src/charon/sa/tasks/ike_auth.c

   1 /*
   2  * Copyright (C) 2005-2009 Martin Willi
   3  * Copyright (C) 2005 Jan Hutter
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details
  15  */
  16
  17 #include "ike_auth.h"
  18
  19 #include <string.h>
  20
  21 #include <daemon.h>
  22 #include <encoding/payloads/id_payload.h>
  23 #include <encoding/payloads/auth_payload.h>
  24 #include <encoding/payloads/eap_payload.h>
  25 #include <encoding/payloads/nonce_payload.h>
  26 #include <sa/authenticators/eap_authenticator.h>
  27
  28 typedef struct private_ike_auth_t private_ike_auth_t;
  29
  30 /**
  31  * Private members of a ike_auth_t task.
  32  */
  33 struct private_ike_auth_t {
  34
  35         /**
  36          * Public methods and task_t interface.
  37          */
  38         ike_auth_t public;
  39
  40         /**
  41          * Assigned IKE_SA.
  42          */
  43         ike_sa_t *ike_sa;
  44
  45         /**
  46          * Are we the initiator?
  47          */
  48         bool initiator;
  49
  50         /**
  51          * Nonce chosen by us in ike_init
  52          */
  53         chunk_t my_nonce;
  54
  55         /**
  56          * Nonce chosen by peer in ike_init
  57          */
  58         chunk_t other_nonce;
  59
  60         /**
  61          * IKE_SA_INIT message sent by us
  62          */
  63         packet_t *my_packet;
  64
  65         /**
  66          * IKE_SA_INIT message sent by peer
  67          */
  68         packet_t *other_packet;
  69
  70         /**
  71          * currently active authenticator, to authenticate us
  72          */
  73         authenticator_t *my_auth;
  74
  75         /**
  76          * currently active authenticator, to authenticate peer
  77          */
  78         authenticator_t *other_auth;
  79
  80         /**
  81          * peer_cfg candidates, ordered by priority
  82          */
  83         linked_list_t *candidates;
  84
  85         /**
  86          * selected peer config (might change when using multiple authentications)
  87          */
  88         peer_cfg_t *peer_cfg;
  89
  90         /**
  91          * have we planned an(other) authentication exchange?
  92          */
  93         bool do_another_auth;
  94
  95         /**
  96          * has the peer announced another authentication exchange?
  97          */
  98         bool expect_another_auth;
  99
 100         /**
 101          * should we send a AUTHENTICATION_FAILED notify?
 102          */
 103         bool authentication_failed;
 104 };
 105
 106 /**
 107  * check if multiple authentication extension is enabled, configuration-wise
 108  */
 109 static bool multiple_auth_enabled()
 110 {
 111         return lib->settings->get_bool(lib->settings,
 112                                                                    "charon.multiple_authentication", TRUE);
 113 }
 114
 115 /**
 116  * collect the needed information in the IKE_SA_INIT exchange from our message
 117  */
 118 static status_t collect_my_init_data(private_ike_auth_t *this,
 119                                                                          message_t *message)
 120 {
 121         nonce_payload_t *nonce;
 122
 123         /* get the nonce that was generated in ike_init */
 124         nonce = (nonce_payload_t*)message->get_payload(message, NONCE);
 125         if (nonce == NULL)
 126         {
 127                 return FAILED;
 128         }
 129         this->my_nonce = nonce->get_nonce(nonce);
 130
 131         /* pre-generate the message, keep a copy */
 132         if (this->ike_sa->generate_message(this->ike_sa, message,
 133                                                                            &this->my_packet) != SUCCESS)
 134         {
 135                 return FAILED;
 136         }
 137         return NEED_MORE;
 138 }
 139
 140 /**
 141  * collect the needed information in the IKE_SA_INIT exchange from others message
 142  */
 143 static status_t collect_other_init_data(private_ike_auth_t *this,
 144                                                                                 message_t *message)
 145 {
 146         /* we collect the needed information in the IKE_SA_INIT exchange */
 147         nonce_payload_t *nonce;
 148
 149         /* get the nonce that was generated in ike_init */
 150         nonce = (nonce_payload_t*)message->get_payload(message, NONCE);
 151         if (nonce == NULL)
 152         {
 153                 return FAILED;
 154         }
 155         this->other_nonce = nonce->get_nonce(nonce);
 156
 157         /* keep a copy of the received packet */
 158         this->other_packet = message->get_packet(message);
 159         return NEED_MORE;
 160 }
 161
 162 /**
 163  * Get the next authentication configuration
 164  */
 165 static auth_cfg_t *get_auth_cfg(private_ike_auth_t *this, bool local)
 166 {
 167         enumerator_t *e1, *e2;
 168         auth_cfg_t *c1, *c2, *next = NULL;
 169
 170         /* find an available config not already done */
 171         e1 = this->peer_cfg->create_auth_cfg_enumerator(this->peer_cfg, local);
 172         while (e1->enumerate(e1, &c1))
 173         {
 174                 bool found = FALSE;
 175
 176                 e2 = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, local);
 177                 while (e2->enumerate(e2, &c2))
 178                 {
 179                         if (c2->complies(c2, c1, FALSE))
