Removed strayed code fragment
[strongswan.git] / src / charon / sa / tasks / ike_config.c
1 /*
2 * Copyright (C) 2007 Martin Willi
3 * Copyright (C) 2006-2007 Fabian Hartmann, Noah Heusser
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "ike_config.h"
18
19 #include <daemon.h>
20 #include <encoding/payloads/cp_payload.h>
21
22 typedef struct private_ike_config_t private_ike_config_t;
23
24 /**
25 * Private members of a ike_config_t task.
26 */
27 struct private_ike_config_t {
28
29 /**
30 * Public methods and task_t interface.
31 */
32 ike_config_t public;
33
34 /**
35 * Assigned IKE_SA.
36 */
37 ike_sa_t *ike_sa;
38
39 /**
40 * Are we the initiator?
41 */
42 bool initiator;
43
44 /**
45 * virtual ip
46 */
47 host_t *virtual_ip;
48
49 /**
50 * list of attributes requested and its handler, entry_t
51 */
52 linked_list_t *requested;
53 };
54
55 /**
56 * Entry for a requested attribute and the requesting handler
57 */
58 typedef struct {
59 /** attribute requested */
60 configuration_attribute_type_t type;
61 /** handler requesting this attribute */
62 attribute_handler_t *handler;
63 } entry_t;
64
65 /**
66 * build INTERNAL_IPV4/6_ADDRESS attribute from virtual ip
67 */
68 static configuration_attribute_t *build_vip(host_t *vip)
69 {
70 configuration_attribute_type_t type;
71 chunk_t chunk, prefix;
72
73 if (vip->get_family(vip) == AF_INET)
74 {
75 type = INTERNAL_IP4_ADDRESS;
76 if (vip->is_anyaddr(vip))
77 {
78 chunk = chunk_empty;
79 }
80 else
81 {
82 chunk = vip->get_address(vip);
83 }
84 }
85 else
86 {
87 type = INTERNAL_IP6_ADDRESS;
88 if (vip->is_anyaddr(vip))
89 {
90 chunk = chunk_empty;
91 }
92 else
93 {
94 prefix = chunk_alloca(1);
95 *prefix.ptr = 64;
96 chunk = vip->get_address(vip);
97 chunk = chunk_cata("cc", chunk, prefix);
98 }
99 }
100 return configuration_attribute_create_value(type, chunk);
101 }
102
103 /**
104 * Handle a received attribute as initiator
105 */
106 static void handle_attribute(private_ike_config_t *this,
107 configuration_attribute_t *ca)
108 {
109 attribute_handler_t *handler = NULL;
110 enumerator_t *enumerator;
111 entry_t *entry;
112
113 /* find the handler which requested this attribute */
114 enumerator = this->requested->create_enumerator(this->requested);
115 while (enumerator->enumerate(enumerator, &entry))
116 {
117 if (entry->type == ca->get_type(ca))
118 {
119 handler = entry->handler;
120 this->requested->remove_at(this->requested, enumerator);
121 free(entry);
122 break;
123 }
124 }
125 enumerator->destroy(enumerator);
126
127 /* and pass it to the handle function */
128 handler = lib->attributes->handle(lib->attributes,
129 this->ike_sa->get_other_id(this->ike_sa), handler,
130 ca->get_type(ca), ca->get_value(ca));
131 if (handler)
132 {
133 this->ike_sa->add_configuration_attribute(this->ike_sa,
134 handler, ca->get_type(ca), ca->get_value(ca));
135 }
136 }
137
138 /**
139 * process a single configuration attribute
140 */
141 static void process_attribute(private_ike_config_t *this,
142 configuration_attribute_t *ca)
143 {
144 host_t *ip;
145 chunk_t addr;
146 int family = AF_INET6;
147
148 switch (ca->get_type(ca))
149 {
150 case INTERNAL_IP4_ADDRESS:
151 family = AF_INET;
152 /* fall */
153 case INTERNAL_IP6_ADDRESS:
154 {
155 addr = ca->get_value(ca);
156 if (addr.len == 0)
157 {
158 ip = host_create_any(family);
159 }
160 else
161 {
162 /* skip prefix byte in IPv6 payload*/
163 if (family == AF_INET6)
164 {
165 addr.len--;
166 }
167 ip = host_create_from_chunk(family, addr, 0);
168 }
169 if (ip)
170 {
171 DESTROY_IF(this->virtual_ip);
172 this->virtual_ip = ip;
173 }
174 break;
175 }
176 default:
177 {
178 if (this->initiator)
179 {
180 handle_attribute(this, ca);
181 }
182 }
183 }
184 }
185
186 /**
187 * Scan for configuration payloads and attributes
188 */
189 static void process_payloads(private_ike_config_t *this, message_t *message)
190 {
