denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- new configuration support added to ike_sa and states

Browse Source
This commit is contained in:
Jan Hutter
2005-12-01 17:16:10 +00:00
parent bae00c63f7
commit a9428251cd
16 changed files with 772 additions and 597 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Source/charon/config/configuration_manager.c
+381 -209
View File
@@ -29,10 +29,67 @@
#include <types.h>
#include <daemon.h>
#include <utils/allocator.h>
#include <encoding/payloads/nonce_payload.h>
#include <encoding/payloads/proposal_substructure.h>
#include <encoding/payloads/ke_payload.h>
#include <encoding/payloads/transform_attribute.h>
typedef struct configuration_entry_t configuration_entry_t;
/* A configuration entry combines a configuration name with a init and sa
* configuration represented as init_config_t and sa_config_t objects.
*/
struct configuration_entry_t {
/**
* Configuration name.
*
*/
char *name;
/**
* Configuration for IKE_SA_INIT exchange.
*/
init_config_t *init_config;
/**
* Configuration for all phases after IKE_SA_INIT exchange.
*/
sa_config_t *sa_config;
/**
* Destroys a configuration_entry_t
*
*
* @param this calling object
*/
void (*destroy) (configuration_entry_t *this);
};
static void configuration_entry_destroy (configuration_entry_t *this)
{
allocator_free(this->name);
allocator_free(this);
}
/**
* Creates a configuration_entry_t object
*
* @param name name of the configuration entry (gets copied)
* @param init_config object of type init_config_t
* @param sa_config object of type sa_config_t
*/
configuration_entry_t * configuration_entry_create(char * name, init_config_t * init_config, sa_config_t * sa_config)
{
configuration_entry_t *entry = allocator_alloc_thing(configuration_entry_t);
/* functions */
entry->destroy = configuration_entry_destroy;
/* private data */
entry->init_config = init_config;
entry->sa_config = sa_config;
entry->name = allocator_alloc(strlen(name) + 1);
strcpy(entry->name,name);
return entry;
}
typedef struct private_configuration_manager_t private_configuration_manager_t;
@@ -42,244 +99,353 @@ typedef struct private_configuration_manager_t private_configuration_manager_t;
struct private_configuration_manager_t {
/**
* Public part
* Public part of configuration manager.
*/
configuration_manager_t public;
/**
* Assigned logger object
* Holding all configurations.
*/
linked_list_t *configurations;
/**
* Holding all init_configs.
*/
linked_list_t *init_configs;
/**
* Holding all init_configs.
*/
linked_list_t *sa_configs;
/**
* Assigned logger object.
*/
logger_t *logger;
/**
* Load default configuration
*
*
* @param this calling object
* @param name name for the configuration
* @param init_config init_config_t object
* @param sa_config sa_config_t object
*/
void (*add_new_configuration) (private_configuration_manager_t *this, char *name, init_config_t *init_config, sa_config_t *sa_config);
/**
* Load default configuration
*
*
* @param this calling object
*/
void (*load_default_config) (private_configuration_manager_t *this);
};
/**
* Implements function configuration_manager_t.get_remote_host.
* Implementation of private_configuration_manager_t.load_default_config.
*/
static status_t get_remote_host(private_configuration_manager_t *this, char *name, host_t **host)
static void load_default_config (private_configuration_manager_t *this)
{
/*
* For testing purposes, hard coded host informations for two configurations are returned.
*
* Further improvements could store them in a linked list or hash table.
*/
host_t *remote;
status_t status = SUCCESS;
init_config_t *init_config1, *init_config2, *init_config3;
ike_proposal_t proposals[2];
sa_config_t *sa_config;
init_config1 = init_config_create("152.96.193.130","152.96.193.131",IKEV2_UDP_PORT,IKEV2_UDP_PORT);
init_config2 = init_config_create("152.96.193.131","152.96.193.130",IKEV2_UDP_PORT,IKEV2_UDP_PORT);
init_config3 = init_config_create("0.0.0.0","127.0.0.1",IKEV2_UDP_PORT,IKEV2_UDP_PORT);
if (strcmp(name, "pinflb30") == 0)
{
remote = host_create(AF_INET, "152.96.193.130", 500);
}
else if (strcmp(name, "pinflb31") == 0)
{
remote = host_create(AF_INET, "152.96.193.131", 500);
}
else if (strcmp(name, "localhost") == 0)
{
remote = host_create(AF_INET, "127.0.0.1", 500);
}
else
{
status = NOT_FOUND;
}
*host = remote;
proposals[0].encryption_algorithm = ENCR_AES_CBC;
proposals[0].encryption_algorithm_key_length = 20;
proposals[0].integrity_algorithm = AUTH_HMAC_SHA1_96;
proposals[0].integrity_algorithm_key_length = 20;
proposals[0].pseudo_random_function = PRF_HMAC_SHA1;
proposals[0].pseudo_random_function_key_length = 20;
proposals[0].diffie_hellman_group = MODP_768_BIT;
proposals[1] = proposals[0];
proposals[1].integrity_algorithm = AUTH_HMAC_MD5_96;
proposals[1].integrity_algorithm_key_length = 16;
proposals[1].pseudo_random_function = PRF_HMAC_MD5;
proposals[1].pseudo_random_function_key_length = 16;
init_config1->add_proposal(init_config1,1,proposals[0]);
init_config1->add_proposal(init_config1,1,proposals[1]);
init_config2->add_proposal(init_config2,1,proposals[0]);
init_config2->add_proposal(init_config2,1,proposals[1]);
init_config3->add_proposal(init_config3,1,proposals[0]);
init_config3->add_proposal(init_config3,1,proposals[1]);
this->add_new_configuration(this,"pinflb31",init_config1,sa_config);
this->add_new_configuration(this,"pinflb30",init_config2,sa_config);
this->add_new_configuration(this,"localhost",init_config3,sa_config);
}
/**
* Implementation of configuration_manager_t.get_init_config_for_host.
*/
static status_t get_init_config_for_host (private_configuration_manager_t *this, host_t *my_host, host_t *other_host,init_config_t **init_config)
{
iterator_t *iterator;
status_t status = NOT_FOUND;
iterator = this->configurations->create_iterator(this->configurations,TRUE);
while (iterator->has_next(iterator))
{
configuration_entry_t *entry;
host_t *config_my_host;
host_t *config_other_host;
iterator->current(iterator,(void **) &entry);
config_my_host = entry->init_config->get_my_host(entry->init_config);
config_other_host = entry->init_config->get_other_host(entry->init_config);
/* first check if ip is equal */
if(config_other_host->ip_is_equal(config_other_host,other_host))
{
/* could be right one, check my_host for default route*/
if (config_my_host->is_default_route(config_my_host))
{
*init_config = entry->init_config;
status = SUCCESS;
break;
}
/* check now if host informations are the same */
else if (config_my_host->ip_is_equal(config_my_host,my_host))
{
*init_config = entry->init_config;
status = SUCCESS;
break;
}
}
/* Then check for wildcard hosts!
* TODO
* actually its only checked if other host with default route can be found! */
else if (config_other_host->is_default_route(config_other_host))
{
/* could be right one, check my_host for default route*/
if (config_my_host->is_default_route(config_my_host))
{
*init_config = entry->init_config;
status = SUCCESS;
break;
}
/* check now if host informations are the same */
else if (config_my_host->ip_is_equal(config_my_host,my_host))
{
*init_config = entry->init_config;
status = SUCCESS;
break;
}
}
}
iterator->destroy(iterator);
return status;
}
/**
* Implements function configuration_manager_t.get_local_host.
* Implementation of configuration_manager_t.get_init_config_for_name.
*/
static status_t get_local_host(private_configuration_manager_t *this, char *name, host_t **host)
static status_t get_init_config_for_name (private_configuration_manager_t *this, char *name, init_config_t **init_config)
{
/*
* For testing purposes, only the default route is returned for each configuration.
*
* Further improvements could store different local host informations in a linked list or hash table.
*/
*host = host_create(AF_INET, "0.0.0.0", 0);
return SUCCESS;
}
/**
* Implements function configuration_manager_t.get_dh_group_number.
*/
static status_t get_dh_group_number(private_configuration_manager_t *this,char *name, u_int16_t *dh_group_number, u_int16_t priority)
{
/* Currently only two dh_group_numbers are supported for each configuration*/
iterator_t *iterator;
status_t status = NOT_FOUND;
if (priority == 1)
iterator = this->configurations->create_iterator(this->configurations,TRUE);
while (iterator->has_next(iterator))
{
*dh_group_number = MODP_1024_BIT;
}
else
{
*dh_group_number = MODP_768_BIT;
}
return SUCCESS;
}
configuration_entry_t *entry;
iterator->current(iterator,(void **) &entry);
/**
* Implements function configuration_manager_t.get_proposals_for_host.