 180                         {
 181                                 found = TRUE;
 182                                 break;
 183                         }
 184                 }
 185                 e2->destroy(e2);
 186                 if (!found)
 187                 {
 188                         next = c1;
 189                         break;
 190                 }
 191         }
 192         e1->destroy(e1);
 193         return next;
 194 }
 195
 196 /**
 197  * Check if we have should initiate another authentication round
 198  */
 199 static bool do_another_auth(private_ike_auth_t *this)
 200 {
 201         bool do_another = FALSE;
 202         enumerator_t *done, *todo;
 203         auth_cfg_t *done_cfg, *todo_cfg;
 204
 205         if (!this->ike_sa->supports_extension(this->ike_sa, EXT_MULTIPLE_AUTH))
 206         {
 207                 return FALSE;
 208         }
 209
 210         done = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, TRUE);
 211         todo = this->peer_cfg->create_auth_cfg_enumerator(this->peer_cfg, TRUE);
 212         while (todo->enumerate(todo, &todo_cfg))
 213         {
 214                 if (!done->enumerate(done, &done_cfg))
 215                 {
 216                         done_cfg = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
 217                 }
 218                 if (!done_cfg->complies(done_cfg, todo_cfg, FALSE))
 219                 {
 220                         do_another = TRUE;
 221                         break;
 222                 }
 223         }
 224         done->destroy(done);
 225         todo->destroy(todo);
 226         return do_another;
 227 }
 228
 229 /**
 230  * Get peer configuration candidates from backends
 231  */
 232 static bool load_cfg_candidates(private_ike_auth_t *this)
 233 {
 234         enumerator_t *enumerator;
 235         peer_cfg_t *peer_cfg;
 236         host_t *me, *other;
 237         identification_t *my_id, *other_id;
 238
 239         me = this->ike_sa->get_my_host(this->ike_sa);
 240         other = this->ike_sa->get_other_host(this->ike_sa);
 241         my_id = this->ike_sa->get_my_id(this->ike_sa);
 242         other_id = this->ike_sa->get_other_id(this->ike_sa);
 243
 244         enumerator = charon->backends->create_peer_cfg_enumerator(charon->backends,
 245                                                                                                         me, other, my_id, other_id);
 246         while (enumerator->enumerate(enumerator, &peer_cfg))
 247         {
 248                 peer_cfg->get_ref(peer_cfg);
 249                 if (this->peer_cfg == NULL)
 250                 {       /* best match */
 251                         this->peer_cfg = peer_cfg;
 252                         this->ike_sa->set_peer_cfg(this->ike_sa, peer_cfg);
 253                 }
 254                 else
 255                 {
 256                         this->candidates->insert_last(this->candidates, peer_cfg);
 257                 }
 258         }
 259         enumerator->destroy(enumerator);
 260         if (this->peer_cfg)
 261         {
 262                 DBG1(DBG_CFG, "selected peer config '%s'",
 263                          this->peer_cfg->get_name(this->peer_cfg));
 264                 return TRUE;
 265         }
 266         DBG1(DBG_CFG, "no matching peer config found");
 267         return FALSE;
 268 }
 269
 270 /**
 271  * update the current peer candidate if necessary, using candidates
 272  */
 273 static bool update_cfg_candidates(private_ike_auth_t *this, bool strict)
 274 {
 275         do
 276         {
 277                 if (this->peer_cfg)
 278                 {
 279                         bool complies = TRUE;
 280                         enumerator_t *e1, *e2, *tmp;
 281                         auth_cfg_t *c1, *c2;
 282
 283                         e1 = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, FALSE);
 284                         e2 = this->peer_cfg->create_auth_cfg_enumerator(this->peer_cfg, FALSE);
 285
 286                         if (strict)
 287                         {       /* swap lists in strict mode: all configured rounds must be
 288                                  * fulfilled. If !strict, we check only the rounds done so far. */
 289                                 tmp = e1;
 290                                 e1 = e2;
 291                                 e2 = tmp;
 292                         }
 293                         while (e1->enumerate(e1, &c1))
 294                         {
 295                                 /* check if done authentications comply to configured ones */
 296                                 if ((!e2->enumerate(e2, &c2)) ||
 297                                         (!strict && !c1->complies(c1, c2, TRUE)) ||
 298                                         (strict && !c2->complies(c2, c1, TRUE)))
 299                                 {
 300                                         complies = FALSE;
 301                                         break;
 302                                 }
 303                         }
 304                         e1->destroy(e1);
 305                         e2->destroy(e2);
 306                         if (complies)
 307                         {
 308                                 break;
 309                         }
 310                         DBG1(DBG_CFG, "selected peer config '%s' inacceptable",
