Renamed ike_cert_pre_v1 to isakmp_cert_pre
authorMartin Willi <martin@revosec.ch>
Mon, 19 Dec 2011 10:17:31 +0000 (11:17 +0100)
committerMartin Willi <martin@revosec.ch>
Tue, 20 Mar 2012 16:31:26 +0000 (17:31 +0100)
src/libcharon/Makefile.am
src/libcharon/sa/ike_sa.c
src/libcharon/sa/task_manager_v1.c
src/libcharon/sa/tasks/ike_cert_pre_v1.c [deleted file]
src/libcharon/sa/tasks/ike_cert_pre_v1.h [deleted file]
src/libcharon/sa/tasks/isakmp_cert_pre.c [new file with mode: 0644]
src/libcharon/sa/tasks/isakmp_cert_pre.h [new file with mode: 0644]
src/libcharon/sa/tasks/task.c
src/libcharon/sa/tasks/task.h

index a58db1d..10992d7 100644 (file)
@@ -84,7 +84,6 @@ sa/tasks/child_rekey.c sa/tasks/child_rekey.h \
 sa/tasks/ike_auth.c sa/tasks/ike_auth.h \
 sa/tasks/ike_cert_pre.c sa/tasks/ike_cert_pre.h \
 sa/tasks/ike_cert_post.c sa/tasks/ike_cert_post.h \
-sa/tasks/ike_cert_pre_v1.c sa/tasks/ike_cert_pre_v1.h \
 sa/tasks/ike_config.c sa/tasks/ike_config.h \
 sa/tasks/ike_delete.c sa/tasks/ike_delete.h \
 sa/tasks/ike_dpd.c sa/tasks/ike_dpd.h \
@@ -99,6 +98,7 @@ sa/tasks/ike_vendor.c sa/tasks/ike_vendor.h \
 sa/tasks/ike_vendor_v1.c sa/tasks/ike_vendor_v1.h \
 sa/tasks/main_mode.c sa/tasks/main_mode.h \
 sa/tasks/informational.c sa/tasks/informational.h \
+sa/tasks/isakmp_cert_pre.c sa/tasks/isakmp_cert_pre.h \
 sa/tasks/isakmp_cert_post.c sa/tasks/isakmp_cert_post.h \
 sa/tasks/isakmp_delete.c sa/tasks/isakmp_delete.h \
 sa/tasks/xauth.c sa/tasks/xauth.h \
index 0a0f94d..fe4e91d 100644 (file)
@@ -35,7 +35,6 @@
 #include <sa/tasks/ike_auth_lifetime.h>
 #include <sa/tasks/ike_config.h>
 #include <sa/tasks/ike_cert_pre.h>
-#include <sa/tasks/ike_cert_pre_v1.h>
 #include <sa/tasks/ike_cert_post.h>
 #include <sa/tasks/ike_rekey.h>
 #include <sa/tasks/ike_reauth.h>
@@ -46,6 +45,7 @@
 #include <sa/tasks/child_delete.h>
 #include <sa/tasks/child_rekey.h>
 #include <sa/tasks/main_mode.h>
+#include <sa/tasks/isakmp_cert_pre.h>
 #include <sa/tasks/isakmp_cert_post.h>
 #include <sa/tasks/quick_mode.h>
 #include <sa/tasks/quick_delete.h>
@@ -1121,7 +1121,7 @@ METHOD(ike_sa_t, initiate, status_t,
                {
                        task = (task_t*)ike_vendor_v1_create(&this->public, TRUE);
                        this->task_manager->queue_task(this->task_manager, task);
-                       task = (task_t*)ike_cert_pre_v1_create(&this->public, TRUE);
+                       task = (task_t*)isakmp_cert_pre_create(&this->public, TRUE);
                        this->task_manager->queue_task(this->task_manager, task);
                        task = (task_t*)main_mode_create(&this->public, TRUE);
                        this->task_manager->queue_task(this->task_manager, task);
index 7f6aa9f..03c68fc 100644 (file)
@@ -26,7 +26,7 @@
 #include <sa/tasks/informational.h>
 #include <sa/tasks/ike_natd_v1.h>
 #include <sa/tasks/ike_vendor_v1.h>
-#include <sa/tasks/ike_cert_pre_v1.h>
+#include <sa/tasks/isakmp_cert_pre.h>
 #include <sa/tasks/isakmp_cert_post.h>
 #include <processing/jobs/retransmit_job.h>
 #include <processing/jobs/delete_ike_sa_job.h>
@@ -300,7 +300,7 @@ METHOD(task_manager_t, initiate, status_t,
                {
                        case IKE_CREATED:
                                activate_task(this, TASK_VENDOR_V1);
-                               activate_task(this, TASK_IKE_CERT_PRE_V1);
+                               activate_task(this, TASK_ISAKMP_CERT_PRE);
                                if (activate_task(this, TASK_MAIN_MODE))
                                {
                                        exchange = ID_PROT;
@@ -660,7 +660,7 @@ static status_t process_request(private_task_manager_t *this,
                        case ID_PROT:
                                task = (task_t *)ike_vendor_v1_create(this->ike_sa, FALSE);
                                this->passive_tasks->insert_last(this->passive_tasks, task);
-                               task = (task_t*)ike_cert_pre_v1_create(this->ike_sa, FALSE);
+                               task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
                                this->passive_tasks->insert_last(this->passive_tasks, task);
                                task = (task_t *)main_mode_create(this->ike_sa, FALSE);
                                this->passive_tasks->insert_last(this->passive_tasks, task);
diff --git a/src/libcharon/sa/tasks/ike_cert_pre_v1.c b/src/libcharon/sa/tasks/ike_cert_pre_v1.c
deleted file mode 100644 (file)
index 0220650..0000000
+++ /dev/null
@@ -1,533 +0,0 @@
-/*
- * Copyright (C) 2011 Martin Willi
- * Copyright (C) 2011 revosec AG
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include "ike_cert_pre_v1.h"
-
-#include <daemon.h>
-#include <sa/ike_sa.h>
-#include <encoding/payloads/cert_payload.h>
-#include <encoding/payloads/sa_payload.h>
-#include <encoding/payloads/certreq_payload.h>
-#include <credentials/certificates/x509.h>
-
-
-typedef struct private_ike_cert_pre_v1_t private_ike_cert_pre_v1_t;
-
-/**
- * Private members of a ike_cert_pre_v1_t task.
