redesigned IKE_SA using a transaction mechanism:
removed old state machine reimplemented IKE_SA setup and delete implemented dead peer detection implemented keep-alives a lot of fixes no rekeying yet
This commit is contained in:
Martin Willi
@@ -0,0 +1,198 @@
|
||||
/**
|
||||
* @file dead_peer_detection.c
|
||||
*
|
||||
* @brief Implementation of the dead_peer_detection transaction.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (C) 2006 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
#include "dead_peer_detection.h"
|
||||
|
||||
#include <daemon.h>
|
||||
|
||||
|
||||
typedef struct private_dead_peer_detection_t private_dead_peer_detection_t;
|
||||
|
||||
/**
|
||||
* Private members of a dead_peer_detection_t object..
|
||||
*/
|
||||
struct private_dead_peer_detection_t {
|
||||
|
||||
/**
|
||||
* Public methods and transaction_t interface.
|
||||
*/
|
||||
dead_peer_detection_t public;
|
||||
|
||||
/**
|
||||
* Assigned IKE_SA.
|
||||
*/
|
||||
ike_sa_t *ike_sa;
|
||||
|
||||
/**
|
||||
* Message sent by our peer, if already generated
|
||||
*/
|
||||
message_t *message;
|
||||
|
||||
/**
|
||||
* Message ID this transaction uses
|
||||
*/
|
||||
u_int32_t message_id;
|
||||
|
||||
/**
|
||||
* Times we did send the request
|
||||
*/
|
||||
u_int32_t requested;
|
||||
|
||||
/**
|
||||
* Assigned logger.
|
||||
*/
|
||||
logger_t *logger;
|
||||
};
|
||||
|
||||
/**
|
||||
* Implementation of transaction_t.get_message_id.
|
||||
*/
|
||||
static u_int32_t get_message_id(private_dead_peer_detection_t *this)
|
||||
{
|
||||
return this->message_id;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of transaction_t.requested.
|
||||
*/
|
||||
static u_int32_t requested(private_dead_peer_detection_t *this)
|
||||
{
|
||||
return this->requested++;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of transaction_t.get_request.
|
||||
*/
|
||||
static status_t get_request(private_dead_peer_detection_t *this, message_t **result)
|
||||
{
|
||||
message_t *request;
|
||||
connection_t *connection;
|
||||
host_t *me, *other;
|
||||
|
||||
/* check if we already have built a message (retransmission) */
|
||||
if (this->message)
|
||||
{
|
||||
*result = this->message;
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
connection = this->ike_sa->get_connection(this->ike_sa);
|
||||
me = connection->get_my_host(connection);
|
||||
other = connection->get_other_host(connection);
|
||||
|
||||
/* build the request */
|
||||
request = message_create();
|
||||
request->set_source(request, me->clone(me));
|
||||
request->set_destination(request, other->clone(other));
|
||||
request->set_exchange_type(request, INFORMATIONAL);
|
||||
request->set_request(request, TRUE);
|
||||
request->set_message_id(request, this->message_id);
|
||||
request->set_ike_sa_id(request, this->ike_sa->get_id(this->ike_sa));
|
||||
/* apply for caller */
|
||||
*result = request;
|
||||
/* store for retransmission */
|
||||
this->message = request;
|
||||
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of transaction_t.get_response.
|
||||
*/
|
||||
static status_t get_response(private_dead_peer_detection_t *this, message_t *request,
|
||||
message_t **result, transaction_t **next)
|
||||
{
|
||||
host_t *me, *other;
|
||||
message_t *response;
|
||||
connection_t *connection;
|
||||
|
||||
/* check if we already have built a response (retransmission) */
|
||||
if (this->message)
|
||||
{
|
||||
*result = this->message;
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
connection = this->ike_sa->get_connection(this->ike_sa);
|
||||
me = connection->get_my_host(connection);
|
||||
other = connection->get_other_host(connection);
|
||||
|
||||
/* set up response */
|
||||
response = message_create();
|
||||
response->set_source(response, me->clone(me));
|
||||
response->set_destination(response, other->clone(other));
|
||||
response->set_exchange_type(response, INFORMATIONAL);
|
||||
response->set_request(response, FALSE);
|
||||
response->set_message_id(response, this->message_id);
|
||||
response->set_ike_sa_id(response, this->ike_sa->get_id(this->ike_sa));
|
||||
this->message = response;
|
||||
*result = response;
|
||||
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Implementation of transaction_t.conclude
|
||||
*/
|
||||
static status_t conclude(private_dead_peer_detection_t *this, message_t *response,
|
||||
transaction_t **transaction)
|
||||
{
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
/**
|
||||
* implements transaction_t.destroy
|
||||
*/
|
||||
static void destroy(private_dead_peer_detection_t *this)
|
||||
{
|
||||
if (this->message)
|
||||
{
|
||||
this->message->destroy(this->message);
|
||||
}
|
||||
free(this);
|
||||
}
|
||||
|
||||
/*
|
||||
* Described in header.
