- fixed policy setup bug
[strongswan.git] / Source / charon / sa / states / ike_auth_requested.c
1 /**
2 * @file ike_auth_requested.c
3 *
4 * @brief Implementation of ike_auth_requested_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "ike_auth_requested.h"
24
25 #include <daemon.h>
26 #include <utils/allocator.h>
27 #include <encoding/payloads/ts_payload.h>
28 #include <encoding/payloads/sa_payload.h>
29 #include <encoding/payloads/id_payload.h>
30 #include <encoding/payloads/auth_payload.h>
31 #include <encoding/payloads/notify_payload.h>
32 #include <transforms/signers/signer.h>
33 #include <transforms/crypters/crypter.h>
34 #include <sa/states/ike_sa_established.h>
35 #include <sa/authenticator.h>
36 #include <sa/child_sa.h>
37
38 typedef struct private_ike_auth_requested_t private_ike_auth_requested_t;
39
40 /**
41 * Private data of a ike_auth_requested_t object.
42 *
43 */
44 struct private_ike_auth_requested_t {
45 /**
46 * Public interface of ike_auth_requested_t.
47 */
48 ike_auth_requested_t public;
49
50 /**
51 * Assigned IKE_SA.
52 */
53 protected_ike_sa_t *ike_sa;
54
55 /**
56 * SA config, just a copy of the one stored in the ike_sa.
57 */
58 sa_config_t *sa_config;
59
60 /**
61 * Received nonce from responder.
62 */
63 chunk_t received_nonce;
64
65 /**
66 * Sent nonce in IKE_SA_INIT request.
67 */
68 chunk_t sent_nonce;
69
70 /**
71 * IKE_SA_INIT-Request in binary form.
72 */
73 chunk_t ike_sa_init_reply_data;
74
75 /**
76 * Proposal to setup CHILD_SA
77 */
78 proposal_t *proposal;
79
80 /**
81 * Traffic selectors applicable at our site
82 */
83 linked_list_t *my_ts;
84
85 /**
86 * Traffic selectors applicable at remote site
87 */
88 linked_list_t *other_ts;
89
90 /**
91 * Child sa created in ike_sa_init_requested
92 */
93 child_sa_t *child_sa;
94
95 /**
96 * Assigned Logger.
97 *
98 * Is logger of ike_sa!
99 */
100 logger_t *logger;
101
102 /**
103 * Process the IDr payload (check if other id is valid)
104 *
105 * @param this calling object
106 * @param idr_payload ID payload of responder
107 * @return
108 * - SUCCESS
109 * - DELETE_ME
110 */
111 status_t (*process_idr_payload) (private_ike_auth_requested_t *this, id_payload_t *idr_payload);
112
113 /**
114 * Process the SA payload (check if selected proposals are valid, setup child sa)
115 *
116 * @param this calling object
117 * @param sa_payload SA payload of responder
118 *
119 * - SUCCESS
120 * - DELETE_ME
121 */
122 status_t (*process_sa_payload) (private_ike_auth_requested_t *this, sa_payload_t *sa_payload);
123
124 /**
125 * Process the AUTH payload (check authenticity of message)
126 *
127 * @param this calling object
128 * @param auth_payload AUTH payload of responder
129 * @param other_id_payload ID payload of responder
130 *
131 * - SUCCESS
132 * - DELETE_ME
133 */
134 status_t (*process_auth_payload) (private_ike_auth_requested_t *this, auth_payload_t *auth_payload, id_payload_t *other_id_payload);
135
136 /**
137 * Process the TS payload (check if selected traffic selectors are valid)
138 *
139 * @param this calling object
140 * @param ts_initiator TRUE if TS payload is TSi, FALSE for TSr
141 * @param ts_payload TS payload of responder
142 *
143 * - SUCCESS
144 * - DELETE_ME
145 */
146 status_t (*process_ts_payload) (private_ike_auth_requested_t *this, bool ts_initiator, ts_payload_t *ts_payload);
147
148 /**
149 * Process a notify payload
150 *
151 * @param this calling object
152 * @param notify_payload notify payload
153 *
154 * - SUCCESS
155 * - FAILED
156 * - DELETE_ME
157 */
158 status_t (*process_notify_payload) (private_ike_auth_requested_t *this, notify_payload_t *notify_payload);
159
160 /**
161 * Destroy function called internally of this class after state change to
162 * state IKE_SA_ESTABLISHED succeeded.
163 *
164 * This destroy function does not destroy objects which were passed to the new state.
