f3283e45178600ae68e49a51290e356daab24add
[strongswan.git] / src / libcharon / encoding / payloads / notify_payload.c
1 /*
2 * Copyright (C) 2006-2008 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2006 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 #include <stddef.h>
20
21 #include "notify_payload.h"
22
23 #include <daemon.h>
24 #include <encoding/payloads/encodings.h>
25 #include <crypto/hashers/hasher.h>
26
27 ENUM_BEGIN(notify_type_names, UNSUPPORTED_CRITICAL_PAYLOAD, UNSUPPORTED_CRITICAL_PAYLOAD,
28 "UNSUPPORTED_CRITICAL_PAYLOAD");
29 ENUM_NEXT(notify_type_names, INVALID_IKE_SPI, INVALID_MAJOR_VERSION, UNSUPPORTED_CRITICAL_PAYLOAD,
30 "INVALID_IKE_SPI",
31 "INVALID_MAJOR_VERSION");
32 ENUM_NEXT(notify_type_names, INVALID_SYNTAX, INVALID_SYNTAX, INVALID_MAJOR_VERSION,
33 "INVALID_SYNTAX");
34 ENUM_NEXT(notify_type_names, INVALID_MESSAGE_ID, INVALID_MESSAGE_ID, INVALID_SYNTAX,
35 "INVALID_MESSAGE_ID");
36 ENUM_NEXT(notify_type_names, INVALID_SPI, INVALID_SPI, INVALID_MESSAGE_ID,
37 "INVALID_SPI");
38 ENUM_NEXT(notify_type_names, NO_PROPOSAL_CHOSEN, NO_PROPOSAL_CHOSEN, INVALID_SPI,
39 "NO_PROPOSAL_CHOSEN");
40 ENUM_NEXT(notify_type_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL_CHOSEN,
41 "INVALID_KE_PAYLOAD");
42 ENUM_NEXT(notify_type_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
43 "AUTHENTICATION_FAILED");
44 ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, CHILD_SA_NOT_FOUND, AUTHENTICATION_FAILED,
45 "SINGLE_PAIR_REQUIRED",
46 "NO_ADDITIONAL_SAS",
47 "INTERNAL_ADDRESS_FAILURE",
48 "FAILED_CP_REQUIRED",
49 "TS_UNACCEPTABLE",
50 "INVALID_SELECTORS",
51 "UNACCEPTABLE_ADDRESSES",
52 "UNEXPECTED_NAT_DETECTED",
53 "USE_ASSIGNED_HoA",
54 "TEMPORARY_FAILURE",
55 "CHILD_SA_NOT_FOUND");
56 ENUM_NEXT(notify_type_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, CHILD_SA_NOT_FOUND,
57 "ME_CONNECT_FAILED");
58 ENUM_NEXT(notify_type_names, INITIAL_CONTACT, EAP_ONLY_AUTHENTICATION, ME_CONNECT_FAILED,
59 "INITIAL_CONTACT",
60 "SET_WINDOW_SIZE",
61 "ADDITIONAL_TS_POSSIBLE",
62 "IPCOMP_SUPPORTED",
63 "NAT_DETECTION_SOURCE_IP",
64 "NAT_DETECTION_DESTINATION_IP",
65 "COOKIE",
66 "USE_TRANSPORT_MODE",
67 "HTTP_CERT_LOOKUP_SUPPORTED",
68 "REKEY_SA",
69 "ESP_TFC_PADDING_NOT_SUPPORTED",
70 "NON_FIRST_FRAGMENTS_ALSO",
71 "MOBIKE_SUPPORTED",
72 "ADDITIONAL_IP4_ADDRESS",
73 "ADDITIONAL_IP6_ADDRESS",
74 "NO_ADDITIONAL_ADDRESSES",
75 "UPDATE_SA_ADDRESSES",
76 "COOKIE2",
77 "NO_NATS_ALLOWED",
78 "AUTH_LIFETIME",
79 "MULTIPLE_AUTH_SUPPORTED",
80 "ANOTHER_AUTH_FOLLOWS",
81 "REDIRECT_SUPPORTED",
82 "REDIRECT",
83 "REDIRECTED_FROM",
84 "TICKET_LT_OPAQUE",
85 "TICKET_REQUEST",
86 "TICKET_ACK",
87 "TICKET_NACK",
88 "TICKET_OPAQUE",
89 "LINK_ID",
90 "USE_WESP_MODE",
91 "ROHC_SUPPORTED",
92 "EAP_ONLY_AUTHENTICATION");
93 ENUM_NEXT(notify_type_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
