- changed interface of ike_sa
- states can access ike_sa fields now just with functions
This commit is contained in:
Jan Hutter
+326
-31
@@ -44,16 +44,175 @@
|
||||
|
||||
|
||||
|
||||
typedef struct private_ike_sa_t private_ike_sa_t;
|
||||
|
||||
/**
|
||||
* Private data of an ike_sa_t object.
|
||||
*/
|
||||
struct private_ike_sa_t {
|
||||
|
||||
/**
|
||||
* Protected part of a ike_sa_t object.
|
||||
*/
|
||||
protected_ike_sa_t protected;
|
||||
|
||||
|
||||
/**
|
||||
* Creates a job to delete the given IKE_SA.
|
||||
*
|
||||
* @param this calling object
|
||||
*/
|
||||
status_t (*create_delete_job) (private_ike_sa_t *this);
|
||||
|
||||
/**
|
||||
* Resends the last sent reply.
|
||||
*
|
||||
* @param this calling object
|
||||
*/
|
||||
status_t (*resend_last_reply) (private_ike_sa_t *this);
|
||||
|
||||
/* private values */
|
||||
|
||||
/**
|
||||
* Identifier for the current IKE_SA
|
||||
*/
|
||||
ike_sa_id_t *ike_sa_id;
|
||||
|
||||
/**
|
||||
* Linked List containing the child sa's of the current IKE_SA
|
||||
*/
|
||||
linked_list_t *child_sas;
|
||||
|
||||
/**
|
||||
* Current state of the IKE_SA
|
||||
*/
|
||||
state_t *current_state;
|
||||
|
||||
/**
|
||||
* this SA's source for random data
|
||||
*/
|
||||
randomizer_t *randomizer;
|
||||
|
||||
/**
|
||||
* contains the last responded message
|
||||
*
|
||||
*/
|
||||
message_t *last_responded_message;
|
||||
|
||||
/**
|
||||
* contains the last requested message
|
||||
*
|
||||
*/
|
||||
message_t *last_requested_message;
|
||||
|
||||
/**
|
||||
* Informations of this host
|
||||
*/
|
||||
struct {
|
||||
host_t *host;
|
||||
} me;
|
||||
|
||||
/**
|
||||
* Informations of the other host
|
||||
*/
|
||||
struct {
|
||||
host_t *host;
|
||||
} other;
|
||||
|
||||
/**
|
||||
* Crypter object for initiator
|
||||
*/
|
||||
crypter_t *crypter_initiator;
|
||||
|
||||
/**
|
||||
* Crypter object for responder
|
||||
*/
|
||||
crypter_t *crypter_responder;
|
||||
|
||||
/**
|
||||
* Signer object for initiator
|
||||
*/
|
||||
signer_t *signer_initiator;
|
||||
|
||||
/**
|
||||
* Signer object for responder
|
||||
*/
|
||||
signer_t *signer_responder;
|
||||
|
||||
/**
|
||||
* prf function
|
||||
*/
|
||||
prf_t *prf;
|
||||
|
||||
|
||||
|
||||
/**
|
||||
* Shared secrets
|
||||
*/
|
||||
struct {
|
||||
/**
|
||||
* Key used for deriving other keys
|
||||
*/
|
||||
chunk_t d_key;
|
||||
|
||||
/**
|
||||
* Key for authenticate (initiator)
|
||||
*/
|
||||
chunk_t ai_key;
|
||||
|
||||
/**
|
||||
* Key for authenticate (responder)
|
||||
*/
|
||||
chunk_t ar_key;
|
||||
|
||||
/**
|
||||
* Key for encryption (initiator)
|
||||
*/
|
||||
chunk_t ei_key;
|
||||
|
||||
/**
|
||||
* Key for encryption (responder)
|
||||
*/
|
||||
chunk_t er_key;
|
||||
|
||||
/**
|
||||
* Key for generating auth payload (initiator)
|
||||
*/
|
||||
chunk_t pi_key;
|
||||
|
||||
/**
|
||||
* Key for generating auth payload (responder)
|
||||
*/
|
||||
chunk_t pr_key;
|
||||
|
||||
} secrets;
|
||||
|
||||
/**
|
||||
* next message id to receive
|
||||
*/
|
||||
u_int32_t message_id_in;
|
||||
|
||||
/**
|
||||
* next message id to send
|
||||
*/
|
||||
u_int32_t message_id_out;
|
||||
|
||||
/**
|
||||
* a logger for this IKE_SA
|
||||
*/
|
||||
logger_t *logger;
|
||||
};
|
||||
|
||||
|
||||
/**
|
||||
* @brief implements function process_message of protected_ike_sa_t
|
||||
*/
|
||||
static status_t process_message (protected_ike_sa_t *this, message_t *message)
|
||||
static status_t process_message (private_ike_sa_t *this, message_t *message)
|
||||
{
|
||||
u_int32_t message_id;
|
||||
exchange_type_t exchange_type;
|
||||
bool is_request;
|
||||
status_t status;
|
||||
state_t *new_state;
|
||||
|
||||