|
||||
*/
|
||||
dead_peer_detection_t *dead_peer_detection_create(ike_sa_t *ike_sa, u_int32_t message_id)
|
||||
{
|
||||
private_dead_peer_detection_t *this = malloc_thing(private_dead_peer_detection_t);
|
||||
|
||||
/* transaction interface functions */
|
||||
this->public.transaction.get_request = (status_t(*)(transaction_t*,message_t**))get_request;
|
||||
this->public.transaction.get_response = (status_t(*)(transaction_t*,message_t*,message_t**,transaction_t**))get_response;
|
||||
this->public.transaction.conclude = (status_t(*)(transaction_t*,message_t*,transaction_t**))conclude;
|
||||
this->public.transaction.get_message_id = (u_int32_t(*)(transaction_t*))get_message_id;
|
||||
this->public.transaction.requested = (u_int32_t(*)(transaction_t*))requested;
|
||||
this->public.transaction.destroy = (void(*)(transaction_t*))destroy;
|
||||
|
||||
/* private data */
|
||||
this->ike_sa = ike_sa;
|
||||
this->message_id = message_id;
|
||||
this->message = NULL;
|
||||
this->requested = 0;
|
||||
this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
/**
|
||||
* @file dead_peer_detection.h
|
||||
*
|
||||
* @brief Interface of transaction dead_peer_detection.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (C) 2006 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
|
||||
#ifndef DEAD_PEER_DETECTION_H_
|
||||
#define DEAD_PEER_DETECTION_H_
|
||||
|
||||
#include <sa/ike_sa.h>
|
||||
#include <sa/transactions/transaction.h>
|
||||
|
||||
|
||||
typedef struct dead_peer_detection_t dead_peer_detection_t;
|
||||
|
||||
/**
|
||||
* @brief A transaction used to detect dead peers.
|
||||
*
|
||||
* In IKEv2, dead peer detection is done using empty
|
||||
* informational messages. These must be acknowledged.
|
||||
*
|
||||
* @ingroup transactions
|
||||
*/
|
||||
struct dead_peer_detection_t {
|
||||
|
||||
/**
|
||||
* The transaction_t interface.
|
||||
*/
|
||||
transaction_t transaction;
|
||||
};
|
||||
|
||||
/**
|
||||
* @brief Create a new transaction which detects dead peers.
|
||||
*
|
||||
* @param ike_sa assigned IKE_SA
|
||||
* @param message_id message ids used in this transaction
|
||||
* @return created dead_peer_detection transaction
|
||||
*
|
||||
* @ingroup transactions
|
||||
*/
|
||||
dead_peer_detection_t *dead_peer_detection_create(ike_sa_t *ike_sa, u_int32_t message_id);
|
||||
|
||||
#endif /* DEAD_PEER_DETECTION_H_ */
|
||||
@@ -0,0 +1,271 @@
|
||||
/**
|
||||
* @file delete_ike_sa.c
|
||||
*
|
||||
* @brief Implementation of the delete_ike_sa transaction.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (C) 2006 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
#include "delete_ike_sa.h"
|
||||
|
||||
#include <daemon.h>
|
||||
#include <encoding/payloads/delete_payload.h>
|
||||
|
||||
|
||||
typedef struct private_delete_ike_sa_t private_delete_ike_sa_t;
|
||||
|
||||
/**
|
||||
* Private members of a delete_ike_sa_t object..
|
||||
*/
|
||||
struct private_delete_ike_sa_t {
|
||||
|
||||
/**
|
||||
* Public methods and transaction_t interface.
|
||||
*/
|
||||
delete_ike_sa_t public;
|
||||
|
||||
/**
|
||||
* Assigned IKE_SA.
