denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reverted ike_cert tasks to IKEv2 only, we use dedicated IKEv1 tasks

Browse Source
This commit is contained in:
Martin Willi
2012-03-20 17:31:13 +01:00
parent 9f80110bc6
commit 6ccabe2561
2 changed files with 41 additions and 497 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/tasks/ike_cert_post.c
Executable → Regular
+11 -161
View File
@@ -21,7 +21,6 @@
#include <encoding/payloads/cert_payload.h> #include <encoding/payloads/cert_payload.h>
#include <encoding/payloads/certreq_payload.h> #include <encoding/payloads/certreq_payload.h>
#include <encoding/payloads/auth_payload.h> #include <encoding/payloads/auth_payload.h>
#include <encoding/payloads/sa_payload.h>
#include <credentials/certificates/x509.h> #include <credentials/certificates/x509.h>
@@ -46,20 +45,6 @@ struct private_ike_cert_post_t {
* Are we the initiator? * Are we the initiator?
*/ */
bool initiator; bool initiator;
/**
* Certificate payload type that we are handling
*/
payload_type_t payload_type;
/**
* States of ike cert pre
*/
enum {
CP_INIT,
CP_SA,
CP_SA_POST,
} state;
}; };
/** /**
@@ -77,14 +62,14 @@ static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this,
if (!this->ike_sa->supports_extension(this->ike_sa, EXT_HASH_AND_URL)) if (!this->ike_sa->supports_extension(this->ike_sa, EXT_HASH_AND_URL))
{ {
return cert_payload_create_from_cert(cert, this->payload_type); return cert_payload_create_from_cert(cert, CERTIFICATE);
} }
hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1); hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (!hasher) if (!hasher)
{ {
DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported"); DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported");
return cert_payload_create_from_cert(cert, this->payload_type); return cert_payload_create_from_cert(cert, CERTIFICATE);
} }
if (!cert->get_encoding(cert, CERT_ASN1_DER, &encoded)) if (!cert->get_encoding(cert, CERT_ASN1_DER, &encoded))
@@ -101,12 +86,12 @@ static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this,
enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr, CERT_X509, id); enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr, CERT_X509, id);
if (enumerator->enumerate(enumerator, &url)) if (enumerator->enumerate(enumerator, &url))
{ {
payload = cert_payload_create_from_hash_and_url(hash, url, this->payload_type); payload = cert_payload_create_from_hash_and_url(hash, url, CERTIFICATE);
DBG1(DBG_IKE, "sending hash-and-url \"%s\"", url); DBG1(DBG_IKE, "sending hash-and-url \"%s\"", url);
} }
else else
{ {
payload = cert_payload_create_from_cert(cert, this->payload_type); payload = cert_payload_create_from_cert(cert, CERTIFICATE);
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
chunk_free(&hash); chunk_free(&hash);
@@ -114,74 +99,21 @@ static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this,
return payload; return payload;
} }
/**
* Checks for the auth_method to see if this task should handle certificates.
* (IKEv1 only)
*/
static status_t check_auth_method(private_ike_cert_post_t *this,
message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
status_t status = SUCCESS;
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == SECURITY_ASSOCIATION_V1)
{
sa_payload_t *sa_payload = (sa_payload_t*)payload;
switch (sa_payload->get_auth_method(sa_payload))
{
case AUTH_RSA:
case AUTH_XAUTH_INIT_RSA:
case AUTH_XAUTH_RESP_RSA:
DBG3(DBG_IKE, "handling certs method (%d)",
sa_payload->get_auth_method(sa_payload));
status = NEED_MORE;
break;
default:
DBG3(DBG_IKE, "not handling certs method (%d)",
sa_payload->get_auth_method(sa_payload));
status = SUCCESS;
break;
}
this->state = CP_SA;
break;
}
}
enumerator->destroy(enumerator);
return status;
}
/** /**
* add certificates to message * add certificates to message
*/ */
static void build_certs(private_ike_cert_post_t *this, message_t *message) static void build_certs(private_ike_cert_post_t *this, message_t *message)
{ {
peer_cfg_t *peer_cfg; peer_cfg_t *peer_cfg;
auth_payload_t *payload;
payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa); peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (!peer_cfg || !payload || payload->get_auth_method(payload) == AUTH_PSK)
if (!peer_cfg) { /* no CERT payload for EAP/PSK */
{
return; return;
} }
if (this->payload_type == CERTIFICATE)
{
auth_payload_t *payload;
payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
if (!payload || payload->get_auth_method(payload) == AUTH_PSK)
{ /* no CERT payload for EAP/PSK */
return;
}
}
switch (peer_cfg->get_cert_policy(peer_cfg)) switch (peer_cfg->get_cert_policy(peer_cfg))
{ {
case CERT_NEVER_SEND: case CERT_NEVER_SEND:
@@ -222,7 +154,7 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
{ {
if (type == AUTH_RULE_IM_CERT) if (type == AUTH_RULE_IM_CERT)
{ {
payload = cert_payload_create_from_cert(cert, this->payload_type); payload = cert_payload_create_from_cert(cert, CERTIFICATE);
if (payload) if (payload)
{ {
DBG1(DBG_IKE, "sending issuer cert \"%Y\"", DBG1(DBG_IKE, "sending issuer cert \"%Y\"",
@@ -234,8 +166,6 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
} }
} }
return;
} }
METHOD(task_t, build_i, status_t, METHOD(task_t, build_i, status_t,
@@ -246,14 +176,6 @@ METHOD(task_t, build_i, status_t,
return NEED_MORE; return NEED_MORE;
} }
METHOD(task_t, build_i_v1, status_t,
private_ike_cert_post_t *this, message_t *message)
{
/* TODO:*/
return FAILED;
}
METHOD(task_t, process_r, status_t, METHOD(task_t, process_r, status_t,
private_ike_cert_post_t *this, message_t *message) private_ike_cert_post_t *this, message_t *message)
{ {
@@ -272,52 +194,6 @@ METHOD(task_t, build_r, status_t,
return SUCCESS; return SUCCESS;
} }
METHOD(task_t, build_r_v1, status_t,
private_ike_cert_post_t *this, message_t *message)
{
switch (message->get_exchange_type(message))
{
case ID_PROT:
{
switch (this->state)
{
case CP_INIT:
this->state = CP_SA;
return check_auth_method(this, message);
break;
case CP_SA:
this->state = CP_SA_POST;
build_certs(this, message);
break;
case CP_SA_POST:
build_certs(this, message);
return SUCCESS;
}
break;
}
case AGGRESSIVE:
{
if (check_auth_method(this, message) == NEED_MORE)
{
build_certs(this, message);
}
return SUCCESS;
break;
}
default:
break;
}
if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
{
return NEED_MORE;
}
return SUCCESS;
}
METHOD(task_t, process_i, status_t, METHOD(task_t, process_i, status_t,
private_ike_cert_post_t *this, message_t *message) private_ike_cert_post_t *this, message_t *message)
{ {
@@ -365,43 +241,17 @@ ike_cert_post_t *ike_cert_post_create(ike_sa_t *ike_sa, bool initiator)
.initiator = initiator, .initiator = initiator,
); );
if (initiator) if (initiator)
{ {
this->public.task.build = _build_i;
this->public.task.process = _process_i; this->public.task.process = _process_i;
} }
else else
{ {
this->public.task.build = _build_r;
this->public.task.process = _process_r; this->public.task.process = _process_r;
} }
if (ike_sa->get_version(ike_sa) == IKEV2)
{
this->payload_type = CERTIFICATE;
if (initiator)
{
this->public.task.build = _build_i;
}
else
{
this->public.task.build = _build_r;
}
}
else
{
this->payload_type = CERTIFICATE_V1;
if (initiator)
{
this->public.task.build = _build_i_v1;
}
else
{
this->public.task.build = _build_r_v1;
}
}
return &this->public; return &this->public;
} }
src/libcharon/sa/tasks/ike_cert_pre.c
Executable → Regular
+30 -336
View File
@@ -19,7 +19,6 @@
#include <daemon.h> #include <daemon.h>
#include <sa/ike_sa.h> #include <sa/ike_sa.h>
#include <encoding/payloads/cert_payload.h> #include <encoding/payloads/cert_payload.h>
#include <encoding/payloads/sa_payload.h>
#include <encoding/payloads/certreq_payload.h> #include <encoding/payloads/certreq_payload.h>
#include <credentials/certificates/x509.h> #include <credentials/certificates/x509.h>
@@ -55,53 +54,8 @@ struct private_ike_cert_pre_t {
* wheter this is the final authentication round * wheter this is the final authentication round
*/ */
bool final; bool final;
/** states of ike cert pre */
enum {
CP_INIT,
CP_SA,
CP_SA_POST,
