denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'ikev1'

Browse Source 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/encoding/generator.c
	src/libcharon/encoding/payloads/notify_payload.c
	src/libcharon/encoding/payloads/notify_payload.h
	src/libcharon/encoding/payloads/payload.c
	src/libcharon/network/receiver.c
	src/libcharon/sa/authenticator.c
	src/libcharon/sa/authenticator.h
	src/libcharon/sa/ikev2/tasks/ike_init.c
	src/libcharon/sa/task_manager.c
	src/libstrongswan/credentials/auth_cfg.c
This commit is contained in:
Martin Willi
2012-05-02 11:12:31 +02:00
parent f99d8b10c9 8c35f5d460
commit b24be29646
297 changed files with 22065 additions and 5546 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/authenticators/eap_authenticator.c
+698
View File
@@ -0,0 +1,698 @@
/*
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "eap_authenticator.h"
#include <daemon.h>
#include <sa/ikev2/keymat_v2.h>
#include <sa/eap/eap_method.h>
#include <encoding/payloads/auth_payload.h>
#include <encoding/payloads/eap_payload.h>
typedef struct private_eap_authenticator_t private_eap_authenticator_t;
/**
* Private data of an eap_authenticator_t object.
*/
struct private_eap_authenticator_t {
/**
* Public authenticator_t interface.
*/
eap_authenticator_t public;
/**
* Assigned IKE_SA
*/
ike_sa_t *ike_sa;
/**
* others nonce to include in AUTH calculation
*/
chunk_t received_nonce;
/**
* our nonce to include in AUTH calculation
*/
chunk_t sent_nonce;
/**
* others IKE_SA_INIT message data to include in AUTH calculation
*/
chunk_t received_init;
/**
* our IKE_SA_INIT message data to include in AUTH calculation
*/
chunk_t sent_init;
/**
* Reserved bytes of ID payload
*/
char reserved[3];
/**
* Current EAP method processing
*/
eap_method_t *method;
/**
* MSK used to build and verify auth payload
*/
chunk_t msk;
/**
* EAP authentication method completed successfully
*/
bool eap_complete;
/**
* Set if we require mutual EAP due EAP-only authentication
*/
bool require_mutual;
/**
* authentication payload verified successfully
*/
bool auth_complete;
/**
* generated EAP payload
*/
eap_payload_t *eap_payload;
/**
* EAP identity of peer
*/
identification_t *eap_identity;
};
/**
* load an EAP method
*/
static eap_method_t *load_method(private_eap_authenticator_t *this,
eap_type_t type, u_int32_t vendor, eap_role_t role)
{
identification_t *server, *peer, *aaa;
auth_cfg_t *auth;
if (role == EAP_SERVER)
{
server = this->ike_sa->get_my_id(this->ike_sa);
peer = this->ike_sa->get_other_id(this->ike_sa);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
}
else
{
server = this->ike_sa->get_other_id(this->ike_sa);
peer = this->ike_sa->get_my_id(this->ike_sa);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
}
if (this->eap_identity)
{
peer = this->eap_identity;
}
aaa = auth->get(auth, AUTH_RULE_AAA_IDENTITY);
if (aaa)
{
server = aaa;
}
return charon->eap->create_instance(charon->eap, type, vendor,
role, server, peer);
}
/**
* Initiate EAP conversation as server
*/
static eap_payload_t* server_initiate_eap(private_eap_authenticator_t *this,
bool do_identity)
{
auth_cfg_t *auth;
eap_type_t type;
identification_t *id;
u_int32_t vendor;
eap_payload_t *out;
char *action;
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
/* initiate EAP-Identity exchange if required */
if (!this->eap_identity && do_identity)
{
id = auth->get(auth, AUTH_RULE_EAP_IDENTITY);
if (id)
{
if (id->get_type(id) == ID_ANY)
{
this->method = load_method(this, EAP_IDENTITY, 0, EAP_SERVER);
if (this->method)
{
if (this->method->initiate(this->method, &out) == NEED_MORE)
{
DBG1(DBG_IKE, "initiating %N method (id 0x%02X)",
eap_type_names, EAP_IDENTITY,
this->method->get_identifier(this->method));
return out;
}
this->method->destroy(this->method);
}
DBG1(DBG_IKE, "EAP-Identity request configured, "
"but not supported");
}
else
{
DBG1(DBG_IKE, "using configured EAP-Identity %Y", id);
this->eap_identity = id->clone(id);
}
}
}
/* invoke real EAP method */
type = (uintptr_t)auth->get(auth, AUTH_RULE_EAP_TYPE);
vendor = (uintptr_t)auth->get(auth, AUTH_RULE_EAP_VENDOR);
action = "loading";
this->method = load_method(this, type, vendor, EAP_SERVER);
if (this->method)
{
action = "initiating";
type = this->method->get_type(this->method, &vendor);
if (this->method->initiate(this->method, &out) == NEED_MORE)
{
if (vendor)
{
DBG1(DBG_IKE, "initiating EAP vendor type %d-%d method (id 0x%02X)",
type, vendor, out->get_identifier(out));
}
else
{
DBG1(DBG_IKE, "initiating %N method (id 0x%02X)", eap_type_names,
type, out->get_identifier(out));
}
return out;
}
}
if (vendor)
{
DBG1(DBG_IKE, "%s EAP vendor type %d-%d method failed",
action, type, vendor);
}
else
{
DBG1(DBG_IKE, "%s %N method failed", action, eap_type_names, type);
}
return eap_payload_create_code(EAP_FAILURE, 0);
}
/**
* Replace the existing EAP-Identity in other auth config
*/
static void replace_eap_identity(private_eap_authenticator_t *this)
{
identification_t *eap_identity;
auth_cfg_t *cfg;
eap_identity = this->eap_identity->clone(this->eap_identity);
cfg = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
cfg->add(cfg, AUTH_RULE_EAP_IDENTITY, eap_identity);
}
/**
* Handle EAP exchange as server
*/
static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
eap_payload_t *in)
{
eap_type_t type, received_type;
u_int32_t vendor, received_vendor;
eap_payload_t *out;
if (in->get_code(in) != EAP_RESPONSE)
{
DBG1(DBG_IKE, "received %N, sending %N",
eap_code_names, in->get_code(in), eap_code_names, EAP_FAILURE);
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
}
type = this->method->get_type(this->method, &vendor);
received_type = in->get_type(in, &received_vendor);
if (type != received_type || vendor != received_vendor)
{
if (received_vendor == 0 && received_type == EAP_NAK)
{
DBG1(DBG_IKE, "received %N, sending %N",
eap_type_names, EAP_NAK, eap_code_names, EAP_FAILURE);
}
else
{
DBG1(DBG_IKE, "received invalid EAP response, sending %N",
eap_code_names, EAP_FAILURE);
}
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
}
switch (this->method->process(this->method, in, &out))
{
case NEED_MORE:
return out;
case SUCCESS:
if (!vendor && type == EAP_IDENTITY)
{
chunk_t data;
if (this->method->get_msk(this->method, &data) == SUCCESS)
{
this->eap_identity = identification_create_from_data(data);
DBG1(DBG_IKE, "received EAP identity '%Y'",
this->eap_identity);
replace_eap_identity(this);
}
/* restart EAP exchange, but with real method */
this->method->destroy(this->method);
return server_initiate_eap(this, FALSE);
}
if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
{
this->msk = chunk_clone(this->msk);
}
if (vendor)
{
DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeeded, "
"%sMSK established", type, vendor,
this->msk.ptr ? "" : "no ");
}
else
{
DBG1(DBG_IKE, "EAP method %N succeeded, %sMSK established",
eap_type_names, type, this->msk.ptr ? "" : "no ");
}
this->ike_sa->set_condition(this->ike_sa, COND_EAP_AUTHENTICATED,
TRUE);
this->eap_complete = TRUE;
return eap_payload_create_code(EAP_SUCCESS, in->get_identifier(in));
case FAILED:
default:
if (vendor)
{
DBG1(DBG_IKE, "EAP vendor specific method %d-%d failed for "
"peer %Y", type, vendor,
this->ike_sa->get_other_id(this->ike_sa));
}
else
{
DBG1(DBG_IKE, "EAP method %N failed for peer %Y",
eap_type_names, type,
this->ike_sa->get_other_id(this->ike_sa));
}
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
}
}
/**
* Processing method for a peer
*/
static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
eap_payload_t *in)
{
eap_type_t type;
u_int32_t vendor;
auth_cfg_t *auth;
eap_payload_t *out;
identification_t *id;
type = in->get_type(in, &vendor);
if (!vendor && type == EAP_IDENTITY)
{
DESTROY_IF(this->eap_identity);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
id = auth->get(auth, AUTH_RULE_EAP_IDENTITY);
if (!id || id->get_type(id) == ID_ANY)
{
id = this->ike_sa->get_my_id(this->ike_sa);
}
DBG1(DBG_IKE, "server requested %N (id 0x%02X), sending '%Y'",
eap_type_names, type, in->get_identifier(in), id);
this->eap_identity = id->clone(id);
this->method = load_method(this, type, vendor, EAP_PEER);
if (this->method)
{
if (this->method->process(this->method, in, &out) == SUCCESS)
{
this->method->destroy(this->method);
this->method = NULL;
return out;
}
this->method->destroy(this->method);
this->method = NULL;
}
DBG1(DBG_IKE, "%N not supported, sending EAP_NAK",
eap_type_names, type);
return eap_payload_create_nak(in->get_identifier(in));
}
if (this->method == NULL)
{
if (vendor)
{
DBG1(DBG_IKE, "server requested vendor specific EAP method %d-%d ",
"(id 0x%02X)", type, vendor, in->get_identifier(in));
}
else
{
DBG1(DBG_IKE, "server requested %N authentication (id 0x%02X)",
eap_type_names, type, in->get_identifier(in));
}
this->method = load_method(this, type, vendor, EAP_PEER);
if (!this->method)
{
DBG1(DBG_IKE, "EAP method not supported, sending EAP_NAK");
return eap_payload_create_nak(in->get_identifier(in));
}
}
type = this->method->get_type(this->method, &vendor);
if (this->method->process(this->method, in, &out) == NEED_MORE)
{ /* client methods should never return SUCCESS */
return out;
}
if (vendor)
{
DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed", type, vendor);
}
else
{
DBG1(DBG_IKE, "%N method failed", eap_type_names, type);
}
return NULL;
}
/**
* Verify AUTH payload
*/
static bool verify_auth(private_eap_authenticator_t *this, message_t *message,
chunk_t nonce, chunk_t init)
{
auth_payload_t *auth_payload;
chunk_t auth_data, recv_auth_data;
identification_t *other_id;
auth_cfg_t *auth;
keymat_v2_t *keymat;
auth_payload = (auth_payload_t*)message->get_payload(message,
AUTHENTICATION);
if (!auth_payload)
{
DBG1(DBG_IKE, "AUTH payload missing");
return FALSE;
}
other_id = this->ike_sa->get_other_id(this->ike_sa);
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
auth_data = keymat->get_psk_sig(keymat, TRUE, init, nonce,
this->msk, other_id, this->reserved);
recv_auth_data = auth_payload->get_data(auth_payload);
if (!auth_data.len || !chunk_equals(auth_data, recv_auth_data))
{
DBG1(DBG_IKE, "verification of AUTH payload with%s EAP MSK failed",
this->msk.ptr ? "" : "out");
chunk_free(&auth_data);
return FALSE;
}
chunk_free(&auth_data);
DBG1(DBG_IKE, "authentication of '%Y' with %N successful",
other_id, auth_class_names, AUTH_CLASS_EAP);
this->auth_complete = TRUE;
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
return TRUE;
}
/**
* Build AUTH payload
*/
static void build_auth(private_eap_authenticator_t *this, message_t *message,
chunk_t nonce, chunk_t init)
{
auth_payload_t *auth_payload;
identification_t *my_id;
chunk_t auth_data;
keymat_v2_t *keymat;
my_id = this->ike_sa->get_my_id(this->ike_sa);
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N",
my_id, auth_class_names, AUTH_CLASS_EAP);
auth_data = keymat->get_psk_sig(keymat, FALSE, init, nonce,
this->msk, my_id, this->reserved);
auth_payload = auth_payload_create();
auth_payload->set_auth_method(auth_payload, AUTH_PSK);
auth_payload->set_data(auth_payload, auth_data);
message->add_payload(message, (payload_t*)auth_payload);
chunk_free(&auth_data);
}
METHOD(authenticator_t, process_server, status_t,
private_eap_authenticator_t *this, message_t *message)
{
eap_payload_t *eap_payload;
if (this->eap_complete)
{
if (!verify_auth(this, message, this->sent_nonce, this->received_init))
{
return FAILED;
}
return NEED_MORE;
}
if (!this->method)
{
this->eap_payload = server_initiate_eap(this, TRUE);
}
else
{
eap_payload = (eap_payload_t*)message->get_payload(message,
EXTENSIBLE_AUTHENTICATION);
if (!eap_payload)
{
return FAILED;
}
this->eap_payload = server_process_eap(this, eap_payload);
}
return NEED_MORE;
}
METHOD(authenticator_t, build_server, status_t,
private_eap_authenticator_t *this, message_t *message)
{
if (this->eap_payload)
{
eap_code_t code;
code = this->eap_payload->get_code(this->eap_payload);
message->add_payload(message, (payload_t*)this->eap_payload);
this->eap_payload = NULL;
if (code == EAP_FAILURE)
{
return FAILED;
}
return NEED_MORE;
}
if (this->eap_complete && this->auth_complete)
{
build_auth(this, message, this->received_nonce, this->sent_init);
return SUCCESS;
}
return FAILED;
}
METHOD(authenticator_t, process_client, status_t,
private_eap_authenticator_t *this, message_t *message)
{
eap_payload_t *eap_payload;
if (this->eap_complete)
{
if (!verify_auth(this, message, this->sent_nonce, this->received_init))
{
return FAILED;
}
if (this->require_mutual && !this->method->is_mutual(this->method))
{ /* we require mutual authentication due to EAP-only */
u_int32_t vendor;
DBG1(DBG_IKE, "EAP-only authentication requires a mutual and "
"MSK deriving EAP method, but %N is not",
eap_type_names, this->method->get_type(this->method, &vendor));
return FAILED;
}
return SUCCESS;
}
eap_payload = (eap_payload_t*)message->get_payload(message,
EXTENSIBLE_AUTHENTICATION);
if (eap_payload)
{
switch (eap_payload->get_code(eap_payload))
{
case EAP_REQUEST:
{
this->eap_payload = client_process_eap(this, eap_payload);
if (this->eap_payload)
{
return NEED_MORE;
}
return FAILED;
}
case EAP_SUCCESS:
{
eap_type_t type;
u_int32_t vendor;
auth_cfg_t *cfg;
if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
{
this->msk = chunk_clone(this->msk);
}
type = this->method->get_type(this->method, &vendor);
if (vendor)
{
DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeeded, "
"%sMSK established", type, vendor,
this->msk.ptr ? "" : "no ");
}
else
{
DBG1(DBG_IKE, "EAP method %N succeeded, %sMSK established",
eap_type_names, type, this->msk.ptr ? "" : "no ");
}
cfg = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
cfg->add(cfg, AUTH_RULE_EAP_TYPE, type);
if (vendor)
{
cfg->add(cfg, AUTH_RULE_EAP_VENDOR, vendor);
}
this->eap_complete = TRUE;
return NEED_MORE;
}
case EAP_FAILURE:
default:
{
DBG1(DBG_IKE, "received %N, EAP authentication failed",
eap_code_names, eap_payload->get_code(eap_payload));
return FAILED;
}
}
}
return FAILED;
}
METHOD(authenticator_t, build_client, status_t,
private_eap_authenticator_t *this, message_t *message)
{
if (this->eap_payload)
{
message->add_payload(message, (payload_t*)this->eap_payload);
this->eap_payload = NULL;
return NEED_MORE;
}
if (this->eap_complete)
{
build_auth(this, message, this->received_nonce, this->sent_init);
return NEED_MORE;
}
return NEED_MORE;
}
METHOD(authenticator_t, is_mutual, bool,
private_eap_authenticator_t *this)
{
/* we don't know yet, but insist on it after EAP is complete */
this->require_mutual = TRUE;
return TRUE;
}
METHOD(authenticator_t, destroy, void,
private_eap_authenticator_t *this)
{
DESTROY_IF(this->method);
DESTROY_IF(this->eap_payload);
DESTROY_IF(this->eap_identity);
chunk_free(&this->msk);
free(this);
}
/*
* Described in header.
*/
eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init,
char reserved[3])
{
private_eap_authenticator_t *this;
INIT(this,
.public = {
.authenticator = {
.build = _build_client,
.process = _process_client,
.is_mutual = _is_mutual,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
.received_init = received_init,
.received_nonce = received_nonce,
.sent_init = sent_init,
.sent_nonce = sent_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
/*
* Described in header.
*/
eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init,
char reserved[3])
{
private_eap_authenticator_t *this;
INIT(this,
.public = {
.authenticator = {
.build = _build_server,
.process = _process_server,
.is_mutual = _is_mutual,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
.received_init = received_init,
.received_nonce = received_nonce,
.sent_init = sent_init,
.sent_nonce = sent_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
src/libcharon/sa/ikev2/authenticators/eap_authenticator.h
+102
View File
@@ -0,0 +1,102 @@
/*
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup eap_authenticator eap_authenticator
* @{ @ingroup authenticators
*/
#ifndef EAP_AUTHENTICATOR_H_
#define EAP_AUTHENTICATOR_H_
typedef struct eap_authenticator_t eap_authenticator_t;
#include <sa/authenticator.h>
/**
* Implementation of authenticator_t using EAP authentication.
*
* Authentication using EAP involves the most complex authenticator. It stays
* alive over multiple ike_auth transactions and handles multiple EAP
* messages.
*
* @verbatim
ike_sa_init
------------------------->
<-------------------------
followed by multiple ike_auth:
+--------+ +--------+
| EAP | IDi, [IDr,] SA, TS | EAP |
| client | ---------------------------> | server |
| | ID, AUTH, EAP | |
| | <--------------------------- | |
| | EAP | |
| | ---------------------------> | |
| | EAP | |
| | <--------------------------- | |
| | EAP | |
| | ---------------------------> | |
| | EAP(SUCCESS) | |
| | <--------------------------- | |
| | AUTH | | If EAP establishes
| | ---------------------------> | | a session key, AUTH
| | AUTH, SA, TS | | payloads use this
| | <--------------------------- | | key, not SK_pi/pr
+--------+ +--------+
@endverbatim
*/
struct eap_authenticator_t {
/**
* Implemented authenticator_t interface.
*/
authenticator_t authenticator;
};
/**
* Create an authenticator to authenticate against an EAP server.
*
* @param ike_sa associated ike_sa
* @param received_nonce nonce received in IKE_SA_INIT
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @param sent_init sent IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return EAP authenticator
*/
eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init,
char reserved[3]);
/**
* Create an authenticator to authenticate EAP clients.
*
* @param ike_sa associated ike_sa
* @param received_nonce nonce received in IKE_SA_INIT
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @param sent_init sent IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return EAP authenticator
*/
eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_nonce,
chunk_t received_init, chunk_t sent_init,
char reserved[3]);
#endif /** EAP_AUTHENTICATOR_H_ @}*/
src/libcharon/sa/ikev2/authenticators/psk_authenticator.c
+204
View File
@@ -0,0 +1,204 @@
/*
* Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "psk_authenticator.h"
#include <daemon.h>
#include <encoding/payloads/auth_payload.h>
#include <sa/ikev2/keymat_v2.h>
typedef struct private_psk_authenticator_t private_psk_authenticator_t;
/**
* Private data of an psk_authenticator_t object.
*/
struct private_psk_authenticator_t {
/**
* Public authenticator_t interface.
*/
psk_authenticator_t public;
/**
* Assigned IKE_SA
*/
ike_sa_t *ike_sa;
/**
* nonce to include in AUTH calculation
*/
chunk_t nonce;
/**
* IKE_SA_INIT message data to include in AUTH calculation
*/
chunk_t ike_sa_init;
/**
* Reserved bytes of ID payload
*/
char reserved[3];
};
METHOD(authenticator_t, build, status_t,
private_psk_authenticator_t *this, message_t *message)
{
identification_t *my_id, *other_id;
auth_payload_t *auth_payload;
shared_key_t *key;
chunk_t auth_data;
keymat_v2_t *keymat;
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
my_id = this->ike_sa->get_my_id(this->ike_sa);
other_id = this->ike_sa->get_other_id(this->ike_sa);
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N",
my_id, auth_method_names, AUTH_PSK);
key = lib->credmgr->get_shared(lib->credmgr, SHARED_IKE, my_id, other_id);
if (key == NULL)
{
DBG1(DBG_IKE, "no shared key found for '%Y' - '%Y'", my_id, other_id);
return NOT_FOUND;
}
auth_data = keymat->get_psk_sig(keymat, FALSE, this->ike_sa_init,
this->nonce, key->get_key(key), my_id, this->reserved);
key->destroy(key);
DBG2(DBG_IKE, "successfully created shared key MAC");
auth_payload = auth_payload_create();
auth_payload->set_auth_method(auth_payload, AUTH_PSK);
auth_payload->set_data(auth_payload, auth_data);
chunk_free(&auth_data);
message->add_payload(message, (payload_t*)auth_payload);
return SUCCESS;
}
METHOD(authenticator_t, process, status_t,
private_psk_authenticator_t *this, message_t *message)
{
chunk_t auth_data, recv_auth_data;
identification_t *my_id, *other_id;
auth_payload_t *auth_payload;
auth_cfg_t *auth;
shared_key_t *key;
enumerator_t *enumerator;
bool authenticated = FALSE;
int keys_found = 0;
keymat_v2_t *keymat;
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
if (!auth_payload)
{
return FAILED;
}
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
recv_auth_data = auth_payload->get_data(auth_payload);
my_id = this->ike_sa->get_my_id(this->ike_sa);
other_id = this->ike_sa->get_other_id(this->ike_sa);
enumerator = lib->credmgr->create_shared_enumerator(lib->credmgr,
SHARED_IKE, my_id, other_id);
while (!authenticated && enumerator->enumerate(enumerator, &key, NULL, NULL))
{
keys_found++;
auth_data = keymat->get_psk_sig(keymat, TRUE, this->ike_sa_init,
this->nonce, key->get_key(key), other_id, this->reserved);
if (auth_data.len && chunk_equals(auth_data, recv_auth_data))
{
DBG1(DBG_IKE, "authentication of '%Y' with %N successful",
other_id, auth_method_names, AUTH_PSK);
authenticated = TRUE;
}
chunk_free(&auth_data);
}
enumerator->destroy(enumerator);
if (!authenticated)
{
if (keys_found == 0)
{
DBG1(DBG_IKE, "no shared key found for '%Y' - '%Y'", my_id, other_id);
return NOT_FOUND;
}
DBG1(DBG_IKE, "tried %d shared key%s for '%Y' - '%Y', but MAC mismatched",
keys_found, keys_found == 1 ? "" : "s", my_id, other_id);
return FAILED;
}
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
return SUCCESS;
}
METHOD(authenticator_t, destroy, void,
private_psk_authenticator_t *this)
{
free(this);
}
/*
* Described in header.
*/
psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init,
char reserved[3])
{
private_psk_authenticator_t *this;
INIT(this,
.public = {
.authenticator = {
.build = _build,
.process = (void*)return_failed,
.is_mutual = (void*)return_false,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
.ike_sa_init = sent_init,
.nonce = received_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
/*
* Described in header.
*/
psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init,
char reserved[3])
{
private_psk_authenticator_t *this;
INIT(this,
.public = {
.authenticator = {
.build = (void*)return_failed,
.process = _process,
.is_mutual = (void*)return_false,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
.ike_sa_init = received_init,
.nonce = sent_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
src/libcharon/sa/ikev2/authenticators/psk_authenticator.h
+65
View File
@@ -0,0 +1,65 @@
/*
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup psk_authenticator psk_authenticator
* @{ @ingroup authenticators
*/
#ifndef PSK_AUTHENTICATOR_H_
#define PSK_AUTHENTICATOR_H_
typedef struct psk_authenticator_t psk_authenticator_t;
#include <sa/authenticator.h>
/**
* Implementation of authenticator_t using pre-shared keys.
*/
struct psk_authenticator_t {
/**
* Implemented authenticator_t interface.
*/
authenticator_t authenticator;
};
/**
* Create an authenticator to build PSK signatures.
*
* @param ike_sa associated ike_sa
* @param received_nonce nonce received in IKE_SA_INIT
* @param sent_init sent IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return PSK authenticator
*/
psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init,
char reserved[3]);
/**
* Create an authenticator to verify PSK signatures.
*
* @param ike_sa associated ike_sa
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return PSK authenticator
*/
psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init,
char reserved[3]);
#endif /** PSK_AUTHENTICATOR_H_ @}*/
src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
+269
View File
@@ -0,0 +1,269 @@
/*
* Copyright (C) 2008 Tobias Brunner
* Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "pubkey_authenticator.h"
#include <daemon.h>
#include <encoding/payloads/auth_payload.h>
#include <sa/ikev2/keymat_v2.h>
typedef struct private_pubkey_authenticator_t private_pubkey_authenticator_t;
/**
* Private data of an pubkey_authenticator_t object.