 311                                  this->peer_cfg->get_name(this->peer_cfg));
 312                         this->peer_cfg->destroy(this->peer_cfg);
 313                 }
 314                 if (this->candidates->remove_first(this->candidates,
 315                                                                                 (void**)&this->peer_cfg) != SUCCESS)
 316                 {
 317                         DBG1(DBG_CFG, "no alternative config found");
 318                         this->peer_cfg = NULL;
 319                 }
 320                 else
 321                 {
 322                         DBG1(DBG_CFG, "switching to peer config '%s'",
 323                                  this->peer_cfg->get_name(this->peer_cfg));
 324                         this->ike_sa->set_peer_cfg(this->ike_sa, this->peer_cfg);
 325                 }
 326         }
 327         while (this->peer_cfg);
 328
 329         return this->peer_cfg != NULL;
 330 }
 331
 332 /**
 333  * Implementation of task_t.build for initiator
 334  */
 335 static status_t build_i(private_ike_auth_t *this, message_t *message)
 336 {
 337         auth_cfg_t *cfg;
 338
 339         if (message->get_exchange_type(message) == IKE_SA_INIT)
 340         {
 341                 return collect_my_init_data(this, message);
 342         }
 343
 344         if (this->peer_cfg == NULL)
 345         {
 346                 this->peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 347                 this->peer_cfg->get_ref(this->peer_cfg);
 348         }
 349
 350         if (message->get_message_id(message) == 1 &&
 351                 this->ike_sa->supports_extension(this->ike_sa, EXT_MULTIPLE_AUTH))
 352         {       /* in the first IKE_AUTH, indicate support for multiple authentication */
 353                 message->add_notify(message, FALSE, MULTIPLE_AUTH_SUPPORTED, chunk_empty);
 354         }
 355
 356         if (!this->do_another_auth && !this->my_auth)
 357         {       /* we have done our rounds */
 358                 return NEED_MORE;
 359         }
 360
 361         /* check if an authenticator is in progress */
 362         if (this->my_auth == NULL)
 363         {
 364                 identification_t *id;
 365                 id_payload_t *id_payload;
 366
 367                 /* clean up authentication config from a previous round */
 368                 cfg = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
 369                 cfg->purge(cfg, TRUE);
 370
 371                 /* add (optional) IDr */
 372                 cfg = get_auth_cfg(this, FALSE);
 373                 if (cfg)
 374                 {
 375                         id = cfg->get(cfg, AUTH_RULE_IDENTITY);
 376                         if (id && !id->contains_wildcards(id))
 377                         {
 378                                 this->ike_sa->set_other_id(this->ike_sa, id->clone(id));
 379                                 id_payload = id_payload_create_from_identification(
 380                                                                                                                         ID_RESPONDER, id);
 381                                 message->add_payload(message, (payload_t*)id_payload);
 382                         }
 383                 }
 384                 /* add IDi */
 385                 cfg = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
 386                 cfg->merge(cfg, get_auth_cfg(this, TRUE), TRUE);
 387                 id = cfg->get(cfg, AUTH_RULE_IDENTITY);
 388                 if (!id)
 389                 {
 390                         DBG1(DBG_CFG, "configuration misses IDi");
 391                         return FAILED;
 392                 }
 393                 this->ike_sa->set_my_id(this->ike_sa, id->clone(id));
 394                 id_payload = id_payload_create_from_identification(ID_INITIATOR, id);
 395                 message->add_payload(message, (payload_t*)id_payload);
 396
 397                 /* build authentication data */
 398                 this->my_auth = authenticator_create_builder(this->ike_sa, cfg,
 399                                                         this->other_nonce, this->my_nonce,
 400                                                         this->other_packet->get_data(this->other_packet),
 401                                                         this->my_packet->get_data(this->my_packet));
 402                 if (!this->my_auth)
 403                 {
 404                         return FAILED;
 405                 }
 406         }
 407         switch (this->my_auth->build(this->my_auth, message))
 408         {
 409                 case SUCCESS:
 410                         /* authentication step complete, reset authenticator */
 411                         cfg = auth_cfg_create();
 412                         cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE), TRUE);
 413                         this->ike_sa->add_auth_cfg(this->ike_sa, TRUE, cfg);
 414                         this->my_auth->destroy(this->my_auth);
 415                         this->my_auth = NULL;
 416                         break;
 417                 case NEED_MORE:
 418                         break;
 419                 default:
 420                         return FAILED;
 421         }
 422
 423         /* check for additional authentication rounds */
