src/charon/sa/tasks/ike_init.c

   1 /*
   2  * Copyright (C) 2008 Tobias Brunner
   3  * Copyright (C) 2005-2007 Martin Willi
   4  * Copyright (C) 2005 Jan Hutter
   5  * Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  *
  17  * $Id$
  18  */
  19
  20 #include "ike_init.h"
  21
  22 #include <string.h>
  23
  24 #include <daemon.h>
  25 #include <crypto/diffie_hellman.h>
  26 #include <encoding/payloads/sa_payload.h>
  27 #include <encoding/payloads/ke_payload.h>
  28 #include <encoding/payloads/nonce_payload.h>
  29 #include <encoding/payloads/vendor_id_payload.h>
  30
  31 /** maximum retries to do with cookies/other dh groups */
  32 #define MAX_RETRIES 5
  33
  34 typedef struct private_ike_init_t private_ike_init_t;
  35
  36 /**
  37  * Private members of a ike_init_t task.
  38  */
  39 struct private_ike_init_t {
  40
  41         /**
  42          * Public methods and task_t interface.
  43          */
  44         ike_init_t public;
  45
  46         /**
  47          * Assigned IKE_SA.
  48          */
  49         ike_sa_t *ike_sa;
  50
  51         /**
  52          * Are we the initiator?
  53          */
  54         bool initiator;
  55
  56         /**
  57          * IKE config to establish
  58          */
  59         ike_cfg_t *config;
  60
  61         /**
  62          * diffie hellman group to use
  63          */
  64         diffie_hellman_group_t dh_group;
  65
  66         /**
  67          * Diffie hellman object used to generate public DH value.
  68          */
  69         diffie_hellman_t *dh;
  70
  71         /**
  72          * nonce chosen by us
  73          */
  74         chunk_t my_nonce;
  75
  76         /**
  77          * nonce chosen by peer
  78          */
  79         chunk_t other_nonce;
  80
  81         /**
  82          * Negotiated proposal used for IKE_SA
  83          */
  84         proposal_t *proposal;
  85
  86         /**
  87          * Old IKE_SA which gets rekeyed
  88          */
  89         ike_sa_t *old_sa;
  90
  91         /**
  92          * cookie received from responder
  93          */
  94         chunk_t cookie;
  95
  96         /**
  97          * retries done so far after failure (cookie or bad dh group)
  98          */
  99         u_int retry;
 100 };
 101
 102 /**
 103  * build the payloads for the message
 104  */
 105 static void build_payloads(private_ike_init_t *this, message_t *message)
 106 {
 107         sa_payload_t *sa_payload;
 108         ke_payload_t *ke_payload;
 109         nonce_payload_t *nonce_payload;
 110         linked_list_t *proposal_list;
 111         ike_sa_id_t *id;
 112         proposal_t *proposal;
 113         iterator_t *iterator;
 114
 115         id = this->ike_sa->get_id(this->ike_sa);
 116
 117         this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 118
 119         if (this->initiator)
 120         {
 121                 proposal_list = this->config->get_proposals(this->config);
 122                 if (this->old_sa)
 123                 {
 124                         /* include SPI of new IKE_SA when we are rekeying */
 125                         iterator = proposal_list->create_iterator(proposal_list, TRUE);
 126                         while (iterator->iterate(iterator, (void**)&proposal))
 127                         {
 128                                 proposal->set_spi(proposal, id->get_initiator_spi(id));
 129                         }
 130                         iterator->destroy(iterator);
 131                 }
 132
 133                 sa_payload = sa_payload_create_from_proposal_list(proposal_list);
 134                 proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
 135         }
 136         else
 137         {
 138                 if (this->old_sa)
 139                 {
 140                         /* include SPI of new IKE_SA when we are rekeying */
 141                         this->proposal->set_spi(this->proposal, id->get_responder_spi(id));
 142                 }
 143                 sa_payload = sa_payload_create_from_proposal(this->proposal);
 144         }
 145         message->add_payload(message, (payload_t*)sa_payload);
 146
 147         nonce_payload = nonce_payload_create();
 148         nonce_payload->set_nonce(nonce_payload, this->my_nonce);
 149         ke_payload = ke_payload_create_from_diffie_hellman(this->dh);
 150
 151         if (this->old_sa)
 152         {       /* payload order differs if we are rekeying */
 153                 message->add_payload(message, (payload_t*)nonce_payload);
 154                 message->add_payload(message, (payload_t*)ke_payload);
 155         }
 156         else
 157         {
 158                 message->add_payload(message, (payload_t*)ke_payload);
 159                 message->add_payload(message, (payload_t*)nonce_payload);
 160         }
 161 }
 162
 163 /**
 164  * Read payloads from message
 165  */
 166 static void process_payloads(private_ike_init_t *this, message_t *message)
 167 {
 168         iterator_t *iterator;
 169         payload_t *payload;
 170
 171         iterator = message->get_payload_iterator(message);
 172         while (iterator->iterate(iterator, (void**)&payload))
 173         {
 174                 switch (payload->get_type(payload))