*/
static status_t get_proposals_for_host(private_configuration_manager_t *this, host_t *host, iterator_t *iterator)
{
/*
* Currently the following hard coded proposal is created and returned for all hosts:
* - ENCR_AES_CBC 128Bit
* - PRF_HMAC_MD5 128Bit
* - AUTH_HMAC_MD5_96 128Bit
* - MODP_1024_BIT
*/
proposal_substructure_t *proposal;
transform_substructure_t *transform;
transform_attribute_t *attribute;
proposal = proposal_substructure_create();
proposal->set_proposal_number(proposal, 1);
proposal->set_protocol_id(proposal, 1);
/*
* Encryption Algorithm
*/
transform = transform_substructure_create();
if (strcmp(entry->name,name) == 0)
{
proposal->add_transform_substructure(proposal, transform);
transform->set_transform_type(transform, ENCRYPTION_ALGORITHM);
transform->set_transform_id(transform, ENCR_AES_CBC);
attribute = transform_attribute_create();
transform->add_transform_attribute(transform, attribute);
attribute->set_attribute_type(attribute, KEY_LENGTH);
attribute->set_value(attribute, 16);
/*
* Pseudo-random Function
*/
transform = transform_substructure_create();
proposal->add_transform_substructure(proposal, transform);
transform->set_transform_type(transform, PSEUDO_RANDOM_FUNCTION);
transform->set_transform_id(transform, PRF_HMAC_MD5);
attribute = transform_attribute_create();
transform->add_transform_attribute(transform, attribute);
attribute->set_attribute_type(attribute, KEY_LENGTH);
attribute->set_value(attribute, 16);
/*
* Integrity Algorithm
*/
transform = transform_substructure_create();
proposal->add_transform_substructure(proposal, transform);
transform->set_transform_type(transform, INTEGRITY_ALGORITHM);
transform->set_transform_id(transform, AUTH_HMAC_MD5_96);
attribute = transform_attribute_create();
transform->add_transform_attribute(transform, attribute);
attribute->set_attribute_type(attribute, KEY_LENGTH);
attribute->set_value(attribute, 16);
/*
* Diffie-Hellman Group
*/
transform = transform_substructure_create();
proposal->add_transform_substructure(proposal, transform);
transform->set_transform_type(transform, DIFFIE_HELLMAN_GROUP);
transform->set_transform_id(transform, MODP_1024_BIT);
iterator->insert_after(iterator, (void*)proposal);
return SUCCESS;
}
/**
* Implements function configuration_manager_t.select_proposals_for_host.
*/
static status_t select_proposals_for_host(private_configuration_manager_t *this, host_t *host, iterator_t *in, iterator_t *out)
{
/* Currently the first suggested proposal is selected, cloned and then returned*/
proposal_substructure_t *first_suggested_proposal;
proposal_substructure_t *selected_proposal;
this->logger->log(this->logger,CONTROL | MORE, "Going to select first suggested proposal");
if (!in->has_next(in))
{
this->logger->log(this->logger,ERROR | MORE, "No proposal suggested");
/* no suggested proposal! */
return FAILED;
/* found configuration */
*init_config = entry->init_config;
status = SUCCESS;
break;
}
}
in->current(in,(void **) &first_suggested_proposal);
selected_proposal = first_suggested_proposal->clone(first_suggested_proposal);
iterator->destroy(iterator);
out->insert_after(out,selected_proposal);
return SUCCESS;
return status;
}
/**
* Implements function configuration_manager_t.check_selected_proposals_for_host.
*/
static status_t check_selected_proposals_for_host (private_configuration_manager_t *this, host_t *host, iterator_t *proposals,bool *valid)
{
/*
* Currently the given proposals are not checked if they are valid for specific host!
*
* The first proposal is taken
*/
this->logger->log(this->logger,CONTROL|MORE, "Going to check selected proposals");
return SUCCESS;
}
/**
* Implements function configuration_manager_t.is_dh_group_allowed_for_host.
*/
static status_t is_dh_group_allowed_for_host(private_configuration_manager_t *this, host_t *host, diffie_hellman_group_t group, bool *allowed)
{
/*
* Only the two DH groups 768 and 1024 are supported for each configuration
*/
if (group == MODP_768_BIT || group == MODP_1024_BIT)
/**
* Implementation of configuration_manager_t.get_sa_config_for_name.
*/
static status_t get_sa_config_for_name (private_configuration_manager_t *this, char *name, sa_config_t **sa_config)
{
iterator_t *iterator;
status_t status = NOT_FOUND;
iterator = this->configurations->create_iterator(this->configurations,TRUE);
while (iterator->has_next(iterator))
{
*allowed = TRUE;
configuration_entry_t *entry;
iterator->current(iterator,(void **) &entry);
if (strcmp(entry->name,name) == 0)
{
/* found configuration */
*sa_config = entry->sa_config;
status = SUCCESS;
break;
}
}
*allowed = FALSE;
this->logger->log(this->logger,CONTROL | MORE, "DH group %s is %s",mapping_find(diffie_hellman_group_m, group),(allowed)? "allowed" : "not allowed");
return SUCCESS;
iterator->destroy(iterator);
return status;
}
/**
* Implementation of configuration_manager_t.get_sa_config_for_init_config_and_id.
*/
static status_t get_sa_config_for_init_config_and_id (private_configuration_manager_t *this, init_config_t *init_config, identification_t *other_id, identification_t *my_id,sa_config_t **sa_config)
{
iterator_t *iterator;
status_t status = NOT_FOUND;
iterator = this->configurations->create_iterator(this->configurations,TRUE);
while (iterator->has_next(iterator))
{
configuration_entry_t *entry;
iterator->current(iterator,(void **) &entry);
if (entry->init_config == init_config)
{
identification_t *config_my_id = entry->sa_config->get_my_id(entry->sa_config);
identification_t *config_other_id = entry->sa_config->get_other_id(entry->sa_config);
/* host informations seem to be the same */
if (config_other_id->equals(config_other_id,other_id))
{
/* other ids seems to match */
if (my_id == NULL)
{
/* first matching one is selected */
/* TODO priorize found entries */
*sa_config = entry->sa_config;
status = SUCCESS;
break;
}
if (config_my_id->equals(config_my_id,my_id))
{
*sa_config = entry->sa_config;
status = SUCCESS;
break;
}
}
}
}
iterator->destroy(iterator);
return status;
}
/**
* Implements function destroy of configuration_t.
* See #configuration_s.destroy for description.
* Implementation of private_configuration_manager_t.add_new_configuration.
*/
static status_t destroy(private_configuration_manager_t *this)
static void add_new_configuration (private_configuration_manager_t *this, char *name, init_config_t *init_config, sa_config_t *sa_config)
{
iterator_t *iterator;
bool found;
iterator = this->init_configs->create_iterator(this->init_configs,TRUE);
found = FALSE;
while (iterator->has_next(iterator))
{
init_config_t *found_init_config;
iterator->current(iterator,(void **) &found_init_config);
if (init_config == found_init_config)
{
found = TRUE;
break;
}
}
iterator->destroy(iterator);
if (!found)
{
this->init_configs->insert_first(this->init_configs,init_config);
}
iterator = this->sa_configs->create_iterator(this->sa_configs,TRUE);
found = FALSE;
while (iterator->has_next(iterator))
{
sa_config_t *found_sa_config;
iterator->current(iterator,(void **) &found_sa_config);
if (sa_config == found_sa_config)
{
found = TRUE;
break;
}
}
iterator->destroy(iterator);
if (!found)
{
this->sa_configs->insert_first(this->sa_configs,sa_config);
}
this->configurations->insert_first(this->configurations,configuration_entry_create(name,init_config,sa_config));
}
/**
* Implementation of configuration_manager_t.destroy.
