denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merged multi-auth branch back into trunk

Browse Source
This commit is contained in:
Martin Willi
2009-04-14 10:34:24 +00:00
parent 6e5c8d9413
commit a44bb9345f
230 changed files with 6163 additions and 4193 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/authenticators/authenticator.c
+33 -13
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2006-2009 Martin Willi
* Copyright (C) 2008 Tobias Brunner
* Copyright (C) 2006-2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -23,6 +23,7 @@
#include <sa/authenticators/pubkey_authenticator.h>
#include <sa/authenticators/psk_authenticator.h>
#include <sa/authenticators/eap_authenticator.h>
#include <encoding/payloads/auth_payload.h>
ENUM_BEGIN(auth_method_names, AUTH_RSA, AUTH_DSS,
@@ -35,7 +36,8 @@ ENUM_NEXT(auth_method_names, AUTH_ECDSA_256, AUTH_ECDSA_521, AUTH_DSS,
"ECDSA-521 signature");
ENUM_END(auth_method_names, AUTH_ECDSA_521);
ENUM(auth_class_names, AUTH_CLASS_PUBKEY, AUTH_CLASS_EAP,
ENUM(auth_class_names, AUTH_CLASS_ANY, AUTH_CLASS_EAP,
"any",
"public key",
"pre-shared key",
"EAP",
@@ -44,17 +46,23 @@ ENUM(auth_class_names, AUTH_CLASS_PUBKEY, AUTH_CLASS_EAP,
/**
* Described in header.
*/
authenticator_t *authenticator_create_from_class(ike_sa_t *ike_sa,
auth_class_t class)
authenticator_t *authenticator_create_builder(
ike_sa_t *ike_sa, auth_cfg_t *cfg,
chunk_t received_nonce, chunk_t sent_init)
{
switch (class)
switch ((uintptr_t)cfg->get(cfg, AUTH_RULE_AUTH_CLASS))
{
case AUTH_CLASS_ANY:
/* defaults to PUBKEY */
case AUTH_CLASS_PUBKEY:
return (authenticator_t*)pubkey_authenticator_create(ike_sa);
return (authenticator_t*)pubkey_authenticator_create_builder(ike_sa,
received_nonce, sent_init);
case AUTH_CLASS_PSK:
return (authenticator_t*)psk_authenticator_create(ike_sa);
return (authenticator_t*)psk_authenticator_create_builder(ike_sa,
received_nonce, sent_init);
case AUTH_CLASS_EAP:
return (authenticator_t*)eap_authenticator_create(ike_sa);
return (authenticator_t*)eap_authenticator_create_builder(ike_sa,
received_nonce, sent_init);
default:
return NULL;
}
@@ -63,19 +71,31 @@ authenticator_t *authenticator_create_from_class(ike_sa_t *ike_sa,
/**
* Described in header.
*/
authenticator_t *authenticator_create_from_method(ike_sa_t *ike_sa,
auth_method_t method)
authenticator_t *authenticator_create_verifier(
ike_sa_t *ike_sa, message_t *message,
chunk_t sent_nonce, chunk_t received_init)
{
switch (method)
auth_payload_t *auth_payload;
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
if (auth_payload == NULL)
{
return (authenticator_t*)eap_authenticator_create_verifier(ike_sa,
sent_nonce, received_init);
}
switch (auth_payload->get_auth_method(auth_payload))
{
case AUTH_RSA:
case AUTH_ECDSA_256:
case AUTH_ECDSA_384:
case AUTH_ECDSA_521:
return (authenticator_t*)pubkey_authenticator_create(ike_sa);
return (authenticator_t*)pubkey_authenticator_create_verifier(ike_sa,
sent_nonce, received_init);
case AUTH_PSK:
return (authenticator_t*)psk_authenticator_create(ike_sa);
return (authenticator_t*)psk_authenticator_create_verifier(ike_sa,
sent_nonce, received_init);
default:
return NULL;
}
}
src/charon/sa/authenticators/authenticator.h
+40 -41
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2008 Tobias Brunner
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -30,9 +30,8 @@ typedef enum auth_class_t auth_class_t;
typedef struct authenticator_t authenticator_t;
#include <library.h>
#include <config/auth_cfg.h>
#include <sa/ike_sa.h>
#include <config/peer_cfg.h>
#include <encoding/payloads/auth_payload.h>
/**
* Method to use for authentication, as defined in IKEv2.
@@ -84,6 +83,8 @@ extern enum_name_t *auth_method_names;
* certificate finally dictates wich method is used.
*/
enum auth_class_t {
/** any class acceptable */
AUTH_CLASS_ANY = 0,
/** authentication using public keys (RSA, ECDSA) */
AUTH_CLASS_PUBKEY = 1,
/** authentication using a pre-shared secrets */
@@ -100,66 +101,64 @@ extern enum_name_t *auth_class_names;
/**
* Authenticator interface implemented by the various authenticators.
*
* Currently the following two AUTH methods are supported:
* - shared key message integrity code
* - RSA digital signature
* - EAP using the EAP framework and one of the EAP plugins
* - ECDSA is supported using OpenSSL
* An authenticator implementation handles AUTH and EAP payloads. Received
* messages are passed to the process() method, to send authentication data
* the message is passed to the build() method.
*/
struct authenticator_t {
/**
* Verify a received authentication payload.
* Process an incoming message using the authenticator.
*
* @param ike_sa_init binary representation of received ike_sa_init
* @param my_nonce the sent nonce
* @param auth_payload authentication payload to verify
* @param message message containing authentication payloads
* @return
* - SUCCESS,
* - FAILED if verification failed
* - INVALID_ARG if auth_method does not match
* - NOT_FOUND if credentials not found
* - SUCCESS if authentication successful
* - FAILED if authentication failed
* - NEED_MORE if another exchange required
*/
status_t (*verify) (authenticator_t *this, chunk_t ike_sa_init,
chunk_t my_nonce, auth_payload_t *auth_payload);
status_t (*process)(authenticator_t *this, message_t *message);
/**
* Build an authentication payload to send to the other peer.
* Attach authentication data to an outgoing message.
*
* @param ike_sa_init binary representation of sent ike_sa_init
* @param other_nonce the received nonce
* @param auth_payload the resulting authentication payload
* @param message message to add authentication data to
* @return
* - SUCCESS,
* - NOT_FOUND if credentials not found
* - SUCCESS if authentication successful
* - FAILED if authentication failed
* - NEED_MORE if another exchange required
*/
status_t (*build) (authenticator_t *this, chunk_t ike_sa_init,
chunk_t other_nonce, auth_payload_t **auth_payload);
status_t (*build)(authenticator_t *this, message_t *message);
/**
* Destroys a authenticator_t object.
* Destroy authenticator instance.
*/
void (*destroy) (authenticator_t *this);
};
/**
* Creates an authenticator for the specified auth class (as configured).
* Create an authenticator to build signatures.
*
* @param ike_sa associated ike_sa
* @param class class of authentication to use
* @return authenticator_t object
* @param ike_sa associated ike_sa
* @param cfg authentication configuration
* @param received_nonce nonce received in IKE_SA_INIT
* @param sent_init sent IKE_SA_INIT message data
* @return authenticator, NULL if not supported
*/
authenticator_t *authenticator_create_from_class(ike_sa_t *ike_sa,
auth_class_t class);
authenticator_t *authenticator_create_builder(
ike_sa_t *ike_sa, auth_cfg_t *cfg,
chunk_t received_nonce, chunk_t sent_init);
/**
* Creates an authenticator for method (as received in payload).
* Create an authenticator to verify signatures.
*
* @param ike_sa associated ike_sa
* @param method method as found in payload
* @return authenticator_t object
* @param ike_sa associated ike_sa
* @param message message containing authentication data
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @return authenticator, NULL if not supported
*/
authenticator_t *authenticator_create_from_method(ike_sa_t *ike_sa,
auth_method_t method);
authenticator_t *authenticator_create_verifier(
ike_sa_t *ike_sa, message_t *message,
chunk_t sent_nonce, chunk_t received_init);
#endif /** AUTHENTICATOR_H_ @}*/
src/charon/sa/authenticators/eap/eap_manager.c
+10 -10
View File
@@ -65,9 +65,9 @@ struct private_eap_manager_t {
linked_list_t *methods;
/**
* mutex to lock methods
* rwlock to lock methods
*/
mutex_t *mutex;
rwlock_t *lock;
};
/**
@@ -84,9 +84,9 @@ static void add_method(private_eap_manager_t *this, eap_type_t type,
entry->role = role;
entry->constructor = constructor;
this->mutex->lock(this->mutex);
this->lock->write_lock(this->lock);
this->methods->insert_last(this->methods, entry);
this->mutex->unlock(this->mutex);
this->lock->unlock(this->lock);
}
/**
@@ -97,7 +97,7 @@ static void remove_method(private_eap_manager_t *this, eap_constructor_t constru
enumerator_t *enumerator;
eap_entry_t *entry;
this->mutex->lock(this->mutex);
this->lock->write_lock(this->lock);
enumerator = this->methods->create_enumerator(this->methods);
while (enumerator->enumerate(enumerator, &entry))
{
@@ -108,7 +108,7 @@ static void remove_method(private_eap_manager_t *this, eap_constructor_t constru
}
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
this->lock->unlock(this->lock);
}
/**
@@ -123,7 +123,7 @@ static eap_method_t* create_instance(private_eap_manager_t *this,
eap_entry_t *entry;
eap_method_t *method = NULL;
this->mutex->lock(this->mutex);
this->lock->read_lock(this->lock);
enumerator = this->methods->create_enumerator(this->methods);
while (enumerator->enumerate(enumerator, &entry))
{
@@ -138,7 +138,7 @@ static eap_method_t* create_instance(private_eap_manager_t *this,
}
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
this->lock->unlock(this->lock);
return method;
}
@@ -148,7 +148,7 @@ static eap_method_t* create_instance(private_eap_manager_t *this,
static void destroy(private_eap_manager_t *this)
{
this->methods->destroy_function(this->methods, free);
this->mutex->destroy(this->mutex);
this->lock->destroy(this->lock);
free(this);
}
@@ -165,7 +165,7 @@ eap_manager_t *eap_manager_create()
this->public.destroy = (void(*)(eap_manager_t*))destroy;
this->methods = linked_list_create();
this->mutex = mutex_create(MUTEX_DEFAULT);
this->lock = rwlock_create(RWLOCK_DEFAULT);
return &this->public;
}
src/charon/sa/authenticators/eap/eap_method.c
+33
View File
@@ -36,6 +36,36 @@ ENUM_NEXT(eap_type_names, EAP_RADIUS, EAP_EXPERIMENTAL, EAP_MSCHAPV2,
"EAP_EXPERIMENTAL");
ENUM_END(eap_type_names, EAP_EXPERIMENTAL);
/*
* See header
*/
eap_type_t eap_type_from_string(char *name)
{
int i;
static struct {
char *name;
eap_type_t type;
} types[] = {
{"identity", EAP_IDENTITY},
{"md5", EAP_MD5},
{"otp", EAP_OTP},
{"gtc", EAP_GTC},
{"sim", EAP_SIM},
{"aka", EAP_AKA},
{"mschapv2", EAP_MSCHAPV2},
{"radius", EAP_RADIUS},
};
for (i = 0; i < countof(types); i++)
{
if (strcasecmp(name, types[i].name) == 0)
{
return types[i].type;
}
}
return 0;
}
ENUM(eap_code_names, EAP_REQUEST, EAP_FAILURE,
"EAP_REQUEST",
"EAP_RESPONSE",
@@ -48,3 +78,6 @@ ENUM(eap_role_names, EAP_SERVER, EAP_PEER,
"EAP_PEER",
);
src/charon/sa/authenticators/eap/eap_method.h
+8 -1
View File
@@ -68,6 +68,14 @@ enum eap_type_t {
*/
extern enum_name_t *eap_type_names;
/**
* Lookup the EAP method type from a string.
*
* @param name EAP method name (such as "md5", "aka")
* @return method type, 0 if unkown
*/
eap_type_t eap_type_from_string(char *name);
/**
* EAP code, type of an EAP message
*/
@@ -83,7 +91,6 @@ enum eap_code_t {
*/
extern enum_name_t *eap_code_names;
/**
* Interface of an EAP method for server and client side.
*
src/charon/sa/authenticators/eap/sim_manager.h
+2 -2
View File
@@ -39,7 +39,7 @@ struct sim_card_t {
* The returned identity owned by the sim_card and not destroyed outside.
* The SIM card may return ID_ANY if it does not support/use an IMSI.
*
* @return identity of type ID_EAP/ID_ANY
* @return identity
*/
identification_t* (*get_imsi)(sim_card_t *this);
@@ -63,7 +63,7 @@ struct sim_provider_t {
/**
* Get a single triplet to authenticate a EAP client.
*
* @param imsi client identity of type ID_EAP
* @param imsi client identity
* @param rand RAND output buffer, fixed size 16 bytes
* @param sres SRES output buffer, fixed size 4 byte
* @param kc KC output buffer, fixed size 8 bytes
src/charon/sa/authenticators/eap_authenticator.c
+451 -374
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2006-2008 Martin Willi
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -15,13 +15,12 @@
* $Id$
*/
#include <string.h>
#include "eap_authenticator.h"
#include <daemon.h>
#include <config/peer_cfg.h>
#include <sa/authenticators/eap/eap_method.h>
#include <encoding/payloads/auth_payload.h>
#include <encoding/payloads/eap_payload.h>
typedef struct private_eap_authenticator_t private_eap_authenticator_t;
@@ -41,9 +40,14 @@ struct private_eap_authenticator_t {
ike_sa_t *ike_sa;
/**
* Role of this authenticator, PEER or SERVER
* nonce to include in AUTH calculation
*/
eap_role_t role;
chunk_t nonce;
/**
* IKE_SA_INIT message data to include in AUTH calculation
*/
chunk_t ike_sa_init;
/**
* Current EAP method processing
@@ -56,335 +60,169 @@ struct private_eap_authenticator_t {
chunk_t msk;
/**
* should we do a EAP-Identity exchange as server?
* EAP authentication method completed successfully
*/
bool do_eap_identity;
bool eap_complete;
/**
* saved EAP type if we do eap_identity
* authentication payload verified successfully
*/
eap_type_t type;
bool auth_complete;
/**
* saved vendor id if we do eap_identity
* generated EAP payload
*/
u_int32_t vendor;
eap_payload_t *eap_payload;
/**
* EAP identity of peer
*/
identification_t *eap_identity;
};
/**
* Implementation of authenticator_t.verify.
*/
static status_t verify(private_eap_authenticator_t *this, chunk_t ike_sa_init,
chunk_t my_nonce, auth_payload_t *auth_payload)
{
chunk_t auth_data, recv_auth_data;
identification_t *other_id;
keymat_t *keymat;
other_id = this->ike_sa->get_other_id(this->ike_sa);
keymat = this->ike_sa->get_keymat(this->ike_sa);
auth_data = keymat->get_psk_sig(keymat, TRUE, ike_sa_init, my_nonce,
this->msk, other_id);
recv_auth_data = auth_payload->get_data(auth_payload);
if (!auth_data.len || !chunk_equals(auth_data, recv_auth_data))
{
DBG1(DBG_IKE, "verification of AUTH payload created from EAP MSK failed");
chunk_free(&auth_data);
return FAILED;
}
chunk_free(&auth_data);
DBG1(DBG_IKE, "authentication of '%D' with %N successful",
other_id, auth_class_names, AUTH_CLASS_EAP);
return SUCCESS;
}
/**
* Implementation of authenticator_t.build.
*/
static status_t build(private_eap_authenticator_t *this, chunk_t ike_sa_init,
chunk_t other_nonce, auth_payload_t **auth_payload)
{
identification_t *my_id;
chunk_t auth_data;
keymat_t *keymat;
my_id = this->ike_sa->get_my_id(this->ike_sa);
keymat = this->ike_sa->get_keymat(this->ike_sa);
DBG1(DBG_IKE, "authentication of '%D' (myself) with %N",
my_id, auth_class_names, AUTH_CLASS_EAP);
auth_data = keymat->get_psk_sig(keymat, FALSE, ike_sa_init, other_nonce,
this->msk, my_id);
*auth_payload = auth_payload_create();
(*auth_payload)->set_auth_method(*auth_payload, AUTH_PSK);
(*auth_payload)->set_data(*auth_payload, auth_data);
chunk_free(&auth_data);
return SUCCESS;
}
/**
* get the peers identity to use in the EAP method
*/
static identification_t *get_peer_id(private_eap_authenticator_t *this)
{
identification_t *id;
peer_cfg_t *config;
auth_info_t *auth;
id = this->ike_sa->get_eap_identity(this->ike_sa);
if (!id)
{
config = this->ike_sa->get_peer_cfg(this->ike_sa);
auth = config->get_auth(config);
if (!auth->get_item(auth, AUTHN_EAP_IDENTITY, (void**)&id) ||
id->get_type(id) == ID_ANY)
{
if (this->role == EAP_PEER)
{
id = this->ike_sa->get_my_id(this->ike_sa);
}
else
{
id = this->ike_sa->get_other_id(this->ike_sa);
}
}
}
if (id->get_type(id) == ID_EAP)
{
return id->clone(id);
}
return identification_create_from_encoding(ID_EAP, id->get_encoding(id));
}
/**
* get the servers identity to use in the EAP method
*/
static identification_t *get_server_id(private_eap_authenticator_t *this)
{
identification_t *id;
if (this->role == EAP_SERVER)
{
id = this->ike_sa->get_my_id(this->ike_sa);
}
else
{
id = this->ike_sa->get_other_id(this->ike_sa);
}
if (id->get_type(id) == ID_EAP)
{
return id->clone(id);
}
return identification_create_from_encoding(ID_EAP, id->get_encoding(id));
}
/**
* load an EAP method using the correct identities
* load an EAP method
*/
static eap_method_t *load_method(private_eap_authenticator_t *this,
eap_type_t type, u_int32_t vendor, eap_role_t role)
{
identification_t *server, *peer;
eap_method_t *method;
server = get_server_id(this);
peer = get_peer_id(this);
method = charon->eap->create_instance(charon->eap, type, vendor, role,
server, peer);
server->destroy(server);
peer->destroy(peer);
return method;
}
/**
* Implementation of eap_authenticator_t.initiate
*/
static status_t initiate(private_eap_authenticator_t *this, eap_type_t type,
u_int32_t vendor, eap_payload_t **out)
{
/* if initiate() is called, role is always server */
this->role = EAP_SERVER;
if (this->do_eap_identity)
{ /* do an EAP-Identity request first */
this->type = type;
this->vendor = vendor;
vendor = 0;
type = EAP_IDENTITY;
}
if (type == 0)
if (role == EAP_SERVER)
{
DBG1(DBG_IKE,
"client requested EAP authentication, but configuration forbids it");
*out = eap_payload_create_code(EAP_FAILURE, 0);
return FAILED;
}
if (vendor)
{
DBG1(DBG_IKE, "requesting vendor specific EAP method %d-%d",
type, vendor);
server = this->ike_sa->get_my_id(this->ike_sa);
peer = this->ike_sa->get_other_id(this->ike_sa);
}
else
{
DBG1(DBG_IKE, "requesting EAP method %N", eap_type_names, type);
server = this->ike_sa->get_other_id(this->ike_sa);
peer = this->ike_sa->get_my_id(this->ike_sa);
}
this->method = load_method(this, type, vendor, this->role);
if (this->method == NULL)
if (this->eap_identity)
{
if (vendor == 0 && type == EAP_IDENTITY)
{
DBG1(DBG_IKE, "skipping %N, no implementation found",
eap_type_names, type);
this->do_eap_identity = FALSE;
return initiate(this, this->type, this->vendor, out);
}
DBG1(DBG_IKE, "configured EAP server method not supported, sending %N",
eap_code_names, EAP_FAILURE);
*out = eap_payload_create_code(EAP_FAILURE, 0);
return FAILED;
peer = this->eap_identity;
}
if (this->method->initiate(this->method, out) != NEED_MORE)
{
DBG1(DBG_IKE, "failed to initiate EAP exchange, sending %N",
eap_code_names, EAP_FAILURE);
*out = eap_payload_create_code(EAP_FAILURE, 0);
return FAILED;
}
return NEED_MORE;
return charon->eap->create_instance(charon->eap, type, vendor,
role, server, peer);
}
/**
* Processing method for a peer
* Initiate EAP conversation as server
*/
static status_t process_peer(private_eap_authenticator_t *this,
eap_payload_t *in, eap_payload_t **out)
static eap_payload_t* server_initiate_eap(private_eap_authenticator_t *this,
bool do_identity)
{
auth_cfg_t *auth;
eap_type_t type;
identification_t *id;
u_int32_t vendor;
eap_payload_t *out;
type = in->get_type(in, &vendor);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
if (!vendor && type == EAP_IDENTITY)
/* initiate EAP-Identity exchange if required */
if (!this->eap_identity && do_identity)
{
eap_method_t *method;
method = load_method(this, type, 0, EAP_PEER);
if (method == NULL || method->process(method, in, out) != SUCCESS)
id = auth->get(auth, AUTH_RULE_EAP_IDENTITY);
if (id)
{
DBG1(DBG_IKE, "EAP server requested %N, but unable to process",
eap_type_names, type);
DESTROY_IF(method);
return FAILED;
this->method = load_method(this, EAP_IDENTITY, 0, EAP_SERVER);
if (this->method)
{
if (this->method->initiate(this->method, &out) == NEED_MORE)
{
DBG1(DBG_IKE, "initiating EAP-Identity request");
return out;
}
this->method->destroy(this->method);
}
DBG1(DBG_IKE, "EAP-Identity request configured, but not supported");
}
DBG1(DBG_IKE, "EAP server requested %N", eap_type_names, type);
method->destroy(method);
return NEED_MORE;
}
/* create an eap_method for the first call */
if (this->method == NULL)
/* invoke real EAP method */
type = (uintptr_t)auth->get(auth, AUTH_RULE_EAP_TYPE);
vendor = (uintptr_t)auth->get(auth, AUTH_RULE_EAP_VENDOR);
this->method = load_method(this, type, vendor, EAP_SERVER);
if (this->method &&
this->method->initiate(this->method, &out) == NEED_MORE)
{
if (vendor)
{
DBG1(DBG_IKE, "EAP server requested vendor specific EAP method %d-%d",
type, vendor);
DBG1(DBG_IKE, "initiating EAP vendor type %d-%d", type, vendor);
}
else
{
DBG1(DBG_IKE, "EAP server requested %N authentication",
eap_type_names, type);
DBG1(DBG_IKE, "initiating %N", eap_type_names, type);
}
this->method = load_method(this, type, vendor, EAP_PEER);
if (this->method == NULL)
return out;
}
if (vendor)
{
DBG1(DBG_IKE, "initiating EAP vendor type %d-%d failed", type, vendor);
}
else
{
DBG1(DBG_IKE, "initiating %N failed", eap_type_names, type);
}
return eap_payload_create_code(EAP_FAILURE, 0);
}
/**
* Handle EAP exchange as server
*/
static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
eap_payload_t *in)
{
eap_type_t type, received_type;
u_int32_t vendor, received_vendor;
eap_payload_t *out;
auth_cfg_t *cfg;
if (in->get_code(in) != EAP_RESPONSE)
{
DBG1(DBG_IKE, "received %N, sending %N",
eap_code_names, in->get_code(in), eap_code_names, EAP_FAILURE);
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
}
type = this->method->get_type(this->method, &vendor);
received_type = in->get_type(in, &received_vendor);
if (type != received_type || vendor != received_vendor)
{
if (received_vendor == 0 && received_type == EAP_NAK)
{
DBG1(DBG_IKE, "EAP server requested unsupported "
"EAP method, sending EAP_NAK");
*out = eap_payload_create_nak(in->get_identifier(in));
return NEED_MORE;
DBG1(DBG_IKE, "received %N, sending %N",
eap_type_names, EAP_NAK, eap_code_names, EAP_FAILURE);
}
else
{
DBG1(DBG_IKE, "received invalid EAP response, sending %N",
eap_code_names, EAP_FAILURE);
}
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
}
type = this->method->get_type(this->method, &vendor);
switch (this->method->process(this->method, in, out))
switch (this->method->process(this->method, in, &out))
{
case NEED_MORE:
return NEED_MORE;
return out;
case SUCCESS:
if (vendor)
if (type == EAP_IDENTITY)
{
DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeded",
type, vendor);
}
else
{
DBG1(DBG_IKE, "EAP method %N succeeded", eap_type_names, type);
}
return SUCCESS;
case FAILED:
default:
if (vendor)
{
DBG1(DBG_IKE, "EAP vendor specific method %d-%d failed",
type, vendor);
}
else
{
DBG1(DBG_IKE, "EAP method %N failed",
eap_type_names, type);
}
return FAILED;
}
}
/**
* handle an EAP-Identity response on the server
*/
static status_t process_eap_identity(private_eap_authenticator_t *this,
eap_payload_t **out)
{
chunk_t data;
identification_t *id;
if (this->method->get_msk(this->method, &data) == SUCCESS)
{
id = identification_create_from_encoding(ID_EAP, data);
DBG1(DBG_IKE, "using EAP identity '%D'", id);
this->ike_sa->set_eap_identity(this->ike_sa, id);
}
/* restart EAP exchange, but with real method */
this->method->destroy(this->method);
this->method = NULL;
this->do_eap_identity = FALSE;
return initiate(this, this->type, this->vendor, out);
}
/**
* Processing method for a server
*/
static status_t process_server(private_eap_authenticator_t *this,
eap_payload_t *in, eap_payload_t **out)
{
eap_type_t type;
u_int32_t vendor;
type = this->method->get_type(this->method, &vendor);
switch (this->method->process(this->method, in, out))
{
case NEED_MORE:
return NEED_MORE;
case SUCCESS:
if (this->do_eap_identity)
{
return process_eap_identity(this, out);
chunk_t data;
char buf[256];
if (this->method->get_msk(this->method, &data) == SUCCESS)
{
snprintf(buf, sizeof(buf), "%.*s", data.len, data.ptr);
this->eap_identity = identification_create_from_string(buf);
DBG1(DBG_IKE, "received EAP identity '%D'",
this->eap_identity);
}
/* restart EAP exchange, but with real method */
this->method->destroy(this->method);
return server_initiate_eap(this, FALSE);
}
if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
{
@@ -392,17 +230,25 @@ static status_t process_server(private_eap_authenticator_t *this,
}
if (vendor)
{
DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeded, "
DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeeded, "
"%sMSK established", type, vendor,
this->msk.ptr ? "" : "no ");
}
else
{
DBG1(DBG_IKE, "EAP method %N succeded, %sMSK established",
DBG1(DBG_IKE, "EAP method %N succeeded, %sMSK established",
eap_type_names, type, this->msk.ptr ? "" : "no ");
}
*out = eap_payload_create_code(EAP_SUCCESS, in->get_identifier(in));
return SUCCESS;
this->ike_sa->set_condition(this->ike_sa, COND_EAP_AUTHENTICATED,
TRUE);
cfg = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
cfg->add(cfg, AUTH_RULE_EAP_TYPE, type);
if (vendor)
{
cfg->add(cfg, AUTH_RULE_EAP_VENDOR, vendor);
}
this->eap_complete = TRUE;
return eap_payload_create_code(EAP_SUCCESS, in->get_identifier(in));
case FAILED:
default:
if (vendor)
@@ -413,85 +259,310 @@ static status_t process_server(private_eap_authenticator_t *this,
}
else
{
DBG1(DBG_IKE, "EAP method %N failed for peer '%D'",
DBG1(DBG_IKE, "EAP method %N failed for peer %D",
eap_type_names, type,
this->ike_sa->get_other_id(this->ike_sa));
}
*out = eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
return FAILED;
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
}
}
/**
* Implementation of eap_authenticator_t.process
* Processing method for a peer
*/
static status_t process(private_eap_authenticator_t *this, eap_payload_t *in,
eap_payload_t **out)
static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
eap_payload_t *in)
{
eap_code_t code = in->get_code(in);
eap_type_t type;
u_int32_t vendor;
auth_cfg_t *auth;
eap_payload_t *out;
identification_t *id;
switch (this->role)
type = in->get_type(in, &vendor);
if (!vendor && type == EAP_IDENTITY)
{
case EAP_SERVER:
DESTROY_IF(this->eap_identity);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
id = auth->get(auth, AUTH_RULE_EAP_IDENTITY);
if (!id || id->get_type(id) == ID_ANY)
{
switch (code)
{
case EAP_RESPONSE:
{
return process_server(this, in, out);
}
default:
{
DBG1(DBG_IKE, "received %N, sending %N",
eap_code_names, code, eap_code_names, EAP_FAILURE);
*out = eap_payload_create_code(EAP_FAILURE,
in->get_identifier(in));
return FAILED;
}
}
id = this->ike_sa->get_my_id(this->ike_sa);
}
case EAP_PEER:
DBG1(DBG_IKE, "server requested %N, sending '%D'",
eap_type_names, type, id);
this->eap_identity = id->clone(id);
this->method = load_method(this, type, vendor, EAP_PEER);
if (this->method)
{
switch (code)
if (this->method->process(this->method, in, &out) == SUCCESS)
{
case EAP_REQUEST:
{
return process_peer(this, in, out);
}
case EAP_SUCCESS:
{
if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
{
this->msk = chunk_clone(this->msk);
}
return SUCCESS;
}
case EAP_FAILURE:
default:
{
DBG1(DBG_IKE, "received %N, EAP authentication failed",
eap_code_names, code);
return FAILED;
}
this->method->destroy(this->method);
this->method = NULL;
return out;
}
this->method->destroy(this->method);
this->method = NULL;
}
default:
DBG1(DBG_IKE, "%N not supported, sending EAP_NAK",
eap_type_names, type);
return eap_payload_create_nak(in->get_identifier(in));
}
if (this->method == NULL)
{
if (vendor)
{
return FAILED;
DBG1(DBG_IKE, "server requested vendor specific EAP method %d-%d",
type, vendor);
}
else
{
DBG1(DBG_IKE, "server requested %N authentication",
eap_type_names, type);
}
this->method = load_method(this, type, vendor, EAP_PEER);
if (!this->method)
{
DBG1(DBG_IKE, "EAP method not supported, sending EAP_NAK");
return eap_payload_create_nak(in->get_identifier(in));
}
}
type = this->method->get_type(this->method, &vendor);
if (this->method->process(this->method, in, &out) == NEED_MORE)
{ /* client methods should never return SUCCESS */
return out;
}
if (vendor)
{
DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed", type, vendor);
}
else
{
DBG1(DBG_IKE, "%N method failed", eap_type_names, type);
}
return NULL;
}
/**
* Implementation of authenticator_t.is_mutual.
* Verify AUTH payload
*/
static bool is_mutual(private_eap_authenticator_t *this)
static bool verify_auth(private_eap_authenticator_t *this, message_t *message)
{
if (this->method)
auth_payload_t *auth_payload;
chunk_t auth_data, recv_auth_data;
identification_t *other_id;
auth_cfg_t *auth;
keymat_t *keymat;
auth_payload = (auth_payload_t*)message->get_payload(message,
AUTHENTICATION);
if (!auth_payload)
{
return this->method->is_mutual(this->method);
DBG1(DBG_IKE, "AUTH payload missing");
return FALSE;
}
return FALSE;
other_id = this->ike_sa->get_other_id(this->ike_sa);
keymat = this->ike_sa->get_keymat(this->ike_sa);
auth_data = keymat->get_psk_sig(keymat, TRUE, this->ike_sa_init,
this->nonce, this->msk, other_id);
recv_auth_data = auth_payload->get_data(auth_payload);
if (!auth_data.len || !chunk_equals(auth_data, recv_auth_data))
{
DBG1(DBG_IKE, "verification of AUTH payload with%s EAP MSK failed",
this->msk.ptr ? "" : "out");
chunk_free(&auth_data);
return FALSE;
}
chunk_free(&auth_data);
DBG1(DBG_IKE, "authentication of '%D' with %N successful",
other_id, auth_class_names, AUTH_CLASS_EAP);
this->auth_complete = TRUE;
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
return TRUE;
}
/**
* Build AUTH payload
*/
static void build_auth(private_eap_authenticator_t *this, message_t *message)
{
auth_payload_t *auth_payload;
identification_t *my_id;
chunk_t auth_data;
keymat_t *keymat;
my_id = this->ike_sa->get_my_id(this->ike_sa);
keymat = this->ike_sa->get_keymat(this->ike_sa);
DBG1(DBG_IKE, "authentication of '%D' (myself) with %N",
my_id, auth_class_names, AUTH_CLASS_EAP);
auth_data = keymat->get_psk_sig(keymat, FALSE, this->ike_sa_init,
this->nonce, this->msk, my_id);
auth_payload = auth_payload_create();
auth_payload->set_auth_method(auth_payload, AUTH_PSK);
auth_payload->set_data(auth_payload, auth_data);
message->add_payload(message, (payload_t*)auth_payload);
chunk_free(&auth_data);
}
/**
* Implementation of authenticator_t.process for a server
*/
static status_t process_server(private_eap_authenticator_t *this,
message_t *message)
{
eap_payload_t *eap_payload;
if (this->eap_complete)
{
if (!verify_auth(this, message))
{
return FAILED;
}
return NEED_MORE;
}
if (!this->method)
{
this->eap_payload = server_initiate_eap(this, TRUE);
}
else
{
eap_payload = (eap_payload_t*)message->get_payload(message,
EXTENSIBLE_AUTHENTICATION);
if (!eap_payload)
{
return FAILED;
}
this->eap_payload = server_process_eap(this, eap_payload);
}
return NEED_MORE;
}
/**
* Implementation of authenticator_t.build for a server
*/
static status_t build_server(private_eap_authenticator_t *this,
message_t *message)
{
if (this->eap_payload)
{
eap_code_t code;
code = this->eap_payload->get_code(this->eap_payload);
message->add_payload(message, (payload_t*)this->eap_payload);
this->eap_payload = NULL;
if (code == EAP_FAILURE)
{
return FAILED;
}
return NEED_MORE;
}
if (this->eap_complete && this->auth_complete)
{
build_auth(this, message);
return SUCCESS;
}
return FAILED;
}
/**
* Implementation of authenticator_t.process for a client
*/
static status_t process_client(private_eap_authenticator_t *this,
message_t *message)
{
eap_payload_t *eap_payload;
if (this->eap_complete)
{
if (!verify_auth(this, message))
{
return FAILED;
}
return SUCCESS;
}
eap_payload = (eap_payload_t*)message->get_payload(message,
EXTENSIBLE_AUTHENTICATION);
if (eap_payload)
{
switch (eap_payload->get_code(eap_payload))
{
case EAP_REQUEST:
{
this->eap_payload = client_process_eap(this, eap_payload);
return NEED_MORE;
}
case EAP_SUCCESS:
{
eap_type_t type;
u_int32_t vendor;
auth_cfg_t *cfg;
if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
{
this->msk = chunk_clone(this->msk);
}
type = this->method->get_type(this->method, &vendor);
if (vendor)
{
DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeeded, "
"%sMSK established", type, vendor,
this->msk.ptr ? "" : "no ");
}
else
{
DBG1(DBG_IKE, "EAP method %N succeeded, %sMSK established",
eap_type_names, type, this->msk.ptr ? "" : "no ");
}
cfg = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
cfg->add(cfg, AUTH_RULE_EAP_TYPE, type);
if (vendor)
{
cfg->add(cfg, AUTH_RULE_EAP_VENDOR, vendor);
}
this->eap_complete = TRUE;
return NEED_MORE;
}
case EAP_FAILURE:
default:
{
DBG1(DBG_IKE, "received %N, EAP authentication failed",
eap_code_names, eap_payload->get_code(eap_payload));
return FAILED;
}
}
}
return FAILED;
}
/**
* Implementation of authenticator_t.build for a client
*/
static status_t build_client(private_eap_authenticator_t *this,
message_t *message)
{
if (this->eap_payload)
{
message->add_payload(message, (payload_t*)this->eap_payload);
this->eap_payload = NULL;
return NEED_MORE;
}
if (this->eap_complete)
{
build_auth(this, message);
return NEED_MORE;
}
return NEED_MORE;
}
/**
@@ -500,6 +571,8 @@ static bool is_mutual(private_eap_authenticator_t *this)
static void destroy(private_eap_authenticator_t *this)
{
DESTROY_IF(this->method);
DESTROY_IF(this->eap_payload);
DESTROY_IF(this->eap_identity);
chunk_free(&this->msk);
free(this);
}
@@ -507,46 +580,50 @@ static void destroy(private_eap_authenticator_t *this)
/*
* Described in header.
*/
eap_authenticator_t *eap_authenticator_create(ike_sa_t *ike_sa)
eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init)
{
peer_cfg_t *config;
auth_info_t *auth;
identification_t *id;
private_eap_authenticator_t *this = malloc_thing(private_eap_authenticator_t);
/* public functions */
this->public.authenticator_interface.verify = (status_t(*)(authenticator_t*,chunk_t,chunk_t,auth_payload_t*))verify;
this->public.authenticator_interface.build = (status_t(*)(authenticator_t*,chunk_t,chunk_t,auth_payload_t**))build;
this->public.authenticator_interface.destroy = (void(*)(authenticator_t*))destroy;
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build_client;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process_client;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
this->public.is_mutual = (bool(*)(eap_authenticator_t*))is_mutual;
this->public.initiate = (status_t(*)(eap_authenticator_t*,eap_type_t,u_int32_t,eap_payload_t**))initiate;
this->public.process = (status_t(*)(eap_authenticator_t*,eap_payload_t*,eap_payload_t**))process;
/* private data */
this->ike_sa = ike_sa;
this->role = EAP_PEER;
this->method = NULL;
this->ike_sa_init = sent_init;
this->nonce = received_nonce;
this->msk = chunk_empty;
this->do_eap_identity = FALSE;
this->type = 0;
this->vendor = 0;
this->method = NULL;
this->eap_payload = NULL;
this->eap_complete = FALSE;
this->auth_complete = FALSE;
this->eap_identity = NULL;
config = ike_sa->get_peer_cfg(ike_sa);
if (config)
{
auth = config->get_auth(config);
if (auth->get_item(auth, AUTHN_EAP_IDENTITY, (void**)&id))
{
if (id->get_type(id) == ID_ANY)
{ /* %any as configured EAP identity runs EAP-Identity first */
this->do_eap_identity = TRUE;
}
else
{
ike_sa->set_eap_identity(ike_sa, id->clone(id));
}
}
}
return &this->public;
}
/*
* Described in header.
*/
eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init)
{
private_eap_authenticator_t *this = malloc_thing(private_eap_authenticator_t);
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *messageh))build_server;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process_server;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
this->ike_sa = ike_sa;
this->ike_sa_init = received_init;
this->nonce = sent_nonce;
this->msk = chunk_empty;
this->method = NULL;
this->eap_payload = NULL;
this->eap_complete = FALSE;
this->auth_complete = FALSE;
this->eap_identity = NULL;
return &this->public;
}
src/charon/sa/authenticators/eap_authenticator.h
+26 -79
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2006 Martin Willi
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -26,21 +26,13 @@
typedef struct eap_authenticator_t eap_authenticator_t;
#include <sa/authenticators/authenticator.h>
#include <encoding/payloads/eap_payload.h>
/**
* Implementation of the authenticator_t interface using AUTH_CLASS_EAP.
* Implementation of authenticator_t using EAP authentication.
*
* Authentication using EAP involves the most complex authenticator. It stays
* alive over multiple ike_auth transactions and handles multiple EAP
* messages.
* EAP authentication must be clearly distinguished between using
* mutual EAP methods and using methods not providing server authentication.
* If no mutual authentication is used, the server must prove it's identity
* by traditional AUTH methods (RSA, psk). Only when the EAP method is mutual,
* the client should accept an EAP-only authentication.
* RFC4306 does always use traditional authentiction, EAP only authentication
* is described in the internet draft draft-eronen-ipsec-ikev2-eap-auth-05.txt.
