Source/charon/sa/states/initiator_init.c

   1 /**
   2  * @file initiator_init.c
   3  *
   4  * @brief Start state of a IKE_SA as initiator
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005 Jan Hutter, Martin Willi
  10  * Hochschule fuer Technik Rapperswil
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License as published by the
  14  * Free Software Foundation; either version 2 of the License, or (at your
  15  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  19  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20  * for more details.
  21  */
  22
  23 #include "initiator_init.h"
  24
  25
  26 #include <globals.h>
  27 #include <sa/states/state.h>
  28 #include <sa/states/ike_sa_init_requested.h>
  29 #include <utils/allocator.h>
  30 #include <transforms/diffie_hellman.h>
  31 #include <encoding/payloads/sa_payload.h>
  32 #include <encoding/payloads/ke_payload.h>
  33 #include <encoding/payloads/nonce_payload.h>
  34
  35
  36 typedef struct private_initiator_init_t private_initiator_init_t;
  37
  38 /**
  39  * Private data of a initiator_init_t object.
  40  *
  41  */
  42 struct private_initiator_init_t {
  43         /**
  44          * Methods of the state_t interface.
  45          */
  46         initiator_init_t public;
  47
  48         /**
  49          * Assigned IKE_SA.
  50          */
  51         protected_ike_sa_t *ike_sa;
  52
  53         /**
  54          * Diffie hellman object used to generate public DH value.
  55          * This objet is passed to the next state of type ike_sa_init_requested_t.
  56          */
  57         diffie_hellman_t *diffie_hellman;
  58
  59         /**
  60          * DH group number.
  61          */
  62         u_int16_t dh_group_number;
  63
  64         /**
  65          * DH group priority used to get dh_group_number from configuration manager.
  66          * This priority is passed to the next state of type ike_sa_init_requested_t.
  67          */
  68         u_int16_t dh_group_priority;
  69
  70         /**
  71          * Sent nonce.
  72          * This nonce is passed to the next state of type ike_sa_init_requested_t.
  73          */
  74         chunk_t sent_nonce;
  75
  76         /**
  77          * Proposals used to initiate connection.
  78          *
  79          */
  80         linked_list_t *proposals;
  81
  82         /**
  83          * Logger used to log :-)
  84          *
  85          * Is logger of ike_sa!
  86          */
  87         logger_t *logger;
  88
  89         /**
  90          * Builds the IKE_SA_INIT request message.
  91          *
  92          * @param this          calling object
  93          * @param message       the created message will be stored at this location
  94          * @return
  95          *                                      - SUCCESS
  96          *                                      - OUT_OF_RES
  97          */
  98         status_t (*build_ike_sa_init_request) (private_initiator_init_t *this, message_t **message);
  99
 100         /**
 101          * Builds the SA payload for this state.
 102          *
 103          * @param this          calling object
 104          * @param payload       The generated SA payload object of type ke_payload_t is
 105          *                                      stored at this location.
 106          * @return
 107          *                                      - SUCCESS
 108          *                                      - OUT_OF_RES
 109          */
 110         status_t (*build_sa_payload) (private_initiator_init_t *this, payload_t **payload);
 111
 112         /**
 113          * Builds the KE payload for this state.
 114          *
 115          * @param this          calling object
 116          * @param payload       The generated KE payload object of type ke_payload_t is
 117          *                                      stored at this location.
 118          * @return
 119          *                                      - SUCCESS
 120          *                                      - OUT_OF_RES
 121          */
 122         status_t (*build_ke_payload) (private_initiator_init_t *this, payload_t **payload);
 123         /**
 124          * Builds the NONCE payload for this state.
 125          *
 126          * @param this          calling object
 127          * @param payload       The generated NONCE payload object of type ke_payload_t is
 128          *                                      stored at this location.
