Source/charon/sa/states/ike_sa_init_requested.c

   1 /**
   2  * @file ike_sa_init_requested.c
   3  *
   4  * @brief State of a IKE_SA after requesting an IKE_SA_INIT
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005 Jan Hutter, Martin Willi
  10  * Hochschule fuer Technik Rapperswil
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License as published by the
  14  * Free Software Foundation; either version 2 of the License, or (at your
  15  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  19  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20  * for more details.
  21  */
  22
  23 #include "ike_sa_init_requested.h"
  24
  25 #include <globals.h>
  26 #include <utils/allocator.h>
  27 #include <encoding/payloads/sa_payload.h>
  28 #include <encoding/payloads/ke_payload.h>
  29 #include <encoding/payloads/nonce_payload.h>
  30 #include <transforms/diffie_hellman.h>
  31
  32
  33 typedef struct private_ike_sa_init_requested_t private_ike_sa_init_requested_t;
  34
  35 /**
  36  * Private data of a ike_sa_init_requested_t object.
  37  *
  38  */
  39 struct private_ike_sa_init_requested_t {
  40         /**
  41          * methods of the state_t interface
  42          */
  43         ike_sa_init_requested_t public;
  44
  45         /**
  46          * Assigned IKE_SA
  47          */
  48         protected_ike_sa_t *ike_sa;
  49
  50         /**
  51          * Diffie Hellman object used to compute shared secret
  52          */
  53         diffie_hellman_t *diffie_hellman;
  54
  55         /**
  56          * Shared secret of successful exchange
  57          */
  58         chunk_t shared_secret;
  59
  60         /**
  61          * Sent nonce value
  62          */
  63         chunk_t sent_nonce;
  64
  65         /**
  66          * Received nonce
  67          */
  68         chunk_t received_nonce;
  69
  70         /**
  71          * DH group priority used to get dh_group_number from configuration manager.
  72          *
  73          * Currently uused but usable if informational messages of unsupported dh group number are processed.
  74          */
  75         u_int16_t dh_group_priority;
  76
  77         /**
  78          * Logger used to log data
  79          *
  80          * Is logger of ike_sa!
  81          */
  82         logger_t *logger;
  83 };
  84
  85 /**
  86  * Implements state_t.get_state
  87  */
  88 static status_t process_message(private_ike_sa_init_requested_t *this, message_t *message)
  89 {
  90         status_t status;
  91         iterator_t *payloads;
  92         exchange_type_t exchange_type;
  93         u_int64_t responder_spi;
  94         ike_sa_id_t *ike_sa_id;
  95
  96
  97         exchange_type = message->get_exchange_type(message);
  98         if (exchange_type != IKE_SA_INIT)
  99         {
 100                 this->logger->log(this->logger, ERROR | MORE, "Message of type %s not supported in state ike_sa_init_requested",mapping_find(exchange_type_m,exchange_type));
 101                 return FAILED;
 102         }
 103
 104         if (message->get_request(message))
 105         {
 106                 this->logger->log(this->logger, ERROR | MORE, "Only responses of type IKE_SA_INIT supported in state ike_sa_init_requested");
 107                 return FAILED;
 108         }
 109
 110         /* parse incoming message */
 111         status = message->parse_body(message, NULL, NULL);
 112         if (status != SUCCESS)
 113         {
 114                 this->logger->log(this->logger, ERROR | MORE, "Could not parse body");
 115                 return status;
 116         }
 117
 118         responder_spi = message->get_responder_spi(message);
 119         ike_sa_id = this->ike_sa->public.get_id(&(this->ike_sa->public));
 120         ike_sa_id->set_responder_spi(ike_sa_id,responder_spi);
 121
 122         /* iterate over incoming payloads */
 123         message->get_payload_iterator(message, &payloads);
 124         while (payloads->has_next(payloads))
 125         {
 126                 payload_t *payload;
 127                 payloads->current(payloads, (void**)&payload);
 128
 129                 this->logger->log(this->logger, CONTROL|MORE, "Processing payload %s", mapping_find(payload_type_m, payload->get_type(payload)));
 130                 switch (payload->get_type(payload))
 131                 {
 132                         case SECURITY_ASSOCIATION:
 133                         {
 134                                 sa_payload_t *sa_payload = (sa_payload_t*)payload;
 135                                 iterator_t      *suggested_proposals;
 136                                 proposal_substructure_t *suggested_proposal;
 137                                 bool valid;
 138
 139
 140                                 /* get the list of suggested proposals */
 141                                 status = sa_payload->create_proposal_substructure_iterator(sa_payload, &suggested_proposals, TRUE);
 142                                 if (status != SUCCESS)
 143                                 {
 144                                         this->logger->log(this->logger, ERROR, "Fatal errror: Could not create iterator on suggested proposals");
