- new configuration support added to ike_sa and states
[strongswan.git] / Source / charon / sa / states / ike_sa_init_requested.c
1 /**
2 * @file ike_sa_init_requested.c
3 *
4 * @brief Implementation of ike_sa_init_requested_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "ike_sa_init_requested.h"
24
25 #include <daemon.h>
26 #include <utils/allocator.h>
27 #include <encoding/payloads/sa_payload.h>
28 #include <encoding/payloads/ke_payload.h>
29 #include <encoding/payloads/nonce_payload.h>
30 #include <encoding/payloads/id_payload.h>
31 #include <encoding/payloads/auth_payload.h>
32 #include <transforms/diffie_hellman.h>
33 #include <sa/states/ike_auth_requested.h>
34
35
36 typedef struct private_ike_sa_init_requested_t private_ike_sa_init_requested_t;
37
38 /**
39 * Private data of a ike_sa_init_requested_t object.
40 *
41 */
42 struct private_ike_sa_init_requested_t {
43 /**
44 * methods of the state_t interface
45 */
46 ike_sa_init_requested_t public;
47
48 /**
49 * Assigned IKE_SA
50 */
51 protected_ike_sa_t *ike_sa;
52
53 /**
54 * Diffie Hellman object used to compute shared secret
55 */
56 diffie_hellman_t *diffie_hellman;
57
58 /**
59 * Shared secret of successful exchange
60 */
61 chunk_t shared_secret;
62
63 /**
64 * Sent nonce value
65 */
66 chunk_t sent_nonce;
67
68 /**
69 * Received nonce
70 */
71 chunk_t received_nonce;
72
73 /**
74 * DH group priority used to get dh_group_number from configuration manager.
75 *
76 * Currently uused but usable if informational messages of unsupported dh group number are processed.
77 */
78 u_int16_t dh_group_priority;
79
80 /**
81 * Logger used to log data
82 *
83 * Is logger of ike_sa!
84 */
85 logger_t *logger;
86
87 /**
88 * Builds the IKE_SA_AUTH request message.
89 *
90 * @param this calling object
91 * @param message the created message will be stored at this location
92 */
93 void (*build_ike_auth_request) (private_ike_sa_init_requested_t *this, message_t **message);
94
95 /**
96 * Builds the id payload for this state.
97 *
98 * @param this calling object
99 * @param payload The generated payload object of type id_payload_t is
100 * stored at this location.
101 */
102 void (*build_id_payload) (private_ike_sa_init_requested_t *this, payload_t **payload);
103
104 /**
105 * Builds the id payload for this state.
106 *
107 * @param this calling object
108 * @param payload The generated payload object of type auth_payload_t is
109 * stored at this location.
110 */
111 void (*build_auth_payload) (private_ike_sa_init_requested_t *this, payload_t **payload);
112
113 /**
114 * Destroy function called internally of this class after state change succeeded.
115 *
116 * This destroy function does not destroy objects which were passed to the new state.