*/
static void destroy(private_configuration_manager_t *this)
{
this->logger->log(this->logger,CONTROL | MORE, "Going to destroy configuration manager ");
while (this->configurations->get_count(this->configurations) > 0)
{
configuration_entry_t *entry;
this->configurations->remove_first(this->configurations,(void **) &entry);
entry->destroy(entry);
}
/* todo delete all config objects */
this->configurations->destroy(this->configurations);
while (this->sa_configs->get_count(this->sa_configs) > 0)
{
sa_config_t *sa_config;
this->sa_configs->remove_first(this->sa_configs,(void **) &sa_config);
// sa_config->destroy(sa_config);
}
this->sa_configs->destroy(this->sa_configs);
while (this->init_configs->get_count(this->init_configs) > 0)
{
init_config_t *init_config;
this->init_configs->remove_first(this->init_configs,(void **) &init_config);
init_config->destroy(init_config);
}
this->init_configs->destroy(this->init_configs);
this->logger->log(this->logger,CONTROL | MOST, "Destroy assigned logger");
charon->logger_manager->destroy_logger(charon->logger_manager,this->logger);
allocator_free(this);
return SUCCESS;
}
/*
@@ -290,17 +456,23 @@ configuration_manager_t *configuration_manager_create()
private_configuration_manager_t *this = allocator_alloc_thing(private_configuration_manager_t);
/* public functions */
this->public.destroy = (status_t(*)(configuration_manager_t*))destroy;
this->public.get_remote_host = (status_t(*)(configuration_manager_t*,char*,host_t**))get_remote_host;
this->public.get_local_host = (status_t(*)(configuration_manager_t*,char*,host_t**))get_local_host;
this->public.get_dh_group_number = (status_t(*)(configuration_manager_t*,char*,u_int16_t *, u_int16_t))get_dh_group_number;
this->public.get_proposals_for_host = (status_t(*)(configuration_manager_t*,host_t*,iterator_t*))get_proposals_for_host;
this->public.select_proposals_for_host = (status_t(*)(configuration_manager_t*,host_t*,iterator_t*,iterator_t*))select_proposals_for_host;
this->public.check_selected_proposals_for_host = (status_t (*) (configuration_manager_t *, host_t *, iterator_t *,bool *)) check_selected_proposals_for_host;
this->public.is_dh_group_allowed_for_host = (status_t(*)(configuration_manager_t*,host_t*,diffie_hellman_group_t,bool*)) is_dh_group_allowed_for_host;
this->public.destroy = (void(*)(configuration_manager_t*))destroy;
this->public.get_init_config_for_name = (status_t (*) (configuration_manager_t *, char *, init_config_t **)) get_init_config_for_name;
this->public.get_init_config_for_host = (status_t (*) (configuration_manager_t *, host_t *, host_t *,init_config_t **)) get_init_config_for_host;
this->public.get_sa_config_for_name =(status_t (*) (configuration_manager_t *, char *, sa_config_t **)) get_sa_config_for_name;
this->public.get_sa_config_for_init_config_and_id =(status_t (*) (configuration_manager_t *, init_config_t *, identification_t *, identification_t *,sa_config_t **)) get_sa_config_for_init_config_and_id;
/* private functions */
this->load_default_config = load_default_config;
this->add_new_configuration = add_new_configuration;
/* private variables */
this->logger = charon->logger_manager->create_logger(charon->logger_manager,CONFIGURATION_MANAGER,NULL);
this->configurations = linked_list_create();
this->sa_configs = linked_list_create();
this->init_configs = linked_list_create();
this->load_default_config(this);
return (&this->public);
}
Source/charon/config/configuration_manager.h
+39 -104
View File
@@ -24,12 +24,8 @@
#define CONFIGURATION_MANAGER_H_
#include <types.h>
#include <utils/linked_list.h>
#include <network/host.h>
#include <encoding/payloads/transform_substructure.h>
#include <transforms/prfs/prf.h>
#include <transforms/signers/signer.h>
#include <transforms/crypters/crypter.h>
#include <config/init_config.h>
#include <config/sa_config.h>
typedef struct configuration_manager_t configuration_manager_t;
@@ -37,138 +33,77 @@ typedef struct configuration_manager_t configuration_manager_t;
/**
* @brief Manages all configuration aspects of the daemon.
*
* Currently the configuration manager class does not store specific configurations.
* It is expected, that in future different configurations are stored in a linked list
* or a hash map and are managed by this class.
*
* @ingroup config
*
*/
struct configuration_manager_t {
/**
* Gets the remote host information for a specific configuration name.
* Gets the configuration information needed for IKE_SA_INIT exchange
* for a specific configuration name.
*
* A host information consist of IP address and UDP port.
* The returned init_config_t object MUST NOT be destroyed cause it's the original one.
*
* @param this calling object
* @param name name of the configuration
* @param host remote host information gets stored at this location
* @param this calling object
* @param name name of the configuration
* @param[out] init_config the configuration is stored at this place
*
* @return
* - NOT_FOUND
* - SUCCESS
*/
status_t (*get_remote_host) (configuration_manager_t *this, char *name, host_t **host);
status_t (*get_init_config_for_name) (configuration_manager_t *this, char *name, init_config_t **init_config);
/**
* Gets the local host information for a specific configuration name
* Gets the configuration information needed for IKE_SA_INIT exchange
* for specific host informations.
*
* A host information consist of IP address and UDP port.
* The returned init_config_t object MUST NOT be destroyed cause it's the original one.
*
* @param this calling object
* @param name name of the configuration
* @param host local host information gets stored at this location
* @param this calling object
* @param my_host my host informations
* @param other_host other host informations
* @param[out] init_config the configuration is stored at this place
*
* @return
* - NOT_FOUND (not yet implemented)
* - NOT_FOUND
* - SUCCESS
*/
status_t (*get_local_host) (configuration_manager_t *this, char *name, host_t **host);
*/
status_t (*get_init_config_for_host) (configuration_manager_t *this, host_t *my_host, host_t *other_host,init_config_t **init_config);
/**
* Returns the DH group number to use when initiating a connection.
*
* To make sure that different group numbers are supported in case
* a group number is not supported by other peer, a priority has to get defined.
* Gets the configuration information needed after IKE_SA_INIT exchange.
*
* The returned sa_config_t object MUST not be destroyed cause it's the original one.
*
* @param this calling object
* @param name name of the configuration
* @param dh_group_number the DH group number gets stored at this location
* @param priority priority to use for selection of DH group number.
* Highest priority is 1. All higher values have lower
* priority.
* @param[out] sa_config the configuration is stored at this place
*
* @return
* - FAILED (not yet implemented)
* - NOT_FOUND (not yet implemented)
* - SUCCESS
* - NOT_FOUND
* - SUCCESS
*/
status_t (*get_dh_group_number) (configuration_manager_t *this, char *name, u_int16_t *dh_group_number, u_int16_t priority);
status_t (*get_sa_config_for_name) (configuration_manager_t *this, char *name, sa_config_t **sa_config);
/**
* Returns the proposals which should be used to initiate a connection with a specific
* host.
*
* The proposals of type proposal_substructure_t * are returned over the given iterator
* and have to be destroyed by the caller.
* Gets the configuration information needed after IKE_SA_INIT exchange
* for specific init_config_t and ID data.
*
* The returned sa_config_t object MUST NOT be destroyed cause it's the original one.
*
* @param this calling object
* @param host host information used to find the correct proposals
* @param list iterator where the proposals are written to
* @param init_config init_config_t object
* @param other_id identification of other one
* @param my_id my identification (can be NULL)
* @param[out] sa_config the configuration is stored at this place
*
* @return
* - NOT_FOUND (not yet implemented)
* - SUCCESS
*/
status_t (*get_proposals_for_host) (configuration_manager_t *this, host_t *host, iterator_t *list);
/**
* Checks the suggested proposals passed as iterator in and selects one proposal to be sent as selection
* of this proposals.
*
* Currently there is no check implemented. The first suggested proposal is cloned and then as selected returned.
*
*
* @param this calling object
* @param host host information used to find the correct proposals
* @param in iterator with suggested proposals of type proposal_substructure_t *
* @param out The selected proposals of type proposal_substructure_t * are written to this iterator
*
* @return
* - FAILED
* - NOT_FOUND (not yet implemented)
* - SUCCESS
*/
status_t (*select_proposals_for_host) (configuration_manager_t *this, host_t *host, iterator_t *in, iterator_t *out);
/**
* Checks if the selected proposals of a remote hosts are valid.