|
||||
*/
|
||||
ike_sa_t *ike_sa;
|
||||
|
||||
/**
|
||||
* Message sent by our peer, if already generated
|
||||
*/
|
||||
message_t *message;
|
||||
|
||||
/**
|
||||
* Message ID this transaction uses
|
||||
*/
|
||||
u_int32_t message_id;
|
||||
|
||||
/**
|
||||
* Times we did send the request
|
||||
*/
|
||||
u_int32_t requested;
|
||||
|
||||
/**
|
||||
* Assigned logger.
|
||||
*/
|
||||
logger_t *logger;
|
||||
};
|
||||
|
||||
/**
|
||||
* Implementation of transaction_t.get_message_id.
|
||||
*/
|
||||
static u_int32_t get_message_id(private_delete_ike_sa_t *this)
|
||||
{
|
||||
return this->message_id;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of transaction_t.requested.
|
||||
*/
|
||||
static u_int32_t requested(private_delete_ike_sa_t *this)
|
||||
{
|
||||
return this->requested++;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of transaction_t.get_request.
|
||||
*/
|
||||
static status_t get_request(private_delete_ike_sa_t *this, message_t **result)
|
||||
{
|
||||
message_t *request;
|
||||
connection_t *connection;
|
||||
host_t *me, *other;
|
||||
delete_payload_t *delete_payload;
|
||||
|
||||
/* check if we already have built a message (retransmission) */
|
||||
if (this->message)
|
||||
{
|
||||
*result = this->message;
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
connection = this->ike_sa->get_connection(this->ike_sa);
|
||||
me = connection->get_my_host(connection);
|
||||
other = connection->get_other_host(connection);
|
||||
|
||||
/* build the request */
|
||||
request = message_create();
|
||||
request->set_source(request, me->clone(me));
|
||||
request->set_destination(request, other->clone(other));
|
||||
request->set_exchange_type(request, INFORMATIONAL);
|
||||
request->set_request(request, TRUE);
|
||||
request->set_message_id(request, this->message_id);
|
||||
request->set_ike_sa_id(request, this->ike_sa->get_id(this->ike_sa));
|
||||
/* apply for caller */
|
||||
*result = request;
|
||||
/* store for retransmission */
|
||||
this->message = request;
|
||||
|
||||
delete_payload = delete_payload_create(PROTO_IKE);
|
||||
request->add_payload(request, (payload_t*)delete_payload);
|
||||
|
||||
/* transit to state SA_DELETING */
|
||||
this->ike_sa->set_state(this->ike_sa, SA_DELETING);
|
||||
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of transaction_t.get_response.
|
||||
*/
|
||||
static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
|
||||
message_t **result, transaction_t **next)
|
||||
{
|
||||
host_t *me, *other;
|
||||
message_t *response;
|
||||
iterator_t *payloads;
|
||||
delete_payload_t *delete_request = NULL;
|
||||
connection_t *connection;
|
||||
|
||||
/* check message type */
|
||||
if (request->get_exchange_type(request) != INFORMATIONAL)
|
||||
{
|
||||
this->logger->log(this->logger, ERROR,
|
||||
"INFORMATIONAL response of invalid type, deleting IKE_SA");
|
||||
return DESTROY_ME;
|
||||
}
|
||||
|
||||
/* check if we already have built a response (retransmission)
|
||||
* this only happens in special simultanous transaction cases,
|
||||
* as we delete the IKE_SA after the response is sent. */
|
||||
if (this->message)
|
||||
{
|
||||
*result = this->message;
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
connection = this->ike_sa->get_connection(this->ike_sa);
|
||||
me = connection->get_my_host(connection);
|
||||
other = connection->get_other_host(connection);
|
||||
|
||||
/* set up response */
|
||||
response = message_create();
|
||||
response->set_source(response, me->clone(me));
|
||||
response->set_destination(response, other->clone(other));
|
||||
response->set_exchange_type(response, INFORMATIONAL);
|
||||
response->set_request(response, FALSE);
|
||||
response->set_message_id(response, this->message_id);
|
||||
response->set_ike_sa_id(response, this->ike_sa->get_id(this->ike_sa));
|
||||
this->message = response;
|
||||
*result = response;
|
||||
|
||||
/* iterate over all payloads */