191 enumerator_t *enumerator, *attributes;
192 payload_t *payload;
193
194 enumerator = message->create_payload_enumerator(message);
195 while (enumerator->enumerate(enumerator, &payload))
196 {
197 if (payload->get_type(payload) == CONFIGURATION)
198 {
199 cp_payload_t *cp = (cp_payload_t*)payload;
200 configuration_attribute_t *ca;
201
202 switch (cp->get_type(cp))
203 {
204 case CFG_REQUEST:
205 case CFG_REPLY:
206 {
207 attributes = cp->create_attribute_enumerator(cp);
208 while (attributes->enumerate(attributes, &ca))
209 {
210 DBG2(DBG_IKE, "processing %N attribute",
211 configuration_attribute_type_names, ca->get_type(ca));
212 process_attribute(this, ca);
213 }
214 attributes->destroy(attributes);
215 break;
216 }
217 default:
218 DBG1(DBG_IKE, "ignoring %N config payload",
219 config_type_names, cp->get_type(cp));
220 break;
221 }
222 }
223 }
224 enumerator->destroy(enumerator);
225 }
226
227 /**
228 * Implementation of task_t.process for initiator
229 */
230 static status_t build_i(private_ike_config_t *this, message_t *message)
231 {
232 if (message->get_message_id(message) == 1)
233 { /* in first IKE_AUTH only */
234 cp_payload_t *cp = NULL;
235 enumerator_t *enumerator;
236 attribute_handler_t *handler;
237 peer_cfg_t *config;
238 configuration_attribute_type_t type;
239 chunk_t data;
240 host_t *vip;
241
242 /* reuse virtual IP if we already have one */
243 vip = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
244 if (!vip)
245 {
246 config = this->ike_sa->get_peer_cfg(this->ike_sa);
247 vip = config->get_virtual_ip(config);
248 }
249 if (vip)
250 {
251 cp = cp_payload_create_type(CFG_REQUEST);
252 cp->add_attribute(cp, build_vip(vip));
253 }
254
255 enumerator = lib->attributes->create_initiator_enumerator(lib->attributes,
256 this->ike_sa->get_other_id(this->ike_sa), vip);
257 while (enumerator->enumerate(enumerator, &handler, &type, &data))
258 {
259 configuration_attribute_t *ca;
260 entry_t *entry;
261
262 /* create configuration attribute */
263 DBG2(DBG_IKE, "building %N attribute",
264 configuration_attribute_type_names, type);
265 ca = configuration_attribute_create_value(type, data);
266 if (!cp)
267 {
268 cp = cp_payload_create_type(CFG_REQUEST);
269 }
270 cp->add_attribute(cp, ca);
271
272 /* save handler along with requested type */
273 entry = malloc_thing(entry_t);
274 entry->type = type;
275 entry->handler = handler;
276
277 this->requested->insert_last(this->requested, entry);
278 }
279 enumerator->destroy(enumerator);
280
281 if (cp)
282 {
283 message->add_payload(message, (payload_t*)cp);
284 }
285 }
286 return NEED_MORE;
287 }
288
289 /**
290 * Implementation of task_t.process for responder
291 */
292 static status_t process_r(private_ike_config_t *this, message_t *message)
293 {
294 if (message->get_message_id(message) == 1)
295 { /* in first IKE_AUTH only */
296 process_payloads(this, message);
297 }
298 return NEED_MORE;
299 }
300
301 /**
302 * Find a peer (EAP) identity to query provider for attributes
303 */
304 static identification_t *get_peer_identity(private_ike_config_t *this)
305 {
306 identification_t *id = NULL, *current;
307 enumerator_t *enumerator;
308 auth_cfg_t *cfg;
309
310 enumerator = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, FALSE);
311 while (enumerator->enumerate(enumerator, &cfg))
312 {
313 /* prefer EAP-Identity of last round */
314 current = cfg->get(cfg, AUTH_RULE_EAP_IDENTITY);
315 if (!current || current->get_type(current) == ID_ANY)
316 {
317 current = cfg->get(cfg, AUTH_RULE_IDENTITY);
318 }
319 if (current && current->get_type(current) != ID_ANY)
320 {
321 id = current;
322 continue;
323 }
324 }
325 enumerator->destroy(enumerator);
326 if (!id)
327 { /* fallback, should not happen */
328 id = this->ike_sa->get_other_id(this->ike_sa);
329 }
330 return id;
331 }
332
333 /**
334 * Implementation of task_t.build for responder
335 */
