Source/charon/sa/states/responder_init.c

   1 /**
   2  * @file responder_init.c
   3  *
   4  * @brief Implementation of responder_init_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005 Jan Hutter, Martin Willi
  10  * Hochschule fuer Technik Rapperswil
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License as published by the
  14  * Free Software Foundation; either version 2 of the License, or (at your
  15  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  19  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20  * for more details.
  21  */
  22
  23 #include "responder_init.h"
  24
  25 #include <globals.h>
  26 #include <sa/states/state.h>
  27 #include <sa/states/ike_sa_init_responded.h>
  28 #include <utils/allocator.h>
  29 #include <encoding/payloads/sa_payload.h>
  30 #include <encoding/payloads/ke_payload.h>
  31 #include <encoding/payloads/nonce_payload.h>
  32 #include <transforms/diffie_hellman.h>
  33
  34
  35 typedef struct private_responder_init_t private_responder_init_t;
  36
  37 /**
  38  * Private data of a responder_init_t object.
  39  *
  40  */
  41 struct private_responder_init_t {
  42         /**
  43          * Methods of the state_t interface.
  44          */
  45         responder_init_t public;
  46
  47         /**
  48          * Assigned IKE_SA.
  49          */
  50         protected_ike_sa_t *ike_sa;
  51
  52         /**
  53          * Diffie Hellman object used to compute shared secret.
  54          *
  55          * After processing of incoming IKE_SA_INIT-Request the shared key is
  56          * passed to the next state of type ike_sa_init_responded_t.
  57          */
  58         diffie_hellman_t *diffie_hellman;
  59
  60         /**
  61          * Diffie Hellman group number.
  62          */
  63         u_int16_t dh_group_number;
  64
  65         /**
  66          * Priority used to get matching dh_group number.
  67          */
  68         u_int16_t dh_group_priority;
  69
  70         /**
  71          * Sent nonce value.
  72          *
  73          * This value is passed to the next state of type ike_sa_init_responded_t.
  74          */
  75         chunk_t sent_nonce;
  76
  77         /**
  78          * Received nonce value
  79          *
  80          * This value is passed to the next state of type ike_sa_init_responded_t.
  81          */
  82         chunk_t received_nonce;
  83
  84         /**
  85          * Logger used to log data
  86          *
  87          * Is logger of ike_sa!
  88          */
  89         logger_t *logger;
  90
  91         /**
  92          * Proposals used to initiate connection
  93          */
  94         linked_list_t *proposals;
  95
  96         /**
  97          * Builds the SA payload for this state.
  98          *
  99          * @param this          calling object
 100          * @param payload       The generated SA payload object of type ke_payload_t is
 101          *                                      stored at this location.
 102          */
 103         void (*build_sa_payload) (private_responder_init_t *this, payload_t **payload);
 104
 105         /**
 106          * Builds the KE payload for this state.
 107          *
 108          * @param this          calling object
 109          * @param payload       The generated KE payload object of type ke_payload_t is
 110          *                                      stored at this location.
 111          */
 112         void (*build_ke_payload) (private_responder_init_t *this, payload_t **payload);
 113
 114         /**
 115          * Builds the NONCE payload for this state.
 116          *
 117          * @param this          calling object
 118          * @param payload       The generated NONCE payload object of type ke_payload_t is
 119          *                                      stored at this location.
 120          */
 121         void (*build_nonce_payload) (private_responder_init_t *this, payload_t **payload);
 122
 123         /**
 124          * Destroy function called internally of this class after state change succeeded.
 125          *
 126          * This destroy function does not destroy objects which were passed to the new state.