94 "USE_BEET_MODE");
95 ENUM_NEXT(notify_type_names, ME_MEDIATION, ME_RESPONSE, USE_BEET_MODE,
96 "ME_MEDIATION",
97 "ME_ENDPOINT",
98 "ME_CALLBACK",
99 "ME_CONNECTID",
100 "ME_CONNECTKEY",
101 "ME_CONNECTAUTH",
102 "ME_RESPONSE");
103 ENUM_END(notify_type_names, ME_RESPONSE);
104
105
106 ENUM_BEGIN(notify_type_short_names, UNSUPPORTED_CRITICAL_PAYLOAD, UNSUPPORTED_CRITICAL_PAYLOAD,
107 "CRIT");
108 ENUM_NEXT(notify_type_short_names, INVALID_IKE_SPI, INVALID_MAJOR_VERSION, UNSUPPORTED_CRITICAL_PAYLOAD,
109 "INVAL_IKE_SPI",
110 "INVAL_MAJOR");
111 ENUM_NEXT(notify_type_short_names, INVALID_SYNTAX, INVALID_SYNTAX, INVALID_MAJOR_VERSION,
112 "INVAL_SYN");
113 ENUM_NEXT(notify_type_short_names, INVALID_MESSAGE_ID, INVALID_MESSAGE_ID, INVALID_SYNTAX,
114 "INVAL_MID");
115 ENUM_NEXT(notify_type_short_names, INVALID_SPI, INVALID_SPI, INVALID_MESSAGE_ID,
116 "INVAL_SPI");
117 ENUM_NEXT(notify_type_short_names, NO_PROPOSAL_CHOSEN, NO_PROPOSAL_CHOSEN, INVALID_SPI,
118 "NO_PROP");
119 ENUM_NEXT(notify_type_short_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL_CHOSEN,
120 "INVAL_KE");
121 ENUM_NEXT(notify_type_short_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
122 "AUTH_FAILED");
123 ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, CHILD_SA_NOT_FOUND, AUTHENTICATION_FAILED,
124 "SINGLE_PAIR",
125 "NO_ADD_SAS",
126 "INT_ADDR_FAIL",
127 "FAIL_CP_REQ",
128 "TS_UNACCEPT",
129 "INVAL_SEL",
130 "UNACCEPT_ADDR",
131 "UNEXPECT_NAT",
132 "ASSIGNED_HoA",
133 "TEMP_FAIL",
134 "NO_CHILD_SA");
135 ENUM_NEXT(notify_type_short_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, CHILD_SA_NOT_FOUND,
136 "ME_CONN_FAIL");
137 ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, EAP_ONLY_AUTHENTICATION, ME_CONNECT_FAILED,
138 "INIT_CONTACT",
139 "SET_WINSIZE",
140 "ADD_TS_POSS",
141 "IPCOMP_SUPP",
142 "NATD_S_IP",
143 "NATD_D_IP",
144 "COOKIE",
145 "USE_TRANSP",
146 "HTTP_CERT_LOOK",
147 "REKEY_SA",
148 "ESP_TFC_PAD_N",
149 "NON_FIRST_FRAG",
150 "MOBIKE_SUP",
151 "ADD_4_ADDR",
152 "ADD_6_ADDR",
153 "NO_ADD_ADDR",
154 "UPD_SA_ADDR",
155 "COOKIE2",
156 "NO_NATS",
157 "AUTH_LFT",
158 "MULT_AUTH",
159 "AUTH_FOLLOWS",
160 "REDIR_SUP",
161 "REDIR",
162 "REDIR_FROM",
163 "TKT_LT_OPAK",
164 "TKT_REQ",
165 "TKT_ACK",
166 "TKT_NACK",
167 "TKT_OPAK",
168 "LINK_ID",
169 "WESP_MODE",
170 "ROHC_SUP",
171 "EAP_ONLY");
172 ENUM_NEXT(notify_type_short_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
173 "BEET_MODE");
174 ENUM_NEXT(notify_type_short_names, ME_MEDIATION, ME_RESPONSE, USE_BEET_MODE,
175 "ME_MED",
176 "ME_EP",
177 "ME_CB",
178 "ME_CID",
179 "ME_CKEY",
180 "ME_CAUTH",
181 "ME_R");
182 ENUM_END(notify_type_short_names, ME_RESPONSE);
183
184
185 typedef struct private_notify_payload_t private_notify_payload_t;
186
187 /**
188 * Private data of an notify_payload_t object.