|
||||
payloads = request->get_payload_iterator(request);
|
||||
while (payloads->has_next(payloads))
|
||||
{
|
||||
payload_t *payload;
|
||||
payloads->current(payloads, (void**)&payload);
|
||||
|
||||
switch (payload->get_type(payload))
|
||||
{
|
||||
case DELETE:
|
||||
{
|
||||
delete_request = (delete_payload_t *)payload;
|
||||
break;
|
||||
}
|
||||
default:
|
||||
{
|
||||
this->logger->log(this->logger, ERROR|LEVEL1, "ignoring payload %s (%d)",
|
||||
mapping_find(payload_type_m, payload->get_type(payload)),
|
||||
payload->get_type(payload));
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
payloads->destroy(payloads);
|
||||
|
||||
if (delete_request &&
|
||||
delete_request->get_protocol_id(delete_request) == PROTO_IKE)
|
||||
{
|
||||
this->logger->log(this->logger, CONTROL,
|
||||
"DELETE request for IKE_SA received, deleting IKE_SA");
|
||||
}
|
||||
else
|
||||
{
|
||||
/* should not happen, as we preparsed this at transaction construction */
|
||||
this->logger->log(this->logger, CONTROL,
|
||||
"received a weird DELETE request for IKE_SA, deleting anyway");
|
||||
}
|
||||
if (this->ike_sa->get_state(this->ike_sa) == SA_DELETING)
|
||||
{
|
||||
/* if we are already deleting an IKE_SA, we do not destroy. We wait
|
||||
* until we get the response for our initiated delete. */
|
||||
return SUCCESS;
|
||||
}
|
||||
this->ike_sa->set_state(this->ike_sa, SA_DELETING);
|
||||
return DESTROY_ME;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Implementation of transaction_t.conclude
|
||||
*/
|
||||
static status_t conclude(private_delete_ike_sa_t *this, message_t *response,
|
||||
transaction_t **transaction)
|
||||
{
|
||||
/* check message type */
|
||||
if (response->get_exchange_type(response) != INFORMATIONAL)
|
||||
{
|
||||
this->logger->log(this->logger, ERROR,
|
||||
"INFORMATIONAL response of invalid type, deleting IKE_SA");
|
||||
return DESTROY_ME;
|
||||
}
|
||||
/* this is only an acknowledge. We can't do anything here, but delete
|
||||
* the IKE_SA. */
|
||||
return DESTROY_ME;
|
||||
}
|
||||
|
||||
/**
|
||||
* implements transaction_t.destroy
|
||||
*/
|
||||
static void destroy(private_delete_ike_sa_t *this)
|
||||
{
|
||||
if (this->message)
|
||||
{
|
||||
this->message->destroy(this->message);
|
||||
}
|
||||
free(this);
|
||||
}
|
||||
|
||||
/*
|
||||
* Described in header.
|
||||
*/
|
||||
delete_ike_sa_t *delete_ike_sa_create(ike_sa_t *ike_sa, u_int32_t message_id)
|
||||
{
|
||||
private_delete_ike_sa_t *this = malloc_thing(private_delete_ike_sa_t);
|
||||
|
||||
/* transaction interface functions */
|
||||
this->public.transaction.get_request = (status_t(*)(transaction_t*,message_t**))get_request;
|
||||
this->public.transaction.get_response = (status_t(*)(transaction_t*,message_t*,message_t**,transaction_t**))get_response;
|
||||
this->public.transaction.conclude = (status_t(*)(transaction_t*,message_t*,transaction_t**))conclude;
|
||||
this->public.transaction.get_message_id = (u_int32_t(*)(transaction_t*))get_message_id;
|
||||
this->public.transaction.requested = (u_int32_t(*)(transaction_t*))requested;
|
||||
this->public.transaction.destroy = (void(*)(transaction_t*))destroy;
|
||||
|
||||
/* private data */
|
||||
this->ike_sa = ike_sa;
|
||||
this->message_id = message_id;
|
||||
this->message = NULL;
|
||||
this->requested = 0;
|
||||
this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
@@ -0,0 +1,83 @@
|
||||
/**
|
||||
* @file delete_ike_sa.h
|
||||
*
|
||||
* @brief Interface of transaction delete_ike_sa.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (C) 2006 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
|
||||
#ifndef DELETE_IKE_SA_H_
|
||||
#define DELETE_IKE_SA_H_
|
||||
|
||||
#include <sa/ike_sa.h>
|
||||
#include <sa/transactions/transaction.h>
|
||||
|
||||
|
||||
typedef struct delete_ike_sa_t delete_ike_sa_t;
|
||||
|
||||
/**
|
||||
* @brief A transaction used to delete the IKE_SA.
