2 * @file ike_sa_init_requested.c
4 * @brief State of a IKE_SA after requesting an IKE_SA_INIT
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
23 #include "ike_sa_init_requested.h"
26 #include <utils/allocator.h>
27 #include <encoding/payloads/sa_payload.h>
28 #include <encoding/payloads/ke_payload.h>
29 #include <encoding/payloads/nonce_payload.h>
30 #include <transforms/diffie_hellman.h>
33 typedef struct private_ike_sa_init_requested_t private_ike_sa_init_requested_t
;
36 * Private data of a ike_sa_init_requested_t object.
39 struct private_ike_sa_init_requested_t
{
41 * methods of the state_t interface
43 ike_sa_init_requested_t
public;
48 protected_ike_sa_t
*ike_sa
;
51 * Diffie Hellman object used to compute shared secret
53 diffie_hellman_t
*diffie_hellman
;
56 * Shared secret of successful exchange
58 chunk_t shared_secret
;
68 chunk_t received_nonce
;
71 * DH group priority used to get dh_group_number from configuration manager.
73 * Currently uused but usable if informational messages of unsupported dh group number are processed.
75 u_int16_t dh_group_priority
;
78 * Logger used to log data
80 * Is logger of ike_sa!
86 * Implements state_t.get_state
88 static status_t
process_message(private_ike_sa_init_requested_t
*this, message_t
*message
)
92 exchange_type_t exchange_type
;
93 u_int64_t responder_spi
;
94 ike_sa_id_t
*ike_sa_id
;
97 exchange_type
= message
->get_exchange_type(message
);
98 if (exchange_type
!= IKE_SA_INIT
)
100 this->logger
->log(this->logger
, ERROR
| MORE
, "Message of type %s not supported in state ike_sa_init_requested",mapping_find(exchange_type_m
,exchange_type
));
104 if (message
->get_request(message
))
106 this->logger
->log(this->logger
, ERROR
| MORE
, "Only responses of type IKE_SA_INIT supported in state ike_sa_init_requested");
110 /* parse incoming message */
111 status
= message
->parse_body(message
, NULL
, NULL
);
112 if (status
!= SUCCESS
)
114 this->logger
->log(this->logger
, ERROR
| MORE
, "Could not parse body");
118 responder_spi
= message
->get_responder_spi(message
);
119 ike_sa_id
= this->ike_sa
->public.get_id(&(this->ike_sa
->public));
120 ike_sa_id
->set_responder_spi(ike_sa_id
,responder_spi
);
122 /* iterate over incoming payloads */
123 message
->get_payload_iterator(message
, &payloads
);
124 while (payloads
->has_next(payloads
))
127 payloads
->current(payloads
, (void**)&payload
);
129 this->logger
->log(this->logger
, CONTROL
|MORE
, "Processing payload %s", mapping_find(payload_type_m
, payload
->get_type(payload
)));
130 switch (payload
->get_type(payload
))
132 case SECURITY_ASSOCIATION
:
134 sa_payload_t
*sa_payload
= (sa_payload_t
*)payload
;
135 iterator_t
*suggested_proposals
;
136 proposal_substructure_t
*suggested_proposal
;
140 /* get the list of suggested proposals */
141 status
= sa_payload
->create_proposal_substructure_iterator(sa_payload
, &suggested_proposals
, TRUE
);
142 if (status
!= SUCCESS
)
144 this->logger
->log(this->logger
, ERROR
, "Fatal errror: Could not create iterator on suggested proposals");
145 payloads
->destroy(payloads
);
149 /* now let the configuration-manager check the selected proposals*/
150 this->logger
->log(this->logger
, CONTROL
| MOST
, "Check suggested proposals");
151 status
= global_configuration_manager
->check_selected_proposals_for_host(global_configuration_manager
,
152 this->ike_sa
->get_other_host(this->ike_sa
), suggested_proposals
,&valid
);
153 if (status
!= SUCCESS
)
155 this->logger
->log(this->logger
, ERROR
| MORE
, "Could not check suggested proposals!");
156 suggested_proposals
->destroy(suggested_proposals
);
157 payloads
->destroy(payloads
);
163 this->logger
->log(this->logger
, ERROR
| MORE
, "Suggested proposals not accepted!");
164 payloads
->destroy(payloads
);
169 /* let the ike_sa create their own transforms from proposal informations */
170 suggested_proposals
->reset(suggested_proposals
);
171 /* TODO check for true*/
172 suggested_proposals
->has_next(suggested_proposals
);
173 status
= suggested_proposals
->current(suggested_proposals
,(void **)&suggested_proposal
);
174 suggested_proposals
->destroy(suggested_proposals
);
175 if (status
!= SUCCESS
)
177 this->logger
->log(this->logger
, ERROR
| MORE
, "Could not get first proposal");
178 payloads
->destroy(payloads
);
182 status
= this->ike_sa
->create_transforms_from_proposal(this->ike_sa
,suggested_proposal
);
183 if (status
!= SUCCESS
)
185 this->logger
->log(this->logger
, ERROR
| MORE