*
* @verbatim
ike_sa_init
@@ -49,12 +41,12 @@ typedef struct eap_authenticator_t eap_authenticator_t;
followed by multiple ike_auth:
+--------+ +--------+
| EAP | ID, SA, TS, N(EAP_ONLY) | EAP |
| EAP | IDi, [IDr,] SA, TS | EAP |
| client | ---------------------------> | server |
| | ID, [AUTH,] EAP | | AUTH payload is
| | <--------------------------- | | only included if
| | EAP | | authentication
| | ---------------------------> | | is not mutual.
| | ID, AUTH, EAP | |
| | <--------------------------- | |
| | EAP | |
| | ---------------------------> | |
| | EAP | |
| | <--------------------------- | |
| | EAP | |
@@ -74,74 +66,29 @@ struct eap_authenticator_t {
/**
* Implemented authenticator_t interface.
*/
authenticator_t authenticator_interface;
/**
* Check if the EAP method was/is mutual and secure.
*
* RFC4306 proposes to authenticate the EAP responder (server) by standard
* IKEv2 methods (RSA, psk). Not all, but some EAP methods
* provide mutual authentication, which would result in a redundant
* authentication. If the client supports EAP_ONLY_AUTHENTICATION, and
* the the server provides mutual authentication, authentication using
* RSA/PSK may be omitted. If the server did not include a traditional
* AUTH payload, the client must verify that the server initiated mutual
* EAP authentication before it can trust the server.
*
* @return TRUE, if no AUTH payload required, FALSE otherwise
*/
bool (*is_mutual) (eap_authenticator_t* this);
/**
* Initiate the EAP exchange.
*
* The server initiates EAP exchanges, so the client never calls
* this method. If initiate() returns NEED_MORE, the EAP authentication
* process started. In any case, a payload is created in "out".
*
* @param type EAP method to use to authenticate client
* @param vendor EAP vendor identifier, if type is vendor specific, or 0
* @param out created initiaal EAP message to send
* @return
* - FAILED, if initiation failed
* - NEED_MORE, if more EAP exchanges reqired
*/
status_t (*initiate) (eap_authenticator_t* this, eap_type_t type,
u_int32_t vendor, eap_payload_t **out);
/**
* Process an EAP message.
*
* After receiving an EAP message "in", the peer/server processes
* the payload and creates a reply/subsequent request.
* The server side always returns NEED_MORE if another EAP message
* is expected from the client, SUCCESS if EAP exchange completed and
* "out" is EAP_SUCCES, or FAILED if the EAP exchange failed with
* a EAP_FAILURE payload in "out". Anyway, a payload in "out" is always
* created.
* The peer (client) side only creates a "out" payload if result is
* NEED_MORE, a SUCCESS/FAILED is returned whenever a
* EAP_SUCCESS/EAP_FAILURE message is received in "in".
* If a SUCCESS is returned (on any side), the EAP authentication was
* successful and the AUTH payload can be exchanged.
*
* @param in received EAP message
* @param out created EAP message to send
* @return
* - FAILED, if authentication/EAP exchange failed
* - SUCCESS, if authentication completed
* - NEED_MORE, if more EAP exchanges reqired
*/
status_t (*process) (eap_authenticator_t* this,
eap_payload_t *in, eap_payload_t **out);
authenticator_t authenticator;
};
/**
* Creates an authenticator for AUTH_CLASS_EAP.
* Create an authenticator to authenticate against an EAP server.
*
* @param ike_sa associated ike_sa
* @return eap_authenticator_t object
* @param ike_sa associated ike_sa
* @param received_nonce nonce received in IKE_SA_INIT
* @param sent_init sent IKE_SA_INIT message data
* @return EAP authenticator
*/
eap_authenticator_t *eap_authenticator_create(ike_sa_t *ike_sa);
eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init);
/**
* Create an authenticator to authenticate EAP clients.
*
* @param ike_sa associated ike_sa
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @return EAP authenticator
*/
eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init);
#endif /** EAP_AUTHENTICATOR_H_ @}*/
src/charon/sa/authenticators/psk_authenticator.c
+94 -47
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -16,13 +16,10 @@
* $Id$
*/
#include <string.h>
#include "psk_authenticator.h"
#include <daemon.h>
#include <credentials/auth_info.h>
#include <encoding/payloads/auth_payload.h>
typedef struct private_psk_authenticator_t private_psk_authenticator_t;
@@ -40,22 +37,74 @@ struct private_psk_authenticator_t {
* Assigned IKE_SA
*/
ike_sa_t *ike_sa;
/**
* nonce to include in AUTH calculation
*/
chunk_t nonce;
/**
* IKE_SA_INIT message data to include in AUTH calculation
*/
chunk_t ike_sa_init;
};
/**
* Implementation of authenticator_t.verify.
/*
* Implementation of authenticator_t.build for builder
*/
static status_t verify(private_psk_authenticator_t *this, chunk_t ike_sa_init,
chunk_t my_nonce, auth_payload_t *auth_payload)
static status_t build(private_psk_authenticator_t *this, message_t *message)
{
identification_t *my_id, *other_id;
auth_payload_t *auth_payload;
shared_key_t *key;
chunk_t auth_data;
keymat_t *keymat;
keymat = this->ike_sa->get_keymat(this->ike_sa);
my_id = this->ike_sa->get_my_id(this->ike_sa);
other_id = this->ike_sa->get_other_id(this->ike_sa);
DBG1(DBG_IKE, "authentication of '%D' (myself) with %N",
my_id, auth_method_names, AUTH_PSK);
key = charon->credentials->get_shared(charon->credentials, SHARED_IKE,
my_id, other_id);
if (key == NULL)
{
DBG1(DBG_IKE, "no shared key found for '%D' - '%D'", my_id, other_id);
return NOT_FOUND;
}
auth_data = keymat->get_psk_sig(keymat, FALSE, this->ike_sa_init,
this->nonce, key->get_key(key), my_id);
key->destroy(key);
DBG2(DBG_IKE, "successfully created shared key MAC");
auth_payload = auth_payload_create();
auth_payload->set_auth_method(auth_payload, AUTH_PSK);
auth_payload->set_data(auth_payload, auth_data);
chunk_free(&auth_data);
message->add_payload(message, (payload_t*)auth_payload);
return SUCCESS;
}
/**
* Implementation of authenticator_t.process for verifier
*/
static status_t process(private_psk_authenticator_t *this, message_t *message)
{
chunk_t auth_data, recv_auth_data;
identification_t *my_id, *other_id;
auth_payload_t *auth_payload;
auth_cfg_t *auth;
shared_key_t *key;
enumerator_t *enumerator;
bool authenticated = FALSE;
int keys_found = 0;
keymat_t *keymat;
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
if (!auth_payload)
{
return FAILED;
}
keymat = this->ike_sa->get_keymat(this->ike_sa);
recv_auth_data = auth_payload->get_data(auth_payload);
my_id = this->ike_sa->get_my_id(this->ike_sa);
@@ -66,8 +115,8 @@ static status_t verify(private_psk_authenticator_t *this, chunk_t ike_sa_init,
{
keys_found++;
auth_data = keymat->get_psk_sig(keymat, TRUE, ike_sa_init, my_nonce,
key->get_key(key), other_id);
auth_data = keymat->get_psk_sig(keymat, TRUE, this->ike_sa_init,
this->nonce, key->get_key(key), other_id);
if (auth_data.len && chunk_equals(auth_data, recv_auth_data))
{
DBG1(DBG_IKE, "authentication of '%D' with %N successful",
@@ -89,42 +138,19 @@ static status_t verify(private_psk_authenticator_t *this, chunk_t ike_sa_init,
keys_found, keys_found == 1 ? "" : "s", my_id, other_id);
return FAILED;
}
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
return SUCCESS;
}
/**
* Implementation of authenticator_t.build.
* Implementation of authenticator_t.process for builder
* Implementation of authenticator_t.build for verifier
*/
static status_t build(private_psk_authenticator_t *this, chunk_t ike_sa_init,
chunk_t other_nonce, auth_payload_t **auth_payload)
static status_t return_failed()
{
identification_t *my_id, *other_id;
shared_key_t *key;
chunk_t auth_data;
keymat_t *keymat;
keymat = this->ike_sa->get_keymat(this->ike_sa);
my_id = this->ike_sa->get_my_id(this->ike_sa);
other_id = this->ike_sa->get_other_id(this->ike_sa);
DBG1(DBG_IKE, "authentication of '%D' (myself) with %N",
my_id, auth_method_names, AUTH_PSK);
key = charon->credentials->get_shared(charon->credentials, SHARED_IKE,
my_id, other_id);
if (key == NULL)
{
DBG1(DBG_IKE, "no shared key found for '%D' - '%D'", my_id, other_id);
return NOT_FOUND;
}
auth_data = keymat->get_psk_sig(keymat, FALSE, ike_sa_init, other_nonce,
key->get_key(key), my_id);
key->destroy(key);
DBG2(DBG_IKE, "successfully created shared key MAC");
*auth_payload = auth_payload_create();
(*auth_payload)->set_auth_method(*auth_payload, AUTH_PSK);
(*auth_payload)->set_data(*auth_payload, auth_data);
chunk_free(&auth_data);
return SUCCESS;
return FAILED;
}
/**
@@ -138,17 +164,38 @@ static void destroy(private_psk_authenticator_t *this)
/*
* Described in header.
*/
psk_authenticator_t *psk_authenticator_create(ike_sa_t *ike_sa)
psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init)
{
private_psk_authenticator_t *this = malloc_thing(private_psk_authenticator_t);
/* public functions */
this->public.authenticator_interface.verify = (status_t(*)(authenticator_t*,chunk_t,chunk_t,auth_payload_t*))verify;
this->public.authenticator_interface.build = (status_t(*)(authenticator_t*,chunk_t,chunk_t,auth_payload_t**))build;
this->public.authenticator_interface.destroy = (void(*)(authenticator_t*))destroy;
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))return_failed;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
/* private data */
this->ike_sa = ike_sa;
this->ike_sa_init = sent_init;
this->nonce = received_nonce;
return &this->public;
}
/*
* Described in header.
*/
psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init)
{
private_psk_authenticator_t *this = malloc_thing(private_psk_authenticator_t);
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *messageh))return_failed;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
this->ike_sa = ike_sa;
this->ike_sa_init = received_init;
this->nonce = sent_nonce;
return &this->public;
}
src/charon/sa/authenticators/psk_authenticator.h
+21 -7
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2006 Martin Willi
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -28,22 +28,36 @@ typedef struct psk_authenticator_t psk_authenticator_t;
#include <sa/authenticators/authenticator.h>
/**
* Implementation of the authenticator_t interface using AUTH_PSK.
* Implementation of authenticator_t using pre-shared keys.
*/
struct psk_authenticator_t {
/**
* Implemented authenticator_t interface.
*/
authenticator_t authenticator_interface;
authenticator_t authenticator;
};
/**
* Creates an authenticator for AUTH_PSK.
* Create an authenticator to build PSK signatures.
*
* @param ike_sa associated ike_sa
* @return psk_authenticator_t object
* @param ike_sa associated ike_sa
* @param received_nonce nonce received in IKE_SA_INIT
* @param sent_init sent IKE_SA_INIT message data
* @return PSK authenticator
*/
psk_authenticator_t *psk_authenticator_create(ike_sa_t *ike_sa);
psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init);
/**
* Create an authenticator to verify PSK signatures.
*
* @param ike_sa associated ike_sa
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @return PSK authenticator
*/
psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init);
#endif /** PSK_AUTHENTICATOR_H_ @}*/
src/charon/sa/authenticators/pubkey_authenticator.c
+136 -87
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2008 Tobias Brunner
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -17,13 +17,10 @@
* $Id$
*/
#include <string.h>
#include "pubkey_authenticator.h"
#include <daemon.h>
#include <credentials/auth_info.h>
#include <encoding/payloads/auth_payload.h>
typedef struct private_pubkey_authenticator_t private_pubkey_authenticator_t;
@@ -41,90 +38,35 @@ struct private_pubkey_authenticator_t {
* Assigned IKE_SA
*/
ike_sa_t *ike_sa;
/**
* nonce to include in AUTH calculation
*/
chunk_t nonce;
/**
* IKE_SA_INIT message data to include in AUTH calculation
*/
chunk_t ike_sa_init;
};
/**
* Implementation of authenticator_t.verify.
* Implementation of authenticator_t.build for builder
*/
static status_t verify(private_pubkey_authenticator_t *this, chunk_t ike_sa_init,
chunk_t my_nonce, auth_payload_t *auth_payload)
{
public_key_t *public;
auth_method_t auth_method;
chunk_t auth_data, octets;
identification_t *id;
auth_info_t *auth, *current_auth;
enumerator_t *enumerator;
key_type_t key_type = KEY_ECDSA;
signature_scheme_t scheme;
status_t status = FAILED;
keymat_t *keymat;
id = this->ike_sa->get_other_id(this->ike_sa);
auth_method = auth_payload->get_auth_method(auth_payload);
switch (auth_method)
{
case AUTH_RSA:
/* We are currently fixed to SHA1 hashes.
* TODO: allow other hash algorithms and note it in "auth" */
key_type = KEY_RSA;
scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
break;
case AUTH_ECDSA_256:
scheme = SIGN_ECDSA_256;
break;
case AUTH_ECDSA_384:
scheme = SIGN_ECDSA_384;
break;
case AUTH_ECDSA_521:
scheme = SIGN_ECDSA_521;
break;
default:
return INVALID_ARG;
}
auth_data = auth_payload->get_data(auth_payload);
keymat = this->ike_sa->get_keymat(this->ike_sa);
octets = keymat->get_auth_octets(keymat, TRUE, ike_sa_init, my_nonce, id);
auth = this->ike_sa->get_other_auth(this->ike_sa);
enumerator = charon->credentials->create_public_enumerator(
charon->credentials, key_type, id, auth);
while (enumerator->enumerate(enumerator, &public, &current_auth))
{
if (public->verify(public, scheme, octets, auth_data))
{
DBG1(DBG_IKE, "authentication of '%D' with %N successful",
id, auth_method_names, auth_method);
status = SUCCESS;
auth->merge(auth, current_auth);
break;
}
else
{
DBG1(DBG_IKE, "signature validation failed, looking for another key");
}
}
enumerator->destroy(enumerator);
chunk_free(&octets);
return status;
}
/**
* Implementation of authenticator_t.build.
*/
static status_t build(private_pubkey_authenticator_t *this, chunk_t ike_sa_init,
chunk_t other_nonce, auth_payload_t **auth_payload)
static status_t build(private_pubkey_authenticator_t *this, message_t *message)
{
chunk_t octets, auth_data;
status_t status = FAILED;
private_key_t *private;
identification_t *id;
auth_info_t *auth;
auth_cfg_t *auth;
auth_payload_t *auth_payload;
auth_method_t auth_method;
signature_scheme_t scheme;
keymat_t *keymat;
id = this->ike_sa->get_my_id(this->ike_sa);
auth = this->ike_sa->get_my_auth(this->ike_sa);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
private = charon->credentials->get_private(charon->credentials, KEY_ANY,
id, auth);
if (private == NULL)
@@ -169,15 +111,15 @@ static status_t build(private_pubkey_authenticator_t *this, chunk_t ike_sa_init,
return status;
}
keymat = this->ike_sa->get_keymat(this->ike_sa);
octets = keymat->get_auth_octets(keymat, FALSE, ike_sa_init, other_nonce, id);
octets = keymat->get_auth_octets(keymat, FALSE, this->ike_sa_init,
this->nonce, id);
if (private->sign(private, scheme, octets, &auth_data))
{
auth_payload_t *payload = auth_payload_create();
payload->set_auth_method(payload, auth_method);
payload->set_data(payload, auth_data);
*auth_payload = payload;
auth_payload = auth_payload_create();
auth_payload->set_auth_method(auth_payload, auth_method);
auth_payload->set_data(auth_payload, auth_data);
chunk_free(&auth_data);
message->add_payload(message, (payload_t*)auth_payload);
status = SUCCESS;
}
DBG1(DBG_IKE, "authentication of '%D' (myself) with %N %s", id,
@@ -189,6 +131,93 @@ static status_t build(private_pubkey_authenticator_t *this, chunk_t ike_sa_init,
return status;
}
/**
* Implementation of authenticator_t.process for verifier
*/
static status_t process(private_pubkey_authenticator_t *this, message_t *message)
{
public_key_t *public;
auth_method_t auth_method;
auth_payload_t *auth_payload;
chunk_t auth_data, octets;
identification_t *id;
auth_cfg_t *auth, *current_auth;
enumerator_t *enumerator;
key_type_t key_type = KEY_ECDSA;
signature_scheme_t scheme;
status_t status = NOT_FOUND;
keymat_t *keymat;
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
if (!auth_payload)
{
return FAILED;
}
auth_method = auth_payload->get_auth_method(auth_payload);
switch (auth_method)
{
case AUTH_RSA:
/* We currently accept SHA1 signatures only
* TODO: allow other hash algorithms and note it in "auth" */
key_type = KEY_RSA;
scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
break;
case AUTH_ECDSA_256:
scheme = SIGN_ECDSA_256;
break;
case AUTH_ECDSA_384:
scheme = SIGN_ECDSA_384;
break;
case AUTH_ECDSA_521:
scheme = SIGN_ECDSA_521;
break;
default:
return INVALID_ARG;
}
auth_data = auth_payload->get_data(auth_payload);
id = this->ike_sa->get_other_id(this->ike_sa);
keymat = this->ike_sa->get_keymat(this->ike_sa);
octets = keymat->get_auth_octets(keymat, TRUE, this->ike_sa_init,
this->nonce, id);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
enumerator = charon->credentials->create_public_enumerator(
charon->credentials, key_type, id, auth);
while (enumerator->enumerate(enumerator, &public, &current_auth))
{
if (public->verify(public, scheme, octets, auth_data))
{
DBG1(DBG_IKE, "authentication of '%D' with %N successful",
id, auth_method_names, auth_method);
status = SUCCESS;
auth->merge(auth, current_auth, FALSE);
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
break;
}
else
{
status = FAILED;
DBG1(DBG_IKE, "signature validation failed, looking for another key");
}
}
enumerator->destroy(enumerator);
chunk_free(&octets);
if (status == NOT_FOUND)
{
DBG1(DBG_IKE, "no trusted %N public key found for '%D'",
key_type_names, key_type, id);
}
return status;
}
/**
* Implementation of authenticator_t.process for builder
* Implementation of authenticator_t.build for verifier
*/
static status_t return_failed()
{
return FAILED;
}
/**
* Implementation of authenticator_t.destroy.
*/
@@ -200,17 +229,37 @@ static void destroy(private_pubkey_authenticator_t *this)
/*
* Described in header.
*/
pubkey_authenticator_t *pubkey_authenticator_create(ike_sa_t *ike_sa)
pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init)
{
private_pubkey_authenticator_t *this = malloc_thing(private_pubkey_authenticator_t);
/* public functions */
this->public.authenticator_interface.verify = (status_t(*)(authenticator_t*,chunk_t,chunk_t,auth_payload_t*))verify;
this->public.authenticator_interface.build = (status_t(*)(authenticator_t*,chunk_t,chunk_t,auth_payload_t**))build;
this->public.authenticator_interface.destroy = (void(*)(authenticator_t*))destroy;
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))return_failed;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
/* private data */
this->ike_sa = ike_sa;
this->ike_sa_init = sent_init;
this->nonce = received_nonce;
return &this->public;
}
/*
* Described in header.
*/
pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init)
{
private_pubkey_authenticator_t *this = malloc_thing(private_pubkey_authenticator_t);
this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))return_failed;
this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process;
this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
this->ike_sa = ike_sa;
this->ike_sa_init = received_init;
this->nonce = sent_nonce;
return &this->public;
}
src/charon/sa/authenticators/pubkey_authenticator.h
+21 -7
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2008 Tobias Brunner
* Copyright (C) 2006 Martin Willi
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -29,22 +29,36 @@ typedef struct pubkey_authenticator_t pubkey_authenticator_t;
#include <sa/authenticators/authenticator.h>
/**
* Implementation of the authenticator_t interface using AUTH_PUBKEY.
* Implementation of authenticator_t using public key authenitcation.
*/
struct pubkey_authenticator_t {
/**
* Implemented authenticator_t interface.
*/
authenticator_t authenticator_interface;
authenticator_t authenticator;
};
/**
* Creates an authenticator for AUTH_PUBKEY.
* Create an authenticator to build public key signatures.
*
* @param ike_sa associated ike_sa
* @return pubkey_authenticator_t object
* @param ike_sa associated ike_sa
* @param received_nonce nonce received in IKE_SA_INIT
* @param sent_init sent IKE_SA_INIT message data
* @return public key authenticator
*/
pubkey_authenticator_t *pubkey_authenticator_create(ike_sa_t *ike_sa);
pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init);
/**
* Create an authenticator to verify public key signatures.
*
* @param ike_sa associated ike_sa
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @return public key authenticator
*/
pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init);
#endif /** PUBKEY_AUTHENTICATOR_H_ @}*/
src/charon/sa/connect_manager.c
+4 -4
View File
@@ -734,11 +734,11 @@ static void build_pairs(check_list_t *checklist)
*/
static status_t process_payloads(message_t *message, check_t *check)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) != NOTIFY)
{
@@ -796,7 +796,7 @@ static status_t process_payloads(message_t *message, check_t *check)
break;
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
if (!check->connect_id.ptr || !check->endpoint || !check->auth.ptr)
{
src/charon/sa/ike_sa.c
+17 -43
View File
@@ -1,7 +1,7 @@
/*
* Copyright (C) 2006-2008 Tobias Brunner
* Copyright (C) 2006 Daniel Roethlisberger
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -109,14 +109,14 @@ struct private_ike_sa_t {
peer_cfg_t *peer_cfg;
/**
* associated authentication/authorization info for local peer
* currently used authentication ruleset, local (as auth_cfg_t)
*/
auth_info_t *my_auth;
auth_cfg_t *my_auth;
/**
* associated authentication/authorization info for remote peer
* currently used authentication constraints, remote (as auth_cfg_t)
*/
auth_info_t *other_auth;
auth_cfg_t *other_auth;
/**
* Selected IKE proposal
@@ -355,40 +355,23 @@ static void set_peer_cfg(private_ike_sa_t *this, peer_cfg_t *peer_cfg)
DESTROY_IF(this->peer_cfg);
peer_cfg->get_ref(peer_cfg);
this->peer_cfg = peer_cfg;
if (this->ike_cfg == NULL)
{
this->ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
this->ike_cfg->get_ref(this->ike_cfg);
}
/* apply IDs if they are not already set */
if (this->my_id->contains_wildcards(this->my_id))
{
DESTROY_IF(this->my_id);
this->my_id = this->peer_cfg->get_my_id(this->peer_cfg);
this->my_id = this->my_id->clone(this->my_id);
}
if (this->other_id->contains_wildcards(this->other_id))
{
DESTROY_IF(this->other_id);
this->other_id = this->peer_cfg->get_other_id(this->peer_cfg);
this->other_id = this->other_id->clone(this->other_id);
}
}
/**
* Implementation of ike_sa_t.get_my_auth.
* Implementation of ike_sa_t.get_auth_cfg
*/
static auth_info_t* get_my_auth(private_ike_sa_t *this)
{
return this->my_auth;
}
/**
* Implementation of ike_sa_t.get_other_auth.
*/
static auth_info_t* get_other_auth(private_ike_sa_t *this)
static auth_cfg_t* get_auth_cfg(private_ike_sa_t *this, bool local)
{
if (local)
{
return this->my_auth;
}
return this->other_auth;
}
@@ -1483,14 +1466,6 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
status = this->task_manager->process_message(this->task_manager, message);
if (status != DESTROY_ME)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
this->state == IKE_ESTABLISHED)
{
/* purge auth items if SA is up, as they contain certs
* and other memory wasting elements */
this->my_auth->purge(this->my_auth);
this->other_auth->purge(this->other_auth);
}
return status;
}
/* if IKE_SA gets closed for any reasons, reroute routed children */
@@ -2304,9 +2279,9 @@ static void destroy(private_ike_sa_t *this)
DESTROY_IF(this->ike_cfg);
DESTROY_IF(this->peer_cfg);
DESTROY_IF(this->my_auth);
DESTROY_IF(this->other_auth);
DESTROY_IF(this->proposal);
this->my_auth->destroy(this->my_auth);
this->other_auth->destroy(this->other_auth);
this->ike_sa_id->destroy(this->ike_sa_id);
free(this);
@@ -2334,8 +2309,7 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->public.set_ike_cfg = (void (*)(ike_sa_t*,ike_cfg_t*))set_ike_cfg;
this->public.get_peer_cfg = (peer_cfg_t* (*)(ike_sa_t*))get_peer_cfg;
this->public.set_peer_cfg = (void (*)(ike_sa_t*,peer_cfg_t*))set_peer_cfg;
this->public.get_my_auth = (auth_info_t*(*)(ike_sa_t*))get_my_auth;
this->public.get_other_auth = (auth_info_t*(*)(ike_sa_t*))get_other_auth;
this->public.get_auth_cfg = (auth_cfg_t*(*)(ike_sa_t*, bool local))get_auth_cfg;
this->public.get_proposal = (proposal_t*(*)(ike_sa_t*))get_proposal;
this->public.set_proposal = (void(*)(ike_sa_t*, proposal_t *proposal))set_proposal;
this->public.get_id = (ike_sa_id_t* (*)(ike_sa_t*)) get_id;
@@ -2416,8 +2390,8 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->stats[STAT_INBOUND] = this->stats[STAT_OUTBOUND] = time(NULL);
this->ike_cfg = NULL;
this->peer_cfg = NULL;
this->my_auth = auth_info_create();
this->other_auth = auth_info_create();
this->my_auth = auth_cfg_create();
this->other_auth = auth_cfg_create();
this->proposal = NULL;
this->task_manager = task_manager_create(&this->public);
this->unique_id = ++unique_id;
src/charon/sa/ike_sa.h
+12 -13
View File
@@ -1,7 +1,7 @@
/*
* Copyright (C) 2006-2008 Tobias Brunner
* Copyright (C) 2006 Daniel Roethlisberger
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -41,7 +41,7 @@ typedef struct ike_sa_t ike_sa_t;
#include <sa/keymat.h>
#include <config/peer_cfg.h>
#include <config/ike_cfg.h>
#include <credentials/auth_info.h>
#include <config/auth_cfg.h>
/**
* Timeout in milliseconds after that a half open IKE_SA gets deleted.
@@ -82,6 +82,11 @@ enum ike_extension_t {
* peer supports HTTP cert lookups as specified in RFC4306
*/
EXT_HASH_AND_URL = (1<<2),
/**
* peer supports multiple authentication exchanges, RFC4739
*/
EXT_MULTIPLE_AUTH = (1<<3),
};
/**
@@ -110,7 +115,7 @@ enum ike_condition_t {
COND_NAT_FAKE = (1<<3),
/**
* peer has ben authenticated using EAP
* peer has been authenticated using EAP at least once
*/
COND_EAP_AUTHENTICATED = (1<<4),
@@ -391,18 +396,12 @@ struct ike_sa_t {
void (*set_peer_cfg) (ike_sa_t *this, peer_cfg_t *config);
/**
* Get authentication/authorization info for local peer.
* Get the authentication config with rules of the current auth round.
*
* @return auth_info for me
* @param local TRUE for local rules, FALSE for remote constraints
* @return current cfg
*/
auth_info_t* (*get_my_auth)(ike_sa_t *this);
/**
* Get authentication/authorization info for remote peer.
*
* @return auth_info for me
*/
auth_info_t* (*get_other_auth)(ike_sa_t *this);
auth_cfg_t* (*get_auth_cfg)(ike_sa_t *this, bool local);
/**
* Get the selected proposal of this IKE_SA.
src/charon/sa/ike_sa_manager.c
+25 -76
View File
@@ -1042,9 +1042,7 @@ static ike_sa_t* checkout_by_config(private_ike_sa_manager_t *this,
enumerator_t *enumerator;
entry_t *entry;
ike_sa_t *ike_sa = NULL;
identification_t *my_id, *other_id;
host_t *my_host, *other_host;
ike_cfg_t *ike_cfg;
peer_cfg_t *current_cfg;
u_int segment;
if (!this->reuse_ikesa)
@@ -1054,70 +1052,29 @@ static ike_sa_t* checkout_by_config(private_ike_sa_manager_t *this,
return ike_sa;
}
ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
my_id = peer_cfg->get_my_id(peer_cfg);
other_id = peer_cfg->get_other_id(peer_cfg);
my_host = host_create_from_dns(ike_cfg->get_my_addr(ike_cfg), 0, 0);
other_host = host_create_from_dns(ike_cfg->get_other_addr(ike_cfg), 0, 0);
if (my_host && other_host)
enumerator = create_table_enumerator(this);
while (enumerator->enumerate(enumerator, &entry, &segment))
{
enumerator = create_table_enumerator(this);
while (enumerator->enumerate(enumerator, &entry, &segment))
if (!wait_for_entry(this, entry, segment))
{
identification_t *found_my_id, *found_other_id;
host_t *found_my_host, *found_other_host;
if (!wait_for_entry(this, entry, segment))
{
continue;
}
if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING)
{
/* skip IKE_SAs which are not usable */
continue;
}
found_my_id = entry->ike_sa->get_my_id(entry->ike_sa);
found_other_id = entry->ike_sa->get_other_id(entry->ike_sa);
found_my_host = entry->ike_sa->get_my_host(entry->ike_sa);
found_other_host = entry->ike_sa->get_other_host(entry->ike_sa);
if (found_my_id->get_type(found_my_id) == ID_ANY &&
found_other_id->get_type(found_other_id) == ID_ANY)
{
/* IKE_SA has no IDs yet, so we can't use it */
continue;
}
DBG2(DBG_MGR, "candidate IKE_SA for \n"
" %H[%D]...%H[%D]\n"
" %H[%D]...%H[%D]",
my_host, my_id, other_host, other_id,
found_my_host, found_my_id, found_other_host, found_other_id);
/* compare ID and hosts. Supplied ID may contain wildcards, and IP
* may be %any. */
if ((my_host->is_anyaddr(my_host) ||
my_host->ip_equals(my_host, found_my_host)) &&
(other_host->is_anyaddr(other_host) ||
other_host->ip_equals(other_host, found_other_host)) &&
found_my_id->matches(found_my_id, my_id) &&
found_other_id->matches(found_other_id, other_id) &&
streq(peer_cfg->get_name(peer_cfg),
entry->ike_sa->get_name(entry->ike_sa)))
{
/* looks good, we take this one */
DBG2(DBG_MGR, "found an existing IKE_SA for %H[%D]...%H[%D]",
my_host, my_id, other_host, other_id);
entry->checked_out = TRUE;
ike_sa = entry->ike_sa;
break;
}
continue;
}
if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING)
{ /* skip IKE_SAs which are not usable */
continue;
}
current_cfg = entry->ike_sa->get_peer_cfg(entry->ike_sa);
if (current_cfg && current_cfg->equals(current_cfg, peer_cfg))
{
DBG2(DBG_MGR, "found an existing IKE_SA with a '%s' config",
current_cfg->get_name(current_cfg));
entry->checked_out = TRUE;
ike_sa = entry->ike_sa;
break;
}
enumerator->destroy(enumerator);
}
DESTROY_IF(my_host);
DESTROY_IF(other_host);
enumerator->destroy(enumerator);
if (!ike_sa)
{ /* no IKE_SA using such a config, hand out a new */
@@ -1326,20 +1283,12 @@ static void checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
/* apply identities for duplicate test (only as responder) */
if (!entry->ike_sa_id->is_initiator(entry->ike_sa_id) &&
(!entry->my_id || !entry->other_id))
ike_sa->get_state(ike_sa) == IKE_ESTABLISHED &&
entry->my_id == NULL && entry->other_id == NULL)
{
if (!entry->my_id && my_id->get_type(my_id) != ID_ANY)
{
entry->my_id = my_id->clone(my_id);
}
if (!entry->other_id && other_id->get_type(other_id) != ID_ANY)
{
entry->other_id = other_id->clone(other_id);
}
if (entry->my_id && entry->other_id)
{
put_connected_peers(this, entry);
}
entry->my_id = my_id->clone(my_id);
entry->other_id = other_id->clone(other_id);
put_connected_peers(this, entry);
}
unlock_single_segment(this, segment);
src/charon/sa/task_manager.c
+7 -6
View File
@@ -650,6 +650,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
static status_t process_request(private_task_manager_t *this,
message_t *message)
{
enumerator_t *enumerator;
iterator_t *iterator;
task_t *task = NULL;
payload_t *payload;
@@ -688,8 +689,8 @@ static status_t process_request(private_task_manager_t *this,
case CREATE_CHILD_SA:
{ /* FIXME: we should prevent this on mediation connections */
bool notify_found = FALSE, ts_found = FALSE;
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
switch (payload->get_type(payload))
{
@@ -716,7 +717,7 @@ static status_t process_request(private_task_manager_t *this,
break;
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
if (ts_found)
{
@@ -739,8 +740,8 @@ static status_t process_request(private_task_manager_t *this,
}
case INFORMATIONAL:
{
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
switch (payload->get_type(payload))
{
@@ -793,7 +794,7 @@ static status_t process_request(private_task_manager_t *this,
break;
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
if (task == NULL)
{
src/charon/sa/tasks/child_create.c
+45 -54
View File
@@ -570,7 +570,7 @@ static void handle_notify(private_child_create_t *this, notify_payload_t *notify
*/
static void process_payloads(private_child_create_t *this, message_t *message)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
sa_payload_t *sa_payload;
ke_payload_t *ke_payload;
@@ -579,8 +579,8 @@ static void process_payloads(private_child_create_t *this, message_t *message)
/* defaults to TUNNEL mode */
this->mode = MODE_TUNNEL;
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
switch (payload->get_type(payload))
{
@@ -616,7 +616,7 @@ static void process_payloads(private_child_create_t *this, message_t *message)
break;
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
}
/**
@@ -643,9 +643,9 @@ static status_t build_i(private_child_create_t *this, message_t *message)
}
break;
case IKE_AUTH:
if (!message->get_payload(message, ID_INITIATOR))
if (message->get_message_id(message) != 1)
{
/* send only in the first request, not in subsequent EAP */
/* send only in the first request, not in subsequent rounds */
return NEED_MORE;
}
break;
@@ -737,8 +737,6 @@ static status_t build_i(private_child_create_t *this, message_t *message)
*/
static status_t process_r(private_child_create_t *this, message_t *message)
{
peer_cfg_t *peer_cfg;
switch (message->get_exchange_type(message))
{
case IKE_SA_INIT:
@@ -747,42 +745,17 @@ static status_t process_r(private_child_create_t *this, message_t *message)
get_nonce(message, &this->other_nonce);
break;
case IKE_AUTH:
if (message->get_payload(message, ID_INITIATOR) == NULL)
if (message->get_message_id(message) != 1)
{
/* wait until extensible authentication completed, if used */
/* only handle first AUTH payload, not additional rounds */
return NEED_MORE;
}
default:
break;
}
process_payloads(this, message);
if (this->tsi == NULL || this->tsr == NULL)
{
DBG1(DBG_IKE, "TS payload missing in message");
return NEED_MORE;
}
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (peer_cfg)
{
host_t *me, *other;
me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
if (me == NULL)
{
me = this->ike_sa->get_my_host(this->ike_sa);
}
other = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
if (other == NULL)
{
other = this->ike_sa->get_other_host(this->ike_sa);
}
this->config = peer_cfg->select_child_cfg(peer_cfg, this->tsr,
this->tsi, me, other);
}
return NEED_MORE;
}
@@ -810,10 +783,11 @@ static void handle_child_sa_failure(private_child_create_t *this,
*/
static status_t build_r(private_child_create_t *this, message_t *message)
{
peer_cfg_t *peer_cfg;
payload_t *payload;
iterator_t *iterator;
enumerator_t *enumerator;
bool no_dh = TRUE;
switch (message->get_exchange_type(message))
{
case IKE_SA_INIT:
@@ -828,9 +802,8 @@ static status_t build_r(private_child_create_t *this, message_t *message)
no_dh = FALSE;
break;
case IKE_AUTH:
if (message->get_payload(message, EXTENSIBLE_AUTHENTICATION))
{
/* wait until extensible authentication completed, if used */
if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
{ /* wait until all authentication round completed */
return NEED_MORE;
}
default:
@@ -844,6 +817,25 @@ static status_t build_r(private_child_create_t *this, message_t *message)
return SUCCESS;
}
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (peer_cfg && this->tsi && this->tsr)
{
host_t *me, *other;
me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
if (me == NULL)
{
me = this->ike_sa->get_my_host(this->ike_sa);
}
other = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
if (other == NULL)
{
other = this->ike_sa->get_other_host(this->ike_sa);
}
this->config = peer_cfg->select_child_cfg(peer_cfg, this->tsr,
this->tsi, me, other);
}
if (this->config == NULL)
{
DBG1(DBG_IKE, "traffic selectors %#R=== %#R inacceptable",
@@ -854,8 +846,8 @@ static status_t build_r(private_child_create_t *this, message_t *message)
}
/* check if ike_config_t included non-critical error notifies */
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == NOTIFY)
{
@@ -868,7 +860,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
{
DBG1(DBG_IKE,"configuration payload negotation "
"failed, no CHILD_SA built");
iterator->destroy(iterator);
enumerator->destroy(enumerator);
handle_child_sa_failure(this, message);
return SUCCESS;
}
@@ -877,7 +869,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
}
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
@@ -938,7 +930,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
*/
static status_t process_i(private_child_create_t *this, message_t *message)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
bool no_dh = TRUE;
@@ -951,9 +943,8 @@ static status_t process_i(private_child_create_t *this, message_t *message)
no_dh = FALSE;
break;
case IKE_AUTH:
if (message->get_payload(message, EXTENSIBLE_AUTHENTICATION))
{
/* wait until extensible authentication completed, if used */
if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
{ /* wait until all authentication round completed */
return NEED_MORE;
}
default:
@@ -961,8 +952,8 @@ static status_t process_i(private_child_create_t *this, message_t *message)
}
/* check for erronous notifies */
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == NOTIFY)
{
@@ -982,7 +973,7 @@ static status_t process_i(private_child_create_t *this, message_t *message)
{
DBG1(DBG_IKE, "received %N notify, no CHILD_SA built",
notify_type_names, type);
iterator->destroy(iterator);
enumerator->destroy(enumerator);
handle_child_sa_failure(this, message);
/* an error in CHILD_SA creation is not critical */
return SUCCESS;
@@ -1000,7 +991,7 @@ static status_t process_i(private_child_create_t *this, message_t *message)
bad_group, diffie_hellman_group_names, this->dh_group);
this->public.task.migrate(&this->public.task, this->ike_sa);
iterator->destroy(iterator);
enumerator->destroy(enumerator);
return NEED_MORE;
}
default:
@@ -1008,7 +999,7 @@ static status_t process_i(private_child_create_t *this, message_t *message)
}
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
process_payloads(this, message);
src/charon/sa/tasks/child_delete.c
+4 -3
View File
@@ -114,15 +114,16 @@ static void build_payloads(private_child_delete_t *this, message_t *message)
*/
static void process_payloads(private_child_delete_t *this, message_t *message)
{
iterator_t *payloads, *spis;
enumerator_t *payloads;
iterator_t *spis;
payload_t *payload;
delete_payload_t *delete_payload;
u_int32_t *spi;
protocol_id_t protocol;
child_sa_t *child_sa;
payloads = message->get_payload_iterator(message);
while (payloads->iterate(payloads, (void**)&payload))
payloads = message->create_payload_enumerator(message);
while (payloads->enumerate(payloads, &payload))
{
if (payload->get_type(payload) == DELETE)
{
src/charon/sa/tasks/child_rekey.c
+9 -9
View File
@@ -103,11 +103,11 @@ static status_t process_i_delete(private_child_rekey_t *this, message_t *message
*/
static void find_child(private_child_rekey_t *this, message_t *message)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
notify_payload_t *notify;
u_int32_t spi;
@@ -131,7 +131,7 @@ static void find_child(private_child_rekey_t *this, message_t *message)
break;
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
}
/**
@@ -220,12 +220,12 @@ static status_t process_i(private_child_rekey_t *this, message_t *message)
protocol_id_t protocol;
u_int32_t spi;
child_sa_t *to_delete;
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
/* handle NO_ADDITIONAL_SAS notify */
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == NOTIFY)
{
@@ -239,12 +239,12 @@ static status_t process_i(private_child_rekey_t *this, message_t *message)
charon->processor->queue_job(charon->processor,
(job_t*)rekey_ike_sa_job_create(
this->ike_sa->get_id(this->ike_sa), TRUE));
iterator->destroy(iterator);
enumerator->destroy(enumerator);
return SUCCESS;
}
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
if (this->child_create->task.process(&this->child_create->task, message) == NEED_MORE)
{
src/charon/sa/tasks/ike_auth.c
+666 -501
View File
File diff suppressed because it is too large Load Diff
src/charon/sa/tasks/ike_auth_lifetime.c
+4 -4
View File
@@ -64,12 +64,12 @@ static void add_auth_lifetime(private_ike_auth_lifetime_t *this, message_t *mess
*/
static void process_payloads(private_ike_auth_lifetime_t *this, message_t *message)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
notify_payload_t *notify;
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == NOTIFY)
{
@@ -88,7 +88,7 @@ static void process_payloads(private_ike_auth_lifetime_t *this, message_t *messa
}
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
}
/**
src/charon/sa/tasks/ike_cert_post.c
+62 -62
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2008 Tobias Brunner
* Copyright (C) 2006-2008 Martin Willi
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -97,71 +97,69 @@ static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this, certifi
return payload;
}
/**
* from ike_auth.c
*/
auth_class_t get_auth_class(peer_cfg_t *config);
/**
* add certificates to message
*/
static void build_certs(private_ike_cert_post_t *this, message_t *message)
{
peer_cfg_t *peer_cfg;
auth_cfg_t *auth;
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (peer_cfg && get_auth_class(peer_cfg) == AUTH_CLASS_PUBKEY)
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
if (!peer_cfg ||
(uintptr_t)auth->get(auth, AUTH_RULE_AUTH_CLASS) != AUTH_CLASS_PUBKEY)
{
switch (peer_cfg->get_cert_policy(peer_cfg))
{
case CERT_NEVER_SEND:
break;
case CERT_SEND_IF_ASKED:
if (!this->ike_sa->has_condition(this->ike_sa, COND_CERTREQ_SEEN))
{
break;
}
/* FALL */
case CERT_ALWAYS_SEND:
return;
}
switch (peer_cfg->get_cert_policy(peer_cfg))
{
case CERT_NEVER_SEND:
break;
case CERT_SEND_IF_ASKED:
if (!this->ike_sa->has_condition(this->ike_sa, COND_CERTREQ_SEEN))
{
cert_payload_t *payload;
enumerator_t *enumerator;
certificate_t *cert;
auth_info_t *auth;
auth_item_t item;
auth = this->ike_sa->get_my_auth(this->ike_sa);
/* get subject cert first, then issuing certificates */
if (!auth->get_item(auth, AUTHZ_SUBJECT_CERT, (void**)&cert))
break;
}
/* FALL */
case CERT_ALWAYS_SEND:
{
cert_payload_t *payload;
enumerator_t *enumerator;
certificate_t *cert;
auth_rule_t type;
/* get subject cert first, then issuing certificates */
cert = auth->get(auth, AUTH_RULE_SUBJECT_CERT);
if (!cert)
{
break;
}
payload = build_cert_payload(this, cert);
if (!payload)
{
break;
}
DBG1(DBG_IKE, "sending end entity cert \"%D\"",
cert->get_subject(cert));
message->add_payload(message, (payload_t*)payload);
enumerator = auth->create_enumerator(auth);
while (enumerator->enumerate(enumerator, &type, &cert))
{
if (type == AUTH_RULE_IM_CERT)
{
break;
}
payload = build_cert_payload(this, cert);
if (!payload)
{
break;
}
DBG1(DBG_IKE, "sending end entity cert \"%D\"",
cert->get_subject(cert));
message->add_payload(message, (payload_t*)payload);
enumerator = auth->create_item_enumerator(auth);
while (enumerator->enumerate(enumerator, &item, &cert))
{
if (item == AUTHZ_IM_CERT)
payload = cert_payload_create_from_cert(cert);
if (payload)
{
payload = cert_payload_create_from_cert(cert);
if (payload)
{
DBG1(DBG_IKE, "sending issuer cert \"%D\"",
cert->get_subject(cert));
message->add_payload(message, (payload_t*)payload);
}
DBG1(DBG_IKE, "sending issuer cert \"%D\"",
cert->get_subject(cert));
message->add_payload(message, (payload_t*)payload);
}
}
enumerator->destroy(enumerator);
}
}
}
enumerator->destroy(enumerator);
}
}
}
@@ -170,12 +168,11 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
*/
static status_t build_i(private_ike_cert_post_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
return NEED_MORE;
if (message->get_payload(message, AUTHENTICATION))
{ /* CERT payloads are sended along AUTH payloads */
build_certs(this, message);
}
build_certs(this, message);
return SUCCESS;
return NEED_MORE;
}
/**
@@ -191,11 +188,14 @@ static status_t process_r(private_ike_cert_post_t *this, message_t *message)
*/
static status_t build_r(private_ike_cert_post_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
if (message->get_payload(message, AUTHENTICATION))
{ /* CERT payloads are sended along AUTH payloads */
build_certs(this, message);
}
if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
{ /* stay alive, we might have additional rounds with certs */
return NEED_MORE;
}
build_certs(this, message);
return SUCCESS;
}
@@ -204,8 +204,8 @@ static status_t build_r(private_ike_cert_post_t *this, message_t *message)
*/
static status_t process_i(private_ike_cert_post_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
{ /* stay alive, we might have additional rounds with CERTS */
return NEED_MORE;
}
return SUCCESS;
src/charon/sa/tasks/ike_cert_pre.c
+157 -131
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2008 Tobias Brunner
* Copyright (C) 2006-2007 Martin Willi
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -48,9 +48,9 @@ struct private_ike_cert_pre_t {
bool initiator;
/**
* Did we send a HTTP_CERT_LOOKUP_SUPPORTED Notify?
* Do we accept HTTP certificate lookup requests
*/
bool http_cert_lookup_supported_sent;
bool do_http_lookup;
};
/**
@@ -58,23 +58,22 @@ struct private_ike_cert_pre_t {
*/
static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
auth_info_t *auth;
bool ca_found = FALSE;
auth_cfg_t *auth;
auth = this->ike_sa->get_my_auth(this->ike_sa);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
switch(payload->get_type(payload))
{
case CERTIFICATE_REQUEST:
{
certreq_payload_t *certreq = (certreq_payload_t*)payload;
chunk_t keyid;
enumerator_t *enumerator;
chunk_t keyid;
this->ike_sa->set_condition(this->ike_sa, COND_CERTREQ_SEEN, TRUE);
@@ -98,15 +97,12 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
{
DBG1(DBG_IKE, "received cert request for \"%D\"",
cert->get_subject(cert));
auth->add_item(auth, AUTHN_CA_CERT, cert);
cert->destroy(cert);
ca_found = TRUE;
auth->add(auth, AUTH_RULE_CA_CERT, cert);
}
else
{
DBG1(DBG_IKE, "received cert request for unknown ca "
"with keyid %D", id);
auth->add_item(auth, AUTHN_CA_CERT_KEYID, id);
}
id->destroy(id);
}
@@ -129,7 +125,7 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
break;
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
}
/**
@@ -140,6 +136,7 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
static certificate_t *try_get_cert(cert_payload_t *cert_payload)
{
certificate_t *cert = NULL;
switch (cert_payload->get_cert_encoding(cert_payload))
{
case ENC_X509_SIGNATURE:
@@ -158,7 +155,7 @@ static certificate_t *try_get_cert(cert_payload_t *cert_payload)
}
id = identification_create_from_encoding(ID_CERT_DER_SHA1, hash);
cert = charon->credentials->get_cert(charon->credentials,
CERT_X509, KEY_ANY, id, FALSE);
CERT_X509, KEY_ANY, id, FALSE);
id->destroy(id);
break;
}
@@ -175,78 +172,81 @@ static certificate_t *try_get_cert(cert_payload_t *cert_payload)
*/
static void process_certs(private_ike_cert_pre_t *this, message_t *message)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
auth_info_t *auth;
auth_cfg_t *auth;
bool first = TRUE;
auth = this->ike_sa->get_other_auth(this->ike_sa);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == CERTIFICATE)
{
cert_payload_t *cert_payload = (cert_payload_t*)payload;
cert_encoding_t type = cert_payload->get_cert_encoding(cert_payload);
switch (type)
cert_payload_t *cert_payload;
cert_encoding_t encoding;
certificate_t *cert;
char *url;
cert_payload = (cert_payload_t*)payload;
encoding = cert_payload->get_cert_encoding(cert_payload);
switch (encoding)
{
case ENC_X509_SIGNATURE:
case ENC_X509_HASH_AND_URL:
{
if (type == ENC_X509_HASH_AND_URL &&
!this->http_cert_lookup_supported_sent)
if (!this->do_http_lookup)
{
DBG1(DBG_IKE, "received hash-and-url encoded cert, but"
" we don't accept them, ignore");
break;
}
certificate_t *cert = try_get_cert(cert_payload);
/* FALL */
}
case ENC_X509_SIGNATURE:
{
cert = try_get_cert(cert_payload);
if (cert)
{
/* we've got a certificate from the payload or the cache */
if (first)
{ /* the first certificate MUST be an end entity one */
{ /* the first is an end entity certificate */
DBG1(DBG_IKE, "received end entity cert \"%D\"",
cert->get_subject(cert));
auth->add_item(auth, AUTHN_SUBJECT_CERT, cert);
auth->add(auth, AUTH_HELPER_SUBJECT_CERT, cert);
first = FALSE;
}
else
{
DBG1(DBG_IKE, "received issuer cert \"%D\"",
cert->get_subject(cert));
auth->add_item(auth, AUTHN_IM_CERT, cert);
auth->add(auth, AUTH_HELPER_IM_CERT, cert);
}
cert->destroy(cert);
}
else if (type == ENC_X509_HASH_AND_URL)
else if (encoding == ENC_X509_HASH_AND_URL)
{
/* we received a "Hash and URL" encoded certificate that
* we haven't fetched yet, we store the URL and fetch
* it later */
char *url = cert_payload->get_url(cert_payload);
/* we fetch the certificate not yet, but only if
* it is really needed during authentication */
url = cert_payload->get_url(cert_payload);
if (!url)
{
DBG1(DBG_IKE, "received invalid hash-and-url encoded"
" cert, ignore");
DBG1(DBG_IKE, "received invalid hash-and-url "
"encoded cert, ignore");
break;
}
url = strdup(url);
if (first)
{ /* the first certificate MUST be an end entity one */
{ /* first URL is for an end entity certificate */
DBG1(DBG_IKE, "received hash-and-url for end"
" entity cert \"%s\"", url);
auth->add_item(auth, AUTHN_SUBJECT_HASH_URL, url);
" entity cert \"%s\"", url);
auth->add(auth, AUTH_HELPER_SUBJECT_HASH_URL, url);
first = FALSE;
}
else
{
DBG1(DBG_IKE, "received hash-and-url for issuer"
" cert \"%s\"", url);
auth->add_item(auth, AUTHN_IM_HASH_URL, url);
auth->add(auth, AUTH_HELPER_IM_HASH_URL, url);
}
}
break;
@@ -264,31 +264,23 @@ static void process_certs(private_ike_cert_pre_t *this, message_t *message)
case ENC_OCSP_CONTENT:
default:
DBG1(DBG_ENC, "certificate encoding %N not supported",
cert_encoding_names, cert_payload->get_cert_encoding(cert_payload));
cert_encoding_names, encoding);
}
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
}
/**
* add a certificate request to the message, building request payload if required.
* add the keyid of a certificate to the certificate request payload
*/
static void add_certreq_payload(message_t *message, certreq_payload_t **reqp,
certificate_t *cert)
static void add_certreq(certreq_payload_t **req, certificate_t *cert)
{
public_key_t *public;
certreq_payload_t *req;
public = cert->get_public_key(cert);
if (!public)
{
return;
}
switch (cert->get_type(cert))
{
case CERT_X509:
{
public_key_t *public;
identification_t *keyid;
x509_t *x509 = (x509_t*)cert;
@@ -296,14 +288,18 @@ static void add_certreq_payload(message_t *message, certreq_payload_t **reqp,
{ /* no CA cert, skip */
break;
}
if (*reqp == NULL)
public = cert->get_public_key(cert);
if (!public)
{
*reqp = certreq_payload_create_type(CERT_X509);
message->add_payload(message, (payload_t*)*reqp);
break;
}
if (*req == NULL)
{
*req = certreq_payload_create_type(CERT_X509);
}
req = *reqp;
keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
req->add_keyid(req, keyid->get_encoding(keyid));
(*req)->add_keyid(*req, keyid->get_encoding(keyid));
public->destroy(public);
DBG1(DBG_IKE, "sending cert request for \"%D\"",
cert->get_subject(cert));
break;
@@ -311,7 +307,30 @@ static void add_certreq_payload(message_t *message, certreq_payload_t **reqp,
default:
break;
}
public->destroy(public);
}
/**
* add a auth_cfg's CA certificates to the certificate request
*/
static void add_certreqs(certreq_payload_t **req, auth_cfg_t *auth)
{
enumerator_t *enumerator;
auth_rule_t type;
void *value;
enumerator = auth->create_enumerator(auth);
while (enumerator->enumerate(enumerator, &type, &value))
{
switch (type)
{
case AUTH_RULE_CA_CERT:
add_certreq(req, (certificate_t*)value);
break;
default:
break;
}
}
enumerator->destroy(enumerator);
}
/**
@@ -319,75 +338,53 @@ static void add_certreq_payload(message_t *message, certreq_payload_t **reqp,
*/
static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
{
enumerator_t *enumerator;
ike_cfg_t *ike_cfg;
peer_cfg_t *peer_cfg;
enumerator_t *enumerator;
certificate_t *cert;
bool restricted = FALSE;
certreq_payload_t *x509_req = NULL;
auth_cfg_t *auth;
certreq_payload_t *req = NULL;
ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
if (!ike_cfg->send_certreq(ike_cfg))
{
return;
}
/* check if we require a specific CA for that peer */
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (peer_cfg)
{
void *ptr;
identification_t *id;
auth_item_t item;
auth_info_t *auth = peer_cfg->get_auth(peer_cfg);
enumerator_t *auth_enumerator = auth->create_item_enumerator(auth);
while (auth_enumerator->enumerate(auth_enumerator, &item, &ptr))
enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, FALSE);
while (enumerator->enumerate(enumerator, &auth))
{
switch (item)
{
case AUTHZ_CA_CERT:
cert = (certificate_t *)ptr;
add_certreq_payload(message, &x509_req, cert);
restricted = TRUE;
break;
case AUTHZ_CA_CERT_NAME:
id = (identification_t *)ptr;
enumerator = charon->credentials->create_cert_enumerator(
charon->credentials, CERT_ANY, KEY_ANY, id, TRUE);
while (enumerator->enumerate(enumerator, &cert, TRUE))
{
add_certreq_payload(message, &x509_req, cert);
restricted = TRUE;
}
enumerator->destroy(enumerator);
break;
default:
break;
}
}
auth_enumerator->destroy(auth_enumerator);
}
if (!restricted)
{
/* otherwise include all trusted CA certificates */
enumerator = charon->credentials->create_cert_enumerator(
charon->credentials, CERT_ANY, KEY_ANY, NULL, TRUE);
while (enumerator->enumerate(enumerator, &cert, TRUE))
{
add_certreq_payload(message, &x509_req, cert);
add_certreqs(&req, auth);
}
enumerator->destroy(enumerator);
}
/* if we've added at least one certreq, we notify our peer that we support
* "Hash and URL" for the requested certificates */
if (lib->settings->get_bool(lib->settings, "charon.hash_and_url", FALSE) &&
message->get_payload(message, CERTIFICATE_REQUEST))
if (!req)
{
message->add_notify(message, FALSE, HTTP_CERT_LOOKUP_SUPPORTED, chunk_empty);
this->http_cert_lookup_supported_sent = TRUE;
/* otherwise add all trusted CA certificates */
enumerator = charon->credentials->create_cert_enumerator(
charon->credentials, CERT_ANY, KEY_ANY, NULL, TRUE);
while (enumerator->enumerate(enumerator, &cert))
{
add_certreq(&req, cert);
}
enumerator->destroy(enumerator);
}
if (req)
{
message->add_payload(message, (payload_t*)req);
if (lib->settings->get_bool(lib->settings, "charon.hash_and_url", FALSE))
{
message->add_notify(message, FALSE, HTTP_CERT_LOOKUP_SUPPORTED,
chunk_empty);
this->do_http_lookup = TRUE;
}
}
}
@@ -396,11 +393,10 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
*/
static status_t build_i(private_ike_cert_pre_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
return NEED_MORE;
if (message->get_message_id(message) == 1)
{ /* initiator sends CERTREQs in first IKE_AUTH */
build_certreqs(this, message);
}
build_certreqs(this, message);
return NEED_MORE;
}
@@ -408,13 +404,12 @@ static status_t build_i(private_ike_cert_pre_t *this, message_t *message)
* Implementation of task_t.process for responder
*/
static status_t process_r(private_ike_cert_pre_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
return NEED_MORE;
{
if (message->get_exchange_type(message) != IKE_SA_INIT)
{ /* handle certreqs/certs in any IKE_AUTH, just in case */
process_certreqs(this, message);
process_certs(this, message);
}
process_certreqs(this, message);
process_certs(this, message);
return NEED_MORE;
}
@@ -426,9 +421,12 @@ static status_t build_r(private_ike_cert_pre_t *this, message_t *message)
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
build_certreqs(this, message);
return NEED_MORE;
}
return SUCCESS;
if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{
return SUCCESS;
}
return NEED_MORE;
}
/**
@@ -439,10 +437,38 @@ static status_t process_i(private_ike_cert_pre_t *this, message_t *message)
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
process_certreqs(this, message);
return NEED_MORE;
}
process_certs(this, message);
return SUCCESS;
/* as ike_auth is not processed yet, we don't know if authentication
* is complete (and we can return SUCCESS). Therefore we check for
* an AUTH payload without a ANOTHER_AUTH_FOLLOWS notify. */
if (message->get_payload(message, AUTHENTICATION))
{
enumerator_t *enumerator;
payload_t *payload;
notify_payload_t *notify;
bool done = TRUE;
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == NOTIFY)
{
notify = (notify_payload_t*)payload;
if (notify->get_notify_type(notify) == ANOTHER_AUTH_FOLLOWS)
{
done = FALSE;
}
}
}
enumerator->destroy(enumerator);
if (done)
{
return SUCCESS;
}
}
return NEED_MORE;
}
/**
@@ -493,7 +519,7 @@ ike_cert_pre_t *ike_cert_pre_create(ike_sa_t *ike_sa, bool initiator)
this->ike_sa = ike_sa;
this->initiator = initiator;
this->http_cert_lookup_supported_sent = FALSE;
this->do_http_lookup = FALSE;
return &this->public;
}
src/charon/sa/tasks/ike_config.c
+13 -17
View File
@@ -260,11 +260,12 @@ static void process_attribute(private_ike_config_t *this,
*/
static void process_payloads(private_ike_config_t *this, message_t *message)
{
iterator_t *iterator, *attributes;
enumerator_t *enumerator;
iterator_t *attributes;
payload_t *payload;
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == CONFIGURATION)
{
@@ -290,7 +291,7 @@ static void process_payloads(private_ike_config_t *this, message_t *message)
}
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
}
/**
@@ -298,9 +299,8 @@ static void process_payloads(private_ike_config_t *this, message_t *message)
*/
static status_t build_i(private_ike_config_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
message->get_payload(message, ID_INITIATOR))
{
if (message->get_message_id(message) == 1)
{ /* in first IKE_AUTH only */
peer_cfg_t *config;
host_t *vip;
@@ -327,9 +327,8 @@ static status_t build_i(private_ike_config_t *this, message_t *message)
*/
static status_t process_r(private_ike_config_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
message->get_payload(message, ID_INITIATOR))
{
if (message->get_message_id(message) == 1)
{ /* in first IKE_AUTH only */
process_payloads(this, message);
}
return NEED_MORE;
@@ -340,9 +339,8 @@ static status_t process_r(private_ike_config_t *this, message_t *message)
*/
static status_t build_r(private_ike_config_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
message->get_payload(message, EXTENSIBLE_AUTHENTICATION) == NULL)
{
if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{ /* in last IKE_AUTH exchange */
peer_cfg_t *config = this->ike_sa->get_peer_cfg(this->ike_sa);
if (config && this->virtual_ip)
@@ -355,7 +353,6 @@ static status_t build_r(private_ike_config_t *this, message_t *message)
ip = charon->attributes->acquire_address(charon->attributes,
config->get_pool(config),
this->ike_sa->get_other_id(this->ike_sa),
this->ike_sa->get_other_auth(this->ike_sa),
this->virtual_ip);
}
if (ip == NULL)
@@ -384,9 +381,8 @@ static status_t build_r(private_ike_config_t *this, message_t *message)
*/
static status_t process_i(private_ike_config_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
!message->get_payload(message, EXTENSIBLE_AUTHENTICATION))
{
if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{ /* in last IKE_AUTH exchange */
host_t *ip;
peer_cfg_t *config;
src/charon/sa/tasks/ike_init.c
+22 -19
View File
@@ -170,11 +170,11 @@ static void build_payloads(private_ike_init_t *this, message_t *message)
*/
static void process_payloads(private_ike_init_t *this, message_t *message)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
switch (payload->get_type(payload))
{
@@ -182,7 +182,7 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
{
sa_payload_t *sa_payload = (sa_payload_t*)payload;
linked_list_t *proposal_list;
proposal_list = sa_payload->get_proposals(sa_payload);
this->proposal = this->config->select_proposal(this->config,
proposal_list);
@@ -225,7 +225,7 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
break;
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
}
/**
@@ -317,12 +317,12 @@ static status_t process_r(private_ike_init_t *this, message_t *message)
#ifdef ME
{
chunk_t connect_id = chunk_empty;
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
/* check for a ME_CONNECTID notify */
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == NOTIFY)
{
@@ -353,7 +353,7 @@ static status_t process_r(private_ike_init_t *this, message_t *message)
}
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
if (connect_id.ptr)
{
@@ -458,12 +458,12 @@ static status_t build_r(private_ike_init_t *this, message_t *message)
*/
static status_t process_i(private_ike_init_t *this, message_t *message)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
/* check for erronous notifies */
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == NOTIFY)
{
@@ -489,19 +489,22 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
this->ike_sa->reset(this->ike_sa);
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
return NEED_MORE;
}
case NAT_DETECTION_SOURCE_IP:
case NAT_DETECTION_DESTINATION_IP:
/* skip, handled in ike_natd_t */
break;
case MULTIPLE_AUTH_SUPPORTED:
/* handled in ike_auth_t */
break;
case COOKIE:
{
chunk_free(&this->cookie);
this->cookie = chunk_clone(notify->get_notification_data(notify));
this->ike_sa->reset(this->ike_sa);
iterator->destroy(iterator);
enumerator->destroy(enumerator);
DBG2(DBG_IKE, "received %N notify", notify_type_names, type);
return NEED_MORE;
}
@@ -511,7 +514,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
{
DBG1(DBG_IKE, "received %N notify error",
notify_type_names, type);
iterator->destroy(iterator);
enumerator->destroy(enumerator);
return FAILED;
}
DBG2(DBG_IKE, "received %N notify",
@@ -521,7 +524,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
}
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
process_payloads(this, message);
src/charon/sa/tasks/ike_me.c
+5 -5
View File
@@ -166,11 +166,11 @@ static void gather_and_add_endpoints(private_ike_me_t *this, message_t *message)
*/
static void process_payloads(private_ike_me_t *this, message_t *message)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) != NOTIFY)
{
@@ -237,7 +237,7 @@ static void process_payloads(private_ike_me_t *this, message_t *message)
break;
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
}
/**
src/charon/sa/tasks/ike_mobike.c
+8 -10
View File
@@ -97,12 +97,12 @@ static void flush_additional_addresses(private_ike_mobike_t *this)
*/
static void process_payloads(private_ike_mobike_t *this, message_t *message)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
bool first = TRUE;
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
int family = AF_INET;
notify_payload_t *notify;
@@ -181,7 +181,7 @@ static void process_payloads(private_ike_mobike_t *this, message_t *message)
break;
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
}
/**
@@ -332,9 +332,8 @@ static void transmit(private_ike_mobike_t *this, packet_t *packet)
*/
static status_t build_i(private_ike_mobike_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
message->get_payload(message, ID_INITIATOR))
{
if (message->get_message_id(message) == 1)
{ /* only in first IKE_AUTH */
message->add_notify(message, FALSE, MOBIKE_SUPPORTED, chunk_empty);
build_address_list(this, message);
}
@@ -381,9 +380,8 @@ static status_t build_i(private_ike_mobike_t *this, message_t *message)
*/
static status_t process_r(private_ike_mobike_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
message->get_payload(message, ID_INITIATOR))
{
if (message->get_message_id(message) == 1)
{ /* only first IKE_AUTH */
process_payloads(this, message);
}
else if (message->get_exchange_type(message) == INFORMATIONAL)
src/charon/sa/tasks/ike_natd.c
+4 -4
View File
@@ -166,7 +166,7 @@ static notify_payload_t *build_natd_payload(private_ike_natd_t *this,
*/
static void process_payloads(private_ike_natd_t *this, message_t *message)
{
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
notify_payload_t *notify;
chunk_t hash, src_hash, dst_hash;
@@ -184,8 +184,8 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
DBG3(DBG_IKE, "precalculated src_hash %B", &src_hash);
DBG3(DBG_IKE, "precalculated dst_hash %B", &dst_hash);
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) != NOTIFY)
{
@@ -235,7 +235,7 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
break;
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
chunk_free(&src_hash);
chunk_free(&dst_hash);
src/charon/sa/tasks/ike_rekey.c
+6 -6
View File
@@ -194,12 +194,12 @@ static status_t build_r(private_ike_rekey_t *this, message_t *message)
static status_t process_i(private_ike_rekey_t *this, message_t *message)
{
ike_sa_id_t *to_delete;
iterator_t *iterator;
enumerator_t *enumerator;
payload_t *payload;
/* handle NO_ADDITIONAL_SAS notify */
iterator = message->get_payload_iterator(message);
while (iterator->iterate(iterator, (void**)&payload))
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == NOTIFY)
{
@@ -213,12 +213,12 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
charon->processor->queue_job(charon->processor,
(job_t*)rekey_ike_sa_job_create(
this->ike_sa->get_id(this->ike_sa), TRUE));
iterator->destroy(iterator);
enumerator->destroy(enumerator);
return SUCCESS;
}
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
switch (this->ike_init->task.process(&this->ike_init->task, message))
{