CP_REQ_SENT,
CP_NO_CERT,
} state;
/**
* type of certicate request to send
*/
payload_type_t cert_req_payload_type;
}; };
/**
* add certificate to auth
*/
static bool add_certificate(auth_cfg_t *auth, id_type_t type, chunk_t data)
{
identification_t *id;
certificate_t *cert;
bool status = TRUE;
if (!data.len)
{
return FALSE;
}
id = identification_create_from_encoding(type, data);
cert = lib->credmgr->get_cert(lib->credmgr, CERT_X509, KEY_ANY, id, TRUE);
if (cert)
{
DBG1(DBG_IKE, "received cert request for \"%Y\"",
cert->get_subject(cert));
auth->add(auth, AUTH_RULE_CA_CERT, cert);
}
else
{
DBG2(DBG_IKE, "received cert request for unknown ca %Y", id);
status = FALSE;
}
id->destroy(id);
return status;
}
/** /**
* read certificate requests * read certificate requests
*/ */
@@ -119,12 +73,11 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
switch (payload->get_type(payload)) switch (payload->get_type(payload))
{ {
case CERTIFICATE_REQUEST: case CERTIFICATE_REQUEST:
case CERTIFICATE_REQUEST_V1:
{ {
certreq_payload_t *certreq = (certreq_payload_t*)payload; certreq_payload_t *certreq = (certreq_payload_t*)payload;
enumerator_t *enumerator; enumerator_t *enumerator;
u_int unknown = 0; u_int unknown = 0;
chunk_t chunk; chunk_t keyid;
this->ike_sa->set_condition(this->ike_sa, COND_CERTREQ_SEEN, TRUE); this->ike_sa->set_condition(this->ike_sa, COND_CERTREQ_SEEN, TRUE);
@@ -134,27 +87,30 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
certificate_type_names, certreq->get_cert_type(certreq)); certificate_type_names, certreq->get_cert_type(certreq));
break; break;
} }
enumerator = certreq->create_keyid_enumerator(certreq);
while (enumerator->enumerate(enumerator, &keyid))
{
identification_t *id;
certificate_t *cert;
if (payload->get_type(payload) == CERTIFICATE_REQUEST) id = identification_create_from_encoding(ID_KEY_ID, keyid);
{ cert = lib->credmgr->get_cert(lib->credmgr,
enumerator = certreq->create_keyid_enumerator(certreq); CERT_X509, KEY_ANY, id, TRUE);
while (enumerator->enumerate(enumerator, &chunk)) if (cert)
{ {
if (!add_certificate(auth, ID_KEY_ID, chunk)) DBG1(DBG_IKE, "received cert request for \"%Y\"",
{ cert->get_subject(cert));
unknown++; auth->add(auth, AUTH_RULE_CA_CERT, cert);
}
} }
enumerator->destroy(enumerator); else
}
else
{
chunk = certreq->get_dn(certreq);
if (!add_certificate(auth, ID_DER_ASN1_DN, chunk))
{ {
DBG2(DBG_IKE, "received cert request for unknown ca "
"with keyid %Y", id);
unknown++; unknown++;
} }
id->destroy(id);
} }
enumerator->destroy(enumerator);
if (unknown) if (unknown)
{ {
DBG1(DBG_IKE, "received %u cert requests for an unknown ca", DBG1(DBG_IKE, "received %u cert requests for an unknown ca",
@@ -235,8 +191,7 @@ static void process_certs(private_ike_cert_pre_t *this, message_t *message)
enumerator = message->create_payload_enumerator(message); enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload)) while (enumerator->enumerate(enumerator, &payload))
{ {
if (payload->get_type(payload) == CERTIFICATE || if (payload->get_type(payload) == CERTIFICATE)
payload->get_type(payload) == CERTIFICATE_V1)
{ {
cert_payload_t *cert_payload; cert_payload_t *cert_payload;
cert_encoding_t encoding; cert_encoding_t encoding;
@@ -336,8 +291,7 @@ static void process_certs(private_ike_cert_pre_t *this, message_t *message)
/** /**
* add the keyid of a certificate to the certificate request payload * add the keyid of a certificate to the certificate request payload
*/ */
static void add_certreq(private_ike_cert_pre_t *this, static void add_certreq(certreq_payload_t **req, certificate_t *cert)
certreq_payload_t **req, certificate_t *cert)
{ {
switch (cert->get_type(cert)) switch (cert->get_type(cert))
{ {
@@ -358,7 +312,7 @@ static void add_certreq(private_ike_cert_pre_t *this,
} }
if (*req == NULL) if (*req == NULL)
{ {
*req = certreq_payload_create_type(CERTIFICATE_REQUEST, CERT_X509); *req = certreq_payload_create_type(CERT_X509);
} }
if (public->get_fingerprint(public, KEYID_PUBKEY_INFO_SHA1, &keyid)) if (public->get_fingerprint(public, KEYID_PUBKEY_INFO_SHA1, &keyid))