*
*
* @param this calling object
* @param host host information
* @param proposals iterator with selected proposals
* @param[out] valid TRUE if selected proposals are accepted
*
* @return
* - FAILED
* - NOT_FOUND (not yet implemented)
* - SUCCESS
*/
status_t (*check_selected_proposals_for_host) (configuration_manager_t *this,
host_t *host,
iterator_t *proposals,
bool *valid);
/**
* Checks if a given dh_group number is allowed for a specific host
*
*
* @param this calling object
* @param host host information
* @param group DH group number to check if allowed
* @param[out] allowed will be set to TRUE if group number is allowed, FALSE otherwise
*
* @return
* - FAILED
* - NOT_FOUND (not yet implemented)
* - SUCCESS
*/
status_t (*is_dh_group_allowed_for_host) (configuration_manager_t *this, host_t *host, diffie_hellman_group_t group, bool *allowed);
* - NOT_FOUND
* - SUCCESS
*/
status_t (*get_sa_config_for_init_config_and_id) (configuration_manager_t *this, init_config_t *init_config, identification_t *other_id, identification_t *my_id,sa_config_t **sa_config);
/**
* Destroys configuration manager
*
@@ -177,7 +112,7 @@ struct configuration_manager_t {
* @return
* - SUCCESS
*/
status_t (*destroy) (configuration_manager_t *this);
void (*destroy) (configuration_manager_t *this);
};
/**
Source/charon/config/init_config.c
+33 -5
View File
@@ -24,6 +24,7 @@
#include <utils/allocator.h>
#include <utils/linked_list.h>
#include <utils/logger.h>
typedef struct private_init_config_t private_init_config_t;
@@ -58,13 +59,29 @@ struct private_init_config_t {
*/
static host_t * get_my_host (private_init_config_t *this)
{
return this->my_host->clone(this->my_host);
return this->my_host;
}
/**
* Implementation of init_config_t.get_other_host.
*/
static host_t * get_other_host (private_init_config_t *this)
{
return this->other_host;
}
/**
* Implementation of init_config_t.get_my_host_clone.
*/
static host_t * get_my_host_clone (private_init_config_t *this)
{
return this->my_host->clone(this->my_host);
}
/**
* Implementation of init_config_t.get_other_host_clone.
*/
static host_t * get_other_host_clone (private_init_config_t *this)
{
return this->other_host->clone(this->other_host);
}
@@ -131,13 +148,21 @@ static status_t select_proposal (private_init_config_t *this, ike_proposal_t *pr
{
my_iterator->current(my_iterator,(void **) &my_current_proposal);
if (memcmp(my_current_proposal,&proposals[i],sizeof(ike_proposal_t)) == 0)
/* memcmp doesn't work here */
if ((proposals[i].encryption_algorithm == my_current_proposal->encryption_algorithm) &&
(proposals[i].encryption_algorithm_key_length == my_current_proposal->encryption_algorithm_key_length) &&
(proposals[i].integrity_algorithm == my_current_proposal->integrity_algorithm) &&
(proposals[i].integrity_algorithm_key_length == my_current_proposal->integrity_algorithm_key_length) &&
(proposals[i].pseudo_random_function == my_current_proposal->pseudo_random_function) &&
(proposals[i].pseudo_random_function_key_length == my_current_proposal->pseudo_random_function_key_length) &&
(proposals[i].diffie_hellman_group == my_current_proposal->diffie_hellman_group))
{
/* found a matching proposal */
*selected_proposal = *my_current_proposal;
my_iterator->destroy(my_iterator);
return SUCCESS;
}
}
}
@@ -151,6 +176,7 @@ static status_t select_proposal (private_init_config_t *this, ike_proposal_t *pr
static void add_proposal (private_init_config_t *this,size_t priority, ike_proposal_t proposal)
{
ike_proposal_t * new_proposal = allocator_alloc(sizeof(ike_proposal_t));
status_t status;
*new_proposal = proposal;
@@ -161,7 +187,8 @@ static void add_proposal (private_init_config_t *this,size_t priority, ike_propo
return;
}
this->proposals->insert_at_position(this->proposals,(priority - 1),new_proposal);
status = this->proposals->insert_at_position(this->proposals,(priority - 1),new_proposal);
}
/**
@@ -180,7 +207,6 @@ static void destroy (private_init_config_t *this)
this->my_host->destroy(this->my_host);
this->other_host->destroy(this->other_host);
allocator_free(this);
}
@@ -194,6 +220,8 @@ init_config_t * init_config_create(char * my_ip, char *other_ip, u_int16_t my_po
/* public functions */
this->public.get_my_host = (host_t*(*)(init_config_t*))get_my_host;
this->public.get_other_host = (host_t*(*)(init_config_t*))get_other_host;
this->public.get_my_host_clone = (host_t*(*)(init_config_t*))get_my_host_clone;
this->public.get_other_host_clone = (host_t*(*)(init_config_t*))get_other_host_clone;
this->public.get_dh_group_number = (diffie_hellman_group_t (*)(init_config_t*,size_t))get_dh_group_number;
this->public.get_proposals = (size_t(*)(init_config_t*,ike_proposal_t**))get_proposals;
this->public.select_proposal = (status_t(*)(init_config_t*,ike_proposal_t*,size_t,ike_proposal_t*))select_proposal;
@@ -203,7 +231,7 @@ init_config_t * init_config_create(char * my_ip, char *other_ip, u_int16_t my_po
/* private variables */
this->my_host = host_create(AF_INET,my_ip, my_port);
this->other_host = host_create(AF_INET,other_ip, other_port);
this->proposals = linked_list_create();
return (&this->public);
Source/charon/config/init_config.h
+22 -2
View File
@@ -87,7 +87,7 @@ struct init_config_t {
/**
* Get my host information as host_t object.
*
* @warning Object is getting cloned and has to get destroyed by caller.
* @warning Object is NOT getting cloned.
*
* @param this calling object
* @return host information as host_t object
@@ -97,13 +97,33 @@ struct init_config_t {
/**
* Get other host information as host_t object.
*
* @warning Object is getting cloned and has to get destroyed by caller.
* @warning Object is NOT getting cloned.
*
* @param this calling object
* @return host information as host_t object
*/
host_t * (*get_other_host) (init_config_t *this);
/**
* Get my host information as host_t object.
*
* @warning Object is not getting cloned and has to get destroyed by caller.
*
* @param this calling object
* @return host information as host_t object
*/
host_t * (*get_my_host_clone) (init_config_t *this);
/**
* Get other host information as host_t object.
*
* @warning Object is not getting cloned and has to get destroyed by caller.
*
* @param this calling object
* @return host information as host_t object
*/
host_t * (*get_other_host_clone) (init_config_t *this);
/**
* Get the diffie hellman group to use as initiator with given priority.
*
Source/charon/daemon.h
+1 -1
View File
@@ -54,7 +54,7 @@
* Port on which the daemon will
* listen for incoming traffic
*/
#define IKEV2_UDP_PORT 500
#define IKEV2_UDP_PORT 4500
/**
* Default loglevel to use. This is the
Source/charon/network/host.c
+55 -19
View File
@@ -69,6 +69,34 @@ static socklen_t *get_sockaddr_len(private_host_t *this)
return &(this->socklen);
}
/**
* Implementation of host_t.is_default_route.
*/
static bool is_default_route (private_host_t *this)
{
switch (this->family)
{
case AF_INET:
{
int i;
for (i = 0; i < 4;i++)
{
struct sockaddr_in *sin = (struct sockaddr_in*)&(this->address);
if (*((&sin->sin_addr.s_addr) + i) != 0)
{
return FALSE;
}
}
return TRUE;
}
default:
{
/* empty chunk is returned */
return FALSE;
}
}
}
/**
* implements host_t.get_address
*/
@@ -156,7 +184,7 @@ static private_host_t *clone(private_host_t *this)
/**
* Impelements host_t.equals
*/
static bool equals(private_host_t *this, private_host_t *other)
static bool ip_is_equal(private_host_t *this, private_host_t *other)
{
switch (this->family)
{
@@ -166,7 +194,6 @@ static bool equals(private_host_t *this, private_host_t *other)
struct sockaddr_in *sin1 = (struct sockaddr_in*)&(this->address);
struct sockaddr_in *sin2 = (struct sockaddr_in*)&(other->address);
if ((sin1->sin_family == sin2->sin_family) &&
(sin1->sin_port == sin2->sin_port) &&
(sin1->sin_addr.s_addr == sin2->sin_addr.s_addr))
{
return TRUE;
@@ -177,10 +204,10 @@ static bool equals(private_host_t *this, private_host_t *other)
}
/*
* Described in header.