189 *
190 */
191 struct private_notify_payload_t {
192 /**
193 * Public notify_payload_t interface.
194 */
195 notify_payload_t public;
196
197 /**
198 * Next payload type.
199 */
200 u_int8_t next_payload;
201
202 /**
203 * Critical flag.
204 */
205 bool critical;
206
207 /**
208 * Length of this payload.
209 */
210 u_int16_t payload_length;
211
212 /**
213 * Protocol id.
214 */
215 u_int8_t protocol_id;
216
217 /**
218 * Spi size.
219 */
220 u_int8_t spi_size;
221
222 /**
223 * Notify message type.
224 */
225 u_int16_t notify_type;
226
227 /**
228 * Security parameter index (spi).
229 */
230 chunk_t spi;
231
232 /**
233 * Notification data.
234 */
235 chunk_t notification_data;
236 };
237
238 /**
239 * Encoding rules to parse or generate a IKEv2-Notify Payload.
240 *
241 * The defined offsets are the positions in a object of type
242 * private_notify_payload_t.
243 *
244 */
245 encoding_rule_t notify_payload_encodings[] = {
246 /* 1 Byte next payload type, stored in the field next_payload */
247 { U_INT_8, offsetof(private_notify_payload_t, next_payload) },
248 /* the critical bit */
249 { FLAG, offsetof(private_notify_payload_t, critical) },
250 /* 7 Bit reserved bits, nowhere stored */
251 { RESERVED_BIT, 0 },
252 { RESERVED_BIT, 0 },
253 { RESERVED_BIT, 0 },
254 { RESERVED_BIT, 0 },
255 { RESERVED_BIT, 0 },
256 { RESERVED_BIT, 0 },
257 { RESERVED_BIT, 0 },
258 /* Length of the whole payload*/
259 { PAYLOAD_LENGTH, offsetof(private_notify_payload_t, payload_length) },
260 /* Protocol ID as 8 bit field*/
261 { U_INT_8, offsetof(private_notify_payload_t, protocol_id) },
262 /* SPI Size as 8 bit field*/
263 { SPI_SIZE, offsetof(private_notify_payload_t, spi_size) },
264 /* Notify message type as 16 bit field*/
265 { U_INT_16, offsetof(private_notify_payload_t, notify_type) },
266 /* SPI as variable length field*/
267 { SPI, offsetof(private_notify_payload_t, spi) },
268 /* Key Exchange Data is from variable size */
269 { NOTIFICATION_DATA, offsetof(private_notify_payload_t, notification_data) }
270 };
271
272 /*
273 1 2 3
274 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
275 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
276 ! Next Payload !C! RESERVED ! Payload Length !
277 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
278 ! Protocol ID ! SPI Size ! Notify Message Type !
279 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
280 ! !
281 ~ Security Parameter Index (SPI) ~
282 ! !
283 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
284 ! !
285 ~ Notification Data ~
286 ! !
287 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
288 */
289
290 /**
291 * Implementation of payload_t.verify.
