- implemented sa_config
[strongswan.git] / Source / charon / sa / states / ike_sa_init_requested.c
1 /**
2 * @file ike_sa_init_requested.c
3 *
4 * @brief Implementation of ike_sa_init_requested_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include "ike_sa_init_requested.h"
24
25 #include <daemon.h>
26 #include <utils/allocator.h>
27 #include <encoding/payloads/sa_payload.h>
28 #include <encoding/payloads/ke_payload.h>
29 #include <encoding/payloads/nonce_payload.h>
30 #include <encoding/payloads/id_payload.h>
31 #include <encoding/payloads/auth_payload.h>
32 #include <transforms/diffie_hellman.h>
33 #include <sa/states/ike_auth_requested.h>
34
35
36 typedef struct private_ike_sa_init_requested_t private_ike_sa_init_requested_t;
37
38 /**
39 * Private data of a ike_sa_init_requested_t object.
40 *
41 */
42 struct private_ike_sa_init_requested_t {
43 /**
44 * methods of the state_t interface
45 */
46 ike_sa_init_requested_t public;
47
48 /**
49 * Assigned IKE_SA
50 */
51 protected_ike_sa_t *ike_sa;
52
53 /**
54 * Diffie Hellman object used to compute shared secret
55 */
56 diffie_hellman_t *diffie_hellman;
57
58 /**
59 * Shared secret of successful exchange
60 */
61 chunk_t shared_secret;
62
63 /**
64 * Sent nonce value
65 */
66 chunk_t sent_nonce;
67
68 /**
69 * Received nonce
70 */
71 chunk_t received_nonce;
72
73 /**
74 * DH group priority used to get dh_group_number from configuration manager.
75 *
76 * Currently uused but usable if informational messages of unsupported dh group number are processed.
77 */
78 u_int16_t dh_group_priority;
79
80 /**
81 * Logger used to log data
82 *
83 * Is logger of ike_sa!
84 */
85 logger_t *logger;
86
87 /**
88 * Builds the IKE_SA_AUTH request message.
89 *
90 * @param this calling object
91 * @param message the created message will be stored at this location
92 */
93 void (*build_ike_auth_request) (private_ike_sa_init_requested_t *this, message_t **message);
94
95 /**
96 * Builds the id payload for this state.
97 *
98 * @param this calling object
99 * @param payload The generated payload object of type id_payload_t is
100 * stored at this location.
101 */
102 void (*build_id_payload) (private_ike_sa_init_requested_t *this, payload_t **payload);
103
104 /**
105 * Builds the id payload for this state.
106 *
107 * @param this calling object
108 * @param payload The generated payload object of type auth_payload_t is
109 * stored at this location.
110 */
111 void (*build_auth_payload) (private_ike_sa_init_requested_t *this, payload_t **payload);
112
113 /**
114 * Destroy function called internally of this class after state change succeeded.
115 *
116 * This destroy function does not destroy objects which were passed to the new state.