 424         if (do_another_auth(this))
 425         {
 426                 if (message->get_payload(message, AUTHENTICATION))
 427                 {
 428                         message->add_notify(message, FALSE, ANOTHER_AUTH_FOLLOWS, chunk_empty);
 429                 }
 430         }
 431         else
 432         {
 433                 this->do_another_auth = FALSE;
 434         }
 435         return NEED_MORE;
 436 }
 437
 438 /**
 439  * Implementation of task_t.process for responder
 440  */
 441 static status_t process_r(private_ike_auth_t *this, message_t *message)
 442 {
 443         auth_cfg_t *cfg, *cand;
 444         id_payload_t *id_payload;
 445         identification_t *id;
 446
 447         if (message->get_exchange_type(message) == IKE_SA_INIT)
 448         {
 449                 return collect_other_init_data(this, message);
 450         }
 451
 452         if (this->my_auth == NULL && this->do_another_auth)
 453         {
 454                 /* handle (optional) IDr payload, apply proposed identity */
 455                 id_payload = (id_payload_t*)message->get_payload(message, ID_RESPONDER);
 456                 if (id_payload)
 457                 {
 458                         id = id_payload->get_identification(id_payload);
 459                 }
 460                 else
 461                 {
 462                         id = identification_create_from_encoding(ID_ANY, chunk_empty);
 463                 }
 464                 this->ike_sa->set_my_id(this->ike_sa, id);
 465         }
 466
 467         if (!this->expect_another_auth)
 468         {
 469                 return NEED_MORE;
 470         }
 471         if (message->get_notify(message, MULTIPLE_AUTH_SUPPORTED))
 472         {
 473                 this->ike_sa->enable_extension(this->ike_sa, EXT_MULTIPLE_AUTH);
 474         }
 475
 476         if (this->other_auth == NULL)
 477         {
 478                 /* handle IDi payload */
 479                 id_payload = (id_payload_t*)message->get_payload(message, ID_INITIATOR);
 480                 if (!id_payload)
 481                 {
 482                         DBG1(DBG_IKE, "IDi payload missing");
 483                         return FAILED;
 484                 }
 485                 id = id_payload->get_identification(id_payload);
 486                 this->ike_sa->set_other_id(this->ike_sa, id);
 487                 cfg = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
 488                 cfg->add(cfg, AUTH_RULE_IDENTITY, id->clone(id));
 489
 490                 if (this->peer_cfg == NULL)
 491                 {
 492                         if (!load_cfg_candidates(this))
 493                         {
 494                                 this->authentication_failed = TRUE;
 495                                 return NEED_MORE;
 496                         }
 497                 }
 498                 if (message->get_payload(message, AUTHENTICATION) == NULL)
 499                 {       /* before authenticating with EAP, we need a EAP config */
 500                         cand = get_auth_cfg(this, FALSE);
 501                         while (!cand || (
 502                                         (uintptr_t)cand->get(cand, AUTH_RULE_EAP_TYPE) == EAP_NAK &&
 503                                         (uintptr_t)cand->get(cand, AUTH_RULE_EAP_VENDOR) == 0))
 504                         {       /* peer requested EAP, but current config does not match */
 505                                 this->peer_cfg->destroy(this->peer_cfg);
 506                                 this->peer_cfg = NULL;
 507                                 if (!update_cfg_candidates(this, FALSE))
 508                                 {
 509                                         this->authentication_failed = TRUE;
 510                                         return NEED_MORE;
 511                                 }
 512                                 cand = get_auth_cfg(this, FALSE);
 513                         }
 514                         cfg->merge(cfg, cand, TRUE);
 515                 }
 516
 517                 /* verify authentication data */
 518                 this->other_auth = authenticator_create_verifier(this->ike_sa,
 519                                                         message, this->other_nonce, this->my_nonce,
 520                                                         this->other_packet->get_data(this->other_packet),
 521                                                         this->my_packet->get_data(this->my_packet));
 522                 if (!this->other_auth)
 523                 {
 524                         this->authentication_failed = TRUE;
 525                         return NEED_MORE;
 526                 }
 527         }
 528         switch (this->other_auth->process(this->other_auth, message))
 529         {
 530                 case SUCCESS:
 531                         this->other_auth->destroy(this->other_auth);
 532                         this->other_auth = NULL;
 533                         break;
 534                 case NEED_MORE:
 535                         if (message->get_payload(message, AUTHENTICATION))
 536                         {       /* AUTH verification successful, but another build() needed */
 537                                 break;
 538                         }
 539                         return NEED_MORE;
