0663f0a5ebc356f858b99c188045f73b4a31f39d
[strongswan.git] / Source / charon / sa / states / ike_sa_init_requested.c
1 /**
2 * @file ike_sa_init_requested.c
3 *
4 * @brief Implementation of ike_sa_init_requested_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "ike_sa_init_requested.h"
24
25 #include <daemon.h>
26 #include <utils/allocator.h>
27 #include <encoding/payloads/sa_payload.h>
28 #include <encoding/payloads/ke_payload.h>
29 #include <encoding/payloads/nonce_payload.h>
30 #include <encoding/payloads/id_payload.h>
31 #include <transforms/diffie_hellman.h>
32
33
34 typedef struct private_ike_sa_init_requested_t private_ike_sa_init_requested_t;
35
36 /**
37 * Private data of a ike_sa_init_requested_t object.
38 *
39 */
40 struct private_ike_sa_init_requested_t {
41 /**
42 * methods of the state_t interface
43 */
44 ike_sa_init_requested_t public;
45
46 /**
47 * Assigned IKE_SA
48 */
49 protected_ike_sa_t *ike_sa;
50
51 /**
52 * Diffie Hellman object used to compute shared secret
53 */
54 diffie_hellman_t *diffie_hellman;
55
56 /**
57 * Shared secret of successful exchange
58 */
59 chunk_t shared_secret;
60
61 /**
62 * Sent nonce value
63 */
64 chunk_t sent_nonce;
65
66 /**
67 * Received nonce
68 */
69 chunk_t received_nonce;
70
71 /**
72 * DH group priority used to get dh_group_number from configuration manager.
73 *
74 * Currently uused but usable if informational messages of unsupported dh group number are processed.
75 */
76 u_int16_t dh_group_priority;
77
78 /**
79 * Logger used to log data
80 *
81 * Is logger of ike_sa!
82 */
83 logger_t *logger;
84
85 /**
86 * Builds the IKE_SA_AUTH request message.
87 *
88 * @param this calling object
89 * @param message the created message will be stored at this location
90 */
91 void (*build_ike_auth_request) (private_ike_sa_init_requested_t *this, message_t **message);
92
93 /**
94 * Builds the id payload for this state.
95 *
96 * @param this calling object
97 * @param payload The generated payload object of type id_payload_t is
98 * stored at this location.
99 */
100 void (*build_id_payload) (private_ike_sa_init_requested_t *this, payload_t **payload);
101
102 };
103
104 /**
105 * Implements state_t.get_state
106 */
107 static status_t process_message(private_ike_sa_init_requested_t *this, message_t *message)
108 {
109 status_t status;
110 iterator_t *payloads;
111 exchange_type_t exchange_type;
112 message_t *request;
113 packet_t *packet;
114 u_int64_t responder_spi;
115 ike_sa_id_t *ike_sa_id;
116
117
118 exchange_type = message->get_exchange_type(message);
119 if (exchange_type != IKE_SA_INIT)
120 {
121 this->logger->log(this->logger, ERROR | MORE, "Message of type %s not supported in state ike_sa_init_requested",mapping_find(exchange_type_m,exchange_type));
122 return FAILED;
123 }
124
125 if (message->get_request(message))
126 {
127 this->logger->log(this->logger, ERROR | MORE, "Only responses of type IKE_SA_INIT supported in state ike_sa_init_requested");
128 return FAILED;
129 }
130
131 /* parse incoming message */
132 status = message->parse_body(message, NULL, NULL);
133 if (status != SUCCESS)
134 {
135 this->logger->log(this->logger, ERROR | MORE, "Could not parse body");
136 return status;
137 }
138
139 responder_spi = message->get_responder_spi(message);
140 ike_sa_id = this->ike_sa->public.get_id(&(this->ike_sa->public));
141 ike_sa_id->set_responder_spi(ike_sa_id,responder_spi);
142
143 /* iterate over incoming payloads */
144 payloads = message->get_payload_iterator(message);
145 while (payloads->has_next(payloads))
146 {
147 payload_t *payload;
148 payloads->current(payloads, (void**)&payload);
149
150 this->logger->log(this->logger, CONTROL|MORE, "Processing payload %s", mapping_find(payload_type_m, payload->get_type(payload)));
151 switch (payload->get_type(payload))
152 {
153 case SECURITY_ASSOCIATION:
154 {
155 sa_payload_t *sa_payload = (sa_payload_t*)payload;
156 iterator_t *suggested_proposals;
157 proposal_substructure_t *suggested_proposal;
158 bool valid;
159
160
161 /* get the list of suggested proposals */
162 suggested_proposals = sa_payload->create_proposal_substructure_iterator(sa_payload, TRUE);
163
164
165 /* now let the configuration-manager check the selected proposals*/
166 this->logger->log(this->logger, CONTROL | MOST, "Check suggested proposals");
167 status = charon->configuration_manager->check_selected_proposals_for_host(charon->configuration_manager,
168 this->ike_sa->get_other_host(this->ike_sa), suggested_proposals,&valid);
169 if (status != SUCCESS)
170 {
171 this->logger->log(this->logger, ERROR | MORE, "Could not check suggested proposals!");
172 suggested_proposals->destroy(suggested_proposals);
173 payloads->destroy(payloads);
174 return status;
175 }
176
177 if (!valid)
178 {
179 this->logger->log(this->logger, ERROR | MORE, "Suggested proposals not accepted!");
180 payloads->destroy(payloads);
181 return status;
182 }
183
184
185 /* let the ike_sa create their own transforms from proposal informations */
186 suggested_proposals->reset(suggested_proposals);
187 /* TODO check for true*/
188 suggested_proposals->has_next(suggested_proposals);
189 status = suggested_proposals->current(suggested_proposals,(void **)&suggested_proposal);
190 suggested_proposals->destroy(suggested_proposals);
191 if (status != SUCCESS)
192 {
193 this->logger->log(this->logger, ERROR | MORE, "Could not get first proposal");
194 payloads->destroy(payloads);
195 return status;
196 }
197
198 status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,suggested_proposal);
199 if (status != SUCCESS)
200 {
201 this->logger->log(this->logger, ERROR | MORE, "Transform objects could not be created from selected proposal");
202 payloads->destroy(payloads);
203 return status;
204 }
205
206
207 /* ok, we have what we need for sa_payload */
208 break;
209 }
210 case KEY_EXCHANGE:
211 {
212 ke_payload_t *ke_payload = (ke_payload_t*)payload;
213
214 this->diffie_hellman->set_other_public_value(this->diffie_hellman, ke_payload->get_key_exchange_data(ke_payload));
215
216 /* shared secret is computed AFTER processing of all payloads... */
217 break;
218 }
219 case NONCE:
220 {
221 nonce_payload_t *nonce_payload = (nonce_payload_t*)payload;
222
223 allocator_free(this->received_nonce.ptr);
224 this->received_nonce = CHUNK_INITIALIZER;
225
226 nonce_payload->get_nonce(nonce_payload, &(this->received_nonce));
227 break;
228 }
229 default:
230 {
231 this->logger->log(this->logger, ERROR, "Payload type not supported!!!!");
232 payloads->destroy(payloads);
233 return FAILED;
234 }
235
236 }
237
238 }
239 payloads->destroy(payloads);
240
241 allocator_free(this->shared_secret.ptr);
242 this->shared_secret = CHUNK_INITIALIZER;
243
244 /* store shared secret */
245 this->logger->log(this->logger, CONTROL | MOST, "Retrieve shared secret and store it");
246 status = this->diffie_hellman->get_shared_secret(this->diffie_hellman, &(this->shared_secret));
247 this->logger->log_chunk(this->logger, PRIVATE, "Shared secret", &this->shared_secret);
248
249 this->ike_sa->compute_secrets(this->ike_sa,this->shared_secret,this->sent_nonce, this->received_nonce);
250
251 this->build_ike_auth_request (this,&request);
252
253 /* generate packet */
254 this->logger->log(this->logger, CONTROL|MOST, "generate packet from message");
255
256 status = request->generate(request, this->ike_sa->get_crypter_initiator(this->ike_sa), this->ike_sa->get_signer_initiator(this->ike_sa), &packet);
257 if (status != SUCCESS)
258 {
259 this->logger->log(this->logger, ERROR, "could not generate packet from message");
260 message->destroy(message);
261 return status;
262 }
263
264 this->logger->log(this->logger, CONTROL|MOST, "Add packet to global send queue");
265 charon->send_queue->add(charon->send_queue, packet);
266
267
268 request->destroy(request);
269
270 /****************************
271 *
272 * TODO
273 *
274 * Send IKE_SA_AUTH request
275 *
276 * Make state change
277 *
278 ****************************/
279
280
281 /* set up the reply */
282 // status = this->ike_sa->build_message(this->ike_sa, IKE_SA_INIT, FALSE, &response);
283 // if (status != SUCCESS)
284 // {
285 // return status;
286 // }
287
288 // response->destroy(response);
289
290
291 return SUCCESS;
292 }
293
294 /**
295 * implements private_ike_sa_init_requested_t.build_ike_auth_request
296 */
297 static void build_ike_auth_request (private_ike_sa_init_requested_t *this, message_t **request)
298 {
299 payload_t *payload;
300 message_t *message;
301
302 /* going to build message */
303 this->logger->log(this->logger, CONTROL|MOST, "Going to build empty message");
304 this->ike_sa->build_message(this->ike_sa, IKE_AUTH, TRUE, &message);
305
306
307 /* build id payload */
308 this->build_id_payload(this, &payload);
309 this->logger->log(this->logger, CONTROL|MOST, "add id payload to message");
310 message->add_payload(message, payload);
311
312 *request = message;
313 }
314
315 static void build_id_payload (private_ike_sa_init_requested_t *this, payload_t **payload)
316 {
317 id_payload_t *id_payload;
318 chunk_t email;
319
320 /* create IDi */
321 id_payload = id_payload_create(TRUE);
322 /* TODO special functions on id payload */
323 /* TODO configuration manager request */
324 id_payload->set_id_type(id_payload,ID_RFC822_ADDR);
325 email.ptr = "moerdi@hsr.ch";
326 email.len = strlen(email.ptr);
327 this->logger->log_chunk(this->logger, CONTROL, "Moerdi",&email);
328 id_payload->set_data(id_payload,email);
329
330 *payload = (payload_t *) id_payload;
331 }
332
333 /**
334 * Implements state_t.get_state
335 */
336 static ike_sa_state_t get_state(private_ike_sa_init_requested_t *this)
337 {
338 return IKE_SA_INIT_REQUESTED;
339 }
340
341 /**
342 * Implements state_t.get_state
343 */
344 static void destroy(private_ike_sa_init_requested_t *this)
345 {
346 this->logger->log(this->logger, CONTROL | MORE, "Going to destroy state of type ike_sa_init_requested_t");
347
348 this->logger->log(this->logger, CONTROL | MOST, "Destroy diffie hellman object");
349 this->diffie_hellman->destroy(this->diffie_hellman);
350
351 allocator_free(this->sent_nonce.ptr);
352 allocator_free(this->received_nonce.ptr);
353 allocator_free(this->shared_secret.ptr);
354 allocator_free(this);
355 }
356
357 /*
358 * Described in header.
359 */
360 ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa,u_int16_t dh_group_priority, diffie_hellman_t *diffie_hellman, chunk_t sent_nonce)
361 {
362 private_ike_sa_init_requested_t *this = allocator_alloc_thing(private_ike_sa_init_requested_t);
363
364 /* interface functions */
365 this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
366 this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
367 this->public.state_interface.destroy = (void (*) (state_t *)) destroy;
368
369 /* private functions */
370 this->build_ike_auth_request = build_ike_auth_request;
371 this->build_id_payload = build_id_payload;
372
373 /* private data */
374 this->ike_sa = ike_sa;
375 this->received_nonce = CHUNK_INITIALIZER;
376 this->shared_secret = CHUNK_INITIALIZER;
377 this->logger = this->ike_sa->get_logger(this->ike_sa);
378 this->diffie_hellman = diffie_hellman;
379 this->sent_nonce = sent_nonce;
380 this->dh_group_priority = dh_group_priority;
381
382 return &(this->public);
383 }