117 *
118 * @param this calling object
119 */
120 void (*destroy_after_state_change) (private_ike_sa_init_requested_t *this);
121 };
122
123 /**
124 * Implements state_t.get_state
125 */
126 static status_t process_message(private_ike_sa_init_requested_t *this, message_t *reply)
127 {
128 status_t status;
129 iterator_t *payloads;
130 exchange_type_t exchange_type;
131 message_t *request;
132 packet_t *packet;
133 u_int64_t responder_spi;
134 ike_sa_id_t *ike_sa_id;
135 ike_auth_requested_t *next_state;
136
137
138 exchange_type = reply->get_exchange_type(reply);
139 if (exchange_type != IKE_SA_INIT)
140 {
141 this->logger->log(this->logger, ERROR | MORE, "Message of type %s not supported in state ike_sa_init_requested",mapping_find(exchange_type_m,exchange_type));
142 return FAILED;
143 }
144
145 if (reply->get_request(reply))
146 {
147 this->logger->log(this->logger, ERROR | MORE, "Only responses of type IKE_SA_INIT supported in state ike_sa_init_requested");
148 return FAILED;
149 }
150
151 /* parse incoming message */
152 status = reply->parse_body(reply, NULL, NULL);
153 if (status != SUCCESS)
154 {
155 this->logger->log(this->logger, ERROR | MORE, "Could not parse body");
156 return status;
157 }
158
159 responder_spi = reply->get_responder_spi(reply);
160 ike_sa_id = this->ike_sa->public.get_id(&(this->ike_sa->public));
161 ike_sa_id->set_responder_spi(ike_sa_id,responder_spi);
162
163 /* iterate over incoming payloads */
164 payloads = reply->get_payload_iterator(reply);
165 while (payloads->has_next(payloads))
166 {
167 payload_t *payload;
168 payloads->current(payloads, (void**)&payload);
169
170 this->logger->log(this->logger, CONTROL|MORE, "Processing payload %s", mapping_find(payload_type_m, payload->get_type(payload)));
171 switch (payload->get_type(payload))
172 {
173 case SECURITY_ASSOCIATION:
174 {
175 sa_payload_t *sa_payload = (sa_payload_t*)payload;
176 iterator_t *suggested_proposals;
177 proposal_substructure_t *suggested_proposal;
178 bool valid;
179
180
181 /* get the list of suggested proposals */
182 suggested_proposals = sa_payload->create_proposal_substructure_iterator(sa_payload, TRUE);
183
184
185 /* now let the configuration-manager check the selected proposals*/
186 this->logger->log(this->logger, CONTROL | MOST, "Check suggested proposals");
187 status = charon->configuration_manager->check_selected_proposals_for_host(charon->configuration_manager,
188 this->ike_sa->get_other_host(this->ike_sa), suggested_proposals,&valid);
189 if (status != SUCCESS)
190 {
191 this->logger->log(this->logger, ERROR | MORE, "Could not check suggested proposals!");
192 suggested_proposals->destroy(suggested_proposals);
193 payloads->destroy(payloads);
194 return status;
195 }
196
197 if (!valid)
198 {
199 this->logger->log(this->logger, ERROR | MORE, "Suggested proposals not accepted!");
200 payloads->destroy(payloads);
201 return status;
202 }
203
204
205 /* let the ike_sa create their own transforms from proposal informations */
206 suggested_proposals->reset(suggested_proposals);
207 /* TODO check for true*/
208 suggested_proposals->has_next(suggested_proposals);
209 status = suggested_proposals->current(suggested_proposals,(void **)&suggested_proposal);
210 suggested_proposals->destroy(suggested_proposals);
211 if (status != SUCCESS)
212 {
213 this->logger->log(this->logger, ERROR | MORE, "Could not get first proposal");
214 payloads->destroy(payloads);
215 return status;
216 }
217
218 status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,suggested_proposal);
219 if (status != SUCCESS)
220 {
221 this->logger->log(this->logger, ERROR | MORE, "Transform objects could not be created from selected proposal");
222 payloads->destroy(payloads);
223 return status;
224 }
225
226
227 /* ok, we have what we need for sa_payload */
228 break;
229 }
230 case KEY_EXCHANGE:
231 {
232 ke_payload_t *ke_payload = (ke_payload_t*)payload;
233