 540                 default:
 541                         this->authentication_failed = TRUE;
 542                         return NEED_MORE;
 543         }
 544
 545         /* store authentication information */
 546         cfg = auth_cfg_create();
 547         cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, FALSE), FALSE);
 548         this->ike_sa->add_auth_cfg(this->ike_sa, FALSE, cfg);
 549
 550         /* another auth round done, invoke authorize hook */
 551         if (!charon->bus->authorize(charon->bus, FALSE))
 552         {
 553                 DBG1(DBG_IKE, "authorization hook forbids IKE_SA, cancelling");
 554                 this->authentication_failed = TRUE;
 555                 return NEED_MORE;
 556         }
 557
 558         if (!update_cfg_candidates(this, FALSE))
 559         {
 560                 this->authentication_failed = TRUE;
 561                 return NEED_MORE;
 562         }
 563
 564         if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS) == NULL)
 565         {
 566                 this->expect_another_auth = FALSE;
 567                 if (!update_cfg_candidates(this, TRUE))
 568                 {
 569                         this->authentication_failed = TRUE;
 570                         return NEED_MORE;
 571                 }
 572         }
 573         return NEED_MORE;
 574 }
 575
 576 /**
 577  * Implementation of task_t.build for responder
 578  */
 579 static status_t build_r(private_ike_auth_t *this, message_t *message)
 580 {
 581         auth_cfg_t *cfg;
 582
 583         if (message->get_exchange_type(message) == IKE_SA_INIT)
 584         {
 585                 if (multiple_auth_enabled())
 586                 {
 587                         message->add_notify(message, FALSE, MULTIPLE_AUTH_SUPPORTED,
 588                                                                 chunk_empty);
 589                 }
 590                 return collect_my_init_data(this, message);
 591         }
 592
 593         if (this->authentication_failed || this->peer_cfg == NULL)
 594         {
 595                 message->add_notify(message, TRUE, AUTHENTICATION_FAILED, chunk_empty);
 596                 return FAILED;
 597         }
 598
 599         if (this->my_auth == NULL && this->do_another_auth)
 600         {
 601                 identification_t *id, *id_cfg;
 602                 id_payload_t *id_payload;
 603
 604                 /* add IDr */
 605                 cfg = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
 606                 cfg->purge(cfg, TRUE);
 607                 cfg->merge(cfg, get_auth_cfg(this, TRUE), TRUE);
 608
 609                 id_cfg = cfg->get(cfg, AUTH_RULE_IDENTITY);
 610                 id = this->ike_sa->get_my_id(this->ike_sa);
 611                 if (id->get_type(id) == ID_ANY)
 612                 {       /* no IDr received, apply configured ID */
 613                         if (!id_cfg || id_cfg->contains_wildcards(id_cfg))
 614                         {
 615                                 DBG1(DBG_CFG, "IDr not configured and negotiation failed");
 616                                 message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
 617                                                                         chunk_empty);
 618                                 return FAILED;
 619                         }
 620                         this->ike_sa->set_my_id(this->ike_sa, id_cfg->clone(id_cfg));
 621                         id = id_cfg;
 622                 }
 623                 else
 624                 {       /* IDr received, check if it matches configuration */
 625                         if (id_cfg && !id->matches(id, id_cfg))
 626                         {
 627                                 DBG1(DBG_CFG, "received IDr %Y, but require %Y", id, id_cfg);
 628                                 message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
 629                                                                         chunk_empty);
 630                                 return FAILED;
 631                         }
 632                 }
 633
 634                 id_payload = id_payload_create_from_identification(ID_RESPONDER, id);
 635                 message->add_payload(message, (payload_t*)id_payload);
 636
 637                 /* build authentication data */
 638                 this->my_auth = authenticator_create_builder(this->ike_sa, cfg,
 639                                                         this->other_nonce, this->my_nonce,
 640                                                         this->other_packet->get_data(this->other_packet),
 641                                                         this->my_packet->get_data(this->my_packet));
 642                 if (!this->my_auth)
 643                 {
 644                         message->add_notify(message, TRUE, AUTHENTICATION_FAILED, chunk_empty);
 645                         return FAILED;
 646                 }
 647         }
 648
 649         if (this->other_auth)
 650         {
 651                 switch (this->other_auth->build(this->other_auth, message))
 652                 {
 653                         case SUCCESS:
 654                                 this->other_auth->destroy(this->other_auth);
 655                                 this->other_auth = NULL;
 656                                 break;
