- encryptino payload

Source/charon/Makefile

@@ -21,9 +21,7 @@ LDFLAGS= -lgmp -lpthread
 CFLAGS+= -Wall \
 		 -DLEAK_DETECTIVE \
 		 -I. \
-		 -g
+		 -g #-Werror
-
-#		 -Werror
 
 # objects is extended by each included Makefile
 OBJS= 

Source/charon/daemon.h

@@ -27,7 +27,7 @@
 
 #define DAEMON_NAME "charon"
 
-#define NUMBER_OF_WORKING_THREADS 4
+#define NUMBER_OF_WORKING_THREADS 1
 
 #define IKEV2_UDP_PORT 500
 

Source/charon/encoding/generator.c

@@ -449,11 +449,12 @@ static status_t generate_u_int_type (private_generator_t *this,encoding_type_t i
 			this->logger->log_bytes(this->logger, RAW|MOST, "   =>", (void*)(this->data_struct + offset), sizeof(u_int64_t));
 			break;
 		}
-
 		default:
+		{
 			this->logger->log(this->logger, ERROR, "U_INT Type %s is not supported", mapping_find(encoding_type_m,int_type));
 			return FAILED;
 		}
+	}
 	return SUCCESS;
 }
 
@@ -1037,6 +1038,21 @@ static status_t generate_payload (private_generator_t *this,payload_t *payload)
 					this->logger->log(this->logger, CONTROL|MOST, "attribute value has not fixed size");
 					/* the attribute value is generated */
 					status = this->generate_from_chunk(this,rules[i].offset);
+					if (status != SUCCESS)
+					{
+						this->logger->log(this->logger, ERROR, "could not write attribute value from chunk");	
+						return status;
+					}
+				}
+				break;
+			}
+			case ENCRYPTED_DATA:
+			{
+				status = this->generate_from_chunk(this, rules[i].offset);
+				if (status != SUCCESS)
+				{
+					this->logger->log(this->logger, ERROR, "could not write encrypted data from chunk");	
+					return status;
 				}
 				break;
 			}

Source/charon/encoding/message.c

@@ -34,6 +34,7 @@
 #include <utils/logger_manager.h>
 #include <encoding/payloads/encodings.h>
 #include <encoding/payloads/payload.h>
+#include <encoding/payloads/encryption_payload.h>
 
 
 typedef struct supported_payload_entry_t supported_payload_entry_t;
@@ -455,7 +456,7 @@ static status_t get_payload_iterator(private_message_t *this, iterator_t **itera
  * Implements message_t's generate function.
  * See #message_s.generate.
  */
-static status_t generate(private_message_t *this, packet_t **packet)
+static status_t generate(private_message_t *this, crypter_t *crypter, signer_t* signer, packet_t **packet)
 {
 	generator_t *generator;
 	ike_header_t *ike_header;
@@ -480,14 +481,13 @@ static status_t generate(private_message_t *this, packet_t **packet)
 		return INVALID_STATE;
 	}
 	
-	
+	/* build ike header */
 	ike_header = ike_header_create();
 	if (ike_header == NULL)
 	{
 		return OUT_OF_RES;
 	}
 	
-	
 	ike_header->set_exchange_type(ike_header, this->exchange_type);
 	ike_header->set_message_id(ike_header, this->message_id);
 	ike_header->set_response_flag(ike_header, !this->is_request);
@@ -509,6 +509,7 @@ static status_t generate(private_message_t *this, packet_t **packet)
 		ike_header->destroy(ike_header);
 		return OUT_OF_RES;
 	}
+	/* generate every payload, except last one */
 	while(iterator->has_next(iterator))
 	{
 		iterator->current(iterator, (void**)&next_payload);
@@ -524,7 +525,21 @@ static status_t generate(private_message_t *this, packet_t **packet)
 	}
 	iterator->destroy(iterator);
 	
+	/* build last payload */
 	payload->set_next_type(payload, NO_PAYLOAD);
+	/* if it's an encryption payload, build it first */
+	if (payload->get_type(payload) == ENCRYPTED)
+	{
+		encryption_payload_t *encryption_payload = (encryption_payload_t*)payload;
+		encryption_payload->set_signer(encryption_payload, signer);
+		status = encryption_payload->encrypt(encryption_payload, crypter);
+		if (status != SUCCESS)
+		{
+			generator->destroy(generator);
+			ike_header->destroy(ike_header);
+			return status;
+		}
+	}
 	status = generator->generate_payload(generator, payload);
 	if (status != SUCCESS)
 	{
@@ -532,28 +547,34 @@ static status_t generate(private_message_t *this, packet_t **packet)
 		ike_header->destroy(ike_header);
 		return status;
 	}
-	
 	ike_header->destroy(ike_header);
 		