- */
-struct private_ike_cert_pre_v1_t {
-
-       /**
-        * Public methods and task_t interface.
-        */
-       ike_cert_pre_v1_t public;
-
-       /**
-        * Assigned IKE_SA.
-        */
-       ike_sa_t *ike_sa;
-
-       /**
-        * Are we the initiator?
-        */
-       bool initiator;
-
-       /**
-        * Send certificate requests?
-        */
-       bool send_req;
-
-       /** next message we expect */
-       enum {
-               CR_SA,
-               CR_KE,
-               CR_AUTH,
-       } state;
-};
-
-/**
- * Find the CA certificate for a given certreq payload
- */
-static certificate_t* find_certificate(private_ike_cert_pre_v1_t *this,
-                                                                          certreq_payload_t *certreq)
-{
-       identification_t *id;
-       certificate_t *cert;
-
-       if (certreq->get_cert_type(certreq) != CERT_X509)
-       {
-               DBG1(DBG_IKE, "%N CERTREQ not supported - ignored",
-                        certificate_type_names, certreq->get_cert_type(certreq));
-               return NULL;
-       }
-       id = certreq->get_dn(certreq);
-       if (!id)
-       {
-               DBG1(DBG_IKE, "ignoring certificate request without data",
-                        certificate_type_names, certreq->get_cert_type(certreq));
-               return NULL;
-       }
-       cert = lib->credmgr->get_cert(lib->credmgr, CERT_X509, KEY_ANY, id, TRUE);
-       if (cert)
-       {
-               DBG1(DBG_IKE, "received cert request for '%Y'",
-                        cert->get_subject(cert));
-       }
-       else
-       {
-               DBG1(DBG_IKE, "received cert request for unknown ca '%Y'", id);
-       }
-       id->destroy(id);
-
-       return cert;
-}
-
-/**
- * read certificate requests
- */
-static void process_certreqs(private_ike_cert_pre_v1_t *this, message_t *message)
-{
-       enumerator_t *enumerator;
-       payload_t *payload;
-       auth_cfg_t *auth;
-
-       auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
-
-       enumerator = message->create_payload_enumerator(message);
-       while (enumerator->enumerate(enumerator, &payload))
-       {
-               switch (payload->get_type(payload))
-               {
-                       case CERTIFICATE_REQUEST_V1:
-                       {
-                               certificate_t *cert;
-
-                               this->ike_sa->set_condition(this->ike_sa,
-                                                                                       COND_CERTREQ_SEEN, TRUE);
-                               cert = find_certificate(this, (certreq_payload_t*)payload);
-                               if (cert)
-                               {
-                                       auth->add(auth, AUTH_RULE_CA_CERT, cert);
-                               }
-                               break;
-                       }
-                       default:
-                               break;
-               }
-       }
-       enumerator->destroy(enumerator);
-}
-
-/**
- * Import receuved certificates
- */
-static void process_certs(private_ike_cert_pre_v1_t *this, message_t *message)
-{
-       enumerator_t *enumerator;
-       payload_t *payload;
-       auth_cfg_t *auth;
-       bool first = TRUE;
-
-       auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
-
-       enumerator = message->create_payload_enumerator(message);
-       while (enumerator->enumerate(enumerator, &payload))
-       {
-               if (payload->get_type(payload) == CERTIFICATE_V1)
-               {
-                       cert_payload_t *cert_payload;
-                       cert_encoding_t encoding;
-                       certificate_t *cert;
-
-                       cert_payload = (cert_payload_t*)payload;
-                       encoding = cert_payload->get_cert_encoding(cert_payload);
-
-                       switch (encoding)
-                       {
-                               case ENC_X509_SIGNATURE:
-                               {
-                                       cert = cert_payload->get_cert(cert_payload);
-                                       if (cert)
-                                       {
-                                               if (first)
-                                               {       /* the first is an end entity certificate */
-                                                       DBG1(DBG_IKE, "received end entity cert \"%Y\"",
-                                                                cert->get_subject(cert));
-                                                       auth->add(auth, AUTH_HELPER_SUBJECT_CERT, cert);
-                                                       first = FALSE;
-                                               }
-                                               else
-                                               {
-                                                       DBG1(DBG_IKE, "received issuer cert \"%Y\"",
-                                                                cert->get_subject(cert));
-                                                       auth->add(auth, AUTH_HELPER_IM_CERT, cert);
-                                               }
-                                       }
-                                       break;
-                               }
-                               case ENC_CRL:
-                                       cert = cert_payload->get_cert(cert_payload);
-                                       if (cert)
-                                       {
-                                               DBG1(DBG_IKE, "received CRL \"%Y\"",
-                                                        cert->get_subject(cert));
-                                               auth->add(auth, AUTH_HELPER_REVOCATION_CERT, cert);
