src/charon/sa/tasks/ike_init.c

   1 /*
   2  * Copyright (C) 2008 Tobias Brunner
   3  * Copyright (C) 2005-2007 Martin Willi
   4  * Copyright (C) 2005 Jan Hutter
   5  * Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  *
  17  * $Id$
  18  */
  19
  20 #include "ike_init.h"
  21
  22 #include <string.h>
  23
  24 #include <daemon.h>
  25 #include <crypto/diffie_hellman.h>
  26 #include <encoding/payloads/sa_payload.h>
  27 #include <encoding/payloads/ke_payload.h>
  28 #include <encoding/payloads/nonce_payload.h>
  29 #include <encoding/payloads/vendor_id_payload.h>
  30
  31 /** maximum retries to do with cookies/other dh groups */
  32 #define MAX_RETRIES 5
  33
  34 typedef struct private_ike_init_t private_ike_init_t;
  35
  36 /**
  37  * Private members of a ike_init_t task.
  38  */
  39 struct private_ike_init_t {
  40
  41         /**
  42          * Public methods and task_t interface.
  43          */
  44         ike_init_t public;
  45
  46         /**
  47          * Assigned IKE_SA.
  48          */
  49         ike_sa_t *ike_sa;
  50
  51         /**
  52          * Are we the initiator?
  53          */
  54         bool initiator;
  55
  56         /**
  57          * IKE config to establish
  58          */
  59         ike_cfg_t *config;
  60
  61         /**
  62          * diffie hellman group to use
  63          */
  64         diffie_hellman_group_t dh_group;
  65
  66         /**
  67          * Diffie hellman object used to generate public DH value.
  68          */
  69         diffie_hellman_t *dh;
  70
  71         /**
  72          * nonce chosen by us
  73          */
  74         chunk_t my_nonce;
  75
  76         /**
  77          * nonce chosen by peer
  78          */
  79         chunk_t other_nonce;
  80
  81         /**
  82          * Negotiated proposal used for IKE_SA
  83          */
  84         proposal_t *proposal;
  85
  86         /**
  87          * Old IKE_SA which gets rekeyed
  88          */
  89         ike_sa_t *old_sa;
  90
  91         /**
  92          * cookie received from responder
  93          */
  94         chunk_t cookie;
  95
  96         /**
  97          * retries done so far after failure (cookie or bad dh group)
  98          */
  99         u_int retry;
 100 };
 101
 102 /**
 103  * build the payloads for the message
 104  */
 105 static void build_payloads(private_ike_init_t *this, message_t *message)
 106 {
 107         sa_payload_t *sa_payload;
 108         ke_payload_t *ke_payload;
 109         nonce_payload_t *nonce_payload;
 110         linked_list_t *proposal_list;
 111         ike_sa_id_t *id;
 112         proposal_t *proposal;
 113         iterator_t *iterator;
 114
 115         id = this->ike_sa->get_id(this->ike_sa);
 116
 117         this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 118
 119         if (this->initiator)
 120         {
 121                 proposal_list = this->config->get_proposals(this->config);
 122                 if (this->old_sa)
 123                 {
 124                         /* include SPI of new IKE_SA when we are rekeying */
 125                         iterator = proposal_list->create_iterator(proposal_list, TRUE);
 126                         while (iterator->iterate(iterator, (void**)&proposal))
 127                         {
 128                                 proposal->set_spi(proposal, id->get_initiator_spi(id));
 129                         }
 130                         iterator->destroy(iterator);
 131                 }
 132
 133                 sa_payload = sa_payload_create_from_proposal_list(proposal_list);
 134                 proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
 135         }
 136         else
 137         {
 138                 if (this->old_sa)
 139                 {
 140                         /* include SPI of new IKE_SA when we are rekeying */
 141                         this->proposal->set_spi(this->proposal, id->get_responder_spi(id));
 142                 }
 143                 sa_payload = sa_payload_create_from_proposal(this->proposal);
 144         }
 145         message->add_payload(message, (payload_t*)sa_payload);
 146
 147         nonce_payload = nonce_payload_create();
 148         nonce_payload->set_nonce(nonce_payload, this->my_nonce);
 149         ke_payload = ke_payload_create_from_diffie_hellman(this->dh);
 150
 151         if (this->old_sa)
 152         {       /* payload order differs if we are rekeying */
 153                 message->add_payload(message, (payload_t*)nonce_payload);
 154                 message->add_payload(message, (payload_t*)ke_payload);
 155         }
 156         else
 157         {
 158                 message->add_payload(message, (payload_t*)ke_payload);
 159                 message->add_payload(message, (payload_t*)nonce_payload);
 160         }
 161 }
 162
 163 /**
 164  * Read payloads from message
 165  */
 166 static void process_payloads(private_ike_init_t *this, message_t *message)
 167 {
 168         iterator_t *iterator;
 169         payload_t *payload;
 170
 171         iterator = message->get_payload_iterator(message);
 172         while (iterator->iterate(iterator, (void**)&payload))
 173         {
 174                 switch (payload->get_type(payload))
 175                 {
 176                         case SECURITY_ASSOCIATION:
 177                         {