 129          * @return
 130          *                                      - SUCCESS
 131          *                                      - OUT_OF_RES
 132          */
 133         status_t (*build_nonce_payload) (private_initiator_init_t *this, payload_t **payload);
 134
 135         /**
 136          * Destroy function called internally of this class after state change succeeded.
 137          *
 138          * This destroy function does not destroy objects which were passed to the new state.
 139          *
 140          * @param this          calling object
 141          * @return                      SUCCESS in any case
 142          */
 143         status_t (*destroy_after_state_change) (private_initiator_init_t *this);
 144 };
 145
 146 /**
 147  * Implements function initiator_init_t.initiate_connection.
 148  */
 149 static status_t initiate_connection (private_initiator_init_t *this, char *name)
 150 {
 151         iterator_t      *proposal_iterator;
 152         ike_sa_init_requested_t         *next_state;
 153         message_t                               *message;
 154         packet_t                                *packet;
 155         status_t                                status;
 156         host_t                                  *my_host;
 157         host_t                                  *other_host;
 158         randomizer_t                            *randomizer;
 159
 160
 161         this->logger->log(this->logger, CONTROL, "Initializing connection %s",name);
 162
 163         status = global_configuration_manager->get_local_host(global_configuration_manager, name, &my_host);
 164         if (status != SUCCESS)
 165         {
 166                 this->logger->log(this->logger, ERROR | MORE, "Could not retrieve local host configuration information for %s",name);
 167                 return INVALID_ARG;
 168         }
 169         this->ike_sa->set_my_host(this->ike_sa,my_host);
 170
 171         status = global_configuration_manager->get_remote_host(global_configuration_manager, name, &other_host);
 172         if (status != SUCCESS)
 173         {
 174                 this->logger->log(this->logger, ERROR | MORE, "Could not retrieve remote host configuration information for %s",name);
 175                 return INVALID_ARG;
 176         }
 177         this->ike_sa->set_other_host(this->ike_sa,other_host);
 178
 179         status = global_configuration_manager->get_dh_group_number(global_configuration_manager, name, &(this->dh_group_number), this->dh_group_priority);
 180         if (status != SUCCESS)
 181         {
 182                 this->logger->log(this->logger, ERROR | MORE, "Could not retrieve DH group number configuration for %s",name);
 183                 return INVALID_ARG;
 184         }
 185
 186         status = this->proposals->create_iterator(this->proposals, &proposal_iterator, FALSE);
 187         if (status != SUCCESS)
 188         {
 189                 this->logger->log(this->logger, ERROR, "Fatal error: Could not create iterator on list for proposals");
 190                 return status;
 191         }
 192
 193         status = global_configuration_manager->get_proposals_for_host(global_configuration_manager, this->ike_sa->get_other_host(this->ike_sa), proposal_iterator);
 194         /* not needed anymore */
 195         proposal_iterator->destroy(proposal_iterator);
 196         if (status != SUCCESS)
 197         {
 198                 this->logger->log(this->logger, ERROR | MORE, "Could not retrieve Proposals for %s",name);
 199                 return status;
 200         }
 201
 202         /* a diffie hellman object could allready exist caused by an failed initiate_connection call */
 203         if (this->diffie_hellman == NULL)
 204         {
 205                 this    ->logger->log(this->logger, CONTROL|MOST, "create diffie hellman object");
 206                 this->diffie_hellman = diffie_hellman_create(this->dh_group_number);
 207         }
 208
 209         if (this->diffie_hellman == NULL)
 210         {
 211                 this->logger->log(this->logger, ERROR, "Object of type diffie_hellman_t could not be created!");
 212                 return FAILED;
 213         }
 214
 215         if (this->sent_nonce.ptr != NULL)
 216         {
 217                 this->logger->log(this->logger, ERROR, "Free existing sent nonce!");
 218                 allocator_free(this->sent_nonce.ptr);
 219                 this->sent_nonce = CHUNK_INITIALIZER;
 220         }
 221
 222         this    ->logger->log(this->logger, CONTROL|MOST, "Get pseudo random bytes for nonce");
 223         randomizer = this->ike_sa->get_randomizer(this->ike_sa);
 224         if (randomizer->allocate_pseudo_random_bytes(randomizer, NONCE_SIZE, &(this->sent_nonce)) != SUCCESS)
 225         {
 226                 this->logger->log(this->logger, ERROR, "Could not create nonce!");
 227                 return OUT_OF_RES;
 228         }
 229         this    ->logger->log(this->logger, RAW|MOST, "Nonce",&(this->sent_nonce));
 230
 231
 232
 233         status = this->build_ike_sa_init_request (this,&message);
 234         if (status != SUCCESS)
 235         {
 236                 this->logger->log(this->logger, ERROR, "Fatal error: could not build IKE_SA_INIT request message");
 237                 return status;
 238         }
 239
 240         /* generate packet */
 241         this->logger->log(this->logger, CONTROL|MOST, "generate packet from message");
 242         status = message->generate(message, &packet);
 243         if (status != SUCCESS)
 244         {
 245                 this->logger->log(this->logger, ERROR, "Fatal error: could not generate packet from message");
 246                 message->destroy(message);
 247                 return status;
 248         }
 249
 250         this->logger->log(this->logger, CONTROL|MOST, "Add packet to global send queue");
 251         status = global_send_queue->add(global_send_queue, packet);
 252         if (status != SUCCESS)
 253         {
 254                 this->logger->log(this->logger, ERROR, "Could not add packet to send queue");
 255                 packet->destroy(packet);
 256                 message->destroy(message);
 257                 return status;
 258         }
 259
 260         /* state can now be changed */
 261         this->logger->log(this->logger, CONTROL|MOST, "Create next state object");
 262         next_state = ike_sa_init_requested_create(this->ike_sa, this->dh_group_number, this->diffie_hellman, this->sent_nonce);
 263         if (next_state == NULL)
 264         {
 265                 this    ->logger->log(this->logger, ERROR, "Fatal error: could not create next state object of type ike_sa_init_requested_t");
 266                 message->destroy(message);
 267                 return FAILED;
 268         }
 269
 270         /* last message can now be set */
 271         status = this->ike_sa->set_last_requested_message(this->ike_sa, message);
 272
 273         if (status != SUCCESS)
 274         {
 275                 this->logger->log(this->logger, ERROR, "Could not set last requested message");
 276                 (next_state->state_interface).destroy(&(next_state->state_interface));
 277                 message->destroy(message);
 278                 return status;
 279         }
 280
 281         /* state can now be changed */
 282         this->ike_sa->set_new_state(this->ike_sa,(state_t *) next_state);
 283
 284         /* state has NOW changed :-) */
 285         this->logger->log(this->logger, CONTROL|MORE, "Changed state of IKE_SA from %s to %s",mapping_find(ike_sa_state_m,INITIATOR_INIT),mapping_find(ike_sa_state_m,IKE_SA_INIT_REQUESTED) );
 286
 287         this->logger->log(this->logger, CONTROL|MOST, "Destroy old sate object");
 288         this->destroy_after_state_change(this);
 289
 290         return SUCCESS;
 291 }
 292
 293 /**
 294  * implements private_initiator_init_t.build_ike_sa_init_request
 295  */
 296 static status_t build_ike_sa_init_request (private_initiator_init_t *this, message_t **request)
 297 {
 298         status_t status;
 299         payload_t *payload;
 300         message_t *message;
 301
 302         /* going to build message */
 303         this    ->logger->log(this->logger, CONTROL|MOST, "Going to build message");
 304         status = this->ike_sa->build_message(this->ike_sa, IKE_SA_INIT, TRUE, &message);
 305         if (status != SUCCESS)
 306         {
 307                 this->logger->log(this->logger, ERROR, "Could not build empty message");
 308                 return status;