-                                       }
-                                       break;
-                               case ENC_PKCS7_WRAPPED_X509:
-                               case ENC_PGP:
-                               case ENC_DNS_SIGNED_KEY:
-                               case ENC_KERBEROS_TOKEN:
-                               case ENC_ARL:
-                               case ENC_SPKI:
-                               case ENC_X509_ATTRIBUTE:
-                               case ENC_RAW_RSA_KEY:
-                               case ENC_X509_HASH_AND_URL_BUNDLE:
-                               case ENC_OCSP_CONTENT:
-                               default:
-                                       DBG1(DBG_ENC, "certificate encoding %N not supported",
-                                                cert_encoding_names, encoding);
-                       }
-               }
-       }
-       enumerator->destroy(enumerator);
-}
-
-/**
- * Add the subject of a CA certificate a message
- */
-static void add_certreq(private_ike_cert_pre_v1_t *this, message_t *message,
-                                               certificate_t *cert)
-{
-       if (cert->get_type(cert) == CERT_X509)
-       {
-               x509_t *x509 = (x509_t*)cert;
-
-               if (x509->get_flags(x509) & X509_CA)
-               {
-                       DBG1(DBG_IKE, "sending cert request for \"%Y\"",
-                                cert->get_subject(cert));
-                       message->add_payload(message, (payload_t*)
-                                                       certreq_payload_create_dn(cert->get_subject(cert)));
-               }
-       }
-}
-
-/**
- * Add auth_cfg's CA certificates to the certificate request
- */
-static void add_certreqs(private_ike_cert_pre_v1_t *this,
-                                                auth_cfg_t *auth, message_t *message)
-{
-       enumerator_t *enumerator;
-       auth_rule_t type;
-       void *value;
-
-       enumerator = auth->create_enumerator(auth);
-       while (enumerator->enumerate(enumerator, &type, &value))
-       {
-               switch (type)
-               {
-                       case AUTH_RULE_CA_CERT:
-                               add_certreq(this, message, (certificate_t*)value);
-                               break;
-                       default:
-                               break;
-               }
-       }
-       enumerator->destroy(enumerator);
-}
-
-/**
- * Build certificate requests
- */
-static void build_certreqs(private_ike_cert_pre_v1_t *this, message_t *message)
-{
-       enumerator_t *enumerator;
-       ike_cfg_t *ike_cfg;
-       peer_cfg_t *peer_cfg;
-       certificate_t *cert;
-       auth_cfg_t *auth;
-
-       ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
-       if (!ike_cfg->send_certreq(ike_cfg))
-       {
-               return;
-       }
-       /* check if we require a specific CA for that peer */
-       peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
-       if (peer_cfg)
-       {
-               enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, FALSE);
-               if (enumerator->enumerate(enumerator, &auth))
-               {
-                       add_certreqs(this, auth, message);
-               }
-               enumerator->destroy(enumerator);
-       }
-       if (!message->get_payload(message, CERTIFICATE_REQUEST_V1))
-       {
-               /* otherwise add all trusted CA certificates */
-               enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
-                                                                                               CERT_ANY, KEY_ANY, NULL, TRUE);
-               while (enumerator->enumerate(enumerator, &cert))
-               {
-                       add_certreq(this, message, cert);
-               }
-               enumerator->destroy(enumerator);
-       }
-}
-
-/**
- * Check if we actually use certificates for authentication
- */
-static bool use_certs(private_ike_cert_pre_v1_t *this, message_t *message)
-{
-       enumerator_t *enumerator;
-       payload_t *payload;
-       bool use = FALSE;
-
-       enumerator = message->create_payload_enumerator(message);
-       while (enumerator->enumerate(enumerator, &payload))
-       {
-               if (payload->get_type(payload) == SECURITY_ASSOCIATION_V1)
-               {
-                       sa_payload_t *sa_payload = (sa_payload_t*)payload;
-
-                       switch (sa_payload->get_auth_method(sa_payload))
-                       {
-                               case AUTH_HYBRID_INIT_RSA:
-                               case AUTH_HYBRID_RESP_RSA:
-                                       if (!this->initiator)
-                                       {
-                                               this->send_req = FALSE;
-                                       }
-                                       /* FALL */
-                               case AUTH_RSA:
-                               case AUTH_XAUTH_INIT_RSA:
-                               case AUTH_XAUTH_RESP_RSA:
-                                       use = TRUE;
-                                       break;
-                               default:
-                                       break;
-                       }
-                       break;
-               }
-       }
-       enumerator->destroy(enumerator);
-
-       return use;
-}
-
-METHOD(task_t, build_i, status_t,
-       private_ike_cert_pre_v1_t *this, message_t *message)
-{
-       switch (message->get_exchange_type(message))
-       {
-               case ID_PROT:
-                       if (this->state == CR_AUTH)
-                       {
-                               build_certreqs(this, message);
-                       }
-                       return NEED_MORE;