234 this->diffie_hellman->set_other_public_value(this->diffie_hellman, ke_payload->get_key_exchange_data(ke_payload));
235
236 /* shared secret is computed AFTER processing of all payloads... */
237 break;
238 }
239 case NONCE:
240 {
241 nonce_payload_t *nonce_payload = (nonce_payload_t*)payload;
242
243 allocator_free(this->received_nonce.ptr);
244 this->received_nonce = CHUNK_INITIALIZER;
245
246 nonce_payload->get_nonce(nonce_payload, &(this->received_nonce));
247 break;
248 }
249 default:
250 {
251 this->logger->log(this->logger, ERROR, "Payload type not supported!!!!");
252 payloads->destroy(payloads);
253 return FAILED;
254 }
255
256 }
257
258 }
259 payloads->destroy(payloads);
260
261 allocator_free(this->shared_secret.ptr);
262 this->shared_secret = CHUNK_INITIALIZER;
263
264 /* store shared secret */
265 this->logger->log(this->logger, CONTROL | MOST, "Retrieve shared secret and store it");
266 status = this->diffie_hellman->get_shared_secret(this->diffie_hellman, &(this->shared_secret));
267 this->logger->log_chunk(this->logger, PRIVATE, "Shared secret", &this->shared_secret);
268
269 this->ike_sa->compute_secrets(this->ike_sa,this->shared_secret,this->sent_nonce, this->received_nonce);
270
271 /* build the complete IKE_AUTH request */
272 this->build_ike_auth_request (this,&request);
273
274 /* generate packet */
275 this->logger->log(this->logger, CONTROL|MOST, "generate packet from message");
276
277 status = request->generate(request, this->ike_sa->get_crypter_initiator(this->ike_sa), this->ike_sa->get_signer_initiator(this->ike_sa), &packet);
278 if (status != SUCCESS)
279 {
280 this->logger->log(this->logger, ERROR, "could not generate packet from message");
281 reply->destroy(reply);
282 return status;
283 }
284
285 this->logger->log(this->logger, CONTROL|MOST, "Add packet to global send queue");
286 charon->send_queue->add(charon->send_queue, packet);
287
288 /* state can now be changed */
289 this->logger->log(this->logger, CONTROL|MOST, "Create next state object");
290 next_state = ike_auth_requested_create(this->ike_sa);
291
292 /* last message can now be set */
293 status = this->ike_sa->set_last_requested_message(this->ike_sa, request);
294
295 if (status != SUCCESS)
296 {
297 this->logger->log(this->logger, ERROR, "Could not set last requested message");
298 (next_state->state_interface).destroy(&(next_state->state_interface));
299 request->destroy(request);
300 return status;
301 }
302
303 /* state can now be changed */
304 this->ike_sa->set_new_state(this->ike_sa,(state_t *) next_state);
305
306 /* state has NOW changed :-) */
307 this->logger->log(this->logger, CONTROL|MORE, "Changed state of IKE_SA from %s to %s", mapping_find(ike_sa_state_m,IKE_SA_INIT_REQUESTED),mapping_find(ike_sa_state_m,IKE_AUTH_REQUESTED) );
308
309 this->logger->log(this->logger, CONTROL|MOST, "Destroy old sate object");
310 this->destroy_after_state_change(this);
311
312 return SUCCESS;
313 }
314
315 /**
316 * implements private_ike_sa_init_requested_t.build_ike_auth_request
317 */
318 static void build_ike_auth_request (private_ike_sa_init_requested_t *this, message_t **request)
319 {
320 payload_t *payload;
321 message_t *message;
322
323 /* going to build message */
324 this->logger->log(this->logger, CONTROL|MOST, "Going to build empty message");
325 this->ike_sa->build_message(this->ike_sa, IKE_AUTH, TRUE, &message);
326
327
328 /* build id payload */
329 this->build_id_payload(this, &payload);
330 this->logger->log(this->logger, CONTROL|MOST, "add ID payload to message");
331 message->add_payload(message, payload);
332
333 /* build auth payload */
334 this->build_auth_payload(this, &payload);
335 this->logger->log(this->logger, CONTROL|MOST, "add AUTH payload to message");
336 message->add_payload(message, payload);
337
338 *request = message;
339 }
340
341 /**
342 * Implementation of private_ike_sa_init_requested_t.build_id_payload.