292 */
293 static status_t verify(private_notify_payload_t *this)
294 {
295 bool bad_length = FALSE;
296
297 switch (this->protocol_id)
298 {
299 case PROTO_NONE:
300 case PROTO_IKE:
301 case PROTO_AH:
302 case PROTO_ESP:
303 break;
304 default:
305 DBG1(DBG_ENC, "Unknown protocol (%d)", this->protocol_id);
306 return FAILED;
307 }
308
309 switch (this->notify_type)
310 {
311 case INVALID_KE_PAYLOAD:
312 {
313 if (this->notification_data.len != 2)
314 {
315 bad_length = TRUE;
316 }
317 break;
318 }
319 case NAT_DETECTION_SOURCE_IP:
320 case NAT_DETECTION_DESTINATION_IP:
321 case ME_CONNECTAUTH:
322 {
323 if (this->notification_data.len != HASH_SIZE_SHA1)
324 {
325 bad_length = TRUE;
326 }
327 break;
328 }
329 case INVALID_SYNTAX:
330 case INVALID_MAJOR_VERSION:
331 case NO_PROPOSAL_CHOSEN:
332 {
333 if (this->notification_data.len != 0)
334 {
335 bad_length = TRUE;
336 }
337 break;
338 }
339 case ADDITIONAL_IP4_ADDRESS:
340 {
341 if (this->notification_data.len != 4)
342 {
343 bad_length = TRUE;
344 }
345 break;
346 }
347 case ADDITIONAL_IP6_ADDRESS:
348 {
349 if (this->notification_data.len != 16)
350 {
351 bad_length = TRUE;
352 }
353 break;
354 }
355 case AUTH_LIFETIME:
356 {
357 if (this->notification_data.len != 4)
358 {
359 bad_length = TRUE;
360 }
361 break;
362 }
363 case IPCOMP_SUPPORTED:
364 {
365 if (this->notification_data.len != 3)
366 {
367 bad_length = TRUE;
368 }
369 break;
370 }
371 case ME_ENDPOINT:
372 if (this->notification_data.len != 8 &&
373 this->notification_data.len != 12 &&
374 this->notification_data.len != 24)
375 {
376 bad_length = TRUE;
377 }
378 break;
379 case ME_CONNECTID:
380 if (this->notification_data.len < 4 ||
381 this->notification_data.len > 16)
382 {
383 bad_length = TRUE;
384 }
385 break;
386 case ME_CONNECTKEY:
387 if (this->notification_data.len < 16 ||
388 this->notification_data.len > 32)
389 {
390 bad_length = TRUE;
391 }
392 break;
393 default:
394 /* TODO: verify */
395 break;
396 }
397 if (bad_length)
398 {
399 DBG1(DBG_ENC, "invalid notify data length for %N (%d)",
400 notify_type_names, this->notify_type,
401 this->notification_data.len);
402 return FAILED;
403 }
404 return SUCCESS;
405 }
406
407 /**
408 * Implementation of payload_t.get_encoding_rules.
409 */
410 static void get_encoding_rules(private_notify_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
411 {
412 *rules = notify_payload_encodings;
413 *rule_count = sizeof(notify_payload_encodings) / sizeof(encoding_rule_t);
414 }
415
416 /**
417 * Implementation of payload_t.get_type.
418 */
419 static payload_type_t get_type(private_notify_payload_t *this)
420 {
421 return NOTIFY;
422 }
423
424 /**
425 * Implementation of payload_t.get_next_type.
426 */
427 static payload_type_t get_next_type(private_notify_payload_t *this)
428 {
429 return (this->next_payload);
430 }
431
432 /**
433 * Implementation of payload_t.set_next_type.
434 */
435 static void set_next_type(private_notify_payload_t *this,payload_type_t type)
436 {
437 this->next_payload = type;
438 }
439
440 /**
441 * recompute the payloads length.
442 */
443 static void compute_length (private_notify_payload_t *this)
444 {
445 size_t length = NOTIFY_PAYLOAD_HEADER_LENGTH;
446 if (this->notification_data.ptr != NULL)
447 {
448 length += this->notification_data.len;
449 }
450 if (this->spi.ptr != NULL)
451 {
452 length += this->spi.len;
453 }
454 this->payload_length = length;
455 }
456
457 /**
458 * Implementation of payload_t.get_length.
459 */
460 static size_t get_length(private_notify_payload_t *this)
461 {
462 return this->payload_length;
463 }
464
465 /**
466 * Implementation of notify_payload_t.get_protocol_id.
467 */
468 static u_int8_t get_protocol_id(private_notify_payload_t *this)
469 {
470 return this->protocol_id;
471 }
472
473 /**
474 * Implementation of notify_payload_t.set_protocol_id.
475 */
476 static void set_protocol_id(private_notify_payload_t *this, u_int8_t protocol_id)
477 {
478 this->protocol_id = protocol_id;
479 }
480
481 /**
482 * Implementation of notify_payload_t.get_notify_type.
483 */
484 static notify_type_t get_notify_type(private_notify_payload_t *this)
485 {
486 return this->notify_type;
487 }
488
489 /**
490 * Implementation of notify_payload_t.set_notify_type.