|
||||
*
|
||||
* Notation as follows:
|
||||
* Mx{D} means: Message, with message ID "x", containing a Delete payload
|
||||
*
|
||||
* The clarifcation Document says in 5.8, that a IKE_SA delete should not
|
||||
* be acknowledged with the same delete. This only makes sense for CHILD_SAs,
|
||||
* as they are paired. IKE_SAs are not, there is only one for both ends.
|
||||
*
|
||||
* Normal case:
|
||||
* ----------------
|
||||
* Mx{D} -->
|
||||
* <-- Mx{}
|
||||
* Delete request is sent, and we wait for the acknowledge.
|
||||
*
|
||||
* Special case 1:
|
||||
* ---------------
|
||||
* Mx{D} -->
|
||||
* <-- My{D}
|
||||
* My{} -->
|
||||
* <-- Mx{}
|
||||
* Both initate a delete at the same time. We ack the delete, but wait for
|
||||
* our delete to be acknowledged.
|
||||
*
|
||||
* @b Constructors:
|
||||
* - delete_ike_sa_create()
|
||||
* - transaction_create() with the appropriate message
|
||||
*
|
||||
* @ingroup transactions
|
||||
*/
|
||||
struct delete_ike_sa_t {
|
||||
|
||||
/**
|
||||
* The transaction_t interface.
|
||||
*/
|
||||
transaction_t transaction;
|
||||
};
|
||||
|
||||
/**
|
||||
* @brief Create a new transaction which deletes the IKE_SA.
|
||||
*
|
||||
* @param ike_sa assigned IKE_SA
|
||||
* @param message_id message ids used in this transaction
|
||||
* @return created delete_ike_sa transaction
|
||||
*
|
||||
* @ingroup transactions
|
||||
*/
|
||||
delete_ike_sa_t *delete_ike_sa_create(ike_sa_t *ike_sa, u_int32_t message_id);
|
||||
|
||||
#endif /* DELETE_IKE_SA_H_ */
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,86 @@
|
||||
/**
|
||||
* @file ike_auth.h
|
||||
*
|
||||
* @brief Interface of transaction ike_auth.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (C) 2006 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
|
||||
#ifndef IKE_AUTH_H_
|
||||
#define IKE_AUTH_H_
|
||||
|
||||
#include <sa/ike_sa.h>
|
||||
#include <sa/transactions/transaction.h>
|
||||
|
||||
|
||||
typedef struct ike_auth_t ike_auth_t;
|
||||
|
||||
/**
|
||||
* @brief A transaction for the second message exchange to authenticate an IKE_SA.
|
||||
*
|
||||
* The second transaction is encrypted and authenticates the peers. It also
|
||||
* sets up a first CHILD_SA.
|
||||
*
|
||||
* @b Constructors:
|
||||
* - ike_auth_create()
|
||||
* - transaction_create() with the appropriate message
|
||||
*
|
||||
* @ingroup transactions
|
||||
*/
|
||||
struct ike_auth_t {
|
||||
|
||||
/**
|
||||
* The transaction_t interface.
|
||||
*/
|
||||
transaction_t transaction;
|
||||
|
||||
/**
|
||||
* @brief Set the nonces used in the previous ike_sa_init transaction.
|
||||
*
|
||||
* The nonces are used to create the authentication data.
|
||||
*
|
||||
* @param this calling object
|
||||
* @param nonce_i initiator chosen nonce
|
||||
* @param nonce_r responder chosen nonce
|
||||
*/
|
||||
void (*set_nonces) (ike_auth_t* this, chunk_t nonce_i, chunk_t nonce_r);
|
||||
|
||||
/**
|
||||
* @brief Set the messages used in the previous ike_sa_init transaction.
|
||||
*
|
||||
* The messages are used to create the authentication data.
|
||||
*
|
||||
* @param this calling object
|
||||
* @param request encoded request message as a chunk
|
||||
* @param response encoded response message as a chunk
|
||||
*/
|
||||
void (*set_init_messages) (ike_auth_t* this, chunk_t request, chunk_t response);
|
||||
};
|
||||
|
||||
/**
|
||||
* @brief Create a new transaction which processes IKE_AUTH exchanges.