336 static status_t build_r(private_ike_config_t *this, message_t *message)
337 {
338 if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
339 { /* in last IKE_AUTH exchange */
340 enumerator_t *enumerator;
341 configuration_attribute_type_t type;
342 chunk_t value;
343 host_t *vip = NULL;
344 cp_payload_t *cp = NULL;
345 peer_cfg_t *config;
346 identification_t *id;
347
348 id = get_peer_identity(this);
349
350 config = this->ike_sa->get_peer_cfg(this->ike_sa);
351 if (config && this->virtual_ip)
352 {
353 DBG1(DBG_IKE, "peer requested virtual IP %H", this->virtual_ip);
354 if (config->get_pool(config))
355 {
356 vip = lib->attributes->acquire_address(lib->attributes,
357 config->get_pool(config), id, this->virtual_ip);
358 }
359 if (vip == NULL)
360 {
361 DBG1(DBG_IKE, "no virtual IP found, sending %N",
362 notify_type_names, INTERNAL_ADDRESS_FAILURE);
363 message->add_notify(message, FALSE, INTERNAL_ADDRESS_FAILURE,
364 chunk_empty);
365 return SUCCESS;
366 }
367 DBG1(DBG_IKE, "assigning virtual IP %H to peer", vip);
368 this->ike_sa->set_virtual_ip(this->ike_sa, FALSE, vip);
369
370 cp = cp_payload_create_type(CFG_REPLY);
371 cp->add_attribute(cp, build_vip(vip));
372 }
373
374 /* query registered providers for additional attributes to include */
375 enumerator = lib->attributes->create_responder_enumerator(
376 lib->attributes, id, vip);
377 while (enumerator->enumerate(enumerator, &type, &value))
378 {
379 if (!cp)
380 {
381 cp = cp_payload_create_type(CFG_REPLY);
382 }
383 DBG2(DBG_IKE, "building %N attribute",
384 configuration_attribute_type_names, type);
385 cp->add_attribute(cp,
386 configuration_attribute_create_value(type, value));
387 }
388 enumerator->destroy(enumerator);
389
390 if (cp)
391 {
392 message->add_payload(message, (payload_t*)cp);
393 }
394 DESTROY_IF(vip);
395 return SUCCESS;
396 }
397 return NEED_MORE;
398 }
399
400 /**
401 * Implementation of task_t.process for initiator
402 */
403 static status_t process_i(private_ike_config_t *this, message_t *message)
404 {
405 if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
406 { /* in last IKE_AUTH exchange */
407
408 process_payloads(this, message);
409
410 if (this->virtual_ip)
411 {
412 this->ike_sa->set_virtual_ip(this->ike_sa, TRUE, this->virtual_ip);
413 }
414 return SUCCESS;
415 }
416 return NEED_MORE;
417 }
418
419 /**
420 * Implementation of task_t.get_type
421 */
422 static task_type_t get_type(private_ike_config_t *this)
423 {
424 return IKE_CONFIG;
425 }
426
427 /**
428 * Implementation of task_t.migrate
429 */
430 static void migrate(private_ike_config_t *this, ike_sa_t *ike_sa)
431 {
432 DESTROY_IF(this->virtual_ip);
433
434 this->ike_sa = ike_sa;
435 this->virtual_ip = NULL;
436 this->requested->destroy_function(this->requested, free);
437 this->requested = linked_list_create();
438 }
439
440 /**
441 * Implementation of task_t.destroy
442 */
443 static void destroy(private_ike_config_t *this)
444 {
445 DESTROY_IF(this->virtual_ip);
446 this->requested->destroy_function(this->requested, free);
447 free(this);
448 }
449
450 /*
451 * Described in header.
452 */
453 ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator)
454 {
455 private_ike_config_t *this = malloc_thing(private_ike_config_t);
456
457 this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
458 this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
459 this->public.task.destroy = (void(*)(task_t*))destroy;
460
461 this->initiator = initiator;
462 this->ike_sa = ike_sa;
463 this->virtual_ip = NULL;
464 this->requested = linked_list_create();
465
466 if (initiator)
467 {
468 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
469 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
470 }
471 else
472 {
473 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
474 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
475 }
476
477 return &this->public;
478 }
479