-               case AGGRESSIVE:
-                       if (this->state == CR_SA)
-                       {
-                               build_certreqs(this, message);
-                       }
-                       return NEED_MORE;
-               default:
-                       return FAILED;
-       }
-}
-
-METHOD(task_t, process_r, status_t,
-       private_ike_cert_pre_v1_t *this, message_t *message)
-{
-       switch (message->get_exchange_type(message))
-       {
-               case ID_PROT:
-               {
-                       switch (this->state)
-                       {
-                               case CR_SA:
-                                       if (!use_certs(this, message))
-                                       {
-                                               return SUCCESS;
-                                       }
-                                       return NEED_MORE;
-                               case CR_KE:
-                                       process_certreqs(this, message);
-                                       return NEED_MORE;
-                               case CR_AUTH:
-                                       process_certreqs(this, message);
-                                       process_certs(this, message);
-                                       return SUCCESS;
-                       }
-               }
-               case AGGRESSIVE:
-               {
-                       switch (this->state)
-                       {
-                               case CR_SA:
-                                       if (!use_certs(this, message))
-                                       {
-                                               return SUCCESS;
-                                       }
-                                       process_certreqs(this, message);
-                                       return NEED_MORE;
-                               case CR_AUTH:
-                                       process_certs(this, message);
-                                       return SUCCESS;
-                               default:
-                                       return FAILED;
-                       }
-               }
-               default:
-                       return FAILED;
-       }
-}
-
-METHOD(task_t, build_r, status_t,
-       private_ike_cert_pre_v1_t *this, message_t *message)
-{
-       switch (message->get_exchange_type(message))
-       {
-               case ID_PROT:
-                       switch (this->state)
-                       {
-                               case CR_SA:
-                                       this->state = CR_KE;
-                                       return NEED_MORE;
-                               case CR_KE:
-                                       if (this->send_req)
-                                       {
-                                               build_certreqs(this, message);
-                                       }
-                                       this->state = CR_AUTH;
-                                       return NEED_MORE;
-                               case CR_AUTH:
-                                       return NEED_MORE;
-                       }
-               case AGGRESSIVE:
-                       switch (this->state)
-                       {
-                               case CR_SA:
-                                       this->state = CR_AUTH;
-                                       return NEED_MORE;
-                               case CR_AUTH:
-                                       return SUCCESS;
-                               default:
-                                       return FAILED;
-                       }
-               default:
-                       return FAILED;
-       }
-}
-
-METHOD(task_t, process_i, status_t,
-       private_ike_cert_pre_v1_t *this, message_t *message)
-{
-       switch (message->get_exchange_type(message))
-       {
-               case ID_PROT:
-               {
-                       switch (this->state)
-                       {
-                               case CR_SA:
-                                       if (!use_certs(this, message))
-                                       {
-                                               return SUCCESS;
-                                       }
-                                       this->state = CR_KE;
-                                       return NEED_MORE;
-                               case CR_KE:
-                                       process_certreqs(this, message);
-                                       this->state = CR_AUTH;
-                                       return NEED_MORE;
-                               case CR_AUTH:
-                                       process_certs(this, message);
-                                       return SUCCESS;
-                               default:
-                                       return FAILED;
-                       }
-                       break;
-               }
-               case AGGRESSIVE:
-               {
-                       if (!use_certs(this, message))
-                       {
-                               return SUCCESS;
-                       }
-                       process_certreqs(this, message);
-                       process_certs(this, message);
-                       return SUCCESS;
-               }
-               default:
-                       return FAILED;
-       }
-}
-
-METHOD(task_t, get_type, task_type_t,
-       private_ike_cert_pre_v1_t *this)
-{
-       return TASK_IKE_CERT_PRE_V1;
-}
-
-METHOD(task_t, migrate, void,
-       private_ike_cert_pre_v1_t *this, ike_sa_t *ike_sa)
-{
-       this->ike_sa = ike_sa;
-}
-
-METHOD(task_t, destroy, void,
-       private_ike_cert_pre_v1_t *this)
-{
-       free(this);
-}
-
-/*
- * Described in header.