 309         }
 310
 311         /* build SA payload */
 312         status = this->build_sa_payload(this, &payload);
 313         if (status != SUCCESS)
 314         {
 315                 this->logger->log(this->logger, ERROR, "Could not build SA payload");
 316                 message->destroy(message);
 317                 return status;
 318         }
 319
 320         this    ->logger->log(this->logger, CONTROL|MOST, "add SA payload to message");
 321         status = message->add_payload(message, payload);
 322         if (status != SUCCESS)
 323         {
 324                 this->logger->log(this->logger, ERROR, "Could not add SA payload to message");
 325                 payload->destroy(payload);
 326                 message->destroy(message);
 327                 return status;
 328         }
 329
 330         /* build KE payload */
 331         status = this->build_ke_payload(this, &payload);
 332         if (status != SUCCESS)
 333         {
 334                 this->logger->log(this->logger, ERROR, "Could not build KE payload");
 335                 message->destroy(message);
 336                 return status;
 337         }
 338
 339         this    ->logger->log(this->logger, CONTROL|MOST, "add KE payload to message");
 340         status = message->add_payload(message, payload);
 341         if (status != SUCCESS)
 342         {
 343                 this->logger->log(this->logger, ERROR, "Could not add KE payload to message");
 344                 payload->destroy(payload);
 345                 message->destroy(message);
 346                 return status;
 347         }
 348
 349         /* build Nonce payload */
 350         status = this->build_nonce_payload(this, &payload);
 351         if (status != SUCCESS)
 352         {
 353                 this->logger->log(this->logger, ERROR, "Could not build NONCE payload");
 354                 message->destroy(message);
 355                 return status;
 356         }
 357
 358         this    ->logger->log(this->logger, CONTROL|MOST, "add nonce payload to message");
 359         status = message->add_payload(message, payload);
 360         if (status != SUCCESS)
 361         {
 362                 this->logger->log(this->logger, ERROR, "Could not add nonce payload to message");
 363                 payload->destroy(payload);
 364                 message->destroy(message);
 365                 return status;
 366         }
 367
 368         *request = message;
 369         return SUCCESS;
 370 }
 371
 372 /**
 373  * implements private_initiator_init_t.build_sa_payload
 374  */
 375 static status_t build_sa_payload(private_initiator_init_t *this, payload_t **payload)
 376 {
 377         sa_payload_t* sa_payload;
 378         iterator_t *proposal_iterator;
 379         status_t status;
 380
 381         /* SA payload takes proposals from this->ike_sa_init_data.proposals and writes them to the created sa_payload */
 382
 383         this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
 384         status = this->proposals->create_iterator(this->proposals, &proposal_iterator, FALSE);
 385         if (status != SUCCESS)
 386         {
 387                 this->logger->log(this->logger, ERROR, "Fatal error: Could not create iterator on list for proposals");
 388                 return status;
 389         }
 390
 391         sa_payload = sa_payload_create();
 392         if (sa_payload == NULL)
 393         {
 394                 this->logger->log(this->logger, ERROR, "Fatal error: Could not create SA payload object");
 395                 return OUT_OF_RES;
 396         }
 397
 398         while (proposal_iterator->has_next(proposal_iterator))
 399         {
 400                 proposal_substructure_t *current_proposal;
 401                 proposal_substructure_t *current_proposal_clone;
 402                 status = proposal_iterator->current(proposal_iterator,(void **) &current_proposal);
 403                 if (status != SUCCESS)
 404                 {
 405                         this->logger->log(this->logger, ERROR, "Could not get current proposal needed to copy");
 406                         proposal_iterator->destroy(proposal_iterator);
 407                         sa_payload->destroy(sa_payload);
 408                         return status;
 409                 }
 410                 status = current_proposal->clone(current_proposal,&current_proposal_clone);
 411                 if (status != SUCCESS)
 412                 {
 413                         this->logger->log(this->logger, ERROR, "Could not clone current proposal");
 414                         proposal_iterator->destroy(proposal_iterator);
 415                         sa_payload->destroy(sa_payload);
 416                         return status;
 417                 }
 418
 419                 status = sa_payload->add_proposal_substructure(sa_payload,current_proposal_clone);
 420                 if (status != SUCCESS)
 421                 {
 422                         this->logger->log(this->logger, ERROR, "Could not add cloned proposal to SA payload");
 423                         proposal_iterator->destroy(proposal_iterator);
 424                         sa_payload->destroy(sa_payload);
 425                         return status;
 426                 }
 427
 428         }
 429         proposal_iterator->destroy(proposal_iterator);
 430
 431         this->logger->log(this->logger, CONTROL|MORE, "sa payload builded");
 432
 433         *payload = (payload_t *) sa_payload;
 434         return SUCCESS;
 435 }
 436
 437 /**
 438  * implements private_initiator_init_t.build_ke_payload
 439  */
 440 static status_t build_ke_payload(private_initiator_init_t *this, payload_t **payload)
 441 {
 442         ke_payload_t *ke_payload;
 443         chunk_t key_data;
 444         status_t status;
 445
 446         this->logger->log(this->logger, CONTROL|MORE, "building ke payload");
 447
 448
 449         this    ->logger->log(this->logger, CONTROL|MORE, "get public dh value to send in ke payload");
 450         status = this->diffie_hellman->get_my_public_value(this->diffie_hellman,&key_data);
 451         if (status != SUCCESS)
 452         {
 453                 this->logger->log(this->logger, ERROR, "Could not get my DH public value");
 454                 return status;
 455         }
 456
 457         ke_payload = ke_payload_create();
 458         if (ke_payload == NULL)
 459         {
 460                 this->logger->log(this->logger, ERROR, "Could not create KE payload");
 461                 allocator_free_chunk(&key_data);
 462                 return OUT_OF_RES;
 463         }
 464         ke_payload->set_dh_group_number(ke_payload, this->dh_group_number);
 465         if (ke_payload->set_key_exchange_data(ke_payload, key_data) != SUCCESS)
 466         {
 467                 this->logger->log(this->logger, ERROR, "Could not set key exchange data of KE payload");
 468                 ke_payload->destroy(ke_payload);
 469                 allocator_free_chunk(&key_data);
 470                 return OUT_OF_RES;
 471         }
 472         allocator_free_chunk(&key_data);
 473
 474         this->logger->log(this->logger, CONTROL|MORE, "ke payload builded");
 475
 476         *payload = (payload_t *) ke_payload;
 477         return SUCCESS;
 478 }
 479
 480 /**
 481  * implements private_initiator_init_t.build_nonce_payload
 482  */
 483 static status_t build_nonce_payload(private_initiator_init_t *this, payload_t **payload)
 484 {
 485         nonce_payload_t *nonce_payload;
 486         status_t status;
 487
 488         this->logger->log(this->logger, CONTROL|MORE, "building nonce payload");
 489
 490         nonce_payload = nonce_payload_create();
 491         if (nonce_payload == NULL)
 492         {
 493                 this->logger->log(this->logger, ERROR, "Fatal error: could not create nonce payload object");
 494                 return OUT_OF_RES;
 495         }
 496
 497         status = nonce_payload->set_nonce(nonce_payload, this->sent_nonce);
 498
 499         if (status != SUCCESS)
 500         {
 501                 this->logger->log(this->logger, ERROR, "Fatal error: could not set nonce data of payload");
 502                 nonce_payload->destroy(nonce_payload);
 503                 return status;
 504         }
 505
 506         *payload = (payload_t *) nonce_payload;
 507
 508         this->logger->log(this->logger, CONTROL|MORE, "nonce payload builded");
 509
 510         return SUCCESS;
 511 }
 512
 513 /**
 514  * Implements state_t.get_state
 515  */
 516 static status_t process_message(private_initiator_init_t *this, message_t *message, state_t **new_state)
 517 {
 518         *new_state = (state_t *) this;
 519         this->logger->log(this->logger, ERROR|MORE, "In state INITIATOR_INIT no message is processed");
 520         return FAILED;
 521 }
 522
 523 /**
 524  * Implements state_t.get_state
 525  */
 526 static ike_sa_state_t get_state(private_initiator_init_t *this)
 527 {
 528         return INITIATOR_INIT;
 529 }
 530
 531 /**
 532  * Implements state_t.get_state
 533  */
 534 static status_t destroy(private_initiator_init_t *this)
 535 {
 536         this->logger->log(this->logger, CONTROL | MORE, "Going to destroy initiator_init_t state object");
 537
 538         /* destroy stored proposal */
 539         this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
 540         while (this->proposals->get_count(this->proposals) > 0)
 541         {
 542                 proposal_substructure_t *current_proposal;
 543                 this->proposals->remove_first(this->proposals,(void **)&current_proposal);
 544                 current_proposal->destroy(current_proposal);
 545         }
 546         this->proposals->destroy(this->proposals);
 547
 548         /* destroy diffie hellman object */
 549         if (this->diffie_hellman != NULL)
 550         {
 551                 this->logger->log(this->logger, CONTROL | MOST, "Destroy diffie_hellman_t object");
 552                 this->diffie_hellman->destroy(this->diffie_hellman);
 553         }
 554         if (this->sent_nonce.ptr != NULL)
 555         {
 556                 this->logger->log(this->logger, CONTROL | MOST, "Free memory of sent nonce");
 557                 allocator_free(this->sent_nonce.ptr);
 558         }
 559
 560         allocator_free(this);
 561         return SUCCESS;
 562 }
 563
 564 /**
 565  * Implements private_initiator_init_t.destroy_after_state_change
 566  */
 567 static status_t destroy_after_state_change (private_initiator_init_t *this)
 568 {
 569         this->logger->log(this->logger, CONTROL | MORE, "Going to destroy initiator_init_t state object");
 570
 571         /* destroy stored proposal */
 572         this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
 573         while (this->proposals->get_count(this->proposals) > 0)
 574         {
 575                 proposal_substructure_t *current_proposal;
 576                 this->proposals->remove_first(this->proposals,(void **)&current_proposal);
 577                 current_proposal->destroy(current_proposal);
 578         }
 579         this->proposals->destroy(this->proposals);
 580         allocator_free(this);
 581         return SUCCESS;
 582 }
 583
 584 /*
 585  * Described in header.
 586  */
 587 initiator_init_t *initiator_init_create(protected_ike_sa_t *ike_sa)
 588 {
 589         private_initiator_init_t *this = allocator_alloc_thing(private_initiator_init_t);
 590
 591         if (this == NULL)
 592         {
 593                 return NULL;
 594         }
 595
 596         /* interface functions */
 597         this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
 598         this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
 599         this->public.state_interface.destroy  = (status_t (*) (state_t *)) destroy;
 600
 601         /* public functions */
 602         this->public.initiate_connection = (status_t (*)(initiator_init_t *, char *)) initiate_connection;
 603
 604         /* private functions */
 605         this->destroy_after_state_change = destroy_after_state_change;
 606         this->build_ike_sa_init_request = build_ike_sa_init_request;
 607         this->build_nonce_payload = build_nonce_payload;
 608         this->build_sa_payload = build_sa_payload;
 609         this->build_ke_payload = build_ke_payload;
 610
 611         /* private data */
 612         this->ike_sa = ike_sa;
 613         this->dh_group_priority = 1;
 614         this->logger = this->ike_sa->get_logger(this->ike_sa);
 615         this->proposals = linked_list_create();
 616         this->sent_nonce = CHUNK_INITIALIZER;
 617         if (this->proposals == NULL)
 618         {
 619                 allocator_free(this);
 620                 return NULL;
 621         }
 622
 623         return &(this->public);
 624 }