 175                 {
 176                         case SECURITY_ASSOCIATION:
 177                         {
 178                                 sa_payload_t *sa_payload = (sa_payload_t*)payload;
 179                                 linked_list_t *proposal_list;
 180
 181                                 proposal_list = sa_payload->get_proposals(sa_payload);
 182                                 this->proposal = this->config->select_proposal(this->config,
 183                                                                                                                            proposal_list);
 184                                 proposal_list->destroy_offset(proposal_list,
 185                                                                                           offsetof(proposal_t, destroy));
 186                                 break;
 187                         }
 188                         case KEY_EXCHANGE:
 189                         {
 190                                 ke_payload_t *ke_payload = (ke_payload_t*)payload;
 191
 192                                 this->dh_group = ke_payload->get_dh_group_number(ke_payload);
 193                                 if (!this->initiator)
 194                                 {
 195                                         this->dh = lib->crypto->create_dh(lib->crypto, this->dh_group);
 196                                 }
 197                                 if (this->dh)
 198                                 {
 199                                         this->dh->set_other_public_value(this->dh,
 200                                                                 ke_payload->get_key_exchange_data(ke_payload));
 201                                 }
 202                                 break;
 203                         }
 204                         case NONCE:
 205                         {
 206                                 nonce_payload_t *nonce_payload = (nonce_payload_t*)payload;
 207
 208                                 this->other_nonce = nonce_payload->get_nonce(nonce_payload);
 209                                 break;
 210                         }
 211                         case VENDOR_ID:
 212                         {
 213                                 vendor_id_payload_t *vendor_id = (vendor_id_payload_t*)payload;
 214                                 chunk_t vid = vendor_id->get_data(vendor_id);
 215
 216                                 DBG1(DBG_ENC, "received vendor id: %#B", &vid);
 217                         }
 218                         default:
 219                                 break;
 220                 }
 221         }
 222         iterator->destroy(iterator);
 223 }
 224
 225 /**
 226  * Implementation of task_t.process for initiator
 227  */
 228 static status_t build_i(private_ike_init_t *this, message_t *message)
 229 {
 230         rng_t *rng;
 231
 232         this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 233         DBG0(DBG_IKE, "initiating IKE_SA %s[%d] to %H",
 234                  this->ike_sa->get_name(this->ike_sa),
 235                  this->ike_sa->get_unique_id(this->ike_sa),
 236                  this->ike_sa->get_other_host(this->ike_sa));
 237         this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 238
 239         if (this->retry++ >= MAX_RETRIES)
 240         {
 241                 DBG1(DBG_IKE, "giving up after %d retries", MAX_RETRIES);
 242                 return FAILED;
 243         }
 244
 245         /* if the DH group is set via use_dh_group(), we already have a DH object */
 246         if (!this->dh)
 247         {
 248                 this->dh_group = this->config->get_dh_group(this->config);
 249                 this->dh = lib->crypto->create_dh(lib->crypto, this->dh_group);
 250                 if (this->dh == NULL)
 251                 {
 252                         DBG1(DBG_IKE, "configured DH group %N not supported",
 253                                 diffie_hellman_group_names, this->dh_group);
 254                         return FAILED;
 255                 }
 256         }
 257
 258         /* generate nonce only when we are trying the first time */
 259         if (this->my_nonce.ptr == NULL)
 260         {
 261                 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 262                 if (!rng)
 263                 {
 264                         DBG1(DBG_IKE, "error generating nonce");
 265                         return FAILED;
 266                 }
 267                 rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
 268                 rng->destroy(rng);
 269         }
 270
 271         if (this->cookie.ptr)
 272         {
 273                 message->add_notify(message, FALSE, COOKIE, this->cookie);
 274         }
 275
 276         build_payloads(this, message);
 277
 278 #ifdef ME
 279         {
 280                 chunk_t connect_id = this->ike_sa->get_connect_id(this->ike_sa);
 281                 if (connect_id.ptr)
 282                 {
 283                         message->add_notify(message, FALSE, ME_CONNECTID, connect_id);
 284                 }
 285         }
 286 #endif /* ME */
 287
 288         return NEED_MORE;
 289 }
 290
 291 /**
 292  * Implementation of task_t.process for responder