/**
* Creates an empty host_t object
*/
host_t *host_create(int family, char *address, u_int16_t port)
static private_host_t *host_create_empty()
{
private_host_t *this = allocator_alloc_thing(private_host_t);
@@ -190,8 +217,20 @@ host_t *host_create(int family, char *address, u_int16_t port)
this->public.get_address = (char* (*) (host_t *))get_address;
this->public.get_address_as_chunk = (chunk_t (*) (host_t *)) get_address_as_chunk;
this->public.get_port = (u_int16_t (*) (host_t *))get_port;
this->public.ip_is_equal = (bool (*) (host_t *,host_t *)) ip_is_equal;
this->public.is_default_route = (bool (*) (host_t *)) is_default_route;
this->public.destroy = (void (*) (host_t*))destroy;
return this;
}
/*
* Described in header.
*/
host_t *host_create(int family, char *address, u_int16_t port)
{
private_host_t *this = host_create_empty();
this->family = family;
switch (family)
@@ -204,11 +243,16 @@ host_t *host_create(int family, char *address, u_int16_t port)
sin->sin_addr.s_addr = inet_addr(address);
sin->sin_port = htons(port);
this->socklen = sizeof(struct sockaddr_in);
return (host_t*)this;
return &(this->public);
}
default:
{
allocator_free(this);
return NULL;
}
}
allocator_free(this);
return NULL;
}
/*
@@ -216,16 +260,7 @@ host_t *host_create(int family, char *address, u_int16_t port)
*/
host_t *host_create_from_chunk(int family, chunk_t address, u_int16_t port)
{
private_host_t *this = allocator_alloc_thing(private_host_t);
this->public.get_sockaddr = (sockaddr_t* (*) (host_t*))get_sockaddr;
this->public.get_sockaddr_len = (socklen_t*(*) (host_t*))get_sockaddr_len;
this->public.clone = (host_t* (*) (host_t*))clone;
this->public.get_address = (char* (*) (host_t *))get_address;
this->public.get_address_as_chunk = (chunk_t (*) (host_t *)) get_address_as_chunk;
this->public.get_port = (u_int16_t (*) (host_t *))get_port;
this->public.equals = (bool (*) (host_t *,host_t *))equals;
this->public.destroy = (void (*) (host_t*))destroy;
private_host_t *this = host_create_empty();
this->family = family;
@@ -241,8 +276,9 @@ host_t *host_create_from_chunk(int family, chunk_t address, u_int16_t port)
memcpy(&(sin->sin_addr.s_addr),address.ptr,4);
sin->sin_port = htons(port);
this->socklen = sizeof(struct sockaddr_in);
return (host_t*)this;
return &(this->public);
}
}
}
allocator_free(this);
Source/charon/network/host.h
+15 -5
View File
@@ -81,17 +81,27 @@ struct host_t {
* Mostly used for debugging purposes.
* @warning string must NOT be freed
*
* @param this object to clone
* @param this object
* @return address string,
*/
char* (*get_address) (host_t *this);
/**
* @brief Checks if the ip address of host is set to default route.
*
* @param this calling object
* @return
* - TRUE if host has IP 0.0.0.0 for default route
* - FALSE otherwise
*/
bool (*is_default_route) (host_t *this);
/**
* @brief get the address of this host as chunk_t
*
* @warning returned chunk has to get destroyed by caller.
*
* @param this object to clone
* @param this object
* @return address string,
*/
chunk_t (*get_address_as_chunk) (host_t *this);
@@ -107,13 +117,13 @@ struct host_t {
u_int16_t (*get_port) (host_t *this);
/**
* @brief Compare two hosts.
* @brief Compare the ips of two hosts hosts.
*
* @param this object to compare
* @param other the other to compare
* @return TRUE if port and address are equal
* @return TRUE if addresses are equal.
*/
bool (*equals) (host_t *this, host_t *other);
bool (*ip_is_equal) (host_t *this, host_t *other);
/**
* @brief Destroy this host object
Source/charon/sa/ike_sa.c
+72 -66
View File
@@ -81,6 +81,16 @@ struct private_ike_sa_t {
* Linked List containing the child sa's of the current IKE_SA
*/
linked_list_t *child_sas;
/**
* TODO
*/
init_config_t *init_config;
/**
* TODO
*/
sa_config_t *sa_config;
/**
* Current state of the IKE_SA
@@ -297,11 +307,7 @@ static status_t initialize_connection(private_ike_sa_t *this, char *name)
current_state = (initiator_init_t *) this->current_state;
status = current_state->initiate_connection(current_state,name);
if (status != SUCCESS)
{
this->create_delete_job(this);
}
return status;
}
@@ -467,16 +473,43 @@ static host_t *get_other_host (private_ike_sa_t *this)
return this->other.host;
}
/**
* Implementation of protected_ike_sa_t.get_init_config.
*/
static init_config_t *get_init_config (private_ike_sa_t *this)
{
return this->init_config;
}
/**
* Implementation of protected_ike_sa_t.set_init_config.
*/
static void set_init_config (private_ike_sa_t *this,init_config_t * init_config)
{
this->init_config = init_config;
}
/**
* Implementation of protected_ike_sa_t.get_sa_config.
*/
static sa_config_t *get_sa_config (private_ike_sa_t *this)
{
return this->sa_config;
}
/**
* Implementation of protected_ike_sa_t.set_sa_config.
*/
static void set_sa_config (private_ike_sa_t *this,sa_config_t * sa_config)
{
this->sa_config = sa_config;
}
/**
* Implementation of protected_ike_sa_t.set_my_host.
*/
static void set_my_host (private_ike_sa_t *this, host_t *my_host)
{
if (this->me.host != NULL)
{
this ->logger->log(this->logger, CONTROL|MOST, "Destroy existing my host object");
this->me.host->destroy(this->me.host);
}
this->me.host = my_host;
}
@@ -485,61 +518,25 @@ static void set_my_host (private_ike_sa_t *this, host_t *my_host)
*/
static void set_other_host (private_ike_sa_t *this, host_t *other_host)
{
if (this->other.host != NULL)
{
this ->logger->log(this->logger, CONTROL|MOST, "Destroy existing other host object");
this->other.host->destroy(this->other.host);
}
this->other.host = other_host;
}
/**
* Implementation of protected_ike_sa_t.set_prf.
*/
static status_t create_transforms_from_proposal (private_ike_sa_t *this,proposal_substructure_t *proposal)
static status_t create_transforms_from_proposal (private_ike_sa_t *this,ike_proposal_t *proposal)
{
status_t status;
u_int16_t encryption_algorithm;
u_int16_t encryption_algorithm_key_length;
u_int16_t integrity_algorithm;
u_int16_t integrity_algorithm_key_length;
u_int16_t pseudo_random_function;
u_int16_t pseudo_random_function_key_length;
this->logger->log(this->logger, CONTROL|MORE, "Going to create transform objects for proposal");
this->logger->log(this->logger, CONTROL|MOST, "Get encryption transform type");
status = proposal->get_info_for_transform_type(proposal,ENCRYPTION_ALGORITHM,&(encryption_algorithm),&(encryption_algorithm_key_length));
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR|MORE, "Could not get encryption transform type");
return status;
}
this->logger->log(this->logger, CONTROL|MORE, "Encryption algorithm: %s with keylength %d",mapping_find(encryption_algorithm_m,encryption_algorithm),encryption_algorithm_key_length);
this->logger->log(this->logger, CONTROL|MOST, "Get integrity transform type");
status = proposal->get_info_for_transform_type(proposal,INTEGRITY_ALGORITHM,&(integrity_algorithm),&(integrity_algorithm_key_length));
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR|MORE, "Could not get integrity transform type");
return status;
}
this->logger->log(this->logger, CONTROL|MORE, "integrity algorithm: %s with keylength %d",mapping_find(integrity_algorithm_m,integrity_algorithm),integrity_algorithm_key_length);
this->logger->log(this->logger, CONTROL|MOST, "Get prf transform type");
status = proposal->get_info_for_transform_type(proposal,PSEUDO_RANDOM_FUNCTION,&(pseudo_random_function),&(pseudo_random_function_key_length));
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR|MORE, "Could not prf transform type");
return status;
}
this->logger->log(this->logger, CONTROL|MORE, "prf: %s with keylength %d",mapping_find(pseudo_random_function_m,pseudo_random_function),pseudo_random_function_key_length);
this->logger->log(this->logger, CONTROL|MORE, "Encryption algorithm: %s with keylength %d",mapping_find(encryption_algorithm_m,proposal->encryption_algorithm),proposal->encryption_algorithm_key_length);
this->logger->log(this->logger, CONTROL|MORE, "integrity algorithm: %s with keylength %d",mapping_find(integrity_algorithm_m,proposal->integrity_algorithm),proposal->integrity_algorithm_key_length);
this->logger->log(this->logger, CONTROL|MORE, "prf: %s with keylength %d",mapping_find(pseudo_random_function_m,proposal->pseudo_random_function),proposal->pseudo_random_function_key_length);
if (this->prf != NULL)
{
this->prf->destroy(this->prf);
}
this->prf = prf_create(pseudo_random_function);
this->prf = prf_create(proposal->pseudo_random_function);
if (this->prf == NULL)
{
this->logger->log(this->logger, ERROR|MORE, "prf not supported!");
@@ -550,7 +547,7 @@ static status_t create_transforms_from_proposal (private_ike_sa_t *this,proposal
{
this->crypter_initiator->destroy(this->crypter_initiator);
}
this->crypter_initiator = crypter_create(encryption_algorithm,encryption_algorithm_key_length);
this->crypter_initiator = crypter_create(proposal->encryption_algorithm,proposal->encryption_algorithm_key_length);
if (this->crypter_initiator == NULL)
{
this->logger->log(this->logger, ERROR|MORE, "encryption algorithm not supported!");
@@ -561,7 +558,7 @@ static status_t create_transforms_from_proposal (private_ike_sa_t *this,proposal
{
this->crypter_responder->destroy(this->crypter_responder);
}
this->crypter_responder = crypter_create(encryption_algorithm,encryption_algorithm_key_length);
this->crypter_responder = crypter_create(proposal->encryption_algorithm,proposal->encryption_algorithm_key_length);
if (this->crypter_responder == NULL)
{
this->logger->log(this->logger, ERROR|MORE, "encryption algorithm not supported!");
@@ -572,7 +569,7 @@ static status_t create_transforms_from_proposal (private_ike_sa_t *this,proposal
{
this->signer_initiator->destroy(this->signer_initiator);
}
this->signer_initiator = signer_create(integrity_algorithm);
this->signer_initiator = signer_create(proposal->integrity_algorithm);
if (this->signer_initiator == NULL)
{
this->logger->log(this->logger, ERROR|MORE, "integrity algorithm not supported!");
@@ -583,7 +580,7 @@ static status_t create_transforms_from_proposal (private_ike_sa_t *this,proposal
{
this->signer_responder->destroy(this->signer_responder);
}
this->signer_responder = signer_create(integrity_algorithm);
this->signer_responder = signer_create(proposal->integrity_algorithm);
if (this->signer_responder == NULL)
{
this->logger->log(this->logger, ERROR|MORE, "integrity algorithm not supported!");
@@ -733,6 +730,19 @@ static void destroy (private_ike_sa_t *this)
this->last_requested_message->destroy(this->last_requested_message);
}
/* destroy stored host_t objects */
if (this->me.host != NULL)
{
this->me.host->destroy(this->me.host);
}
/* destroy stored host_t objects */
if (this->other.host != NULL)
{
this->other.host->destroy(this->other.host);
}
/* destroy stored responded messages */
if (this->last_responded_message != NULL)
{
@@ -741,16 +751,6 @@ static void destroy (private_ike_sa_t *this)
this->randomizer->destroy(this->randomizer);
if (this->me.host != NULL)
{
this->me.host->destroy(this->me.host);
}
if (this->other.host != NULL)
{
this->other.host->destroy(this->other.host);
}
this->logger->log(this->logger, CONTROL | MOST, "Destroy current state object");
this->current_state->destroy(this->current_state);
@@ -777,6 +777,10 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->protected.build_message = (void (*) (protected_ike_sa_t *, exchange_type_t , bool , message_t **)) build_message;
this->protected.compute_secrets = (void (*) (protected_ike_sa_t *,chunk_t ,chunk_t , chunk_t )) compute_secrets;
this->protected.get_logger = (logger_t *(*) (protected_ike_sa_t *)) get_logger;
this->protected.set_init_config = (void (*) (protected_ike_sa_t *,init_config_t *)) set_init_config;
this->protected.get_init_config = (init_config_t *(*) (protected_ike_sa_t *)) get_init_config;
this->protected.set_sa_config = (void (*) (protected_ike_sa_t *,sa_config_t *)) set_sa_config;
this->protected.get_sa_config = (sa_config_t *(*) (protected_ike_sa_t *)) get_sa_config;
this->protected.get_my_host = (host_t *(*) (protected_ike_sa_t *)) get_my_host;
this->protected.get_other_host = (host_t *(*) (protected_ike_sa_t *)) get_other_host;
this->protected.set_my_host = (void(*) (protected_ike_sa_t *,host_t *)) set_my_host;
@@ -784,7 +788,7 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->protected.get_randomizer = (randomizer_t *(*) (protected_ike_sa_t *)) get_randomizer;
this->protected.set_last_requested_message = (status_t (*) (protected_ike_sa_t *,message_t *)) set_last_requested_message;
this->protected.set_last_responded_message = (status_t (*) (protected_ike_sa_t *,message_t *)) set_last_responded_message;
this->protected.create_transforms_from_proposal = (status_t (*) (protected_ike_sa_t *,proposal_substructure_t *)) create_transforms_from_proposal;
this->protected.create_transforms_from_proposal = (status_t (*) (protected_ike_sa_t *,ike_proposal_t *)) create_transforms_from_proposal;
this->protected.set_new_state = (void (*) (protected_ike_sa_t *,state_t *)) set_new_state;
this->protected.get_crypter_initiator = (crypter_t *(*) (protected_ike_sa_t *)) get_crypter_initiator;
this->protected.get_signer_initiator = (signer_t *(*) (protected_ike_sa_t *)) get_signer_initiator;
@@ -821,6 +825,8 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
this->signer_initiator = NULL;
this->signer_responder = NULL;
this->prf = NULL;
this->init_config = NULL;
this->sa_config = NULL;
/* at creation time, IKE_SA is in a initiator state */
if (ike_sa_id->is_initiator(ike_sa_id))
Source/charon/sa/ike_sa.h
+38 -2
View File
@@ -27,6 +27,7 @@
#include <encoding/message.h>
#include <encoding/payloads/proposal_substructure.h>
#include <sa/ike_sa_id.h>
#include <config/configuration_manager.h>
#include <utils/logger.h>
#include <utils/randomizer.h>
#include <sa/states/state.h>
@@ -137,6 +138,41 @@ struct protected_ike_sa_t {
*/
logger_t *(*get_logger) (protected_ike_sa_t *this);
/**
* Gets the internal stored init_config_t object.
*
* Returned value has to get checked for NULL value!
*
* @param this calling object
* @return pointer to the internal stored init_config_t object
*/
init_config_t *(*get_init_config) (protected_ike_sa_t *this);
/**
* Sets the internal init_config_t object.
*
* @param this calling object
* @param init_config object of type init_config_t
*/
void (*set_init_config) (protected_ike_sa_t *this,init_config_t *init_config);
/**
* Gets the internal stored sa_config_t object.
*
* Returned value has to get checked for NULL value!
*
* @param this calling object
* @return pointer to the internal stored sa_config_t object
*/
sa_config_t *(*get_sa_config) (protected_ike_sa_t *this);
/**
* Sets the internal sa_config_t object.
*
* @param this calling object
* @param sa_config object of type sa_config_t
*/
void (*set_sa_config) (protected_ike_sa_t *this,sa_config_t *sa_config);
/**
* Gets the internal stored host_t object for my host.
@@ -176,7 +212,7 @@ struct protected_ike_sa_t {
/**
* Creates all needed transform objects for given ike_sa_t using
* the informations stored in a proposal_substructure_t object
* the informations stored in a ike_proposal_t object
*
* Allready existing objects get destroyed.
*
@@ -184,7 +220,7 @@ struct protected_ike_sa_t {
* @param proposal proposal used to get informations for transform
* objects (algorithms, key lengths, etc.)
*/
status_t (*create_transforms_from_proposal) (protected_ike_sa_t *this,proposal_substructure_t *proposal);
status_t (*create_transforms_from_proposal) (protected_ike_sa_t *this,ike_proposal_t * proposal);
/**
* Sets the last requested message.
Source/charon/sa/states/ike_sa_init_requested.c
+26 -35
View File
@@ -173,57 +173,48 @@ static status_t process_message(private_ike_sa_init_requested_t *this, message_t
case SECURITY_ASSOCIATION:
{
sa_payload_t *sa_payload = (sa_payload_t*)payload;
iterator_t *suggested_proposals;
proposal_substructure_t *suggested_proposal;
bool valid;
ike_proposal_t *ike_proposals;
ike_proposal_t selected_proposal;
size_t proposal_count;
init_config_t *init_config;
/* get the list of suggested proposals */
suggested_proposals = sa_payload->create_proposal_substructure_iterator(sa_payload, TRUE);
status = sa_payload->get_ike_proposals (sa_payload, &ike_proposals,&proposal_count);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR | MORE, "SA payload does not contain IKE proposals");
payloads->destroy(payloads);
return status;
}
if (proposal_count != 1)
{
this->logger->log(this->logger, ERROR | MORE, "More then one proposal selected!");
allocator_free(ike_proposals);
payloads->destroy(payloads);
return status;
}
/* now let the configuration-manager check the selected proposals*/
this->logger->log(this->logger, CONTROL | MOST, "Check suggested proposals");
status = charon->configuration_manager->check_selected_proposals_for_host(charon->configuration_manager,
this->ike_sa->get_other_host(this->ike_sa), suggested_proposals,&valid);
init_config = this->ike_sa->get_init_config(this->ike_sa);
status = init_config->select_proposal (init_config,ike_proposals,1,&selected_proposal);
allocator_free(ike_proposals);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR | MORE, "Could not check suggested proposals!");
suggested_proposals->destroy(suggested_proposals);
this->logger->log(this->logger, ERROR | MORE, "Selected proposal not a suggested one!");
payloads->destroy(payloads);
return status;
}
if (!valid)
{
this->logger->log(this->logger, ERROR | MORE, "Suggested proposals not accepted!");
payloads->destroy(payloads);
return status;
}
/* let the ike_sa create their own transforms from proposal informations */
suggested_proposals->reset(suggested_proposals);
/* TODO check for true*/
suggested_proposals->has_next(suggested_proposals);
status = suggested_proposals->current(suggested_proposals,(void **)&suggested_proposal);
suggested_proposals->destroy(suggested_proposals);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR | MORE, "Could not get first proposal");
payloads->destroy(payloads);
return status;
}
status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,suggested_proposal);
status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,&selected_proposal);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR | MORE, "Transform objects could not be created from selected proposal");
payloads->destroy(payloads);
return status;
}
/* ok, we have what we need for sa_payload */
break;
}
Source/charon/sa/states/ike_sa_init_responded.c
+1 -2
View File
@@ -83,7 +83,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
status_t status;
signer_t *signer;
crypter_t *crypter;
iterator_t *payloads, *iterator;
iterator_t *payloads;
exchange_type_t exchange_type;
id_payload_t *idi_payload, *idr_payload;
auth_payload_t *auth_payload;
@@ -234,7 +234,6 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
static status_t build_id_payload(private_ike_sa_init_responded_t *this, id_payload_t *id_payload)
{
return SUCCESS;
}
Source/charon/sa/states/initiator_init.c
+22 -76
View File
@@ -72,12 +72,6 @@ struct private_initiator_init_t {
* This nonce is passed to the next state of type ike_sa_init_requested_t.
*/
chunk_t sent_nonce;
/**
* Proposals used to initiate connection.
*
*/
linked_list_t *proposals;
/**
* Logger used to log :-)
@@ -136,66 +130,43 @@ struct private_initiator_init_t {
*/
static status_t initiate_connection (private_initiator_init_t *this, char *name)
{
iterator_t *proposal_iterator;
ike_sa_init_requested_t *next_state;
message_t *message;
packet_t *packet;
status_t status;
host_t *my_host;
host_t *other_host;
randomizer_t *randomizer;
init_config_t *init_config;
this->logger->log(this->logger, CONTROL, "Initializing connection %s",name);
/* get local host */
status = charon->configuration_manager->get_local_host(charon->configuration_manager, name, &my_host);
/* get init_config_t object */
status = charon->configuration_manager->get_init_config_for_name(charon->configuration_manager,name,&init_config);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR | MORE, "Could not retrieve local host configuration information for %s",name);
this->logger->log(this->logger, ERROR | MORE, "Could not retrieve INIT configuration informations for %s",name);
return INVALID_ARG;
}
this->ike_sa->set_my_host(this->ike_sa,my_host);
/* get remote host */
status = charon->configuration_manager->get_remote_host(charon->configuration_manager, name, &other_host);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR | MORE, "Could not retrieve remote host configuration information for %s",name);
return INVALID_ARG;
}
this->ike_sa->set_other_host(this->ike_sa,other_host);
/* configuration can be set */
this->ike_sa->set_init_config(this->ike_sa,init_config);
/* get dh group */
status = charon->configuration_manager->get_dh_group_number(charon->configuration_manager, name, &(this->dh_group_number), this->dh_group_priority);
if (status != SUCCESS)
this->ike_sa->set_other_host(this->ike_sa,init_config->get_other_host_clone(init_config));
this->ike_sa->set_my_host(this->ike_sa,init_config->get_my_host_clone(init_config));
this->dh_group_number = init_config->get_dh_group_number(init_config,this->dh_group_priority);
if (this->dh_group_number == MODP_UNDEFINED)
{
this->logger->log(this->logger, ERROR | MORE, "Could not retrieve DH group number configuration for %s",name);
this->logger->log(this->logger, ERROR | MORE, "Diffie hellman group could not be retrieved with priority %d", this->dh_group_priority);
return INVALID_ARG;
}
/* get proposals */
proposal_iterator = this->proposals->create_iterator(this->proposals, FALSE);
status = charon->configuration_manager->get_proposals_for_host(charon->configuration_manager, this->ike_sa->get_other_host(this->ike_sa), proposal_iterator);
proposal_iterator->destroy(proposal_iterator);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR | MORE, "Could not retrieve Proposals for %s",name);
return status;
}
/* a diffie hellman object could allready exist caused by an failed initiate_connection call */
if (this->diffie_hellman == NULL)
{
this->diffie_hellman = diffie_hellman_create(this->dh_group_number);
}
if (this->diffie_hellman == NULL)
{
this->logger->log(this->logger, ERROR, "Object of type diffie_hellman_t could not be created!");
return FAILED;
}
if (this->sent_nonce.ptr != NULL)
{
allocator_free(this->sent_nonce.ptr);
@@ -286,29 +257,19 @@ static void build_ike_sa_init_request (private_initiator_init_t *this, message_t
static void build_sa_payload(private_initiator_init_t *this, payload_t **payload)
{
sa_payload_t* sa_payload;
iterator_t *proposal_iterator;
size_t proposal_count;
ike_proposal_t *proposals;
init_config_t *init_config;
/* SA payload takes proposals from this->ike_sa_init_data.proposals
* and writes them to the created sa_payload
*/
this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
proposal_iterator = this->proposals->create_iterator(this->proposals, FALSE);
sa_payload = sa_payload_create();
while (proposal_iterator->has_next(proposal_iterator))
{
proposal_substructure_t *current_proposal;
proposal_substructure_t *current_proposal_clone;
proposal_iterator->current(proposal_iterator,(void **) &current_proposal);
init_config = this->ike_sa->get_init_config(this->ike_sa);
current_proposal_clone = current_proposal->clone(current_proposal);
sa_payload->add_proposal_substructure(sa_payload,current_proposal_clone);
}
proposal_iterator->destroy(proposal_iterator);
proposal_count = init_config->get_proposals(init_config,&proposals);
sa_payload = sa_payload_create_from_ike_proposals(proposals,proposal_count);
allocator_free(proposals);
*payload = (payload_t *) sa_payload;
}
@@ -375,14 +336,7 @@ static void destroy(private_initiator_init_t *this)
/* destroy stored proposal */
this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
while (this->proposals->get_count(this->proposals) > 0)
{
proposal_substructure_t *current_proposal;
this->proposals->remove_first(this->proposals,(void **)&current_proposal);
current_proposal->destroy(current_proposal);
}
this->proposals->destroy(this->proposals);
/* destroy diffie hellman object */
if (this->diffie_hellman != NULL)
{
@@ -406,13 +360,6 @@ static void destroy_after_state_change (private_initiator_init_t *this)
/* destroy stored proposal */
this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
while (this->proposals->get_count(this->proposals) > 0)
{
proposal_substructure_t *current_proposal;
this->proposals->remove_first(this->proposals,(void **)&current_proposal);
current_proposal->destroy(current_proposal);
}
this->proposals->destroy(this->proposals);
allocator_free(this);
}
@@ -442,7 +389,6 @@ initiator_init_t *initiator_init_create(protected_ike_sa_t *ike_sa)
this->ike_sa = ike_sa;
this->dh_group_priority = 1;
this->logger = this->ike_sa->get_logger(this->ike_sa);
this->proposals = linked_list_create();
this->sent_nonce = CHUNK_INITIALIZER;
return &(this->public);
Source/charon/sa/states/responder_init.c
+36 -71
View File
@@ -89,10 +89,10 @@ struct private_responder_init_t {
logger_t *logger;
/**
* Proposals used to initiate connection
* Selected proposal from suggested ones.