491 */
492 static void set_notify_type(private_notify_payload_t *this, u_int16_t notify_type)
493 {
494 this->notify_type = notify_type;
495 }
496
497 /**
498 * Implementation of notify_payload_t.get_spi.
499 */
500 static u_int32_t get_spi(private_notify_payload_t *this)
501 {
502 switch (this->protocol_id)
503 {
504 case PROTO_AH:
505 case PROTO_ESP:
506 if (this->spi.len == 4)
507 {
508 return *((u_int32_t*)this->spi.ptr);
509 }
510 default:
511 break;
512 }
513 return 0;
514 }
515
516 /**
517 * Implementation of notify_payload_t.set_spi.
518 */
519 static void set_spi(private_notify_payload_t *this, u_int32_t spi)
520 {
521 chunk_free(&this->spi);
522 switch (this->protocol_id)
523 {
524 case PROTO_AH:
525 case PROTO_ESP:
526 this->spi = chunk_alloc(4);
527 *((u_int32_t*)this->spi.ptr) = spi;
528 break;
529 default:
530 break;
531 }
532 this->spi_size = this->spi.len;
533 compute_length(this);
534 }
535
536 /**
537 * Implementation of notify_payload_t.get_notification_data.
538 */
539 static chunk_t get_notification_data(private_notify_payload_t *this)
540 {
541 return (this->notification_data);
542 }
543
544 /**
545 * Implementation of notify_payload_t.set_notification_data.
546 */
547 static status_t set_notification_data(private_notify_payload_t *this, chunk_t notification_data)
548 {
549 chunk_free(&this->notification_data);
550 if (notification_data.len > 0)
551 {
552 this->notification_data = chunk_clone(notification_data);
553 }
554 compute_length(this);
555 return SUCCESS;
556 }
557
558 /**
559 * Implementation of notify_payload_t.destroy and notify_payload_t.destroy.
560 */
561 static status_t destroy(private_notify_payload_t *this)
562 {
563 chunk_free(&this->notification_data);
564 chunk_free(&this->spi);
565 free(this);
566 return SUCCESS;
567 }
568
569 /*
570 * Described in header
571 */
572 notify_payload_t *notify_payload_create()
573 {
574 private_notify_payload_t *this = malloc_thing(private_notify_payload_t);
575
576 /* interface functions */
577 this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
578 this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
579 this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
580 this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
581 this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
582 this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
583 this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
584
585 /* public functions */
586 this->public.get_protocol_id = (u_int8_t (*) (notify_payload_t *)) get_protocol_id;
587 this->public.set_protocol_id = (void (*) (notify_payload_t *,u_int8_t)) set_protocol_id;
588 this->public.get_notify_type = (notify_type_t (*) (notify_payload_t *)) get_notify_type;
589 this->public.set_notify_type = (void (*) (notify_payload_t *,notify_type_t)) set_notify_type;
590 this->public.get_spi = (u_int32_t (*) (notify_payload_t *)) get_spi;
591 this->public.set_spi = (void (*) (notify_payload_t *,u_int32_t)) set_spi;
592 this->public.get_notification_data = (chunk_t (*) (notify_payload_t *)) get_notification_data;
593 this->public.set_notification_data = (void (*) (notify_payload_t *,chunk_t)) set_notification_data;
594 this->public.destroy = (void (*) (notify_payload_t *)) destroy;
595
596 /* set default values of the fields */
597 this->critical = FALSE;
598 this->next_payload = NO_PAYLOAD;
599 this->payload_length = NOTIFY_PAYLOAD_HEADER_LENGTH;
600 this->protocol_id = 0;
601 this->notify_type = 0;
602 this->spi.ptr = NULL;
603 this->spi.len = 0;
604 this->spi_size = 0;
605 this->notification_data.ptr = NULL;
606 this->notification_data.len = 0;
607
608 return &this->public;
609 }
610
611 /*
612 * Described in header.
613 */
614 notify_payload_t *notify_payload_create_from_protocol_and_type(protocol_id_t protocol_id, notify_type_t notify_type)
615 {
616 notify_payload_t *notify = notify_payload_create();
617
618 notify->set_notify_type(notify,notify_type);
619 notify->set_protocol_id(notify,protocol_id);
620
621 return notify;
622 }