-	
+	/* build packet */
-	
 	if (this->packet->data.ptr != NULL)
 	{
 		allocator_free(this->packet->data.ptr);
 	}	
-	
 	status = generator->write_to_chunk(generator, &(this->packet->data));
+	generator->destroy(generator);
 	if (status != SUCCESS)
 	{
-		generator->destroy(generator);
 		return status;
 	}
 	
+	/* append integrity checksum if necessary */
+	if (payload->get_type(payload) == ENCRYPTED)
+	{
+		encryption_payload_t *encryption_payload = (encryption_payload_t*)payload;
+		status = encryption_payload->build_signature(encryption_payload, this->packet->data);
+		if (status != SUCCESS)
+		{
+			return status;
+		}
+	}
+	
+	/* colen packet for caller */
 	this->packet->clone(this->packet, packet);
 	
-	generator->destroy(generator);
-	
-	
 	this->logger->log(this->logger, CONTROL, "message generated successfully");
 	return SUCCESS;
 }
@@ -617,54 +638,27 @@ static status_t parse_header(private_message_t *this)
 }
 
 /**
- * Implements message_t's parse_body function.
+ * Implements message_t.parse_body.
- * See #message_s.parse_body.
  */
-static status_t parse_body (private_message_t *this)
+static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t *signer)
 {
 	status_t status = SUCCESS;
-	int i;
 	payload_type_t current_payload_type = this->first_payload;
-	supported_payload_entry_t *supported_payloads;
-	size_t supported_payloads_count;
-	
 		
 	this->logger->log(this->logger, CONTROL, "parsing body of message");
 	
-	if (this->get_supported_payloads (this, &supported_payloads, &supported_payloads_count) != SUCCESS)
-	{
-		this->logger->log(this->logger, ERROR, "could not get supported payloads");
-		return FAILED;
-	}
-		
 	while (current_payload_type != NO_PAYLOAD)
 	{
 		payload_t *current_payload;
-		bool supported = FALSE;
 		
 		this->logger->log(this->logger, CONTROL|MORE, "start parsing payload of type %s", 
 							mapping_find(payload_type_m, current_payload_type));
-		for (i = 0; i < supported_payloads_count;i++)
-		{
-			if (supported_payloads[i].payload_type == current_payload_type)
-			{
-				supported = TRUE;
-				break;
-			}
-		}
-		if (!supported && (current_payload_type != NO_PAYLOAD))
-		{
-			/* type not supported */
-			status = NOT_SUPPORTED;
-			this->logger->log(this->logger, ERROR, "payload type %s not supported",mapping_find(payload_type_m,current_payload_type));
-			break;
-		}
 		
 		status = this->parser->parse_payload(this->parser,current_payload_type,(payload_t **) &current_payload);
 		if (status != SUCCESS)
 		{
 			this->logger->log(this->logger, ERROR, "payload type %s could not be parsed",mapping_find(payload_type_m,current_payload_type));
-			break;
+			return status;
 		}
 		
 		status = current_payload->verify(current_payload);
@@ -672,7 +666,26 @@ static status_t parse_body (private_message_t *this)
 		{
 			this->logger->log(this->logger, ERROR, "payload type %s could not be verified",mapping_find(payload_type_m,current_payload_type));
 			status = VERIFY_ERROR;
-			break;
+			return status;
+		}
+		
+		/* encrypted payload must be decrypted */
+		if (current_payload->get_type(current_payload) == ENCRYPTED)
+		{
+			encryption_payload_t *encryption_payload = (encryption_payload_t*)current_payload;
+			encryption_payload->set_signer(encryption_payload, signer);
+			status = encryption_payload->verify_signature(encryption_payload, this->packet->data);
+			if (status != SUCCESS)
+			{
+				this->logger->log(this->logger, ERROR, "encryption payload signature invaild");
+				return status;
+			}
+			status = encryption_payload->decrypt(encryption_payload, crypter);
+			if (status != SUCCESS)
+			{
+				this->logger->log(this->logger, ERROR, "parsing decrypted encryption payload failed");
+				return status;
+			}
 		}
 
 		/* get next payload type */
@@ -681,18 +694,34 @@ static status_t parse_body (private_message_t *this)
 		status = this->payloads->insert_last(this->payloads,current_payload);
 		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR, "Could not insert current payload to internal list cause of ressource exhausting");
+			this->logger->log(this->logger, ERROR, "%s on adding payload", mapping_find(status_m, status));
-			break;			
+			return status;;
 		}
 		