 178                                 sa_payload_t *sa_payload = (sa_payload_t*)payload;
 179                                 linked_list_t *proposal_list;
 180
 181                                 proposal_list = sa_payload->get_proposals(sa_payload);
 182                                 this->proposal = this->config->select_proposal(this->config,
 183                                                                                                                            proposal_list);
 184                                 proposal_list->destroy_offset(proposal_list,
 185                                                                                           offsetof(proposal_t, destroy));
 186                                 break;
 187                         }
 188                         case KEY_EXCHANGE:
 189                         {
 190                                 ke_payload_t *ke_payload = (ke_payload_t*)payload;
 191
 192                                 this->dh_group = ke_payload->get_dh_group_number(ke_payload);
 193                                 if (!this->initiator)
 194                                 {
 195                                         this->dh = lib->crypto->create_dh(lib->crypto, this->dh_group);
 196                                 }
 197                                 if (this->dh)
 198                                 {
 199                                         this->dh->set_other_public_value(this->dh,
 200                                                                 ke_payload->get_key_exchange_data(ke_payload));
 201                                 }
 202                                 break;
 203                         }
 204                         case NONCE:
 205                         {
 206                                 nonce_payload_t *nonce_payload = (nonce_payload_t*)payload;
 207
 208                                 this->other_nonce = nonce_payload->get_nonce(nonce_payload);
 209                                 break;
 210                         }
 211                         case VENDOR_ID:
 212                         {
 213                                 vendor_id_payload_t *vendor_id = (vendor_id_payload_t*)payload;
 214                                 chunk_t vid = vendor_id->get_data(vendor_id);
 215
 216                                 DBG1(DBG_ENC, "received vendor id: %#B", &vid);
 217                         }
 218                         default:
 219                                 break;
 220                 }
 221         }
 222         iterator->destroy(iterator);
 223 }
 224
 225 /**
 226  * Implementation of task_t.process for initiator
 227  */
 228 static status_t build_i(private_ike_init_t *this, message_t *message)
 229 {
 230         rng_t *rng;
 231
 232         this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 233         SIG_IKE(UP_START, "initiating IKE_SA %s[%d] to %H",
 234                 this->ike_sa->get_name(this->ike_sa),
 235                 this->ike_sa->get_unique_id(this->ike_sa),
 236                 this->ike_sa->get_other_host(this->ike_sa));
 237         this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 238
 239         if (this->retry++ >= MAX_RETRIES)
 240         {
 241                 SIG_IKE(UP_FAILED, "giving up after %d retries", MAX_RETRIES);
 242                 return FAILED;
 243         }
 244
 245         /* if the DH group is set via use_dh_group(), we already have a DH object */
 246         if (!this->dh)
 247         {
 248                 this->dh_group = this->config->get_dh_group(this->config);
 249                 this->dh = lib->crypto->create_dh(lib->crypto, this->dh_group);
 250                 if (this->dh == NULL)
 251                 {
 252                         SIG_IKE(UP_FAILED, "configured DH group %N not supported",
 253                                 diffie_hellman_group_names, this->dh_group);
 254                         return FAILED;
 255                 }
 256         }
 257
 258         /* generate nonce only when we are trying the first time */
 259         if (this->my_nonce.ptr == NULL)
 260         {
 261                 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 262                 if (!rng)
 263                 {
 264                         SIG_IKE(UP_FAILED, "error generating nonce");
 265                         return FAILED;
 266                 }
 267                 rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
 268                 rng->destroy(rng);
 269         }
 270
 271         if (this->cookie.ptr)
 272         {
 273                 message->add_notify(message, FALSE, COOKIE, this->cookie);
 274         }
 275
 276         build_payloads(this, message);
 277
 278 #ifdef ME
 279         {
 280                 chunk_t connect_id = this->ike_sa->get_connect_id(this->ike_sa);
 281                 if (connect_id.ptr)
 282                 {
 283                         message->add_notify(message, FALSE, ME_CONNECTID, connect_id);
 284                 }
 285         }
 286 #endif /* ME */
 287
 288         return NEED_MORE;
 289 }
 290
 291 /**
 292  * Implementation of task_t.process for responder
 293  */
 294 static status_t process_r(private_ike_init_t *this, message_t *message)
 295 {
 296         rng_t *rng;
 297
 298         this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 299         SIG_IKE(UP_START, "%H is initiating an IKE_SA",