 657                         case NEED_MORE:
 658                                 break;
 659                         default:
 660                                 if (!message->get_payload(message, EXTENSIBLE_AUTHENTICATION))
 661                                 {       /* skip AUTHENTICATION_FAILED if we have EAP_FAILURE */
 662                                         message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
 663                                                                                 chunk_empty);
 664                                 }
 665                                 return FAILED;
 666                 }
 667         }
 668         if (this->my_auth)
 669         {
 670                 switch (this->my_auth->build(this->my_auth, message))
 671                 {
 672                         case SUCCESS:
 673                                 cfg = auth_cfg_create();
 674                                 cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE),
 675                                                    TRUE);
 676                                 this->ike_sa->add_auth_cfg(this->ike_sa, TRUE, cfg);
 677                                 this->my_auth->destroy(this->my_auth);
 678                                 this->my_auth = NULL;
 679                                 break;
 680                         case NEED_MORE:
 681                                 break;
 682                         default:
 683                                 message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
 684                                                                         chunk_empty);
 685                                 return FAILED;
 686                 }
 687         }
 688
 689         /* check for additional authentication rounds */
 690         if (do_another_auth(this))
 691         {
 692                 message->add_notify(message, FALSE, ANOTHER_AUTH_FOLLOWS, chunk_empty);
 693         }
 694         else
 695         {
 696                 this->do_another_auth = FALSE;
 697         }
 698         if (!this->do_another_auth && !this->expect_another_auth)
 699         {
 700                 if (charon->ike_sa_manager->check_uniqueness(charon->ike_sa_manager,
 701                                                                                                          this->ike_sa))
 702                 {
 703                         DBG1(DBG_IKE, "cancelling IKE_SA setup due uniqueness policy");
 704                         message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
 705                                                                 chunk_empty);
 706                         return FAILED;
 707                 }
 708                 if (!charon->bus->authorize(charon->bus, TRUE))
 709                 {
 710                         DBG1(DBG_IKE, "final authorization hook forbids IKE_SA, cancelling");
 711                         message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
 712                                                                 chunk_empty);
 713                         return FAILED;
 714                 }
 715                 DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
 716                          this->ike_sa->get_name(this->ike_sa),
 717                          this->ike_sa->get_unique_id(this->ike_sa),
 718                          this->ike_sa->get_my_host(this->ike_sa),
 719                          this->ike_sa->get_my_id(this->ike_sa),
 720                          this->ike_sa->get_other_host(this->ike_sa),
 721                          this->ike_sa->get_other_id(this->ike_sa));
 722                 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
 723                 charon->bus->ike_updown(charon->bus, this->ike_sa, TRUE);
 724                 return SUCCESS;
 725         }
 726         return NEED_MORE;
 727 }
 728
 729 /**
 730  * Implementation of task_t.process for initiator
 731  */
 732 static status_t process_i(private_ike_auth_t *this, message_t *message)
 733 {
 734         enumerator_t *enumerator;
 735         payload_t *payload;
 736         auth_cfg_t *cfg;
 737
 738         if (message->get_exchange_type(message) == IKE_SA_INIT)
 739         {
 740                 if (message->get_notify(message, MULTIPLE_AUTH_SUPPORTED) &&
 741                         multiple_auth_enabled())
 742                 {
 743                         this->ike_sa->enable_extension(this->ike_sa, EXT_MULTIPLE_AUTH);
 744                 }
 745                 return collect_other_init_data(this, message);
 746         }
 747
 748         enumerator = message->create_payload_enumerator(message);
 749         while (enumerator->enumerate(enumerator, &payload))
 750         {
 751                 if (payload->get_type(payload) == NOTIFY)
 752                 {
 753                         notify_payload_t *notify = (notify_payload_t*)payload;
 754                         notify_type_t type = notify->get_notify_type(notify);
 755
 756                         switch (type)
 757                         {
 758                                 case NO_PROPOSAL_CHOSEN:
 759                                 case SINGLE_PAIR_REQUIRED:
 760                                 case NO_ADDITIONAL_SAS:
 761                                 case INTERNAL_ADDRESS_FAILURE:
 762                                 case FAILED_CP_REQUIRED:
 763                                 case TS_UNACCEPTABLE:
 764                                 case INVALID_SELECTORS:
 765                                         /* these are errors, but are not critical as only the
 766                                          * CHILD_SA won't get build, but IKE_SA establishes anyway */
 767                                         break;
 768                                 case MOBIKE_SUPPORTED:
 769                                 case ADDITIONAL_IP4_ADDRESS:
 770                                 case ADDITIONAL_IP6_ADDRESS:
 771                                         /* handled in ike_mobike task */
 772                                         break;
 773                                 case AUTH_LIFETIME:
 774                                         /* handled in ike_auth_lifetime task */
 775                                         break;
 776                                 case ME_ENDPOINT:
 777                                         /* handled in ike_me task */
 778                                         break;
 779                                 default:
 780                                 {
 781                                         if (type < 16383)
 782                                         {
 783                                                 DBG1(DBG_IKE, "received %N notify error",
 784                                                          notify_type_names, type);
 785                                                 enumerator->destroy(enumerator);
 786                                                 return FAILED;
 787                                         }
 788                                         DBG2(DBG_IKE, "received %N notify",
 789                                                 notify_type_names, type);
 790                                         break;
 791                                 }
 792                         }
 793                 }
 794         }
 795         enumerator->destroy(enumerator);
 796
 797         if (this->my_auth)
 798         {
 799                 switch (this->my_auth->process(this->my_auth, message))
 800                 {
 801                         case SUCCESS:
 802                                 cfg = auth_cfg_create();
 803                                 cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE),
 804                                                    TRUE);
 805                                 this->ike_sa->add_auth_cfg(this->ike_sa, TRUE, cfg);
 806                                 this->my_auth->destroy(this->my_auth);
 807                                 this->my_auth = NULL;
 808                                 this->do_another_auth = do_another_auth(this);
 809                                 break;
 810                         case NEED_MORE:
 811                                 break;
 812                         default:
 813                                 return FAILED;
 814                 }
 815         }
 816
 817         if (this->expect_another_auth)
 818         {
 819                 if (this->other_auth == NULL)
 820                 {
 821                         id_payload_t *id_payload;
 822                         identification_t *id;
 823
 824                         /* responder is not allowed to do EAP */
 825                         if (!message->get_payload(message, AUTHENTICATION))
 826                         {
 827                                 DBG1(DBG_IKE, "AUTH payload missing");
 828                                 return FAILED;
 829                         }
 830
 831                         /* handle IDr payload */
 832                         id_payload = (id_payload_t*)message->get_payload(message,
 833                                                                                                                          ID_RESPONDER);
 834                         if (!id_payload)
 835                         {
 836                                 DBG1(DBG_IKE, "IDr payload missing");
 837                                 return FAILED;
 838                         }
 839                         id = id_payload->get_identification(id_payload);
 840                         this->ike_sa->set_other_id(this->ike_sa, id);
 841                         cfg = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
 842                         cfg->add(cfg, AUTH_RULE_IDENTITY, id->clone(id));
 843
 844                         /* verify authentication data */
 845                         this->other_auth = authenticator_create_verifier(this->ike_sa,
 846                                                         message, this->other_nonce, this->my_nonce,
 847                                                         this->other_packet->get_data(this->other_packet),
 848                                                         this->my_packet->get_data(this->my_packet));
 849                         if (!this->other_auth)
 850                         {
 851                                 return FAILED;
 852                         }
 853                 }
 854                 switch (this->other_auth->process(this->other_auth, message))
 855                 {
 856                         case SUCCESS:
 857                                 break;
 858                         case NEED_MORE:
 859                                 return NEED_MORE;
 860                         default:
 861                                 return FAILED;
 862                 }
 863                 /* store authentication information, reset authenticator */
 864                 cfg = auth_cfg_create();
 865                 cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, FALSE), FALSE);
 866                 this->ike_sa->add_auth_cfg(this->ike_sa, FALSE, cfg);
 867                 this->other_auth->destroy(this->other_auth);
 868                 this->other_auth = NULL;
 869
 870                 /* another auth round done, invoke authorize hook */
 871                 if (!charon->bus->authorize(charon->bus, FALSE))
 872                 {
 873                         DBG1(DBG_IKE, "authorization forbids IKE_SA, cancelling");
 874                         return FAILED;
 875                 }
 876         }
 877
 878         if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS) == NULL)
 879         {
 880                 this->expect_another_auth = FALSE;
 881         }
 882         if (!this->expect_another_auth && !this->do_another_auth && !this->my_auth)
 883         {
 884                 if (!update_cfg_candidates(this, TRUE))
 885                 {
 886                         return FAILED;
 887                 }
 888                 if (!charon->bus->authorize(charon->bus, TRUE))
 889                 {
 890                         DBG1(DBG_IKE, "final authorization hook forbids IKE_SA, cancelling");
 891                         return FAILED;
 892                 }
 893                 DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
 894                          this->ike_sa->get_name(this->ike_sa),
 895                          this->ike_sa->get_unique_id(this->ike_sa),
 896                          this->ike_sa->get_my_host(this->ike_sa),
 897                          this->ike_sa->get_my_id(this->ike_sa),
 898                          this->ike_sa->get_other_host(this->ike_sa),
 899                          this->ike_sa->get_other_id(this->ike_sa));
 900                 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
 901                 charon->bus->ike_updown(charon->bus, this->ike_sa, TRUE);
 902                 return SUCCESS;
 903         }
 904         return NEED_MORE;
 905 }
 906
 907 /**
 908  * Implementation of task_t.get_type
 909  */
 910 static task_type_t get_type(private_ike_auth_t *this)
 911 {
 912         return IKE_AUTHENTICATE;
 913 }
 914
 915 /**
 916  * Implementation of task_t.migrate
 917  */
 918 static void migrate(private_ike_auth_t *this, ike_sa_t *ike_sa)
 919 {
 920         chunk_free(&this->my_nonce);
 921         chunk_free(&this->other_nonce);
 922         DESTROY_IF(this->my_packet);
 923         DESTROY_IF(this->other_packet);
 924         DESTROY_IF(this->peer_cfg);
 925         DESTROY_IF(this->my_auth);
 926         DESTROY_IF(this->other_auth);
 927         this->candidates->destroy_offset(this->candidates, offsetof(peer_cfg_t, destroy));
 928
 929         this->my_packet = NULL;
 930         this->other_packet = NULL;
 931         this->ike_sa = ike_sa;
 932         this->peer_cfg = NULL;
 933         this->my_auth = NULL;
 934         this->other_auth = NULL;
 935         this->do_another_auth = TRUE;
 936         this->expect_another_auth = TRUE;
 937         this->authentication_failed = FALSE;
 938         this->candidates = linked_list_create();
 939 }
 940
 941 /**
 942  * Implementation of task_t.destroy
 943  */
 944 static void destroy(private_ike_auth_t *this)
 945 {
 946         chunk_free(&this->my_nonce);
 947         chunk_free(&this->other_nonce);
 948         DESTROY_IF(this->my_packet);
 949         DESTROY_IF(this->other_packet);
 950         DESTROY_IF(this->my_auth);
 951         DESTROY_IF(this->other_auth);
 952         DESTROY_IF(this->peer_cfg);
 953         this->candidates->destroy_offset(this->candidates, offsetof(peer_cfg_t, destroy));
 954         free(this);
 955 }
 956
 957 /*
 958  * Described in header.
 959  */
 960 ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, bool initiator)
 961 {
 962         private_ike_auth_t *this = malloc_thing(private_ike_auth_t);
 963
 964         this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 965         this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 966         this->public.task.destroy = (void(*)(task_t*))destroy;
 967
 968         if (initiator)
 969         {
 970                 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
 971                 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
 972         }
 973         else
 974         {
 975                 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 976                 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 977         }
 978
 979         this->ike_sa = ike_sa;
 980         this->initiator = initiator;
 981         this->my_nonce = chunk_empty;
 982         this->other_nonce = chunk_empty;
 983         this->my_packet = NULL;
 984         this->other_packet = NULL;
 985         this->peer_cfg = NULL;
 986         this->candidates = linked_list_create();
 987         this->my_auth = NULL;
 988         this->other_auth = NULL;
 989         this->do_another_auth = TRUE;
 990         this->expect_another_auth = TRUE;
 991         this->authentication_failed = FALSE;
 992
 993         return &this->public;
 994 }
 995