 293  */
 294 static status_t process_r(private_ike_init_t *this, message_t *message)
 295 {
 296         rng_t *rng;
 297
 298         this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 299         DBG0(DBG_IKE, "%H is initiating an IKE_SA", message->get_source(message));
 300         this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 301
 302         rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 303         if (!rng)
 304         {
 305                 DBG1(DBG_IKE, "error generating nonce");
 306                 return FAILED;
 307         }
 308         rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
 309         rng->destroy(rng);
 310
 311 #ifdef ME
 312         {
 313                 chunk_t connect_id = chunk_empty;
 314                 iterator_t *iterator;
 315                 payload_t *payload;
 316
 317                 /* check for a ME_CONNECTID notify */
 318                 iterator = message->get_payload_iterator(message);
 319                 while (iterator->iterate(iterator, (void**)&payload))
 320                 {
 321                         if (payload->get_type(payload) == NOTIFY)
 322                         {
 323                                 notify_payload_t *notify = (notify_payload_t*)payload;
 324                                 notify_type_t type = notify->get_notify_type(notify);
 325
 326                                 switch (type)
 327                                 {
 328                                         case ME_CONNECTID:
 329                                         {
 330                                                 chunk_free(&connect_id);
 331                                                 connect_id = chunk_clone(notify->get_notification_data(notify));
 332                                                 DBG2(DBG_IKE, "received ME_CONNECTID %#B", &connect_id);
 333                                                 break;
 334                                         }
 335                                         default:
 336                                         {
 337                                                 if (type < 16383)
 338                                                 {
 339                                                         DBG1(DBG_IKE, "received %N notify error",
 340                                                                 notify_type_names, type);
 341                                                         break;
 342                                                 }
 343                                                 DBG2(DBG_IKE, "received %N notify",
 344                                                         notify_type_names, type);
 345                                                 break;
 346                                         }
 347                                 }
 348                         }
 349                 }
 350                 iterator->destroy(iterator);
 351
 352                 if (connect_id.ptr)
 353                 {
 354                         charon->connect_manager->stop_checks(charon->connect_manager,
 355                                 connect_id);
 356                         chunk_free(&connect_id);
 357                 }
 358         }
 359 #endif /* ME */
 360
 361         process_payloads(this, message);
 362
 363         return NEED_MORE;
 364 }
 365
 366 /**
 367  * Implementation of task_t.build for responder
 368  */
 369 static status_t build_r(private_ike_init_t *this, message_t *message)
 370 {
 371         chunk_t secret;
 372         status_t status;
 373
 374         /* check if we have everything we need */
 375         if (this->proposal == NULL ||
 376                 this->other_nonce.len == 0 || this->my_nonce.len == 0)
 377         {
 378                 DBG1(DBG_IKE, "received proposals inacceptable");
 379                 message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
 380                 return FAILED;
 381         }
 382
 383         if (this->dh == NULL ||
 384                 !this->proposal->has_dh_group(this->proposal, this->dh_group) ||
 385                 this->dh->get_shared_secret(this->dh, &secret) != SUCCESS)
 386         {
 387                 u_int16_t group;
 388
 389                 if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
 390                                                                                   &group, NULL))
 391                 {
 392                         DBG1(DBG_IKE, "DH group %N inacceptable, requesting %N",
 393                                  diffie_hellman_group_names, this->dh_group,
 394                                  diffie_hellman_group_names, group);
 395                         this->dh_group = group;
 396                         group = htons(group);
 397                         message->add_notify(message, FALSE, INVALID_KE_PAYLOAD,
 398                                                                 chunk_from_thing(group));
 399                 }
 400                 else
 401                 {
 402                         DBG1(DBG_IKE, "no acceptable proposal found");
 403                 }
 404                 return FAILED;
 405         }
 406
 407         if (this->old_sa)
 408         {
 409                 ike_sa_id_t *id;