 127          *
 128          * @param this          calling object
 129          */
 130         void (*destroy_after_state_change) (private_responder_init_t *this);
 131 };
 132
 133 /**
 134  * Implements state_t.get_state
 135  */
 136 static status_t process_message(private_responder_init_t *this, message_t *message)
 137 {
 138         iterator_t *payloads;
 139         host_t *source, *destination;
 140         status_t status;
 141         message_t *response;
 142         payload_t *payload;
 143         packet_t *packet;
 144         chunk_t shared_secret;
 145         exchange_type_t exchange_type;
 146         ike_sa_init_responded_t *next_state;
 147         host_t *my_host;
 148         host_t *other_host;
 149         randomizer_t *randomizer;
 150
 151         exchange_type = message->get_exchange_type(message);
 152         if (exchange_type != IKE_SA_INIT)
 153         {
 154                 this->logger->log(this->logger, ERROR | MORE, "Message of type %s not supported in state responder_init",mapping_find(exchange_type_m,exchange_type));
 155                 return FAILED;
 156         }
 157
 158         if (!message->get_request(message))
 159         {
 160                 this->logger->log(this->logger, ERROR | MORE, "Only requests of type IKE_SA_INIT supported in state responder_init");
 161                 return FAILED;
 162         }
 163
 164         /* this is the first message we process, so copy host infos */
 165         message->get_source(message, &source);
 166         message->get_destination(message, &destination);
 167
 168         /* we need to clone them, since we destroy the message later */
 169         my_host = destination->clone(destination);
 170         other_host = source->clone(source);
 171
 172         this->ike_sa->set_my_host(this->ike_sa, my_host);
 173         this->ike_sa->set_other_host(this->ike_sa, other_host);
 174
 175         /* parse incoming message */
 176         status = message->parse_body(message, NULL, NULL);
 177         if (status != SUCCESS)
 178         {
 179                 this->logger->log(this->logger, ERROR | MORE, "Could not parse body of request message");
 180                 return status;
 181         }
 182
 183         /* iterate over incoming payloads. We can be sure, the message contains only accepted payloads! */
 184         message->get_payload_iterator(message, &payloads);
 185
 186         while (payloads->has_next(payloads))
 187         {
 188                 payload_t *payload;
 189
 190                 /* get current payload */
 191                 payloads->current(payloads, (void**)&payload);
 192
 193                 this->logger->log(this->logger, CONTROL|MORE, "Processing payload of type %s", mapping_find(payload_type_m, payload->get_type(payload)));
 194                 switch (payload->get_type(payload))
 195                 {
 196                         case SECURITY_ASSOCIATION:
 197                         {
 198                                 sa_payload_t *sa_payload = (sa_payload_t*)payload;
 199                                 iterator_t *suggested_proposals, *accepted_proposals;
 200                                 proposal_substructure_t *accepted_proposal;
 201
 202                                 this->proposals->create_iterator(this->proposals, &accepted_proposals, FALSE);
 203
 204                                 /* get the list of suggested proposals */
 205                                 sa_payload->create_proposal_substructure_iterator(sa_payload, &suggested_proposals, TRUE);
 206
 207                                 /* now let the configuration-manager select a subset of the proposals */
 208                                 status = global_configuration_manager->select_proposals_for_host(global_configuration_manager,
 209                                                                         this->ike_sa->get_other_host(this->ike_sa), suggested_proposals, accepted_proposals);
 210                                 if (status != SUCCESS)
 211                                 {
 212                                         this->logger->log(this->logger, CONTROL | MORE, "No proposal of suggested proposals selected");
 213                                         suggested_proposals->destroy(suggested_proposals);
 214                                         accepted_proposals->destroy(accepted_proposals);
 215                                         payloads->destroy(payloads);
 216                                         return status;
 217                                 }
 218
 219                                 /* iterators are not needed anymore */
 220                                 suggested_proposals->destroy(suggested_proposals);
 221
 222                                 /* let the ike_sa create their own transforms from proposal informations */
 223                                 accepted_proposals->reset(accepted_proposals);
 224                                 /* TODO check for true*/
 225                                 accepted_proposals->has_next(accepted_proposals);
 226                                 status = accepted_proposals->current(accepted_proposals,(void **)&accepted_proposal);
 227                                 if (status != SUCCESS)
 228                                 {
 229                                         this->logger->log(this->logger, ERROR | MORE, "Accepted proposals not supported?!");
 230                                         accepted_proposals->destroy(accepted_proposals);
 231                                         payloads->destroy(payloads);
 232                                         return status;
 233                                 }
 234
 235                                 status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,accepted_proposal);
 236                                 accepted_proposals->destroy(accepted_proposals);
 237                                 if (status != SUCCESS)
 238                                 {
 239                                         this->logger->log(this->logger, ERROR | MORE, "Transform objects could not be created from selected proposal");
 240                                         payloads->destroy(payloads);
 241                                         return status;
 242                                 }
 243
 244                                 this->logger->log(this->logger, CONTROL | MORE, "SA Payload processed");
 245                                 /* ok, we have what we need for sa_payload (proposals are stored in this->proposals)*/
 246                                 break;
 247                         }
 248                         case KEY_EXCHANGE:
 249                         {
 250                                 ke_payload_t *ke_payload = (ke_payload_t*)payload;
 251                                 diffie_hellman_group_t group;
 252                                 diffie_hellman_t *dh;
 253                                 bool allowed_group;
 254
 255                                 group = ke_payload->get_dh_group_number(ke_payload);
 256
 257                                 status = global_configuration_manager->is_dh_group_allowed_for_host(global_configuration_manager,
 258                                                                 this->ike_sa->get_other_host(this->ike_sa), group, &allowed_group);
 259
 260                                 if (status != SUCCESS)
 261                                 {
 262                                         this->logger->log(this->logger, ERROR | MORE, "Could not get informations about DH group");
 263                                         payloads->destroy(payloads);
 264                                         return status;
 265                                 }
 266                                 if (!allowed_group)
 267                                 {
 268                                         /** @todo Send info reply */
 269                                 }
 270
 271                                 /* create diffie hellman object to handle DH exchange */
 272                                 dh = diffie_hellman_create(group);
 273                                 if (dh == NULL)
 274                                 {
 275                                         this->logger->log(this->logger, ERROR, "Could not generate DH object");
 276                                         payloads->destroy(payloads);
 277                                         return NOT_SUPPORTED;
 278                                 }
 279
 280                                 this->logger->log(this->logger, CONTROL | MORE, "Set other DH public value");
 281
 282                                 dh->set_other_public_value(dh, ke_payload->get_key_exchange_data(ke_payload));
 283
 284                                 this->diffie_hellman = dh;
 285
 286                                 this->logger->log(this->logger, CONTROL | MORE, "KE Payload processed");
 287                                 break;
 288                         }
 289                         case NONCE:
 290                         {
 291                                 nonce_payload_t *nonce_payload = (nonce_payload_t*)payload;
 292
 293                                 allocator_free(this->received_nonce.ptr);
 294                                 this->received_nonce = CHUNK_INITIALIZER;
 295
 296                                 this->logger->log(this->logger, CONTROL | MORE, "Get nonce value and store it");
 297                                 nonce_payload->get_nonce(nonce_payload, &(this->received_nonce));
 298
 299                                 this->logger->log(this->logger, CONTROL | MORE, "Nonce Payload processed");
 300                                 break;
 301                         }
 302                         default:
 303                         {
 304                                 this->logger->log(this->logger, ERROR | MORE, "Payload type not supported!");
 305                                 payloads->destroy(payloads);
 306                                 return NOT_SUPPORTED;
 307                         }
 308                 }
 309         }
 310         /* iterator can be destroyed */
 311         payloads->destroy(payloads);
 312
 313         this->logger->log(this->logger, CONTROL | MORE, "Request successfully handled. Going to create reply.");
 314
 315         this->logger->log(this->logger, CONTROL | MOST, "Going to create nonce.");
 316
 317         randomizer = this->ike_sa->get_randomizer(this->ike_sa);
 318
 319         randomizer->allocate_pseudo_random_bytes(randomizer, NONCE_SIZE, &(this->sent_nonce));
 320
 321         /* store shared secret  */
 322         this->logger->log(this->logger, CONTROL | MOST, "Retrieve shared secret and store it");
 323         status = this->diffie_hellman->get_shared_secret(this->diffie_hellman, &shared_secret);
 324         this->logger->log_chunk(this->logger, PRIVATE, "Shared secret", &shared_secret);
 325
 326         this->ike_sa->compute_secrets(this->ike_sa,shared_secret,this->received_nonce, this->sent_nonce);
 327
 328         /* set up the reply */
 329         this->ike_sa->build_message(this->ike_sa, IKE_SA_INIT, FALSE, &response);
 330
 331
 332         /* build SA payload */
 333         this->build_sa_payload(this, &payload);
 334         this->logger->log(this->logger, CONTROL|MOST, "add SA payload to message");
 335         response->add_payload(response, payload);
 336
 337         /* build KE payload */
 338         this->build_ke_payload(this,&payload);
 339         this->logger->log(this->logger, CONTROL|MOST, "add KE payload to message");
 340         response->add_payload(response, payload);
 341
 342         /* build Nonce payload */
 343         this->build_nonce_payload(this, &payload);
 344         this->logger->log(this->logger, CONTROL|MOST, "add nonce payload to message");
 345         response->add_payload(response, payload);
 346
 347         /* generate packet */
 348         this->logger->log(this->logger, CONTROL|MOST, "generate packet from message");
 349         status = response->generate(response, NULL, NULL, &packet);
 350         if (status != SUCCESS)
 351         {
 352                 this->logger->log(this->logger, ERROR, "could not generate packet from message");
 353                 return status;
 354         }
 355
 356         this->logger->log(this->logger, CONTROL|MOST, "Add packet to global send queue");
 357          global_send_queue->add(global_send_queue, packet);
 358
 359         /* state can now be changed */
 360         this->logger->log(this->logger, CONTROL|MOST, "Create next state object");
 361
 362         next_state = ike_sa_init_responded_create(this->ike_sa, shared_secret, this->received_nonce, this->sent_nonce);
 363
 364         /* last message can now be set */
 365         status = this->ike_sa->set_last_responded_message(this->ike_sa, response);
 366
 367         if (status != SUCCESS)
 368         {
 369                 this->logger->log(this->logger, ERROR, "Could not set last responded message");
 370                 response->destroy(response);
 371                 (next_state->state_interface).destroy(&(next_state->state_interface));
 372                 return status;
 373         }
 374
 375         /* state can now be changed */
 376         this->ike_sa->set_new_state(this->ike_sa, (state_t *) next_state);
 377         /* state has NOW changed :-) */
 378         this->logger->log(this->logger, CONTROL|MORE, "Changed state of IKE_SA from %s to %s",mapping_find(ike_sa_state_m,RESPONDER_INIT),mapping_find(ike_sa_state_m,IKE_SA_INIT_RESPONDED) );
 379
 380         this->logger->log(this->logger, CONTROL|MOST, "Destroy old sate object");
 381         this->destroy_after_state_change(this);
 382
 383         return SUCCESS;
 384 }
 385
 386 /**
 387  * implements private_initiator_init_t.build_sa_payload
 388  */
 389 static void build_sa_payload(private_responder_init_t *this, payload_t **payload)
 390 {
 391         sa_payload_t* sa_payload;
 392         iterator_t *proposal_iterator;
 393
 394         /* SA payload takes proposals from this->ike_sa_init_data.proposals and writes them to the created sa_payload */
 395
 396         this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
 397
 398         this->proposals->create_iterator(this->proposals, &proposal_iterator, FALSE);
 399
 400         sa_payload = sa_payload_create();
 401
 402         while (proposal_iterator->has_next(proposal_iterator))
 403         {
 404                 proposal_substructure_t *current_proposal;
 405                 proposal_substructure_t *current_proposal_clone;
 406
 407                 proposal_iterator->current(proposal_iterator,(void **) &current_proposal);
 408                 current_proposal->clone(current_proposal,&current_proposal_clone);
 409                 sa_payload->add_proposal_substructure(sa_payload,current_proposal_clone);
 410         }
 411
 412         proposal_iterator->destroy(proposal_iterator);
 413
 414         *payload = (payload_t *) sa_payload;
 415 }
 416
 417 /**
 418  * implements private_initiator_init_t.build_ke_payload
 419  */
 420 static void build_ke_payload(private_responder_init_t *this, payload_t **payload)
 421 {
 422         ke_payload_t *ke_payload;
 423         chunk_t key_data;
 424
 425         this->logger->log(this->logger, CONTROL|MORE, "building ke payload");
 426         this->diffie_hellman->get_my_public_value(this->diffie_hellman,&key_data);
 427
 428         ke_payload = ke_payload_create();
 429         ke_payload->set_dh_group_number(ke_payload, MODP_1024_BIT);
 430
 431         allocator_free_chunk(&key_data);
 432         *payload = (payload_t *) ke_payload;
 433 }
 434
 435 /**
 436  * implements private_initiator_init_t.build_nonce_payload
 437  */
 438 static void build_nonce_payload(private_responder_init_t *this, payload_t **payload)
 439 {
 440         nonce_payload_t *nonce_payload;
 441         status_t status;
 442
 443         this->logger->log(this->logger, CONTROL|MORE, "building nonce payload");
 444
 445         nonce_payload = nonce_payload_create();
 446
 447         status = nonce_payload->set_nonce(nonce_payload, this->sent_nonce);
 448
 449         *payload = (payload_t *) nonce_payload;
 450 }
 451
 452
 453 /**
 454  * Implements state_t.get_state
 455  */
 456 static ike_sa_state_t get_state(private_responder_init_t *this)
 457 {
 458         return RESPONDER_INIT;
 459 }
 460
 461 /**
 462  * Implements state_t.get_state
 463  */
 464 static void destroy(private_responder_init_t *this)
 465 {
 466         this->logger->log(this->logger, CONTROL | MORE, "Going to destroy responder init state object");
 467
 468         /* destroy stored proposal */
 469         this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
 470         while (this->proposals->get_count(this->proposals) > 0)
 471         {
 472                 proposal_substructure_t *current_proposal;
 473                 this->proposals->remove_first(this->proposals,(void **)&current_proposal);
 474                 current_proposal->destroy(current_proposal);
 475         }
 476         this->proposals->destroy(this->proposals);
 477
 478         allocator_free(this->sent_nonce.ptr);
 479         allocator_free(this->received_nonce.ptr);
 480
 481         if (this->diffie_hellman != NULL)
 482         {
 483                 this->diffie_hellman->destroy(this->diffie_hellman);
 484         }
 485         allocator_free(this);
 486 }
 487
 488 /**
 489  * Implements private_responder_init_t.destroy_after_state_change
 490  */
 491 static void destroy_after_state_change (private_responder_init_t *this)
 492 {
 493         this->logger->log(this->logger, CONTROL | MORE, "Going to destroy responder_init_t state object");
 494
 495         /* destroy stored proposal */
 496         this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
 497         while (this->proposals->get_count(this->proposals) > 0)
 498         {
 499                 proposal_substructure_t *current_proposal;
 500                 this->proposals->remove_first(this->proposals,(void **)&current_proposal);
 501                 current_proposal->destroy(current_proposal);
 502         }
 503         this->proposals->destroy(this->proposals);
 504
 505         /* destroy diffie hellman object */
 506         if (this->diffie_hellman != NULL)
 507         {
 508                 this->logger->log(this->logger, CONTROL | MOST, "Destroy diffie_hellman_t object");
 509                 this->diffie_hellman->destroy(this->diffie_hellman);
 510         }
 511
 512         allocator_free(this);
 513 }
 514
 515 /*
 516  * Described in header.
 517  */
 518 responder_init_t *responder_init_create(protected_ike_sa_t *ike_sa)
 519 {
 520         private_responder_init_t *this = allocator_alloc_thing(private_responder_init_t);
 521
 522         /* interface functions */
 523         this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
 524         this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
 525         this->public.state_interface.destroy  = (void (*) (state_t *)) destroy;
 526
 527         /* private functions */
 528         this->build_sa_payload = build_sa_payload;
 529         this->build_ke_payload = build_ke_payload;
 530         this->build_nonce_payload = build_nonce_payload;
 531         this->destroy_after_state_change = destroy_after_state_change;
 532
 533         /* private data */
 534         this->ike_sa = ike_sa;
 535         this->logger = this->ike_sa->get_logger(this->ike_sa);
 536         this->sent_nonce = CHUNK_INITIALIZER;
 537         this->received_nonce = CHUNK_INITIALIZER;
 538         this->proposals = linked_list_create();
 539
 540         return &(this->public);
 541 }