/* we must process each request or response from remote host */
|
||||
|
||||
@@ -96,19 +255,16 @@ static status_t process_message (protected_ike_sa_t *this, message_t *message)
|
||||
}
|
||||
|
||||
/* now the message is processed by the current state object */
|
||||
status = this->current_state->process_message(this->current_state,message,&new_state);
|
||||
/* the current state does change the current change to the next one*/
|
||||
status = this->current_state->process_message(this->current_state,message);
|
||||
|
||||
if (status == SUCCESS)
|
||||
{
|
||||
this->current_state = new_state;
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Implements function build_message of protected_ike_sa_t.
|
||||
*/
|
||||
static status_t build_message(protected_ike_sa_t *this, exchange_type_t type, bool request, message_t **message)
|
||||
static status_t build_message(private_ike_sa_t *this, exchange_type_t type, bool request, message_t **message)
|
||||
{
|
||||
status_t status;
|
||||
message_t *new_message;
|
||||
@@ -162,12 +318,11 @@ static status_t build_message(protected_ike_sa_t *this, exchange_type_t type, bo
|
||||
/**
|
||||
* @brief implements function process_configuration of protected_ike_sa_t
|
||||
*/
|
||||
static status_t initialize_connection(protected_ike_sa_t *this, char *name)
|
||||
static status_t initialize_connection(private_ike_sa_t *this, char *name)
|
||||
{
|
||||
/* work is done in state object of type INITIATOR_INIT */
|
||||
initiator_init_t *current_state;
|
||||
status_t status;
|
||||
state_t *new_state;
|
||||
|
||||
if (this->current_state->get_state(this->current_state) != INITIATOR_INIT)
|
||||
{
|
||||
@@ -176,13 +331,9 @@ static status_t initialize_connection(protected_ike_sa_t *this, char *name)
|
||||
|
||||
current_state = (initiator_init_t *) this->current_state;
|
||||
|
||||
status = current_state->initiate_connection(current_state,name,&new_state);
|
||||
status = current_state->initiate_connection(current_state,name);
|
||||
|
||||
if (status == SUCCESS)
|
||||
{
|
||||
this->current_state = new_state;
|
||||
}
|
||||
else
|
||||
if (status != SUCCESS)
|
||||
{
|
||||
this->create_delete_job(this);
|
||||
}
|
||||
@@ -192,12 +343,12 @@ static status_t initialize_connection(protected_ike_sa_t *this, char *name)
|
||||
/**
|
||||
* @brief implements function protected_ike_sa_t.get_id
|
||||
*/
|
||||
static ike_sa_id_t* get_id(protected_ike_sa_t *this)
|
||||
static ike_sa_id_t* get_id(private_ike_sa_t *this)
|
||||
{
|
||||
return this->ike_sa_id;
|
||||
}
|
||||
|
||||
static status_t compute_secrets (protected_ike_sa_t *this,chunk_t dh_shared_secret,chunk_t initiator_nonce, chunk_t responder_nonce)
|
||||
static status_t compute_secrets (private_ike_sa_t *this,chunk_t dh_shared_secret,chunk_t initiator_nonce, chunk_t responder_nonce)
|
||||
{
|
||||
chunk_t concatenated_nonces;
|
||||
chunk_t skeyseed;
|
||||
@@ -294,7 +445,7 @@ static status_t compute_secrets (protected_ike_sa_t *this,chunk_t dh_shared_secr
|
||||
/**
|
||||
* @brief implements function resend_last_reply of protected_ike_sa_t
|
||||
*/
|
||||
status_t resend_last_reply (protected_ike_sa_t *this)
|
||||
status_t resend_last_reply (private_ike_sa_t *this)
|
||||
{
|
||||
packet_t *packet;
|
||||
status_t status;
|
||||
@@ -316,7 +467,7 @@ status_t resend_last_reply (protected_ike_sa_t *this)
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
status_t create_delete_job (protected_ike_sa_t *this)
|
||||
status_t create_delete_job (private_ike_sa_t *this)
|
||||
{
|
||||
job_t *delete_job;
|
||||
status_t status;
|
||||
@@ -340,10 +491,141 @@ status_t create_delete_job (protected_ike_sa_t *this)
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of protected_ike_sa_t.set_new_state.