 	}
-	if (status != SUCCESS)
+	return this->public.verify(&(this->public));
-	{
+	
-		/* already parsed payload is destroyed later in destroy call from outside this object */
 }
-	else
+
+/**
+ * implements message_t.verify
+ */
+static status_t verify(private_message_t *this)
 {
 	iterator_t *iterator;
+	status_t status;
+	int i;
+	supported_payload_entry_t *supported_payloads;
+	size_t supported_payloads_count;
+	
+	this->logger->log(this->logger, CONTROL|MORE, "verifying message");
+	
+	status = this->get_supported_payloads(this, &supported_payloads, &supported_payloads_count);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "could not get supported payloads: %s");
+		return status;
+	}
 		
 	status = this->payloads->create_iterator(this->payloads,&iterator,TRUE);
 	if (status != SUCCESS)
@@ -719,7 +748,7 @@ static status_t parse_body (private_message_t *this)
 			{
 				this->logger->log(this->logger, ERROR, "Could not get payload from internal list");
 				iterator->destroy(iterator);
-					return status;
+				return OUT_OF_RES;
 			}
 			if (current_payload->get_type(current_payload) == payload_type)
 			{
@@ -732,7 +761,6 @@ static status_t parse_body (private_message_t *this)
 					return NOT_SUPPORTED;					
 				}
 			}
-
 		}
 		if (found_payloads < min_occurence)
 		{
@@ -741,13 +769,11 @@ static status_t parse_body (private_message_t *this)
 			iterator->destroy(iterator);
 			return NOT_SUPPORTED;
 		}
-			
 	}
 	iterator->destroy(iterator);
-	}
-	return status;	
-}
 	
+	return SUCCESS;
+}
 
 
 /**
@@ -809,14 +835,15 @@ message_t *message_create_from_packet(packet_t *packet)
 	this->public.set_request = (status_t(*)(message_t*, bool))set_request;
 	this->public.get_request = (bool(*)(message_t*))get_request;
 	this->public.add_payload = (status_t(*)(message_t*,payload_t*))add_payload;
-	this->public.generate = (status_t (*) (message_t *, packet_t**)) generate;
+	this->public.generate = (status_t (*) (message_t *,crypter_t*,signer_t*,packet_t**)) generate;
 	this->public.set_source = (status_t (*) (message_t*,host_t*)) set_source;
 	this->public.get_source = (status_t (*) (message_t*,host_t**)) get_source;
 	this->public.set_destination = (status_t (*) (message_t*,host_t*)) set_destination;
 	this->public.get_destination = (status_t (*) (message_t*,host_t**)) get_destination;
 	this->public.get_payload_iterator = (status_t (*) (message_t *, iterator_t **)) get_payload_iterator;
 	this->public.parse_header = (status_t (*) (message_t *)) parse_header;
-	this->public.parse_body = 	(status_t (*) (message_t *)) parse_body;
+	this->public.parse_body = (status_t (*) (message_t *,crypter_t*,signer_t*)) parse_body;
+	this->public.verify =  (status_t (*) (message_t*)) verify;
 	this->public.destroy = (status_t(*)(message_t*))destroy;
 		
 	/* public values */

Source/charon/encoding/message.h

@@ -28,6 +28,8 @@
 #include <network/packet.h>
 #include <encoding/payloads/ike_header.h>
 #include <utils/linked_list.h>
+#include <transforms/crypters/crypter.h>
+#include <transforms/signers/signer.h>
 
 
 typedef struct message_t message_t;
@@ -218,7 +220,7 @@ struct message_t {
 	 *					- PARSE_ERROR if corrupted/invalid data found
 	 * 					- VERIFY_ERROR if verification of some payload failed
 	 */
-	status_t (*parse_body) (message_t *this);
+	status_t (*parse_body) (message_t *this, crypter_t *crypter, signer_t *signer);
 
 	/**
 	 * @brief Generates the UDP packet of specific message
@@ -229,7 +231,9 @@ struct message_t {
 	 * 					- EXCHANGE_TYPE_NOT_SET if exchange type is currently not set
 	 * ....
 	 */	
-	status_t (*generate) (message_t *this, packet_t **packet);
+	status_t (*generate) (message_t *this, crypter_t *crypter, signer_t *signer, packet_t **packet);
+	
+	status_t (*verify) (message_t *this);
 	status_t (*get_source) (message_t *this, host_t **host);
 	status_t (*set_source) (message_t *this, host_t *host);
 	status_t (*get_destination) (message_t *this, host_t **host);

Source/charon/encoding/parser.c

@@ -40,6 +40,7 @@
 #include <encoding/payloads/ke_payload.h>
 #include <encoding/payloads/nonce_payload.h>
 #include <encoding/payloads/notify_payload.h>
+#include <encoding/payloads/encryption_payload.h>
 
 
 