- */
-ike_cert_pre_v1_t *ike_cert_pre_v1_create(ike_sa_t *ike_sa, bool initiator)
-{
-       private_ike_cert_pre_v1_t *this;
-
-       INIT(this,
-               .public = {
-                       .task = {
-                               .get_type = _get_type,
-                               .migrate = _migrate,
-                               .destroy = _destroy,
-                       },
-               },
-               .ike_sa = ike_sa,
-               .initiator = initiator,
-               .state = CR_SA,
-               .send_req = TRUE,
-       );
-       if (initiator)
-       {
-               this->public.task.build = _build_i;
-               this->public.task.process = _process_i;
-       }
-       else
-       {
-               this->public.task.build = _build_r;
-               this->public.task.process = _process_r;
-       }
-       return &this->public;
-}
diff --git a/src/libcharon/sa/tasks/ike_cert_pre_v1.h b/src/libcharon/sa/tasks/ike_cert_pre_v1.h
deleted file mode 100644 (file)
index 38042cc..0000000
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) 2011 Martin Willi
- * Copyright (C) 2011 revosec AG
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ike_cert_pre_v1 ike_cert_pre_v1
- * @{ @ingroup tasks
- */
-
-#ifndef IKE_CERT_PRE_V1_H_
-#define IKE_CERT_PRE_V1_H_
-
-typedef struct ike_cert_pre_v1_t ike_cert_pre_v1_t;
-
-#include <library.h>
-#include <sa/ike_sa.h>
-#include <sa/tasks/task.h>
-
-/**
- * IKE_CERT_PRE_V1 task, IKEv1 certificate processing before authentication.
- */
-struct ike_cert_pre_v1_t {
-
-       /**
-        * Implements the task_t interface
-        */
-       task_t task;
-};
-
-/**
- * Create a new IKE_CERT_PRE_V1 task.
- *
- * The initiator parameter means the original initiator, not the initiator
- * of the certificate request.
- *
- * @param ike_sa               IKE_SA this task works for
- * @param initiator            TRUE if task is the original initiator
- * @return                             ike_cert_pre_v1 task to handle by the task_manager
- */
-ike_cert_pre_v1_t *ike_cert_pre_v1_create(ike_sa_t *ike_sa, bool initiator);
-
-#endif /** IIKE_CERT_PRE_V1_H_ @}*/
diff --git a/src/libcharon/sa/tasks/isakmp_cert_pre.c b/src/libcharon/sa/tasks/isakmp_cert_pre.c
new file mode 100644 (file)
index 0000000..db25bf3
--- /dev/null
@@ -0,0 +1,533 @@
+/*
+ * Copyright (C) 2011 Martin Willi
+ * Copyright (C) 2011 revosec AG
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "isakmp_cert_pre.h"
+
+#include <daemon.h>
+#include <sa/ike_sa.h>
+#include <encoding/payloads/cert_payload.h>
+#include <encoding/payloads/sa_payload.h>
+#include <encoding/payloads/certreq_payload.h>
+#include <credentials/certificates/x509.h>
+
+
+typedef struct private_isakmp_cert_pre_t private_isakmp_cert_pre_t;
+
+/**
+ * Private members of a isakmp_cert_pre_t task.
+ */
+struct private_isakmp_cert_pre_t {
+
+       /**
+        * Public methods and task_t interface.
+        */
+       isakmp_cert_pre_t public;
+
+       /**
+        * Assigned IKE_SA.
+        */
+       ike_sa_t *ike_sa;
+
+       /**
+        * Are we the initiator?
+        */
+       bool initiator;
+
+       /**
+        * Send certificate requests?
+        */
+       bool send_req;
+
+       /** next message we expect */
+       enum {
+               CR_SA,
+               CR_KE,
+               CR_AUTH,
+       } state;
+};
+
+/**
+ * Find the CA certificate for a given certreq payload
+ */
+static certificate_t* find_certificate(private_isakmp_cert_pre_t *this,
+                                                                          certreq_payload_t *certreq)
+{
+       identification_t *id;
+       certificate_t *cert;
+
+       if (certreq->get_cert_type(certreq) != CERT_X509)
+       {
+               DBG1(DBG_IKE, "%N CERTREQ not supported - ignored",
+                        certificate_type_names, certreq->get_cert_type(certreq));
+               return NULL;
+       }
+       id = certreq->get_dn(certreq);
+       if (!id)
+       {
+               DBG1(DBG_IKE, "ignoring certificate request without data",
+                        certificate_type_names, certreq->get_cert_type(certreq));
+               return NULL;
+       }
+       cert = lib->credmgr->get_cert(lib->credmgr, CERT_X509, KEY_ANY, id, TRUE);
+       if (cert)
+       {
+               DBG1(DBG_IKE, "received cert request for '%Y'",
+                        cert->get_subject(cert));
+       }
+       else
+       {
+               DBG1(DBG_IKE, "received cert request for unknown ca '%Y'", id);
+       }
+       id->destroy(id);
+
+       return cert;
+}
+
+/**
+ * read certificate requests
+ */
+static void process_certreqs(private_isakmp_cert_pre_t *this, message_t *message)
+{
+       enumerator_t *enumerator;
+       payload_t *payload;
+       auth_cfg_t *auth;
+
+       auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
+
+       enumerator = message->create_payload_enumerator(message);
+       while (enumerator->enumerate(enumerator, &payload))
+       {
+               switch (payload->get_type(payload))
+               {
+                       case CERTIFICATE_REQUEST_V1:
+                       {
+                               certificate_t *cert;
+
+                               this->ike_sa->set_condition(this->ike_sa,
+                                                                                       COND_CERTREQ_SEEN, TRUE);
+                               cert = find_certificate(this, (certreq_payload_t*)payload);
+                               if (cert)
+                               {
+                                       auth->add(auth, AUTH_RULE_CA_CERT, cert);
+                               }
+                               break;
+                       }
+                       default:
+                               break;
+               }
+       }
+       enumerator->destroy(enumerator);
+}
+
+/**
+ * Import receuved certificates
+ */
+static void process_certs(private_isakmp_cert_pre_t *this, message_t *message)
+{
+       enumerator_t *enumerator;
+       payload_t *payload;
+       auth_cfg_t *auth;
+       bool first = TRUE;
+
+       auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
+
+       enumerator = message->create_payload_enumerator(message);
+       while (enumerator->enumerate(enumerator, &payload))
+       {
+               if (payload->get_type(payload) == CERTIFICATE_V1)
+               {
+                       cert_payload_t *cert_payload;
+                       cert_encoding_t encoding;
+                       certificate_t *cert;
+
+                       cert_payload = (cert_payload_t*)payload;
+                       encoding = cert_payload->get_cert_encoding(cert_payload);
+
+                       switch (encoding)
+                       {
+                               case ENC_X509_SIGNATURE:
+                               {
+                                       cert = cert_payload->get_cert(cert_payload);
+                                       if (cert)
+                                       {
+                                               if (first)
+                                               {       /* the first is an end entity certificate */
+                                                       DBG1(DBG_IKE, "received end entity cert \"%Y\"",
+                                                                cert->get_subject(cert));
+                                                       auth->add(auth, AUTH_HELPER_SUBJECT_CERT, cert);
+                                                       first = FALSE;
+                                               }
+                                               else
+                                               {
+                                                       DBG1(DBG_IKE, "received issuer cert \"%Y\"",
+                                                                cert->get_subject(cert));
+                                                       auth->add(auth, AUTH_HELPER_IM_CERT, cert);
+                                               }
+                                       }
+                                       break;
+                               }
+                               case ENC_CRL:
+                                       cert = cert_payload->get_cert(cert_payload);
+                                       if (cert)
+                                       {
+                                               DBG1(DBG_IKE, "received CRL \"%Y\"",
+                                                        cert->get_subject(cert));
+                                               auth->add(auth, AUTH_HELPER_REVOCATION_CERT, cert);
+                                       }
+                                       break;
+                               case ENC_PKCS7_WRAPPED_X509:
+                               case ENC_PGP:
+                               case ENC_DNS_SIGNED_KEY:
+                               case ENC_KERBEROS_TOKEN:
+                               case ENC_ARL:
+                               case ENC_SPKI:
+                               case ENC_X509_ATTRIBUTE:
+                               case ENC_RAW_RSA_KEY:
+                               case ENC_X509_HASH_AND_URL_BUNDLE:
+                               case ENC_OCSP_CONTENT:
+                               default:
+                                       DBG1(DBG_ENC, "certificate encoding %N not supported",
+                                                cert_encoding_names, encoding);
+                       }
+               }
+       }
+       enumerator->destroy(enumerator);
+}
+
+/**
+ * Add the subject of a CA certificate a message
+ */
+static void add_certreq(private_isakmp_cert_pre_t *this, message_t *message,
+                                               certificate_t *cert)
+{
+       if (cert->get_type(cert) == CERT_X509)
+       {
+               x509_t *x509 = (x509_t*)cert;
+
+               if (x509->get_flags(x509) & X509_CA)
+               {
+                       DBG1(DBG_IKE, "sending cert request for \"%Y\"",
+                                cert->get_subject(cert));
+                       message->add_payload(message, (payload_t*)
+                                                       certreq_payload_create_dn(cert->get_subject(cert)));
+               }
+       }
+}
+
+/**
+ * Add auth_cfg's CA certificates to the certificate request
+ */
+static void add_certreqs(private_isakmp_cert_pre_t *this,
+                                                auth_cfg_t *auth, message_t *message)
+{
+       enumerator_t *enumerator;
+       auth_rule_t type;
+       void *value;
+
+       enumerator = auth->create_enumerator(auth);
+       while (enumerator->enumerate(enumerator, &type, &value))
+       {
+               switch (type)
+               {
+                       case AUTH_RULE_CA_CERT:
+                               add_certreq(this, message, (certificate_t*)value);
+                               break;
+                       default:
+                               break;
+               }
+       }
+       enumerator->destroy(enumerator);
+}
+
+/**
+ * Build certificate requests
+ */
+static void build_certreqs(private_isakmp_cert_pre_t *this, message_t *message)
+{
+       enumerator_t *enumerator;
+       ike_cfg_t *ike_cfg;
+       peer_cfg_t *peer_cfg;
+       certificate_t *cert;
+       auth_cfg_t *auth;
+
+       ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
+       if (!ike_cfg->send_certreq(ike_cfg))
+       {
+               return;
+       }
+       /* check if we require a specific CA for that peer */
+       peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
+       if (peer_cfg)
+       {
+               enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, FALSE);
+               if (enumerator->enumerate(enumerator, &auth))
+               {
+                       add_certreqs(this, auth, message);
+               }
+               enumerator->destroy(enumerator);
+       }
+       if (!message->get_payload(message, CERTIFICATE_REQUEST_V1))
+       {
+               /* otherwise add all trusted CA certificates */
+               enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
+                                                                                               CERT_ANY, KEY_ANY, NULL, TRUE);
+               while (enumerator->enumerate(enumerator, &cert))
+               {
+                       add_certreq(this, message, cert);
+               }
+               enumerator->destroy(enumerator);
+       }
+}
+
+/**
+ * Check if we actually use certificates for authentication
+ */
+static bool use_certs(private_isakmp_cert_pre_t *this, message_t *message)
+{
+       enumerator_t *enumerator;
+       payload_t *payload;
+       bool use = FALSE;
+
+       enumerator = message->create_payload_enumerator(message);
+       while (enumerator->enumerate(enumerator, &payload))
+       {
+               if (payload->get_type(payload) == SECURITY_ASSOCIATION_V1)
+               {
+                       sa_payload_t *sa_payload = (sa_payload_t*)payload;
+
+                       switch (sa_payload->get_auth_method(sa_payload))
+                       {
+                               case AUTH_HYBRID_INIT_RSA:
+                               case AUTH_HYBRID_RESP_RSA:
+                                       if (!this->initiator)
+                                       {
+                                               this->send_req = FALSE;
+                                       }
+                                       /* FALL */
+                               case AUTH_RSA:
+                               case AUTH_XAUTH_INIT_RSA:
+                               case AUTH_XAUTH_RESP_RSA:
+                                       use = TRUE;
+                                       break;
+                               default:
+                                       break;
+                       }
+                       break;
+               }
+       }
+       enumerator->destroy(enumerator);
+
+       return use;
+}
+
+METHOD(task_t, build_i, status_t,
+       private_isakmp_cert_pre_t *this, message_t *message)
+{
+       switch (message->get_exchange_type(message))
+       {
+               case ID_PROT:
+                       if (this->state == CR_AUTH)
+                       {
+                               build_certreqs(this, message);
+                       }
+                       return NEED_MORE;
+               case AGGRESSIVE:
+                       if (this->state == CR_SA)
+                       {
+                               build_certreqs(this, message);
+                       }
+                       return NEED_MORE;
+               default:
+                       return FAILED;
+       }
+}
+
+METHOD(task_t, process_r, status_t,
+       private_isakmp_cert_pre_t *this, message_t *message)
+{
+       switch (message->get_exchange_type(message))
+       {
+               case ID_PROT:
+               {
+                       switch (this->state)
+                       {
+                               case CR_SA:
+                                       if (!use_certs(this, message))
+                                       {
+                                               return SUCCESS;
+                                       }
+                                       return NEED_MORE;
+                               case CR_KE:
+                                       process_certreqs(this, message);
+                                       return NEED_MORE;
+                               case CR_AUTH:
+                                       process_certreqs(this, message);
+                                       process_certs(this, message);
+                                       return SUCCESS;
+                       }
+               }
+               case AGGRESSIVE:
+               {
+                       switch (this->state)
+                       {
+                               case CR_SA:
+                                       if (!use_certs(this, message))
+                                       {
+                                               return SUCCESS;
+                                       }
+                                       process_certreqs(this, message);
+                                       return NEED_MORE;
+                               case CR_AUTH:
+                                       process_certs(this, message);