 410                 prf_t *prf, *child_prf;
 411
 412                 /* Apply SPI if we are rekeying */
 413                 id = this->ike_sa->get_id(this->ike_sa);
 414                 id->set_initiator_spi(id, this->proposal->get_spi(this->proposal));
 415
 416                 /* setup crypto keys for the rekeyed SA */
 417                 prf = this->old_sa->get_prf(this->old_sa);
 418                 child_prf = this->old_sa->get_child_prf(this->old_sa);
 419                 status = this->ike_sa->derive_keys(this->ike_sa, this->proposal, secret,
 420                                                                                    this->other_nonce, this->my_nonce,
 421                                                                                    FALSE, child_prf, prf);
 422         }
 423         else
 424         {
 425                 /* setup crypto keys */
 426                 status =  this->ike_sa->derive_keys(this->ike_sa, this->proposal, secret,
 427                                                                                     this->other_nonce, this->my_nonce,
 428                                                                                     FALSE, NULL, NULL);
 429         }
 430         if (status != SUCCESS)
 431         {
 432                 DBG1(DBG_IKE, "key derivation failed");
 433                 message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
 434                 return FAILED;
 435         }
 436
 437         build_payloads(this, message);
 438         return SUCCESS;
 439 }
 440
 441 /**
 442  * Implementation of task_t.process for initiator
 443  */
 444 static status_t process_i(private_ike_init_t *this, message_t *message)
 445 {
 446         chunk_t secret;
 447         status_t status;
 448         iterator_t *iterator;
 449         payload_t *payload;
 450
 451         /* check for erronous notifies */
 452         iterator = message->get_payload_iterator(message);
 453         while (iterator->iterate(iterator, (void**)&payload))
 454         {
 455                 if (payload->get_type(payload) == NOTIFY)
 456                 {
 457                         notify_payload_t *notify = (notify_payload_t*)payload;
 458                         notify_type_t type = notify->get_notify_type(notify);
 459
 460                         switch (type)
 461                         {
 462                                 case INVALID_KE_PAYLOAD:
 463                                 {
 464                                         chunk_t data;
 465                                         diffie_hellman_group_t bad_group;
 466
 467                                         bad_group = this->dh_group;
 468                                         data = notify->get_notification_data(notify);
 469                                         this->dh_group = ntohs(*((u_int16_t*)data.ptr));
 470                                         DBG1(DBG_IKE, "peer didn't accept DH group %N, "
 471                                                  "it requested %N", diffie_hellman_group_names,
 472                                                  bad_group, diffie_hellman_group_names, this->dh_group);
 473
 474                                         if (this->old_sa == NULL)
 475                                         {       /* reset the IKE_SA if we are not rekeying */
 476                                                 this->ike_sa->reset(this->ike_sa);
 477                                         }
 478
 479                                         iterator->destroy(iterator);
 480                                         return NEED_MORE;
 481                                 }
 482                                 case NAT_DETECTION_SOURCE_IP:
 483                                 case NAT_DETECTION_DESTINATION_IP:
 484                                         /* skip, handled in ike_natd_t */
 485                                         break;
 486                                 case COOKIE:
 487                                 {
 488                                         chunk_free(&this->cookie);
 489                                         this->cookie = chunk_clone(notify->get_notification_data(notify));
 490                                         this->ike_sa->reset(this->ike_sa);
 491                                         iterator->destroy(iterator);
 492                                         DBG2(DBG_IKE, "received %N notify", notify_type_names, type);
 493                                         return NEED_MORE;
 494                                 }
 495                                 default:
 496                                 {
 497                                         if (type < 16383)
 498                                         {
 499                                                 DBG1(DBG_IKE, "received %N notify error",
 500                                                          notify_type_names, type);
 501                                                 iterator->destroy(iterator);
 502                                                 return FAILED;
 503                                         }
 504                                         DBG2(DBG_IKE, "received %N notify",
 505                                                 notify_type_names, type);
 506                                         break;
 507                                 }
 508                         }
 509                 }
 510         }
 511         iterator->destroy(iterator);
 512
 513         process_payloads(this, message);
 514
 515         /* check if we have everything */
 516         if (this->proposal == NULL ||
 517                 this->other_nonce.len == 0 || this->my_nonce.len == 0)
 518         {
 519                 DBG1(DBG_IKE, "peers proposal selection invalid");
 520                 return FAILED;
 521         }
 522
 523         if (this->dh == NULL ||
 524                 !this->proposal->has_dh_group(this->proposal, this->dh_group) ||
 525                 this->dh->get_shared_secret(this->dh, &secret) != SUCCESS)
 526         {
 527                 DBG1(DBG_IKE, "peer DH group selection invalid");
 528                 return FAILED;
 529         }
 530
 531         /* Apply SPI if we are rekeying */
 532         if (this->old_sa)
 533         {
 534                 ike_sa_id_t *id;
 535                 prf_t *prf, *child_prf;
 536
 537                 id = this->ike_sa->get_id(this->ike_sa);
 538                 id->set_responder_spi(id, this->proposal->get_spi(this->proposal));
 539
 540                 /* setup crypto keys for the rekeyed SA */
 541                 prf = this->old_sa->get_prf(this->old_sa);
 542                 child_prf = this->old_sa->get_child_prf(this->old_sa);
 543                 status = this->ike_sa->derive_keys(this->ike_sa, this->proposal, secret,
 544                                                                                     this->my_nonce, this->other_nonce,
 545                                                                                     TRUE, child_prf, prf);
 546         }
 547         else
 548         {
 549                 /* setup crypto keys for a new SA */
 550                 status = this->ike_sa->derive_keys(this->ike_sa, this->proposal, secret,
 551                                                                                    this->my_nonce, this->other_nonce,
 552                                                                                    TRUE, NULL, NULL);
 553         }
 554         if (status != SUCCESS)
 555         {
 556                 DBG1(DBG_IKE, "key derivation failed");
 557                 return FAILED;
 558         }
 559
 560         return SUCCESS;
 561 }
 562
 563 /**
 564  * Implementation of task_t.get_type
 565  */
 566 static task_type_t get_type(private_ike_init_t *this)
 567 {
 568         return IKE_INIT;
 569 }
 570
 571 /**
 572  * Implementation of task_t.get_type
 573  */
 574 static chunk_t get_lower_nonce(private_ike_init_t *this)
 575 {
 576         if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
 577                            min(this->my_nonce.len, this->other_nonce.len)) < 0)
 578         {
 579                 return this->my_nonce;
 580         }
 581         else
 582         {
 583                 return this->other_nonce;
 584         }
 585 }
 586
 587 /**
 588  * Implementation of task_t.migrate
 589  */
 590 static void migrate(private_ike_init_t *this, ike_sa_t *ike_sa)
 591 {
 592         DESTROY_IF(this->proposal);
 593         DESTROY_IF(this->dh);
 594         chunk_free(&this->other_nonce);
 595
 596         this->ike_sa = ike_sa;
 597         this->proposal = NULL;
 598         this->dh = lib->crypto->create_dh(lib->crypto, this->dh_group);
 599 }
 600
 601 /**
 602  * Implementation of task_t.destroy
 603  */
 604 static void destroy(private_ike_init_t *this)
 605 {
 606         DESTROY_IF(this->proposal);
 607         DESTROY_IF(this->dh);
 608         chunk_free(&this->my_nonce);
 609         chunk_free(&this->other_nonce);
 610         chunk_free(&this->cookie);
 611         free(this);
 612 }
 613
 614 /*
 615  * Described in header.
 616  */
 617 ike_init_t *ike_init_create(ike_sa_t *ike_sa, bool initiator, ike_sa_t *old_sa)
 618 {
 619         private_ike_init_t *this = malloc_thing(private_ike_init_t);
 620
 621         this->public.get_lower_nonce = (chunk_t(*)(ike_init_t*))get_lower_nonce;
 622         this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 623         this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 624         this->public.task.destroy = (void(*)(task_t*))destroy;
 625         if (initiator)
 626         {
 627                 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
 628                 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
 629         }
 630         else
 631         {
 632                 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 633                 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 634         }
 635
 636         this->ike_sa = ike_sa;
 637         this->initiator = initiator;
 638         this->dh_group = MODP_NONE;
 639         this->dh = NULL;
 640         this->my_nonce = chunk_empty;
 641         this->other_nonce = chunk_empty;
 642         this->cookie = chunk_empty;
 643         this->proposal = NULL;
 644         this->config = NULL;
 645         this->old_sa = old_sa;
 646         this->retry = 0;
 647
 648         return &this->public;
 649 }