show kind of notify contained in messages in log
[strongswan.git] / src / charon / encoding / payloads / notify_payload.c
1 /**
2 * @file notify_payload.c
3 *
4 * @brief Implementation of notify_payload_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
10 * Copyright (C) 2005-2006 Martin Willi
11 * Copyright (C) 2005 Jan Hutter
12 * Hochschule fuer Technik Rapperswil
13 *
14 * This program is free software; you can redistribute it and/or modify it
15 * under the terms of the GNU General Public License as published by the
16 * Free Software Foundation; either version 2 of the License, or (at your
17 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
18 *
19 * This program is distributed in the hope that it will be useful, but
20 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
21 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
22 * for more details.
23 */
24
25 #include <stddef.h>
26
27 #include "notify_payload.h"
28
29 #include <daemon.h>
30 #include <encoding/payloads/encodings.h>
31 #include <crypto/hashers/hasher.h>
32
33 ENUM_BEGIN(notify_type_names, UNSUPPORTED_CRITICAL_PAYLOAD, UNSUPPORTED_CRITICAL_PAYLOAD,
34 "UNSUPPORTED_CRITICAL_PAYLOAD");
35 ENUM_NEXT(notify_type_names, INVALID_IKE_SPI, INVALID_MAJOR_VERSION, UNSUPPORTED_CRITICAL_PAYLOAD,
36 "INVALID_IKE_SPI",
37 "INVALID_MAJOR_VERSION");
38 ENUM_NEXT(notify_type_names, INVALID_SYNTAX, INVALID_SYNTAX, INVALID_MAJOR_VERSION,
39 "INVALID_SYNTAX");
40 ENUM_NEXT(notify_type_names, INVALID_MESSAGE_ID, INVALID_MESSAGE_ID, INVALID_SYNTAX,
41 "INVALID_MESSAGE_ID");
42 ENUM_NEXT(notify_type_names, INVALID_SPI, INVALID_SPI, INVALID_MESSAGE_ID,
43 "INVALID_SPI");
44 ENUM_NEXT(notify_type_names, NO_PROPOSAL_CHOSEN, NO_PROPOSAL_CHOSEN, INVALID_SPI,
45 "NO_PROPOSAL_CHOSEN");
46 ENUM_NEXT(notify_type_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL_CHOSEN,
47 "INVALID_KE_PAYLOAD");
48 ENUM_NEXT(notify_type_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
49 "AUTHENTICATION_FAILED");
50 ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, UNEXPECTED_NAT_DETECTED, AUTHENTICATION_FAILED,
51 "SINGLE_PAIR_REQUIRED",
52 "NO_ADDITIONAL_SAS",
53 "INTERNAL_ADDRESS_FAILURE",
54 "FAILED_CP_REQUIRED",
55 "TS_UNACCEPTABLE",
56 "INVALID_SELECTORS",
57 "UNACCEPTABLE_ADDRESSES",
58 "UNEXPECTED_NAT_DETECTED");
59 ENUM_NEXT(notify_type_names, INITIAL_CONTACT, AUTH_LIFETIME, UNEXPECTED_NAT_DETECTED,
60 "INITIAL_CONTACT",
61 "SET_WINDOW_SIZE",
62 "ADDITIONAL_TS_POSSIBLE",
63 "IPCOMP_SUPPORTED",
64 "NAT_DETECTION_SOURCE_IP",
65 "NAT_DETECTION_DESTINATION_IP",
66 "COOKIE",
67 "USE_TRANSPORT_MODE",
68 "HTTP_CERT_LOOKUP_SUPPORTED",
69 "REKEY_SA",
70 "ESP_TFC_PADDING_NOT_SUPPORTED",
71 "NON_FIRST_FRAGMENTS_ALSO",
72 "MOBIKE_SUPPORTED",
73 "ADDITIONAL_IP4_ADDRESS",
74 "ADDITIONAL_IP6_ADDRESS",
75 "NO_ADDITIONAL_ADDRESSES",
76 "UPDATE_SA_ADDRESSES",
77 "COOKIE2",
78 "NO_NATS_ALLOWED",
79 "AUTH_LIFETIME");
80 ENUM_NEXT(notify_type_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, AUTH_LIFETIME,
81 "EAP_ONLY_AUTHENTICATION");
82 ENUM_END(notify_type_names, EAP_ONLY_AUTHENTICATION);
83
84
85 ENUM_BEGIN(notify_type_short_names, UNSUPPORTED_CRITICAL_PAYLOAD, UNSUPPORTED_CRITICAL_PAYLOAD,
86 "CRIT");
87 ENUM_NEXT(notify_type_short_names, INVALID_IKE_SPI, INVALID_MAJOR_VERSION, UNSUPPORTED_CRITICAL_PAYLOAD,
88 "INVAL_IKE_SPI",
89 "INVAL_MAJOR");
90 ENUM_NEXT(notify_type_short_names, INVALID_SYNTAX, INVALID_SYNTAX, INVALID_MAJOR_VERSION,
91 "INVAL_SYN");
92 ENUM_NEXT(notify_type_short_names, INVALID_MESSAGE_ID, INVALID_MESSAGE_ID, INVALID_SYNTAX,
93 "INVAL_MID");
94 ENUM_NEXT(notify_type_short_names, INVALID_SPI, INVALID_SPI, INVALID_MESSAGE_ID,