343 */
344 static void build_id_payload (private_ike_sa_init_requested_t *this, payload_t **payload)
345 {
346 id_payload_t *id_payload;
347 chunk_t email;
348
349 /* create IDi */
350 id_payload = id_payload_create(TRUE);
351 /* TODO special functions on id payload */
352 /* TODO configuration manager request */
353 id_payload->set_id_type(id_payload,ID_RFC822_ADDR);
354 email.ptr = "moerdi@hsr.ch";
355 email.len = strlen(email.ptr)+1;
356 this->logger->log_chunk(this->logger, CONTROL, "Moerdi",&email);
357 id_payload->set_data(id_payload,email);
358
359 *payload = (payload_t *) id_payload;
360 }
361
362 /**
363 * Implementation of private_ike_sa_init_requested_t.build_auth_payload.
364 */
365 static void build_auth_payload (private_ike_sa_init_requested_t *this, payload_t **payload)
366 {
367 auth_payload_t *auth_payload;
368 chunk_t auth_data;
369
370 /* create IDi */
371 auth_payload = auth_payload_create();
372 /* TODO configuration manager request */
373 auth_payload->set_auth_method(auth_payload,RSA_DIGITAL_SIGNATURE);
374 auth_data.ptr = "this is the key";
375 auth_data.len = strlen(auth_data.ptr);
376 this->logger->log_chunk(this->logger, CONTROL, "Auth Data",&auth_data);
377 auth_payload->set_data(auth_payload,auth_data);
378 *payload = (payload_t *) auth_payload;
379 }
380
381 /**
382 * Implements state_t.get_state
383 */
384 static ike_sa_state_t get_state(private_ike_sa_init_requested_t *this)
385 {
386 return IKE_SA_INIT_REQUESTED;
387 }
388
389 /**
390 * Implements private_ike_sa_init_requested_t.destroy_after_state_change
391 */
392 static void destroy_after_state_change (private_ike_sa_init_requested_t *this)
393 {
394 this->logger->log(this->logger, CONTROL | MORE, "Going to destroy state of type ike_sa_init_requested_t after state change");
395
396 this->logger->log(this->logger, CONTROL | MOST, "Destroy diffie hellman object");
397 this->diffie_hellman->destroy(this->diffie_hellman);
398
399 allocator_free(this->sent_nonce.ptr);
400 allocator_free(this->received_nonce.ptr);
401 allocator_free(this->shared_secret.ptr);
402 allocator_free(this);
403
404 }
405
406 /**
407 * Implements state_t.get_state
408 */
409 static void destroy(private_ike_sa_init_requested_t *this)
410 {
411 this->logger->log(this->logger, CONTROL | MORE, "Going to destroy state of type ike_sa_init_requested_t");
412
413 this->logger->log(this->logger, CONTROL | MOST, "Destroy diffie hellman object");
414 this->diffie_hellman->destroy(this->diffie_hellman);
415
416 allocator_free(this->sent_nonce.ptr);
417 allocator_free(this->received_nonce.ptr);
418 allocator_free(this->shared_secret.ptr);
419 allocator_free(this);
420 }
421
422 /*
423 * Described in header.
424 */
425 ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa,u_int16_t dh_group_priority, diffie_hellman_t *diffie_hellman, chunk_t sent_nonce)
426 {
427 private_ike_sa_init_requested_t *this = allocator_alloc_thing(private_ike_sa_init_requested_t);
428
429 /* interface functions */
430 this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
431 this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
432 this->public.state_interface.destroy = (void (*) (state_t *)) destroy;
433
434 /* private functions */
435 this->build_ike_auth_request = build_ike_auth_request;
436 this->build_id_payload = build_id_payload;
437 this->build_auth_payload = build_auth_payload;
438 this->destroy_after_state_change = destroy_after_state_change;
439
440 /* private data */
441 this->ike_sa = ike_sa;
442 this->received_nonce = CHUNK_INITIALIZER;
443 this->shared_secret = CHUNK_INITIALIZER;
444 this->logger = this->ike_sa->get_logger(this->ike_sa);
445 this->diffie_hellman = diffie_hellman;
446 this->sent_nonce = sent_nonce;
447 this->dh_group_priority = dh_group_priority;
448
449 return &(this->public);
450 }