 145                                         payloads->destroy(payloads);
 146                                         return status;
 147                                 }
 148
 149                                 /* now let the configuration-manager check the selected proposals*/
 150                                 this->logger->log(this->logger, CONTROL | MOST, "Check suggested proposals");
 151                                 status = global_configuration_manager->check_selected_proposals_for_host(global_configuration_manager,
 152                                                                         this->ike_sa->get_other_host(this->ike_sa), suggested_proposals,&valid);
 153                                 if (status != SUCCESS)
 154                                 {
 155                                         this->logger->log(this->logger, ERROR | MORE, "Could not check suggested proposals!");
 156                                         suggested_proposals->destroy(suggested_proposals);
 157                                         payloads->destroy(payloads);
 158                                         return status;
 159                                 }
 160
 161                                 if (!valid)
 162                                 {
 163                                         this->logger->log(this->logger, ERROR | MORE, "Suggested proposals not accepted!");
 164                                         payloads->destroy(payloads);
 165                                         return status;
 166                                 }
 167
 168
 169                                 /* let the ike_sa create their own transforms from proposal informations */
 170                                 suggested_proposals->reset(suggested_proposals);
 171                                 /* TODO check for true*/
 172                                 suggested_proposals->has_next(suggested_proposals);
 173                                 status = suggested_proposals->current(suggested_proposals,(void **)&suggested_proposal);
 174                                 suggested_proposals->destroy(suggested_proposals);
 175                                 if (status != SUCCESS)
 176                                 {
 177                                         this->logger->log(this->logger, ERROR | MORE, "Could not get first proposal");
 178                                         payloads->destroy(payloads);
 179                                         return status;
 180                                 }
 181
 182                                 status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,suggested_proposal);
 183                                 if (status != SUCCESS)
 184                                 {
 185                                         this->logger->log(this->logger, ERROR | MORE, "Transform objects could not be created from selected proposal");
 186                                         payloads->destroy(payloads);
 187                                         return status;
 188                                 }
 189
 190
 191                                 /* ok, we have what we need for sa_payload */
 192                                 break;
 193                         }
 194                         case KEY_EXCHANGE:
 195                         {
 196                                 ke_payload_t *ke_payload = (ke_payload_t*)payload;
 197
 198                                 status = this->diffie_hellman->set_other_public_value(this->diffie_hellman, ke_payload->get_key_exchange_data(ke_payload));
 199                                 if (status != SUCCESS)
 200                                 {
 201                                         this->logger->log(this->logger, ERROR, "Could not set other public value for DH exchange. Status %s",mapping_find(status_m,status));
 202                                         payloads->destroy(payloads);
 203                                         return OUT_OF_RES;
 204                                 }
 205
 206                                 /* shared secret is computed AFTER processing of all payloads... */
 207                                 break;
 208                         }
 209                         case NONCE:
 210                         {
 211                                 nonce_payload_t         *nonce_payload = (nonce_payload_t*)payload;
 212
 213                                 if (this->received_nonce.ptr != NULL)
 214                                 {
 215                                         this->logger->log(this->logger, CONTROL | MOST, "Destroy existing received nonce");
 216                                         allocator_free(this->received_nonce.ptr);
 217                                         this->received_nonce.ptr = NULL;
 218                                         this->received_nonce.len = 0;
 219                                 }
 220
 221                                 status = nonce_payload->get_nonce(nonce_payload, &(this->received_nonce));
 222                                 if (status != SUCCESS)