@@ -836,6 +837,16 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
 				}		
 				break;			
 			}
+			case ENCRYPTED_DATA:
+			{				
+				size_t data_length = payload_length - ENCRYPTION_PAYLOAD_HEADER_LENGTH ;
+				if (this->parse_chunk(this, rule_number, output + rule->offset, data_length) != SUCCESS) 
+				{
+					pld->destroy(pld);
+					return PARSE_ERROR;
+				}		
+				break;	
+			}
 			default:
 			{
 				this->logger->log(this->logger, ERROR, "  no rule to parse rule %d %s (%d)", rule_number, mapping_find(encoding_type_m, rule->type), rule->type);

Source/charon/encoding/payloads/Makefile.payloads

@@ -54,3 +54,7 @@ OBJS+= $(BUILD_DIR)transform_substructure.o
 $(BUILD_DIR)transform_substructure.o :	$(PAYLOADS_DIR)transform_substructure.c $(PAYLOADS_DIR)transform_substructure.h
 										$(CC) $(CFLAGS) -c -o $@ $<
 
+OBJS+= $(BUILD_DIR)encryption_payload.o
+$(BUILD_DIR)encryption_payload.o :		$(PAYLOADS_DIR)encryption_payload.c $(PAYLOADS_DIR)encryption_payload.h
+										$(CC) $(CFLAGS) -c -o $@ $<
+								

Source/charon/encoding/payloads/encodings.h

@@ -286,7 +286,7 @@ enum encoding_type_t{
 	 */
 	ATTRIBUTE_LENGTH_OR_VALUE,
 
-	/*	
+	/**
 	 * Depending on the field of type ATTRIBUTE_FORMAT
 	 * this field is available or missing and so parsed/generated 
 	 * or not parsed/not generated
@@ -316,7 +316,10 @@ enum encoding_type_t{
 	 * 
 	 * When parsing 8 bytes are read and written into the u_int64_t pointing to.
 	 */
-	IKE_SPI
+	IKE_SPI,
+	
+	ENCRYPTED_DATA,
+	
 };
 
 /**

Source/charon/sa/ike_sa.c

@@ -529,7 +529,7 @@ status_t resend_last_reply (private_ike_sa_t *this)
 	packet_t *packet;
 	status_t status;
 	
-	status = this->last_responded_message->generate(this->last_responded_message, &packet);
+	status = this->last_responded_message->generate(this->last_responded_message, NULL, NULL, &packet);
 	if (status != SUCCESS)
 	{
 		this->logger->log(this->logger, ERROR, "Could not generate message to resent");

Source/charon/sa/states/ike_sa_init_requested.c

@@ -108,7 +108,7 @@ static status_t process_message(private_ike_sa_init_requested_t *this, message_t
 	}
 	
 	/* parse incoming message */
-	status = message->parse_body(message);
+	status = message->parse_body(message, NULL, NULL);
 	if (status != SUCCESS)
 	{
 		this->logger->log(this->logger, ERROR | MORE, "Could not parse body");

Source/charon/sa/states/initiator_init.c

@@ -239,7 +239,7 @@ static status_t initiate_connection (private_initiator_init_t *this, char *name)
 	
 	/* generate packet */	
 	this->logger->log(this->logger, CONTROL|MOST, "generate packet from message");
-	status = message->generate(message, &packet);
+	status = message->generate(message, NULL, NULL, &packet);
 	if (status != SUCCESS)
 	{
 		this->logger->log(this->logger, ERROR, "Fatal error: could not generate packet from message");

Source/charon/sa/states/responder_init.c

@@ -194,7 +194,7 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
 	this->ike_sa->set_other_host(this->ike_sa, other_host);
 	
 	/* parse incoming message */
-	status = message->parse_body(message);
+	status = message->parse_body(message, NULL, NULL);
 	if (status != SUCCESS)
 	{
 		this->logger->log(this->logger, ERROR | MORE, "Could not parse body of request message");
@@ -453,7 +453,7 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
 	
 	/* generate packet */	
 	this->logger->log(this->logger, CONTROL|MOST, "generate packet from message");
-	status = response->generate(response, &packet);
+	status = response->generate(response, NULL, NULL, &packet);
 	if (status != SUCCESS)
 	{
 		this->logger->log(this->logger, ERROR, "Fatal error: could not generate packet from message");

Source/charon/utils/logger_manager.c

@@ -151,11 +151,11 @@ static logger_t *create_logger(private_logger_manager_t *this, logger_context_t
 			logger_level |= FULL;
 		case IKE_SA_MANAGER:
 		case MESSAGE:
+		case WORKER:
 			logger_level |= ALL;
 		case PARSER:
 		case GENERATOR:
 		case THREAD_POOL:
-		case WORKER:
 		case SCHEDULER:
 		case SENDER:
 		case RECEIVER: