keymat: Log nonce and DH context ids
[strongswan.git] / src / charon-tkm / src / tkm / tkm_keymat.c
1 /*
2 * Copyrigth (C) 2012 Reto Buerki
3 * Copyright (C) 2012 Adrian-Ken Rueegsegger
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include <daemon.h>
18 #include <sa/ikev2/keymat_v2.h>
19
20 #include "tkm.h"
21 #include "tkm_diffie_hellman.h"
22 #include "tkm_keymat.h"
23
24 typedef struct private_tkm_keymat_t private_tkm_keymat_t;
25
26 /**
27 * Private data of a keymat_t object.
28 */
29 struct private_tkm_keymat_t {
30
31 /**
32 * Public tkm_keymat_t interface.
33 */
34 tkm_keymat_t public;
35
36 /**
37 * IKEv2 keymat proxy (will be removed).
38 */
39 keymat_v2_t *proxy;
40
41 /**
42 * IKE_SA Role, initiator or responder
43 */
44 bool initiator;
45
46 };
47
48 METHOD(keymat_t, get_version, ike_version_t,
49 private_tkm_keymat_t *this)
50 {
51 return IKEV2;
52 }
53
54 METHOD(keymat_t, create_dh, diffie_hellman_t*,
55 private_tkm_keymat_t *this, diffie_hellman_group_t group)
56 {
57 return lib->crypto->create_dh(lib->crypto, group);
58 }
59
60 METHOD(keymat_t, create_nonce_gen, nonce_gen_t*,
61 private_tkm_keymat_t *this)
62 {
63 return lib->crypto->create_nonce_gen(lib->crypto);
64 }
65
66 METHOD(tkm_keymat_t, derive_ike_keys, bool,
67 private_tkm_keymat_t *this, proposal_t *proposal, diffie_hellman_t *dh,
68 chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id,
69 pseudo_random_function_t rekey_function, chunk_t rekey_skd)
70 {
71 tkm_diffie_hellman_t * const tkm_dh = (tkm_diffie_hellman_t *)dh;
72 chunk_t * const nonce = this->initiator ? &nonce_i : &nonce_r;
73
74 const uint64_t nc_id = tkm->chunk_map->get_id(tkm->chunk_map, nonce);
75 if (!nc_id)
76 {
77 DBG1(DBG_IKE, "unable to acquire context id for nonce");
78 return FALSE;
79 }
80
81 DBG1(DBG_IKE, "deriving IKE keys (nc: %llu, dh: %llu)", nc_id,
82 tkm_dh->get_id(tkm_dh));
83 if (this->proxy->derive_ike_keys(this->proxy, proposal, dh, nonce_i,
84 nonce_r, id, rekey_function, rekey_skd))
85 {
86 tkm->chunk_map->remove(tkm->chunk_map, nonce);
87 return TRUE;
88 }
89 return FALSE;
90 }
91
92 METHOD(tkm_keymat_t, derive_child_keys, bool,
93 private_tkm_keymat_t *this, proposal_t *proposal, diffie_hellman_t *dh,
94 chunk_t nonce_i, chunk_t nonce_r, chunk_t *encr_i, chunk_t *integ_i,
95 chunk_t *encr_r, chunk_t *integ_r)
96 {
97 DBG1(DBG_CHD, "deriving child keys");
98 return this->proxy->derive_child_keys(this->proxy, proposal, dh, nonce_i,
99 nonce_r, encr_i, integ_i, encr_r, integ_r);
100 }
101
102 METHOD(keymat_t, get_aead, aead_t*,
103 private_tkm_keymat_t *this, bool in)
104 {
105 DBG1(DBG_IKE, "returning aead transform");
106 return this->proxy->keymat.get_aead(&this->proxy->keymat, in);
107 }
108
109 METHOD(tkm_keymat_t, get_auth_octets, bool,
110 private_tkm_keymat_t *this, bool verify, chunk_t ike_sa_init,
111 chunk_t nonce, identification_t *id, char reserved[3], chunk_t *octets)
112 {
113 DBG1(DBG_IKE, "returning auth octets");
114 return this->proxy->get_auth_octets(this->proxy, verify, ike_sa_init, nonce,
115 id, reserved, octets);
116 }
117
118 METHOD(tkm_keymat_t, get_skd, pseudo_random_function_t,
119 private_tkm_keymat_t *this, chunk_t *skd)
120 {
121 DBG1(DBG_IKE, "returning skd");
122 return this->proxy->get_skd(this->proxy, skd);
123 }
124
125 METHOD(tkm_keymat_t, get_psk_sig, bool,
126 private_tkm_keymat_t *this, bool verify, chunk_t ike_sa_init, chunk_t nonce,
127 chunk_t secret, identification_t *id, char reserved[3], chunk_t *sig)
128 {
129 DBG1(DBG_IKE, "returning PSK signature");
130 return this->proxy->get_psk_sig(this->proxy, verify, ike_sa_init, nonce,
131 secret, id, reserved, sig);
132 }
133
134 METHOD(keymat_t, destroy, void,
135 private_tkm_keymat_t *this)
136 {
137 free(this);
138 }
139
140 /**
141 * See header.
142 */
143 tkm_keymat_t *tkm_keymat_create(bool initiator)
144 {
145 private_tkm_keymat_t *this;
146
147 INIT(this,
148 .public = {
149 .keymat = {
150 .get_version = _get_version,
151 .create_dh = _create_dh,
152 .create_nonce_gen = _create_nonce_gen,
153 .get_aead = _get_aead,
154 .destroy = _destroy,
155 },
156 .derive_ike_keys = _derive_ike_keys,
157 .derive_child_keys = _derive_child_keys,
158 .get_skd = _get_skd,
159 .get_auth_octets = _get_auth_octets,
160 .get_psk_sig = _get_psk_sig,
161 },
162 .initiator = initiator,
163 .proxy = keymat_v2_create(initiator),
164 );
165
166 return &this->public;
167 }