+                                       return SUCCESS;
+                               default:
+                                       return FAILED;
+                       }
+               }
+               default:
+                       return FAILED;
+       }
+}
+
+METHOD(task_t, build_r, status_t,
+       private_isakmp_cert_pre_t *this, message_t *message)
+{
+       switch (message->get_exchange_type(message))
+       {
+               case ID_PROT:
+                       switch (this->state)
+                       {
+                               case CR_SA:
+                                       this->state = CR_KE;
+                                       return NEED_MORE;
+                               case CR_KE:
+                                       if (this->send_req)
+                                       {
+                                               build_certreqs(this, message);
+                                       }
+                                       this->state = CR_AUTH;
+                                       return NEED_MORE;
+                               case CR_AUTH:
+                                       return NEED_MORE;
+                       }
+               case AGGRESSIVE:
+                       switch (this->state)
+                       {
+                               case CR_SA:
+                                       this->state = CR_AUTH;
+                                       return NEED_MORE;
+                               case CR_AUTH:
+                                       return SUCCESS;
+                               default:
+                                       return FAILED;
+                       }
+               default:
+                       return FAILED;
+       }
+}
+
+METHOD(task_t, process_i, status_t,
+       private_isakmp_cert_pre_t *this, message_t *message)
+{
+       switch (message->get_exchange_type(message))
+       {
+               case ID_PROT:
+               {
+                       switch (this->state)
+                       {
+                               case CR_SA:
+                                       if (!use_certs(this, message))
+                                       {
+                                               return SUCCESS;
+                                       }
+                                       this->state = CR_KE;
+                                       return NEED_MORE;
+                               case CR_KE:
+                                       process_certreqs(this, message);
+                                       this->state = CR_AUTH;
+                                       return NEED_MORE;
+                               case CR_AUTH:
+                                       process_certs(this, message);
+                                       return SUCCESS;
+                               default:
+                                       return FAILED;
+                       }
+                       break;
+               }
+               case AGGRESSIVE:
+               {
+                       if (!use_certs(this, message))
+                       {
+                               return SUCCESS;
+                       }
+                       process_certreqs(this, message);
+                       process_certs(this, message);
+                       return SUCCESS;
+               }
+               default:
+                       return FAILED;
+       }
+}
+
+METHOD(task_t, get_type, task_type_t,
+       private_isakmp_cert_pre_t *this)
+{
+       return TASK_ISAKMP_CERT_PRE;
+}
+
+METHOD(task_t, migrate, void,
+       private_isakmp_cert_pre_t *this, ike_sa_t *ike_sa)
+{
+       this->ike_sa = ike_sa;
+}
+
+METHOD(task_t, destroy, void,
+       private_isakmp_cert_pre_t *this)
+{
+       free(this);
+}
+
+/*
+ * Described in header.
+ */
+isakmp_cert_pre_t *isakmp_cert_pre_create(ike_sa_t *ike_sa, bool initiator)
+{
+       private_isakmp_cert_pre_t *this;
+
+       INIT(this,
+               .public = {
+                       .task = {
+                               .get_type = _get_type,
+                               .migrate = _migrate,
+                               .destroy = _destroy,
+                       },
+               },
+               .ike_sa = ike_sa,
+               .initiator = initiator,
+               .state = CR_SA,
+               .send_req = TRUE,
+       );
+       if (initiator)
+       {
+               this->public.task.build = _build_i;
+               this->public.task.process = _process_i;
+       }
+       else
+       {
+               this->public.task.build = _build_r;
+               this->public.task.process = _process_r;
+       }
+       return &this->public;
+}
diff --git a/src/libcharon/sa/tasks/isakmp_cert_pre.h b/src/libcharon/sa/tasks/isakmp_cert_pre.h
new file mode 100644 (file)
index 0000000..c6dc98a
--- /dev/null
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2011 Martin Willi
+ * Copyright (C) 2011 revosec AG
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup isakmp_cert_pre isakmp_cert_pre
+ * @{ @ingroup tasks
+ */
+
+#ifndef ISAKMP_CERT_PRE_H_
+#define ISAKMP_CERT_PRE_H_
+
+typedef struct isakmp_cert_pre_t isakmp_cert_pre_t;
+
+#include <library.h>
+#include <sa/ike_sa.h>
+#include <sa/tasks/task.h>
+
+/**
+ * ISAKMP_CERT_PRE task, IKEv1 certificate processing before authentication.
+ */
+struct isakmp_cert_pre_t {
+
+       /**
+        * Implements the task_t interface
+        */
+       task_t task;
+};
+
+/**
+ * Create a new ISAKMP_CERT_PRE task.
+ *
+ * The initiator parameter means the original initiator, not the initiator
+ * of the certificate request.
+ *
+ * @param ike_sa               IKE_SA this task works for
+ * @param initiator            TRUE if task is the original initiator
+ * @return                             isakmp_cert_pre task to handle by the task_manager
+ */
+isakmp_cert_pre_t *isakmp_cert_pre_create(ike_sa_t *ike_sa, bool initiator);
+
+#endif /** ISAKMP_CERT_PRE_H_ @}*/
index a3a8489..e635d53 100644 (file)
@@ -45,6 +45,6 @@ ENUM(task_type_names, TASK_IKE_INIT, TASK_ISAKMP_CERT_POST,
        "QUICK_DELETE",
        "VENDOR_V1",
        "IKE_NATD_V1",
-       "IKE_CERT_PRE_V1",
+       "ISAKMP_CERT_PRE",
        "ISAKMP_CERT_POST",
 );
index 0af8ea7..5033775 100644 (file)
@@ -88,7 +88,7 @@ enum task_type_t {
        /** IKEv1 NAT detection */
        TASK_IKE_NATD_V1,
        /** IKEv1 pre-authentication certificate handling */
-       TASK_IKE_CERT_PRE_V1,
+       TASK_ISAKMP_CERT_PRE,
        /** IKEv1 post-authentication certificate handling */
        TASK_ISAKMP_CERT_POST,
 };