{ {
@@ -374,42 +328,10 @@ static void add_certreq(private_ike_cert_pre_t *this,
} }
} }
/**
* Add the subject of a CA certificate a message
*/
static void add_certreq_v1(private_ike_cert_pre_t *this,
message_t *message, certificate_t *cert)
{
switch (cert->get_type(cert))
{
case CERT_X509:
{
x509_t *x509 = (x509_t*)cert;
identification_t *id;
certreq_payload_t *req;
if (!(x509->get_flags(x509) & X509_CA))
{ /* no CA cert, skip */
break;
}
req = certreq_payload_create_type(CERTIFICATE_REQUEST_V1, CERT_X509);
id = cert->get_subject(cert);
req->set_dn(req, id->get_encoding(id));
DBG1(DBG_IKE, "sending cert request for \"%Y\"",
cert->get_subject(cert));
message->add_payload(message, &req->payload_interface);
break;
}
default:
break;
}
}
/** /**
* add a auth_cfg's CA certificates to the certificate request * add a auth_cfg's CA certificates to the certificate request
*/ */
static void add_certreqs(private_ike_cert_pre_t *this, static void add_certreqs(certreq_payload_t **req, auth_cfg_t *auth)
certreq_payload_t **req, auth_cfg_t *auth)
{ {
enumerator_t *enumerator; enumerator_t *enumerator;
auth_rule_t type; auth_rule_t type;
@@ -421,32 +343,7 @@ static void add_certreqs(private_ike_cert_pre_t *this,
switch (type) switch (type)
{ {
case AUTH_RULE_CA_CERT: case AUTH_RULE_CA_CERT:
add_certreq(this, req, (certificate_t*)value); add_certreq(req, (certificate_t*)value);
break;
default:
break;
}
}
enumerator->destroy(enumerator);
}
/**
* add a auth_cfg's CA certificates to the certificate request
*/
static void add_certreqs_v1(private_ike_cert_pre_t *this,
auth_cfg_t *auth, message_t *message)
{
enumerator_t *enumerator;
auth_rule_t type;
void *value;
enumerator = auth->create_enumerator(auth);
while (enumerator->enumerate(enumerator, &type, &value))
{
switch (type)
{
case AUTH_RULE_CA_CERT:
add_certreq_v1(this, message, (certificate_t*)value);
break; break;
default: default:
break; break;
@@ -480,7 +377,7 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, FALSE); enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, FALSE);
while (enumerator->enumerate(enumerator, &auth)) while (enumerator->enumerate(enumerator, &auth))
{ {
add_certreqs(this, &req, auth); add_certreqs(&req, auth);
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
} }
@@ -492,7 +389,7 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
CERT_ANY, KEY_ANY, NULL, TRUE); CERT_ANY, KEY_ANY, NULL, TRUE);
while (enumerator->enumerate(enumerator, &cert)) while (enumerator->enumerate(enumerator, &cert))
{ {
add_certreq(this, &req, cert); add_certreq(&req, cert);
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
} }
@@ -510,49 +407,6 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
} }
} }
/**
* build certificate requests
*/
static void build_certreqs_v1(private_ike_cert_pre_t *this, message_t *message)
{
enumerator_t *enumerator;
ike_cfg_t *ike_cfg;
peer_cfg_t *peer_cfg;
certificate_t *cert;
auth_cfg_t *auth;
ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
if (!ike_cfg->send_certreq(ike_cfg))
{
return;
}
/* check if we require a specific CA for that peer */
/* Get the first authentcation config from peer config */
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (peer_cfg)
{
enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, FALSE);
if (enumerator->enumerate(enumerator, &auth))
{
add_certreqs_v1(this, auth, message);
}
enumerator->destroy(enumerator);
}
if (!message->get_payload(message, CERTIFICATE_REQUEST_V1))
{
/* otherwise add all trusted CA certificates */
enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
CERT_ANY, KEY_ANY, NULL, TRUE);
while (enumerator->enumerate(enumerator, &cert))
{
add_certreq_v1(this, message, cert);
}
enumerator->destroy(enumerator);
}
}
/** /**
* Check if this is the final authentication round * Check if this is the final authentication round
*/ */
@@ -570,55 +424,6 @@ static bool final_auth(message_t *message)
return TRUE; return TRUE;
} }
/**
* Checks for the auth_method to see if this task should handle certificates.
