denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

further work for rekeying:

Browse Source 
get liftimes from policy
  added new state
  initiation of rekeying done
proposal redone:
  removed support for AH+ESP proposals
This commit is contained in:
Martin Willi
2006-06-07 13:26:23 +00:00
parent a401efd091
commit 8d77eddec2
36 changed files with 1403 additions and 1409 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/child_sa.c
+196 -253
View File
@@ -36,25 +36,12 @@ typedef struct sa_policy_t sa_policy_t;
*/
struct sa_policy_t {
/**
* Network on local side
*/
host_t *my_net;
/**
* Network on remote side
*/
host_t *other_net;
/**
* Number of bits for local network (subnet size)
*/
u_int8_t my_net_mask;
/**
* Number of bits for remote network (subnet size)
*/
u_int8_t other_net_mask;
struct {
/** subnet address behind peer peer */
host_t *net;
/** netmask used for net */
u_int8_t net_mask;
} me, other;
/**
* Protocol for this policy, such as TCP/UDP/ICMP...
@@ -73,38 +60,20 @@ struct private_child_sa_t {
*/
child_sa_t public;
/**
* IP of this peer
*/
host_t *me;
struct {
/** address of peer */
host_t *addr;
/** actual used SPI, 0 if unused */
u_int32_t spi;
} me, other;
/**
* IP of other peer
* Protocol used to protect this SA, ESP|AH
*/
host_t *other;
protocol_id_t protocol;
/**
* Local security parameter index for AH protocol, 0 if not used
*/
u_int32_t my_ah_spi;
/**
* Local security parameter index for ESP protocol, 0 if not used
*/
u_int32_t my_esp_spi;
/**
* Remote security parameter index for AH protocol, 0 if not used
*/
u_int32_t other_ah_spi;
/**
* Remote security parameter index for ESP protocol, 0 if not used
*/
u_int32_t other_esp_spi;
/**
* List containing policy_id_t objects
* List containing sa_policy_t objects
*/
linked_list_t *policies;
@@ -113,6 +82,16 @@ struct private_child_sa_t {
*/
u_int32_t reqid;
/**
* Lifetime before rekeying
*/
u_int32_t soft_lifetime;
/**
* Lifetime before delete
*/
u_int32_t hard_lifetime;
/**
* CHILD_SAs own logger
*/
@@ -126,13 +105,33 @@ static u_int32_t get_reqid(private_child_sa_t *this)
{
return this->reqid;
}
/**
* Implements child_sa_t.get_spi
*/
u_int32_t get_spi(private_child_sa_t *this, bool inbound)
{
if (inbound)
{
return this->me.spi;
}
return this->other.spi;
}
/**
* Implements child_sa_t.get_protocol
*/
protocol_id_t get_protocol(private_child_sa_t *this)
{
return this->protocol;
}
/**
* Implements child_sa_t.alloc
*/
static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
{
protocol_id_t protocols[2];
protocol_id_t protocol;
iterator_t *iterator;
proposal_t *proposal;
status_t status;
@@ -143,50 +142,21 @@ static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
while(iterator->has_next(iterator))
{
iterator->current(iterator, (void**)&proposal);
proposal->get_protocols(proposal, protocols);
/* check all protocols */
for (i = 0; i<2; i++)
protocol = proposal->get_protocol(proposal);
status = charon->kernel_interface->get_spi(
charon->kernel_interface,
this->me.addr, this->other.addr,
protocol, FALSE,
&(this->me.spi));
if (status != SUCCESS)
{
switch (protocols[i])
{
case PROTO_AH:
/* do we already have an spi for AH?*/
if (this->my_ah_spi == 0)
{
/* nope, get one */
status = charon->kernel_interface->get_spi(
charon->kernel_interface,
this->me, this->other,
PROTO_AH, FALSE,
&(this->my_ah_spi));
}
/* update proposal */
proposal->set_spi(proposal, PROTO_AH, (u_int64_t)this->my_ah_spi);
break;
case PROTO_ESP:
/* do we already have an spi for ESP?*/
if (this->my_esp_spi == 0)
{
/* nope, get one */
status = charon->kernel_interface->get_spi(
charon->kernel_interface,
this->me, this->other,
PROTO_ESP, FALSE,
&(this->my_esp_spi));
}
/* update proposal */
proposal->set_spi(proposal, PROTO_ESP, (u_int64_t)this->my_esp_spi);
break;
default:
break;
}
if (status != SUCCESS)
{
iterator->destroy(iterator);
return FAILED;
}
iterator->destroy(iterator);
return FAILED;
}
/* update proposal */
proposal->set_spi(proposal, (u_int64_t)this->me.spi);
}
iterator->destroy(iterator);
return SUCCESS;
@@ -194,7 +164,6 @@ static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus, bool mine)
{
protocol_id_t protocols[2];
u_int32_t spi;
encryption_algorithm_t enc_algo;
integrity_algorithm_t int_algo;
@@ -206,128 +175,103 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus
host_t *src;
host_t *dst;
status_t status;
u_int i;
/* we must assign the roles to correctly set up the SAs */
if (mine)
{
src = this->me;
dst = this->other;
src = this->me.addr;
dst = this->other.addr;
}
else
{
dst = this->me;
src = this->other;
dst = this->me.addr;
src = this->other.addr;
}
proposal->get_protocols(proposal, protocols);
/* derive keys in order as protocols appear */
for (i = 0; i<2; i++)
this->protocol = proposal->get_protocol(proposal);
/* now we have to decide which spi to use. Use self allocated, if "mine",
* or the one in the proposal, if not "mine" (others). */
if (mine)
{
if (protocols[i] != PROTO_NONE)
{
/* now we have to decide which spi to use. Use self allocated, if "mine",
* or the one in the proposal, if not "mine" (others). */
if (mine)
{
if (protocols[i] == PROTO_AH)
{
spi = this->my_ah_spi;
}
else
{
spi = this->my_esp_spi;
}
}
else /* use proposals spi */
{
spi = proposal->get_spi(proposal, protocols[i]);
if (protocols[i] == PROTO_AH)
{
this->other_ah_spi = spi;
}
else
{
this->other_esp_spi = spi;
}
}
/* derive encryption key first */
if (proposal->get_algorithm(proposal, protocols[i], ENCRYPTION_ALGORITHM, &algo))
{
enc_algo = algo->algorithm;
this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s, ",
mapping_find(protocol_id_m, protocols[i]),
mine ? "me" : "other",
mapping_find(transform_type_m, ENCRYPTION_ALGORITHM),
mapping_find(encryption_algorithm_m, enc_algo));
/* we must create a (unused) crypter, since its the only way to get the size
* of the key. This is not so nice, since charon must support all algorithms
* the kernel supports...
* TODO: build something of a encryption algorithm lookup function
*/
crypter = crypter_create(enc_algo, algo->key_size);
key_size = crypter->get_key_size(crypter);
crypter->destroy(crypter);
prf_plus->allocate_bytes(prf_plus, key_size, &enc_key);
this->logger->log_chunk(this->logger, PRIVATE, "key:", enc_key);
}
else
{
enc_algo = ENCR_UNDEFINED;
}
/* derive integrity key */
if (proposal->get_algorithm(proposal, protocols[i], INTEGRITY_ALGORITHM, &algo))
{
int_algo = algo->algorithm;
this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s,",
mapping_find(protocol_id_m, protocols[i]),
mine ? "me" : "other",
mapping_find(transform_type_m, INTEGRITY_ALGORITHM),
mapping_find(integrity_algorithm_m, algo->algorithm));
signer = signer_create(int_algo);
key_size = signer->get_key_size(signer);
signer->destroy(signer);
prf_plus->allocate_bytes(prf_plus, key_size, &int_key);
this->logger->log_chunk(this->logger, PRIVATE, "key:", int_key);
}
else
{
int_algo = AUTH_UNDEFINED;
}
/* send keys down to kernel */
this->logger->log(this->logger, CONTROL|LEVEL1,
"installing 0x%.8x for %s, src %s dst %s",
ntohl(spi), mapping_find(protocol_id_m, protocols[i]),
src->get_address(src), dst->get_address(dst));
status = charon->kernel_interface->add_sa(charon->kernel_interface,
src, dst,
spi, protocols[i],
this->reqid,
5, 30,
enc_algo, enc_key,
int_algo, int_key, mine);
/* clean up for next round */
if (enc_algo != ENCR_UNDEFINED)
{
chunk_free(&enc_key);
}
if (int_algo != AUTH_UNDEFINED)
{
chunk_free(&int_key);
}
if (status != SUCCESS)
{
return FAILED;
}
}
spi = this->me.spi;
}
return SUCCESS;
else
{
spi = proposal->get_spi(proposal);
this->other.spi = spi;
}
/* derive encryption key first */
if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &algo))
{
enc_algo = algo->algorithm;
this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s, ",
mapping_find(protocol_id_m, this->protocol),
mine ? "me" : "other",
mapping_find(transform_type_m, ENCRYPTION_ALGORITHM),
mapping_find(encryption_algorithm_m, enc_algo));
/* we must create a (unused) crypter, since its the only way to get the size
* of the key. This is not so nice, since charon must support all algorithms
* the kernel supports...
* TODO: build something of a encryption algorithm lookup function
*/
crypter = crypter_create(enc_algo, algo->key_size);
key_size = crypter->get_key_size(crypter);
crypter->destroy(crypter);
prf_plus->allocate_bytes(prf_plus, key_size, &enc_key);
this->logger->log_chunk(this->logger, PRIVATE, "key:", enc_key);
}
else
{
enc_algo = ENCR_UNDEFINED;
}
/* derive integrity key */
if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &algo))
{
int_algo = algo->algorithm;
this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s,",
mapping_find(protocol_id_m, this->protocol),
mine ? "me" : "other",
mapping_find(transform_type_m, INTEGRITY_ALGORITHM),
mapping_find(integrity_algorithm_m, algo->algorithm));
signer = signer_create(int_algo);
key_size = signer->get_key_size(signer);
signer->destroy(signer);
prf_plus->allocate_bytes(prf_plus, key_size, &int_key);
this->logger->log_chunk(this->logger, PRIVATE, "key:", int_key);
}
else
{
int_algo = AUTH_UNDEFINED;
}
/* send keys down to kernel */
this->logger->log(this->logger, CONTROL|LEVEL1,
"installing 0x%.8x for %s, src %s dst %s",
ntohl(spi), mapping_find(protocol_id_m, this->protocol),
src->get_address(src), dst->get_address(dst));
status = charon->kernel_interface->add_sa(charon->kernel_interface,
src, dst,
spi, this->protocol,
this->reqid,
mine ? 0 : this->soft_lifetime,
this->hard_lifetime,
enc_algo, enc_key,
int_algo, int_key, mine);
/* clean up */
if (enc_algo != ENCR_UNDEFINED)
{
chunk_free(&enc_key);
}
if (int_algo != AUTH_UNDEFINED)
{
chunk_free(&int_key);
}
return status;
}
static status_t add(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
@@ -412,8 +356,8 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
from_port = my_ts->get_from_port(my_ts);
to_port = my_ts->get_to_port(my_ts);
from_port = (from_port != to_port) ? 0 : from_port;
policy->my_net = host_create_from_chunk(family, from_addr, from_port);
policy->my_net_mask = my_ts->get_netmask(my_ts);
policy->me.net = host_create_from_chunk(family, from_addr, from_port);
policy->me.net_mask = my_ts->get_netmask(my_ts);
chunk_free(&from_addr);
/* calculate net and ports for remote side */
@@ -422,41 +366,44 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
from_port = other_ts->get_from_port(other_ts);
to_port = other_ts->get_to_port(other_ts);
from_port = (from_port != to_port) ? 0 : from_port;
policy->other_net = host_create_from_chunk(family, from_addr, from_port);
policy->other_net_mask = other_ts->get_netmask(other_ts);
policy->other.net = host_create_from_chunk(family, from_addr, from_port);
policy->other.net_mask = other_ts->get_netmask(other_ts);
chunk_free(&from_addr);
/* install 3 policies: out, in and forward */
status = charon->kernel_interface->add_policy(charon->kernel_interface,
this->me, this->other,
policy->my_net, policy->other_net,
policy->my_net_mask, policy->other_net_mask,
this->me.addr, this->other.addr,
policy->me.net, policy->other.net,
policy->me.net_mask, policy->other.net_mask,
XFRM_POLICY_OUT, policy->upper_proto,
this->my_ah_spi, this->my_esp_spi,
this->protocol == PROTO_AH,
this->protocol == PROTO_ESP,
this->reqid);
status |= charon->kernel_interface->add_policy(charon->kernel_interface,
this->other, this->me,
policy->other_net, policy->my_net,
policy->other_net_mask, policy->my_net_mask,
this->other.addr, this->me.addr,
policy->other.net, policy->me.net,
policy->other.net_mask, policy->me.net_mask,
XFRM_POLICY_IN, policy->upper_proto,
this->my_ah_spi, this->my_esp_spi,
this->protocol == PROTO_AH,
this->protocol == PROTO_ESP,
this->reqid);
status |= charon->kernel_interface->add_policy(charon->kernel_interface,
this->other, this->me,
policy->other_net, policy->my_net,
policy->other_net_mask, policy->my_net_mask,
this->other.addr, this->me.addr,
policy->other.net, policy->me.net,
policy->other.net_mask, policy->me.net_mask,
XFRM_POLICY_FWD, policy->upper_proto,
this->my_ah_spi, this->my_esp_spi,
this->protocol == PROTO_AH,
this->protocol == PROTO_ESP,
this->reqid);
if (status != SUCCESS)
{
my_iter->destroy(my_iter);
other_iter->destroy(other_iter);
policy->my_net->destroy(policy->my_net);
policy->other_net->destroy(policy->other_net);
policy->me.net->destroy(policy->me.net);
policy->other.net->destroy(policy->other.net);
free(policy);
return status;
}
@@ -465,7 +412,6 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
this->policies->insert_last(this->policies, policy);
}
}
my_iter->destroy(my_iter);
other_iter->destroy(other_iter);
return SUCCESS;
@@ -486,10 +432,11 @@ static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
{
logger = this->logger;
}
logger->log(logger, CONTROL|LEVEL1, " \"%s\": protected with ESP (0x%x/0x%x), AH (0x%x,0x%x):",
logger->log(logger, CONTROL|LEVEL1, " \"%s\": protected with %s (0x%x/0x%x), reqid %d:",
name,
htonl(this->my_esp_spi), htonl(this->other_esp_spi),
htonl(this->my_ah_spi), htonl(this->other_ah_spi));
this->protocol == PROTO_ESP ? "ESP" : "AH",
htonl(this->me.spi), htonl(this->other.spi),
this->reqid);
iterator = this->policies->create_iterator(this->policies, TRUE);
while (iterator->has_next(iterator))
{
@@ -508,9 +455,9 @@ static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
}
logger->log(logger, CONTROL, " \"%s\": %s/%d==%s==%s/%d",
name,
policy->my_net->get_address(policy->my_net), policy->my_net_mask,
policy->me.net->get_address(policy->me.net), policy->me.net_mask,
proto_name,
policy->other_net->get_address(policy->other_net), policy->other_net_mask);
policy->other.net->get_address(policy->other.net), policy->other.net_mask);
}
iterator->destroy(iterator);
}
@@ -525,43 +472,36 @@ static void destroy(private_child_sa_t *this)
while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
{
charon->kernel_interface->del_policy(charon->kernel_interface,
this->me, this->other,
policy->my_net, policy->other_net,
policy->my_net_mask, policy->other_net_mask,
this->me.addr, this->other.addr,
policy->me.net, policy->other.net,
policy->me.net_mask, policy->other.net_mask,
XFRM_POLICY_OUT, policy->upper_proto);
charon->kernel_interface->del_policy(charon->kernel_interface,
this->other, this->me,
policy->other_net, policy->my_net,
policy->other_net_mask, policy->my_net_mask,
this->other.addr, this->me.addr,
policy->other.net, policy->me.net,
policy->other.net_mask, policy->me.net_mask,
XFRM_POLICY_IN, policy->upper_proto);
charon->kernel_interface->del_policy(charon->kernel_interface,
this->other, this->me,
policy->other_net, policy->my_net,
policy->other_net_mask, policy->my_net_mask,
this->other.addr, this->me.addr,
policy->other.net, policy->me.net,
policy->other.net_mask, policy->me.net_mask,
XFRM_POLICY_FWD, policy->upper_proto);
policy->my_net->destroy(policy->my_net);
policy->other_net->destroy(policy->other_net);
policy->me.net->destroy(policy->me.net);
policy->other.net->destroy(policy->other.net);
free(policy);
}
this->policies->destroy(this->policies);
/* delete SAs in the kernel, if they are set up */
if (this->my_ah_spi)
if (this->protocol != PROTO_NONE)
{
charon->kernel_interface->del_sa(charon->kernel_interface,
this->other, this->my_ah_spi, PROTO_AH);
this->other.addr, this->me.spi, this->protocol);
charon->kernel_interface->del_sa(charon->kernel_interface,
this->me, this->other_ah_spi, PROTO_AH);
}
if (this->my_esp_spi)
{
charon->kernel_interface->del_sa(charon->kernel_interface,
this->other, this->my_esp_spi, PROTO_ESP);
charon->kernel_interface->del_sa(charon->kernel_interface,
this->me, this->other_esp_spi, PROTO_ESP);
this->me.addr, this->other.spi, this->protocol);
}
free(this);
}
@@ -569,13 +509,15 @@ static void destroy(private_child_sa_t *this)
/*
* Described in header.
*/
child_sa_t * child_sa_create(host_t *me, host_t* other)
child_sa_t * child_sa_create(host_t *me, host_t* other, u_int32_t soft_lifetime, u_int32_t hard_lifetime)
{
static u_int32_t reqid = 2000000000;
private_child_sa_t *this = malloc_thing(private_child_sa_t);
/* public functions */
this->public.get_reqid = (u_int32_t(*)(child_sa_t*))get_reqid;
this->public.get_spi = (u_int32_t(*)(child_sa_t*, bool))get_spi;
this->public.get_protocol = (protocol_id_t(*)(child_sa_t*))get_protocol;
this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc;
this->public.add = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))add;
this->public.update = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))update;
@@ -585,14 +527,15 @@ child_sa_t * child_sa_create(host_t *me, host_t* other)
/* private data */
this->logger = logger_manager->get_logger(logger_manager, CHILD_SA);
this->me = me;
this->other = other;
this->my_ah_spi = 0;
this->my_esp_spi = 0;
this->other_ah_spi = 0;
this->other_esp_spi = 0;
this->me.addr = me;
this->other.addr = other;
this->me.spi = 0;
this->other.spi = 0;
this->soft_lifetime = soft_lifetime;
this->hard_lifetime = hard_lifetime;
this->reqid = ++reqid;
this->policies = linked_list_create();
this->protocol = PROTO_NONE;
return (&this->public);
}
src/charon/sa/child_sa.h
+26 -2
View File
@@ -27,6 +27,7 @@
#include <types.h>
#include <crypto/prf_plus.h>
#include <encoding/payloads/proposal_substructure.h>
#include <config/proposal.h>
#include <utils/logger.h>
typedef struct child_sa_t child_sa_t;
@@ -69,6 +70,27 @@ struct child_sa_t {
*/
u_int32_t (*get_reqid)(child_sa_t *this);
/**
* @brief Get the SPI of this CHILD_SA.
*
* Set the boolean parameter inbound to TRUE to
* get the SPI for which we receive packets, use
* FALSE to get those we use for sending packets.
*
* @param this calling object
* @param inbound TRUE to get inbound SPI, FALSE for outbound.
* @return spi of the CHILD SA
*/
u_int32_t (*get_spi) (child_sa_t *this, bool inbound);
/**
* @brief Get the protocol which this CHILD_SA uses to protect traffic.
*
* @param this calling object
* @return AH | ESP
*/
protocol_id_t (*get_protocol) (child_sa_t *this);
/**
* @brief Allocate SPIs for a given proposals.
*
@@ -112,7 +134,7 @@ struct child_sa_t {
/**
* @brief Install the policies using some traffic selectors.
*
*
* Supplied lists of traffic_selector_t's specify the policies
* to use for this child sa.
*
@@ -151,10 +173,12 @@ struct child_sa_t {
*
* @param me own address
* @param other remote address
* @param soft_lifetime time before rekeying
* @param hard_lifteime time before delete
* @return child_sa_t object
*
* @ingroup sa
*/
child_sa_t * child_sa_create(host_t *me, host_t *other);
child_sa_t * child_sa_create(host_t *me, host_t *other, u_int32_t soft_lifetime, u_int32_t hard_lifetime);
#endif /*CHILD_SA_H_*/
src/charon/sa/ike_sa.c
+389 -205
View File
@@ -38,8 +38,10 @@
#include <encoding/payloads/delete_payload.h>
#include <encoding/payloads/transform_substructure.h>
#include <encoding/payloads/transform_attribute.h>
#include <encoding/payloads/ts_payload.h>
#include <sa/states/initiator_init.h>
#include <sa/states/responder_init.h>
#include <sa/states/create_child_sa_requested.h>
#include <queues/jobs/retransmit_request_job.h>
#include <queues/jobs/delete_established_ike_sa_job.h>
#include <queues/jobs/delete_half_open_ike_sa_job.h>
@@ -63,7 +65,7 @@ struct private_ike_sa_t {
* Identifier for the current IKE_SA.
*/
ike_sa_id_t *ike_sa_id;
/**
* Linked List containing the child sa's of the current IKE_SA.
*/
@@ -84,30 +86,12 @@ struct private_ike_sa_t {
state_t *current_state;
/**
* INIT configuration, needed for the IKE_SA_INIT exchange.
*
* Gets set in states:
* - INITATOR_INIT
* - RESPONDER_INIT
*
* Available in states:
* - IKE_SA_INIT_REQUESTED
* - IKE_SA_INIT_RESPONDED
* - IKE_AUTH_REQUESTED
* -IKE_SA_ESTABLISHED
* Connection definition used for this IKE_SA
*/
connection_t *connection;
/**
* SA configuration, needed for all other exchanges after IKE_SA_INIT exchange.
*
* Gets set in states:
* - IKE_SA_INIT_REQUESTED
* - IKE_SA_INIT_RESPONDED
*
* Available in states:
* - IKE_AUTH_REQUESTED
* -IKE_SA_ESTABLISHED
* Policy definition used for this IKE_SA
*/
policy_t *policy;
@@ -189,77 +173,6 @@ struct private_ike_sa_t {
logger_t *logger;
};
/**
* Implementation of ike_sa_t.process_message.
*/
static status_t process_message(private_ike_sa_t *this, message_t *message)
{
u_int32_t message_id;
exchange_type_t exchange_type;
bool is_request;
/* We must process each request or response from remote host */
/* Find out type of message (request or response) */
is_request = message->get_request(message);
exchange_type = message->get_exchange_type(message);
this->logger->log(this->logger, CONTROL|LEVEL1, "Process %s of exchange type %s",
(is_request) ? "request" : "response",mapping_find(exchange_type_m,exchange_type));
message_id = message->get_message_id(message);
/*
* It has to be checked, if the message has to be resent cause of lost packets!
*/
if (is_request && (message_id == (this->message_id_in - 1)))
{
/* resend last message, if any */
if (this->last_responded_message)
{
packet_t *packet = this->last_responded_message->get_packet(this->last_responded_message);
this->logger->log(this->logger, CONTROL|LEVEL1, "Resent request detected. Send stored reply.");
charon->send_queue->add(charon->send_queue, packet);
return SUCCESS;
}
else
{
/* somebody does something nasty here... */
return FAILED;
}
}
/* Now, the message id is checked for request AND reply */
if (is_request)
{
/* In a request, the message has to be this->message_id_in (other case is already handled) */
if (message_id != this->message_id_in)
{
this->logger->log(this->logger, ERROR | LEVEL1,
"Message request with message id %d received, but %d expected",
message_id,this->message_id_in);
return FAILED;
}
}
else
{
/* In a reply, the message has to be this->message_id_out -1 cause it is the reply to the last sent message*/
if (message_id != (this->message_id_out - 1))
{
this->logger->log(this->logger, ERROR | LEVEL1,
"Message reply with message id %d received, but %d expected",
message_id,this->message_id_in);
return FAILED;
}
}
/* now the message is processed by the current state object.
* The specific state object is responsible to check if a message can be received in
* the state it represents.
* The current state is also responsible to change the state object to the next state
* by calling protected_ike_sa_t.set_new_state*/
return this->current_state->process_message(this->current_state,message);
}
/**
* Implementation of protected_ike_sa_t.build_message.
*/
@@ -283,95 +196,6 @@ static void build_message(private_ike_sa_t *this, exchange_type_t type, bool req
*message = new_message;
}
/**
* Implementation of protected_ike_sa_t.initiate_connection.
*/
static status_t initiate_connection(private_ike_sa_t *this, connection_t *connection)
{
initiator_init_t *current_state;
/* Work is done in state object of type INITIATOR_INIT. All other states are not
* initial states and so don't have a initiate_connection function */
if (this->current_state->get_state(this->current_state) != INITIATOR_INIT)
{
return FAILED;
}
current_state = (initiator_init_t *) this->current_state;
return current_state->initiate_connection(current_state, connection);
}
/**
* Implementation of ike_sa_t.get_id.
*/
static ike_sa_id_t* get_id(private_ike_sa_t *this)
{
return this->ike_sa_id;
}
/**
* Implementation of ike_sa_t.get_my_host.
*/
static host_t* get_my_host(private_ike_sa_t *this)
{
return this->connection->get_my_host(this->connection);;
}
/**
* Implementation of ike_sa_t.get_other_host.
*/
static host_t* get_other_host(private_ike_sa_t *this)
{
return this->connection->get_other_host(this->connection);;
}
/**
* Implementation of ike_sa_t.get_my_id.
*/
static identification_t* get_my_id(private_ike_sa_t *this)
{
return this->policy->get_my_id(this->policy);;
}
/**
* Implementation of ike_sa_t.get_other_id.
*/
static identification_t* get_other_id(private_ike_sa_t *this)
{
return this->policy->get_other_id(this->policy);;
}
/**
* Implementation of ike_sa_t.retransmit_request.
*/
status_t retransmit_request (private_ike_sa_t *this, u_int32_t message_id)
{
packet_t *packet;
if (this->last_requested_message == NULL)
{
return NOT_FOUND;
}
if (message_id == this->last_replied_message_id)
{
return NOT_FOUND;
}
if ((this->last_requested_message->get_message_id(this->last_requested_message)) != message_id)
{
return NOT_FOUND;
}
this->logger->log(this->logger, CONTROL | LEVEL1, "Going to retransmit message with id %d",message_id);
packet = this->last_requested_message->get_packet(this->last_requested_message);
charon->send_queue->add(charon->send_queue, packet);
return SUCCESS;
}
/**
* Implementation of ike_sa_t.get_state.
*/
@@ -454,6 +278,74 @@ static prf_t *get_prf_auth_r(private_ike_sa_t *this)
{
return this->prf_auth_r;
}
/**
* Implementation of ike_sa_t.get_id.
*/
static ike_sa_id_t* get_id(private_ike_sa_t *this)
{
return this->ike_sa_id;
}
/**
* Implementation of ike_sa_t.get_my_host.
*/
static host_t* get_my_host(private_ike_sa_t *this)
{
return this->connection->get_my_host(this->connection);;
}
/**
* Implementation of ike_sa_t.get_other_host.
*/
static host_t* get_other_host(private_ike_sa_t *this)
{
return this->connection->get_other_host(this->connection);;
}
/**
* Implementation of ike_sa_t.get_my_id.
*/
static identification_t* get_my_id(private_ike_sa_t *this)
{
return this->policy->get_my_id(this->policy);;
}
/**
* Implementation of ike_sa_t.get_other_id.
*/
static identification_t* get_other_id(private_ike_sa_t *this)
{
return this->policy->get_other_id(this->policy);;
}
/**
* Implementation of ike_sa_t.retransmit_request.
*/
status_t retransmit_request (private_ike_sa_t *this, u_int32_t message_id)
{
packet_t *packet;
if (this->last_requested_message == NULL)
{
return NOT_FOUND;
}
if (message_id == this->last_replied_message_id)
{
return NOT_FOUND;
}
if ((this->last_requested_message->get_message_id(this->last_requested_message)) != message_id)
{
return NOT_FOUND;
}
this->logger->log(this->logger, CONTROL | LEVEL1, "Going to retransmit message with id %d",message_id);
packet = this->last_requested_message->get_packet(this->last_requested_message);
charon->send_queue->add(charon->send_queue, packet);
return SUCCESS;
}
/**
@@ -468,13 +360,13 @@ static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, d
size_t key_size;
/*
* Build the PRF+ instance for deriving keys
*/
* Build the PRF+ instance for deriving keys
*/
if (this->prf != NULL)
{
this->prf->destroy(this->prf);
}
proposal->get_algorithm(proposal, PROTO_IKE, PSEUDO_RANDOM_FUNCTION, &algo);
proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo);
if (algo == NULL)
{
this->logger->log(this->logger, ERROR|LEVEL2, "No PRF algoithm selected!?");
@@ -511,10 +403,10 @@ static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, d
chunk_free(&secret);
/* prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr )
* = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr
*
* we use the prf directly for prf+
*/
* = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr
*
* we use the prf directly for prf+
*/
this->prf->set_key(this->prf, skeyseed);
prf_plus = prf_plus_create(this->prf, nonces_spis);
@@ -525,9 +417,9 @@ static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, d
/*
* We now can derive all of our key. We build the transforms
* directly.
*/
* We now can derive all of our key. We build the transforms
* directly.
*/
/* SK_d used for prf+ to derive keys for child SAs */
@@ -540,7 +432,7 @@ static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, d
/* SK_ai/SK_ar used for integrity protection */
proposal->get_algorithm(proposal, PROTO_IKE, INTEGRITY_ALGORITHM, &algo);
proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &algo);
if (algo == NULL)
{
this->logger->log(this->logger, ERROR|LEVEL2, "No integrity algoithm selected?!");
@@ -578,7 +470,7 @@ static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, d
/* SK_ei/SK_er used for encryption */
proposal->get_algorithm(proposal, PROTO_IKE, ENCRYPTION_ALGORITHM, &algo);
proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &algo);
if (algo == NULL)
{
this->logger->log(this->logger, ERROR|LEVEL2, "No encryption algoithm selected!?");
@@ -616,7 +508,7 @@ static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, d
chunk_free(&key);
/* SK_pi/SK_pr used for authentication */
proposal->get_algorithm(proposal, PROTO_IKE, PSEUDO_RANDOM_FUNCTION, &algo);
proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo);
if (this->prf_auth_i != NULL)
{
this->prf_auth_i->destroy(this->prf_auth_i);
@@ -701,7 +593,7 @@ static status_t send_request(private_ike_sa_t *this, message_t *message)
if (message->get_message_id(message) != this->message_id_out)
{
this->logger->log(this->logger, ERROR, "Message could not be sent cause id (%d) was not as expected (%d)",
message->get_message_id(message),this->message_id_out);
message->get_message_id(message),this->message_id_out);
return FAILED;
}
@@ -727,8 +619,8 @@ static status_t send_request(private_ike_sa_t *this, message_t *message)
}
this->logger->log(this->logger, CONTROL|LEVEL3,
"Add request packet with message id %d to global send queue",
this->message_id_out);
"Add request packet with message id %d to global send queue",
this->message_id_out);
charon->send_queue->add(charon->send_queue, packet);
/* replace last message for retransmit with current */
@@ -754,8 +646,8 @@ static status_t send_request(private_ike_sa_t *this, message_t *message)
/* message counter can now be increased */
this->logger->log(this->logger, CONTROL|LEVEL3,
"Increase message counter for outgoing messages from %d",
this->message_id_out);
"Increase message counter for outgoing messages from %d",
this->message_id_out);
this->message_id_out++;
return SUCCESS;
}
@@ -795,8 +687,8 @@ static status_t send_response(private_ike_sa_t *this, message_t *message)
}
this->logger->log(this->logger, CONTROL|LEVEL3,
"Add response packet with message id %d to global send queue",
this->message_id_in);
"Add response packet with message id %d to global send queue",
this->message_id_in);
charon->send_queue->add(charon->send_queue, packet);
if (this->last_responded_message != NULL)
@@ -827,7 +719,7 @@ static void send_notify(private_ike_sa_t *this, exchange_type_t exchange_type, n
this->logger->log(this->logger, CONTROL|LEVEL2, "Going to build message with notify payload");
/* set up the reply */
this->protected.build_message(&(this->protected), exchange_type, FALSE, &response);
build_message(this, exchange_type, FALSE, &response);
payload = notify_payload_create_from_protocol_and_type(PROTO_IKE, type);
if ((data.ptr != NULL) && (data.len > 0))
{
@@ -886,6 +778,220 @@ static void add_child_sa(private_ike_sa_t *this, child_sa_t *child_sa)
this->child_sas->insert_last(this->child_sas, child_sa);
}
/**
* Process an informational request
*/
static status_t process_informational(private_ike_sa_t *this, message_t *request)
{
delete_payload_t *delete_request = NULL;
message_t *response;
iterator_t *payloads;
state_t *old_state;
build_message(this, INFORMATIONAL, FALSE, &response);
payloads = request->get_payload_iterator(request);
while (payloads->has_next(payloads))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case DELETE:
{
delete_request = (delete_payload_t *) payload;
break;
}
default:
{
this->logger->log(this->logger, ERROR|LEVEL1, "Ignoring Payload %s (%d)",
mapping_find(payload_type_m, payload->get_type(payload)),
payload->get_type(payload));
break;
}
}
}
/* iterator can be destroyed */
payloads->destroy(payloads);
if (delete_request)
{
if (delete_request->get_protocol_id(delete_request) == PROTO_IKE)
{
this->logger->log(this->logger, CONTROL, "DELETE request for IKE_SA received");
if (send_response(this, response) != SUCCESS)
{
/* something is seriously wrong, kill connection */
this->logger->log(this->logger, AUDIT, "Unable to send reply. Deleting IKE_SA");
response->destroy(response);
}
/* switch to delete_requested. This is not absolutly correct, but we
* allow the clean destruction of an SA only in this state. */
old_state = this->current_state;
set_new_state(this, (state_t*)delete_requested_create(this));
old_state->destroy(old_state);
return DESTROY_ME;
}
else
{
this->logger->log(this->logger, CONTROL, "DELETE request for CHILD_SA received. Ignored");
response->destroy(response);
return FAILED;
}
}
return SUCCESS;
}
/**
* Process an informational request
*/
static status_t process_create_child_sa(private_ike_sa_t *this, message_t *request)
{
}
/**
* Implementation of ike_sa_t.process_message.
*/
static status_t process_message(private_ike_sa_t *this, message_t *message)
{
u_int32_t message_id;
exchange_type_t exchange_type;
bool is_request;
status_t status;
crypter_t *crypter;
signer_t *signer;
/* Find out type of message (request or response) */
is_request = message->get_request(message);
exchange_type = message->get_exchange_type(message);
this->logger->log(this->logger, CONTROL|LEVEL1, "Process %s of exchange type %s",
(is_request) ? "request" : "response",
mapping_find(exchange_type_m, exchange_type));
message_id = message->get_message_id(message);
/* check if message already received, and retransmit its reply */
if (is_request && (message_id == (this->message_id_in - 1)))
{
/* resend last message, if any */
if (this->last_responded_message)
{
packet_t *packet = this->last_responded_message->get_packet(this->last_responded_message);
this->logger->log(this->logger, CONTROL|LEVEL1, "Resent request detected. Send stored reply.");
charon->send_queue->add(charon->send_queue, packet);
return SUCCESS;
}
else
{
/* somebody does something nasty here... */
return FAILED;
}
}
/* Now, the message id is checked for request AND reply */
if (is_request)
{
/* In a request, the message has to be this->message_id_in (other case is already handled) */
if (message_id != this->message_id_in)
{
this->logger->log(this->logger, ERROR | LEVEL1,
"Message request with message id %d received, but %d expected",
message_id,this->message_id_in);
return FAILED;
}
}
else
{
/* In a reply, the message has to be this->message_id_out -1 cause it is the reply to the last sent message*/
if (message_id != (this->message_id_out - 1))
{
this->logger->log(this->logger, ERROR | LEVEL1,
"Message reply with message id %d received, but %d expected",
message_id,this->message_id_in);
return FAILED;
}
}
if (this->current_state->get_state(this->current_state) == IKE_SA_ESTABLISHED)
{
if (is_request)
{
/* get signer for verification and crypter for decryption */
if (!this->ike_sa_id->is_initiator(this->ike_sa_id))
{
crypter = this->crypter_initiator;
signer = this->signer_initiator;
}
else
{
crypter = this->crypter_responder;
signer = this->signer_responder;
}
/* parse incoming message */
status = message->parse_body(message, crypter, signer);
if (status != SUCCESS)
{
this->logger->log(this->logger, AUDIT, "%s request decryption failed. Ignoring message",
mapping_find(exchange_type_m, message->get_exchange_type(message)));
return status;
}
switch (message->get_exchange_type(message))
{
case CREATE_CHILD_SA:
return process_create_child_sa(this, message);
case INFORMATIONAL:
return process_informational(this, message);
default:
this->logger->log(this->logger, CONTROL,
"Received a %s request, ignored",
mapping_find(exchange_type_m, exchange_type));
}
}
else
{
this->logger->log(this->logger, ERROR|LEVEL1,
"Received an unexpected %s response, ignored",
mapping_find(exchange_type_m, exchange_type));
}
return FAILED;
}
else
{
/* now the message is processed by the current state object.
* The specific state object is responsible to check if a message can be received in
* the state it represents.
* The current state is also responsible to change the state object to the next state
* by calling protected_ike_sa_t.set_new_state
*/
return this->current_state->process_message(this->current_state, message);
}
}
/**
* Implementation of protected_ike_sa_t.initiate_connection.
*/
static status_t initiate_connection(private_ike_sa_t *this, connection_t *connection)
{
initiator_init_t *current_state;
/* Work is done in state object of type INITIATOR_INIT. All other states are not
* initial states and so don't have a initiate_connection function */
if (this->current_state->get_state(this->current_state) != INITIATOR_INIT)
{
return FAILED;
}
current_state = (initiator_init_t *) this->current_state;
return current_state->initiate_connection(current_state, connection);
}
/**
* Implementation of ike_sa_t.get_child_sa.
*/
@@ -908,6 +1014,83 @@ static child_sa_t *get_child_sa(private_ike_sa_t *this, u_int32_t reqid)
return found;
}
/**
* Implementation of ike_sa_t.delete_child_sa.
*/
static status_t delete_child_sa(private_ike_sa_t *this, u_int32_t reqid)
{
return NOT_FOUND;
}
/**
* Implementation of ike_sa_t.rekey_child_sa.
*/
static status_t rekey_child_sa(private_ike_sa_t *this, u_int32_t reqid)
{
message_t *request;
child_sa_t *child_sa;
notify_payload_t *notify;
sa_payload_t *sa_payload;
ts_payload_t *tsi_payload, *tsr_payload;
nonce_payload_t *nonce_payload;
policy_t *policy;
randomizer_t *randomizer;
linked_list_t *proposals;
chunk_t nonce;
linked_list_t *my_ts, *other_ts;
state_t *old_state;
if (this->current_state->get_state(this->current_state) != IKE_SA_ESTABLISHED)
{
this->logger->log(this->logger, ERROR|LEVEL1,
"Rekeying of an IKE_SA not in state IKE_SA_ESTABLISHED, aborting", reqid);
return FAILED;
}
child_sa = get_child_sa(this, reqid);
if (child_sa == NULL)
{
this->logger->log(this->logger, ERROR|LEVEL1,
"IKE_SA does not contain a CHILD_SA with reqid %d", reqid);
return FAILED;
}
build_message(this, CREATE_CHILD_SA, TRUE, &request);
notify = notify_payload_create_from_protocol_and_type(
child_sa->get_protocol(child_sa), REKEY_SA);
notify->set_spi(notify, child_sa->get_spi(child_sa, TRUE));
request->add_payload(request, (payload_t*)notify);
proposals = this->policy->get_proposals(this->policy);
sa_payload = sa_payload_create_from_proposal_list(proposals);
request->add_payload(request, (payload_t*)sa_payload);
nonce_payload = nonce_payload_create();
if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer,
NONCE_SIZE, &nonce))
{
request->destroy(request);
return FAILED;
}
nonce_payload->set_nonce(nonce_payload, nonce);
request->add_payload(request, (payload_t*)nonce_payload);
my_ts = this->policy->get_my_traffic_selectors(this->policy);
other_ts = this->policy->get_my_traffic_selectors(this->policy);
tsi_payload = ts_payload_create_from_traffic_selectors(TRUE, my_ts);
tsr_payload = ts_payload_create_from_traffic_selectors(FALSE, other_ts);
request->add_payload(request, (payload_t*)tsi_payload);
request->add_payload(request, (payload_t*)tsr_payload);
send_request(this, request);
old_state = this->current_state;
set_new_state(this, (state_t*)create_child_sa_requested_create(&this->protected, nonce));
old_state->destroy(old_state);
return SUCCESS;
}
/**
* Implementation of protected_ike_sa_t.reset_message_buffers.
*/
@@ -1125,7 +1308,6 @@ static void destroy(private_ike_sa_t *this)
this->ike_sa_id->destroy(this->ike_sa_id);
this->randomizer->destroy(this->randomizer);
this->current_state->destroy(this->current_state);
free(this);
}
@@ -1135,10 +1317,12 @@ static void destroy(private_ike_sa_t *this)
ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
{
private_ike_sa_t *this = malloc_thing(private_ike_sa_t);
/* Public functions */
this->protected.public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
this->protected.public.initiate_connection = (status_t(*)(ike_sa_t*,connection_t*)) initiate_connection;
this->protected.public.delete_child_sa = (status_t(*)(ike_sa_t*,u_int32_t)) delete_child_sa;
this->protected.public.rekey_child_sa = (status_t(*)(ike_sa_t*,u_int32_t)) rekey_child_sa;
this->protected.public.get_child_sa = (child_sa_t*(*)(ike_sa_t*,u_int32_t))get_child_sa;
this->protected.public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
this->protected.public.get_my_host = (host_t*(*)(ike_sa_t*)) get_my_host;
@@ -1153,7 +1337,7 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->protected.public.destroy = (void(*)(ike_sa_t*))destroy;
/* protected functions */
this->protected.build_message = (void (*) (protected_ike_sa_t *, exchange_type_t , bool , message_t **)) build_message;
this->protected.build_message = (void (*) (protected_ike_sa_t *, exchange_type_t,bool,message_t**)) build_message;
this->protected.get_prf = (prf_t *(*) (protected_ike_sa_t *)) get_prf;
this->protected.get_child_prf = (prf_t *(*) (protected_ike_sa_t *)) get_child_prf;
this->protected.get_prf_auth_i = (prf_t *(*) (protected_ike_sa_t *)) get_prf_auth_i;
src/charon/sa/ike_sa.h
+28
View File
@@ -126,6 +126,34 @@ struct ike_sa_t {
*/
child_sa_t* (*get_child_sa) (ike_sa_t *this, u_int32_t reqid);
/**
* @brief Close the CHILD SA with the specified reqid.
*
* Looks for a CHILD SA owned by this IKE_SA, deletes it and
* notify's the remote peer about the delete. The associated
* states and policies in the kernel get deleted, if they exist.
*
* @param this calling object
* @param reqid reqid of the child SA, as used in the kernel
* @return
* - NOT_FOUND, if IKE_SA has no such CHILD_SA
* - SUCCESS, if deleted and delete message sent
*/
status_t (*delete_child_sa) (ike_sa_t *this, u_int32_t reqid);
/**
* @brief Rekey the CHILD SA with the specified reqid.
*
* Looks for a CHILD SA owned by this IKE_SA, and start the rekeing.
*
* @param this calling object
* @param spi security parameter index identifying the SA to rekey
* @return
* - NOT_FOUND, if IKE_SA has no such CHILD_SA
* - SUCCESS, if rekeying initiated
*/
status_t (*rekey_child_sa) (ike_sa_t *this, u_int32_t reqid);
/**
* @brief Get local peer address of the IKE_SA.
*
src/charon/sa/states/create_child_sa_requested.c
+112
View File
@@ -0,0 +1,112 @@
/**
* @file create_child_sa_requested.c
*
* @brief State after a CREATE_CHILD_SA request was sent.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "create_child_sa_requested.h"
#include <sa/child_sa.h>
#include <encoding/payloads/ts_payload.h>
#include <encoding/payloads/sa_payload.h>
#include <encoding/payloads/nonce_payload.h>
#include <encoding/payloads/notify_payload.h>
#include <utils/logger_manager.h>
typedef struct private_create_child_sa_requested_t private_create_child_sa_requested_t;
/**
* Private data of a create_child_sa_requested_t object.
*/
struct private_create_child_sa_requested_t {
/**
* Public interface of create_child_sa_requested_t.
*/
create_child_sa_requested_t public;
/**
* Assigned IKE_SA.
*/
protected_ike_sa_t *ike_sa;
/**
* nonce chosen by initiator
*/
chunk_t nonce_i;
/**
* nonce chosen by the responder
*/
chunk_t nonce_r;
/**
* Assigned logger.
*
* Is logger of ike_sa!
*/
logger_t *logger;
};
/**
* Implements state_t.get_state
*/
static status_t process_message(private_create_child_sa_requested_t *this, message_t *request)
{
this->logger->log(this->logger, ERROR, "NOT IMPLEMENTED");
}
/**
* Implements state_t.get_state
*/
static ike_sa_state_t get_state(private_create_child_sa_requested_t *this)
{
return CREATE_CHILD_SA_REQUESTED;
}
/**
* Implementation of state_t.destroy.
*/
static void destroy(private_create_child_sa_requested_t *this)
{
chunk_free(&this->nonce_i);
chunk_free(&this->nonce_r);
free(this);
}
/*
* Described in header.
*/
create_child_sa_requested_t *create_child_sa_requested_create(protected_ike_sa_t *ike_sa, chunk_t nonce_i)
{
private_create_child_sa_requested_t *this = malloc_thing(private_create_child_sa_requested_t);
/* interface functions */
this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
this->public.state_interface.destroy = (void (*) (state_t *)) destroy;
/* private data */
this->ike_sa = ike_sa;
this->nonce_i = nonce_i;
this->nonce_r = CHUNK_INITIALIZER;
this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
return &(this->public);
}
src/charon/sa/states/create_child_sa_requested.h
+57
View File
@@ -0,0 +1,57 @@
/**
* @file create_child_sa_requested.h
*
* @brief Interface of create_child_sa_requested_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef CREATE_CHILD_SA_REQEUSTED_H_
#define CREATE_CHILD_SA_REQEUSTED_H_
#include <sa/states/state.h>
#include <sa/ike_sa.h>
typedef struct create_child_sa_requested_t create_child_sa_requested_t;
/**
* @brief State after a CREATE_CHILD_SA request was sent.
*
* @b Constructors:
* - create_child_sa_requested_create()
*
* @ingroup states
*/
struct create_child_sa_requested_t {
/**
* methods of the state_t interface
*/
state_t state_interface;
};
/**
* @brief Constructor of class create_child_sa_requested_t
*
* @param ike_sa assigned ike_sa
* @param nonce nonce sent at initialization
* @return created create_child_sa_requested_t object
*
* @ingroup states
*/
create_child_sa_requested_t *create_child_sa_requested_create(protected_ike_sa_t *ike_sa, chunk_t nonce_i);
#endif /*CREATE_CHILD_SA_REQEUSTED_H_*/
src/charon/sa/states/ike_sa_established.c
+1 -126
View File
@@ -48,138 +48,13 @@ struct private_ike_sa_established_t {
logger_t *logger;
};
/**
* Process an informational request
*/
static status_t process_informational(private_ike_sa_established_t *this, message_t *request, message_t *response)
{
delete_payload_t *delete_request = NULL;
iterator_t *payloads = request->get_payload_iterator(request);
while (payloads->has_next(payloads))
{
payload_t *payload;
payloads->current(payloads, (void**)&payload);
switch (payload->get_type(payload))
{
case DELETE:
{
delete_request = (delete_payload_t *) payload;
break;
}
default:
{
this->logger->log(this->logger, ERROR|LEVEL1, "Ignoring Payload %s (%d)",
mapping_find(payload_type_m, payload->get_type(payload)),
payload->get_type(payload));
break;
}
}
}
/* iterator can be destroyed */
payloads->destroy(payloads);
if (delete_request)
{
if (delete_request->get_protocol_id(delete_request) == PROTO_IKE)
{
this->logger->log(this->logger, CONTROL, "DELETE request for IKE_SA received");
/* we reply with an empty informational message */
return DESTROY_ME;
}
else
{
this->logger->log(this->logger, CONTROL, "DELETE request for CHILD_SA received. Ignored");
response->destroy(response);
return SUCCESS;
}
}
return SUCCESS;
}
/**
* Implements state_t.get_state
*/
static status_t process_message(private_ike_sa_established_t *this, message_t *message)
{
delete_payload_t *delete_request = NULL;
ike_sa_id_t *ike_sa_id;
iterator_t *payloads;
message_t *response;
crypter_t *crypter;
signer_t *signer;
status_t status;
/* only requests are allowed, responses are handled in sub-states */
if (!message->get_request(message))
{
this->logger->log(this->logger, ERROR | LEVEL1,
"INFORMATIONAL responses not handled in state ike_sa_established");
return FAILED;
}
/* get signer for verification and crypter for decryption */
ike_sa_id = this->ike_sa->public.get_id(&(this->ike_sa->public));
if (!ike_sa_id->is_initiator(ike_sa_id))
{
crypter = this->ike_sa->get_crypter_initiator(this->ike_sa);
signer = this->ike_sa->get_signer_initiator(this->ike_sa);
}
else
{
crypter = this->ike_sa->get_crypter_responder(this->ike_sa);
signer = this->ike_sa->get_signer_responder(this->ike_sa);
}
/* parse incoming message */
status = message->parse_body(message, crypter, signer);
if (status != SUCCESS)
{
this->logger->log(this->logger, AUDIT, "%s request decryption failed. Ignoring message",
mapping_find(exchange_type_m, message->get_exchange_type(message)));
return status;
}
/* prepare a reply of the same type */
this->ike_sa->build_message(this->ike_sa, message->get_exchange_type(message), FALSE, &response);
/* handle the different message types in their functions */
switch (message->get_exchange_type(message))
{
case INFORMATIONAL:
status = process_informational(this, message, response);
break;
default:
this->logger->log(this->logger, ERROR | LEVEL1,
"Message of type %s currently not supported in state ike_sa_established",
mapping_find(exchange_type_m, message->get_exchange_type(message)));
status = NOT_SUPPORTED;
}
/* if we get a DESTROY_ME, we respond to follow strict request/reply scheme */
if (status == SUCCESS || status == DESTROY_ME)
{
if (this->ike_sa->send_response(this->ike_sa, response) != SUCCESS)
{
/* something is seriously wrong, kill connection */
this->logger->log(this->logger, AUDIT, "Unable to send reply. Deleting IKE_SA");
response->destroy(response);
status = DESTROY_ME;
}
else if (status == DESTROY_ME)
{
/* switch to delete_requested. This is not absolutly correct, but we
* allow the clean destruction of an SA only in this state. */
this->ike_sa->set_new_state(this->ike_sa, (state_t*)delete_requested_create(this));
this->public.state_interface.destroy(&(this->public.state_interface));
}
}
else
{
response->destroy(response);
}
return status;
}
/**
src/charon/sa/states/ike_sa_init_requested.c
+3 -1
View File
@@ -572,7 +572,9 @@ static status_t build_sa_payload (private_ike_sa_init_requested_t *this, message
/* build child sa */
connection = this->ike_sa->get_connection(this->ike_sa);
this->child_sa = child_sa_create(connection->get_my_host(connection),
connection->get_other_host(connection));
connection->get_other_host(connection),
policy->get_soft_lifetime(policy),
policy->get_hard_lifetime(policy));
if (this->child_sa->alloc(this->child_sa, proposal_list) != SUCCESS)
{
this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA! Deleting IKE_SA");
src/charon/sa/states/ike_sa_init_responded.c
+5 -1
View File
@@ -441,6 +441,7 @@ static status_t build_sa_payload(private_ike_sa_init_responded_t *this, sa_paylo
prf_plus_t *prf_plus;
status_t status;
connection_t *connection;
policy_t *policy;
/* prepare reply */
sa_response = sa_payload_create();
@@ -474,9 +475,12 @@ static status_t build_sa_payload(private_ike_sa_init_responded_t *this, sa_paylo
prf_plus = prf_plus_create(this->ike_sa->get_child_prf(this->ike_sa), seed);
chunk_free(&seed);
policy = this->ike_sa->get_policy(this->ike_sa);
connection = this->ike_sa->get_connection(this->ike_sa);
this->child_sa = child_sa_create(connection->get_my_host(connection),
connection->get_other_host(connection));
connection->get_other_host(connection),
policy->get_soft_lifetime(policy),
policy->get_hard_lifetime(policy));
status = this->child_sa->add(this->child_sa, proposal, prf_plus);
prf_plus->destroy(prf_plus);
src/charon/sa/states/initiator_init.c
+6 -8
View File
@@ -159,14 +159,15 @@ status_t retry_initiate_connection (private_initiator_init_t *this, diffie_hellm
message_t *message;
status_t status;
if (dh_group == MODP_UNDEFINED)
this->diffie_hellman = diffie_hellman_create(dh_group);
if (this->diffie_hellman == NULL)
{
this->logger->log(this->logger, AUDIT, "No DH group acceptable for initialization, Aborting");
this->logger->log(this->logger, AUDIT, "DH group %s (%d) not supported, aborting",
mapping_find(diffie_hellman_group_m, dh_group), dh_group);
return DESTROY_ME;
}
connection = this->ike_sa->get_connection(this->ike_sa);
this->diffie_hellman = diffie_hellman_create(dh_group);
ike_sa_id = this->ike_sa->public.get_id(&(this->ike_sa->public));
ike_sa_id->set_responder_spi(ike_sa_id,0);
@@ -174,12 +175,10 @@ status_t retry_initiate_connection (private_initiator_init_t *this, diffie_hellm
this->logger->log(this->logger, CONTROL|LEVEL2, "Going to build message");
this->ike_sa->build_message(this->ike_sa, IKE_SA_INIT, TRUE, &message);
/* build SA payload */
/* build SA payload */
this->build_sa_payload(this, message);
/* build KE payload */
this->build_ke_payload(this, message);
/* build Nonce payload */
status = this->build_nonce_payload(this, message);
if (status != SUCCESS)
@@ -188,7 +187,6 @@ status_t retry_initiate_connection (private_initiator_init_t *this, diffie_hellm
message->destroy(message);
return DESTROY_ME;
}
/* message can now be sent (must not be destroyed) */
status = this->ike_sa->send_request(this->ike_sa, message);
if (status != SUCCESS)
@@ -244,7 +242,7 @@ static void build_ke_payload(private_initiator_init_t *this, message_t *request)
this->logger->log(this->logger, CONTROL|LEVEL1, "Building KE payload");
this->diffie_hellman->get_my_public_value(this->diffie_hellman,&key_data);
this->diffie_hellman->get_my_public_value(this->diffie_hellman, &key_data);
dh_group = this->diffie_hellman->get_dh_group(this->diffie_hellman);
ke_payload = ke_payload_create();
src/charon/sa/states/responder_init.c
+1 -1
View File
@@ -343,7 +343,7 @@ static status_t build_sa_payload(private_responder_init_t *this,sa_payload_t *sa
return DESTROY_ME;
}
/* get selected DH group to force policy, this is very restrictive!? */
this->proposal->get_algorithm(this->proposal, PROTO_IKE, DIFFIE_HELLMAN_GROUP, &algo);
this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP, &algo);
this->dh_group_number = algo->algorithm;
this->logger->log(this->logger, CONTROL | LEVEL2, "SA Payload processed");
src/charon/sa/states/state.c
+1
View File
@@ -34,5 +34,6 @@ mapping_t ike_sa_state_m[] = {
{IKE_AUTH_REQUESTED, "IKE_AUTH_REQUESTED"},
{IKE_SA_ESTABLISHED, "IKE_SA_ESTABLISHED"},
{DELETE_REQUESTED, "DELETE_REQUESTED"},
{CREATE_CHILD_SA_REQUESTED, "CREATE_CHILD_SA_REQUESTED"},
{MAPPING_END, NULL}
};
src/charon/sa/states/state.h
+61 -24
View File
@@ -34,6 +34,8 @@ typedef enum ike_sa_state_t ike_sa_state_t;
*
* @todo Support of more states (CHILD_SA_REQUESTED, etc...)
*
* @see state_t for state diagram
*
* @ingroup states
*/
enum ike_sa_state_t {
@@ -54,7 +56,7 @@ enum ike_sa_state_t {
*
* Implemented in class responder_init_t.
*/
RESPONDER_INIT = 2,
RESPONDER_INIT,
/**
* @brief A IKE_SA_INIT request was sent. In this state a reply of type IKE_SA_INIT is expected.
@@ -65,7 +67,7 @@ enum ike_sa_state_t {
*
* Implemented in class ike_sa_init_requested_t.
*/
IKE_SA_INIT_REQUESTED = 3,
IKE_SA_INIT_REQUESTED,
/**
* @brief A IKE_SA_INIT response was sent. In this state a request of type IKE_AUTH is expected.
@@ -74,7 +76,7 @@ enum ike_sa_state_t {
*
* Implemented in class ike_sa_init_responded_t.
*/
IKE_SA_INIT_RESPONDED = 4,
IKE_SA_INIT_RESPONDED,
/**
* @brief An IKE_AUTH request was sent after a successful IKE_SA_INIT-exchange.
@@ -83,7 +85,7 @@ enum ike_sa_state_t {
*
* Implemented in class ike_auth_requested_t.
*/
IKE_AUTH_REQUESTED = 5,
IKE_AUTH_REQUESTED,
/**
* @brief An IKE_AUTH exchange was successfuly handled either as initiator or responder.
@@ -92,7 +94,7 @@ enum ike_sa_state_t {
*
* Implemented in class ike_sa_established_t.
*/
IKE_SA_ESTABLISHED = 6,
IKE_SA_ESTABLISHED,
/**
* @brief An IKE SA has sent a DELETE IKE_SA to the other peer.
@@ -103,7 +105,9 @@ enum ike_sa_state_t {
*
* Implemented in class delete_requested.
*/
DELETE_REQUESTED = 7
DELETE_REQUESTED,
CREATE_CHILD_SA_REQUESTED,
};
@@ -117,24 +121,57 @@ typedef struct state_t state_t;
/**
* @brief This interface represents an IKE_SA state.
*
* A state_t object is responsible to handle incoming messages. States
* are exclusive, an IKE_SA is exactly in one state. They are used on IKE_SA
* setup, as there is a strict scheme message exchange follow. This can be
* mapped in a state machine. Every state is represented in a single class,
* and the IKE_SA may switch these states by replacing the owned state.
@verbatim
initiator responder
--------- ---------
¦ ¦
V ¦
+-----------------------+ ¦
¦ initiator_init ¦ msg1 V
+-----------------------+ -----> +-----------------------+
¦ msg2 ¦ responder_init ¦
V <----- +-----------------------+
+-----------------------+ ¦
¦ ike_sa_init_requested ¦ msg3 V
+-----------------------+ -----> +-----------------------+
¦ msg4 ¦ ike_sa_init_requested ¦
V <----- +-----------------------+
+-----------------------+ ¦
¦ ike_auth_requested ¦ ¦
+-----------------------+ ¦
¦ ¦
V V
+---------------------------+
¦ ike_sa_established ¦
+---------------------------+
¦
V
+---------------------------+
¦ delete_requested ¦
+---------------------------+
msg1 = IKE_SA_INIT request
msg2 = IKE_SA_INIT response
msg3 = IKE_AUTH request
msg4 = IKE_AUTH response
@endverbatim
* Every state can be left by deleting the IKE_SA, except the state
* ike_sa_established: it must switch to the delete_requested state first,
* as the peer must be informed about the delete.
*
* A state_t object is responsible to handle incoming messages.
*
* It's the responsibility of the state_t object to parse the body of the message and to process each
* payload.
*
* Needed Configurations and transform objects can be retrieved over an internal stored protected_ike_sa_t object
* which is passed to a state_t object when creating it (see different constructors).
*
* The following states are supported and implemented:
* - INITIATOR_INIT: implemented in initiator_init_t
* - RESPONDER_INIT: implemented in responder_init_t
* - IKE_SA_INIT_REQUESTED: implemented in ike_sa_init_requested_t
* - IKE_SA_INIT_RESPONDED: implemented in ike_sa_init_responded_t
* - IKE_AUTH_REQUESTED: implemented in ike_auth_requested_t
* - IKE_SA_ESTABLISHED: implemented in ike_sa_established_t
* - DELETE_REQUESTED: implemented in delete_requested_t
*
* For the handling of message in a established IKE_SA, another concept is used.
* The state-concept is good if a single state is possible. But in a established
* IKE_SA, there is no strict message order, and if a window size > 1 is used,
* multiple "states" would be possible. We call this transactions, better
* descripted in the transaction_t interface.
*
* @b Constructors:
* - initiator_init_create()
* - responder_init_create()
@@ -176,4 +213,4 @@ struct state_t {
void (*destroy) (state_t *this);
};
#endif /*STATE_H_*/
#endif /* STATE_H_ */