*/
linked_list_t *proposals;
ike_proposal_t selected_proposal;
/**
* Builds the SA payload for this state.
*
@@ -147,6 +147,8 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
host_t *my_host;
host_t *other_host;
randomizer_t *randomizer;
init_config_t *init_config;
diffie_hellman_group_t dh_group = MODP_UNDEFINED;
exchange_type = message->get_exchange_type(message);
if (exchange_type != IKE_SA_INIT)
@@ -154,16 +156,26 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
this->logger->log(this->logger, ERROR | MORE, "Message of type %s not supported in state responder_init",mapping_find(exchange_type_m,exchange_type));
return FAILED;
}
if (!message->get_request(message))
{
this->logger->log(this->logger, ERROR | MORE, "Only requests of type IKE_SA_INIT supported in state responder_init");
return FAILED;
}
/* this is the first message we process, so copy host infos */
source = message->get_source(message);
destination = message->get_destination(message);
status = charon->configuration_manager->get_init_config_for_host(charon->configuration_manager,destination,source,&init_config);
if (status != SUCCESS)
{
/* no configuration matches given host */
this->logger->log(this->logger, ERROR | MORE, "No INIT configuration found for given remote and local hosts");
return FAILED;
}
this->ike_sa->set_init_config(this->ike_sa,init_config);
/* we need to clone them, since we destroy the message later */
my_host = destination->clone(destination);
@@ -195,44 +207,30 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
case SECURITY_ASSOCIATION:
{
sa_payload_t *sa_payload = (sa_payload_t*)payload;
iterator_t *suggested_proposals, *accepted_proposals;
proposal_substructure_t *accepted_proposal;
accepted_proposals = this->proposals->create_iterator(this->proposals, FALSE);
ike_proposal_t *ike_proposals;
size_t proposal_count;
/* get the list of suggested proposals */
suggested_proposals = sa_payload->create_proposal_substructure_iterator(sa_payload, TRUE);
/* now let the configuration-manager select a subset of the proposals */
status = charon->configuration_manager->select_proposals_for_host(charon->configuration_manager,
this->ike_sa->get_other_host(this->ike_sa), suggested_proposals, accepted_proposals);
status = sa_payload->get_ike_proposals (sa_payload, &ike_proposals,&proposal_count);
if (status != SUCCESS)
{
this->logger->log(this->logger, CONTROL | MORE, "No proposal of suggested proposals selected");
suggested_proposals->destroy(suggested_proposals);
accepted_proposals->destroy(accepted_proposals);
this->logger->log(this->logger, ERROR | MORE, "SA payload does not contain IKE proposals");
payloads->destroy(payloads);
return status;
}
status = init_config->select_proposal(init_config, ike_proposals,proposal_count,&(this->selected_proposal));
allocator_free(ike_proposals);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR | MORE, "No proposal of suggested proposals selected");
payloads->destroy(payloads);
return status;
}
/* iterators are not needed anymore */
suggested_proposals->destroy(suggested_proposals);
dh_group = this->selected_proposal.diffie_hellman_group;
/* let the ike_sa create their own transforms from proposal informations */
accepted_proposals->reset(accepted_proposals);
/* TODO check for true*/
accepted_proposals->has_next(accepted_proposals);
status = accepted_proposals->current(accepted_proposals,(void **)&accepted_proposal);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR | MORE, "Accepted proposals not supported?!");
accepted_proposals->destroy(accepted_proposals);
payloads->destroy(payloads);
return status;
}
status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,accepted_proposal);
accepted_proposals->destroy(accepted_proposals);
status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,&(this->selected_proposal));
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR | MORE, "Transform objects could not be created from selected proposal");
@@ -253,12 +251,9 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
group = ke_payload->get_dh_group_number(ke_payload);
status = charon->configuration_manager->is_dh_group_allowed_for_host(charon->configuration_manager,
this->ike_sa->get_other_host(this->ike_sa), group, &allowed_group);
if (status != SUCCESS)
if (dh_group == MODP_UNDEFINED)
{
this->logger->log(this->logger, ERROR | MORE, "Could not get informations about DH group");
this->logger->log(this->logger, ERROR | MORE, "Could not get informations about DH group. SA payload before KE payload?");
payloads->destroy(payloads);
return status;
}
@@ -387,27 +382,12 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
static void build_sa_payload(private_responder_init_t *this, payload_t **payload)
{
sa_payload_t* sa_payload;
iterator_t *proposal_iterator;
/* SA payload takes proposals from this->ike_sa_init_data.proposals and writes them to the created sa_payload */
this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
proposal_iterator = this->proposals->create_iterator(this->proposals, FALSE);
sa_payload = sa_payload_create();
while (proposal_iterator->has_next(proposal_iterator))
{
proposal_substructure_t *current_proposal;
proposal_substructure_t *current_proposal_clone;
proposal_iterator->current(proposal_iterator,(void **) &current_proposal);
current_proposal_clone = current_proposal->clone(current_proposal);
sa_payload->add_proposal_substructure(sa_payload,current_proposal_clone);
}
proposal_iterator->destroy(proposal_iterator);
sa_payload = sa_payload_create_from_ike_proposals(&(this->selected_proposal),1);
*payload = (payload_t *) sa_payload;
}
@@ -466,13 +446,6 @@ static void destroy(private_responder_init_t *this)
/* destroy stored proposal */
this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
while (this->proposals->get_count(this->proposals) > 0)
{
proposal_substructure_t *current_proposal;
this->proposals->remove_first(this->proposals,(void **)&current_proposal);
current_proposal->destroy(current_proposal);
}
this->proposals->destroy(this->proposals);
allocator_free(this->sent_nonce.ptr);
allocator_free(this->received_nonce.ptr);
@@ -493,13 +466,6 @@ static void destroy_after_state_change (private_responder_init_t *this)
/* destroy stored proposal */
this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
while (this->proposals->get_count(this->proposals) > 0)
{
proposal_substructure_t *current_proposal;
this->proposals->remove_first(this->proposals,(void **)&current_proposal);
current_proposal->destroy(current_proposal);
}
this->proposals->destroy(this->proposals);
/* destroy diffie hellman object */
if (this->diffie_hellman != NULL)
@@ -534,7 +500,6 @@ responder_init_t *responder_init_create(protected_ike_sa_t *ike_sa)
this->logger = this->ike_sa->get_logger(this->ike_sa);
this->sent_nonce = CHUNK_INITIALIZER;
this->received_nonce = CHUNK_INITIALIZER;
this->proposals = linked_list_create();
return &(this->public);
}
Source/charon/utils/identification.c
+20
View File
@@ -80,6 +80,25 @@ static char *get_string(private_identification_t *this)
return this->string;
}
/**
* Implementation of identification_t.equals.
*/
static bool equals (private_identification_t *this,private_identification_t *other)
{
if (this->type == other->type)
{
if (this->encoded.len != other->encoded.len)
{
return FALSE;
}
if (memcmp(this->encoded.ptr,other->encoded.ptr,this->encoded.len) == 0)
{
return TRUE;
}
}
return FALSE;
}
/**
* implements identification_t.destroy
*/
@@ -99,6 +118,7 @@ static private_identification_t *identification_create()
private_identification_t *this = allocator_alloc_thing(private_identification_t);
/* assign methods */
this->public.equals = (bool (*) (identification_t*,identification_t*))equals;
this->public.get_encoding = (chunk_t (*) (identification_t*))get_encoding;
this->public.get_type = (id_type_t (*) (identification_t*))get_type;
this->public.get_string = (char* (*) (identification_t*))get_string;
Source/charon/utils/identification.h
+10
View File
@@ -76,6 +76,16 @@ struct identification_t {
* @return string
*/
char *(*get_string) (identification_t *this);
/**
* @brief Check if two identification_t objects are equal.
*
* @param this the identification_t_object
* @param other other identification_t_object
* @return string
*/
bool (*equals) (identification_t *this,identification_t *other);
/**
* @brief Destroys a identification_t object.
Source/charon/utils/logger_manager.c
+1
View File
@@ -150,6 +150,7 @@ static logger_t *create_logger(private_logger_manager_t *this, logger_context_t
case MESSAGE:
case WORKER:
logger_level |= ALL;
break;
case PARSER:
case GENERATOR:
case THREAD_POOL: