2f403abf6804a071f099c8aa10694710de61264a
[strongswan.git] / Source / charon / sa / ike_sa.c
1 /**
2 * @file ike_sa.c
3 *
4 * @brief Implementation of ike_sa_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "ike_sa.h"
24
25 #include <types.h>
26 #include <daemon.h>
27 #include <definitions.h>
28 #include <utils/allocator.h>
29 #include <utils/linked_list.h>
30 #include <utils/logger_manager.h>
31 #include <utils/randomizer.h>
32 #include <transforms/diffie_hellman.h>
33 #include <transforms/prf_plus.h>
34 #include <transforms/crypters/crypter.h>
35 #include <encoding/payloads/sa_payload.h>
36 #include <encoding/payloads/nonce_payload.h>
37 #include <encoding/payloads/ke_payload.h>
38 #include <encoding/payloads/delete_payload.h>
39 #include <encoding/payloads/transform_substructure.h>
40 #include <encoding/payloads/transform_attribute.h>
41 #include <sa/states/initiator_init.h>
42 #include <sa/states/responder_init.h>
43 #include <queues/jobs/retransmit_request_job.h>
44 #include <queues/jobs/delete_established_ike_sa_job.h>
45
46
47
48
49 typedef struct private_ike_sa_t private_ike_sa_t;
50
51 /**
52 * Private data of an ike_sa_t object.
53 */
54 struct private_ike_sa_t {
55
56 /**
57 * Protected part of a ike_sa_t object.
58 */
59 protected_ike_sa_t protected;
60
61 /**
62 * Resends the last sent reply.
63 *
64 * @param this calling object
65 */
66 status_t (*resend_last_reply) (private_ike_sa_t *this);
67
68 /* private values */
69
70 /**
71 * Identifier for the current IKE_SA.
72 */
73 ike_sa_id_t *ike_sa_id;
74
75 /**
76 * Linked List containing the child sa's of the current IKE_SA.
77 */
78 linked_list_t *child_sas;
79
80 /**
81 * Current state of the IKE_SA represented as state_t object.
82 *
83 * A state object representates one of the following states and is processing
84 * messages in the specific state:
85 * - INITIATOR_INIT
86 * - RESPONDER_INIT
87 * - IKE_SA_INIT_REQUESTED
88 * - IKE_SA_INIT_RESPONDED
89 * - IKE_AUTH_REQUESTED
90 * -IKE_SA_ESTABLISHED
91 */
92 state_t *current_state;
93
94 /**
95 * INIT configuration, needed for the IKE_SA_INIT exchange.
96 *
97 * Gets set in states:
98 * - INITATOR_INIT
99 * - RESPONDER_INIT
100 *
101 * Available in states:
102 * - IKE_SA_INIT_REQUESTED
103 * - IKE_SA_INIT_RESPONDED
104 * - IKE_AUTH_REQUESTED
105 * -IKE_SA_ESTABLISHED
106 */
107 init_config_t *init_config;
108
109 /**
110 * SA configuration, needed for all other exchanges after IKE_SA_INIT exchange.
111 *
112 * Gets set in states:
113 * - IKE_SA_INIT_REQUESTED
114 * - IKE_SA_INIT_RESPONDED
115 *
116 * Available in states:
117 * - IKE_AUTH_REQUESTED
118 * -IKE_SA_ESTABLISHED
119 */
120 sa_config_t *sa_config;
121
122 /**
123 * This SA's source for random data.
124 *
125 * Is available in every state.
126 */
127 randomizer_t *randomizer;
128
129 /**
130 * The last responded message.
131 */
132 message_t *last_responded_message;
133
134 /**
135 * The ast requested message.
136 */
137 message_t *last_requested_message;
138
139 /**
140 * Informations of this host.
141 */
142 struct {
143 host_t *host;
144 } me;
145
146 /**
147 * Informations of the other host.
148 */
149 struct {
150 host_t *host;
151 } other;
152
153 /**
154 * Crypter object for initiator.
155 *
156 * Gets set in states:
157 * - IKE_SA_INIT_REQUESTED
158 * - RESPONDER_INIT
159 *
160 * Available in states:
161 * - IKE_SA_INIT_RESPONDED
162 * - IKE_AUTH_REQUESTED
163 * -IKE_SA_ESTABLISHED
164 */
165 crypter_t *crypter_initiator;
166
167 /**
168 * Crypter object for responder.
169 *
170 * Gets set in states:
171 * - IKE_SA_INIT_REQUESTED
172 * - RESPONDER_INIT
173 *
174 * Available in states:
175 * - IKE_SA_INIT_RESPONDED
176 * - IKE_AUTH_REQUESTED
177 * -IKE_SA_ESTABLISHED
178 */
179 crypter_t *crypter_responder;
180
181 /**
182 * Signer object for initiator.
183 *
184 * Gets set in states:
185 * - IKE_SA_INIT_REQUESTED
186 * - RESPONDER_INIT
187 *
188 * Available in states:
189 * - IKE_SA_INIT_RESPONDED
190 * - IKE_AUTH_REQUESTED
191 * -IKE_SA_ESTABLISHED
192 */
193 signer_t *signer_initiator;
194
195 /**
196 * Signer object for responder.
197 *
198 * Gets set in states:
199 * - IKE_SA_INIT_REQUESTED
200 * - RESPONDER_INIT
201 *
202 * Available in states:
203 * - IKE_SA_INIT_RESPONDED
204 * - IKE_AUTH_REQUESTED
205 * -IKE_SA_ESTABLISHED
206 */
207 signer_t *signer_responder;
208
209 /**
210 * Prf function.
211 *
212 * Gets set in states:
213 * - IKE_SA_INIT_REQUESTED
214 * - RESPONDER_INIT
215 *
216 * Available in states:
217 * - IKE_SA_INIT_RESPONDED
218 * - IKE_AUTH_REQUESTED
219 * -IKE_SA_ESTABLISHED
220 */
221 prf_t *prf;
222
223 /**
224 * Prf function for derivating keymat child SAs
225 *
226 * Gets set in states:
227 * - IKE_SA_INIT_REQUESTED
228 * - RESPONDER_INIT
229 *
230 * Available in states:
231 * - IKE_SA_INIT_RESPONDED
232 * - IKE_AUTH_REQUESTED
233 * -IKE_SA_ESTABLISHED
234 */
235 prf_t *child_prf;
236
237 /**
238 * Shared secrets which have to be stored.
239 *
240 * Are getting set in states:
241 * - IKE_SA_INIT_REQUESTED
242 * - RESPONDER_INIT
243 *
244 * Available in states:
245 * - IKE_SA_INIT_RESPONDED
246 * - IKE_AUTH_REQUESTED
247 * -IKE_SA_ESTABLISHED
248 */
249 struct {
250 /**
251 * Key for generating auth payload (initiator)
252 */
253 chunk_t pi_key;
254
255 /**
256 * Key for generating auth payload (responder)
257 */
258 chunk_t pr_key;
259
260 } secrets;
261
262 /**
263 * Next message id to receive.
264 */
265 u_int32_t message_id_in;
266
267 /**
268 * Next message id to send.
269 */
270 u_int32_t message_id_out;
271
272 /**
273 * Last reply id which was successfully received.
274 */
275 int32_t last_replied_message_id;
276
277 /**
278 * A logger for this IKE_SA.
279 */
280 logger_t *logger;
281 };
282
283 /**
284 * Implementation of ike_sa_t.process_message.
285 */
286 static status_t process_message (private_ike_sa_t *this, message_t *message)
287 {
288 u_int32_t message_id;
289 exchange_type_t exchange_type;
290 bool is_request;
291
292 /* We must process each request or response from remote host */
293
294 /* Find out type of message (request or response) */
295 is_request = message->get_request(message);
296 exchange_type = message->get_exchange_type(message);
297
298 this->logger->log(this->logger, CONTROL, "Process %s message of exchange type %s",
299 (is_request) ? "REQUEST" : "RESPONSE",mapping_find(exchange_type_m,exchange_type));
300
301 message_id = message->get_message_id(message);
302
303 /*
304 * It has to be checked, if the message has to be resent cause of lost packets!
305 */
306 if (is_request && (message_id == (this->message_id_in - 1)))
307 {
308 /* Message can be resent ! */
309 this->logger->log(this->logger, CONTROL|LEVEL1, "Resent request detected. Send stored reply.");
310 return (this->resend_last_reply(this));
311 }
312
313 /* Now, the message id is checked for request AND reply */
314 if (is_request)
315 {
316 /* In a request, the message has to be this->message_id_in (other case is already handled) */
317 if (message_id != this->message_id_in)
318 {
319 this->logger->log(this->logger, ERROR | LEVEL1,
320 "Message request with message id %d received, but %d expected",
321 message_id,this->message_id_in);
322 return FAILED;
323 }
324 }
325 else
326 {
327 /* In a reply, the message has to be this->message_id_out -1 cause it is the reply to the last sent message*/
328 if (message_id != (this->message_id_out - 1))
329 {
330 this->logger->log(this->logger, ERROR | LEVEL1,
331 "Message reply with message id %d received, but %d expected",
332 message_id,this->message_id_in);
333 return FAILED;
334 }
335 }
336
337 /* now the message is processed by the current state object.
338 * The specific state object is responsible to check if a message can be received in
339 * the state it represents.
340 * The current state is also responsible to change the state object to the next state
341 * by calling protected_ike_sa_t.set_new_state*/
342 return this->current_state->process_message(this->current_state,message);
343 }
344
345 /**
346 * Implementation of protected_ike_sa_t.build_message.
347 */
348 static void build_message(private_ike_sa_t *this, exchange_type_t type, bool request, message_t **message)
349 {
350 message_t *new_message;
351
352 this->logger->log(this->logger, CONTROL|LEVEL2, "Build empty message");
353 new_message = message_create();
354 new_message->set_source(new_message, this->me.host->clone(this->me.host));
355 new_message->set_destination(new_message, this->other.host->clone(this->other.host));
356 new_message->set_exchange_type(new_message, type);
357 new_message->set_request(new_message, request);
358 new_message->set_message_id(new_message, (request) ? this->message_id_out : this->message_id_in);
359 new_message->set_ike_sa_id(new_message, this->ike_sa_id);
360
361 *message = new_message;
362 }
363
364 /**
365 * Implementation of protected_ike_sa_t.process_configuration.
366 */
367 static status_t initialize_connection(private_ike_sa_t *this, char *name)
368 {
369 initiator_init_t *current_state;
370 status_t status;
371
372 /* Work is done in state object of type INITIATOR_INIT. All other states are not
373 * initial states and so don't have a initialize_connection function */
374
375 if (this->current_state->get_state(this->current_state) != INITIATOR_INIT)
376 {
377 return FAILED;
378 }
379
380 current_state = (initiator_init_t *) this->current_state;
381
382 status = current_state->initiate_connection(current_state,name);
383 return status;
384 }
385
386 /**
387 * Implementation of ike_sa_t.send_delete_ike_sa_request.
388 */
389 static void send_delete_ike_sa_request (private_ike_sa_t *this)
390 {
391 message_t *informational_request;
392 delete_payload_t *delete_payload;
393 crypter_t *crypter;
394 signer_t *signer;
395 packet_t *packet;
396 status_t status;
397
398 if (this->current_state->get_state(this->current_state) != IKE_SA_ESTABLISHED)
399 {
400 return;
401 }
402
403 /* build empty INFORMATIONAL message */
404 this->protected.build_message(&(this->protected), INFORMATIONAL, TRUE, &informational_request);
405
406 delete_payload = delete_payload_create();
407 delete_payload->set_protocol_id(delete_payload,IKE);
408
409 informational_request->add_payload(informational_request,(payload_t *)delete_payload);
410
411 if (this->ike_sa_id->is_initiator(this->ike_sa_id))
412 {
413 crypter = this->crypter_initiator;
414 signer = this->signer_initiator;
415 }
416 else
417 {
418 crypter = this->crypter_responder;
419 signer = this->signer_responder;
420 }
421
422 status = informational_request->generate(informational_request,
423 crypter,
424 signer, &packet);
425 informational_request->destroy(informational_request);
426 if (status != SUCCESS)
427 {
428 this->logger->log(this->logger, ERROR, "Could not generate packet from message");
429 return ;
430 }
431
432 charon->send_queue->add(charon->send_queue,packet);
433 }
434
435 /**
436 * Implementation of protected_ike_sa_t.get_id.
437 */
438 static ike_sa_id_t* get_id(private_ike_sa_t *this)
439 {
440 return this->ike_sa_id;
441 }
442
443 /**
444 * Implementation of protected_ike_sa_t.compute_secrets.
445 */
446 static void compute_secrets(private_ike_sa_t *this,
447 chunk_t dh_shared_secret,
448 chunk_t initiator_nonce,
449 chunk_t responder_nonce)
450 {
451 u_int8_t d_buffer[this->child_prf->get_block_size(this->child_prf)];
452 chunk_t d_key = {ptr: d_buffer, len: sizeof(d_buffer)};
453 u_int8_t ei_buffer[this->crypter_initiator->get_block_size(this->crypter_initiator)];
454 chunk_t ei_key = {ptr: ei_buffer, len: sizeof(ei_buffer)};
455 u_int8_t er_buffer[this->crypter_responder->get_block_size(this->crypter_responder)];
456 chunk_t er_key = {ptr: er_buffer, len: sizeof(er_buffer)};
457 u_int8_t ai_buffer[this->signer_initiator->get_key_size(this->signer_initiator)];
458 chunk_t ai_key = {ptr: ai_buffer, len: sizeof(ai_buffer)};
459 u_int8_t ar_buffer[this->signer_responder->get_key_size(this->signer_responder)];
460 chunk_t ar_key = {ptr: ar_buffer, len: sizeof(ar_buffer)};
461 u_int8_t concatenated_nonces_buffer[initiator_nonce.len + responder_nonce.len];
462 chunk_t concatenated_nonces = {ptr: concatenated_nonces_buffer, len : sizeof(concatenated_nonces_buffer)};
463 u_int8_t skeyseed_buffer[this->prf->get_block_size(this->prf)];
464 chunk_t skeyseed = {ptr: skeyseed_buffer, len: sizeof(skeyseed_buffer)};
465 u_int64_t initiator_spi;
466 u_int64_t responder_spi;
467 chunk_t prf_plus_seed;
468 prf_plus_t *prf_plus;
469
470 /* first is initiator */
471 memcpy(concatenated_nonces.ptr,initiator_nonce.ptr,initiator_nonce.len);
472 /* second is responder */
473 memcpy(concatenated_nonces.ptr + initiator_nonce.len,responder_nonce.ptr,responder_nonce.len);
474
475 this->logger->log_chunk(this->logger, RAW | LEVEL2, "Nonce data", &concatenated_nonces);
476
477 /* Status of set_key is not checked */
478 this->prf->set_key(this->prf,concatenated_nonces);
479
480 this->prf->get_bytes(this->prf,dh_shared_secret,skeyseed_buffer);
481
482 prf_plus_seed.len = (initiator_nonce.len + responder_nonce.len + 16);
483 prf_plus_seed.ptr = allocator_alloc(prf_plus_seed.len);
484
485 /* first is initiator */
486 memcpy(prf_plus_seed.ptr,initiator_nonce.ptr,initiator_nonce.len);
487 /* second is responder */
488 memcpy(prf_plus_seed.ptr + initiator_nonce.len,responder_nonce.ptr,responder_nonce.len);
489 /* third is initiator spi */
490 initiator_spi = this->ike_sa_id->get_initiator_spi(this->ike_sa_id);
491 memcpy(prf_plus_seed.ptr + initiator_nonce.len + responder_nonce.len,&initiator_spi,8);
492 /* fourth is responder spi */
493 responder_spi = this->ike_sa_id->get_responder_spi(this->ike_sa_id);
494 memcpy(prf_plus_seed.ptr + initiator_nonce.len + responder_nonce.len + 8,&responder_spi,8);
495
496 this->logger->log_chunk(this->logger, PRIVATE | LEVEL1, "Keyseed", &skeyseed);
497 this->logger->log_chunk(this->logger, PRIVATE | LEVEL1, "PRF+ Seed", &prf_plus_seed);
498
499 this->logger->log(this->logger, CONTROL | LEVEL2, "Set new key of prf object");
500 this->prf->set_key(this->prf,skeyseed);
501
502 this->logger->log(this->logger, CONTROL | LEVEL2, "Create new prf+ object");
503 prf_plus = prf_plus_create(this->prf, prf_plus_seed);
504 allocator_free_chunk(&prf_plus_seed);
505
506
507 prf_plus->get_bytes(prf_plus,d_key.len,d_buffer);
508 this->logger->log_chunk(this->logger, PRIVATE, "Sk_d secret", &(d_key));
509 this->child_prf->set_key(this->child_prf, d_key);
510
511 prf_plus->get_bytes(prf_plus,ai_key.len,ai_buffer);
512 this->logger->log_chunk(this->logger, PRIVATE, "Sk_ai secret", &(ai_key));
513 this->signer_initiator->set_key(this->signer_initiator,ai_key);
514
515 prf_plus->get_bytes(prf_plus,ar_key.len,ar_buffer);
516 this->logger->log_chunk(this->logger, PRIVATE, "Sk_ar secret", &(ar_key));
517 this->signer_responder->set_key(this->signer_responder,ar_key);
518
519 prf_plus->get_bytes(prf_plus,ei_key.len,ei_buffer);
520 this->logger->log_chunk(this->logger, PRIVATE, "Sk_ei secret", &(ei_key));
521 this->crypter_initiator->set_key(this->crypter_initiator,ei_key);
522
523 prf_plus->get_bytes(prf_plus,er_key.len,er_buffer);
524 this->logger->log_chunk(this->logger, PRIVATE, "Sk_er secret", &(er_key));
525 this->crypter_responder->set_key(this->crypter_responder,er_key);
526
527 prf_plus->allocate_bytes(prf_plus,
528 this->crypter_responder->get_block_size(this->crypter_responder),
529 &(this->secrets.pi_key));
530 this->logger->log_chunk(this->logger, PRIVATE, "Sk_pi secret", &(this->secrets.pi_key));
531
532 prf_plus->allocate_bytes(prf_plus,
533 this->crypter_responder->get_block_size(this->crypter_responder),
534 &(this->secrets.pr_key));
535 this->logger->log_chunk(this->logger, PRIVATE, "Sk_pr secret", &(this->secrets.pr_key));
536
537 prf_plus->destroy(prf_plus);
538 }
539
540 /**
541 * Implementation of private_ike_sa_t.resend_last_reply.
542 */
543 static status_t resend_last_reply(private_ike_sa_t *this)
544 {
545 packet_t *packet;
546
547 this->logger->log(this->logger, CONTROL | LEVEL1, "Going to retransmit last reply");
548 packet = this->last_responded_message->get_packet(this->last_responded_message);
549 charon->send_queue->add(charon->send_queue, packet);
550
551 return SUCCESS;
552 }
553
554 /**
555 * Implementation of ike_sa_t.retransmit_request.
556 */
557 status_t retransmit_request (private_ike_sa_t *this, u_int32_t message_id)
558 {
559 packet_t *packet;
560
561 if (this->last_requested_message == NULL)
562 {
563 return NOT_FOUND;
564 }
565
566 if (message_id == this->last_replied_message_id)
567 {
568 return NOT_FOUND;
569 }
570
571 if ((this->last_requested_message->get_message_id(this->last_requested_message)) != message_id)
572 {
573 return NOT_FOUND;
574 }
575
576 this->logger->log(this->logger, CONTROL | LEVEL1, "Going to retransmit message with id %d",message_id);
577 packet = this->last_requested_message->get_packet(this->last_requested_message);
578 charon->send_queue->add(charon->send_queue, packet);
579
580 return SUCCESS;
581 }
582
583 /**
584 * Implementation of protected_ike_sa_t.set_new_state.
585 */
586 static void set_new_state (private_ike_sa_t *this, state_t *state)
587 {
588 this->logger->log(this->logger, CONTROL, "Change current state %s to %s",
589 mapping_find(ike_sa_state_m,this->current_state->get_state(this->current_state)),
590 mapping_find(ike_sa_state_m,state->get_state(state)));
591 this->current_state = state;
592 }
593
594 /**
595 * Implementation of protected_ike_sa_t.get_logger.
596 */
597 static logger_t *get_logger (private_ike_sa_t *this)
598 {
599 return this->logger;
600 }
601
602 /**
603 * Implementation of protected_ike_sa_t.get_my_host.
604 */
605 static host_t *get_my_host (private_ike_sa_t *this)
606 {
607 return this->me.host;
608 }
609
610 /**
611 * Implementation of protected_ike_sa_t.get_other_host.
612 */
613 static host_t *get_other_host (private_ike_sa_t *this)
614 {
615 return this->other.host;
616 }
617
618 /**
619 * Implementation of protected_ike_sa_t.get_init_config.
620 */
621 static init_config_t *get_init_config (private_ike_sa_t *this)
622 {
623 return this->init_config;
624 }
625
626 /**
627 * Implementation of protected_ike_sa_t.set_init_config.
628 */
629 static void set_init_config (private_ike_sa_t *this,init_config_t * init_config)
630 {
631 this->init_config = init_config;
632 }
633
634 /**
635 * Implementation of protected_ike_sa_t.get_sa_config.
636 */
637 static sa_config_t *get_sa_config (private_ike_sa_t *this)
638 {
639 return this->sa_config;
640 }
641
642 /**
643 * Implementation of protected_ike_sa_t.set_sa_config.
644 */
645 static void set_sa_config (private_ike_sa_t *this,sa_config_t * sa_config)
646 {
647 this->sa_config = sa_config;
648 }
649
650 /**
651 * Implementation of protected_ike_sa_t.set_my_host.
652 */
653 static void set_my_host (private_ike_sa_t *this, host_t *my_host)
654 {
655 this->me.host = my_host;
656 }
657
658 /**
659 * Implementation of protected_ike_sa_t.set_other_host.
660 */
661 static void set_other_host (private_ike_sa_t *this, host_t *other_host)
662 {
663 this->other.host = other_host;
664 }
665
666 /**
667 * Implementation of protected_ike_sa_t.get_prf.
668 */
669 static prf_t *get_prf (private_ike_sa_t *this)
670 {
671 return this->prf;
672 }
673
674 /**
675 * Implementation of protected_ike_sa_t.get_prf.
676 */
677 static prf_t *get_child_prf (private_ike_sa_t *this)
678 {
679 return this->child_prf;
680 }
681
682 /**
683 * Implementation of protected_ike_sa_t.get_key_pr.
684 */
685 static chunk_t get_key_pr (private_ike_sa_t *this)
686 {
687 return this->secrets.pr_key;
688 }
689
690
691 /**
692 * Implementation of protected_ike_sa_t.get_key_pi.
693 */
694 static chunk_t get_key_pi (private_ike_sa_t *this)
695 {
696 return this->secrets.pi_key;
697 }
698
699 /**
700 * Implementation of protected_ike_sa_t.set_prf.
701 */
702 static status_t create_transforms_from_proposal (private_ike_sa_t *this,ike_proposal_t *proposal)
703 {
704 this->logger->log(this->logger, CONTROL|LEVEL2, "Going to create transform objects for proposal");
705
706 this->logger->log(this->logger, CONTROL|LEVEL2, "Encryption algorithm: %s with keylength %d",
707 mapping_find(encryption_algorithm_m,proposal->encryption_algorithm),
708 proposal->encryption_algorithm_key_length);
709 this->logger->log(this->logger, CONTROL|LEVEL2, "Integrity algorithm: %s with keylength %d",
710 mapping_find(integrity_algorithm_m,proposal->integrity_algorithm),
711 proposal->integrity_algorithm_key_length);
712 this->logger->log(this->logger, CONTROL|LEVEL2, "PRF: %s with keylength %d",
713 mapping_find(pseudo_random_function_m,proposal->pseudo_random_function),
714 proposal->pseudo_random_function_key_length);
715
716 if (this->prf != NULL)
717 {
718 this->prf->destroy(this->prf);
719 }
720 this->prf = prf_create(proposal->pseudo_random_function);
721 if (this->prf == NULL)
722 {
723 this->logger->log(this->logger, ERROR|LEVEL1, "PRF %s not supported!",
724 mapping_find(pseudo_random_function_m,proposal->pseudo_random_function));
725 return FAILED;
726 }
727 this->child_prf = prf_create(proposal->pseudo_random_function);
728 if (this->child_prf == NULL)
729 {
730 this->logger->log(this->logger, ERROR|LEVEL1, "PRF %s not supported!",
731 mapping_find(pseudo_random_function_m,proposal->pseudo_random_function));
732 return FAILED;
733 }
734
735 if (this->crypter_initiator != NULL)
736 {
737 this->crypter_initiator->destroy(this->crypter_initiator);
738 }
739 this->crypter_initiator = crypter_create(proposal->encryption_algorithm,
740 proposal->encryption_algorithm_key_length);
741 if (this->crypter_initiator == NULL)
742 {
743 this->logger->log(this->logger, ERROR|LEVEL1, "Encryption algorithm %s not supported!",
744 mapping_find(encryption_algorithm_m,proposal->encryption_algorithm));
745 return FAILED;
746 }
747
748 if (this->crypter_responder != NULL)
749 {
750 this->crypter_responder->destroy(this->crypter_responder);
751 }
752 this->crypter_responder = crypter_create(proposal->encryption_algorithm,
753 proposal->encryption_algorithm_key_length);
754 /* check must not be done again */
755
756 if (this->signer_initiator != NULL)
757 {
758 this->signer_initiator->destroy(this->signer_initiator);
759 }
760 this->signer_initiator = signer_create(proposal->integrity_algorithm);
761 if (this->signer_initiator == NULL)
762 {
763 this->logger->log(this->logger, ERROR|LEVEL1, "Integrity algorithm %s not supported!",
764 mapping_find(integrity_algorithm_m,proposal->integrity_algorithm));
765 return FAILED;
766 }
767
768 if (this->signer_responder != NULL)
769 {
770 this->signer_responder->destroy(this->signer_responder);
771 }
772 this->signer_responder = signer_create(proposal->integrity_algorithm);
773
774 return SUCCESS;
775 }
776
777 /**
778 * Implementation of protected_ike_sa_t.get_randomizer.
779 */
780 static randomizer_t *get_randomizer (private_ike_sa_t *this)
781 {
782 return this->randomizer;
783 }
784
785 /**
786 * Implementation of protected_ike_sa_t.get_crypter_initiator.
787 */
788 static crypter_t *get_crypter_initiator (private_ike_sa_t *this)
789 {
790 return this->crypter_initiator;
791 }
792
793 /**
794 * Implementation of protected_ike_sa_t.get_signer_initiator.
795 */
796 static signer_t *get_signer_initiator (private_ike_sa_t *this)
797 {
798 return this->signer_initiator;
799 }
800
801 /**
802 * Implementation of protected_ike_sa_t.get_crypter_responder.
803 */
804 static crypter_t *get_crypter_responder(private_ike_sa_t *this)
805 {
806 return this->crypter_responder;
807 }
808
809 /**
810 * Implementation of protected_ike_sa_t.get_signer_responder.
811 */
812 static signer_t *get_signer_responder (private_ike_sa_t *this)
813 {
814 return this->signer_responder;
815 }
816
817 /**
818 * Implementation of protected_ike_sa_t.send_request.
819 */
820 static status_t send_request (private_ike_sa_t *this,message_t * message)
821 {
822 retransmit_request_job_t *retransmit_job;
823 u_int32_t timeout;
824 crypter_t *crypter;
825 signer_t *signer;
826 packet_t *packet;
827 status_t status;
828
829 if (message->get_message_id(message) != this->message_id_out)
830 {
831 this->logger->log(this->logger, ERROR, "Message could not be sent cause id (%d) was not as expected (%d)",
832 message->get_message_id(message),this->message_id_out);
833 return FAILED;
834 }
835
836 /* generate packet */
837 this->logger->log(this->logger, CONTROL|LEVEL2, "Generate packet from message");
838
839 if (this->ike_sa_id->is_initiator(this->ike_sa_id))
840 {
841 crypter = this->crypter_initiator;
842 signer = this->signer_initiator;
843 }
844 else
845 {
846 crypter = this->crypter_responder;
847 signer =this->signer_responder;
848 }
849
850 status = message->generate(message, crypter,signer, &packet);
851 if (status != SUCCESS)
852 {
853 this->logger->log(this->logger, ERROR, "Could not generate packet from message");
854 return FAILED;
855 }
856
857 this->logger->log(this->logger, CONTROL|LEVEL3,
858 "Add request packet with message id %d to global send queue",
859 this->message_id_out);
860 charon->send_queue->add(charon->send_queue, packet);
861
862 if (this->last_requested_message != NULL)
863 {
864 /* destroy message */
865 this->last_requested_message->destroy(this->last_requested_message);
866 }
867
868 this->logger->log(this->logger, CONTROL|LEVEL3, "Replace last requested message with new one");
869 this->last_requested_message = message;
870
871 retransmit_job = retransmit_request_job_create(this->message_id_out,this->ike_sa_id);
872
873 status = charon->configuration_manager->get_retransmit_timeout (charon->configuration_manager,
874 retransmit_job->get_retransmit_count(retransmit_job),&timeout);
875
876 if (status != SUCCESS)
877 {
878 this->logger->log(this->logger, CONTROL|LEVEL2, "No retransmit job for message created!");
879 retransmit_job->destroy(retransmit_job);
880 }
881 else
882 {
883 this->logger->log(this->logger, CONTROL|LEVEL2, "Request will be retransmitted in %d ms.",timeout);
884 charon->event_queue->add_relative(charon->event_queue,(job_t *) retransmit_job,timeout);
885 }
886
887 /* message counter can now be increased */
888 this->logger->log(this->logger, CONTROL|LEVEL3,
889 "Increase message counter for outgoing messages from %d",
890 this->message_id_out);
891 this->message_id_out++;
892 return SUCCESS;
893 }
894
895 /**
896 * Implementation of protected_ike_sa_t.send_response.
897 */
898 static status_t send_response (private_ike_sa_t *this,message_t * message)
899 {
900 crypter_t *crypter;
901 signer_t *signer;
902 packet_t *packet;
903 status_t status;
904
905 if (message->get_message_id(message) != this->message_id_in)
906 {
907 this->logger->log(this->logger, ERROR, "Message could not be sent cause id was not as expected");
908 return FAILED;
909 }
910
911
912 if (this->ike_sa_id->is_initiator(this->ike_sa_id))
913 {
914 crypter = this->crypter_initiator;
915 signer = this->signer_initiator;
916 }
917 else
918 {
919 crypter = this->crypter_responder;
920 signer =this->signer_responder;
921 }
922
923 status = message->generate(message, crypter,signer, &packet);
924 if (status != SUCCESS)
925 {
926 this->logger->log(this->logger, ERROR, "Could not generate packet from message");
927 return FAILED;
928 }
929
930 this->logger->log(this->logger, CONTROL|LEVEL3,
931 "Add response packet with message id %d to global send queue",
932 this->message_id_in);
933 charon->send_queue->add(charon->send_queue, packet);
934
935 if (this->last_responded_message != NULL)
936 {
937 /* destroy message */
938 this->last_responded_message->destroy(this->last_responded_message);
939 }
940
941 this->logger->log(this->logger, CONTROL|LEVEL3, "Replace last responded message with new one");
942 this->last_responded_message = message;
943
944 /* message counter can now be increased */
945 this->logger->log(this->logger, CONTROL|LEVEL3, "Increase message counter for incoming messages");
946 this->message_id_in++;
947
948 return SUCCESS;
949 }
950
951 /**
952 * Implementation of of private_responder_init_t.send_notify_reply.
953 */
954 static void send_notify(private_ike_sa_t *this, exchange_type_t exchange_type, notify_message_type_t type, chunk_t data)
955 {
956 notify_payload_t *payload;
957 message_t *response;
958 packet_t *packet;
959 status_t status;
960
961 this->logger->log(this->logger, CONTROL|LEVEL2, "Going to build message with notify payload");
962 /* set up the reply */
963 this->protected.build_message(&(this->protected), exchange_type, FALSE, &response);
964 payload = notify_payload_create_from_protocol_and_type(IKE,type);
965 if ((data.ptr != NULL) && (data.len > 0))
966 {
967 this->logger->log(this->logger, CONTROL|LEVEL2, "Add Data to notify payload");
968 payload->set_notification_data(payload,data);
969 }
970
971 this->logger->log(this->logger, CONTROL|LEVEL2, "Add Notify payload to message");
972 response->add_payload(response,(payload_t *) payload);
973
974 /* generate packet */
975 this->logger->log(this->logger, CONTROL|LEVEL2, "Generate packet from message");
976 status = response->generate(response, this->crypter_responder, this->signer_responder, &packet);
977 if (status != SUCCESS)
978 {
979 this->logger->log(this->logger, ERROR|LEVEL1, "Could not generate notify message");
980 response->destroy(response);
981 return;
982 }
983
984 this->logger->log(this->logger, CONTROL|LEVEL2, "Add packet to global send queue");
985 charon->send_queue->add(charon->send_queue, packet);
986 this->logger->log(this->logger, CONTROL|LEVEL2, "Destroy message");
987 response->destroy(response);
988 }
989
990 /**
991 * Implementation of protected_ike_sa_t.set_last_replied_message_id.
992 */
993 static void set_last_replied_message_id (private_ike_sa_t *this,u_int32_t message_id)
994 {
995 this->last_replied_message_id = message_id;
996 }
997
998 /**
999 * Implementation of protected_ike_sa_t.get_last_responded_message.
1000 */
1001 static message_t * get_last_responded_message (private_ike_sa_t *this)
1002 {
1003 return this->last_responded_message;
1004 }
1005
1006 /**
1007 * Implementation of protected_ike_sa_t.get_last_requested_message.
1008 */
1009 static message_t * get_last_requested_message (private_ike_sa_t *this)
1010 {
1011 return this->last_requested_message;
1012 }
1013
1014 /**
1015 * Implementation of protected_ike_sa_t.get_state.
1016 */
1017 static ike_sa_state_t get_state (private_ike_sa_t *this)
1018 {
1019 return this->current_state->get_state(this->current_state);
1020 }
1021
1022 /**
1023 * Implementation of protected_ike_sa_t.reset_message_buffers.
1024 */
1025 static void reset_message_buffers (private_ike_sa_t *this)
1026 {
1027 this->logger->log(this->logger, CONTROL|LEVEL2, "Reset message counters and destroy stored messages");
1028 /* destroy stored requested message */
1029 if (this->last_requested_message != NULL)
1030 {
1031 this->last_requested_message->destroy(this->last_requested_message);
1032 this->last_requested_message = NULL;
1033 }
1034
1035 /* destroy stored responded messages */
1036 if (this->last_responded_message != NULL)
1037 {
1038 this->last_responded_message->destroy(this->last_responded_message);
1039 this->last_responded_message = NULL;
1040 }
1041
1042 this->message_id_out = 0;
1043 this->message_id_in = 0;
1044 this->last_replied_message_id = -1;
1045 }
1046
1047 /**
1048 * Implementation of protected_ike_sa_t.create_delete_established_ike_sa_job.
1049 */
1050 static void create_delete_established_ike_sa_job (private_ike_sa_t *this,u_int32_t timeout)
1051 {
1052 job_t *delete_job;
1053
1054 this->logger->log(this->logger, CONTROL | LEVEL1,
1055 "Going to create job to delete established IKE_SA in %d ms",
1056 timeout);
1057
1058 delete_job = (job_t *) delete_established_ike_sa_job_create(this->ike_sa_id);
1059 charon->event_queue->add_relative(charon->event_queue,delete_job, timeout);
1060 }
1061
1062 /**
1063 * Implementation of protected_ike_sa_t.destroy.
1064 */
1065 static void destroy (private_ike_sa_t *this)
1066 {
1067 this->logger->log(this->logger, CONTROL|LEVEL2, "Going to destroy IKE SA %llu:%llu, role %s",
1068 this->ike_sa_id->get_initiator_spi(this->ike_sa_id),
1069 this->ike_sa_id->get_responder_spi(this->ike_sa_id),
1070 this->ike_sa_id->is_initiator(this->ike_sa_id) ? "initiator" : "responder");
1071
1072 /* destroy child sa's */
1073 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy all child_sa's");
1074 while (this->child_sas->get_count(this->child_sas) > 0)
1075 {
1076 void *child_sa;
1077 if (this->child_sas->remove_first(this->child_sas, &child_sa) != SUCCESS)
1078 {
1079 break;
1080 }
1081 /* destroy child sa */
1082 }
1083 this->child_sas->destroy(this->child_sas);
1084
1085 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy secrets");
1086 allocator_free(this->secrets.pi_key.ptr);
1087 allocator_free(this->secrets.pr_key.ptr);
1088
1089 if (this->crypter_initiator != NULL)
1090 {
1091 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy initiator crypter_t object");
1092 this->crypter_initiator->destroy(this->crypter_initiator);
1093 }
1094
1095 if (this->crypter_responder != NULL)
1096 {
1097 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy responder crypter_t object");
1098 this->crypter_responder->destroy(this->crypter_responder);
1099 }
1100
1101 if (this->signer_initiator != NULL)
1102 {
1103 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy initiator signer_t object");
1104 this->signer_initiator->destroy(this->signer_initiator);
1105 }
1106
1107 if (this->signer_responder != NULL)
1108 {
1109 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy responder signer_t object");
1110 this->signer_responder->destroy(this->signer_responder);
1111 }
1112
1113 if (this->prf != NULL)
1114 {
1115 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy prf_t object");
1116 this->prf->destroy(this->prf);
1117 }
1118 if (this->child_prf != NULL)
1119 {
1120 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy child_prf object");
1121 this->child_prf->destroy(this->child_prf);
1122 }
1123
1124 /* destroy ike_sa_id */
1125 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy ike_sa_id object");
1126 this->ike_sa_id->destroy(this->ike_sa_id);
1127
1128 /* destroy stored requested message */
1129 if (this->last_requested_message != NULL)
1130 {
1131 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy last requested message");
1132 this->last_requested_message->destroy(this->last_requested_message);
1133 }
1134
1135 /* destroy stored responded messages */
1136 if (this->last_responded_message != NULL)
1137 {
1138 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy last responded message");
1139 this->last_responded_message->destroy(this->last_responded_message);
1140 }
1141
1142 /* destroy stored host_t objects */
1143 if (this->me.host != NULL)
1144 {
1145 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy my host_t object");
1146 this->me.host->destroy(this->me.host);
1147 }
1148
1149 /* destroy stored host_t objects */
1150 if (this->other.host != NULL)
1151 {
1152 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy other host_t object");
1153 this->other.host->destroy(this->other.host);
1154 }
1155
1156 this->randomizer->destroy(this->randomizer);
1157
1158 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy current state object");
1159 this->current_state->destroy(this->current_state);
1160
1161 this->logger->log(this->logger, CONTROL | LEVEL3, "Destroy logger of IKE_SA");
1162 charon->logger_manager->destroy_logger(charon->logger_manager, this->logger);
1163
1164 allocator_free(this);
1165 }
1166
1167 /*
1168 * Described in header.
1169 */
1170 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
1171 {
1172 private_ike_sa_t *this = allocator_alloc_thing(private_ike_sa_t);
1173
1174 /* Public functions */
1175 this->protected.public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
1176 this->protected.public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
1177 this->protected.public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
1178 this->protected.public.retransmit_request = (status_t (*) (ike_sa_t *, u_int32_t)) retransmit_request;
1179 this->protected.public.get_state = (ike_sa_state_t (*) (ike_sa_t *this)) get_state;
1180 this->protected.public.send_delete_ike_sa_request = (void (*)(ike_sa_t*)) send_delete_ike_sa_request;
1181 this->protected.public.destroy = (void(*)(ike_sa_t*))destroy;
1182
1183 /* protected functions */
1184 this->protected.build_message = (void (*) (protected_ike_sa_t *, exchange_type_t , bool , message_t **)) build_message;
1185 this->protected.compute_secrets = (void (*) (protected_ike_sa_t *,chunk_t ,chunk_t , chunk_t )) compute_secrets;
1186 this->protected.get_prf = (prf_t *(*) (protected_ike_sa_t *)) get_prf;
1187 this->protected.get_child_prf = (prf_t *(*) (protected_ike_sa_t *)) get_child_prf;
1188 this->protected.get_key_pr = (chunk_t (*) (protected_ike_sa_t *)) get_key_pr;
1189 this->protected.get_key_pi = (chunk_t (*) (protected_ike_sa_t *)) get_key_pi;
1190 this->protected.get_logger = (logger_t *(*) (protected_ike_sa_t *)) get_logger;
1191 this->protected.set_init_config = (void (*) (protected_ike_sa_t *,init_config_t *)) set_init_config;
1192 this->protected.get_init_config = (init_config_t *(*) (protected_ike_sa_t *)) get_init_config;
1193 this->protected.set_sa_config = (void (*) (protected_ike_sa_t *,sa_config_t *)) set_sa_config;
1194 this->protected.get_sa_config = (sa_config_t *(*) (protected_ike_sa_t *)) get_sa_config;
1195 this->protected.get_my_host = (host_t *(*) (protected_ike_sa_t *)) get_my_host;
1196 this->protected.get_other_host = (host_t *(*) (protected_ike_sa_t *)) get_other_host;
1197 this->protected.set_my_host = (void(*) (protected_ike_sa_t *,host_t *)) set_my_host;
1198 this->protected.set_other_host = (void(*) (protected_ike_sa_t *, host_t *)) set_other_host;
1199 this->protected.get_randomizer = (randomizer_t *(*) (protected_ike_sa_t *)) get_randomizer;
1200 this->protected.send_request = (status_t (*) (protected_ike_sa_t *,message_t *)) send_request;
1201 this->protected.send_response = (status_t (*) (protected_ike_sa_t *,message_t *)) send_response;
1202 this->protected.send_notify = (void (*)(protected_ike_sa_t*,exchange_type_t,notify_message_type_t,chunk_t)) send_notify;
1203 this->protected.create_transforms_from_proposal = (status_t (*) (protected_ike_sa_t *,ike_proposal_t *)) create_transforms_from_proposal;
1204 this->protected.set_new_state = (void (*) (protected_ike_sa_t *,state_t *)) set_new_state;
1205 this->protected.get_crypter_initiator = (crypter_t *(*) (protected_ike_sa_t *)) get_crypter_initiator;
1206 this->protected.get_signer_initiator = (signer_t *(*) (protected_ike_sa_t *)) get_signer_initiator;
1207 this->protected.get_crypter_responder = (crypter_t *(*) (protected_ike_sa_t *)) get_crypter_responder;
1208 this->protected.get_signer_responder = (signer_t *(*) (protected_ike_sa_t *)) get_signer_responder;
1209 this->protected.reset_message_buffers = (void (*) (protected_ike_sa_t *)) reset_message_buffers;
1210 this->protected.get_last_responded_message = (message_t * (*) (protected_ike_sa_t *this)) get_last_responded_message;
1211 this->protected.get_last_requested_message = (message_t * (*) (protected_ike_sa_t *this)) get_last_requested_message;
1212 this->protected.create_delete_established_ike_sa_job = (void (*) (protected_ike_sa_t *this,u_int32_t)) create_delete_established_ike_sa_job;
1213
1214 this->protected.set_last_replied_message_id = (void (*) (protected_ike_sa_t *,u_int32_t)) set_last_replied_message_id;
1215
1216 /* private functions */
1217 this->resend_last_reply = resend_last_reply;
1218
1219 /* initialize private fields */
1220 this->logger = charon->logger_manager->create_logger(charon->logger_manager, IKE_SA, NULL);
1221
1222 this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
1223 this->child_sas = linked_list_create();
1224 this->randomizer = randomizer_create();
1225
1226 this->me.host = NULL;
1227 this->other.host = NULL;
1228 this->last_requested_message = NULL;
1229 this->last_responded_message = NULL;
1230 this->message_id_out = 0;
1231 this->message_id_in = 0;
1232 this->last_replied_message_id = -1;
1233 this->secrets.pi_key = CHUNK_INITIALIZER;
1234 this->secrets.pr_key = CHUNK_INITIALIZER;
1235 this->crypter_initiator = NULL;
1236 this->crypter_responder = NULL;
1237 this->signer_initiator = NULL;
1238 this->signer_responder = NULL;
1239 this->prf = NULL;
1240 this->child_prf = NULL;
1241 this->init_config = NULL;
1242 this->sa_config = NULL;
1243
1244 /* at creation time, IKE_SA is in a initiator state */
1245 if (ike_sa_id->is_initiator(ike_sa_id))
1246 {
1247 this->logger->log(this->logger, CONTROL | LEVEL2, "Create first state_t object of type INITIATOR_INIT");
1248 this->current_state = (state_t *) initiator_init_create(&(this->protected));
1249 }
1250 else
1251 {
1252 this->logger->log(this->logger, CONTROL | LEVEL2, "Create first state_t object of type RESPONDER_INIT");
1253 this->current_state = (state_t *) responder_init_create(&(this->protected));
1254 }
1255 return &(this->protected.public);
1256 }