165 *
166 * @param this calling object
167 */
168 void (*destroy_after_state_change) (private_ike_auth_requested_t *this);
169 };
170
171
172 /**
173 * Implements state_t.process_message
174 */
175 static status_t process_message(private_ike_auth_requested_t *this, message_t *ike_auth_reply)
176 {
177 ts_payload_t *tsi_payload = NULL, *tsr_payload = NULL;
178 id_payload_t *idr_payload = NULL;
179 auth_payload_t *auth_payload = NULL;
180 sa_payload_t *sa_payload = NULL;
181 iterator_t *payloads = NULL;
182 crypter_t *crypter = NULL;
183 signer_t *signer = NULL;
184 status_t status;
185 host_t *my_host, *other_host;
186 chunk_t seed;
187 prf_plus_t *prf_plus;
188
189 if (ike_auth_reply->get_exchange_type(ike_auth_reply) != IKE_AUTH)
190 {
191 this->logger->log(this->logger, ERROR | LEVEL1, "Message of type %s not supported in state ike_auth_requested",
192 mapping_find(exchange_type_m,ike_auth_reply->get_exchange_type(ike_auth_reply)));
193 return FAILED;
194 }
195
196 if (ike_auth_reply->get_request(ike_auth_reply))
197 {
198 this->logger->log(this->logger, ERROR | LEVEL1, "IKE_AUTH requests not allowed state ike_sa_init_responded");
199 return FAILED;
200 }
201
202 /* get signer for verification and crypter for decryption */
203 signer = this->ike_sa->get_signer_responder(this->ike_sa);
204 crypter = this->ike_sa->get_crypter_responder(this->ike_sa);
205
206 /* parse incoming message */
207 status = ike_auth_reply->parse_body(ike_auth_reply, crypter, signer);
208 if (status != SUCCESS)
209 {
210 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply decryption failed. Ignoring message");
211 return status;
212 }
213
214 this->sa_config = this->ike_sa->get_sa_config(this->ike_sa);
215
216 /* we collect all payloads, which are processed later. Notify's are processed
217 * in place, since we don't know how may are there.
218 */
219 payloads = ike_auth_reply->get_payload_iterator(ike_auth_reply);
220 while (payloads->has_next(payloads))
221 {
222 payload_t *payload;
223 payloads->current(payloads, (void**)&payload);
224
225 switch (payload->get_type(payload))
226 {
227 case AUTHENTICATION:
228 {
229 auth_payload = (auth_payload_t*)payload;
230 break;
231 }
232 case ID_RESPONDER:
233 {
234 idr_payload = (id_payload_t*)payload;
235 break;
236 }
237 case SECURITY_ASSOCIATION:
238 {
239 sa_payload = (sa_payload_t*)payload;
240 break;
241 }
242 case TRAFFIC_SELECTOR_INITIATOR:
243 {
244 tsi_payload = (ts_payload_t*)payload;
245 break;
246 }
247 case TRAFFIC_SELECTOR_RESPONDER:
248 {
249 tsr_payload = (ts_payload_t*)payload;
250 break;
251 }
252 case NOTIFY:
253 {
254 notify_payload_t *notify_payload = (notify_payload_t *) payload;
255 /* handle the notify directly, abort if no further processing required */
256 status = this->process_notify_payload(this, notify_payload);
257 if (status != SUCCESS)
258 {
259 payloads->destroy(payloads);
260 return status;
261 }
262 }
263 case CERTIFICATE:
264 {
265 /* TODO handle cert payloads */
266 }
267 default:
268 {
269 this->logger->log(this->logger, ERROR|LEVEL1, "Ignoring Payload %s (%d)",
270 mapping_find(payload_type_m, payload->get_type(payload)), payload->get_type(payload));
271 break;
272 }
273 }
274 }
275 /* iterator can be destroyed */
276 payloads->destroy(payloads);
277
278 /* check if we have all payloads */
279 if (!(idr_payload && sa_payload && auth_payload && tsi_payload && tsr_payload))
280 {
281 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply did not contain all required payloads. Deleting IKE_SA");
282 return DELETE_ME;
283 }
284
285 /* process all payloads */
286 status = this->process_idr_payload(this, idr_payload);
287 if (status != SUCCESS)
288 {
289 return status;
290 }
291 status = this->process_auth_payload(this, auth_payload,idr_payload);
292 if (status != SUCCESS)
293 {
294 return status;
295 }
296 status = this->process_sa_payload(this, sa_payload);
297 if (status != SUCCESS)
298 {
299 return status;
300 }
301 status = this->process_ts_payload(this, TRUE, tsi_payload);
302 if (status != SUCCESS)
303 {
304 return status;
305 }
306 status = this->process_ts_payload(this, FALSE, tsr_payload);
307 if (status != SUCCESS)
308 {
309 return status;
310 }
311
312 /* install child SAs for AH and esp */
313 if (!this->child_sa)
314 {
315 this->logger->log(this->logger, CONTROL, "No CHILD_SA requested, no CHILD_SA built");
316 }
317 if (!this->proposal)
318 {
319 this->logger->log(this->logger, CONTROL, "Proposal negotiation failed, no CHILD_SA built");
320 }
321 else if (this->my_ts->get_count(this->my_ts) == 0 || this->other_ts->get_count(this->other_ts) == 0)
322 {
323 this->logger->log(this->logger, CONTROL, "Traffic selector negotiation failed, no CHILD_SA built");
324 }
325 else
326 {
327 seed = allocator_alloc_as_chunk(this->sent_nonce.len + this->received_nonce.len);
328 memcpy(seed.ptr, this->sent_nonce.ptr, this->sent_nonce.len);
329 memcpy(seed.ptr + this->sent_nonce.len, this->received_nonce.ptr, this->received_nonce.len);
330 prf_plus = prf_plus_create(this->ike_sa->get_child_prf(this->ike_sa), seed);
331 allocator_free_chunk(&seed);
332
333 status = this->child_sa->update(this->child_sa, this->proposal, prf_plus);
334 prf_plus->destroy(prf_plus);
335 if (status != SUCCESS)
336 {
337 this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA! Deleting IKE_SA");
338 return DELETE_ME;
339 }
340 status = this->child_sa->add_policy(this->child_sa, this->my_ts, this->other_ts);
341 if (status != SUCCESS)
342 {
343 this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA policy! Deleting IKE_SA");
344 return DELETE_ME;
345 }
346 this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
347 }
348
349 this->ike_sa->set_last_replied_message_id(this->ike_sa,ike_auth_reply->get_message_id(ike_auth_reply));
350 /* create new state */
351 my_host = this->ike_sa->get_my_host(this->ike_sa);
352 other_host = this->ike_sa->get_other_host(this->ike_sa);
353 this->logger->log(this->logger, AUDIT, "IKE_SA established between %s - %s, authenticated peer with %s",
354 my_host->get_address(my_host), other_host->get_address(other_host),
355 mapping_find(auth_method_m, auth_payload->get_auth_method(auth_payload)));
356
357 this->ike_sa->create_delete_established_ike_sa_job(this->ike_sa,this->sa_config->get_ike_sa_lifetime(this->sa_config));
358 this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
359 this->destroy_after_state_change(this);
360 return SUCCESS;
361 }
362
363 /**
364 * Implements private_ike_auth_requested_t.process_idr_payload
365 */
366 static status_t process_idr_payload(private_ike_auth_requested_t *this, id_payload_t *idr_payload)
367 {
368 identification_t *other_id, *configured_other_id;
369
370 other_id = idr_payload->get_identification(idr_payload);
371
372 configured_other_id = this->sa_config->get_other_id(this->sa_config);
373 if (configured_other_id)
374 {
375 this->logger->log(this->logger, CONTROL|LEVEL1, "configured ID: %s, ID of responder: %s",
376 configured_other_id->get_string(configured_other_id),
377 other_id->get_string(other_id));
378
379 if (!other_id->equals(other_id, configured_other_id))
380 {
381 other_id->destroy(other_id);
382 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained a not requested ID. Deleting IKE_SA");
383 return DELETE_ME;
384 }
385 }
386
387 other_id->destroy(other_id);
388 /* TODO do we have to store other_id somewhere ? */
389 return SUCCESS;
390 }
391
392 /**
393 * Implements private_ike_auth_requested_t.process_sa_payload
394 */
395 static status_t process_sa_payload(private_ike_auth_requested_t *this, sa_payload_t *sa_payload)
396 {
397 proposal_t *proposal, *proposal_tmp;
398 linked_list_t *proposal_list;
399
400 /* get his selected proposal */
401 proposal_list = sa_payload->get_proposals(sa_payload);
402 /* check count of proposals */
403 if (proposal_list->get_count(proposal_list) == 0)
404 {
405 /* no proposal? we accept this, but no child sa is built */
406 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply's SA_PAYLOAD didn't contain any proposals. No CHILD_SA created",
407 proposal_list->get_count(proposal_list));
408 proposal_list->destroy(proposal_list);
409 return SUCCESS;
410 }
411 if (proposal_list->get_count(proposal_list) > 1)
412 {
413 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply's SA_PAYLOAD contained %d proposal. Deleting IKE_SA",
414 proposal_list->get_count(proposal_list));
415 while (proposal_list->remove_last(proposal_list, (void**)&proposal) == SUCCESS)