|
||||
*
|
||||
* @param ike_sa assigned IKE_SA
|
||||
* @param message_id message ids used in this transaction
|
||||
* @return created ike_auth transaction
|
||||
*
|
||||
* @ingroup transactions
|
||||
*/
|
||||
ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, u_int32_t message_id);
|
||||
|
||||
#endif /* IKE_AUTH_H_ */
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,73 @@
|
||||
/**
|
||||
* @file ike_sa_init.h
|
||||
*
|
||||
* @brief Interface of transaction ike_sa_init.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (C) 2006 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
|
||||
#ifndef IKE_SA_INIT_H_
|
||||
#define IKE_SA_INIT_H_
|
||||
|
||||
#include <sa/ike_sa.h>
|
||||
#include <sa/transactions/transaction.h>
|
||||
|
||||
|
||||
typedef struct ike_sa_init_t ike_sa_init_t;
|
||||
|
||||
/**
|
||||
* @brief A transaction for the first message exchange to set up an IKE_SA.
|
||||
*
|
||||
* @b Constructors:
|
||||
* - ike_sa_init_create()
|
||||
* - transaction_create() with the appropriate message
|
||||
*
|
||||
* @ingroup transactions
|
||||
*/
|
||||
struct ike_sa_init_t {
|
||||
|
||||
/**
|
||||
* The transaction_t interface.
|
||||
*/
|
||||
transaction_t transaction;
|
||||
|
||||
/**
|
||||
* @brief Set the Diffie Hellman group to use for initiating.
|
||||
*
|
||||
* If a first exchange fails with a INVALID_KE_PAYLOAD, the second
|
||||
* try uses the DH group proposed by the responder.
|
||||
*
|
||||
* @param this calling object
|
||||
* @param dh_group diffie hellman group to use
|
||||
* @return FALSE, if DH group not allowed/supported
|
||||
*/
|
||||
bool (*use_dh_group) (ike_sa_init_t* this, diffie_hellman_group_t dh_group);
|
||||
};
|
||||
|
||||
/**
|
||||
* @brief Create a new transaction which processes IKE_SA_INIT exchanges.
|
||||
*
|
||||
* @param ike_sa assigned IKE_SA
|
||||
* @param message_id message ids used in this transaction
|
||||
* @return created ike_sa_init transaction
|
||||
*
|
||||
* @ingroup transactions
|
||||
*/
|
||||
ike_sa_init_t *ike_sa_init_create(ike_sa_t *ike_sa, u_int32_t message_id);
|
||||
|
||||
#endif /* IKE_SA_INIT_H_ */
|
||||
@@ -0,0 +1,147 @@
|
||||
/**
|
||||
* @file transaction.c
|
||||
*
|
||||
* @brief Generic contstructor for the different transaction types.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (C) 2006 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
#include "transaction.h"
|
||||
|
||||
#include <sa/child_sa.h>
|
||||
#include <sa/transactions/ike_sa_init.h>
|
||||
#include <sa/transactions/ike_auth.h>
|
||||
#include <sa/transactions/delete_ike_sa.h>
|
||||
#include <sa/transactions/dead_peer_detection.h>
|
||||
#include <encoding/payloads/ts_payload.h>
|
||||
#include <encoding/payloads/sa_payload.h>
|
||||
#include <encoding/payloads/nonce_payload.h>
|
||||
#include <encoding/payloads/notify_payload.h>
|
||||
#include <encoding/payloads/delete_payload.h>
|
||||
#include <utils/logger_manager.h>
|
||||
|
||||
|
||||
/*
|
||||
* see header file
|
||||
*/
|
||||
transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
|
||||
{
|
||||
iterator_t *iterator;
|
||||
payload_t *current;
|
||||
notify_payload_t *notify;
|
||||
transaction_t *transaction = NULL;
|
||||
u_int32_t message_id;
|
||||
|
||||
if (!request->get_request(request))
|
||||
{
|
||||
return NULL;
|
||||
}
|
||||
message_id = request->get_message_id(request);
|
||||
|
||||
switch (request->get_exchange_type(request))
|
||||
{
|
||||
case IKE_SA_INIT:
|
||||
{
|
||||
transaction = (transaction_t*)ike_sa_init_create(ike_sa, message_id);
|
||||
break;
|
||||
}
|
||||
case IKE_AUTH:
|
||||
{
|
||||
/* IKE_AUTH is always created in IKE_SA_INIT, it never should
|
||||
* appear alone */
|
||||
break;
|
||||
}
|
||||
case CREATE_CHILD_SA:
|
||||
{
|
||||
/* look for a REKEY_SA notify */
|
||||
iterator = request->get_payload_iterator(request);
|
||||
while (iterator->has_next(iterator))