* (IKEv1 only)
*/
static status_t check_auth_method(private_ike_cert_pre_t *this,
message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
status_t status = SUCCESS;
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == SECURITY_ASSOCIATION_V1)
{
sa_payload_t *sa_payload = (sa_payload_t*)payload;
switch (sa_payload->get_auth_method(sa_payload))
{
case AUTH_RSA:
case AUTH_XAUTH_INIT_RSA:
case AUTH_XAUTH_RESP_RSA:
DBG3(DBG_IKE, "handling certs method (%d)",
sa_payload->get_auth_method(sa_payload));
status = NEED_MORE;
break;
default:
DBG3(DBG_IKE, "not handling certs method (%d)",
sa_payload->get_auth_method(sa_payload));
status = SUCCESS;
break;
}
this->state = CP_SA;
break;
}
}
enumerator->destroy(enumerator);
if (status != NEED_MORE)
{
this->state = CP_NO_CERT;
this->final = TRUE;
}
return status;
}
METHOD(task_t, build_i, status_t, METHOD(task_t, build_i, status_t,
private_ike_cert_pre_t *this, message_t *message) private_ike_cert_pre_t *this, message_t *message)
{ {
@@ -671,97 +476,6 @@ METHOD(task_t, process_i, status_t,
return NEED_MORE; return NEED_MORE;
} }
METHOD(task_t, process_r_v1, status_t,
private_ike_cert_pre_t *this, message_t *message)
{
switch (message->get_exchange_type(message))
{
case ID_PROT:
{
switch (this->state)
{
case CP_INIT:
check_auth_method(this, message);
break;
case CP_SA:
process_certreqs(this, message);
this->state = CP_SA_POST;
break;
case CP_SA_POST:
process_certreqs(this, message);
process_certs(this, message);
this->state = CP_REQ_SENT;
this->final = TRUE;
break;
default:
break;
}
break;
}
case AGGRESSIVE:
{
if (check_auth_method(this, message) == NEED_MORE)
{
process_certreqs(this, message);
process_certs(this, message);
}
this->final = TRUE;
break;
}
default:
break;
}
return NEED_MORE;
}
METHOD(task_t, process_i_v1, status_t,
private_ike_cert_pre_t *this, message_t *message)
{
/* TODO: */
return FAILED;
}
METHOD(task_t, build_r_v1, status_t,
private_ike_cert_pre_t *this, message_t *message)
{
switch (message->get_exchange_type(message))
{
case ID_PROT:
{
if (this->state == CP_SA_POST)
{
build_certreqs_v1(this, message);
}
break;
}
case AGGRESSIVE:
{
if (this->state != CP_NO_CERT)
{
build_certreqs_v1(this, message);
}
}
default:
break;
}
if (this->final)
{
return SUCCESS;
}
return NEED_MORE;
}
METHOD(task_t, build_i_v1, status_t,
private_ike_cert_pre_t *this, message_t *message)
{
/* TODO: */
return FAILED;
}
METHOD(task_t, get_type, task_type_t, METHOD(task_t, get_type, task_type_t,
private_ike_cert_pre_t *this) private_ike_cert_pre_t *this)
{ {
@@ -799,35 +513,15 @@ ike_cert_pre_t *ike_cert_pre_create(ike_sa_t *ike_sa, bool initiator)
.initiator = initiator, .initiator = initiator,
); );
if (ike_sa->get_version(ike_sa) == IKEV2) if (initiator)
{ {
if (initiator) this->public.task.build = _build_i;
{ this->public.task.process = _process_i;
this->public.task.build = _build_i;
this->public.task.process = _process_i;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
}
this->cert_req_payload_type = CERTIFICATE_REQUEST;
} }
else else
{ {
this->state = CP_INIT; this->public.task.build = _build_r;
if (initiator) this->public.task.process = _process_r;
{
this->public.task.build = _build_i_v1;
this->public.task.process = _process_i_v1;
}
else
{
this->public.task.build = _build_r_v1;
this->public.task.process = _process_r_v1;
}
this->cert_req_payload_type = CERTIFICATE_REQUEST_V1;
} }
return &this->public; return &this->public;