 223                                 {
 224                                         this->logger->log(this->logger, ERROR, "Fatal error: Could not get received nonce");
 225                                         payloads->destroy(payloads);
 226                                         return OUT_OF_RES;
 227                                 }
 228
 229                                 break;
 230                         }
 231                         default:
 232                         {
 233                                 this->logger->log(this->logger, ERROR, "Fatal errror: Payload type not supported!!!!");
 234                                 payloads->destroy(payloads);
 235                                 return FAILED;
 236                         }
 237
 238                 }
 239
 240         }
 241         payloads->destroy(payloads);
 242
 243         if (this->shared_secret.ptr != NULL)
 244         {
 245                 this->logger->log(this->logger, CONTROL | MOST, "Destroy existing shared_secret");
 246                 allocator_free(this->shared_secret.ptr);
 247                 this->shared_secret.ptr = NULL;
 248                 this->shared_secret.len = 0;
 249         }
 250
 251
 252         /* store shared secret  */
 253         this->logger->log(this->logger, CONTROL | MOST, "Retrieve shared secret and store it");
 254         status = this->diffie_hellman->get_shared_secret(this->diffie_hellman, &(this->shared_secret));
 255         this->logger->log_chunk(this->logger, PRIVATE, "Shared secret", &this->shared_secret);
 256
 257         status = this->ike_sa->compute_secrets(this->ike_sa,this->shared_secret,this->sent_nonce, this->received_nonce);
 258         if (status != SUCCESS)
 259         {
 260                 /* secrets could not be computed */
 261                 this->logger->log(this->logger, ERROR | MORE, "Secrets could not be computed!");
 262                 return status;
 263         }
 264
 265
 266
 267
 268         /****************************
 269          *
 270          *  TODO
 271          *
 272          * Send IKE_SA_AUTH request
 273          *
 274          * Make state change
 275          *
 276          ****************************/
 277
 278
 279         /* set up the reply */
 280 //      status = this->ike_sa->build_message(this->ike_sa, IKE_SA_INIT, FALSE, &response);
 281 //      if (status != SUCCESS)
 282 //      {
 283 //              return status;
 284 //      }
 285
 286 //      response->destroy(response);
 287
 288
 289
 290         return SUCCESS;
 291 }
 292
 293 /**
 294  * Implements state_t.get_state
 295  */
 296 static ike_sa_state_t get_state(private_ike_sa_init_requested_t *this)
 297 {
 298         return IKE_SA_INIT_REQUESTED;
 299 }
 300
 301 /**
 302  * Implements state_t.get_state
 303  */
 304 static status_t destroy(private_ike_sa_init_requested_t *this)
 305 {
 306         this->logger->log(this->logger, CONTROL | MORE, "Going to destroy state of type ike_sa_init_requested_t");
 307
 308         this->logger->log(this->logger, CONTROL | MOST, "Destroy diffie hellman object");
 309         this->diffie_hellman->destroy(this->diffie_hellman);
 310         if (this->sent_nonce.ptr != NULL)
 311         {
 312                 this->logger->log(this->logger, CONTROL | MOST, "Destroy sent nonce");
 313                 allocator_free(this->sent_nonce.ptr);
 314         }
 315         if (this->received_nonce.ptr != NULL)
 316         {
 317                 this->logger->log(this->logger, CONTROL | MOST, "Destroy received nonce");
 318                 allocator_free(this->received_nonce.ptr);
 319         }
 320
 321         if (this->shared_secret.ptr != NULL)
 322         {
 323                 this->logger->log(this->logger, CONTROL | MOST, "Destroy shared secret");
 324                 allocator_free(this->shared_secret.ptr);
 325         }
 326
 327         allocator_free(this);
 328         return SUCCESS;
 329 }
 330
 331 /*
 332  * Described in header.
 333  */
 334 ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa,u_int16_t dh_group_priority, diffie_hellman_t *diffie_hellman, chunk_t sent_nonce)
 335 {
 336         private_ike_sa_init_requested_t *this = allocator_alloc_thing(private_ike_sa_init_requested_t);
 337
 338         if (this == NULL)
 339         {
 340                 return NULL;
 341         }
 342
 343         /* interface functions */
 344         this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
 345         this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
 346         this->public.state_interface.destroy  = (status_t (*) (state_t *)) destroy;
 347
 348         /* private data */
 349         this->ike_sa = ike_sa;
 350         this->received_nonce.ptr = NULL;
 351         this->received_nonce.len = 0;
 352         this->shared_secret.ptr = NULL;
 353         this->shared_secret.len = 0;
 354         this->logger = this->ike_sa->get_logger(this->ike_sa);
 355         this->diffie_hellman = diffie_hellman;
 356         this->sent_nonce = sent_nonce;
 357         this->dh_group_priority = dh_group_priority;
 358
 359         return &(this->public);
 360 }