416 {
417 proposal->destroy(proposal);
418 }
419 proposal_list->destroy(proposal_list);
420 return DELETE_ME;
421 }
422
423 /* we have to re-check here if other's selection is valid */
424 proposal = this->sa_config->select_proposal(this->sa_config, proposal_list);
425 /* list not needed anymore */
426 while (proposal_list->remove_last(proposal_list, (void**)&proposal_tmp) == SUCCESS)
427 {
428 proposal_tmp->destroy(proposal_tmp);
429 }
430 proposal_list->destroy(proposal_list);
431 /* got a match? */
432 if (proposal == NULL)
433 {
434 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained a not offered proposal. Deleting IKE_SA");
435 return DELETE_ME;
436 }
437
438 /* apply proposal */
439 this->proposal = proposal;
440
441 return SUCCESS;
442 }
443
444 /**
445 * Implements private_ike_auth_requested_t.process_auth_payload
446 */
447 static status_t process_auth_payload(private_ike_auth_requested_t *this, auth_payload_t *auth_payload, id_payload_t *other_id_payload)
448 {
449 authenticator_t *authenticator;
450 status_t status;
451
452 authenticator = authenticator_create(this->ike_sa);
453 status = authenticator->verify_auth_data(authenticator,auth_payload,this->ike_sa_init_reply_data,this->sent_nonce,other_id_payload,FALSE);
454 authenticator->destroy(authenticator);
455 if (status != SUCCESS)
456 {
457 this->logger->log(this->logger, AUDIT, "Verification of IKE_AUTH reply failed. Deleting IKE_SA");
458 return DELETE_ME;
459 }
460
461 this->logger->log(this->logger, CONTROL|LEVEL1, "AUTH data verified successfully");
462 return SUCCESS;
463 }
464
465 /**
466 * Implements private_ike_auth_requested_t.process_ts_payload
467 */
468 static status_t process_ts_payload(private_ike_auth_requested_t *this, bool ts_initiator, ts_payload_t *ts_payload)
469 {
470 linked_list_t *ts_received, *ts_selected;
471 traffic_selector_t *ts;
472
473 /* get ts form payload */
474 ts_received = ts_payload->get_traffic_selectors(ts_payload);
475 /* select ts depending on payload type */
476 if (ts_initiator)
477 {
478 ts_selected = this->sa_config->select_my_traffic_selectors(this->sa_config, ts_received);
479 this->my_ts = ts_selected;
480 }
481 else
482 {
483 ts_selected = this->sa_config->select_other_traffic_selectors(this->sa_config, ts_received);
484 this->other_ts = ts_selected;
485 }
486 /* check if the responder selected valid proposals */
487 if (ts_selected->get_count(ts_selected) != ts_received->get_count(ts_received))
488 {
489 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained not offered traffic selectors.");
490 }
491
492 /* cleanup */
493 while (ts_received->remove_last(ts_received, (void**)&ts) == SUCCESS)
494 {
495 ts->destroy(ts);
496 }
497 ts_received->destroy(ts_received);
498
499 return SUCCESS;
500 }
501
502 /**
503 * Implements private_ike_auth_requested_t.process_notify_payload
504 */
505 static status_t process_notify_payload(private_ike_auth_requested_t *this, notify_payload_t *notify_payload)
506 {
507 notify_message_type_t notify_message_type = notify_payload->get_notify_message_type(notify_payload);
508
509 this->logger->log(this->logger, CONTROL|LEVEL1, "Process notify type %s for protocol %s",
510 mapping_find(notify_message_type_m, notify_message_type),
511 mapping_find(protocol_id_m, notify_payload->get_protocol_id(notify_payload)));
512
513 if (notify_payload->get_protocol_id(notify_payload) != IKE)
514 {
515 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained a notify for an invalid protocol. Deleting IKE_SA");
516 return DELETE_ME;
517 }
518
519 switch (notify_message_type)
520 {
521 case INVALID_SYNTAX:
522 {
523 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained an INVALID_SYNTAX notify. Deleting IKE_SA");
524 return DELETE_ME;
525
526 }
527 case AUTHENTICATION_FAILED:
528 {
529 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained an AUTHENTICATION_FAILED notify. Deleting IKE_SA");
530 return DELETE_ME;
531
532 }
533 case SINGLE_PAIR_REQUIRED:
534 {
535 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained a SINGLE_PAIR_REQUIRED notify. Deleting IKE_SA");
536 return DELETE_ME;
537 }
538 default:
539 {
540 /*
541 * - In case of unknown error: IKE_SA gets destroyed.
542 * - In case of unknown status: logging
543 */
544
545 if (notify_message_type < 16383)
546 {
547 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained an unknown notify error (%d). Deleting IKE_SA",
548 notify_message_type);
549 return DELETE_ME;
550
551 }
552 else
553 {
554 this->logger->log(this->logger, CONTROL, "IKE_AUTH reply contained an unknown notify (%d), ignored.",
555 notify_message_type);
556 return SUCCESS;
557 }
558 }
559 }
560 }
561
562 /**
563 * Implements state_t.get_state
564 */
565 static ike_sa_state_t get_state(private_ike_auth_requested_t *this)
566 {
567 return IKE_AUTH_REQUESTED;
568 }
569
570 /**
571 * Implements state_t.get_state
572 */
573 static void destroy(private_ike_auth_requested_t *this)
574 {
575 allocator_free_chunk(&(this->received_nonce));
576 allocator_free_chunk(&(this->sent_nonce));
577 allocator_free_chunk(&(this->ike_sa_init_reply_data));
578 if (this->child_sa)
579 {
580 this->child_sa->destroy(this->child_sa);
581 }
582 if (this->my_ts)
583 {
584 traffic_selector_t *ts;
585 while (this->my_ts->remove_last(this->my_ts, (void**)&ts) == SUCCESS)
586 {
587 ts->destroy(ts);
588 }
589 this->my_ts->destroy(this->my_ts);
590 }
591 if (this->other_ts)
592 {
593 traffic_selector_t *ts;
594 while (this->other_ts->remove_last(this->other_ts, (void**)&ts) == SUCCESS)
595 {
596 ts->destroy(ts);
597 }
598 this->other_ts->destroy(this->other_ts);
599 }
600 if (this->proposal)
601 {
602 this->proposal->destroy(this->proposal);
603 }
604 allocator_free(this);
605 }
606 /**
607 * Implements protected_ike_sa_t.destroy_after_state_change
608 */
609 static void destroy_after_state_change(private_ike_auth_requested_t *this)
610 {
611 allocator_free_chunk(&(this->received_nonce));
612 allocator_free_chunk(&(this->sent_nonce));
613 allocator_free_chunk(&(this->ike_sa_init_reply_data));
614 if (this->my_ts)
615 {
616 traffic_selector_t *ts;
617 while (this->my_ts->remove_last(this->my_ts, (void**)&ts) == SUCCESS)
618 {
619 ts->destroy(ts);
620 }
621 this->my_ts->destroy(this->my_ts);
622 }
623 if (this->other_ts)
624 {
625 traffic_selector_t *ts;
626 while (this->other_ts->remove_last(this->other_ts, (void**)&ts) == SUCCESS)
627 {
628 ts->destroy(ts);
629 }
630 this->other_ts->destroy(this->other_ts);
631 }
632 if (this->proposal)
633 {
634 this->proposal->destroy(this->proposal);
635 }
636 allocator_free(this);
637 }
638
639 /*
640 * Described in header.
641 */
642 ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa,chunk_t sent_nonce,chunk_t received_nonce,chunk_t ike_sa_init_reply_data, child_sa_t *child_sa)
643 {
644 private_ike_auth_requested_t *this = allocator_alloc_thing(private_ike_auth_requested_t);
645
646 /* interface functions */
647 this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
648 this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
649 this->public.state_interface.destroy = (void (*) (state_t *)) destroy;
650
651 /* private functions */
652 this->process_idr_payload = process_idr_payload;
653 this->process_sa_payload = process_sa_payload;
654 this->process_auth_payload = process_auth_payload;
655 this->process_ts_payload = process_ts_payload;
656 this->process_notify_payload = process_notify_payload;
657 this->destroy_after_state_change = destroy_after_state_change;
658
659 /* private data */
660 this->ike_sa = ike_sa;
661 this->received_nonce = received_nonce;
662 this->sent_nonce = sent_nonce;
663 this->ike_sa_init_reply_data = ike_sa_init_reply_data;
664 this->logger = this->ike_sa->get_logger(this->ike_sa);
665 this->my_ts = NULL;
666 this->other_ts = NULL;
667 this->proposal = NULL;
668 this->child_sa = child_sa;
669
670 return &(this->public);
671 }