|
||||
{
|
||||
iterator->current(iterator, (void**)¤t);
|
||||
if (current->get_type(current) != NOTIFY)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
notify = (notify_payload_t*)current;
|
||||
if (notify->get_notify_type(notify) != REKEY_SA)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
switch (notify->get_protocol_id(notify))
|
||||
{
|
||||
case PROTO_IKE:
|
||||
/* TODO: transaction = rekey_ike_sa_create(ike_sa, message_id); */
|
||||
break;
|
||||
case PROTO_AH:
|
||||
case PROTO_ESP:
|
||||
{
|
||||
/* TODO: transaction = rekey_child_sa_create(ike_sa, message_id); */
|
||||
break;
|
||||
}
|
||||
default:
|
||||
break;
|
||||
}
|
||||
if (transaction)
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
iterator->destroy(iterator);
|
||||
break;
|
||||
}
|
||||
case INFORMATIONAL:
|
||||
{
|
||||
u_int payload_count = 0;
|
||||
iterator = request->get_payload_iterator(request);
|
||||
while (iterator->has_next(iterator))
|
||||
{
|
||||
payload_count++;
|
||||
iterator->current(iterator, (void**)¤t);
|
||||
switch (current->get_type(current))
|
||||
{
|
||||
case DELETE:
|
||||
{
|
||||
delete_payload_t *delete_payload;
|
||||
delete_payload = (delete_payload_t*)current;
|
||||
if (delete_payload->get_protocol_id(delete_payload) == PROTO_IKE)
|
||||
{
|
||||
transaction = (transaction_t*)
|
||||
delete_ike_sa_create(ike_sa, message_id);
|
||||
break;
|
||||
}
|
||||
}
|
||||
default:
|
||||
break;
|
||||
}
|
||||
if (transaction)
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
iterator->destroy(iterator);
|
||||
if (payload_count == 0)
|
||||
{
|
||||
transaction = (transaction_t*)
|
||||
dead_peer_detection_create(ike_sa, message_id);
|
||||
}
|
||||
break;
|
||||
}
|
||||
default:
|
||||
break;
|
||||
}
|
||||
return transaction;
|
||||
}
|
||||
@@ -0,0 +1,181 @@
|
||||
/**
|
||||
* @file transaction.h
|
||||
*
|
||||
* @brief Interface transaction_t.
|
||||
*
|
||||
*/
|
||||
|
||||
/*
|
||||
* Copyright (C) 2006 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
#ifndef TRANSACTION_H_
|
||||
#define TRANSACTION_H_
|
||||
|
||||
#include <types.h>
|
||||
#include <encoding/message.h>
|
||||
#include <sa/ike_sa.h>
|
||||
|
||||
|
||||
typedef struct transaction_t transaction_t;
|
||||
|
||||
/**
|
||||
* @brief This interface represents a transaction an established IKE_SA can do.
|
||||
*
|
||||
* To every transaction, a message ID is associated. IKEv2 uses strict message
|
||||
* IDs, which are equal for a request/response pair in a transaction.
|
||||
* An initiator of a transaction does the following:
|
||||
* - create the transaction using a specific constructor
|
||||
* - call request() to get the message for initiaton
|
||||
* - call conclude() to process received reply
|
||||
* The other peer does the following:
|
||||
* - create a transanction using the generic transaction constructor
|
||||
* - call respond() to get a reply to send
|
||||
*
|
||||
* The responder must not destroy the transaction, until the
|
||||
* initiator initiates another transaction (or a number of transactions
|
||||
* > window size). This allows us to redo a transaction in case of a
|
||||
* message loss. The initiator can destroy the the transaction once
|
||||
* the conclude() function is called.
|
||||
*
|
||||
* @b Constructors:
|
||||
* - transaction_create()
|
||||
* - ike_sa_init_create()
|
||||
* - ike_auth_create()
|
||||
*
|
||||
* @ingroup transactions
|
||||
*/
|
||||
struct transaction_t {
|
||||
|
||||
/**
|
||||
* @brief Get the request to use for initiating the transaction.
|
||||
*
|
||||
* A transaction creates a request only once. The request is stored
|
||||
* internally and may be queried multiple times for retransmission.
|
||||
* The transaction is not responsible for generating/encrypting the
|
||||
* message, this is the job of the caller. But it MAY be already
|
||||
* generated when calling get_request() the second time.
