- comments

[strongswan.git] / Source / charon / sa / states / ike_auth_requested.c

diff --git a/Source/charon/sa/states/ike_auth_requested.c b/Source/charon/sa/states/ike_auth_requested.c
index eb4ccae..64881cc 100644 (file)
--- a/Source/charon/sa/states/ike_auth_requested.c
+++ b/Source/charon/sa/states/ike_auth_requested.c
@@ -45,16 +45,6 @@ struct private_ike_auth_requested_t {
        ike_auth_requested_t public;
        
        /**
        ike_auth_requested_t public;
        
        /**

-        * Sent nonce value
-        */
-       chunk_t sent_nonce;
-       
-       /**
-        * Received nonce
-        */
-       chunk_t received_nonce;
-       
-       /**

         * Assigned IKE_SA
         */
         protected_ike_sa_t *ike_sa;
         * Assigned IKE_SA
         */
         protected_ike_sa_t *ike_sa;


@@ -71,9 +61,24 @@ struct private_ike_auth_requested_t {
         */
        logger_t *logger;
        
         */
        logger_t *logger;
        

+       /**
+        * process the IDr payload (check if other id is valid)
+        */

        status_t (*process_idr_payload) (private_ike_auth_requested_t *this, id_payload_t *idr_payload);
        status_t (*process_idr_payload) (private_ike_auth_requested_t *this, id_payload_t *idr_payload);

+       
+       /**
+        * process the SA payload (check if selected proposals are valid, setup child sa)
+        */

        status_t (*process_sa_payload) (private_ike_auth_requested_t *this, sa_payload_t *sa_payload);
        status_t (*process_sa_payload) (private_ike_auth_requested_t *this, sa_payload_t *sa_payload);

+       
+       /**
+        * process the AUTH payload (check authenticity of message)
+        */

        status_t (*process_auth_payload) (private_ike_auth_requested_t *this, auth_payload_t *auth_payload);
        status_t (*process_auth_payload) (private_ike_auth_requested_t *this, auth_payload_t *auth_payload);

+       
+       /**
+        * process the TS payload (check if selected traffic selectors are valid)
+        */

        status_t (*process_ts_payload) (private_ike_auth_requested_t *this, bool ts_initiator, ts_payload_t *ts_payload);
         
 };
        status_t (*process_ts_payload) (private_ike_auth_requested_t *this, bool ts_initiator, ts_payload_t *ts_payload);
         
 };


@@ -89,13 +94,11 @@ static status_t process_message(private_ike_auth_requested_t *this, message_t *r
        crypter_t *crypter;
        iterator_t *payloads;
        exchange_type_t exchange_type;
        crypter_t *crypter;
        iterator_t *payloads;
        exchange_type_t exchange_type;

-       id_payload_t *idr_payload;
+       id_payload_t *idr_payload = NULL;

        auth_payload_t *auth_payload;
        sa_payload_t *sa_payload;
        ts_payload_t *tsi_payload, *tsr_payload;
        
        auth_payload_t *auth_payload;
        sa_payload_t *sa_payload;
        ts_payload_t *tsi_payload, *tsr_payload;
        

-       return SUCCESS;
-

        exchange_type = request->get_exchange_type(request);
        if (exchange_type != IKE_AUTH)
        {
        exchange_type = request->get_exchange_type(request);
        if (exchange_type != IKE_AUTH)
        {


@@ -172,9 +175,8 @@ static status_t process_message(private_ike_auth_requested_t *this, message_t *r
        }
        /* iterator can be destroyed */
        payloads->destroy(payloads);
        }
        /* iterator can be destroyed */
        payloads->destroy(payloads);

-       
-       
-       /* add payloads to it */
+
+       /* process all payloads */

        status = this->process_idr_payload(this, idr_payload);
        if (status != SUCCESS)
        {
        status = this->process_idr_payload(this, idr_payload);
        if (status != SUCCESS)
        {


@@ -206,39 +208,46 @@ static status_t process_message(private_ike_auth_requested_t *this, message_t *r
                return status;
        }
 
                return status;
        }
 

+       this->ike_sa->set_last_replied_message_id(this->ike_sa,request->get_message_id(request));

        this->logger->log(this->logger, CONTROL | MORE, "IKE_AUTH response successfully handled. IKE_SA established.");
        
        /* create new state */
        this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
 
        this->logger->log(this->logger, CONTROL | MORE, "IKE_AUTH response successfully handled. IKE_SA established.");
        
        /* create new state */
        this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
 

+       this->public.state_interface.destroy(&(this->public.state_interface));

        return SUCCESS;
 }
 
 /**
        return SUCCESS;
 }
 
 /**

- * Implements private_ike_auth_requested_t.build_idr_payload
+ * Implements private_ike_auth_requested_t.process_idr_payload

  */
 static status_t process_idr_payload(private_ike_auth_requested_t *this, id_payload_t *idr_payload)
 {
        identification_t *other_id, *configured_other_id;
        
  */
 static status_t process_idr_payload(private_ike_auth_requested_t *this, id_payload_t *idr_payload)
 {
        identification_t *other_id, *configured_other_id;
        

-       other_id = idr_payload->get_identification(idr_payload);
-
-       configured_other_id = this->sa_config->get_other_id(this->sa_config);
-       if (configured_other_id)
+       /* idr is optional */
+       if (idr_payload)

        {
        {

-               if (!other_id->equals(other_id, configured_other_id))
+               other_id = idr_payload->get_identification(idr_payload);
+       
+               configured_other_id = this->sa_config->get_other_id(this->sa_config);
+               if (configured_other_id)

                {
                {

-                       this->logger->log(this->logger, ERROR, "IKE_AUTH reply didn't contain requested id");
-                       return FAILED;  
+                       if (!other_id->equals(other_id, configured_other_id))
+                       {
+                               this->logger->log(this->logger, ERROR, "IKE_AUTH reply didn't contain requested id");
+                               return FAILED;  
+                       }

                }
                }

+               
+               other_id->destroy(other_id);
+               /* TODO do we have to store other_id  somewhere ? */

        }
        }

-       
-       /* TODO do we have to store other_id  somewhere ? */    

        return SUCCESS;
 }
 
 /**
        return SUCCESS;
 }
 
 /**

- * Implements private_ike_auth_requested_t.build_sa_payload
+ * Implements private_ike_auth_requested_t.process_sa_payload

  */
 static status_t process_sa_payload(private_ike_auth_requested_t *this, sa_payload_t *sa_payload)
 {
  */
 static status_t process_sa_payload(private_ike_auth_requested_t *this, sa_payload_t *sa_payload)
 {


@@ -282,7 +291,7 @@ static status_t process_sa_payload(private_ike_auth_requested_t *this, sa_payloa
 }
 
 /**
 }
 
 /**

- * Implements private_ike_auth_requested_t.build_auth_payload
+ * Implements private_ike_auth_requested_t.process_auth_payload

  */
 static status_t process_auth_payload(private_ike_auth_requested_t *this, auth_payload_t *auth_payload)
 {
  */
 static status_t process_auth_payload(private_ike_auth_requested_t *this, auth_payload_t *auth_payload)
 {


@@ -291,7 +300,7 @@ static status_t process_auth_payload(private_ike_auth_requested_t *this, auth_pa
 }
 
 /**
 }
 
 /**

- * Implements private_ike_auth_requested_t.build_ts_payload
+ * Implements private_ike_auth_requested_t.process_ts_payload

  */
 static status_t process_ts_payload(private_ike_auth_requested_t *this, bool ts_initiator, ts_payload_t *ts_payload)
 {
  */
 static status_t process_ts_payload(private_ike_auth_requested_t *this, bool ts_initiator, ts_payload_t *ts_payload)
 {


@@ -345,15 +354,13 @@ static ike_sa_state_t get_state(private_ike_auth_requested_t *this)
  */
 static void destroy(private_ike_auth_requested_t *this)
 {
  */
 static void destroy(private_ike_auth_requested_t *this)
 {

-       allocator_free(this->sent_nonce.ptr);
-       allocator_free(this->received_nonce.ptr);

        allocator_free(this);
 }
 
 /* 
  * Described in header.
  */
        allocator_free(this);
 }
 
 /* 
  * Described in header.
  */

-ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa, chunk_t sent_nonce, chunk_t received_nonce)
+ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa)

 {
        private_ike_auth_requested_t *this = allocator_alloc_thing(private_ike_auth_requested_t);
 
 {
        private_ike_auth_requested_t *this = allocator_alloc_thing(private_ike_auth_requested_t);
 


@@ -371,9 +378,7 @@ ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa, chun
        
        /* private data */
        this->ike_sa = ike_sa;
        
        /* private data */
        this->ike_sa = ike_sa;

-       this->sent_nonce = sent_nonce;
-       this->received_nonce = received_nonce;
-       
+       this->logger = this->ike_sa->get_logger(this->ike_sa);

        
        return &(this->public);
 }
        
        return &(this->public);
 }