 300                 message->get_source(message));
 301         this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 302
 303         rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 304         if (!rng)
 305         {
 306                 DBG1(DBG_IKE, "error generating nonce");
 307                 return FAILED;
 308         }
 309         rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
 310         rng->destroy(rng);
 311
 312 #ifdef ME
 313         {
 314                 chunk_t connect_id = chunk_empty;
 315                 iterator_t *iterator;
 316                 payload_t *payload;
 317
 318                 /* check for a ME_CONNECTID notify */
 319                 iterator = message->get_payload_iterator(message);
 320                 while (iterator->iterate(iterator, (void**)&payload))
 321                 {
 322                         if (payload->get_type(payload) == NOTIFY)
 323                         {
 324                                 notify_payload_t *notify = (notify_payload_t*)payload;
 325                                 notify_type_t type = notify->get_notify_type(notify);
 326
 327                                 switch (type)
 328                                 {
 329                                         case ME_CONNECTID:
 330                                         {
 331                                                 chunk_free(&connect_id);
 332                                                 connect_id = chunk_clone(notify->get_notification_data(notify));
 333                                                 DBG2(DBG_IKE, "received ME_CONNECTID %#B", &connect_id);
 334                                                 break;
 335                                         }
 336                                         default:
 337                                         {
 338                                                 if (type < 16383)
 339                                                 {
 340                                                         DBG1(DBG_IKE, "received %N notify error",
 341                                                                 notify_type_names, type);
 342                                                         break;
 343                                                 }
 344                                                 DBG2(DBG_IKE, "received %N notify",
 345                                                         notify_type_names, type);
 346                                                 break;
 347                                         }
 348                                 }
 349                         }
 350                 }
 351                 iterator->destroy(iterator);
 352
 353                 if (connect_id.ptr)
 354                 {
 355                         charon->connect_manager->stop_checks(charon->connect_manager,
 356                                 connect_id);
 357                         chunk_free(&connect_id);
 358                 }
 359         }
 360 #endif /* ME */
 361
 362         process_payloads(this, message);
 363
 364         return NEED_MORE;
 365 }
 366
 367 /**
 368  * Implementation of task_t.build for responder
 369  */
 370 static status_t build_r(private_ike_init_t *this, message_t *message)
 371 {
 372         chunk_t secret;
 373         status_t status;
 374
 375         /* check if we have everything we need */
 376         if (this->proposal == NULL ||
 377                 this->other_nonce.len == 0 || this->my_nonce.len == 0)
 378         {
 379                 SIG_IKE(UP_FAILED, "received proposals inacceptable");
 380                 message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
 381                 return FAILED;
 382         }
 383
 384         if (this->dh == NULL ||
 385                 !this->proposal->has_dh_group(this->proposal, this->dh_group) ||
 386                 this->dh->get_shared_secret(this->dh, &secret) != SUCCESS)
 387         {
 388                 u_int16_t group;
 389
 390                 if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
 391                                                                                   &group, NULL))
 392                 {
 393                         SIG_CHD(UP_FAILED, NULL, "DH group %N inacceptable, requesting %N",
 394                                 diffie_hellman_group_names, this->dh_group,
 395                                 diffie_hellman_group_names, group);
 396                         this->dh_group = group;
 397                         group = htons(group);
 398                         message->add_notify(message, FALSE, INVALID_KE_PAYLOAD,
 399                                                                 chunk_from_thing(group));
 400                 }
 401                 else
 402                 {
 403                         SIG_IKE(UP_FAILED, "no acceptable proposal found");
 404                 }
 405                 return FAILED;
 406         }
 407
 408         if (this->old_sa)
 409         {
 410                 ike_sa_id_t *id;
 411                 prf_t *prf, *child_prf;
 412
 413                 /* Apply SPI if we are rekeying */
 414                 id = this->ike_sa->get_id(this->ike_sa);
 415                 id->set_initiator_spi(id, this->proposal->get_spi(this->proposal));
 416
 417                 /* setup crypto keys for the rekeyed SA */