|
||||
*
|
||||
* @param this calling object
|
||||
* @param[out] request resultin request
|
||||
* @return
|
||||
* - FAILED if transaction failed
|
||||
* - DESTROY_ME if transaction failed and IKE SA
|
||||
* must be deleted
|
||||
* - SUCCESS
|
||||
*/
|
||||
status_t (*get_request) (transaction_t *this, message_t **request);
|
||||
|
||||
/**
|
||||
* @brief Build the response for a received request.
|
||||
*
|
||||
* A transaction creates a response only once for a unique request.
|
||||
* This allows the use of get_response multiple times for retransmission
|
||||
* purposes.
|
||||
* The transaction is not responsible for generating/encrypting the
|
||||
* response, nor is it responsible for decrypting/parsing the request.
|
||||
* This is the job of the caller. But the response MAY be already
|
||||
* generated when calling get_request() the second time.
|
||||
* The initiator waits for a response, so we send one in every case. This
|
||||
* means response points always to a valid message. This message
|
||||
* may not be modified or destroyed, it gets destroyed along with the
|
||||
* transaction.
|
||||
* The get_response() function may return a next transaction. This allows
|
||||
* passing of informations from one transaction to a next one.
|
||||
*
|
||||
* @param this calling object
|
||||
* @param request received request
|
||||
* @param[out] response resulting response
|
||||
* @param[out] next transaction expected as next, or NULL
|
||||
* @return
|
||||
* - FAILED if transaction failed
|
||||
* - DESTROY_ME if transaction failed and IKE SA
|
||||
* must be deleted
|
||||
* - SUCCESS
|
||||
*/
|
||||
status_t (*get_response) (transaction_t *this, message_t *request,
|
||||
message_t **response, transaction_t **next);
|
||||
|
||||
/**
|
||||
* @brief Conclude an initiated transaction with a received response.
|
||||
*
|
||||
* The response must be decrypted and parsed. The conclude function
|
||||
* may return a new transaction. This transaction has to be executed
|
||||
* next to complete a multi-exchange scenario. It allows a clean
|
||||
* transaction mechanism, as the transaction knows best whats to do
|
||||
* after it completes. It must only be executed if conclude returns
|
||||
* SUCCESS.
|
||||
*
|
||||
* @param this calling object
|
||||
* @param response received response
|
||||
* @param[out] next transaction to execute as next, or NULL
|
||||
* @return
|
||||
* - FAILED if transaction failed
|
||||
* - DESTROY_ME if transaction failed and IKE SA
|
||||
* must be deleted
|
||||
* - SUCCESS
|
||||
*/
|
||||
status_t (*conclude) (transaction_t *this, message_t *response,
|
||||
transaction_t **next);
|
||||
|
||||
/**
|
||||
* @brief Get the message ID associated with this transaction.
|
||||
*
|
||||
* Every transaction consists of a message pair with the same
|
||||
* message ID. This ID can be queried with get_message_id().
|
||||
*
|
||||
* @param this calling object
|
||||
* @return message id
|
||||
*/
|
||||
u_int32_t (*get_message_id) (transaction_t *this);
|
||||
|
||||
/**
|
||||
* @brief Times we already sent the request (retransmitted).
|
||||
*
|
||||
* The transaction stores an internal counter to see how
|
||||
* many times we sent the request. This counter is incremented
|
||||
* each time after a call to requested().
|
||||
*
|
||||
* @param this calling object
|
||||
* @return message id
|
||||
*/
|
||||
u_int32_t (*requested) (transaction_t *this);
|
||||
|
||||
/**
|
||||
* @brief Destroys a transaction_t object.
|
||||
*
|
||||
* @param this calling object
|
||||
*/
|
||||
void (*destroy) (transaction_t *this);
|
||||
};
|
||||
|
||||
/**
|
||||
* @brief Create a transaction instance based on a received request.
|
||||
*
|
||||
* Incoming requests are handled by a transaction. But as we don't
|
||||
* know what kind of transaction we use for a specific request, we use
|
||||
* a generic constructor. This constructor decides which instance will
|
||||
* handle the transaction, and creates it.
|
||||
*
|
||||
* @param ike_sa ike_sa associated with this transaction
|
||||
* @param request received request
|
||||
* @return
|
||||
* - created transaction, or
|
||||
* - NULL no transaction needed
|
||||
*
|
||||
* @ingroup transactions
|
||||
*/
|
||||
transaction_t *transaction_create(ike_sa_t *ike_sa, message_t* request);
|
||||
|
||||
#endif /* TRANSACTION_H_ */
|
||||
Reference in New Issue
Block a user