95 "INVAL_SPI");
96 ENUM_NEXT(notify_type_short_names, NO_PROPOSAL_CHOSEN, NO_PROPOSAL_CHOSEN, INVALID_SPI,
97 "NO_PROP");
98 ENUM_NEXT(notify_type_short_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL_CHOSEN,
99 "INVAL_KE");
100 ENUM_NEXT(notify_type_short_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
101 "AUTH_FAILED");
102 ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, UNEXPECTED_NAT_DETECTED, AUTHENTICATION_FAILED,
103 "SINGLE_PAIR",
104 "NO_ADD_SAS",
105 "INT_ADDR_FAIL",
106 "FAIL_CP_REQ",
107 "TS_UNACCEPT",
108 "INVAL_SEL",
109 "UNACCEPT_ADDR",
110 "UNEXPECT_NAT");
111 ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, AUTH_LIFETIME, UNEXPECTED_NAT_DETECTED,
112 "INIT_CONTACT",
113 "SET_WINSIZE",
114 "ADD_TS_POSS",
115 "IPCOMP_SUPP",
116 "NATD_S_IP",
117 "NATD_D_IP",
118 "COOKIE",
119 "USE_TRANSP",
120 "HTTP_CERT_LOOK",
121 "REKEY_SA",
122 "ESP_TFC_PAD_N",
123 "NON_FIRST_FRAG",
124 "MOBIKE_SUP",
125 "ADD_4_ADDR",
126 "ADD_6_ADDR",
127 "NO_ADD_ADDR",
128 "UPD_SA_ADDR",
129 "COOKIE2",
130 "NO_NATS",
131 "AUTH_LFT");
132 ENUM_NEXT(notify_type_short_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, AUTH_LIFETIME,
133 "EAP_ONLY");
134 ENUM_END(notify_type_short_names, EAP_ONLY_AUTHENTICATION);
135
136
137 typedef struct private_notify_payload_t private_notify_payload_t;
138
139 /**
140 * Private data of an notify_payload_t object.
141 *
142 */
143 struct private_notify_payload_t {
144 /**
145 * Public notify_payload_t interface.
146 */
147 notify_payload_t public;
148
149 /**
150 * Next payload type.
151 */
152 u_int8_t next_payload;
153
154 /**
155 * Critical flag.
156 */
157 bool critical;
158
159 /**
160 * Length of this payload.
161 */
162 u_int16_t payload_length;
163
164 /**
165 * Protocol id.
166 */
167 u_int8_t protocol_id;
168
169 /**
170 * Spi size.
171 */
172 u_int8_t spi_size;
173
174 /**
175 * Notify message type.
176 */
177 u_int16_t notify_type;
178
179 /**
180 * Security parameter index (spi).
181 */
182 chunk_t spi;
183
184 /**
185 * Notification data.
186 */
187 chunk_t notification_data;
188 };
189
190 /**
191 * Encoding rules to parse or generate a IKEv2-Notify Payload.
192 *
193 * The defined offsets are the positions in a object of type
194 * private_notify_payload_t.
195 *
196 */
197 encoding_rule_t notify_payload_encodings[] = {
198 /* 1 Byte next payload type, stored in the field next_payload */
199 { U_INT_8, offsetof(private_notify_payload_t, next_payload) },
200 /* the critical bit */
201 { FLAG, offsetof(private_notify_payload_t, critical) },
202 /* 7 Bit reserved bits, nowhere stored */
203 { RESERVED_BIT, 0 },
204 { RESERVED_BIT, 0 },
205 { RESERVED_BIT, 0 },
206 { RESERVED_BIT, 0 },
207 { RESERVED_BIT, 0 },
208 { RESERVED_BIT, 0 },
209 { RESERVED_BIT, 0 },
210 /* Length of the whole payload*/
211 { PAYLOAD_LENGTH, offsetof(private_notify_payload_t, payload_length) },
212 /* Protocol ID as 8 bit field*/
213 { U_INT_8, offsetof(private_notify_payload_t, protocol_id) },
214 /* SPI Size as 8 bit field*/
215 { SPI_SIZE, offsetof(private_notify_payload_t, spi_size) },
216 /* Notify message type as 16 bit field*/
217 { U_INT_16, offsetof(private_notify_payload_t, notify_type) },
218 /* SPI as variable length field*/
219 { SPI, offsetof(private_notify_payload_t, spi) },
220 /* Key Exchange Data is from variable size */
221 { NOTIFICATION_DATA, offsetof(private_notify_payload_t, notification_data) }
222 };
223
224 /*
225 1 2 3
226 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
227 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
228 ! Next Payload !C! RESERVED ! Payload Length !