, "Transform objects could not be created from selected proposal");
186 payloads
->destroy(payloads
);
191 /* ok, we have what we need for sa_payload */
196 ke_payload_t
*ke_payload
= (ke_payload_t
*)payload
;
198 status
= this->diffie_hellman
->set_other_public_value(this->diffie_hellman
, ke_payload
->get_key_exchange_data(ke_payload
));
199 if (status
!= SUCCESS
)
201 this->logger
->log(this->logger
, ERROR
, "Could not set other public value for DH exchange. Status %s",mapping_find(status_m
,status
));
202 payloads
->destroy(payloads
);
206 /* shared secret is computed AFTER processing of all payloads... */
211 nonce_payload_t
*nonce_payload
= (nonce_payload_t
*)payload
;
213 if (this->received_nonce
.ptr
!= NULL
)
215 this->logger
->log(this->logger
, CONTROL
| MOST
, "Destroy existing received nonce");
216 allocator_free(this->received_nonce
.ptr
);
217 this->received_nonce
.ptr
= NULL
;
218 this->received_nonce
.len
= 0;
221 status
= nonce_payload
->get_nonce(nonce_payload
, &(this->received_nonce
));
222 if (status
!= SUCCESS
)
224 this->logger
->log(this->logger
, ERROR
, "Fatal error: Could not get received nonce");
225 payloads
->destroy(payloads
);
233 this->logger
->log(this->logger
, ERROR
, "Fatal errror: Payload type not supported!!!!");
234 payloads
->destroy(payloads
);
241 payloads
->destroy(payloads
);
243 if (this->shared_secret
.ptr
!= NULL
)
245 this->logger
->log(this->logger
, CONTROL
| MOST
, "Destroy existing shared_secret");
246 allocator_free(this->shared_secret
.ptr
);
247 this->shared_secret
.ptr
= NULL
;
248 this->shared_secret
.len
= 0;
252 /* store shared secret */
253 this->logger
->log(this->logger
, CONTROL
| MOST
, "Retrieve shared secret and store it");
254 status
= this->diffie_hellman
->get_shared_secret(this->diffie_hellman
, &(this->shared_secret
));
255 this->logger
->log_chunk(this->logger
, PRIVATE
, "Shared secret", &this->shared_secret
);
257 status
= this->ike_sa
->compute_secrets(this->ike_sa
,this->shared_secret
,this->sent_nonce
, this->received_nonce
);
258 if (status
!= SUCCESS
)
260 /* secrets could not be computed */
261 this->logger
->log(this->logger
, ERROR
| MORE
, "Secrets could not be computed!");
268 /****************************
272 * Send IKE_SA_AUTH request
276 ****************************/
279 /* set up the reply */
280 // status = this->ike_sa->build_message(this->ike_sa, IKE_SA_INIT, FALSE, &response);
281 // if (status != SUCCESS)
286 // response->destroy(response);
294 * Implements state_t.get_state
296 static ike_sa_state_t
get_state(private_ike_sa_init_requested_t
*this)
298 return IKE_SA_INIT_REQUESTED
;
302 * Implements state_t.get_state
304 static status_t
destroy(private_ike_sa_init_requested_t
*this)
306 this->logger
->log(this->logger
, CONTROL
| MORE
, "Going to destroy state of type ike_sa_init_requested_t");
308 this->logger
->log(this->logger
, CONTROL
| MOST
, "Destroy diffie hellman object");
309 this->diffie_hellman
->destroy(this->diffie_hellman
);
310 if (this->sent_nonce
.ptr
!= NULL
)
312 this->logger
->log(this->logger
, CONTROL
| MOST
, "Destroy sent nonce");
313 allocator_free(this->sent_nonce
.ptr
);
315 if (this->received_nonce
.ptr
!= NULL
)
317 this->logger
->log(this->logger
, CONTROL
| MOST
, "Destroy received nonce");
318 allocator_free(this->received_nonce
.ptr
);
321 if (this->shared_secret
.ptr
!= NULL
)
323 this->logger
->log(this->logger
, CONTROL
| MOST
, "Destroy shared secret");
324 allocator_free(this->shared_secret
.ptr
);
327 allocator_free(this);
332 * Described in header.
334 ike_sa_init_requested_t
*ike_sa_init_requested_create(protected_ike_sa_t
*ike_sa
,u_int16_t dh_group_priority
, diffie_hellman_t
*diffie_hellman
, chunk_t sent_nonce
)
336 private_ike_sa_init_requested_t
*this = allocator_alloc_thing(private_ike_sa_init_requested_t
);
343 /* interface functions */
344 this->public.state_interface
.process_message
= (status_t (*) (state_t
*,message_t
*)) process_message
;
345 this->public.state_interface
.get_state
= (ike_sa_state_t (*) (state_t
*)) get_state
;
346 this->public.state_interface
.destroy
= (status_t (*) (state_t
*)) destroy
;
349 this->ike_sa
= ike_sa
;
350 this->received_nonce
.ptr
= NULL
;
351 this->received_nonce
.len
= 0;
352 this->shared_secret
.ptr
= NULL
;
353 this->shared_secret
.len
= 0;
354 this->logger
= this->ike_sa
->get_logger(this->ike_sa
);
355 this->diffie_hellman
= diffie_hellman
;
356 this->sent_nonce
= sent_nonce
;
357 this->dh_group_priority
= dh_group_priority
;
359 return &(this->public);