|
||||
*/
|
||||
static void set_new_state (private_ike_sa_t *this, state_t *state)
|
||||
{
|
||||
this->current_state = state;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of protected_ike_sa_t.get_logger.
|
||||
*/
|
||||
static logger_t *get_logger (private_ike_sa_t *this)
|
||||
{
|
||||
return this->logger;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of protected_ike_sa_t.get_my_host.
|
||||
*/
|
||||
static host_t *get_my_host (private_ike_sa_t *this)
|
||||
{
|
||||
return this->me.host;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of protected_ike_sa_t.get_other_host.
|
||||
*/
|
||||
static host_t *get_other_host (private_ike_sa_t *this)
|
||||
{
|
||||
return this->other.host;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of protected_ike_sa_t.set_my_host.
|
||||
*/
|
||||
static void set_my_host (private_ike_sa_t *this, host_t *my_host)
|
||||
{
|
||||
if (this->me.host != NULL)
|
||||
{
|
||||
this->me.host->destroy(this->me.host);
|
||||
}
|
||||
this->me.host = my_host;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of protected_ike_sa_t.set_other_host.
|
||||
*/
|
||||
static void set_other_host (private_ike_sa_t *this, host_t *other_host)
|
||||
{
|
||||
if (this->other.host != NULL)
|
||||
{
|
||||
this->other.host->destroy(this->other.host);
|
||||
}
|
||||
this->other.host = other_host;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of protected_ike_sa_t.set_prf.
|
||||
*/
|
||||
static void set_prf (private_ike_sa_t *this,prf_t *prf)
|
||||
{
|
||||
if (this->prf != NULL)
|
||||
{
|
||||
this->prf->destroy(this->prf);
|
||||
}
|
||||
this->prf = prf;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of protected_ike_sa_t.get_randomizer.
|
||||
*/
|
||||
static randomizer_t *get_randomizer (private_ike_sa_t *this)
|
||||
{
|
||||
return this->randomizer;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implementation of protected_ike_sa_t.set_last_requested_message.
|
||||
*/
|
||||
static status_t set_last_requested_message (private_ike_sa_t *this,message_t * message)
|
||||
{
|
||||
if ( this->last_requested_message != NULL)
|
||||
{
|
||||
/* destroy message */
|
||||
this ->logger->log(this->logger, CONTROL|MOST, "Destroy stored last requested message");
|
||||
this->last_requested_message->destroy(this->last_requested_message);
|
||||
}
|
||||
|
||||
if (message->get_message_id(message) != this->message_id_out)
|
||||
{
|
||||
this ->logger->log(this->logger, CONTROL|MOST, "last requested message could not be set cause id was not as expected");
|
||||
return FAILED;
|
||||
}
|
||||
this ->logger->log(this->logger, CONTROL|MOST, "replace last requested message with new one");
|
||||
this->last_requested_message = message;
|
||||
|
||||
/* message counter can now be increased */
|
||||
this ->logger->log(this->logger, CONTROL|MOST, "Increate message counter for outgoing messages");
|
||||
this->message_id_out++;
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Implementation of protected_ike_sa_t.set_last_responded_message.
|
||||
*/
|
||||
static status_t set_last_responded_message (private_ike_sa_t *this,message_t * message)
|
||||
{
|
||||
if ( this->last_responded_message != NULL)
|
||||
{
|
||||
/* destroy message */
|
||||
this ->logger->log(this->logger, CONTROL|MOST, "Destroy stored last responded message");
|
||||
this->last_responded_message->destroy(this->last_responded_message);
|
||||
}
|
||||
if (message->get_message_id(message) != this->message_id_in)
|
||||
{
|
||||
this ->logger->log(this->logger, CONTROL|MOST, "last responded message could not be set cause id was not as expected");
|
||||
return FAILED;
|
||||
|
||||
}
|
||||
this ->logger->log(this->logger, CONTROL|MOST, "replace last responded message with new one");
|
||||
this->last_responded_message = message;
|
||||
|
||||
/* message counter can now be increased */
|
||||
this ->logger->log(this->logger, CONTROL|MOST, "Increate message counter for incoming messages");
|
||||
this->message_id_in++;
|
||||
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* @brief implements function destroy of protected_ike_sa_t
|
||||
*/
|
||||
static status_t destroy (protected_ike_sa_t *this)
|
||||
static status_t destroy (private_ike_sa_t *this)
|
||||
{
|
||||
|
||||
this->logger->log(this->logger, CONTROL | MORE, "Going to destroy IKE_SA");
|
||||
@@ -470,23 +752,36 @@ static status_t destroy (protected_ike_sa_t *this)
|
||||
*/
|
||||
ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
|
||||
{
|
||||
protected_ike_sa_t *this = allocator_alloc_thing(protected_ike_sa_t);
|
||||
private_ike_sa_t *this = allocator_alloc_thing(private_ike_sa_t);
|
||||
if (this == NULL)
|
||||
{
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* Public functions */
|
||||
this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
|
||||
this->public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
|
||||
this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
|
||||
this->public.destroy = (status_t(*)(ike_sa_t*))destroy;
|
||||
this->protected.public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
|
||||
this->protected.public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
|
||||
this->protected.public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
|
||||
this->protected.public.destroy = (status_t(*)(ike_sa_t*))destroy;
|
||||
|
||||
/* protected functions */
|
||||
this->protected.build_message = (status_t (*) (protected_ike_sa_t *, exchange_type_t , bool , message_t **)) build_message;
|
||||
this->protected.compute_secrets = (status_t (*) (protected_ike_sa_t *,chunk_t ,chunk_t , chunk_t )) compute_secrets;
|
||||
this->protected.get_logger = (logger_t *(*) (protected_ike_sa_t *)) get_logger;
|
||||
this->protected.get_my_host = (host_t *(*) (protected_ike_sa_t *)) get_my_host;
|
||||
this->protected.get_other_host = (host_t *(*) (protected_ike_sa_t *)) get_other_host;
|
||||
this->protected.set_my_host = (void(*) (protected_ike_sa_t *,host_t *)) set_my_host;
|
||||
this->protected.set_other_host = (void(*) (protected_ike_sa_t *, host_t *)) set_other_host;
|
||||
this->protected.get_randomizer = (randomizer_t *(*) (protected_ike_sa_t *)) get_randomizer;
|
||||
this->protected.set_last_requested_message = (status_t (*) (protected_ike_sa_t *,message_t *)) set_last_requested_message;
|
||||
this->protected.set_last_responded_message = (status_t (*) (protected_ike_sa_t *,message_t *)) set_last_responded_message;
|
||||
this->protected.set_prf = (void (*) (protected_ike_sa_t *,prf_t *)) set_prf;
|
||||
this->protected.set_new_state = (void (*) (protected_ike_sa_t *,state_t *)) set_new_state;
|
||||
|
||||
/* private functions */
|
||||
this->build_message = build_message;
|
||||
this->resend_last_reply = resend_last_reply;
|
||||
this->create_delete_job = create_delete_job;
|
||||
this->compute_secrets = compute_secrets;
|
||||
|
||||
|
||||
/* initialize private fields */
|
||||
this->logger = global_logger_manager->create_logger(global_logger_manager, IKE_SA, NULL);
|
||||
@@ -553,11 +848,11 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
|
||||
/* at creation time, IKE_SA is in a initiator state */
|
||||
if (ike_sa_id->is_initiator(ike_sa_id))
|
||||
{
|
||||
this->current_state = (state_t *) initiator_init_create(this);
|
||||
this->current_state = (state_t *) initiator_init_create(&(this->protected));
|
||||
}
|
||||
else
|
||||
{
|
||||
this->current_state = (state_t *) responder_init_create(this);
|
||||
this->current_state = (state_t *) responder_init_create(&(this->protected));
|
||||
}
|
||||
|
||||
if (this->current_state == NULL)
|
||||
@@ -571,5 +866,5 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
|
||||
}
|
||||
|
||||
|
||||
return &(this->public);
|
||||
return &(this->protected.public);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user