229 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
230 ! Protocol ID ! SPI Size ! Notify Message Type !
231 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
232 ! !
233 ~ Security Parameter Index (SPI) ~
234 ! !
235 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
236 ! !
237 ~ Notification Data ~
238 ! !
239 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
240 */
241
242 /**
243 * Implementation of payload_t.verify.
244 */
245 static status_t verify(private_notify_payload_t *this)
246 {
247 bool bad_length = FALSE;
248
249 switch (this->protocol_id)
250 {
251 case PROTO_NONE:
252 case PROTO_IKE:
253 case PROTO_AH:
254 case PROTO_ESP:
255 break;
256 default:
257 DBG1(DBG_ENC, "Unknown protocol (%d)", this->protocol_id);
258 return FAILED;
259 }
260
261 switch (this->notify_type)
262 {
263 case INVALID_KE_PAYLOAD:
264 {
265 if (this->notification_data.len != 2)
266 {
267 bad_length = TRUE;
268 }
269 break;
270 }
271 case NAT_DETECTION_SOURCE_IP:
272 case NAT_DETECTION_DESTINATION_IP:
273 {
274 if (this->notification_data.len != HASH_SIZE_SHA1)
275 {
276 bad_length = TRUE;
277 }
278 break;
279 }
280 case INVALID_SYNTAX:
281 case INVALID_MAJOR_VERSION:
282 case NO_PROPOSAL_CHOSEN:
283 {
284 if (this->notification_data.len != 0)
285 {
286 bad_length = TRUE;
287 }
288 break;
289 }
290 case ADDITIONAL_IP4_ADDRESS:
291 {
292 if (this->notification_data.len != 4)
293 {
294 bad_length = TRUE;
295 }
296 break;
297 }
298 case ADDITIONAL_IP6_ADDRESS:
299 {
300 if (this->notification_data.len != 16)
301 {
302 bad_length = TRUE;
303 }
304 break;
305 }
306 default:
307 /* TODO: verify */
308 break;
309 }
310 if (bad_length)
311 {
312 DBG1(DBG_ENC, "invalid notify data length for %N (%d)",
313 notify_type_names, this->notify_type,
314 this->notification_data.len);
315 return FAILED;
316 }
317 return SUCCESS;
318 }
319
320 /**
321 * Implementation of payload_t.get_encoding_rules.
322 */
323 static void get_encoding_rules(private_notify_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
324 {
325 *rules = notify_payload_encodings;
326 *rule_count = sizeof(notify_payload_encodings) / sizeof(encoding_rule_t);
327 }
328
329 /**
330 * Implementation of payload_t.get_type.
331 */
332 static payload_type_t get_type(private_notify_payload_t *this)
333 {
334 return NOTIFY;
335 }
336
337 /**
338 * Implementation of payload_t.get_next_type.
339 */
340 static payload_type_t get_next_type(private_notify_payload_t *this)
341 {
342 return (this->next_payload);
343 }
344
345 /**
346 * Implementation of payload_t.set_next_type.
347 */
348 static void set_next_type(private_notify_payload_t *this,payload_type_t type)
349 {
350 this->next_payload = type;
351 }
352
353 /**
354 * recompute the payloads length.
355 */
356 static void compute_length (private_notify_payload_t *this)
357 {
358 size_t length = NOTIFY_PAYLOAD_HEADER_LENGTH;
359 if (this->notification_data.ptr != NULL)
360 {
361 length += this->notification_data.len;
362 }
363 if (this->spi.ptr != NULL)
364 {
365 length += this->spi.len;
366 }
367 this->payload_length = length;
368 }
369
370 /**
371 * Implementation of payload_t.get_length.
372 */
373 static size_t get_length(private_notify_payload_t *this)
374 {
375 compute_length(this);
376 return this->payload_length;
377 }
378
379 /**
380 * Implementation of notify_payload_t.get_protocol_id.
381 */
382 static u_int8_t get_protocol_id(private_notify_payload_t *this)
383 {
384 return this->protocol_id;
385 }
386
387 /**
388 * Implementation of notify_payload_t.set_protocol_id.
389 */
390 static void set_protocol_id(private_notify_payload_t *this, u_int8_t protocol_id)
391 {
392 this->protocol_id = protocol_id;
393 }
394
395 /**
396 * Implementation of notify_payload_t.get_notify_type.
397 */
398 static notify_type_t get_notify_type(private_notify_payload_t *this)
399 {
400 return this->notify_type;
401 }
402
403 /**
404 * Implementation of notify_payload_t.set_notify_type.
405 */
406 static void set_notify_type(private_notify_payload_t *this, u_int16_t notify_type)
407 {
408 this->notify_type = notify_type;
409 }
410
411 /**
412 * Implementation of notify_payload_t.get_spi.
413 */
414 static u_int32_t get_spi(private_notify_payload_t *this)
415 {
416 switch (this->protocol_id)
417 {
418 case PROTO_AH:
419 case PROTO_ESP:
420 if (this->spi.len == 4)
421 {
422 return *((u_int32_t*)this->spi.ptr);
423 }
424 default:
425 break;
426 }
427 return 0;
428 }
429
430 /**
431 * Implementation of notify_payload_t.set_spi.
432 */
433 static void set_spi(private_notify_payload_t *this, u_int32_t spi)
434 {
435 chunk_free(&this->spi);
436 switch (this->protocol_id)
437 {
438 case PROTO_AH:
439 case PROTO_ESP:
440 this->spi = chunk_alloc(4);
441 *((u_int32_t*)this->spi.ptr) = spi;
442 break;
443 default:
444 break;
445 }
446 this->spi_size = this->spi.len;
447 compute_length(this);
448 }
449
450 /**
451 * Implementation of notify_payload_t.get_notification_data.
452 */
453 static chunk_t get_notification_data(private_notify_payload_t *this)
454 {
455 return (this->notification_data);
456 }
457
458 /**
459 * Implementation of notify_payload_t.set_notification_data.
460 */
461 static status_t set_notification_data(private_notify_payload_t *this, chunk_t notification_data)
462 {
463 chunk_free(&this->notification_data);
464 if (notification_data.len > 0)
465 {
466 this->notification_data = chunk_clone(notification_data);
467 }
468 compute_length(this);
469 return SUCCESS;
470 }
471
472 /**
473 * Implementation of notify_payload_t.destroy and notify_payload_t.destroy.
474 */
475 static status_t destroy(private_notify_payload_t *this)
476 {
477 chunk_free(&this->notification_data);
478 chunk_free(&this->spi);
479 free(this);
480 return SUCCESS;
481 }
482
483 /*
484 * Described in header
485 */
486 notify_payload_t *notify_payload_create()
487 {
488 private_notify_payload_t *this = malloc_thing(private_notify_payload_t);
489
490 /* interface functions */
491 this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
492 this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
493 this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
494 this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
495 this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
496 this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
497 this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
498
499 /* public functions */
500 this->public.get_protocol_id = (u_int8_t (*) (notify_payload_t *)) get_protocol_id;
501 this->public.set_protocol_id = (void (*) (notify_payload_t *,u_int8_t)) set_protocol_id;
502 this->public.get_notify_type = (notify_type_t (*) (notify_payload_t *)) get_notify_type;
503 this->public.set_notify_type = (void (*) (notify_payload_t *,notify_type_t)) set_notify_type;
504 this->public.get_spi = (u_int32_t (*) (notify_payload_t *)) get_spi;
505 this->public.set_spi = (void (*) (notify_payload_t *,u_int32_t)) set_spi;
506 this->public.get_notification_data = (chunk_t (*) (notify_payload_t *)) get_notification_data;
507 this->public.set_notification_data = (void (*) (notify_payload_t *,chunk_t)) set_notification_data;
508 this->public.destroy = (void (*) (notify_payload_t *)) destroy;
509
510 /* set default values of the fields */
511 this->critical = FALSE;
512 this->next_payload = NO_PAYLOAD;
513 this->payload_length = NOTIFY_PAYLOAD_HEADER_LENGTH;
514 this->protocol_id = 0;
515 this->notify_type = 0;
516 this->spi.ptr = NULL;
517 this->spi.len = 0;
518 this->spi_size = 0;
519 this->notification_data.ptr = NULL;
520 this->notification_data.len = 0;
521
522 return &this->public;
523 }
524
525 /*
526 * Described in header.
527 */
528 notify_payload_t *notify_payload_create_from_protocol_and_type(protocol_id_t protocol_id, notify_type_t notify_type)
529 {
530 notify_payload_t *notify = notify_payload_create();
531
532 notify->set_notify_type(notify,notify_type);
533 notify->set_protocol_id(notify,protocol_id);
534
535 return notify;
536 }