117 *
118 * @param this calling object
119 */
120 void (*destroy_after_state_change) (private_ike_sa_init_requested_t *this);
121 };
122
123 /**
124 * Implements state_t.get_state
125 */
126 static status_t process_message(private_ike_sa_init_requested_t *this, message_t *reply)
127 {
128 status_t status;
129 iterator_t *payloads;
130 exchange_type_t exchange_type;
131 message_t *request;
132 packet_t *packet;
133 u_int64_t responder_spi;
134 ike_sa_id_t *ike_sa_id;
135 ike_auth_requested_t *next_state;
136
137
138 exchange_type = reply->get_exchange_type(reply);
139 if (exchange_type != IKE_SA_INIT)
140 {
141 this->logger->log(this->logger, ERROR | MORE, "Message of type %s not supported in state ike_sa_init_requested",mapping_find(exchange_type_m,exchange_type));
142 return FAILED;
143 }
144
145 if (reply->get_request(reply))
146 {
147 this->logger->log(this->logger, ERROR | MORE, "Only responses of type IKE_SA_INIT supported in state ike_sa_init_requested");
148 return FAILED;
149 }
150
151 /* parse incoming message */
152 status = reply->parse_body(reply, NULL, NULL);
153 if (status != SUCCESS)
154 {
155 this->logger->log(this->logger, ERROR | MORE, "Could not parse body");
156 return status;
157 }
158
159 responder_spi = reply->get_responder_spi(reply);
160 ike_sa_id = this->ike_sa->public.get_id(&(this->ike_sa->public));
161 ike_sa_id->set_responder_spi(ike_sa_id,responder_spi);
162
163 /* iterate over incoming payloads */
164 payloads = reply->get_payload_iterator(reply);
165 while (payloads->has_next(payloads))
166 {
167 payload_t *payload;
168 payloads->current(payloads, (void**)&payload);
169
170 this->logger->log(this->logger, CONTROL|MORE, "Processing payload %s", mapping_find(payload_type_m, payload->get_type(payload)));
171 switch (payload->get_type(payload))
172 {
173 case SECURITY_ASSOCIATION:
174 {
175 sa_payload_t *sa_payload = (sa_payload_t*)payload;
176 ike_proposal_t *ike_proposals;
177 ike_proposal_t selected_proposal;
178 size_t proposal_count;
179 init_config_t *init_config;
180
181 /* get the list of suggested proposals */
182 status = sa_payload->get_ike_proposals (sa_payload, &ike_proposals,&proposal_count);
183 if (status != SUCCESS)
184 {
185 this->logger->log(this->logger, ERROR | MORE, "SA payload does not contain IKE proposals");
186 payloads->destroy(payloads);
187 return status;
188 }
189
190 if (proposal_count != 1)
191 {
192 this->logger->log(this->logger, ERROR | MORE, "More then one proposal selected!");
193 allocator_free(ike_proposals);
194 payloads->destroy(payloads);
195 return status;
196 }
197
198 /* now let the configuration-manager check the selected proposals*/
199 this->logger->log(this->logger, CONTROL | MOST, "Check suggested proposals");
200 init_config = this->ike_sa->get_init_config(this->ike_sa);
201
202 status = init_config->select_proposal (init_config,ike_proposals,1,&selected_proposal);
203 allocator_free(ike_proposals);
204 if (status != SUCCESS)
205 {
206 this->logger->log(this->logger, ERROR | MORE, "Selected proposal not a suggested one!");
207 payloads->destroy(payloads);
208 return status;
209 }
210
211 status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,&selected_proposal);
212 if (status != SUCCESS)
213 {
214 this->logger->log(this->logger, ERROR | MORE, "Transform objects could not be created from selected proposal");
215 payloads->destroy(payloads);
216 return status;
217 }
218 /* ok, we have what we need for sa_payload */
219 break;
220 }
221 case KEY_EXCHANGE:
222 {
223 ke_payload_t *ke_payload = (ke_payload_t*)payload;
224
225 this->diffie_hellman->set_other_public_value(this->diffie_hellman, ke_payload->get_key_exchange_data(ke_payload));
226
227 /* shared secret is computed AFTER processing of all payloads... */
228 break;
229 }
230 case NONCE:
231 {
232 nonce_payload_t *nonce_payload = (nonce_payload_t*)payload;
233
234 allocator_free(this->received_nonce.ptr);
235 this->received_nonce = CHUNK_INITIALIZER;
236
237 nonce_payload->get_nonce(nonce_payload, &(this->received_nonce));
238 break;
239 }
240 default:
241 {
242 this->logger->log(this->logger, ERROR, "Payload type not supported!!!!");
243 payloads->destroy(payloads);
244 return FAILED;
245 }
246
247 }
248
249 }
250 payloads->destroy(payloads);
251
252 allocator_free(this->shared_secret.ptr);
253 this->shared_secret = CHUNK_INITIALIZER;
254
255 /* store shared secret */
256 this->logger->log(this->logger, CONTROL | MOST, "Retrieve shared secret and store it");
257 status = this->diffie_hellman->get_shared_secret(this->diffie_hellman, &(this->shared_secret));
258 this->logger->log_chunk(this->logger, PRIVATE, "Shared secret", &this->shared_secret);
259
260 this->ike_sa->compute_secrets(this->ike_sa,this->shared_secret,this->sent_nonce, this->received_nonce);
261
262 /* build the complete IKE_AUTH request */
263 this->build_ike_auth_request (this,&request);
264
265 /* generate packet */
266 this->logger->log(this->logger, CONTROL|MOST, "generate packet from message");
267
268 status = request->generate(request, this->ike_sa->get_crypter_initiator(this->ike_sa), this->ike_sa->get_signer_initiator(this->ike_sa), &packet);
269 if (status != SUCCESS)
270 {
271 this->logger->log(this->logger, ERROR, "could not generate packet from message");
272 reply->destroy(reply);
273 return status;
274 }
275
276 this->logger->log(this->logger, CONTROL|MOST, "Add packet to global send queue");
277 charon->send_queue->add(charon->send_queue, packet);
278
279 /* state can now be changed */
280 this->logger->log(this->logger, CONTROL|MOST, "Create next state object");
281 next_state = ike_auth_requested_create(this->ike_sa);
282
283 /* last message can now be set */
284 status = this->ike_sa->set_last_requested_message(this->ike_sa, request);
285
286 if (status != SUCCESS)
287 {
288 this->logger->log(this->logger, ERROR, "Could not set last requested message");
289 (next_state->state_interface).destroy(&(next_state->state_interface));
290 request->destroy(request);
291 return status;
292 }
293
294 /* state can now be changed */
295 this->ike_sa->set_new_state(this->ike_sa,(state_t *) next_state);
296
297 /* state has NOW changed :-) */
298 this->logger->log(this->logger, CONTROL|MORE, "Changed state of IKE_SA from %s to %s", mapping_find(ike_sa_state_m,IKE_SA_INIT_REQUESTED),mapping_find(ike_sa_state_m,IKE_AUTH_REQUESTED) );
299
300 this->logger->log(this->logger, CONTROL|MOST, "Destroy old sate object");
301 this->destroy_after_state_change(this);
302
303 return SUCCESS;
304 }
305
306 /**
307 * implements private_ike_sa_init_requested_t.build_ike_auth_request
308 */
309 static void build_ike_auth_request (private_ike_sa_init_requested_t *this, message_t **request)
310 {
311 payload_t *payload;
312 message_t *message;
313
314 /* going to build message */
315 this->logger->log(this->logger, CONTROL|MOST, "Going to build empty message");
316 this->ike_sa->build_message(this->ike_sa, IKE_AUTH, TRUE, &message);
317
318
319 /* build id payload */
320 this->build_id_payload(this, &payload);
321 this->logger->log(this->logger, CONTROL|MOST, "add ID payload to message");
322 message->add_payload(message, payload);
323
324 /* build auth payload */
325 this->build_auth_payload(this, &payload);
326 this->logger->log(this->logger, CONTROL|MOST, "add AUTH payload to message");
327 message->add_payload(message, payload);
328
329 *request = message;
330 }
331
332 /**
333 * Implementation of private_ike_sa_init_requested_t.build_id_payload.
334 */
335 static void build_id_payload (private_ike_sa_init_requested_t *this, payload_t **payload)
336 {
337 id_payload_t *id_payload;
338 chunk_t email;
339
340 /* create IDi */
341 id_payload = id_payload_create(TRUE);
342 /* TODO special functions on id payload */
343 /* TODO configuration manager request */
344 id_payload->set_id_type(id_payload,ID_RFC822_ADDR);
345 email.ptr = "moerdi@hsr.ch";
346 email.len = strlen(email.ptr)+1;
347 this->logger->log_chunk(this->logger, CONTROL, "Moerdi",&email);
348 id_payload->set_data(id_payload,email);
349
350 *payload = (payload_t *) id_payload;
351 }
352
353 /**
354 * Implementation of private_ike_sa_init_requested_t.build_auth_payload.
355 */
356 static void build_auth_payload (private_ike_sa_init_requested_t *this, payload_t **payload)
357 {
358 auth_payload_t *auth_payload;
359 chunk_t auth_data;
360
361 /* create IDi */
362 auth_payload = auth_payload_create();
363 /* TODO configuration manager request */
364 auth_payload->set_auth_method(auth_payload,RSA_DIGITAL_SIGNATURE);
365 auth_data.ptr = "this is the key";
366 auth_data.len = strlen(auth_data.ptr);
367 this->logger->log_chunk(this->logger, CONTROL, "Auth Data",&auth_data);
368 auth_payload->set_data(auth_payload,auth_data);
369 *payload = (payload_t *) auth_payload;
370 }
371
372 /**
373 * Implements state_t.get_state
374 */
375 static ike_sa_state_t get_state(private_ike_sa_init_requested_t *this)
376 {
377 return IKE_SA_INIT_REQUESTED;
378 }
379
380 /**
381 * Implements private_ike_sa_init_requested_t.destroy_after_state_change
382 */
383 static void destroy_after_state_change (private_ike_sa_init_requested_t *this)
384 {
385 this->logger->log(this->logger, CONTROL | MORE, "Going to destroy state of type ike_sa_init_requested_t after state change");
386
387 this->logger->log(this->logger, CONTROL | MOST, "Destroy diffie hellman object");
388 this->diffie_hellman->destroy(this->diffie_hellman);
389
390 allocator_free(this->sent_nonce.ptr);
391 allocator_free(this->received_nonce.ptr);
392 allocator_free(this->shared_secret.ptr);
393 allocator_free(this);
394
395 }
396
397 /**
398 * Implements state_t.get_state
399 */
400 static void destroy(private_ike_sa_init_requested_t *this)
401 {
402 this->logger->log(this->logger, CONTROL | MORE, "Going to destroy state of type ike_sa_init_requested_t");
403
404 this->logger->log(this->logger, CONTROL | MOST, "Destroy diffie hellman object");
405 this->diffie_hellman->destroy(this->diffie_hellman);
406
407 allocator_free(this->sent_nonce.ptr);
408 allocator_free(this->received_nonce.ptr);
409 allocator_free(this->shared_secret.ptr);
410 allocator_free(this);
411 }
412
413 /*
414 * Described in header.
415 */
416 ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa,u_int16_t dh_group_priority, diffie_hellman_t *diffie_hellman, chunk_t sent_nonce)
417 {
418 private_ike_sa_init_requested_t *this = allocator_alloc_thing(private_ike_sa_init_requested_t);
419
420 /* interface functions */
421 this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
422 this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
423 this->public.state_interface.destroy = (void (*) (state_t *)) destroy;
424
425 /* private functions */
426 this->build_ike_auth_request = build_ike_auth_request;
427 this->build_id_payload = build_id_payload;
428 this->build_auth_payload = build_auth_payload;
429 this->destroy_after_state_change = destroy_after_state_change;
430
431 /* private data */
432 this->ike_sa = ike_sa;
433 this->received_nonce = CHUNK_INITIALIZER;
434 this->shared_secret = CHUNK_INITIALIZER;
435 this->logger = this->ike_sa->get_logger(this->ike_sa);
436 this->diffie_hellman = diffie_hellman;
437 this->sent_nonce = sent_nonce;
438 this->dh_group_priority = dh_group_priority;
439
440 return &(this->public);
441 }