 418                 prf = this->old_sa->get_prf(this->old_sa);
 419                 child_prf = this->old_sa->get_child_prf(this->old_sa);
 420                 status = this->ike_sa->derive_keys(this->ike_sa, this->proposal, secret,
 421                                                                                    this->other_nonce, this->my_nonce,
 422                                                                                    FALSE, child_prf, prf);
 423         }
 424         else
 425         {
 426                 /* setup crypto keys */
 427                 status =  this->ike_sa->derive_keys(this->ike_sa, this->proposal, secret,
 428                                                                                     this->other_nonce, this->my_nonce,
 429                                                                                     FALSE, NULL, NULL);
 430         }
 431         if (status != SUCCESS)
 432         {
 433                 SIG_IKE(UP_FAILED, "key derivation failed");
 434                 message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
 435                 return FAILED;
 436         }
 437
 438         /* Keep the selected IKE proposal for status information purposes */
 439         {
 440                 char buf[BUF_LEN];
 441
 442                 snprintf(buf, BUF_LEN, "%P", this->proposal);
 443                 this->ike_sa->set_proposal(this->ike_sa, buf+4);
 444         }
 445
 446         build_payloads(this, message);
 447         return SUCCESS;
 448 }
 449
 450 /**
 451  * Implementation of task_t.process for initiator
 452  */
 453 static status_t process_i(private_ike_init_t *this, message_t *message)
 454 {
 455         chunk_t secret;
 456         status_t status;
 457         iterator_t *iterator;
 458         payload_t *payload;
 459
 460         /* check for erronous notifies */
 461         iterator = message->get_payload_iterator(message);
 462         while (iterator->iterate(iterator, (void**)&payload))
 463         {
 464                 if (payload->get_type(payload) == NOTIFY)
 465                 {
 466                         notify_payload_t *notify = (notify_payload_t*)payload;
 467                         notify_type_t type = notify->get_notify_type(notify);
 468
 469                         switch (type)
 470                         {
 471                                 case INVALID_KE_PAYLOAD:
 472                                 {
 473                                         chunk_t data;
 474                                         diffie_hellman_group_t bad_group;
 475
 476                                         bad_group = this->dh_group;
 477                                         data = notify->get_notification_data(notify);
 478                                         this->dh_group = ntohs(*((u_int16_t*)data.ptr));
 479                                         DBG1(DBG_IKE, "peer didn't accept DH group %N, "
 480                                                  "it requested %N", diffie_hellman_group_names,
 481                                                  bad_group, diffie_hellman_group_names, this->dh_group);
 482
 483                                         if (this->old_sa == NULL)
 484                                         {       /* reset the IKE_SA if we are not rekeying */
 485                                                 this->ike_sa->reset(this->ike_sa);
 486                                         }
 487
 488                                         iterator->destroy(iterator);
 489                                         return NEED_MORE;
 490                                 }
 491                                 case NAT_DETECTION_SOURCE_IP:
 492                                 case NAT_DETECTION_DESTINATION_IP:
 493                                         /* skip, handled in ike_natd_t */
 494                                         break;
 495                                 case COOKIE:
 496                                 {
 497                                         chunk_free(&this->cookie);
 498                                         this->cookie = chunk_clone(notify->get_notification_data(notify));
 499                                         this->ike_sa->reset(this->ike_sa);
 500                                         iterator->destroy(iterator);
 501                                         DBG2(DBG_IKE, "received %N notify", notify_type_names, type);
 502                                         return NEED_MORE;
 503                                 }
 504                                 default:
 505                                 {
 506                                         if (type < 16383)
 507                                         {
 508                                                 SIG_IKE(UP_FAILED, "received %N notify error",
 509                                                          notify_type_names, type);
 510                                                 iterator->destroy(iterator);
 511                                                 return FAILED;
 512                                         }
 513                                         DBG2(DBG_IKE, "received %N notify",
 514                                                 notify_type_names, type);
 515                                         break;
 516                                 }
 517                         }
 518                 }
 519         }
 520         iterator->destroy(iterator);
 521
 522         process_payloads(this, message);
 523
 524         /* check if we have everything */
 525         if (this->proposal == NULL ||
 526                 this->other_nonce.len == 0 || this->my_nonce.len == 0)
 527         {
 528                 SIG_IKE(UP_FAILED, "peer's proposal selection invalid");
 529                 return FAILED;
 530         }
 531
 532         if (this->dh == NULL ||
 533                 !this->proposal->has_dh_group(this->proposal, this->dh_group) ||
 534                 this->dh->get_shared_secret(this->dh, &secret) != SUCCESS)
 535         {
 536                 SIG_IKE(UP_FAILED, "peer's DH group selection invalid");
 537                 return FAILED;
 538         }
 539
 540         /* Apply SPI if we are rekeying */
 541         if (this->old_sa)
 542         {
 543                 ike_sa_id_t *id;
 544                 prf_t *prf, *child_prf;
 545
 546                 id = this->ike_sa->get_id(this->ike_sa);
 547                 id->set_responder_spi(id, this->proposal->get_spi(this->proposal));
 548
 549                 /* setup crypto keys for the rekeyed SA */
 550                 prf = this->old_sa->get_prf(this->old_sa);
 551                 child_prf = this->old_sa->get_child_prf(this->old_sa);
 552                 status = this->ike_sa->derive_keys(this->ike_sa, this->proposal, secret,
 553                                                                                     this->my_nonce, this->other_nonce,
 554                                                                                     TRUE, child_prf, prf);
 555         }
 556         else
 557         {
 558                 /* setup crypto keys for a new SA */
 559                 status = this->ike_sa->derive_keys(this->ike_sa, this->proposal, secret,
 560                                                                                    this->my_nonce, this->other_nonce,
 561                                                                                    TRUE, NULL, NULL);
 562         }
 563         if (status != SUCCESS)
 564         {
 565                 SIG_IKE(UP_FAILED, "key derivation failed");
 566                 return FAILED;
 567         }
 568
 569         /* Keep the selected IKE proposal for status information purposes */
 570         {
 571                 char buf[BUF_LEN];
 572
 573                 snprintf(buf, BUF_LEN, "%P", this->proposal);
 574                 this->ike_sa->set_proposal(this->ike_sa, buf+4);
 575         }
 576
 577         return SUCCESS;
 578 }
 579
 580 /**
 581  * Implementation of task_t.get_type
 582  */
 583 static task_type_t get_type(private_ike_init_t *this)
 584 {
 585         return IKE_INIT;
 586 }
 587
 588 /**
 589  * Implementation of task_t.get_type
 590  */
 591 static chunk_t get_lower_nonce(private_ike_init_t *this)
 592 {
 593         if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
 594                            min(this->my_nonce.len, this->other_nonce.len)) < 0)
 595         {
 596                 return this->my_nonce;
 597         }
 598         else
 599         {
 600                 return this->other_nonce;
 601         }
 602 }
 603
 604 /**
 605  * Implementation of task_t.migrate
 606  */
 607 static void migrate(private_ike_init_t *this, ike_sa_t *ike_sa)
 608 {
 609         DESTROY_IF(this->proposal);
 610         DESTROY_IF(this->dh);
 611         chunk_free(&this->other_nonce);
 612
 613         this->ike_sa = ike_sa;
 614         this->proposal = NULL;
 615         this->dh = lib->crypto->create_dh(lib->crypto, this->dh_group);
 616 }
 617
 618 /**
 619  * Implementation of task_t.destroy
 620  */
 621 static void destroy(private_ike_init_t *this)
 622 {
 623         DESTROY_IF(this->proposal);
 624         DESTROY_IF(this->dh);
 625         chunk_free(&this->my_nonce);
 626         chunk_free(&this->other_nonce);
 627         chunk_free(&this->cookie);
 628         free(this);
 629 }
 630
 631 /*
 632  * Described in header.
 633  */
 634 ike_init_t *ike_init_create(ike_sa_t *ike_sa, bool initiator, ike_sa_t *old_sa)
 635 {
 636         private_ike_init_t *this = malloc_thing(private_ike_init_t);
 637
 638         this->public.get_lower_nonce = (chunk_t(*)(ike_init_t*))get_lower_nonce;
 639         this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 640         this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 641         this->public.task.destroy = (void(*)(task_t*))destroy;
 642         if (initiator)
 643         {
 644                 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
 645                 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
 646         }
 647         else
 648         {
 649                 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 650                 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 651         }
 652
 653         this->ike_sa = ike_sa;
 654         this->initiator = initiator;
 655         this->dh_group = MODP_NONE;
 656         this->dh = NULL;
 657         this->my_nonce = chunk_empty;
 658         this->other_nonce = chunk_empty;
 659         this->cookie = chunk_empty;
 660         this->proposal = NULL;
 661         this->config = NULL;
 662         this->old_sa = old_sa;
 663         this->retry = 0;
 664
 665         return &this->public;
 666 }