*/
struct private_pubkey_authenticator_t {
/**
* Public authenticator_t interface.
*/
pubkey_authenticator_t public;
/**
* Assigned IKE_SA
*/
ike_sa_t *ike_sa;
/**
* nonce to include in AUTH calculation
*/
chunk_t nonce;
/**
* IKE_SA_INIT message data to include in AUTH calculation
*/
chunk_t ike_sa_init;
/**
* Reserved bytes of ID payload
*/
char reserved[3];
};
METHOD(authenticator_t, build, status_t,
private_pubkey_authenticator_t *this, message_t *message)
{
chunk_t octets, auth_data;
status_t status = FAILED;
private_key_t *private;
identification_t *id;
auth_cfg_t *auth;
auth_payload_t *auth_payload;
auth_method_t auth_method;
signature_scheme_t scheme;
keymat_v2_t *keymat;
id = this->ike_sa->get_my_id(this->ike_sa);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
private = lib->credmgr->get_private(lib->credmgr, KEY_ANY, id, auth);
if (private == NULL)
{
DBG1(DBG_IKE, "no private key found for '%Y'", id);
return NOT_FOUND;
}
switch (private->get_type(private))
{
case KEY_RSA:
/* we currently use always SHA1 for signatures,
* TODO: support other hashes depending on configuration/auth */
scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
auth_method = AUTH_RSA;
break;
case KEY_ECDSA:
/* we try to deduct the signature scheme from the keysize */
switch (private->get_keysize(private))
{
case 256:
scheme = SIGN_ECDSA_256;
auth_method = AUTH_ECDSA_256;
break;
case 384:
scheme = SIGN_ECDSA_384;
auth_method = AUTH_ECDSA_384;
break;
case 521:
scheme = SIGN_ECDSA_521;
auth_method = AUTH_ECDSA_521;
break;
default:
DBG1(DBG_IKE, "%d bit ECDSA private key size not supported",
private->get_keysize(private));
return status;
}
break;
default:
DBG1(DBG_IKE, "private key of type %N not supported",
key_type_names, private->get_type(private));
return status;
}
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
octets = keymat->get_auth_octets(keymat, FALSE, this->ike_sa_init,
this->nonce, id, this->reserved);
if (private->sign(private, scheme, octets, &auth_data))
{
auth_payload = auth_payload_create();
auth_payload->set_auth_method(auth_payload, auth_method);
auth_payload->set_data(auth_payload, auth_data);
chunk_free(&auth_data);
message->add_payload(message, (payload_t*)auth_payload);
status = SUCCESS;
}
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N %s", id,
auth_method_names, auth_method,
(status == SUCCESS)? "successful":"failed");
chunk_free(&octets);
private->destroy(private);
return status;
}
METHOD(authenticator_t, process, status_t,
private_pubkey_authenticator_t *this, message_t *message)
{
public_key_t *public;
auth_method_t auth_method;
auth_payload_t *auth_payload;
chunk_t auth_data, octets;
identification_t *id;
auth_cfg_t *auth, *current_auth;
enumerator_t *enumerator;
key_type_t key_type = KEY_ECDSA;
signature_scheme_t scheme;
status_t status = NOT_FOUND;
keymat_v2_t *keymat;
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
if (!auth_payload)
{
return FAILED;
}
auth_method = auth_payload->get_auth_method(auth_payload);
switch (auth_method)
{
case AUTH_RSA:
/* We currently accept SHA1 signatures only
* TODO: allow other hash algorithms and note it in "auth" */
key_type = KEY_RSA;
scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
break;
case AUTH_ECDSA_256:
scheme = SIGN_ECDSA_256;
break;
case AUTH_ECDSA_384:
scheme = SIGN_ECDSA_384;
break;
case AUTH_ECDSA_521:
scheme = SIGN_ECDSA_521;
break;
default:
return INVALID_ARG;
}
auth_data = auth_payload->get_data(auth_payload);
id = this->ike_sa->get_other_id(this->ike_sa);
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
octets = keymat->get_auth_octets(keymat, TRUE, this->ike_sa_init,
this->nonce, id, this->reserved);
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
key_type, id, auth);
while (enumerator->enumerate(enumerator, &public, &current_auth))
{
if (public->verify(public, scheme, octets, auth_data))
{
DBG1(DBG_IKE, "authentication of '%Y' with %N successful",
id, auth_method_names, auth_method);
status = SUCCESS;
auth->merge(auth, current_auth, FALSE);
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
break;
}
else
{
status = FAILED;
DBG1(DBG_IKE, "signature validation failed, looking for another key");
}
}
enumerator->destroy(enumerator);
chunk_free(&octets);
if (status == NOT_FOUND)
{
DBG1(DBG_IKE, "no trusted %N public key found for '%Y'",
key_type_names, key_type, id);
}
return status;
}
METHOD(authenticator_t, destroy, void,
private_pubkey_authenticator_t *this)
{
free(this);
}
/*
* Described in header.
*/
pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init,
char reserved[3])
{
private_pubkey_authenticator_t *this;
INIT(this,
.public = {
.authenticator = {
.build = _build,
.process = (void*)return_failed,
.is_mutual = (void*)return_false,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
.ike_sa_init = sent_init,
.nonce = received_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
/*
* Described in header.
*/
pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init,
char reserved[3])
{
private_pubkey_authenticator_t *this;
INIT(this,
.public = {
.authenticator = {
.build = (void*)return_failed,
.process = _process,
.is_mutual = (void*)return_false,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
.ike_sa_init = received_init,
.nonce = sent_nonce,
);
memcpy(this->reserved, reserved, sizeof(this->reserved));
return &this->public;
}
src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.h
+66
View File
@@ -0,0 +1,66 @@
/*
* Copyright (C) 2008 Tobias Brunner
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup pubkey_authenticator pubkey_authenticator
* @{ @ingroup authenticators
*/
#ifndef PUBKEY_AUTHENTICATOR_H_
#define PUBKEY_AUTHENTICATOR_H_
typedef struct pubkey_authenticator_t pubkey_authenticator_t;
#include <sa/authenticator.h>
/**
* Implementation of authenticator_t using public key authenitcation.
*/
struct pubkey_authenticator_t {
/**
* Implemented authenticator_t interface.
*/
authenticator_t authenticator;
};
/**
* Create an authenticator to build public key signatures.
*
* @param ike_sa associated ike_sa
* @param received_nonce nonce received in IKE_SA_INIT
* @param sent_init sent IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return public key authenticator
*/
pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
chunk_t received_nonce, chunk_t sent_init,
char reserved[3]);
/**
* Create an authenticator to verify public key signatures.
*
* @param ike_sa associated ike_sa
* @param sent_nonce nonce sent in IKE_SA_INIT
* @param received_init received IKE_SA_INIT message data
* @param reserved reserved bytes of ID payload
* @return public key authenticator
*/
pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
chunk_t sent_nonce, chunk_t received_init,
char reserved[3]);
#endif /** PUBKEY_AUTHENTICATOR_H_ @}*/
src/libcharon/sa/ikev2/connect_manager.c
+1601
View File
File diff suppressed because it is too large Load Diff
src/libcharon/sa/ikev2/connect_manager.h
+126
View File
@@ -0,0 +1,126 @@
/*
* Copyright (C) 2007-2008 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup connect_manager connect_manager
* @{ @ingroup sa
*/
#ifndef CONNECT_MANAGER_H_
#define CONNECT_MANAGER_H_
typedef struct connect_manager_t connect_manager_t;
#include <encoding/message.h>
#include <sa/ike_sa_id.h>
#include <utils/identification.h>
/**
* The connection manager is responsible for establishing a direct
* connection with another peer.
*/
struct connect_manager_t {
/**
* Checks if a there is already a mediated connection registered
* between two peers.
*
* @param id my id
* @param peer_id the other peer's id
* @param mediated_sa the IKE_SA ID of the mediated connection
* @returns
* - TRUE, if a mediated connection is registered
* - FALSE, otherwise
*/
bool (*check_and_register) (connect_manager_t *this, identification_t *id,
identification_t *peer_id,
ike_sa_id_t *mediated_sa);
/**
* Checks if there are waiting connections with a specific peer.
* If so, reinitiate them.
*
* @param id my id
* @param peer_id the other peer's id
*/
void (*check_and_initiate) (connect_manager_t *this,
ike_sa_id_t *mediation_sa, identification_t *id,
identification_t *peer_id);
/**
* Creates a checklist and sets the initiator's data.
*
* @param initiator ID of the initiator
* @param responder ID of the responder
* @param connect_id the connect ID provided by the initiator
* @param key the initiator's key
* @param endpoints the initiator's endpoints
* @param is_initiator TRUE, if the caller of this method is the initiator
* @returns SUCCESS
*/
status_t (*set_initiator_data) (connect_manager_t *this,
identification_t *initiator,
identification_t *responder,
chunk_t connect_id, chunk_t key,
linked_list_t *endpoints,
bool is_initiator);
/**
* Updates a checklist and sets the responder's data. The checklist's
* state is advanced to WAITING which means that checks will be sent.
*
* @param connect_id the connect ID
* @param chunk_t the responder's key
* @param endpoints the responder's endpoints
* @returns
* - NOT_FOUND, if the checklist has not been found
* - SUCCESS, otherwise
*/
status_t (*set_responder_data) (connect_manager_t *this,
chunk_t connect_id, chunk_t key,
linked_list_t *endpoints);
/**
* Stops checks for a checklist. Called after the responder received an
* IKE_SA_INIT request which contains a ME_CONNECTID payload.
*
* @param connect_id the connect ID
* @returns
* - NOT_FOUND, if the checklist has not been found
* - SUCCESS, otherwise
*/
status_t (*stop_checks) (connect_manager_t *this, chunk_t connect_id);
/**
* Processes a connectivity check
*
* @param message the received message
*/
void (*process_check) (connect_manager_t *this, message_t *message);
/**
* Destroys the manager with all data.
*/
void (*destroy) (connect_manager_t *this);
};
/**
* Create a manager.
*
* @returns connect_manager_t object
*/
connect_manager_t *connect_manager_create(void);
#endif /** CONNECT_MANAGER_H_ @}*/
src/libcharon/sa/ikev2/keymat_v2.c
+588
View File
@@ -0,0 +1,588 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "keymat_v2.h"
#include <daemon.h>
#include <crypto/prf_plus.h>
typedef struct private_keymat_v2_t private_keymat_v2_t;
/**
* Private data of an keymat_t object.
*/
struct private_keymat_v2_t {
/**
* Public keymat_v2_t interface.
*/
keymat_v2_t public;
/**
* IKE_SA Role, initiator or responder
*/
bool initiator;
/**
* inbound AEAD
*/
aead_t *aead_in;
/**
* outbound AEAD
*/
aead_t *aead_out;
/**
* General purpose PRF
*/
prf_t *prf;
/**
* Negotiated PRF algorithm
*/
pseudo_random_function_t prf_alg;
/**
* Key to derive key material from for CHILD_SAs, rekeying
*/
chunk_t skd;
/**
* Key to build outging authentication data (SKp)
*/
chunk_t skp_build;
/**
* Key to verify incoming authentication data (SKp)
*/
chunk_t skp_verify;
};
METHOD(keymat_t, get_version, ike_version_t,
private_keymat_v2_t *this)
{
return IKEV2;
}
METHOD(keymat_t, create_dh, diffie_hellman_t*,
private_keymat_v2_t *this, diffie_hellman_group_t group)
{
return lib->crypto->create_dh(lib->crypto, group);
}
/**
* Derive IKE keys for a combined AEAD algorithm
*/
static bool derive_ike_aead(private_keymat_v2_t *this, u_int16_t alg,
u_int16_t key_size, prf_plus_t *prf_plus)
{
aead_t *aead_i, *aead_r;
chunk_t key;
/* SK_ei/SK_er used for encryption */
aead_i = lib->crypto->create_aead(lib->crypto, alg, key_size / 8);
aead_r = lib->crypto->create_aead(lib->crypto, alg, key_size / 8);
if (aead_i == NULL || aead_r == NULL)
{
DBG1(DBG_IKE, "%N %N (key size %d) not supported!",
transform_type_names, ENCRYPTION_ALGORITHM,
encryption_algorithm_names, alg, key_size);
return FALSE;
}
key_size = aead_i->get_key_size(aead_i);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_ei secret %B", &key);
aead_i->set_key(aead_i, key);
chunk_clear(&key);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_er secret %B", &key);
aead_r->set_key(aead_r, key);
chunk_clear(&key);
if (this->initiator)
{
this->aead_in = aead_r;
this->aead_out = aead_i;
}
else
{
this->aead_in = aead_i;
this->aead_out = aead_r;
}
return TRUE;
}
/**
* Derive IKE keys for traditional encryption and MAC algorithms
*/
static bool derive_ike_traditional(private_keymat_v2_t *this, u_int16_t enc_alg,
u_int16_t enc_size, u_int16_t int_alg, prf_plus_t *prf_plus)
{
crypter_t *crypter_i, *crypter_r;
signer_t *signer_i, *signer_r;
size_t key_size;
chunk_t key;
/* SK_ai/SK_ar used for integrity protection */
signer_i = lib->crypto->create_signer(lib->crypto, int_alg);
signer_r = lib->crypto->create_signer(lib->crypto, int_alg);
if (signer_i == NULL || signer_r == NULL)
{
DBG1(DBG_IKE, "%N %N not supported!",
transform_type_names, INTEGRITY_ALGORITHM,
integrity_algorithm_names, int_alg);
return FALSE;
}
key_size = signer_i->get_key_size(signer_i);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_ai secret %B", &key);
signer_i->set_key(signer_i, key);
chunk_clear(&key);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_ar secret %B", &key);
signer_r->set_key(signer_r, key);
chunk_clear(&key);
/* SK_ei/SK_er used for encryption */
crypter_i = lib->crypto->create_crypter(lib->crypto, enc_alg, enc_size / 8);
crypter_r = lib->crypto->create_crypter(lib->crypto, enc_alg, enc_size / 8);
if (crypter_i == NULL || crypter_r == NULL)
{
DBG1(DBG_IKE, "%N %N (key size %d) not supported!",
transform_type_names, ENCRYPTION_ALGORITHM,
encryption_algorithm_names, enc_alg, enc_size);
signer_i->destroy(signer_i);
signer_r->destroy(signer_r);
return FALSE;
}
key_size = crypter_i->get_key_size(crypter_i);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_ei secret %B", &key);
crypter_i->set_key(crypter_i, key);
chunk_clear(&key);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_er secret %B", &key);
crypter_r->set_key(crypter_r, key);
chunk_clear(&key);
if (this->initiator)
{
this->aead_in = aead_create(crypter_r, signer_r);
this->aead_out = aead_create(crypter_i, signer_i);
}
else
{
this->aead_in = aead_create(crypter_i, signer_i);
this->aead_out = aead_create(crypter_r, signer_r);
}
return TRUE;
}
METHOD(keymat_v2_t, derive_ike_keys, bool,
private_keymat_v2_t *this, proposal_t *proposal, diffie_hellman_t *dh,
chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id,
pseudo_random_function_t rekey_function, chunk_t rekey_skd)
{
chunk_t skeyseed, key, secret, full_nonce, fixed_nonce, prf_plus_seed;
chunk_t spi_i, spi_r;
prf_plus_t *prf_plus;
u_int16_t alg, key_size, int_alg;
prf_t *rekey_prf = NULL;
spi_i = chunk_alloca(sizeof(u_int64_t));
spi_r = chunk_alloca(sizeof(u_int64_t));
if (dh->get_shared_secret(dh, &secret) != SUCCESS)
{
return FALSE;
}
/* Create SAs general purpose PRF first, we may use it here */
if (!proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &alg, NULL))
{
DBG1(DBG_IKE, "no %N selected",
transform_type_names, PSEUDO_RANDOM_FUNCTION);
return FALSE;
}
this->prf_alg = alg;
this->prf = lib->crypto->create_prf(lib->crypto, alg);
if (this->prf == NULL)
{
DBG1(DBG_IKE, "%N %N not supported!",
transform_type_names, PSEUDO_RANDOM_FUNCTION,
pseudo_random_function_names, alg);
return FALSE;
}
DBG4(DBG_IKE, "shared Diffie Hellman secret %B", &secret);
/* full nonce is used as seed for PRF+ ... */
full_nonce = chunk_cat("cc", nonce_i, nonce_r);
/* but the PRF may need a fixed key which only uses the first bytes of
* the nonces. */
switch (alg)
{
case PRF_AES128_XCBC:
/* while rfc4434 defines variable keys for AES-XCBC, rfc3664 does
* not and therefore fixed key semantics apply to XCBC for key
* derivation. */
case PRF_CAMELLIA128_XCBC:
/* draft-kanno-ipsecme-camellia-xcbc refers to rfc 4434, we
* assume fixed key length. */
key_size = this->prf->get_key_size(this->prf)/2;
nonce_i.len = min(nonce_i.len, key_size);
nonce_r.len = min(nonce_r.len, key_size);
break;
default:
/* all other algorithms use variable key length, full nonce */
break;
}
fixed_nonce = chunk_cat("cc", nonce_i, nonce_r);
*((u_int64_t*)spi_i.ptr) = id->get_initiator_spi(id);
*((u_int64_t*)spi_r.ptr) = id->get_responder_spi(id);
prf_plus_seed = chunk_cat("ccc", full_nonce, spi_i, spi_r);
/* KEYMAT = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr)
*
* if we are rekeying, SKEYSEED is built on another way
*/
if (rekey_function == PRF_UNDEFINED) /* not rekeying */
{
/* SKEYSEED = prf(Ni | Nr, g^ir) */
this->prf->set_key(this->prf, fixed_nonce);
this->prf->allocate_bytes(this->prf, secret, &skeyseed);
this->prf->set_key(this->prf, skeyseed);
prf_plus = prf_plus_create(this->prf, TRUE, prf_plus_seed);
}
else
{
/* SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
* use OLD SAs PRF functions for both prf_plus and prf */
rekey_prf = lib->crypto->create_prf(lib->crypto, rekey_function);
if (!rekey_prf)
{
DBG1(DBG_IKE, "PRF of old SA %N not supported!",
pseudo_random_function_names, rekey_function);
chunk_free(&full_nonce);
chunk_free(&fixed_nonce);
chunk_clear(&prf_plus_seed);
return FALSE;
}
secret = chunk_cat("mc", secret, full_nonce);
rekey_prf->set_key(rekey_prf, rekey_skd);
rekey_prf->allocate_bytes(rekey_prf, secret, &skeyseed);
rekey_prf->set_key(rekey_prf, skeyseed);
prf_plus = prf_plus_create(rekey_prf, TRUE, prf_plus_seed);
}
DBG4(DBG_IKE, "SKEYSEED %B", &skeyseed);
chunk_clear(&skeyseed);
chunk_clear(&secret);
chunk_free(&full_nonce);
chunk_free(&fixed_nonce);
chunk_clear(&prf_plus_seed);
/* KEYMAT = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr */
/* SK_d is used for generating CHILD_SA key mat => store for later use */
key_size = this->prf->get_key_size(this->prf);
prf_plus->allocate_bytes(prf_plus, key_size, &this->skd);
DBG4(DBG_IKE, "Sk_d secret %B", &this->skd);
if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &key_size))
{
DBG1(DBG_IKE, "no %N selected",
transform_type_names, ENCRYPTION_ALGORITHM);
prf_plus->destroy(prf_plus);
DESTROY_IF(rekey_prf);
return FALSE;
}
if (encryption_algorithm_is_aead(alg))
{
if (!derive_ike_aead(this, alg, key_size, prf_plus))
{
prf_plus->destroy(prf_plus);
DESTROY_IF(rekey_prf);
return FALSE;
}
}
else
{
if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM,
&int_alg, NULL))
{
DBG1(DBG_IKE, "no %N selected",
transform_type_names, INTEGRITY_ALGORITHM);
prf_plus->destroy(prf_plus);
DESTROY_IF(rekey_prf);
return FALSE;
}
if (!derive_ike_traditional(this, alg, key_size, int_alg, prf_plus))
{
prf_plus->destroy(prf_plus);
DESTROY_IF(rekey_prf);
return FALSE;
}
}
/* SK_pi/SK_pr used for authentication => stored for later */
key_size = this->prf->get_key_size(this->prf);
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_pi secret %B", &key);
if (this->initiator)
{
this->skp_build = key;
}
else
{
this->skp_verify = key;
}
prf_plus->allocate_bytes(prf_plus, key_size, &key);
DBG4(DBG_IKE, "Sk_pr secret %B", &key);
if (this->initiator)
{
this->skp_verify = key;
}
else
{
this->skp_build = key;
}
/* all done, prf_plus not needed anymore */
prf_plus->destroy(prf_plus);
DESTROY_IF(rekey_prf);
return TRUE;
}
METHOD(keymat_v2_t, derive_child_keys, bool,
private_keymat_v2_t *this, proposal_t *proposal, diffie_hellman_t *dh,
chunk_t nonce_i, chunk_t nonce_r, chunk_t *encr_i, chunk_t *integ_i,
chunk_t *encr_r, chunk_t *integ_r)
{
u_int16_t enc_alg, int_alg, enc_size = 0, int_size = 0;
chunk_t seed, secret = chunk_empty;
prf_plus_t *prf_plus;
if (dh)
{
if (dh->get_shared_secret(dh, &secret) != SUCCESS)
{
return FALSE;
}
DBG4(DBG_CHD, "DH secret %B", &secret);
}
seed = chunk_cata("mcc", secret, nonce_i, nonce_r);
DBG4(DBG_CHD, "seed %B", &seed);
if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM,
&enc_alg, &enc_size))
{
DBG2(DBG_CHD, " using %N for encryption",
encryption_algorithm_names, enc_alg);
if (!enc_size)
{
enc_size = keymat_get_keylen_encr(enc_alg);
}
if (enc_alg != ENCR_NULL && !enc_size)
{
DBG1(DBG_CHD, "no keylength defined for %N",
encryption_algorithm_names, enc_alg);
return FALSE;
}
/* to bytes */
enc_size /= 8;
/* CCM/GCM/CTR/GMAC needs additional bytes */
switch (enc_alg)
{
case ENCR_AES_CCM_ICV8:
case ENCR_AES_CCM_ICV12:
case ENCR_AES_CCM_ICV16:
case ENCR_CAMELLIA_CCM_ICV8:
case ENCR_CAMELLIA_CCM_ICV12:
case ENCR_CAMELLIA_CCM_ICV16:
enc_size += 3;
break;
case ENCR_AES_GCM_ICV8:
case ENCR_AES_GCM_ICV12:
case ENCR_AES_GCM_ICV16:
case ENCR_AES_CTR:
case ENCR_NULL_AUTH_AES_GMAC:
enc_size += 4;
break;
default:
break;
}
}
if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM,
&int_alg, &int_size))
{
DBG2(DBG_CHD, " using %N for integrity",
integrity_algorithm_names, int_alg);
if (!int_size)
{
int_size = keymat_get_keylen_integ(int_alg);
}
if (!int_size)
{
DBG1(DBG_CHD, "no keylength defined for %N",
integrity_algorithm_names, int_alg);
return FALSE;
}
/* to bytes */
int_size /= 8;
}
this->prf->set_key(this->prf, this->skd);
prf_plus = prf_plus_create(this->prf, TRUE, seed);
prf_plus->allocate_bytes(prf_plus, enc_size, encr_i);
prf_plus->allocate_bytes(prf_plus, int_size, integ_i);
prf_plus->allocate_bytes(prf_plus, enc_size, encr_r);
prf_plus->allocate_bytes(prf_plus, int_size, integ_r);
prf_plus->destroy(prf_plus);
if (enc_size)
{
DBG4(DBG_CHD, "encryption initiator key %B", encr_i);
DBG4(DBG_CHD, "encryption responder key %B", encr_r);
}
if (int_size)
{
DBG4(DBG_CHD, "integrity initiator key %B", integ_i);
DBG4(DBG_CHD, "integrity responder key %B", integ_r);
}
return TRUE;
}
METHOD(keymat_v2_t, get_skd, pseudo_random_function_t,
private_keymat_v2_t *this, chunk_t *skd)
{
*skd = this->skd;
return this->prf_alg;
}
METHOD(keymat_t, get_aead, aead_t*,
private_keymat_v2_t *this, bool in)
{
return in ? this->aead_in : this->aead_out;
}
METHOD(keymat_v2_t, get_auth_octets, chunk_t,
private_keymat_v2_t *this, bool verify, chunk_t ike_sa_init,
chunk_t nonce, identification_t *id, char reserved[3])
{
chunk_t chunk, idx, octets;
chunk_t skp;
skp = verify ? this->skp_verify : this->skp_build;
chunk = chunk_alloca(4);
chunk.ptr[0] = id->get_type(id);
memcpy(chunk.ptr + 1, reserved, 3);
idx = chunk_cata("cc", chunk, id->get_encoding(id));
DBG3(DBG_IKE, "IDx' %B", &idx);
DBG3(DBG_IKE, "SK_p %B", &skp);
this->prf->set_key(this->prf, skp);
this->prf->allocate_bytes(this->prf, idx, &chunk);
octets = chunk_cat("ccm", ike_sa_init, nonce, chunk);
DBG3(DBG_IKE, "octets = message + nonce + prf(Sk_px, IDx') %B", &octets);
return octets;
}
/**
* Key pad for the AUTH method SHARED_KEY_MESSAGE_INTEGRITY_CODE.
*/
#define IKEV2_KEY_PAD "Key Pad for IKEv2"
#define IKEV2_KEY_PAD_LENGTH 17
METHOD(keymat_v2_t, get_psk_sig, chunk_t,
private_keymat_v2_t *this, bool verify, chunk_t ike_sa_init,
chunk_t nonce, chunk_t secret, identification_t *id, char reserved[3])
{
chunk_t key_pad, key, sig, octets;
if (!secret.len)
{ /* EAP uses SK_p if no MSK has been established */
secret = verify ? this->skp_verify : this->skp_build;
}
octets = get_auth_octets(this, verify, ike_sa_init, nonce, id, reserved);
/* AUTH = prf(prf(Shared Secret,"Key Pad for IKEv2"), <msg octets>) */
key_pad = chunk_create(IKEV2_KEY_PAD, IKEV2_KEY_PAD_LENGTH);
this->prf->set_key(this->prf, secret);
this->prf->allocate_bytes(this->prf, key_pad, &key);
this->prf->set_key(this->prf, key);
this->prf->allocate_bytes(this->prf, octets, &sig);
DBG4(DBG_IKE, "secret %B", &secret);
DBG4(DBG_IKE, "prf(secret, keypad) %B", &key);
DBG3(DBG_IKE, "AUTH = prf(prf(secret, keypad), octets) %B", &sig);
chunk_free(&octets);
chunk_free(&key);
return sig;
}
METHOD(keymat_t, destroy, void,
private_keymat_v2_t *this)
{
DESTROY_IF(this->aead_in);
DESTROY_IF(this->aead_out);
DESTROY_IF(this->prf);
chunk_clear(&this->skd);
chunk_clear(&this->skp_verify);
chunk_clear(&this->skp_build);
free(this);
}
/**
* See header
*/
keymat_v2_t *keymat_v2_create(bool initiator)
{
private_keymat_v2_t *this;
INIT(this,
.public = {
.keymat = {
.get_version = _get_version,
.create_dh = _create_dh,
.get_aead = _get_aead,
.destroy = _destroy,
},
.derive_ike_keys = _derive_ike_keys,
.derive_child_keys = _derive_child_keys,
.get_skd = _get_skd,
.get_auth_octets = _get_auth_octets,
.get_psk_sig = _get_psk_sig,
},
.initiator = initiator,
.prf_alg = PRF_UNDEFINED,
);
return &this->public;
}
src/libcharon/sa/ikev2/keymat_v2.h
+135
View File
@@ -0,0 +1,135 @@
/*
* Copyright (C) 2011 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup keymat_v2 keymat_v2
* @{ @ingroup sa
*/
#ifndef KEYMAT_V2_H_
#define KEYMAT_V2_H_
#include <sa/keymat.h>
typedef struct keymat_v2_t keymat_v2_t;
/**
* Derivation and management of sensitive keying material, IKEv2 variant.
*/
struct keymat_v2_t {
/**
* Implements keymat_t.
*/
keymat_t keymat;
/**
* Derive keys for the IKE_SA.
*
* These keys are not handed out, but are used by the associated signers,
* crypters and authentication functions.
*
* @param proposal selected algorithms
* @param dh diffie hellman key allocated by create_dh()
* @param nonce_i initiators nonce value
* @param nonce_r responders nonce value
* @param id IKE_SA identifier
* @param rekey_prf PRF of old SA if rekeying, PRF_UNDEFINED otherwise
* @param rekey_sdk SKd of old SA if rekeying
* @return TRUE on success
*/
bool (*derive_ike_keys)(keymat_v2_t *this, proposal_t *proposal,
diffie_hellman_t *dh, chunk_t nonce_i,
chunk_t nonce_r, ike_sa_id_t *id,
pseudo_random_function_t rekey_function,
chunk_t rekey_skd);
/**
* Derive keys for a CHILD_SA.
*
* The keys for the CHILD_SA are allocated in the integ and encr chunks.
* An implementation might hand out encrypted keys only, which are
* decrypted in the kernel before use.
* If no PFS is used for the CHILD_SA, dh can be NULL.
*
* @param proposal selected algorithms
* @param dh diffie hellman key allocated by create_dh(), or NULL
* @param nonce_i initiators nonce value
* @param nonce_r responders nonce value
* @param encr_i chunk to write initiators encryption key to
* @param integ_i chunk to write initiators integrity key to
* @param encr_r chunk to write responders encryption key to
* @param integ_r chunk to write responders integrity key to
* @return TRUE on success
*/
bool (*derive_child_keys)(keymat_v2_t *this,
proposal_t *proposal, diffie_hellman_t *dh,
chunk_t nonce_i, chunk_t nonce_r,
chunk_t *encr_i, chunk_t *integ_i,
chunk_t *encr_r, chunk_t *integ_r);
/**
* Get SKd to pass to derive_ikey_keys() during rekeying.
*
* @param skd chunk to write SKd to (internal data)
* @return PRF function to derive keymat
*/
pseudo_random_function_t (*get_skd)(keymat_v2_t *this, chunk_t *skd);
/**
* Generate octets to use for authentication procedure (RFC4306 2.15).
*
* This method creates the plain octets and is usually signed by a private
* key. PSK and EAP authentication include a secret into the data, use
* the get_psk_sig() method instead.
*
* @param verify TRUE to create for verfification, FALSE to sign
* @param ike_sa_init encoded ike_sa_init message
* @param nonce nonce value
* @param id identity
* @param reserved reserved bytes of id_payload
* @return authentication octets
*/
chunk_t (*get_auth_octets)(keymat_v2_t *this, bool verify,
chunk_t ike_sa_init, chunk_t nonce,
identification_t *id, char reserved[3]);
/**
* Build the shared secret signature used for PSK and EAP authentication.
*
* This method wraps the get_auth_octets() method and additionally
* includes the secret into the signature. If no secret is given, SK_p is
* used as secret (used for EAP methods without MSK).
*
* @param verify TRUE to create for verfification, FALSE to sign
* @param ike_sa_init encoded ike_sa_init message
* @param nonce nonce value
* @param secret optional secret to include into signature
* @param id identity
* @param reserved reserved bytes of id_payload
* @return signature octets
*/
chunk_t (*get_psk_sig)(keymat_v2_t *this, bool verify, chunk_t ike_sa_init,
chunk_t nonce, chunk_t secret,
identification_t *id, char reserved[3]);
};
/**
* Create a keymat instance.
*
* @param initiator TRUE if we are the initiator
* @return keymat instance
*/
keymat_v2_t *keymat_v2_create(bool initiator);
#endif /** KEYMAT_V2_H_ @}*/
src/libcharon/sa/ikev2/mediation_manager.c
+332
View File
@@ -0,0 +1,332 @@
/*
* Copyright (C) 2007 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "mediation_manager.h"
#include <daemon.h>
#include <threading/mutex.h>
#include <utils/linked_list.h>
#include <processing/jobs/mediation_job.h>
typedef struct peer_t peer_t;
/**
* An entry in the linked list.
*/
struct peer_t {
/** id of the peer */
identification_t *id;
/** sa id of the peer, NULL if offline */
ike_sa_id_t *ike_sa_id;
/** list of peer ids that reuested this peer */
linked_list_t *requested_by;
};
/**
* Implementation of peer_t.destroy.
*/
static void peer_destroy(peer_t *this)
{
DESTROY_IF(this->id);
DESTROY_IF(this->ike_sa_id);
this->requested_by->destroy_offset(this->requested_by,
offsetof(identification_t, destroy));
free(this);
}
/**
* Creates a new entry for the list.
*/
static peer_t *peer_create(identification_t *id, ike_sa_id_t* ike_sa_id)
{
peer_t *this;
INIT(this,
.id = id->clone(id),
.ike_sa_id = ike_sa_id ? ike_sa_id->clone(ike_sa_id) : NULL,
.requested_by = linked_list_create(),
);
return this;
}
typedef struct private_mediation_manager_t private_mediation_manager_t;
/**
* Additional private members of mediation_manager_t.
*/
struct private_mediation_manager_t {
/**
* Public interface of mediation_manager_t.
*/
mediation_manager_t public;
/**
* Lock for exclusivly accessing the manager.
*/
mutex_t *mutex;
/**
* Linked list with state entries.
*/
linked_list_t *peers;
};
/**
* Registers a peer's ID at another peer, if it is not yet registered
*/
static void register_peer(peer_t *peer, identification_t *peer_id)
{
enumerator_t *enumerator;
identification_t *current;
enumerator = peer->requested_by->create_enumerator(peer->requested_by);
while (enumerator->enumerate(enumerator, (void**)&current))
{
if (peer_id->equals(peer_id, current))
{
enumerator->destroy(enumerator);
return;
}
}
enumerator->destroy(enumerator);
peer->requested_by->insert_last(peer->requested_by,
peer_id->clone(peer_id));
}
/**
* Get a peer_t object by a peer's id
*/
static status_t get_peer_by_id(private_mediation_manager_t *this,
identification_t *id, peer_t **peer)
{
enumerator_t *enumerator;
peer_t *current;
status_t status = NOT_FOUND;
enumerator = this->peers->create_enumerator(this->peers);
while (enumerator->enumerate(enumerator, (void**)&current))
{
if (id->equals(id, current->id))
{
if (peer)
{
*peer = current;
}
status = SUCCESS;
break;
}
}
enumerator->destroy(enumerator);
return status;
}
/**
* Check if a given peer is registered at other peers. If so, remove it there
* and then remove peers completely that are not online and have no registered
* peers.
*/
static void unregister_peer(private_mediation_manager_t *this,
identification_t *peer_id)
{
enumerator_t *enumerator, *enumerator_r;
peer_t *peer;
identification_t *registered;
enumerator = this->peers->create_enumerator(this->peers);
while (enumerator->enumerate(enumerator, (void**)&peer))
{
enumerator_r = peer->requested_by->create_enumerator(peer->requested_by);
while (enumerator_r->enumerate(enumerator_r, (void**)&registered))
{
if (peer_id->equals(peer_id, registered))
{
peer->requested_by->remove_at(peer->requested_by, enumerator_r);
registered->destroy(registered);
break;
}
}
enumerator_r->destroy(enumerator_r);
if (!peer->ike_sa_id &&
!peer->requested_by->get_count(peer->requested_by))
{
this->peers->remove_at(this->peers, enumerator);
peer_destroy(peer);
break;
}
}
enumerator->destroy(enumerator);
}
METHOD(mediation_manager_t, remove_sa, void,
private_mediation_manager_t *this, ike_sa_id_t *ike_sa_id)
{
enumerator_t *enumerator;
peer_t *peer;
this->mutex->lock(this->mutex);
enumerator = this->peers->create_enumerator(this->peers);
while (enumerator->enumerate(enumerator, (void**)&peer))
{
if (ike_sa_id->equals(ike_sa_id, peer->ike_sa_id))
{
this->peers->remove_at(this->peers, enumerator);
unregister_peer(this, peer->id);
peer_destroy(peer);
break;
}
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
}
METHOD(mediation_manager_t, update_sa_id, void,
private_mediation_manager_t *this, identification_t *peer_id,
ike_sa_id_t *ike_sa_id)
{
enumerator_t *enumerator;
peer_t *peer;
bool found = FALSE;
this->mutex->lock(this->mutex);
enumerator = this->peers->create_enumerator(this->peers);
while (enumerator->enumerate(enumerator, (void**)&peer))
{
if (peer_id->equals(peer_id, peer->id))
{
DESTROY_IF(peer->ike_sa_id);
found = TRUE;
break;
}
}
enumerator->destroy(enumerator);
if (!found)
{
DBG2(DBG_IKE, "adding peer '%Y'", peer_id);
peer = peer_create(peer_id, NULL);
this->peers->insert_last(this->peers, peer);
}
DBG2(DBG_IKE, "changing registered IKE_SA ID of peer '%Y'", peer_id);
peer->ike_sa_id = ike_sa_id ? ike_sa_id->clone(ike_sa_id) : NULL;
/* send callbacks to registered peers */
identification_t *requester;
while(peer->requested_by->remove_last(peer->requested_by,
(void**)&requester) == SUCCESS)
{
job_t *job = (job_t*)mediation_callback_job_create(requester, peer_id);
lib->processor->queue_job(lib->processor, job);
requester->destroy(requester);
}
this->mutex->unlock(this->mutex);
}
METHOD(mediation_manager_t, check, ike_sa_id_t*,
private_mediation_manager_t *this, identification_t *peer_id)
{
peer_t *peer;
ike_sa_id_t *ike_sa_id;
this->mutex->lock(this->mutex);
if (get_peer_by_id(this, peer_id, &peer) != SUCCESS)
{
this->mutex->unlock(this->mutex);
return NULL;
}
ike_sa_id = peer->ike_sa_id;
this->mutex->unlock(this->mutex);
return ike_sa_id;
}
METHOD(mediation_manager_t, check_and_register, ike_sa_id_t*,
private_mediation_manager_t *this, identification_t *peer_id,
identification_t *requester)
{
peer_t *peer;
ike_sa_id_t *ike_sa_id;
this->mutex->lock(this->mutex);
if (get_peer_by_id(this, peer_id, &peer) != SUCCESS)
{
DBG2(DBG_IKE, "adding peer %Y", peer_id);
peer = peer_create(peer_id, NULL);
this->peers->insert_last(this->peers, peer);
}
if (!peer->ike_sa_id)
{
/* the peer is not online */
DBG2(DBG_IKE, "requested peer '%Y' is offline, registering peer '%Y'",
peer_id, requester);
register_peer(peer, requester);
this->mutex->unlock(this->mutex);
return NULL;
}
ike_sa_id = peer->ike_sa_id;
this->mutex->unlock(this->mutex);
return ike_sa_id;
}
METHOD(mediation_manager_t, destroy, void,
private_mediation_manager_t *this)
{
this->mutex->lock(this->mutex);
this->peers->destroy_function(this->peers, (void*)peer_destroy);
this->mutex->unlock(this->mutex);
this->mutex->destroy(this->mutex);
free(this);
}
/*
* Described in header.
*/
mediation_manager_t *mediation_manager_create()
{
private_mediation_manager_t *this;
INIT(this,
.public = {
.destroy = _destroy,
.remove = _remove_sa,
.update_sa_id = _update_sa_id,
.check = _check,
.check_and_register = _check_and_register,
},
.peers = linked_list_create(),
.mutex = mutex_create(MUTEX_TYPE_DEFAULT),
);
return &this->public;
}
src/libcharon/sa/ikev2/mediation_manager.h
+90
View File
@@ -0,0 +1,90 @@
/*
* Copyright (C) 2007 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup mediation_manager mediation_manager
* @{ @ingroup sa
*/
#ifndef MEDIATION_MANAGER_H_
#define MEDIATION_MANAGER_H_
typedef struct mediation_manager_t mediation_manager_t;
#include <sa/ike_sa_id.h>
#include <utils/identification.h>
/**
* The mediation manager is responsible for managing currently online
* peers and registered requests for offline peers on the mediation server.
*/
struct mediation_manager_t {
/**
* Remove the IKE_SA of a peer.
*
* @param ike_sa_id the IKE_SA ID of the peer's SA
*/
void (*remove) (mediation_manager_t* this, ike_sa_id_t *ike_sa_id);
/**
* Update the ike_sa_id that is assigned to a peer's ID. If the peer
* is new, it gets a new record assigned.
*
* @param peer_id the peer's ID
* @param ike_sa_id the IKE_SA ID of the peer's SA
*/
void (*update_sa_id) (mediation_manager_t* this, identification_t *peer_id,
ike_sa_id_t *ike_sa_id);
/**
* Checks if a specific peer is online.
*
* @param peer_id the peer's ID
* @returns
* - IKE_SA ID of the peer's SA.
* - NULL, if the peer is not online.
*/
ike_sa_id_t* (*check) (mediation_manager_t* this,
identification_t *peer_id);
/**
* Checks if a specific peer is online and registers the requesting
* peer if it is not.
*
* @param peer_id the peer's ID
* @param requester the requesters ID
* @returns
* - IKE_SA ID of the peer's SA.
* - NULL, if the peer is not online.
*/
ike_sa_id_t* (*check_and_register) (mediation_manager_t* this,
identification_t *peer_id,
identification_t *requester);
/**
* Destroys the manager with all data.
*/
void (*destroy) (mediation_manager_t *this);
};
/**
* Create a manager.
*
* @returns mediation_manager_t object
*/
mediation_manager_t *mediation_manager_create(void);
#endif /** MEDIATION_MANAGER_H_ @}*/
src/libcharon/sa/ikev2/task_manager_v2.c
+1484
View File
File diff suppressed because it is too large Load Diff
src/libcharon/sa/ikev2/task_manager_v2.h
+46
View File
@@ -0,0 +1,46 @@
/*
* Copyright (C) 2011 Martin Willi
* Copyright (C) 2011 revosec AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup task_manager_v2 task_manager_v2
* @{ @ingroup sa
*/
#ifndef TASK_MANAGER_V2_H_
#define TASK_MANAGER_V2_H_
typedef struct task_manager_v2_t task_manager_v2_t;
#include <sa/task_manager.h>
/**
* Task manager, IKEv2 variant.
*/
struct task_manager_v2_t {
/**
* Implements task_manager_t.
*/
task_manager_t task_manager;
};
/**
* Create an instance of the task manager.
*
* @param ike_sa IKE_SA to manage.
*/
task_manager_v2_t *task_manager_v2_create(ike_sa_t *ike_sa);
#endif /** TASK_MANAGER_V2_H_ @}*/
src/libcharon/sa/ikev2/tasks/child_create.c
+1333
View File
File diff suppressed because it is too large Load Diff
src/libcharon/sa/ikev2/tasks/child_create.h
+83
View File
@@ -0,0 +1,83 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup child_create child_create
* @{ @ingroup tasks
*/
#ifndef CHILD_CREATE_H_
#define CHILD_CREATE_H_
typedef struct child_create_t child_create_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
#include <config/child_cfg.h>
/**
* Task of type TASK_CHILD_CREATE, established a new CHILD_SA.
*
* This task may be included in the IKE_AUTH message or in a separate
* CREATE_CHILD_SA exchange.
*/
struct child_create_t {
/**
* Implements the task_t interface
*/
task_t task;
/**
* Use a specific reqid for the CHILD_SA.
*
* When this task is used for rekeying, the same reqid is used
* for the new CHILD_SA.
*
* @param reqid reqid to use
*/
void (*use_reqid) (child_create_t *this, u_int32_t reqid);
/**
* Get the lower of the two nonces, used for rekey collisions.
*
* @return lower nonce
*/
chunk_t (*get_lower_nonce) (child_create_t *this);
/**
* Get the CHILD_SA established/establishing by this task.
*
* @return child_sa
*/
child_sa_t* (*get_child) (child_create_t *this);
};
/**
* Create a new child_create task.
*
* @param ike_sa IKE_SA this task works for
* @param config child_cfg if task initiator, NULL if responder
* @param rekey whether we do a rekey or not
* @param tsi source of triggering packet, or NULL
* @param tsr destination of triggering packet, or NULL
* @return child_create task to handle by the task_manager
*/
child_create_t *child_create_create(ike_sa_t *ike_sa,
child_cfg_t *config, bool rekey,
traffic_selector_t *tsi, traffic_selector_t *tsr);
#endif /** CHILD_CREATE_H_ @}*/
src/libcharon/sa/ikev2/tasks/child_delete.c
+410
View File
@@ -0,0 +1,410 @@
/*
* Copyright (C) 2006-2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "child_delete.h"
#include <daemon.h>
#include <encoding/payloads/delete_payload.h>
typedef struct private_child_delete_t private_child_delete_t;
/**
* Private members of a child_delete_t task.
*/
struct private_child_delete_t {
/**
* Public methods and task_t interface.
*/
child_delete_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* Are we the initiator?
*/
bool initiator;
/**
* Protocol of CHILD_SA to delete
*/
protocol_id_t protocol;
/**
* Inbound SPI of CHILD_SA to delete
*/
u_int32_t spi;
/**
* whether to enforce delete action policy
*/
bool check_delete_action;
/**
* is this delete exchange following a rekey?
*/
bool rekeyed;
/**
* CHILD_SA already expired?
*/
bool expired;
/**
* CHILD_SAs which get deleted
*/
linked_list_t *child_sas;
};
/**
* build the delete payloads from the listed child_sas
*/
static void build_payloads(private_child_delete_t *this, message_t *message)
{
delete_payload_t *ah = NULL, *esp = NULL;
enumerator_t *enumerator;
child_sa_t *child_sa;
enumerator = this->child_sas->create_enumerator(this->child_sas);
while (enumerator->enumerate(enumerator, (void**)&child_sa))
{
protocol_id_t protocol = child_sa->get_protocol(child_sa);
u_int32_t spi = child_sa->get_spi(child_sa, TRUE);
switch (protocol)
{
case PROTO_ESP:
if (esp == NULL)
{
esp = delete_payload_create(DELETE, PROTO_ESP);
message->add_payload(message, (payload_t*)esp);
}
esp->add_spi(esp, spi);
DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
protocol_id_names, protocol, ntohl(spi));
break;
case PROTO_AH:
if (ah == NULL)
{
ah = delete_payload_create(DELETE, PROTO_AH);
message->add_payload(message, (payload_t*)ah);
}
ah->add_spi(ah, spi);
DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
protocol_id_names, protocol, ntohl(spi));
break;
default:
break;
}
child_sa->set_state(child_sa, CHILD_DELETING);
}
enumerator->destroy(enumerator);
}
/**
* read in payloads and find the children to delete
*/
static void process_payloads(private_child_delete_t *this, message_t *message)
{
enumerator_t *payloads, *spis;
payload_t *payload;
delete_payload_t *delete_payload;
u_int32_t spi;
protocol_id_t protocol;
child_sa_t *child_sa;
payloads = message->create_payload_enumerator(message);
while (payloads->enumerate(payloads, &payload))
{
if (payload->get_type(payload) == DELETE)
{
delete_payload = (delete_payload_t*)payload;
protocol = delete_payload->get_protocol_id(delete_payload);
if (protocol != PROTO_ESP && protocol != PROTO_AH)
{
continue;
}
spis = delete_payload->create_spi_enumerator(delete_payload);
while (spis->enumerate(spis, &spi))
{
child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
spi, FALSE);
if (child_sa == NULL)
{
DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI %.8x, "
"but no such SA", protocol_id_names, protocol, ntohl(spi));
continue;
}
DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI %.8x",
protocol_id_names, protocol, ntohl(spi));
switch (child_sa->get_state(child_sa))
{
case CHILD_REKEYING:
this->rekeyed = TRUE;
/* we reply as usual, rekeying will fail */
break;
case CHILD_DELETING:
/* we don't send back a delete if we initiated ourself */
if (!this->initiator)
{
this->ike_sa->destroy_child_sa(this->ike_sa,
protocol, spi);
continue;
}
/* fall through */
case CHILD_INSTALLED:
if (!this->initiator)
{ /* reestablish installed children if required */
this->check_delete_action = TRUE;
}
default:
break;
}
this->child_sas->insert_last(this->child_sas, child_sa);
}
spis->destroy(spis);
}
}
payloads->destroy(payloads);
}
/**
* destroy the children listed in this->child_sas, reestablish by policy
*/
static status_t destroy_and_reestablish(private_child_delete_t *this)
{
enumerator_t *enumerator;
child_sa_t *child_sa;
child_cfg_t *child_cfg;
protocol_id_t protocol;
u_int32_t spi;
action_t action;
status_t status = SUCCESS;
enumerator = this->child_sas->create_enumerator(this->child_sas);
while (enumerator->enumerate(enumerator, (void**)&child_sa))
{
/* signal child down event if we are not rekeying */
if (!this->rekeyed)
{
charon->bus->child_updown(charon->bus, child_sa, FALSE);
}
spi = child_sa->get_spi(child_sa, TRUE);
protocol = child_sa->get_protocol(child_sa);
child_cfg = child_sa->get_config(child_sa);
child_cfg->get_ref(child_cfg);
action = child_sa->get_close_action(child_sa);
this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi);
if (this->check_delete_action)
{ /* enforce child_cfg policy if deleted passively */
switch (action)
{
case ACTION_RESTART:
child_cfg->get_ref(child_cfg);
status = this->ike_sa->initiate(this->ike_sa, child_cfg, 0,
NULL, NULL);
break;
case ACTION_ROUTE:
charon->traps->install(charon->traps,
this->ike_sa->get_peer_cfg(this->ike_sa), child_cfg);
break;
default:
break;
}
}
child_cfg->destroy(child_cfg);
if (status != SUCCESS)
{
break;
}
}
enumerator->destroy(enumerator);
return status;
}
/**
* send closing signals for all CHILD_SAs over the bus
*/
static void log_children(private_child_delete_t *this)
{
enumerator_t *enumerator;
child_sa_t *child_sa;
u_int64_t bytes_in, bytes_out;
enumerator = this->child_sas->create_enumerator(this->child_sas);
while (enumerator->enumerate(enumerator, (void**)&child_sa))
{
if (this->expired)
{
DBG0(DBG_IKE, "closing expired CHILD_SA %s{%d} "
"with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
ntohl(child_sa->get_spi(child_sa, TRUE)),
ntohl(child_sa->get_spi(child_sa, FALSE)),
child_sa->get_traffic_selectors(child_sa, TRUE),
child_sa->get_traffic_selectors(child_sa, FALSE));
}
else
{
child_sa->get_usestats(child_sa, TRUE, NULL, &bytes_in);
child_sa->get_usestats(child_sa, FALSE, NULL, &bytes_out);
DBG0(DBG_IKE, "closing CHILD_SA %s{%d} with SPIs %.8x_i "
"(%llu bytes) %.8x_o (%llu bytes) and TS %#R=== %#R",
child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
ntohl(child_sa->get_spi(child_sa, TRUE)), bytes_in,
ntohl(child_sa->get_spi(child_sa, FALSE)), bytes_out,
child_sa->get_traffic_selectors(child_sa, TRUE),
child_sa->get_traffic_selectors(child_sa, FALSE));
}
}
enumerator->destroy(enumerator);
}
METHOD(task_t, build_i, status_t,
private_child_delete_t *this, message_t *message)
{
child_sa_t *child_sa;
child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
this->spi, TRUE);
if (!child_sa)
{ /* check if it is an outbound sa */
child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
this->spi, FALSE);
if (!child_sa)
{ /* child does not exist anymore */
return SUCCESS;
}
/* we work only with the inbound SPI */
this->spi = child_sa->get_spi(child_sa, TRUE);
}
this->child_sas->insert_last(this->child_sas, child_sa);
if (child_sa->get_state(child_sa) == CHILD_REKEYING)
{
this->rekeyed = TRUE;
}
log_children(this);
build_payloads(this, message);
return NEED_MORE;
}
METHOD(task_t, process_i, status_t,
private_child_delete_t *this, message_t *message)
{
/* flush the list before adding new SAs */
this->child_sas->destroy(this->child_sas);
this->child_sas = linked_list_create();
process_payloads(this, message);
DBG1(DBG_IKE, "CHILD_SA closed");
return destroy_and_reestablish(this);
}
METHOD(task_t, process_r, status_t,
private_child_delete_t *this, message_t *message)
{
process_payloads(this, message);
log_children(this);
return NEED_MORE;
}
METHOD(task_t, build_r, status_t,
private_child_delete_t *this, message_t *message)
{
/* if we are rekeying, we send an empty informational */
if (this->ike_sa->get_state(this->ike_sa) != IKE_REKEYING)
{
build_payloads(this, message);
}
DBG1(DBG_IKE, "CHILD_SA closed");
return destroy_and_reestablish(this);
}
METHOD(task_t, get_type, task_type_t,
private_child_delete_t *this)
{
return TASK_CHILD_DELETE;
}
METHOD(child_delete_t , get_child, child_sa_t*,
private_child_delete_t *this)
{
child_sa_t *child_sa = NULL;
this->child_sas->get_first(this->child_sas, (void**)&child_sa);
return child_sa;
}
METHOD(task_t, migrate, void,
private_child_delete_t *this, ike_sa_t *ike_sa)
{
this->check_delete_action = FALSE;
this->ike_sa = ike_sa;
this->child_sas->destroy(this->child_sas);
this->child_sas = linked_list_create();
}
METHOD(task_t, destroy, void,
private_child_delete_t *this)
{
this->child_sas->destroy(this->child_sas);
free(this);
}
/*
* Described in header.
*/
child_delete_t *child_delete_create(ike_sa_t *ike_sa, protocol_id_t protocol,
u_int32_t spi, bool expired)
{
private_child_delete_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
.get_child = _get_child,
},
.ike_sa = ike_sa,
.child_sas = linked_list_create(),
.protocol = protocol,
.spi = spi,
.expired = expired,
);
if (protocol != PROTO_NONE)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
this->initiator = TRUE;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
this->initiator = FALSE;
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/child_delete.h
+61
View File
@@ -0,0 +1,61 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup child_delete child_delete
* @{ @ingroup tasks
*/
#ifndef CHILD_DELETE_H_
#define CHILD_DELETE_H_
typedef struct child_delete_t child_delete_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
#include <sa/child_sa.h>
/**
* Task of type child_delete, delete a CHILD_SA.
*/
struct child_delete_t {
/**
* Implements the task_t interface
*/
task_t task;
/**
* Get the CHILD_SA to delete by this task.
*
* @return child_sa
*/
child_sa_t* (*get_child) (child_delete_t *this);
};
/**
* Create a new child_delete task.
*
* @param ike_sa IKE_SA this task works for
* @param protocol protocol of CHILD_SA to delete, PROTO_NONE as responder
* @param spi inbound SPI of CHILD_SA to delete
* @param expired TRUE if CHILD_SA already expired
* @return child_delete task to handle by the task_manager
*/
child_delete_t *child_delete_create(ike_sa_t *ike_sa, protocol_id_t protocol,
u_int32_t spi, bool expired);
#endif /** CHILD_DELETE_H_ @}*/
src/libcharon/sa/ikev2/tasks/child_rekey.c
+482
View File
@@ -0,0 +1,482 @@
/*
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "child_rekey.h"
#include <daemon.h>
#include <encoding/payloads/notify_payload.h>
#include <sa/ikev2/tasks/child_create.h>
#include <sa/ikev2/tasks/child_delete.h>
#include <processing/jobs/rekey_child_sa_job.h>
#include <processing/jobs/rekey_ike_sa_job.h>
typedef struct private_child_rekey_t private_child_rekey_t;
/**
* Private members of a child_rekey_t task.
*/
struct private_child_rekey_t {
/**
* Public methods and task_t interface.
*/
child_rekey_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* Are we the initiator?
*/
bool initiator;
/**
* Protocol of CHILD_SA to rekey
*/
protocol_id_t protocol;
/**
* Inbound SPI of CHILD_SA to rekey
*/
u_int32_t spi;
/**
* the CHILD_CREATE task which is reused to simplify rekeying
*/
child_create_t *child_create;
/**
* the CHILD_DELETE task to delete rekeyed CHILD_SA
*/
child_delete_t *child_delete;
/**
* CHILD_SA which gets rekeyed
*/
child_sa_t *child_sa;
/**
* colliding task, may be delete or rekey
*/
task_t *collision;
/**
* Indicate that peer destroyed the redundant child from collision.
* This happens if a peer's delete notification for the redundant
* child gets processed before the rekey job. If so, we must not
* touch the child created in the collision since it points to
* memory already freed.
*/
bool other_child_destroyed;
};
/**
* Implementation of task_t.build for initiator, after rekeying
*/
static status_t build_i_delete(private_child_rekey_t *this, message_t *message)
{
/* update exchange type to INFORMATIONAL for the delete */
message->set_exchange_type(message, INFORMATIONAL);
return this->child_delete->task.build(&this->child_delete->task, message);
}
/**
* Implementation of task_t.process for initiator, after rekeying
*/
static status_t process_i_delete(private_child_rekey_t *this, message_t *message)
{
return this->child_delete->task.process(&this->child_delete->task, message);
}
/**
* find a child using the REKEY_SA notify
*/
static void find_child(private_child_rekey_t *this, message_t *message)
{
notify_payload_t *notify;
protocol_id_t protocol;
u_int32_t spi;
notify = message->get_notify(message, REKEY_SA);
if (notify)
{
protocol = notify->get_protocol_id(notify);
spi = notify->get_spi(notify);
if (protocol == PROTO_ESP || protocol == PROTO_AH)
{
this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
spi, FALSE);
}
}
}
METHOD(task_t, build_i, status_t,
private_child_rekey_t *this, message_t *message)
{
notify_payload_t *notify;
u_int32_t reqid;
child_cfg_t *config;
this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
this->spi, TRUE);
if (!this->child_sa)
{ /* check if it is an outbound CHILD_SA */
this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
this->spi, FALSE);
if (!this->child_sa)
{ /* CHILD_SA is gone, unable to rekey. As an empty CREATE_CHILD_SA
* exchange is invalid, we fall back to an INFORMATIONAL exchange.*/
message->set_exchange_type(message, INFORMATIONAL);
return SUCCESS;
}
/* we work only with the inbound SPI */
this->spi = this->child_sa->get_spi(this->child_sa, TRUE);
}
config = this->child_sa->get_config(this->child_sa);
/* we just need the rekey notify ... */
notify = notify_payload_create_from_protocol_and_type(NOTIFY,
this->protocol, REKEY_SA);
notify->set_spi(notify, this->spi);
message->add_payload(message, (payload_t*)notify);
/* ... our CHILD_CREATE task does the hard work for us. */
if (!this->child_create)
{
this->child_create = child_create_create(this->ike_sa,
config->get_ref(config), TRUE, NULL, NULL);
}
reqid = this->child_sa->get_reqid(this->child_sa);
this->child_create->use_reqid(this->child_create, reqid);
this->child_create->task.build(&this->child_create->task, message);
this->child_sa->set_state(this->child_sa, CHILD_REKEYING);
return NEED_MORE;
}
METHOD(task_t, process_r, status_t,
private_child_rekey_t *this, message_t *message)
{
/* let the CHILD_CREATE task process the message */
this->child_create->task.process(&this->child_create->task, message);
find_child(this, message);
return NEED_MORE;
}
METHOD(task_t, build_r, status_t,
private_child_rekey_t *this, message_t *message)
{
u_int32_t reqid;
if (this->child_sa == NULL ||
this->child_sa->get_state(this->child_sa) == CHILD_DELETING)
{
DBG1(DBG_IKE, "unable to rekey, CHILD_SA not found");
message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
return SUCCESS;
}
/* let the CHILD_CREATE task build the response */
reqid = this->child_sa->get_reqid(this->child_sa);
this->child_create->use_reqid(this->child_create, reqid);
this->child_create->task.build(&this->child_create->task, message);
if (message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
{
/* rekeying failed, reuse old child */
this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
return SUCCESS;
}
this->child_sa->set_state(this->child_sa, CHILD_REKEYING);
/* invoke rekey hook */
charon->bus->child_rekey(charon->bus, this->child_sa,
this->child_create->get_child(this->child_create));
return SUCCESS;
}
/**
* Handle a rekey collision
*/
static child_sa_t *handle_collision(private_child_rekey_t *this)
{
child_sa_t *to_delete;
if (this->collision->get_type(this->collision) == TASK_CHILD_REKEY)
{
chunk_t this_nonce, other_nonce;
private_child_rekey_t *other = (private_child_rekey_t*)this->collision;
this_nonce = this->child_create->get_lower_nonce(this->child_create);
other_nonce = other->child_create->get_lower_nonce(other->child_create);
/* if we have the lower nonce, delete rekeyed SA. If not, delete
* the redundant. */
if (memcmp(this_nonce.ptr, other_nonce.ptr,
min(this_nonce.len, other_nonce.len)) > 0)
{
child_sa_t *child_sa;
DBG1(DBG_IKE, "CHILD_SA rekey collision won, deleting old child");
to_delete = this->child_sa;
/* don't touch child other created, it has already been deleted */
if (!this->other_child_destroyed)
{
/* disable close action for the redundand child */
child_sa = other->child_create->get_child(other->child_create);
if (child_sa)
{
child_sa->set_close_action(child_sa, ACTION_NONE);
}
}
}
else
{
DBG1(DBG_IKE, "CHILD_SA rekey collision lost, "
"deleting rekeyed child");
to_delete = this->child_create->get_child(this->child_create);
}
}
else
{ /* CHILD_DELETE */
child_delete_t *del = (child_delete_t*)this->collision;
/* we didn't had a chance to compare the nonces, so we delete
* the CHILD_SA the other is not deleting. */
if (del->get_child(del) != this->child_sa)
{
DBG1(DBG_IKE, "CHILD_SA rekey/delete collision, "
"deleting rekeyed child");
to_delete = this->child_sa;
}
else
{
DBG1(DBG_IKE, "CHILD_SA rekey/delete collision, "
"deleting redundant child");
to_delete = this->child_create->get_child(this->child_create);
}
}
return to_delete;
}
METHOD(task_t, process_i, status_t,
private_child_rekey_t *this, message_t *message)
{
protocol_id_t protocol;
u_int32_t spi;
child_sa_t *to_delete;
if (message->get_notify(message, NO_ADDITIONAL_SAS))
{
DBG1(DBG_IKE, "peer seems to not support CHILD_SA rekeying, "
"starting reauthentication");
this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
lib->processor->queue_job(lib->processor,
(job_t*)rekey_ike_sa_job_create(
this->ike_sa->get_id(this->ike_sa), TRUE));
return SUCCESS;
}
if (this->child_create->task.process(&this->child_create->task,
message) == NEED_MORE)
{
/* bad DH group while rekeying, try again */
this->child_create->task.migrate(&this->child_create->task, this->ike_sa);
return NEED_MORE;
}
if (message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
{
/* establishing new child failed, reuse old. but not when we
* received a delete in the meantime */
if (!(this->collision &&
this->collision->get_type(this->collision) == TASK_CHILD_DELETE))
{
job_t *job;
u_int32_t retry = RETRY_INTERVAL - (random() % RETRY_JITTER);
job = (job_t*)rekey_child_sa_job_create(
this->child_sa->get_reqid(this->child_sa),
this->child_sa->get_protocol(this->child_sa),
this->child_sa->get_spi(this->child_sa, TRUE));
DBG1(DBG_IKE, "CHILD_SA rekeying failed, "
"trying again in %d seconds", retry);
this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
lib->scheduler->schedule_job(lib->scheduler, job, retry);
}
return SUCCESS;
}
/* check for rekey collisions */
if (this->collision)
{
to_delete = handle_collision(this);
}
else
{
to_delete = this->child_sa;
}
if (to_delete != this->child_create->get_child(this->child_create))
{ /* invoke rekey hook if rekeying successful */
charon->bus->child_rekey(charon->bus, this->child_sa,
this->child_create->get_child(this->child_create));
}
if (to_delete == NULL)
{
return SUCCESS;
}
spi = to_delete->get_spi(to_delete, TRUE);
protocol = to_delete->get_protocol(to_delete);
/* rekeying done, delete the obsolete CHILD_SA using a subtask */
this->child_delete = child_delete_create(this->ike_sa, protocol, spi, FALSE);
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i_delete;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_i_delete;
return NEED_MORE;
}
METHOD(task_t, get_type, task_type_t,
private_child_rekey_t *this)
{
return TASK_CHILD_REKEY;
}
METHOD(child_rekey_t, collide, void,
private_child_rekey_t *this, task_t *other)
{
/* the task manager only detects exchange collision, but not if
* the collision is for the same child. we check it here. */
if (other->get_type(other) == TASK_CHILD_REKEY)
{
private_child_rekey_t *rekey = (private_child_rekey_t*)other;
if (rekey->child_sa != this->child_sa)
{
/* not the same child => no collision */
other->destroy(other);
return;
}
}
else if (other->get_type(other) == TASK_CHILD_DELETE)
{
child_delete_t *del = (child_delete_t*)other;
if (del->get_child(del) == this->child_create->get_child(this->child_create))
{
/* peer deletes redundant child created in collision */
this->other_child_destroyed = TRUE;
other->destroy(other);
return;
}
if (del->get_child(del) != this->child_sa)
{
/* not the same child => no collision */
other->destroy(other);
return;
}
}
else
{
/* any other task is not critical for collisisions, ignore */
other->destroy(other);
return;
}
DBG1(DBG_IKE, "detected %N collision with %N", task_type_names,
TASK_CHILD_REKEY, task_type_names, other->get_type(other));
DESTROY_IF(this->collision);
this->collision = other;
}
METHOD(task_t, migrate, void,
private_child_rekey_t *this, ike_sa_t *ike_sa)
{
if (this->child_create)
{
this->child_create->task.migrate(&this->child_create->task, ike_sa);
}
if (this->child_delete)
{
this->child_delete->task.migrate(&this->child_delete->task, ike_sa);
}
DESTROY_IF(this->collision);
this->ike_sa = ike_sa;
this->collision = NULL;
}
METHOD(task_t, destroy, void,
private_child_rekey_t *this)
{
if (this->child_create)
{
this->child_create->task.destroy(&this->child_create->task);
}
if (this->child_delete)
{
this->child_delete->task.destroy(&this->child_delete->task);
}
DESTROY_IF(this->collision);
free(this);
}
/*
* Described in header.
*/
child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, protocol_id_t protocol,
u_int32_t spi)
{
private_child_rekey_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
.collide = _collide,
},
.ike_sa = ike_sa,
.protocol = protocol,
.spi = spi,
);
if (protocol != PROTO_NONE)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
this->initiator = TRUE;
this->child_create = NULL;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
this->initiator = FALSE;
this->child_create = child_create_create(ike_sa, NULL, TRUE, NULL, NULL);
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/child_rekey.h
+64
View File
@@ -0,0 +1,64 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup child_rekey child_rekey
* @{ @ingroup tasks
*/
#ifndef CHILD_REKEY_H_
#define CHILD_REKEY_H_
typedef struct child_rekey_t child_rekey_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/child_sa.h>
#include <sa/task.h>
/**
* Task of type TASK_CHILD_REKEY, rekey an established CHILD_SA.
*/
struct child_rekey_t {
/**
* Implements the task_t interface
*/
task_t task;
/**
* Register a rekeying task which collides with this one
*
* If two peers initiate rekeying at the same time, the collision must
* be handled gracefully. The task manager is aware of what exchanges
* are going on and notifies the outgoing task by passing the incoming.
*
* @param other incoming task
*/
void (*collide)(child_rekey_t* this, task_t *other);
};
/**
* Create a new TASK_CHILD_REKEY task.
*
* @param ike_sa IKE_SA this task works for
* @param protocol protocol of CHILD_SA to rekey, PROTO_NONE as responder
* @param spi inbound SPI of CHILD_SA to rekey
* @return child_rekey task to handle by the task_manager
*/
child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, protocol_id_t protocol,
u_int32_t spi);
#endif /** CHILD_REKEY_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_auth.c
+1108
View File
File diff suppressed because it is too large Load Diff
src/libcharon/sa/ikev2/tasks/ike_auth.h
+57
View File
@@ -0,0 +1,57 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_auth ike_auth
* @{ @ingroup tasks
*/
#ifndef IKE_AUTH_H_
#define IKE_AUTH_H_
typedef struct ike_auth_t ike_auth_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type ike_auth, authenticates an IKE_SA using authenticators.
*
* The ike_auth task authenticates the IKE_SA using the IKE_AUTH
* exchange. It processes and build IDi and IDr payloads and also
* handles AUTH payloads. The AUTH payloads are passed to authenticator_t's,
* which do the actual authentication process. If the ike_auth task is used
* with EAP authentication, it stays alive over multiple exchanges until
* EAP has completed.
*/
struct ike_auth_t {
/**
* Implements the task_t interface
*/
task_t task;
};
/**
* Create a new task of type TASK_IKE_AUTH.
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if task is the initiator of an exchange
* @return ike_auth task to handle by the task_manager
*/
ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, bool initiator);
#endif /** IKE_AUTH_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_auth_lifetime.c
+172
View File
@@ -0,0 +1,172 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_auth_lifetime.h"
#include <time.h>
#include <daemon.h>
#include <encoding/payloads/notify_payload.h>
typedef struct private_ike_auth_lifetime_t private_ike_auth_lifetime_t;
/**
* Private members of a ike_auth_lifetime_t task.
*/
struct private_ike_auth_lifetime_t {
/**
* Public methods and task_t interface.
*/
ike_auth_lifetime_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
};
/**
* add the AUTH_LIFETIME notify to the message
*/
static void add_auth_lifetime(private_ike_auth_lifetime_t *this, message_t *message)
{
chunk_t chunk;
u_int32_t lifetime;
lifetime = this->ike_sa->get_statistic(this->ike_sa, STAT_REAUTH);
if (lifetime)
{
lifetime -= time_monotonic(NULL);
chunk = chunk_from_thing(lifetime);
*(u_int32_t*)chunk.ptr = htonl(lifetime);
message->add_notify(message, FALSE, AUTH_LIFETIME, chunk);
}
}
/**
* read notifys from message and evaluate them
*/
static void process_payloads(private_ike_auth_lifetime_t *this, message_t *message)
{
notify_payload_t *notify;
chunk_t data;
u_int32_t lifetime;
notify = message->get_notify(message, AUTH_LIFETIME);
if (notify)
{
data = notify->get_notification_data(notify);
lifetime = ntohl(*(u_int32_t*)data.ptr);
this->ike_sa->set_auth_lifetime(this->ike_sa, lifetime);
}
}
METHOD(task_t, build_i, status_t,
private_ike_auth_lifetime_t *this, message_t *message)
{
if (message->get_exchange_type(message) == INFORMATIONAL)
{
add_auth_lifetime(this, message);
return SUCCESS;
}
return NEED_MORE;
}
METHOD(task_t, process_r, status_t,
private_ike_auth_lifetime_t *this, message_t *message)
{
if (message->get_exchange_type(message) == INFORMATIONAL)
{
process_payloads(this, message);
return SUCCESS;
}
return NEED_MORE;
}
METHOD(task_t, build_r, status_t,
private_ike_auth_lifetime_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{
add_auth_lifetime(this, message);
return SUCCESS;
}
return NEED_MORE;
}
METHOD(task_t, process_i, status_t,
private_ike_auth_lifetime_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{
process_payloads(this, message);
return SUCCESS;
}
return NEED_MORE;
}
METHOD(task_t, get_type, task_type_t,
private_ike_auth_lifetime_t *this)
{
return TASK_IKE_AUTH_LIFETIME;
}
METHOD(task_t, migrate, void,
private_ike_auth_lifetime_t *this, ike_sa_t *ike_sa)
{
this->ike_sa = ike_sa;
}
METHOD(task_t, destroy, void,
private_ike_auth_lifetime_t *this)
{
free(this);
}
/*
* Described in header.
*/
ike_auth_lifetime_t *ike_auth_lifetime_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_auth_lifetime_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
);
if (initiator)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_auth_lifetime.h
+53
View File
@@ -0,0 +1,53 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_auth_lifetime ike_auth_lifetime
* @{ @ingroup tasks
*/
#ifndef IKE_AUTH_LIFETIME_H_
#define IKE_AUTH_LIFETIME_H_
typedef struct ike_auth_lifetime_t ike_auth_lifetime_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type TASK_IKE_AUTH_LIFETIME, implements RFC4478.
*
* This task exchanges lifetimes for IKE_AUTH to force a client to
* reauthenticate before the responders lifetime reaches the limit.
*/
struct ike_auth_lifetime_t {
/**
* Implements the task_t interface
*/
task_t task;
};
/**
* Create a new TASK_IKE_AUTH_LIFETIME task.
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if taks is initiated by us
* @return ike_auth_lifetime task to handle by the task_manager
*/
ike_auth_lifetime_t *ike_auth_lifetime_create(ike_sa_t *ike_sa, bool initiator);
#endif /** IKE_AUTH_LIFETIME_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_cert_post.c
+256
View File
@@ -0,0 +1,256 @@
/*
* Copyright (C) 2008 Tobias Brunner
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_cert_post.h"
#include <daemon.h>
#include <sa/ike_sa.h>
#include <encoding/payloads/cert_payload.h>
#include <encoding/payloads/certreq_payload.h>
#include <encoding/payloads/auth_payload.h>
#include <credentials/certificates/x509.h>
typedef struct private_ike_cert_post_t private_ike_cert_post_t;
/**
* Private members of a ike_cert_post_t task.
*/
struct private_ike_cert_post_t {
/**
* Public methods and task_t interface.
*/
ike_cert_post_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* Are we the initiator?
*/
bool initiator;
};
/**
* Generates the cert payload, if possible with "Hash and URL"
*/
static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this,
certificate_t *cert)
{
hasher_t *hasher;
identification_t *id;
chunk_t hash, encoded ;
enumerator_t *enumerator;
char *url;
cert_payload_t *payload = NULL;
if (!this->ike_sa->supports_extension(this->ike_sa, EXT_HASH_AND_URL))
{
return cert_payload_create_from_cert(CERTIFICATE, cert);
}
hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (!hasher)
{
DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported");
return cert_payload_create_from_cert(CERTIFICATE, cert);
}
if (!cert->get_encoding(cert, CERT_ASN1_DER, &encoded))
{
DBG1(DBG_IKE, "encoding certificate for cert payload failed");
hasher->destroy(hasher);
return NULL;
}
hasher->allocate_hash(hasher, encoded, &hash);
chunk_free(&encoded);
hasher->destroy(hasher);
id = identification_create_from_encoding(ID_KEY_ID, hash);
enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr, CERT_X509, id);
if (enumerator->enumerate(enumerator, &url))
{
payload = cert_payload_create_from_hash_and_url(hash, url);
DBG1(DBG_IKE, "sending hash-and-url \"%s\"", url);
}
else
{
payload = cert_payload_create_from_cert(CERTIFICATE, cert);
}
enumerator->destroy(enumerator);
chunk_free(&hash);
id->destroy(id);
return payload;
}
/**
* add certificates to message
*/
static void build_certs(private_ike_cert_post_t *this, message_t *message)
{
peer_cfg_t *peer_cfg;
auth_payload_t *payload;
payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (!peer_cfg || !payload || payload->get_auth_method(payload) == AUTH_PSK)
{ /* no CERT payload for EAP/PSK */
return;
}
switch (peer_cfg->get_cert_policy(peer_cfg))
{
case CERT_NEVER_SEND:
break;
case CERT_SEND_IF_ASKED:
if (!this->ike_sa->has_condition(this->ike_sa, COND_CERTREQ_SEEN))
{
break;
}
/* FALL */
case CERT_ALWAYS_SEND:
{
cert_payload_t *payload;
enumerator_t *enumerator;
certificate_t *cert;
auth_rule_t type;
auth_cfg_t *auth;
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
/* get subject cert first, then issuing certificates */
cert = auth->get(auth, AUTH_RULE_SUBJECT_CERT);
if (!cert)
{
break;
}
payload = build_cert_payload(this, cert);
if (!payload)
{
break;
}
DBG1(DBG_IKE, "sending end entity cert \"%Y\"",
cert->get_subject(cert));
message->add_payload(message, (payload_t*)payload);
enumerator = auth->create_enumerator(auth);
while (enumerator->enumerate(enumerator, &type, &cert))
{
if (type == AUTH_RULE_IM_CERT)
{
payload = cert_payload_create_from_cert(CERTIFICATE, cert);
if (payload)
{
DBG1(DBG_IKE, "sending issuer cert \"%Y\"",
cert->get_subject(cert));
message->add_payload(message, (payload_t*)payload);
}
}
}
enumerator->destroy(enumerator);
}
}
}
METHOD(task_t, build_i, status_t,
private_ike_cert_post_t *this, message_t *message)
{
build_certs(this, message);
return NEED_MORE;
}
METHOD(task_t, process_r, status_t,
private_ike_cert_post_t *this, message_t *message)
{
return NEED_MORE;
}
METHOD(task_t, build_r, status_t,
private_ike_cert_post_t *this, message_t *message)
{
build_certs(this, message);
if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
{ /* stay alive, we might have additional rounds with certs */
return NEED_MORE;
}
return SUCCESS;
}
METHOD(task_t, process_i, status_t,
private_ike_cert_post_t *this, message_t *message)
{
if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
{ /* stay alive, we might have additional rounds with CERTS */
return NEED_MORE;
}
return SUCCESS;
}
METHOD(task_t, get_type, task_type_t,
private_ike_cert_post_t *this)
{
return TASK_IKE_CERT_POST;
}
METHOD(task_t, migrate, void,
private_ike_cert_post_t *this, ike_sa_t *ike_sa)
{
this->ike_sa = ike_sa;
}
METHOD(task_t, destroy, void,
private_ike_cert_post_t *this)
{
free(this);
}
/*
* Described in header.
*/
ike_cert_post_t *ike_cert_post_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_cert_post_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
.initiator = initiator,
);
if (initiator)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_cert_post.h
+53
View File
@@ -0,0 +1,53 @@
/*
* Copyright (C) 2007-2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_cert_post ike_cert_post
* @{ @ingroup tasks
*/
#ifndef IKE_CERT_POST_H_
#define IKE_CERT_POST_H_
typedef struct ike_cert_post_t ike_cert_post_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type ike_cert_post, certificate processing after authentication.
*/
struct ike_cert_post_t {
/**
* Implements the task_t interface
*/
task_t task;
};
/**
* Create a new ike_cert_post task.
*
* The initiator parameter means the original initiator, not the initiator
* of the certificate request.
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if task is the original initiator
* @return ike_cert_post task to handle by the task_manager
*/
ike_cert_post_t *ike_cert_post_create(ike_sa_t *ike_sa, bool initiator);
#endif /** IKE_CERT_POST_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_cert_pre.c
+528
View File
@@ -0,0 +1,528 @@
/*
* Copyright (C) 2008 Tobias Brunner
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_cert_pre.h"
#include <daemon.h>
#include <sa/ike_sa.h>
#include <encoding/payloads/cert_payload.h>
#include <encoding/payloads/certreq_payload.h>
#include <credentials/certificates/x509.h>
typedef struct private_ike_cert_pre_t private_ike_cert_pre_t;
/**
* Private members of a ike_cert_pre_t task.
*/
struct private_ike_cert_pre_t {
/**
* Public methods and task_t interface.
*/
ike_cert_pre_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* Are we the initiator?
*/
bool initiator;
/**
* Do we accept HTTP certificate lookup requests
*/
bool do_http_lookup;
/**
* whether this is the final authentication round
*/
bool final;
};
/**
* read certificate requests
*/
static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
auth_cfg_t *auth;
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
switch (payload->get_type(payload))
{
case CERTIFICATE_REQUEST:
{
certreq_payload_t *certreq = (certreq_payload_t*)payload;
enumerator_t *enumerator;
u_int unknown = 0;
chunk_t keyid;
this->ike_sa->set_condition(this->ike_sa, COND_CERTREQ_SEEN, TRUE);
if (certreq->get_cert_type(certreq) != CERT_X509)
{
DBG1(DBG_IKE, "cert payload %N not supported - ignored",
certificate_type_names, certreq->get_cert_type(certreq));
break;
}
enumerator = certreq->create_keyid_enumerator(certreq);
while (enumerator->enumerate(enumerator, &keyid))
{
identification_t *id;
certificate_t *cert;
id = identification_create_from_encoding(ID_KEY_ID, keyid);
cert = lib->credmgr->get_cert(lib->credmgr,
CERT_X509, KEY_ANY, id, TRUE);
if (cert)
{
DBG1(DBG_IKE, "received cert request for \"%Y\"",
cert->get_subject(cert));
auth->add(auth, AUTH_RULE_CA_CERT, cert);
}
else
{
DBG2(DBG_IKE, "received cert request for unknown ca "
"with keyid %Y", id);
unknown++;
}
id->destroy(id);
}
enumerator->destroy(enumerator);
if (unknown)
{
DBG1(DBG_IKE, "received %u cert requests for an unknown ca",
unknown);
}
break;
}
case NOTIFY:
{
notify_payload_t *notify = (notify_payload_t*)payload;
/* we only handle one type of notify here */
if (notify->get_notify_type(notify) == HTTP_CERT_LOOKUP_SUPPORTED)
{
this->ike_sa->enable_extension(this->ike_sa, EXT_HASH_AND_URL);
}
break;
}
default:
/* ignore other payloads here, these are handled elsewhere */
break;
}
}
enumerator->destroy(enumerator);
}
/**
* tries to extract a certificate from the cert payload or the credential
* manager (based on the hash of a "Hash and URL" encoded cert).
* Note: the returned certificate (if any) has to be destroyed
*/
static certificate_t *try_get_cert(cert_payload_t *cert_payload)
{
certificate_t *cert = NULL;
switch (cert_payload->get_cert_encoding(cert_payload))
{
case ENC_X509_SIGNATURE:
{
cert = cert_payload->get_cert(cert_payload);
break;
}
case ENC_X509_HASH_AND_URL:
{
identification_t *id;
chunk_t hash = cert_payload->get_hash(cert_payload);
if (!hash.ptr)
{
/* invalid "Hash and URL" data (logged elsewhere) */
break;
}
id = identification_create_from_encoding(ID_KEY_ID, hash);
cert = lib->credmgr->get_cert(lib->credmgr,
CERT_X509, KEY_ANY, id, FALSE);
id->destroy(id);
break;
}
default:
{
break;
}
}
return cert;
}
/**
* import certificates
*/
static void process_certs(private_ike_cert_pre_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
auth_cfg_t *auth;
bool first = TRUE;
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == CERTIFICATE)
{
cert_payload_t *cert_payload;
cert_encoding_t encoding;
certificate_t *cert;
char *url;
cert_payload = (cert_payload_t*)payload;
encoding = cert_payload->get_cert_encoding(cert_payload);
switch (encoding)
{
case ENC_X509_HASH_AND_URL:
{
if (!this->do_http_lookup)
{
DBG1(DBG_IKE, "received hash-and-url encoded cert, but"
" we don't accept them, ignore");
break;
}
/* FALL */
}
case ENC_X509_SIGNATURE:
{
cert = try_get_cert(cert_payload);
if (cert)
{
if (first)
{ /* the first is an end entity certificate */
DBG1(DBG_IKE, "received end entity cert \"%Y\"",
cert->get_subject(cert));
auth->add(auth, AUTH_HELPER_SUBJECT_CERT, cert);
first = FALSE;
}
else
{
DBG1(DBG_IKE, "received issuer cert \"%Y\"",
cert->get_subject(cert));
auth->add(auth, AUTH_HELPER_IM_CERT, cert);
}
}
else if (encoding == ENC_X509_HASH_AND_URL)
{
/* we fetch the certificate not yet, but only if
* it is really needed during authentication */
url = cert_payload->get_url(cert_payload);
if (!url)
{
DBG1(DBG_IKE, "received invalid hash-and-url "
"encoded cert, ignore");
break;
}
url = strdup(url);
if (first)
{ /* first URL is for an end entity certificate */
DBG1(DBG_IKE, "received hash-and-url for end"
" entity cert \"%s\"", url);
auth->add(auth, AUTH_HELPER_SUBJECT_HASH_URL, url);
first = FALSE;
}
else
{
DBG1(DBG_IKE, "received hash-and-url for issuer"
" cert \"%s\"", url);
auth->add(auth, AUTH_HELPER_IM_HASH_URL, url);
}
}
break;
}
case ENC_CRL:
cert = cert_payload->get_cert(cert_payload);
if (cert)
{
DBG1(DBG_IKE, "received CRL \"%Y\"",
cert->get_subject(cert));
auth->add(auth, AUTH_HELPER_REVOCATION_CERT, cert);
}
break;
case ENC_PKCS7_WRAPPED_X509:
case ENC_PGP:
case ENC_DNS_SIGNED_KEY:
case ENC_KERBEROS_TOKEN:
case ENC_ARL:
case ENC_SPKI:
case ENC_X509_ATTRIBUTE:
case ENC_RAW_RSA_KEY:
case ENC_X509_HASH_AND_URL_BUNDLE:
case ENC_OCSP_CONTENT:
default:
DBG1(DBG_ENC, "certificate encoding %N not supported",
cert_encoding_names, encoding);
}
}
}
enumerator->destroy(enumerator);
}
/**
* add the keyid of a certificate to the certificate request payload
*/
static void add_certreq(certreq_payload_t **req, certificate_t *cert)
{
switch (cert->get_type(cert))
{
case CERT_X509:
{
public_key_t *public;
chunk_t keyid;
x509_t *x509 = (x509_t*)cert;
if (!(x509->get_flags(x509) & X509_CA))
{ /* no CA cert, skip */
break;
}
public = cert->get_public_key(cert);
if (!public)
{
break;
}
if (*req == NULL)
{
*req = certreq_payload_create_type(CERT_X509);
}
if (public->get_fingerprint(public, KEYID_PUBKEY_INFO_SHA1, &keyid))
{
(*req)->add_keyid(*req, keyid);
DBG1(DBG_IKE, "sending cert request for \"%Y\"",
cert->get_subject(cert));
}
public->destroy(public);
break;
}
default:
break;
}
}
/**
* add a auth_cfg's CA certificates to the certificate request
*/
static void add_certreqs(certreq_payload_t **req, auth_cfg_t *auth)
{
enumerator_t *enumerator;
auth_rule_t type;
void *value;
enumerator = auth->create_enumerator(auth);
while (enumerator->enumerate(enumerator, &type, &value))
{
switch (type)
{
case AUTH_RULE_CA_CERT:
add_certreq(req, (certificate_t*)value);
break;
default:
break;
}
}
enumerator->destroy(enumerator);
}
/**
* build certificate requests
*/
static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
{
enumerator_t *enumerator;
ike_cfg_t *ike_cfg;
peer_cfg_t *peer_cfg;
certificate_t *cert;
auth_cfg_t *auth;
certreq_payload_t *req = NULL;
ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
if (!ike_cfg->send_certreq(ike_cfg))
{
return;
}
/* check if we require a specific CA for that peer */
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (peer_cfg)
{
enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, FALSE);
while (enumerator->enumerate(enumerator, &auth))
{
add_certreqs(&req, auth);
}
enumerator->destroy(enumerator);
}
if (!req)
{
/* otherwise add all trusted CA certificates */
enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
CERT_ANY, KEY_ANY, NULL, TRUE);
while (enumerator->enumerate(enumerator, &cert))
{
add_certreq(&req, cert);
}
enumerator->destroy(enumerator);
}
if (req)
{
message->add_payload(message, (payload_t*)req);
if (lib->settings->get_bool(lib->settings, "charon.hash_and_url", FALSE))
{
message->add_notify(message, FALSE, HTTP_CERT_LOOKUP_SUPPORTED,
chunk_empty);
this->do_http_lookup = TRUE;
}
}
}
/**
* Check if this is the final authentication round
*/
static bool final_auth(message_t *message)
{
/* we check for an AUTH payload without a ANOTHER_AUTH_FOLLOWS notify */
if (message->get_payload(message, AUTHENTICATION) == NULL)
{
return FALSE;
}
if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS))
{
return FALSE;
}
return TRUE;
}
METHOD(task_t, build_i, status_t,
private_ike_cert_pre_t *this, message_t *message)
{
if (message->get_message_id(message) == 1)
{ /* initiator sends CERTREQs in first IKE_AUTH */
build_certreqs(this, message);
}
return NEED_MORE;
}
METHOD(task_t, process_r, status_t,
private_ike_cert_pre_t *this, message_t *message)
{
if (message->get_exchange_type(message) != IKE_SA_INIT)
{ /* handle certreqs/certs in any IKE_AUTH, just in case */
process_certreqs(this, message);
process_certs(this, message);
}
this->final = final_auth(message);
return NEED_MORE;
}
METHOD(task_t, build_r, status_t,
private_ike_cert_pre_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
build_certreqs(this, message);
}
if (this->final)
{
return SUCCESS;
}
return NEED_MORE;
}
METHOD(task_t, process_i, status_t,
private_ike_cert_pre_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
process_certreqs(this, message);
}
process_certs(this, message);
if (final_auth(message))
{
return SUCCESS;
}
return NEED_MORE;
}
METHOD(task_t, get_type, task_type_t,
private_ike_cert_pre_t *this)
{
return TASK_IKE_CERT_PRE;
}
METHOD(task_t, migrate, void,
private_ike_cert_pre_t *this, ike_sa_t *ike_sa)
{
this->ike_sa = ike_sa;
}
METHOD(task_t, destroy, void,
private_ike_cert_pre_t *this)
{
free(this);
}
/*
* Described in header.
*/
ike_cert_pre_t *ike_cert_pre_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_cert_pre_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
.initiator = initiator,
);
if (initiator)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_cert_pre.h
+53
View File
@@ -0,0 +1,53 @@
/*
* Copyright (C) 2007-2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_cert_pre ike_cert_pre
* @{ @ingroup tasks
*/
#ifndef IKE_CERT_PRE_H_
#define IKE_CERT_PRE_H_
typedef struct ike_cert_pre_t ike_cert_pre_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type ike_cert_post, certificate processing before authentication.
*/
struct ike_cert_pre_t {
/**
* Implements the task_t interface
*/
task_t task;
};
/**
* Create a new ike_cert_pre task.
*
* The initiator parameter means the original initiator, not the initiator
* of the certificate request.
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if task is the original initiator
* @return ike_cert_pre task to handle by the task_manager
*/
ike_cert_pre_t *ike_cert_pre_create(ike_sa_t *ike_sa, bool initiator);
#endif /** IKE_CERT_PRE_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_config.c
+445
View File
@@ -0,0 +1,445 @@
/*
* Copyright (C) 2007 Martin Willi
* Copyright (C) 2006-2007 Fabian Hartmann, Noah Heusser
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_config.h"
#include <daemon.h>
#include <hydra.h>
#include <encoding/payloads/cp_payload.h>
typedef struct private_ike_config_t private_ike_config_t;
/**
* Private members of a ike_config_t task.
*/
struct private_ike_config_t {
/**
* Public methods and task_t interface.
*/
ike_config_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* Are we the initiator?
*/
bool initiator;
/**
* virtual ip
*/
host_t *virtual_ip;
/**
* list of attributes requested and its handler, entry_t
*/
linked_list_t *requested;
};
/**
* Entry for a requested attribute and the requesting handler
*/
typedef struct {
/** attribute requested */
configuration_attribute_type_t type;
/** handler requesting this attribute */
attribute_handler_t *handler;
} entry_t;
/**
* build INTERNAL_IPV4/6_ADDRESS attribute from virtual ip
*/
static configuration_attribute_t *build_vip(host_t *vip)
{
configuration_attribute_type_t type;
chunk_t chunk, prefix;
if (vip->get_family(vip) == AF_INET)
{
type = INTERNAL_IP4_ADDRESS;
if (vip->is_anyaddr(vip))
{
chunk = chunk_empty;
}
else
{
chunk = vip->get_address(vip);
}
}
else
{
type = INTERNAL_IP6_ADDRESS;
if (vip->is_anyaddr(vip))
{
chunk = chunk_empty;
}
else
{
prefix = chunk_alloca(1);
*prefix.ptr = 64;
chunk = vip->get_address(vip);
chunk = chunk_cata("cc", chunk, prefix);
}
}
return configuration_attribute_create_chunk(CONFIGURATION_ATTRIBUTE,
type, chunk);
}
/**
* Handle a received attribute as initiator
*/
static void handle_attribute(private_ike_config_t *this,
configuration_attribute_t *ca)
{
attribute_handler_t *handler = NULL;
enumerator_t *enumerator;
entry_t *entry;
/* find the handler which requested this attribute */
enumerator = this->requested->create_enumerator(this->requested);
while (enumerator->enumerate(enumerator, &entry))
{
if (entry->type == ca->get_type(ca))
{
handler = entry->handler;
this->requested->remove_at(this->requested, enumerator);
free(entry);
break;
}
}
enumerator->destroy(enumerator);
/* and pass it to the handle function */
handler = hydra->attributes->handle(hydra->attributes,
this->ike_sa->get_other_id(this->ike_sa), handler,
ca->get_type(ca), ca->get_chunk(ca));
if (handler)
{
this->ike_sa->add_configuration_attribute(this->ike_sa,
handler, ca->get_type(ca), ca->get_chunk(ca));
}
}
/**
* process a single configuration attribute
*/
static void process_attribute(private_ike_config_t *this,
configuration_attribute_t *ca)
{
host_t *ip;
chunk_t addr;
int family = AF_INET6;
switch (ca->get_type(ca))
{
case INTERNAL_IP4_ADDRESS:
family = AF_INET;
/* fall */
case INTERNAL_IP6_ADDRESS:
{
addr = ca->get_chunk(ca);
if (addr.len == 0)
{
ip = host_create_any(family);
}
else
{
/* skip prefix byte in IPv6 payload*/
if (family == AF_INET6)
{
addr.len--;
}
ip = host_create_from_chunk(family, addr, 0);
}
if (ip)
{
DESTROY_IF(this->virtual_ip);
this->virtual_ip = ip;
}
break;
}
case INTERNAL_IP4_SERVER:
case INTERNAL_IP6_SERVER:
/* assume it's a Windows client if we see proprietary attributes */
this->ike_sa->enable_extension(this->ike_sa, EXT_MS_WINDOWS);
/* fall */
default:
{
if (this->initiator)
{
handle_attribute(this, ca);
}
}
}
}
/**
* Scan for configuration payloads and attributes
*/
static void process_payloads(private_ike_config_t *this, message_t *message)
{
enumerator_t *enumerator, *attributes;
payload_t *payload;
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == CONFIGURATION)
{
cp_payload_t *cp = (cp_payload_t*)payload;
configuration_attribute_t *ca;
switch (cp->get_type(cp))
{
case CFG_REQUEST:
case CFG_REPLY:
{
attributes = cp->create_attribute_enumerator(cp);
while (attributes->enumerate(attributes, &ca))
{
DBG2(DBG_IKE, "processing %N attribute",
configuration_attribute_type_names, ca->get_type(ca));
process_attribute(this, ca);
}
attributes->destroy(attributes);
break;
}
default:
DBG1(DBG_IKE, "ignoring %N config payload",
config_type_names, cp->get_type(cp));
break;
}
}
}
enumerator->destroy(enumerator);
}
METHOD(task_t, build_i, status_t,
private_ike_config_t *this, message_t *message)
{
if (message->get_message_id(message) == 1)
{ /* in first IKE_AUTH only */
cp_payload_t *cp = NULL;
enumerator_t *enumerator;
attribute_handler_t *handler;
peer_cfg_t *config;
configuration_attribute_type_t type;
chunk_t data;
host_t *vip;
/* reuse virtual IP if we already have one */
vip = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
if (!vip)
{
config = this->ike_sa->get_peer_cfg(this->ike_sa);
vip = config->get_virtual_ip(config);
}
if (vip)
{
cp = cp_payload_create_type(CONFIGURATION, CFG_REQUEST);
cp->add_attribute(cp, build_vip(vip));
}
enumerator = hydra->attributes->create_initiator_enumerator(hydra->attributes,
this->ike_sa->get_other_id(this->ike_sa), vip);
while (enumerator->enumerate(enumerator, &handler, &type, &data))
{
configuration_attribute_t *ca;
entry_t *entry;
/* create configuration attribute */
DBG2(DBG_IKE, "building %N attribute",
configuration_attribute_type_names, type);
ca = configuration_attribute_create_chunk(CONFIGURATION_ATTRIBUTE,
type, data);
if (!cp)
{
cp = cp_payload_create_type(CONFIGURATION, CFG_REQUEST);
}
cp->add_attribute(cp, ca);
/* save handler along with requested type */
entry = malloc_thing(entry_t);
entry->type = type;
entry->handler = handler;
this->requested->insert_last(this->requested, entry);
}
enumerator->destroy(enumerator);
if (cp)
{
message->add_payload(message, (payload_t*)cp);
}
}
return NEED_MORE;
}
METHOD(task_t, process_r, status_t,
private_ike_config_t *this, message_t *message)
{
if (message->get_message_id(message) == 1)
{ /* in first IKE_AUTH only */
process_payloads(this, message);
}
return NEED_MORE;
}
METHOD(task_t, build_r, status_t,
private_ike_config_t *this, message_t *message)
{
if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{ /* in last IKE_AUTH exchange */
enumerator_t *enumerator;
configuration_attribute_type_t type;
chunk_t value;
host_t *vip = NULL;
cp_payload_t *cp = NULL;
peer_cfg_t *config;
identification_t *id;
id = this->ike_sa->get_other_eap_id(this->ike_sa);
config = this->ike_sa->get_peer_cfg(this->ike_sa);
if (this->virtual_ip)
{
DBG1(DBG_IKE, "peer requested virtual IP %H", this->virtual_ip);
if (config->get_pool(config))
{
vip = hydra->attributes->acquire_address(hydra->attributes,
config->get_pool(config), id, this->virtual_ip);
}
if (vip == NULL)
{
DBG1(DBG_IKE, "no virtual IP found, sending %N",
notify_type_names, INTERNAL_ADDRESS_FAILURE);
message->add_notify(message, FALSE, INTERNAL_ADDRESS_FAILURE,
chunk_empty);
return SUCCESS;
}
DBG1(DBG_IKE, "assigning virtual IP %H to peer '%Y'", vip, id);
this->ike_sa->set_virtual_ip(this->ike_sa, FALSE, vip);
cp = cp_payload_create_type(CONFIGURATION, CFG_REPLY);
cp->add_attribute(cp, build_vip(vip));
}
/* query registered providers for additional attributes to include */
enumerator = hydra->attributes->create_responder_enumerator(
hydra->attributes, config->get_pool(config), id, vip);
while (enumerator->enumerate(enumerator, &type, &value))
{
if (!cp)
{
cp = cp_payload_create_type(CONFIGURATION, CFG_REPLY);
}
DBG2(DBG_IKE, "building %N attribute",
configuration_attribute_type_names, type);
cp->add_attribute(cp,
configuration_attribute_create_chunk(CONFIGURATION_ATTRIBUTE,
type, value));
}
enumerator->destroy(enumerator);
if (cp)
{
message->add_payload(message, (payload_t*)cp);
}
DESTROY_IF(vip);
return SUCCESS;
}
return NEED_MORE;
}
METHOD(task_t, process_i, status_t,
private_ike_config_t *this, message_t *message)
{
if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{ /* in last IKE_AUTH exchange */
process_payloads(this, message);
if (this->virtual_ip)
{
this->ike_sa->set_virtual_ip(this->ike_sa, TRUE, this->virtual_ip);
}
return SUCCESS;
}
return NEED_MORE;
}
METHOD(task_t, get_type, task_type_t,
private_ike_config_t *this)
{
return TASK_IKE_CONFIG;
}
METHOD(task_t, migrate, void,
private_ike_config_t *this, ike_sa_t *ike_sa)
{
DESTROY_IF(this->virtual_ip);
this->ike_sa = ike_sa;
this->virtual_ip = NULL;
this->requested->destroy_function(this->requested, free);
this->requested = linked_list_create();
}
METHOD(task_t, destroy, void,
private_ike_config_t *this)
{
DESTROY_IF(this->virtual_ip);
this->requested->destroy_function(this->requested, free);
free(this);
}
/*
* Described in header.
*/
ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_config_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
},
.initiator = initiator,
.ike_sa = ike_sa,
.requested = linked_list_create(),
);
if (initiator)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_config.h
+51
View File
@@ -0,0 +1,51 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_config ike_config
* @{ @ingroup tasks
*/
#ifndef IKE_CONFIG_H_
#define IKE_CONFIG_H_
typedef struct ike_config_t ike_config_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type TASK_IKE_CONFIG, sets up a virtual IP and other
* configurations for an IKE_SA.
*/
struct ike_config_t {
/**
* Implements the task_t interface
*/
task_t task;
};
/**
* Create a new ike_config task.
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE for initiator
* @return ike_config task to handle by the task_manager
*/
ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator);
#endif /** IKE_CONFIG_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_delete.c
+199
View File
@@ -0,0 +1,199 @@
/*
* Copyright (C) 2006-2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_delete.h"
#include <daemon.h>
#include <encoding/payloads/delete_payload.h>
typedef struct private_ike_delete_t private_ike_delete_t;
/**
* Private members of a ike_delete_t task.
*/
struct private_ike_delete_t {
/**
* Public methods and task_t interface.
*/
ike_delete_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* Are we the initiator?
*/
bool initiator;
/**
* are we deleting a rekeyed SA?
*/
bool rekeyed;
/**
* are we responding to a delete, but have initated our own?
*/
bool simultaneous;
};
METHOD(task_t, build_i, status_t,
private_ike_delete_t *this, message_t *message)
{
delete_payload_t *delete_payload;
DBG0(DBG_IKE, "deleting IKE_SA %s[%d] between %H[%Y]...%H[%Y]",
this->ike_sa->get_name(this->ike_sa),
this->ike_sa->get_unique_id(this->ike_sa),
this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa));
delete_payload = delete_payload_create(DELETE, PROTO_IKE);
message->add_payload(message, (payload_t*)delete_payload);
if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
{
this->rekeyed = TRUE;
}
this->ike_sa->set_state(this->ike_sa, IKE_DELETING);
DBG1(DBG_IKE, "sending DELETE for IKE_SA %s[%d]",
this->ike_sa->get_name(this->ike_sa),
this->ike_sa->get_unique_id(this->ike_sa));
return NEED_MORE;
}
METHOD(task_t, process_i, status_t,
private_ike_delete_t *this, message_t *message)
{
DBG0(DBG_IKE, "IKE_SA deleted");
if (!this->rekeyed)
{ /* invoke ike_down() hook if SA has not been rekeyed */
charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
}
/* completed, delete IKE_SA by returning DESTROY_ME */
return DESTROY_ME;
}
METHOD(task_t, process_r, status_t,
private_ike_delete_t *this, message_t *message)
{
/* we don't even scan the payloads, as the message wouldn't have
* come so far without being correct */
DBG1(DBG_IKE, "received DELETE for IKE_SA %s[%d]",
this->ike_sa->get_name(this->ike_sa),
this->ike_sa->get_unique_id(this->ike_sa));
DBG0(DBG_IKE, "deleting IKE_SA %s[%d] between %H[%Y]...%H[%Y]",
this->ike_sa->get_name(this->ike_sa),
this->ike_sa->get_unique_id(this->ike_sa),
this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa));
switch (this->ike_sa->get_state(this->ike_sa))
{
case IKE_ESTABLISHED:
this->ike_sa->set_state(this->ike_sa, IKE_DELETING);
this->ike_sa->reestablish(this->ike_sa);
return NEED_MORE;
case IKE_REKEYING:
this->rekeyed = TRUE;
break;
case IKE_DELETING:
this->simultaneous = TRUE;
break;
default:
break;
}
this->ike_sa->set_state(this->ike_sa, IKE_DELETING);
return NEED_MORE;
}
METHOD(task_t, build_r, status_t,
private_ike_delete_t *this, message_t *message)
{
DBG0(DBG_IKE, "IKE_SA deleted");
if (this->simultaneous)
{
/* wait for peer's response for our delete request, but set a timeout */
return SUCCESS;
}
if (!this->rekeyed)
{ /* invoke ike_down() hook if SA has not been rekeyed */
charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
}
/* completed, delete IKE_SA by returning DESTROY_ME */
return DESTROY_ME;
}
METHOD(task_t, get_type, task_type_t,
private_ike_delete_t *this)
{
return TASK_IKE_DELETE;
}
METHOD(task_t, migrate, void,
private_ike_delete_t *this, ike_sa_t *ike_sa)
{
this->ike_sa = ike_sa;
this->simultaneous = FALSE;
}
METHOD(task_t, destroy, void,
private_ike_delete_t *this)
{
free(this);
}
/*
* Described in header.
*/
ike_delete_t *ike_delete_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_delete_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
.initiator = initiator,
);
if (initiator)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_delete.h
+50
View File
@@ -0,0 +1,50 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_delete ike_delete
* @{ @ingroup tasks
*/
#ifndef IKE_DELETE_H_
#define IKE_DELETE_H_
typedef struct ike_delete_t ike_delete_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type ike_delete, delete an IKE_SA.
*/
struct ike_delete_t {
/**
* Implements the task_t interface
*/
task_t task;
};
/**
* Create a new ike_delete task.
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if we initiate the delete
* @return ike_delete task to handle by the task_manager
*/
ike_delete_t *ike_delete_create(ike_sa_t *ike_sa, bool initiator);
#endif /** IKE_DELETE_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_dpd.c
+94
View File
@@ -0,0 +1,94 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_dpd.h"
#include <daemon.h>
typedef struct private_ike_dpd_t private_ike_dpd_t;
/**
* Private members of a ike_dpd_t task.
*/
struct private_ike_dpd_t {
/**
* Public methods and task_t interface.
*/
ike_dpd_t public;
};
METHOD(task_t, return_need_more, status_t,
private_ike_dpd_t *this, message_t *message)
{
return NEED_MORE;
}
METHOD(task_t, return_success, status_t,
private_ike_dpd_t *this, message_t *message)
{
return SUCCESS;
}
METHOD(task_t, get_type, task_type_t,
private_ike_dpd_t *this)
{
return TASK_IKE_DPD;
}
METHOD(task_t, migrate, void,
private_ike_dpd_t *this, ike_sa_t *ike_sa)
{
}
METHOD(task_t, destroy, void,
private_ike_dpd_t *this)
{
free(this);
}
/*
* Described in header.
*/
ike_dpd_t *ike_dpd_create(bool initiator)
{
private_ike_dpd_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
},
);
if (initiator)
{
this->public.task.build = _return_need_more;
this->public.task.process = _return_success;
}
else
{
this->public.task.build = _return_success;
this->public.task.process = _return_need_more;
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_dpd.h
+51
View File
@@ -0,0 +1,51 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_dpd ike_dpd
* @{ @ingroup tasks
*/
#ifndef IKE_DPD_H_
#define IKE_DPD_H_
typedef struct ike_dpd_t ike_dpd_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type ike_dpd, detects dead peers.
*
* The DPD task actually does nothing, as a DPD has no associated payloads.
*/
struct ike_dpd_t {
/**
* Implements the task_t interface
*/
task_t task;
};
/**
* Create a new ike_dpd task.
*
* @param initiator TRUE if task is the original initiator
* @return ike_dpd task to handle by the task_manager
*/
ike_dpd_t *ike_dpd_create(bool initiator);
#endif /** IKE_DPD_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_init.c
+590
View File
@@ -0,0 +1,590 @@
/*
* Copyright (C) 2008-2009 Tobias Brunner
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_init.h"
#include <string.h>
#include <daemon.h>
#include <sa/ikev2/keymat_v2.h>
#include <crypto/diffie_hellman.h>
#include <encoding/payloads/sa_payload.h>
#include <encoding/payloads/ke_payload.h>
#include <encoding/payloads/nonce_payload.h>
/** maximum retries to do with cookies/other dh groups */
#define MAX_RETRIES 5
typedef struct private_ike_init_t private_ike_init_t;
/**
* Private members of a ike_init_t task.
*/
struct private_ike_init_t {
/**
* Public methods and task_t interface.
*/
ike_init_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* Are we the initiator?
*/
bool initiator;
/**
* IKE config to establish
*/
ike_cfg_t *config;
/**
* diffie hellman group to use
*/
diffie_hellman_group_t dh_group;
/**
* diffie hellman key exchange
*/
diffie_hellman_t *dh;
/**
* Keymat derivation (from IKE_SA)
*/
keymat_v2_t *keymat;
/**
* nonce chosen by us
*/
chunk_t my_nonce;
/**
* nonce chosen by peer
*/
chunk_t other_nonce;
/**
* Negotiated proposal used for IKE_SA
*/
proposal_t *proposal;
/**
* Old IKE_SA which gets rekeyed
*/
ike_sa_t *old_sa;
/**
* cookie received from responder
*/
chunk_t cookie;
/**
* retries done so far after failure (cookie or bad dh group)
*/
u_int retry;
};
/**
* build the payloads for the message
*/
static void build_payloads(private_ike_init_t *this, message_t *message)
{
sa_payload_t *sa_payload;
ke_payload_t *ke_payload;
nonce_payload_t *nonce_payload;
linked_list_t *proposal_list;
ike_sa_id_t *id;
proposal_t *proposal;
enumerator_t *enumerator;
id = this->ike_sa->get_id(this->ike_sa);
this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
if (this->initiator)
{
proposal_list = this->config->get_proposals(this->config);
if (this->old_sa)
{
/* include SPI of new IKE_SA when we are rekeying */
enumerator = proposal_list->create_enumerator(proposal_list);
while (enumerator->enumerate(enumerator, (void**)&proposal))
{
proposal->set_spi(proposal, id->get_initiator_spi(id));
}
enumerator->destroy(enumerator);
}
sa_payload = sa_payload_create_from_proposals_v2(proposal_list);
proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
}
else
{
if (this->old_sa)
{
/* include SPI of new IKE_SA when we are rekeying */
this->proposal->set_spi(this->proposal, id->get_responder_spi(id));
}
sa_payload = sa_payload_create_from_proposal_v2(this->proposal);
}
message->add_payload(message, (payload_t*)sa_payload);
nonce_payload = nonce_payload_create(NONCE);
nonce_payload->set_nonce(nonce_payload, this->my_nonce);
ke_payload = ke_payload_create_from_diffie_hellman(KEY_EXCHANGE, this->dh);
if (this->old_sa)
{ /* payload order differs if we are rekeying */
message->add_payload(message, (payload_t*)nonce_payload);
message->add_payload(message, (payload_t*)ke_payload);
}
else
{
message->add_payload(message, (payload_t*)ke_payload);
message->add_payload(message, (payload_t*)nonce_payload);
}
}
/**
* Read payloads from message
*/
static void process_payloads(private_ike_init_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
switch (payload->get_type(payload))
{
case SECURITY_ASSOCIATION:
{
sa_payload_t *sa_payload = (sa_payload_t*)payload;
linked_list_t *proposal_list;
bool private;
proposal_list = sa_payload->get_proposals(sa_payload);
private = this->ike_sa->supports_extension(this->ike_sa,
EXT_STRONGSWAN);
this->proposal = this->config->select_proposal(this->config,
proposal_list, private);
proposal_list->destroy_offset(proposal_list,
offsetof(proposal_t, destroy));
break;
}
case KEY_EXCHANGE:
{
ke_payload_t *ke_payload = (ke_payload_t*)payload;
this->dh_group = ke_payload->get_dh_group_number(ke_payload);
if (!this->initiator)
{
this->dh = this->keymat->keymat.create_dh(
&this->keymat->keymat, this->dh_group);
}
if (this->dh)
{
this->dh->set_other_public_value(this->dh,
ke_payload->get_key_exchange_data(ke_payload));
}
break;
}
case NONCE:
{
nonce_payload_t *nonce_payload = (nonce_payload_t*)payload;
this->other_nonce = nonce_payload->get_nonce(nonce_payload);
break;
}
default:
break;
}
}
enumerator->destroy(enumerator);
}
METHOD(task_t, build_i, status_t,
private_ike_init_t *this, message_t *message)
{
rng_t *rng;
this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
DBG0(DBG_IKE, "initiating IKE_SA %s[%d] to %H",
this->ike_sa->get_name(this->ike_sa),
this->ike_sa->get_unique_id(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa));
this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
if (this->retry >= MAX_RETRIES)
{
DBG1(DBG_IKE, "giving up after %d retries", MAX_RETRIES);
return FAILED;
}
/* if the DH group is set via use_dh_group(), we already have a DH object */
if (!this->dh)
{
this->dh_group = this->config->get_dh_group(this->config);
this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
this->dh_group);
if (!this->dh)
{
DBG1(DBG_IKE, "configured DH group %N not supported",
diffie_hellman_group_names, this->dh_group);
return FAILED;
}
}
/* generate nonce only when we are trying the first time */
if (this->my_nonce.ptr == NULL)
{
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
{
DBG1(DBG_IKE, "error generating nonce");
return FAILED;
}
rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
rng->destroy(rng);
}
if (this->cookie.ptr)
{
message->add_notify(message, FALSE, COOKIE, this->cookie);
}
build_payloads(this, message);
#ifdef ME
{
chunk_t connect_id = this->ike_sa->get_connect_id(this->ike_sa);
if (connect_id.ptr)
{
message->add_notify(message, FALSE, ME_CONNECTID, connect_id);
}
}
#endif /* ME */
return NEED_MORE;
}
METHOD(task_t, process_r, status_t,
private_ike_init_t *this, message_t *message)
{
rng_t *rng;
this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
DBG0(DBG_IKE, "%H is initiating an IKE_SA", message->get_source(message));
this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
{
DBG1(DBG_IKE, "error generating nonce");
return FAILED;
}
rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
rng->destroy(rng);
#ifdef ME
{
notify_payload_t *notify = message->get_notify(message, ME_CONNECTID);
if (notify)
{
chunk_t connect_id = notify->get_notification_data(notify);
DBG2(DBG_IKE, "received ME_CONNECTID %#B", &connect_id);
charon->connect_manager->stop_checks(charon->connect_manager,
connect_id);
}
}
#endif /* ME */
process_payloads(this, message);
return NEED_MORE;
}
/**
* Derive the keymat for the IKE_SA
*/
static bool derive_keys(private_ike_init_t *this,
chunk_t nonce_i, chunk_t nonce_r)
{
keymat_v2_t *old_keymat;
pseudo_random_function_t prf_alg = PRF_UNDEFINED;
chunk_t skd = chunk_empty;
ike_sa_id_t *id;
id = this->ike_sa->get_id(this->ike_sa);
if (this->old_sa)
{
/* rekeying: Include old SKd, use old PRF, apply SPI */
old_keymat = (keymat_v2_t*)this->old_sa->get_keymat(this->old_sa);
prf_alg = old_keymat->get_skd(old_keymat, &skd);
if (this->initiator)
{
id->set_responder_spi(id, this->proposal->get_spi(this->proposal));
}
else
{
id->set_initiator_spi(id, this->proposal->get_spi(this->proposal));
}
}
if (!this->keymat->derive_ike_keys(this->keymat, this->proposal, this->dh,
nonce_i, nonce_r, id, prf_alg, skd))
{
return FALSE;
}
charon->bus->ike_keys(charon->bus, this->ike_sa, this->dh, chunk_empty,
nonce_i, nonce_r, this->old_sa, NULL);
return TRUE;
}
METHOD(task_t, build_r, status_t,
private_ike_init_t *this, message_t *message)
{
/* check if we have everything we need */
if (this->proposal == NULL ||
this->other_nonce.len == 0 || this->my_nonce.len == 0)
{
DBG1(DBG_IKE, "received proposals inacceptable");
message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
return FAILED;
}
this->ike_sa->set_proposal(this->ike_sa, this->proposal);
if (this->dh == NULL ||
!this->proposal->has_dh_group(this->proposal, this->dh_group))
{
u_int16_t group;
if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
&group, NULL))
{
DBG1(DBG_IKE, "DH group %N inacceptable, requesting %N",
diffie_hellman_group_names, this->dh_group,
diffie_hellman_group_names, group);
this->dh_group = group;
group = htons(group);
message->add_notify(message, FALSE, INVALID_KE_PAYLOAD,
chunk_from_thing(group));
}
else
{
DBG1(DBG_IKE, "no acceptable proposal found");
}
return FAILED;
}
if (!derive_keys(this, this->other_nonce, this->my_nonce))
{
DBG1(DBG_IKE, "key derivation failed");
message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
return FAILED;
}
build_payloads(this, message);
return SUCCESS;
}
METHOD(task_t, process_i, status_t,
private_ike_init_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
/* check for erronous notifies */
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == NOTIFY)
{
notify_payload_t *notify = (notify_payload_t*)payload;
notify_type_t type = notify->get_notify_type(notify);
switch (type)
{
case INVALID_KE_PAYLOAD:
{
chunk_t data;
diffie_hellman_group_t bad_group;
bad_group = this->dh_group;
data = notify->get_notification_data(notify);
this->dh_group = ntohs(*((u_int16_t*)data.ptr));
DBG1(DBG_IKE, "peer didn't accept DH group %N, "
"it requested %N", diffie_hellman_group_names,
bad_group, diffie_hellman_group_names, this->dh_group);
if (this->old_sa == NULL)
{ /* reset the IKE_SA if we are not rekeying */
this->ike_sa->reset(this->ike_sa);
}
enumerator->destroy(enumerator);
this->retry++;
return NEED_MORE;
}
case NAT_DETECTION_SOURCE_IP:
case NAT_DETECTION_DESTINATION_IP:
/* skip, handled in ike_natd_t */
break;
case MULTIPLE_AUTH_SUPPORTED:
/* handled in ike_auth_t */
break;
case COOKIE:
{
chunk_free(&this->cookie);
this->cookie = chunk_clone(notify->get_notification_data(notify));
this->ike_sa->reset(this->ike_sa);
enumerator->destroy(enumerator);
DBG2(DBG_IKE, "received %N notify", notify_type_names, type);
this->retry++;
return NEED_MORE;
}
default:
{
if (type <= 16383)
{
DBG1(DBG_IKE, "received %N notify error",
notify_type_names, type);
enumerator->destroy(enumerator);
return FAILED;
}
DBG2(DBG_IKE, "received %N notify",
notify_type_names, type);
break;
}
}
}
}
enumerator->destroy(enumerator);
process_payloads(this, message);
/* check if we have everything */
if (this->proposal == NULL ||
this->other_nonce.len == 0 || this->my_nonce.len == 0)
{
DBG1(DBG_IKE, "peers proposal selection invalid");
return FAILED;
}
this->ike_sa->set_proposal(this->ike_sa, this->proposal);
if (this->dh == NULL ||
!this->proposal->has_dh_group(this->proposal, this->dh_group))
{
DBG1(DBG_IKE, "peer DH group selection invalid");
return FAILED;
}
if (!derive_keys(this, this->my_nonce, this->other_nonce))
{
DBG1(DBG_IKE, "key derivation failed");
return FAILED;
}
return SUCCESS;
}
METHOD(task_t, get_type, task_type_t,
private_ike_init_t *this)
{
return TASK_IKE_INIT;
}
METHOD(task_t, migrate, void,
private_ike_init_t *this, ike_sa_t *ike_sa)
{
DESTROY_IF(this->proposal);
chunk_free(&this->other_nonce);
this->ike_sa = ike_sa;
this->keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa);
this->proposal = NULL;
if (this->dh && this->dh->get_dh_group(this->dh) != this->dh_group)
{ /* reset DH value only if group changed (INVALID_KE_PAYLOAD) */
this->dh->destroy(this->dh);
this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
this->dh_group);
}
}
METHOD(task_t, destroy, void,
private_ike_init_t *this)
{
DESTROY_IF(this->dh);
DESTROY_IF(this->proposal);
chunk_free(&this->my_nonce);
chunk_free(&this->other_nonce);
chunk_free(&this->cookie);
free(this);
}
METHOD(ike_init_t, get_lower_nonce, chunk_t,
private_ike_init_t *this)
{
if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
min(this->my_nonce.len, this->other_nonce.len)) < 0)
{
return this->my_nonce;
}
else
{
return this->other_nonce;
}
}
/*
* Described in header.
*/
ike_init_t *ike_init_create(ike_sa_t *ike_sa, bool initiator, ike_sa_t *old_sa)
{
private_ike_init_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
.get_lower_nonce = _get_lower_nonce,
},
.ike_sa = ike_sa,
.initiator = initiator,
.dh_group = MODP_NONE,
.keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa),
.old_sa = old_sa,
);
if (initiator)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_init.h
+60
View File
@@ -0,0 +1,60 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_init ike_init
* @{ @ingroup tasks
*/
#ifndef IKE_INIT_H_
#define IKE_INIT_H_
typedef struct ike_init_t ike_init_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type TASK_IKE_INIT, creates an IKE_SA without authentication.
*
* The authentication of is handle in the ike_auth task.
*/
struct ike_init_t {
/**
* Implements the task_t interface
*/
task_t task;
/**
* Get the lower of the two nonces, used for rekey collisions.
*
* @return lower nonce
*/
chunk_t (*get_lower_nonce) (ike_init_t *this);
};
/**
* Create a new TASK_IKE_INIT task.
*
* @param ike_sa IKE_SA this task works for (new one when rekeying)
* @param initiator TRUE if task is the original initiator
* @param old_sa old IKE_SA when we are rekeying
* @return ike_init task to handle by the task_manager
*/
ike_init_t *ike_init_create(ike_sa_t *ike_sa, bool initiator, ike_sa_t *old_sa);
#endif /** IKE_INIT_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_me.c
+833
View File
@@ -0,0 +1,833 @@
/*
* Copyright (C) 2007-2008 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_me.h"
#include <string.h>
#include <hydra.h>
#include <daemon.h>
#include <config/peer_cfg.h>
#include <encoding/payloads/id_payload.h>
#include <encoding/payloads/notify_payload.h>
#include <encoding/payloads/endpoint_notify.h>
#include <processing/jobs/mediation_job.h>
#define ME_CONNECTID_LEN 4
#define ME_CONNECTKEY_LEN 16
typedef struct private_ike_me_t private_ike_me_t;
/**
* Private members of a ike_me_t task.
*/
struct private_ike_me_t {
/**
* Public methods and task_t interface.
*/
ike_me_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* Are we the initiator?
*/
bool initiator;
/**
* Is this a mediation connection?
*/
bool mediation;
/**
* Is this the response from another peer?
*/
bool response;
/**
* Gathered endpoints
*/
linked_list_t *local_endpoints;
/**
* Parsed endpoints
*/
linked_list_t *remote_endpoints;
/**
* Did the peer request a callback?
*/
bool callback;
/**
* Did the connect fail?
*/
bool failed;
/**
* Was there anything wrong with the payloads?
*/
bool invalid_syntax;
/**
* The requested peer
*/
identification_t *peer_id;
/**
* Received ID used for connectivity checks
*/
chunk_t connect_id;
/**
* Received key used for connectivity checks
*/
chunk_t connect_key;
/**
* Peer config of the mediated connection
*/
peer_cfg_t *mediated_cfg;
};
/**
* Adds a list of endpoints as notifies to a given message
*/
static void add_endpoints_to_message(message_t *message, linked_list_t *endpoints)
{
enumerator_t *enumerator;
endpoint_notify_t *endpoint;
enumerator = endpoints->create_enumerator(endpoints);
while (enumerator->enumerate(enumerator, (void**)&endpoint))
{
message->add_payload(message, (payload_t*)endpoint->build_notify(endpoint));
}
enumerator->destroy(enumerator);
}
/**
* Gathers endpoints and adds them to the current message
*/
static void gather_and_add_endpoints(private_ike_me_t *this, message_t *message)
{
enumerator_t *enumerator;
host_t *addr, *host;
u_int16_t port;
/* get the port that is used to communicate with the ms */
host = this->ike_sa->get_my_host(this->ike_sa);
port = host->get_port(host);
enumerator = hydra->kernel_interface->create_address_enumerator(
hydra->kernel_interface, FALSE, FALSE);
while (enumerator->enumerate(enumerator, (void**)&addr))
{
host = addr->clone(addr);
host->set_port(host, port);
this->local_endpoints->insert_last(this->local_endpoints,
endpoint_notify_create_from_host(HOST, host, NULL));
host->destroy(host);
}
enumerator->destroy(enumerator);
host = this->ike_sa->get_server_reflexive_host(this->ike_sa);
if (host)
{
this->local_endpoints->insert_last(this->local_endpoints,
endpoint_notify_create_from_host(SERVER_REFLEXIVE, host,
this->ike_sa->get_my_host(this->ike_sa)));
}
add_endpoints_to_message(message, this->local_endpoints);
}
/**
* read notifys from message and evaluate them
*/
static void process_payloads(private_ike_me_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) != NOTIFY)
{
continue;
}
notify_payload_t *notify = (notify_payload_t*)payload;
switch (notify->get_notify_type(notify))
{
case ME_CONNECT_FAILED:
{
DBG2(DBG_IKE, "received ME_CONNECT_FAILED notify");
this->failed = TRUE;
break;
}
case ME_MEDIATION:
{
DBG2(DBG_IKE, "received ME_MEDIATION notify");
this->mediation = TRUE;
break;
}
case ME_ENDPOINT:
{
endpoint_notify_t *endpoint;
endpoint = endpoint_notify_create_from_payload(notify);
if (!endpoint)
{
DBG1(DBG_IKE, "received invalid ME_ENDPOINT notify");
break;
}
DBG1(DBG_IKE, "received %N ME_ENDPOINT %#H",
me_endpoint_type_names, endpoint->get_type(endpoint),
endpoint->get_host(endpoint));
this->remote_endpoints->insert_last(this->remote_endpoints,
endpoint);
break;
}
case ME_CALLBACK:
{
DBG2(DBG_IKE, "received ME_CALLBACK notify");
this->callback = TRUE;
break;
}
case ME_CONNECTID:
{
chunk_free(&this->connect_id);
this->connect_id = chunk_clone(notify->get_notification_data(notify));
DBG2(DBG_IKE, "received ME_CONNECTID %#B", &this->connect_id);
break;
}
case ME_CONNECTKEY:
{
chunk_free(&this->connect_key);
this->connect_key = chunk_clone(notify->get_notification_data(notify));
DBG4(DBG_IKE, "received ME_CONNECTKEY %#B", &this->connect_key);
break;
}
case ME_RESPONSE:
{
DBG2(DBG_IKE, "received ME_RESPONSE notify");
this->response = TRUE;
break;
}
default:
break;
}
}
enumerator->destroy(enumerator);
}
METHOD(task_t, build_i, status_t,
private_ike_me_t *this, message_t *message)
{
switch(message->get_exchange_type(message))
{
case IKE_SA_INIT:
{
peer_cfg_t *peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (peer_cfg->is_mediation(peer_cfg))
{
DBG2(DBG_IKE, "adding ME_MEDIATION");
message->add_notify(message, FALSE, ME_MEDIATION, chunk_empty);
}
else
{
return SUCCESS;
}
break;
}
case IKE_AUTH:
{
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_HERE))
{
endpoint_notify_t *endpoint;
endpoint = endpoint_notify_create_from_host(SERVER_REFLEXIVE,
NULL, NULL);
message->add_payload(message, (payload_t*)endpoint->build_notify(endpoint));
endpoint->destroy(endpoint);
}
break;
}
case ME_CONNECT:
{
rng_t *rng;
id_payload_t *id_payload;
id_payload = id_payload_create_from_identification(ID_PEER,
this->peer_id);
message->add_payload(message, (payload_t*)id_payload);
rng = lib->crypto->create_rng(lib->crypto, RNG_STRONG);
if (!rng)
{
DBG1(DBG_IKE, "unable to generate connect ID for ME_CONNECT");
return FAILED;
}
if (!this->response)
{
/* only the initiator creates a connect ID. the responder
* returns the connect ID that it received from the initiator */
rng->allocate_bytes(rng, ME_CONNECTID_LEN, &this->connect_id);
}
rng->allocate_bytes(rng, ME_CONNECTKEY_LEN, &this->connect_key);
rng->destroy(rng);
message->add_notify(message, FALSE, ME_CONNECTID, this->connect_id);
message->add_notify(message, FALSE, ME_CONNECTKEY, this->connect_key);
if (this->response)
{
message->add_notify(message, FALSE, ME_RESPONSE, chunk_empty);
}
else
{
/* FIXME: should we make this configurable? */
message->add_notify(message, FALSE, ME_CALLBACK, chunk_empty);
}
gather_and_add_endpoints(this, message);
break;
}
default:
break;
}
return NEED_MORE;
}
METHOD(task_t, process_r, status_t,
private_ike_me_t *this, message_t *message)
{
switch(message->get_exchange_type(message))
{
case ME_CONNECT:
{
id_payload_t *id_payload;
id_payload = (id_payload_t*)message->get_payload(message, ID_PEER);
if (!id_payload)
{
DBG1(DBG_IKE, "received ME_CONNECT without ID_PEER payload"
", aborting");
break;
}
this->peer_id = id_payload->get_identification(id_payload);
process_payloads(this, message);
if (this->callback)
{
DBG1(DBG_IKE, "received ME_CALLBACK for '%Y'", this->peer_id);
break;
}
if (!this->connect_id.ptr)
{
DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTID notify"
", aborting");
this->invalid_syntax = TRUE;
break;
}
if (!this->connect_key.ptr)
{
DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTKEY "
"notify, aborting");
this->invalid_syntax = TRUE;
break;
}
if (!this->remote_endpoints->get_count(this->remote_endpoints))
{
DBG1(DBG_IKE, "received ME_CONNECT without any ME_ENDPOINT "
"payloads, aborting");
this->invalid_syntax = TRUE;
break;
}
DBG1(DBG_IKE, "received ME_CONNECT");
break;
}
default:
break;
}
return NEED_MORE;
}
METHOD(task_t, build_r, status_t,
private_ike_me_t *this, message_t *message)
{
switch(message->get_exchange_type(message))
{
case ME_CONNECT:
{
if (this->invalid_syntax)
{
message->add_notify(message, TRUE, INVALID_SYNTAX, chunk_empty);
break;
}
if (this->callback)
{
/* we got a callback from the mediation server, initiate the
* queued mediated connecction */
charon->connect_manager->check_and_initiate(
charon->connect_manager,
this->ike_sa->get_id(this->ike_sa),
this->ike_sa->get_my_id(this->ike_sa), this->peer_id);
return SUCCESS;
}
if (this->response)
{
/* FIXME: handle result of set_responder_data
* as initiator, upon receiving a response from another peer,
* update the checklist and start sending checks */
charon->connect_manager->set_responder_data(
charon->connect_manager,
this->connect_id, this->connect_key,
this->remote_endpoints);
}
else
{
/* FIXME: handle result of set_initiator_data
* as responder, create a checklist with the initiator's data */
charon->connect_manager->set_initiator_data(
charon->connect_manager,
this->peer_id, this->ike_sa->get_my_id(this->ike_sa),
this->connect_id, this->connect_key,
this->remote_endpoints, FALSE);
if (this->ike_sa->respond(this->ike_sa, this->peer_id,
this->connect_id) != SUCCESS)
{
return FAILED;
}
}
break;
}
default:
break;
}
return SUCCESS;
}
METHOD(task_t, process_i, status_t,
private_ike_me_t *this, message_t *message)
{
switch(message->get_exchange_type(message))
{
case IKE_SA_INIT:
{
process_payloads(this, message);
if (!this->mediation)
{
DBG1(DBG_IKE, "server did not return a ME_MEDIATION, aborting");
return FAILED;
}
/* if we are on a mediation connection we switch to port 4500 even
* if no NAT is detected. */
this->ike_sa->float_ports(this->ike_sa);
return NEED_MORE;
}
case IKE_AUTH:
{
process_payloads(this, message);
/* FIXME: we should update the server reflexive endpoint somehow,
* if mobike notices a change */
endpoint_notify_t *reflexive;
if (this->remote_endpoints->get_first(this->remote_endpoints,
(void**)&reflexive) == SUCCESS &&
reflexive->get_type(reflexive) == SERVER_REFLEXIVE)
{ /* FIXME: should we accept this endpoint even if we did not send
* a request? */
host_t *endpoint = reflexive->get_host(reflexive);
endpoint = endpoint->clone(endpoint);
this->ike_sa->set_server_reflexive_host(this->ike_sa, endpoint);
}
break;
}
case ME_CONNECT:
{
process_payloads(this, message);
if (this->failed)
{
DBG1(DBG_IKE, "peer '%Y' is not online", this->peer_id);
/* FIXME: notify the mediated connection (job?) */
}
else
{
if (this->response)
{
/* FIXME: handle result of set_responder_data. */
/* as responder, we update the checklist and start sending
* checks */
charon->connect_manager->set_responder_data(
charon->connect_manager, this->connect_id,
this->connect_key, this->local_endpoints);
}
else
{
/* FIXME: handle result of set_initiator_data */
/* as initiator, we create a checklist and set the
* initiator's data */
charon->connect_manager->set_initiator_data(
charon->connect_manager,
this->ike_sa->get_my_id(this->ike_sa),
this->peer_id, this->connect_id, this->connect_key,
this->local_endpoints, TRUE);
/* FIXME: also start a timer for the whole transaction
* (maybe within the connect_manager?) */
}
}
break;
}
default:
break;
}
return SUCCESS;
}
/**
* For mediation server
*/
METHOD(task_t, build_i_ms, status_t,
private_ike_me_t *this, message_t *message)
{
switch(message->get_exchange_type(message))
{
case ME_CONNECT:
{
id_payload_t *id_payload;
id_payload = id_payload_create_from_identification(ID_PEER,
this->peer_id);
message->add_payload(message, (payload_t*)id_payload);
if (this->callback)
{
message->add_notify(message, FALSE, ME_CALLBACK, chunk_empty);
}
else
{
if (this->response)
{
message->add_notify(message, FALSE, ME_RESPONSE,
chunk_empty);
}
message->add_notify(message, FALSE, ME_CONNECTID,
this->connect_id);
message->add_notify(message, FALSE, ME_CONNECTKEY,
this->connect_key);
add_endpoints_to_message(message, this->remote_endpoints);
}
break;
}
default:
break;
}
return NEED_MORE;
}
/**
* For mediation server
*/
METHOD(task_t, process_r_ms, status_t,
private_ike_me_t *this, message_t *message)
{
switch(message->get_exchange_type(message))
{
case IKE_SA_INIT:
{
/* FIXME: we should check for SA* and TS* payloads. if there are
* any, send NO_ADDITIONAL_SAS back and delete this SA */
process_payloads(this, message);
return this->mediation ? NEED_MORE : SUCCESS;
}
case IKE_AUTH:
{
/* FIXME: we should check whether the current peer_config is
* configured as mediation connection */
process_payloads(this, message);
break;
}
case CREATE_CHILD_SA:
{
/* FIXME: if this is not to rekey the IKE SA we have to return a
* NO_ADDITIONAL_SAS and then delete the SA */
break;
}
case ME_CONNECT:
{
id_payload_t *id_payload;
id_payload = (id_payload_t*)message->get_payload(message, ID_PEER);
if (!id_payload)
{
DBG1(DBG_IKE, "received ME_CONNECT without ID_PEER payload"
", aborting");
this->invalid_syntax = TRUE;
break;
}
this->peer_id = id_payload->get_identification(id_payload);
process_payloads(this, message);
if (!this->connect_id.ptr)
{
DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTID notify"
", aborting");
this->invalid_syntax = TRUE;
break;
}
if (!this->connect_key.ptr)
{
DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTKEY notify"
", aborting");
this->invalid_syntax = TRUE;
break;
}
if (!this->remote_endpoints->get_count(this->remote_endpoints))
{
DBG1(DBG_IKE, "received ME_CONNECT without any ME_ENDPOINT "
"payloads, aborting");
this->invalid_syntax = TRUE;
break;
}
break;
}
default:
break;
}
return NEED_MORE;
}
/**
* For mediation server
*/
METHOD(task_t, build_r_ms, status_t,
private_ike_me_t *this, message_t *message)
{
switch(message->get_exchange_type(message))
{
case IKE_SA_INIT:
{
message->add_notify(message, FALSE, ME_MEDIATION, chunk_empty);
return NEED_MORE;
}
case IKE_AUTH:
{
endpoint_notify_t *endpoint;
if (this->remote_endpoints->get_first(this->remote_endpoints,
(void**)&endpoint) == SUCCESS &&
endpoint->get_type(endpoint) == SERVER_REFLEXIVE)
{
host_t *host = this->ike_sa->get_other_host(this->ike_sa);
DBG2(DBG_IKE, "received request for a server reflexive "
"endpoint sending: %#H", host);
endpoint = endpoint_notify_create_from_host(SERVER_REFLEXIVE,
host, NULL);
message->add_payload(message, (payload_t*)endpoint->build_notify(endpoint));
endpoint->destroy(endpoint);
}
this->ike_sa->act_as_mediation_server(this->ike_sa);
break;
}
case ME_CONNECT:
{
if (this->invalid_syntax)
{
message->add_notify(message, TRUE, INVALID_SYNTAX, chunk_empty);
break;
}
ike_sa_id_t *peer_sa;
if (this->callback)
{
peer_sa = charon->mediation_manager->check_and_register(
charon->mediation_manager, this->peer_id,
this->ike_sa->get_other_id(this->ike_sa));
}
else
{
peer_sa = charon->mediation_manager->check(
charon->mediation_manager, this->peer_id);
}
if (!peer_sa)
{
/* the peer is not online */
message->add_notify(message, TRUE, ME_CONNECT_FAILED,
chunk_empty);
break;
}
job_t *job = (job_t*)mediation_job_create(this->peer_id,
this->ike_sa->get_other_id(this->ike_sa), this->connect_id,
this->connect_key, this->remote_endpoints, this->response);
lib->processor->queue_job(lib->processor, job);
break;
}
default:
break;
}
return SUCCESS;
}
/**
* For mediation server
*/
METHOD(task_t, process_i_ms, status_t,
private_ike_me_t *this, message_t *message)
{
/* FIXME: theoretically we should be prepared to receive a ME_CONNECT_FAILED
* here if the responding peer is not able to proceed. in this case we shall
* notify the initiating peer with a ME_CONNECT request containing only a
* ME_CONNECT_FAILED */
return SUCCESS;
}
METHOD(ike_me_t, me_connect, void,
private_ike_me_t *this, identification_t *peer_id)
{
this->peer_id = peer_id->clone(peer_id);
}
METHOD(ike_me_t, me_respond, void,
private_ike_me_t *this, identification_t *peer_id, chunk_t connect_id)
{
this->peer_id = peer_id->clone(peer_id);
this->connect_id = chunk_clone(connect_id);
this->response = TRUE;
}
METHOD(ike_me_t, me_callback, void,
private_ike_me_t *this, identification_t *peer_id)
{
this->peer_id = peer_id->clone(peer_id);
this->callback = TRUE;
}
METHOD(ike_me_t, relay, void,
private_ike_me_t *this, identification_t *requester, chunk_t connect_id,
chunk_t connect_key, linked_list_t *endpoints, bool response)
{
this->peer_id = requester->clone(requester);
this->connect_id = chunk_clone(connect_id);
this->connect_key = chunk_clone(connect_key);
this->remote_endpoints->destroy_offset(this->remote_endpoints,
offsetof(endpoint_notify_t, destroy));
this->remote_endpoints = endpoints->clone_offset(endpoints,
offsetof(endpoint_notify_t, clone));
this->response = response;
}
METHOD(task_t, get_type, task_type_t,
private_ike_me_t *this)
{
return TASK_IKE_ME;
}
METHOD(task_t, migrate, void,
private_ike_me_t *this, ike_sa_t *ike_sa)
{
this->ike_sa = ike_sa;
}
METHOD(task_t, destroy, void,
private_ike_me_t *this)
{
DESTROY_IF(this->peer_id);
chunk_free(&this->connect_id);
chunk_free(&this->connect_key);
this->local_endpoints->destroy_offset(this->local_endpoints,
offsetof(endpoint_notify_t, destroy));
this->remote_endpoints->destroy_offset(this->remote_endpoints,
offsetof(endpoint_notify_t, destroy));
DESTROY_IF(this->mediated_cfg);
free(this);
}
/*
* Described in header.
*/
ike_me_t *ike_me_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_me_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
.connect = _me_connect,
.respond = _me_respond,
.callback = _me_callback,
.relay = _relay,
},
.ike_sa = ike_sa,
.initiator = initiator,
.local_endpoints = linked_list_create(),
.remote_endpoints = linked_list_create(),
);
if (ike_sa->has_condition(ike_sa, COND_ORIGINAL_INITIATOR))
{
if (initiator)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
}
}
else
{
/* mediation server */
if (initiator)
{
this->public.task.build = _build_i_ms;
this->public.task.process = _process_i_ms;
}
else
{
this->public.task.build = _build_r_ms;
this->public.task.process = _process_r_ms;
}
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_me.h
+100
View File
@@ -0,0 +1,100 @@
/*
* Copyright (C) 2007 Tobias Brunner
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_me ike_me
* @{ @ingroup tasks
*/
#ifndef IKE_ME_H_
#define IKE_ME_H_
typedef struct ike_me_t ike_me_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type TASK_IKE_ME, detects and handles IKE-ME extensions.
*
* This tasks handles the ME_MEDIATION Notify exchange to setup a mediation
* connection, allows to initiate mediated connections using ME_CONNECT
* exchanges and to request reflexive addresses from the mediation server using
* ME_ENDPOINT notifies.
*
* @note This task has to be activated before the IKE_AUTH task, because that
* task generates the IKE_SA_INIT message so that no more payloads can be added
* to it afterwards.
*/
struct ike_me_t {
/**
* Implements the task_t interface
*/
task_t task;
/**
* Initiates a connection with another peer (i.e. sends a ME_CONNECT
* to the mediation server)
*
* @param peer_id ID of the other peer (gets cloned)
*/
void (*connect)(ike_me_t *this, identification_t *peer_id);
/**
* Responds to a ME_CONNECT from another peer (i.e. sends a ME_CONNECT
* to the mediation server)
*
* Data gets cloned.
*
* @param peer_id ID of the other peer
* @param connect_id the connect ID as provided by the initiator
*/
void (*respond)(ike_me_t *this, identification_t *peer_id,
chunk_t connect_id);
/**
* Sends a ME_CALLBACK to a peer that previously requested some other peer.
*
* @param peer_id ID of the other peer (gets cloned)
*/
void (*callback)(ike_me_t *this, identification_t *peer_id);
/**
* Relays data to another peer (i.e. sends a ME_CONNECT to the peer)
*
* Data gets cloned.
*
* @param requester ID of the requesting peer
* @param connect_id content of the ME_CONNECTID notify
* @param connect_key content of the ME_CONNECTKEY notify
* @param endpoints endpoints
* @param response TRUE if this is a response
*/
void (*relay)(ike_me_t *this, identification_t *requester,
chunk_t connect_id, chunk_t connect_key,
linked_list_t *endpoints, bool response);
};
/**
* Create a new ike_me task.
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if task is initiated by us
* @return ike_me task to be handled by the task_manager
*/
ike_me_t *ike_me_create(ike_sa_t *ike_sa, bool initiator);
#endif /** IKE_ME_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_mobike.c
+648
View File
@@ -0,0 +1,648 @@
/*
* Copyright (C) 2010-2012 Tobias Brunner
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_mobike.h"
#include <string.h>
#include <hydra.h>
#include <daemon.h>
#include <sa/ikev2/tasks/ike_natd.h>
#include <encoding/payloads/notify_payload.h>
#define COOKIE2_SIZE 16
#define MAX_ADDITIONAL_ADDRS 8
typedef struct private_ike_mobike_t private_ike_mobike_t;
/**
* Private members of a ike_mobike_t task.
*/
struct private_ike_mobike_t {
/**
* Public methods and task_t interface.
*/
ike_mobike_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* Are we the initiator?
*/
bool initiator;
/**
* cookie2 value to verify new addresses
*/
chunk_t cookie2;
/**
* NAT discovery reusing the TASK_IKE_NATD task
*/
ike_natd_t *natd;
/**
* use task to update addresses
*/
bool update;
/**
* do routability check
*/
bool check;
/**
* include address list update
*/
bool address;
/**
* additional addresses got updated
*/
bool addresses_updated;
};
/**
* read notifys from message and evaluate them
*/
static void process_payloads(private_ike_mobike_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
bool first = TRUE;
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
int family = AF_INET;
notify_payload_t *notify;
chunk_t data;
host_t *host;
if (payload->get_type(payload) != NOTIFY)
{
continue;
}
notify = (notify_payload_t*)payload;
switch (notify->get_notify_type(notify))
{
case MOBIKE_SUPPORTED:
{
peer_cfg_t *peer_cfg;
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (!this->initiator &&
peer_cfg && !peer_cfg->use_mobike(peer_cfg))
{
DBG1(DBG_IKE, "peer supports MOBIKE, but disabled in config");
}
else
{
DBG1(DBG_IKE, "peer supports MOBIKE");
this->ike_sa->enable_extension(this->ike_sa, EXT_MOBIKE);
}
break;
}
case COOKIE2:
{
chunk_free(&this->cookie2);
this->cookie2 = chunk_clone(notify->get_notification_data(notify));
break;
}
case ADDITIONAL_IP6_ADDRESS:
{
family = AF_INET6;
/* fall through */
}
case ADDITIONAL_IP4_ADDRESS:
{
if (first)
{ /* an ADDITIONAL_*_ADDRESS means replace, so flush once */
this->ike_sa->clear_peer_addresses(this->ike_sa);
first = FALSE;
/* add the peer's current address to the list */
host = this->ike_sa->get_other_host(this->ike_sa);
this->ike_sa->add_peer_address(this->ike_sa,
host->clone(host));
}
data = notify->get_notification_data(notify);
host = host_create_from_chunk(family, data, 0);
DBG2(DBG_IKE, "got additional MOBIKE peer address: %H", host);
this->ike_sa->add_peer_address(this->ike_sa, host);
this->addresses_updated = TRUE;
break;
}
case UPDATE_SA_ADDRESSES:
{
this->update = TRUE;
break;
}
case NO_ADDITIONAL_ADDRESSES:
{
this->ike_sa->clear_peer_addresses(this->ike_sa);
/* add the peer's current address to the list */
host = this->ike_sa->get_other_host(this->ike_sa);
this->ike_sa->add_peer_address(this->ike_sa, host->clone(host));
this->addresses_updated = TRUE;
break;
}
case NAT_DETECTION_SOURCE_IP:
case NAT_DETECTION_DESTINATION_IP:
{
/* NAT check in this MOBIKE exchange, create subtask for it */
if (this->natd == NULL)
{
this->natd = ike_natd_create(this->ike_sa, this->initiator);
}
break;
}
default:
break;
}
}
enumerator->destroy(enumerator);
}
/**
* Add ADDITIONAL_*_ADDRESS notifys depending on our address list
*/
static void build_address_list(private_ike_mobike_t *this, message_t *message)
{
enumerator_t *enumerator;
host_t *host, *me;
notify_type_t type;
int added = 0;
me = this->ike_sa->get_my_host(this->ike_sa);
enumerator = hydra->kernel_interface->create_address_enumerator(
hydra->kernel_interface, FALSE, FALSE);
while (enumerator->enumerate(enumerator, (void**)&host))
{
if (me->ip_equals(me, host))
{ /* "ADDITIONAL" means do not include IKE_SAs host */
continue;
}
switch (host->get_family(host))
{
case AF_INET:
type = ADDITIONAL_IP4_ADDRESS;
break;
case AF_INET6:
type = ADDITIONAL_IP6_ADDRESS;
break;
default:
continue;
}
message->add_notify(message, FALSE, type, host->get_address(host));
if (++added >= MAX_ADDITIONAL_ADDRS)
{ /* limit number of notifys, some implementations do not like too
* many of them (f.e. strongSwan ;-) */
break;
}
}
if (!added)
{
message->add_notify(message, FALSE, NO_ADDITIONAL_ADDRESSES, chunk_empty);
}
enumerator->destroy(enumerator);
}
/**
* build a cookie and add it to the message
*/
static void build_cookie(private_ike_mobike_t *this, message_t *message)
{
rng_t *rng;
chunk_free(&this->cookie2);
rng = lib->crypto->create_rng(lib->crypto, RNG_STRONG);
if (rng)
{
rng->allocate_bytes(rng, COOKIE2_SIZE, &this->cookie2);
rng->destroy(rng);
message->add_notify(message, FALSE, COOKIE2, this->cookie2);
}
}
/**
* update addresses of associated CHILD_SAs
*/
static void update_children(private_ike_mobike_t *this)
{
enumerator_t *enumerator;
child_sa_t *child_sa;
enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
while (enumerator->enumerate(enumerator, (void**)&child_sa))
{
if (child_sa->update(child_sa,
this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa),
this->ike_sa->get_virtual_ip(this->ike_sa, TRUE),
this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY)) == NOT_SUPPORTED)
{
this->ike_sa->rekey_child_sa(this->ike_sa,
child_sa->get_protocol(child_sa),
child_sa->get_spi(child_sa, TRUE));
}
}
enumerator->destroy(enumerator);
}
/**
* Apply the port of the old host, if its ip equals the new, use port otherwise.
*/
static void apply_port(host_t *host, host_t *old, u_int16_t port)
{
if (host->ip_equals(host, old))
{
port = old->get_port(old);
}
else if (port == IKEV2_UDP_PORT)
{
port = IKEV2_NATT_PORT;
}
host->set_port(host, port);
}
METHOD(ike_mobike_t, transmit, void,
private_ike_mobike_t *this, packet_t *packet)
{
host_t *me, *other, *me_old, *other_old;
enumerator_t *enumerator;
ike_cfg_t *ike_cfg;
packet_t *copy;
if (!this->check)
{
return;
}
me_old = this->ike_sa->get_my_host(this->ike_sa);
other_old = this->ike_sa->get_other_host(this->ike_sa);
ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
enumerator = this->ike_sa->create_peer_address_enumerator(this->ike_sa);
while (enumerator->enumerate(enumerator, (void**)&other))
{
me = hydra->kernel_interface->get_source_addr(
hydra->kernel_interface, other, NULL);
if (me)
{
if (me->get_family(me) != other->get_family(other))
{
me->destroy(me);
continue;
}
/* reuse port for an active address, 4500 otherwise */
apply_port(me, me_old, ike_cfg->get_my_port(ike_cfg));
other = other->clone(other);
apply_port(other, other_old, ike_cfg->get_other_port(ike_cfg));
DBG1(DBG_IKE, "checking path %#H - %#H", me, other);
copy = packet->clone(packet);
copy->set_source(copy, me);
copy->set_destination(copy, other);
charon->sender->send(charon->sender, copy);
}
}
enumerator->destroy(enumerator);
}
METHOD(task_t, build_i, status_t,
private_ike_mobike_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
message->get_message_id(message) == 1)
{ /* only in first IKE_AUTH */
message->add_notify(message, FALSE, MOBIKE_SUPPORTED, chunk_empty);
build_address_list(this, message);
}
else if (message->get_exchange_type(message) == INFORMATIONAL)
{
host_t *old, *new;
/* we check if the existing address is still valid */
old = message->get_source(message);
new = hydra->kernel_interface->get_source_addr(hydra->kernel_interface,
message->get_destination(message), old);
if (new)
{
if (!new->ip_equals(new, old))
{
new->set_port(new, old->get_port(old));
message->set_source(message, new);
}
else
{
new->destroy(new);
}
}
if (this->update)
{
message->add_notify(message, FALSE, UPDATE_SA_ADDRESSES,
chunk_empty);
build_cookie(this, message);
update_children(this);
}
if (this->address && !this->check)
{
build_address_list(this, message);
}
if (this->natd)
{
this->natd->task.build(&this->natd->task, message);
}
}
return NEED_MORE;
}
METHOD(task_t, process_r, status_t,
private_ike_mobike_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
message->get_message_id(message) == 1)
{ /* only first IKE_AUTH */
process_payloads(this, message);
}
else if (message->get_exchange_type(message) == INFORMATIONAL)
{
process_payloads(this, message);
if (this->update)
{
host_t *me, *other;
me = message->get_destination(message);
other = message->get_source(message);
this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
}
if (this->natd)
{
this->natd->task.process(&this->natd->task, message);
}
if (this->addresses_updated && this->ike_sa->has_condition(this->ike_sa,
COND_ORIGINAL_INITIATOR))
{
host_t *other = message->get_source(message);
host_t *other_old = this->ike_sa->get_other_host(this->ike_sa);
if (!other->equals(other, other_old))
{
DBG1(DBG_IKE, "remote address changed from %H to %H", other_old,
other);
this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
this->update = TRUE;
}
}
}
return NEED_MORE;
}
METHOD(task_t, build_r, status_t,
private_ike_mobike_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{
if (this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
{
message->add_notify(message, FALSE, MOBIKE_SUPPORTED, chunk_empty);
build_address_list(this, message);
}
return SUCCESS;
}
else if (message->get_exchange_type(message) == INFORMATIONAL)
{
if (this->natd)
{
this->natd->task.build(&this->natd->task, message);
}
if (this->cookie2.ptr)
{
message->add_notify(message, FALSE, COOKIE2, this->cookie2);
chunk_free(&this->cookie2);
}
if (this->update)
{
update_children(this);
}
return SUCCESS;
}
return NEED_MORE;
}
METHOD(task_t, process_i, status_t,
private_ike_mobike_t *this, message_t *message)
{
if (message->get_exchange_type(message) == IKE_AUTH &&
this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
{
process_payloads(this, message);
return SUCCESS;
}
else if (message->get_exchange_type(message) == INFORMATIONAL)
{
u_int32_t updates = this->ike_sa->get_pending_updates(this->ike_sa) - 1;
this->ike_sa->set_pending_updates(this->ike_sa, updates);
if (updates > 0)
{
/* newer update queued, ignore this one */
return SUCCESS;
}
if (this->cookie2.ptr)
{ /* check cookie if we included one */
chunk_t cookie2;
cookie2 = this->cookie2;
this->cookie2 = chunk_empty;
process_payloads(this, message);
if (!chunk_equals(cookie2, this->cookie2))
{
chunk_free(&cookie2);
DBG1(DBG_IKE, "COOKIE2 mismatch, closing IKE_SA");
return FAILED;
}
chunk_free(&cookie2);
}
else
{
process_payloads(this, message);
}
if (this->natd)
{
this->natd->task.process(&this->natd->task, message);
if (this->natd->has_mapping_changed(this->natd))
{
/* force an update if mappings have changed */
this->update = this->check = TRUE;
DBG1(DBG_IKE, "detected changes in NAT mappings, "
"initiating MOBIKE update");
}
}
if (this->update)
{
/* update again, as NAT state may have changed */
update_children(this);
}
if (this->check)
{
host_t *me_new, *me_old, *other_new, *other_old;
me_new = message->get_destination(message);
other_new = message->get_source(message);
me_old = this->ike_sa->get_my_host(this->ike_sa);
other_old = this->ike_sa->get_other_host(this->ike_sa);
if (!me_new->equals(me_new, me_old))
{
this->update = TRUE;
this->ike_sa->set_my_host(this->ike_sa, me_new->clone(me_new));
}
if (!other_new->equals(other_new, other_old))
{
this->update = TRUE;
this->ike_sa->set_other_host(this->ike_sa, other_new->clone(other_new));
}
if (this->update)
{
/* use the same task to ... */
if (!this->ike_sa->has_condition(this->ike_sa,
COND_ORIGINAL_INITIATOR))
{ /*... send an updated list of addresses as responder */
update_children(this);
this->update = FALSE;
}
else
{ /* ... send the update as original initiator */
if (this->natd)
{
this->natd->task.destroy(&this->natd->task);
}
this->natd = ike_natd_create(this->ike_sa, this->initiator);
}
this->check = FALSE;
this->ike_sa->set_pending_updates(this->ike_sa, 1);
return NEED_MORE;
}
}
return SUCCESS;
}
return NEED_MORE;
}
METHOD(ike_mobike_t, addresses, void,
private_ike_mobike_t *this)
{
this->address = TRUE;
this->ike_sa->set_pending_updates(this->ike_sa,
this->ike_sa->get_pending_updates(this->ike_sa) + 1);
}
METHOD(ike_mobike_t, roam, void,
private_ike_mobike_t *this, bool address)
{
this->check = TRUE;
this->address = address;
this->ike_sa->set_pending_updates(this->ike_sa,
this->ike_sa->get_pending_updates(this->ike_sa) + 1);
}
METHOD(ike_mobike_t, dpd, void,
private_ike_mobike_t *this)
{
if (!this->natd)
{
this->natd = ike_natd_create(this->ike_sa, this->initiator);
}
this->ike_sa->set_pending_updates(this->ike_sa,
this->ike_sa->get_pending_updates(this->ike_sa) + 1);
}
METHOD(ike_mobike_t, is_probing, bool,
private_ike_mobike_t *this)
{
return this->check;
}
METHOD(task_t, get_type, task_type_t,
private_ike_mobike_t *this)
{
return TASK_IKE_MOBIKE;
}
METHOD(task_t, migrate, void,
private_ike_mobike_t *this, ike_sa_t *ike_sa)
{
chunk_free(&this->cookie2);
this->ike_sa = ike_sa;
if (this->natd)
{
this->natd->task.migrate(&this->natd->task, ike_sa);
}
}
METHOD(task_t, destroy, void,
private_ike_mobike_t *this)
{
chunk_free(&this->cookie2);
if (this->natd)
{
this->natd->task.destroy(&this->natd->task);
}
free(this);
}
/*
* Described in header.
*/
ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_mobike_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
.addresses = _addresses,
.roam = _roam,
.dpd = _dpd,
.transmit = _transmit,
.is_probing = _is_probing,
},
.ike_sa = ike_sa,
.initiator = initiator,
);
if (initiator)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_mobike.h
+93
View File
@@ -0,0 +1,93 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_mobike ike_mobike
* @{ @ingroup tasks
*/
#ifndef IKE_MOBIKE_H_
#define IKE_MOBIKE_H_
typedef struct ike_mobike_t ike_mobike_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
#include <network/packet.h>
/**
* Task of type ike_mobike, detects and handles MOBIKE extension.
*
* The MOBIKE extension is defined in RFC4555. It allows to update IKE
* and IPsec tunnel addresses.
* This tasks handles the MOBIKE_SUPPORTED notify exchange to detect MOBIKE
* support, allows the exchange of ADDITIONAL_*_ADDRESS to exchange additional
* endpoints and handles the UPDATE_SA_ADDRESS notify to finally update
* endpoints.
*/
struct ike_mobike_t {
/**
* Implements the task_t interface
*/
task_t task;
/**
* Use the task to update the list of additional addresses.
*/
void (*addresses)(ike_mobike_t *this);
/**
* Use the task to roam to other addresses.
*
* @param address TRUE to include address list update
*/
void (*roam)(ike_mobike_t *this, bool address);
/**
* Use the task for a DPD check which detects changes in NAT mappings.
*/
void (*dpd)(ike_mobike_t *this);
/**
* Transmision hook, called by task manager.
*
* The task manager calls this hook whenever it transmits a packet. It
* allows the mobike task to send the packet on multiple paths to do path
* probing.
*
* @param packet the packet to transmit
*/
void (*transmit)(ike_mobike_t *this, packet_t *packet);
/**
* Check if this task is probing for routability.
*
* @return TRUE if task is probing
*/
bool (*is_probing)(ike_mobike_t *this);
};
/**
* Create a new ike_mobike task.
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if taks is initiated by us
* @return ike_mobike task to handle by the task_manager
*/
ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator);
#endif /** IKE_MOBIKE_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_natd.c
+448
View File
@@ -0,0 +1,448 @@
/*
* Copyright (C) 2006-2007 Martin Willi
* Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_natd.h"
#include <string.h>
#include <hydra.h>
#include <daemon.h>
#include <config/peer_cfg.h>
#include <crypto/hashers/hasher.h>
#include <encoding/payloads/notify_payload.h>
typedef struct private_ike_natd_t private_ike_natd_t;
/**
* Private members of a ike_natd_t task.
*/
struct private_ike_natd_t {
/**
* Public methods and task_t interface.
*/
ike_natd_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* Are we the initiator?
*/
bool initiator;
/**
* Hasher used to build NAT detection hashes
*/
hasher_t *hasher;
/**
* Did we process any NAT detection notifys for a source address?
*/
bool src_seen;
/**
* Did we process any NAT detection notifys for a destination address?
*/
bool dst_seen;
/**
* Have we found a matching source address NAT hash?
*/
bool src_matched;
/**
* Have we found a matching destination address NAT hash?
*/
bool dst_matched;
/**
* whether NAT mappings for our NATed address has changed
*/
bool mapping_changed;
};
/**
* Build NAT detection hash for a host
*/
static chunk_t generate_natd_hash(private_ike_natd_t *this,
ike_sa_id_t *ike_sa_id, host_t *host)
{
chunk_t natd_chunk, spi_i_chunk, spi_r_chunk, addr_chunk, port_chunk;
chunk_t natd_hash;
u_int64_t spi_i, spi_r;
u_int16_t port;
/* prepare all required chunks */
spi_i = ike_sa_id->get_initiator_spi(ike_sa_id);
spi_r = ike_sa_id->get_responder_spi(ike_sa_id);
spi_i_chunk.ptr = (void*)&spi_i;
spi_i_chunk.len = sizeof(spi_i);
spi_r_chunk.ptr = (void*)&spi_r;
spi_r_chunk.len = sizeof(spi_r);
port = htons(host->get_port(host));
port_chunk.ptr = (void*)&port;
port_chunk.len = sizeof(port);
addr_chunk = host->get_address(host);
/* natd_hash = SHA1( spi_i | spi_r | address | port ) */
natd_chunk = chunk_cat("cccc", spi_i_chunk, spi_r_chunk, addr_chunk, port_chunk);
this->hasher->allocate_hash(this->hasher, natd_chunk, &natd_hash);
DBG3(DBG_IKE, "natd_chunk %B", &natd_chunk);
DBG3(DBG_IKE, "natd_hash %B", &natd_hash);
chunk_free(&natd_chunk);
return natd_hash;
}
/**
* build a faked NATD payload to enforce UDP encap
*/
static chunk_t generate_natd_hash_faked(private_ike_natd_t *this)
{
rng_t *rng;
chunk_t chunk;
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
{
DBG1(DBG_IKE, "unable to get random bytes for NATD fake");
return chunk_empty;
}
rng->allocate_bytes(rng, HASH_SIZE_SHA1, &chunk);
rng->destroy(rng);
return chunk;
}
/**
* Build a NAT detection notify payload.
*/
static notify_payload_t *build_natd_payload(private_ike_natd_t *this,
notify_type_t type, host_t *host)
{
chunk_t hash;
notify_payload_t *notify;
ike_sa_id_t *ike_sa_id;
ike_cfg_t *config;
ike_sa_id = this->ike_sa->get_id(this->ike_sa);
config = this->ike_sa->get_ike_cfg(this->ike_sa);
if (config->force_encap(config) && type == NAT_DETECTION_SOURCE_IP)
{
hash = generate_natd_hash_faked(this);
}
else
{
hash = generate_natd_hash(this, ike_sa_id, host);
}
notify = notify_payload_create(NOTIFY);
notify->set_notify_type(notify, type);
notify->set_notification_data(notify, hash);
chunk_free(&hash);
return notify;
}
/**
* read notifys from message and evaluate them
*/
static void process_payloads(private_ike_natd_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
notify_payload_t *notify;
chunk_t hash, src_hash, dst_hash;
ike_sa_id_t *ike_sa_id;
host_t *me, *other;
ike_cfg_t *config;
/* Precompute NAT-D hashes for incoming NAT notify comparison */
ike_sa_id = message->get_ike_sa_id(message);
me = message->get_destination(message);
other = message->get_source(message);
dst_hash = generate_natd_hash(this, ike_sa_id, me);
src_hash = generate_natd_hash(this, ike_sa_id, other);
DBG3(DBG_IKE, "precalculated src_hash %B", &src_hash);
DBG3(DBG_IKE, "precalculated dst_hash %B", &dst_hash);
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) != NOTIFY)
{
continue;
}
notify = (notify_payload_t*)payload;
switch (notify->get_notify_type(notify))
{
case NAT_DETECTION_DESTINATION_IP:
{
this->dst_seen = TRUE;
hash = notify->get_notification_data(notify);
if (!this->dst_matched)
{
DBG3(DBG_IKE, "received dst_hash %B", &hash);
if (chunk_equals(hash, dst_hash))
{
this->dst_matched = TRUE;
}
}
/* RFC4555 says we should also compare against IKE_SA_INIT
* NATD payloads, but this does not work: We are running
* there at port 500, but use 4500 afterwards... */
if (message->get_exchange_type(message) == INFORMATIONAL &&
this->initiator && !this->dst_matched)
{
this->mapping_changed = this->ike_sa->has_mapping_changed(
this->ike_sa, hash);
}
break;
}
case NAT_DETECTION_SOURCE_IP:
{
this->src_seen = TRUE;
if (!this->src_matched)
{
hash = notify->get_notification_data(notify);
DBG3(DBG_IKE, "received src_hash %B", &hash);
if (chunk_equals(hash, src_hash))
{
this->src_matched = TRUE;
}
}
break;
}
default:
break;
}
}
enumerator->destroy(enumerator);
chunk_free(&src_hash);
chunk_free(&dst_hash);
if (this->src_seen && this->dst_seen)
{
this->ike_sa->enable_extension(this->ike_sa, EXT_NATT);
this->ike_sa->set_condition(this->ike_sa, COND_NAT_HERE,
!this->dst_matched);
this->ike_sa->set_condition(this->ike_sa, COND_NAT_THERE,
!this->src_matched);
config = this->ike_sa->get_ike_cfg(this->ike_sa);
if (this->dst_matched && this->src_matched &&
config->force_encap(config))
{
this->ike_sa->set_condition(this->ike_sa, COND_NAT_FAKE, TRUE);
}
}
}
METHOD(task_t, process_i, status_t,
private_ike_natd_t *this, message_t *message)
{
process_payloads(this, message);
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
peer_cfg_t *peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY) ||
/* if peer supports NAT-T, we switch to port 4500 even
* if no NAT is detected. can't be done later (when we would know
* whether the peer supports MOBIKE) because there would be no
* exchange to actually do the switch (other than a forced DPD). */
(peer_cfg->use_mobike(peer_cfg) &&
this->ike_sa->supports_extension(this->ike_sa, EXT_NATT)))
{
this->ike_sa->float_ports(this->ike_sa);
}
}
return SUCCESS;
}
METHOD(task_t, build_i, status_t,
private_ike_natd_t *this, message_t *message)
{
notify_payload_t *notify;
enumerator_t *enumerator;
ike_cfg_t *ike_cfg;
host_t *host;
if (this->hasher == NULL)
{
DBG1(DBG_IKE, "unable to build NATD payloads, SHA1 not supported");
return NEED_MORE;
}
ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
/* destination is always set */
host = message->get_destination(message);
notify = build_natd_payload(this, NAT_DETECTION_DESTINATION_IP, host);
message->add_payload(message, (payload_t*)notify);
/* source may be any, we have 3 possibilities to get our source address:
* 1. It is defined in the config => use the one of the IKE_SA
* 2. We do a routing lookup in the kernel interface
* 3. Include all possbile addresses
*/
host = message->get_source(message);
if (!host->is_anyaddr(host))
{ /* 1. */
notify = build_natd_payload(this, NAT_DETECTION_SOURCE_IP, host);
message->add_payload(message, (payload_t*)notify);
}
else
{
host = hydra->kernel_interface->get_source_addr(hydra->kernel_interface,
this->ike_sa->get_other_host(this->ike_sa), NULL);
if (host)
{ /* 2. */
host->set_port(host, ike_cfg->get_my_port(ike_cfg));
notify = build_natd_payload(this, NAT_DETECTION_SOURCE_IP, host);
message->add_payload(message, (payload_t*)notify);
host->destroy(host);
}
else
{ /* 3. */
enumerator = hydra->kernel_interface->create_address_enumerator(
hydra->kernel_interface, FALSE, FALSE);
while (enumerator->enumerate(enumerator, (void**)&host))
{
/* apply port 500 to host, but work on a copy */
host = host->clone(host);
host->set_port(host, ike_cfg->get_my_port(ike_cfg));
notify = build_natd_payload(this, NAT_DETECTION_SOURCE_IP, host);
host->destroy(host);
message->add_payload(message, (payload_t*)notify);
}
enumerator->destroy(enumerator);
}
}
return NEED_MORE;
}
METHOD(task_t, build_r, status_t,
private_ike_natd_t *this, message_t *message)
{
notify_payload_t *notify;
host_t *me, *other;
/* only add notifies on successful responses. */
if (message->get_exchange_type(message) == IKE_SA_INIT &&
message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
{
return SUCCESS;
}
if (this->src_seen && this->dst_seen)
{
if (this->hasher == NULL)
{
DBG1(DBG_IKE, "unable to build NATD payloads, SHA1 not supported");
return SUCCESS;
}
/* initiator seems to support NAT detection, add response */
me = message->get_source(message);
notify = build_natd_payload(this, NAT_DETECTION_SOURCE_IP, me);
message->add_payload(message, (payload_t*)notify);
other = message->get_destination(message);
notify = build_natd_payload(this, NAT_DETECTION_DESTINATION_IP, other);
message->add_payload(message, (payload_t*)notify);
}
return SUCCESS;
}
METHOD(task_t, process_r, status_t,
private_ike_natd_t *this, message_t *message)
{
process_payloads(this, message);
return NEED_MORE;
}
METHOD(task_t, get_type, task_type_t,
private_ike_natd_t *this)
{
return TASK_IKE_NATD;
}
METHOD(task_t, migrate, void,
private_ike_natd_t *this, ike_sa_t *ike_sa)
{
this->ike_sa = ike_sa;
this->src_seen = FALSE;
this->dst_seen = FALSE;
this->src_matched = FALSE;
this->dst_matched = FALSE;
this->mapping_changed = FALSE;
}
METHOD(task_t, destroy, void,
private_ike_natd_t *this)
{
DESTROY_IF(this->hasher);
free(this);
}
METHOD(ike_natd_t, has_mapping_changed, bool,
private_ike_natd_t *this)
{
return this->mapping_changed;
}
/*
* Described in header.
*/
ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_natd_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.destroy = _destroy,
},
.has_mapping_changed = _has_mapping_changed,
},
.ike_sa = ike_sa,
.initiator = initiator,
.hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1),
);
if (initiator)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
}
else
{
this->public.task.build = _build_r;
this->public.task.process = _process_r;
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_natd.h
+59
View File
@@ -0,0 +1,59 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_natd ike_natd
* @{ @ingroup tasks
*/
#ifndef IKE_NATD_H_
#define IKE_NATD_H_
typedef struct ike_natd_t ike_natd_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type ike_natd, detects NAT situation in IKE_SA_INIT exchange.
*/
struct ike_natd_t {
/**
* Implements the task_t interface
*/
task_t task;
/**
* Check if the NAT mapping has changed for our address.
*
* MOBIKE uses NAT payloads in DPD to detect changes in the NAT mappings.
*
* @return TRUE if mappings have changed
*/
bool (*has_mapping_changed)(ike_natd_t *this);
};
/**
* Create a new ike_natd task.
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if task is the original initiator
* @return ike_natd task to handle by the task_manager
*/
ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator);
#endif /** IKE_NATD_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_reauth.c
+194
View File
@@ -0,0 +1,194 @@
/*
* Copyright (C) 2006-2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_reauth.h"
#include <daemon.h>
#include <sa/ikev2/tasks/ike_delete.h>
typedef struct private_ike_reauth_t private_ike_reauth_t;
/**
* Private members of a ike_reauth_t task.
*/
struct private_ike_reauth_t {
/**
* Public methods and task_t interface.
*/
ike_reauth_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* reused ike_delete task
*/
ike_delete_t *ike_delete;
};
METHOD(task_t, build_i, status_t,
private_ike_reauth_t *this, message_t *message)
{
return this->ike_delete->task.build(&this->ike_delete->task, message);
}
METHOD(task_t, process_i, status_t,
private_ike_reauth_t *this, message_t *message)
{
ike_sa_t *new;
host_t *host;
enumerator_t *enumerator;
child_sa_t *child_sa;
peer_cfg_t *peer_cfg;
/* process delete response first */
this->ike_delete->task.process(&this->ike_delete->task, message);
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
/* reauthenticate only if we have children */
if (this->ike_sa->get_child_count(this->ike_sa) == 0
#ifdef ME
/* we allow peers to reauth mediation connections (without children) */
&& !peer_cfg->is_mediation(peer_cfg)
#endif /* ME */
)
{
DBG1(DBG_IKE, "unable to reauthenticate IKE_SA, no CHILD_SA to recreate");
return FAILED;
}
new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
this->ike_sa->get_version(this->ike_sa), TRUE);
if (!new)
{ /* shouldn't happen */
return FAILED;
}
new->set_peer_cfg(new, peer_cfg);
host = this->ike_sa->get_other_host(this->ike_sa);
new->set_other_host(new, host->clone(host));
host = this->ike_sa->get_my_host(this->ike_sa);
new->set_my_host(new, host->clone(host));
/* if we already have a virtual IP, we reuse it */
host = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
if (host)
{
new->set_virtual_ip(new, TRUE, host);
}
#ifdef ME
/* we initiate the new IKE_SA of the mediation connection without CHILD_SA */
if (peer_cfg->is_mediation(peer_cfg))
{
if (new->initiate(new, NULL, 0, NULL, NULL) == DESTROY_ME)
{
charon->ike_sa_manager->checkin_and_destroy(
charon->ike_sa_manager, new);
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
return FAILED;
}
}
#endif /* ME */
enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
while (enumerator->enumerate(enumerator, (void**)&child_sa))
{
switch (child_sa->get_state(child_sa))
{
case CHILD_ROUTED:
{
/* move routed child directly */
this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
new->add_child_sa(new, child_sa);
break;
}
default:
{
/* initiate/queue all child SAs */
child_cfg_t *child_cfg = child_sa->get_config(child_sa);
child_cfg->get_ref(child_cfg);
if (new->initiate(new, child_cfg, 0, NULL, NULL) == DESTROY_ME)
{
enumerator->destroy(enumerator);
charon->ike_sa_manager->checkin_and_destroy(
charon->ike_sa_manager, new);
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
return FAILED;
}
break;
}
}
}
enumerator->destroy(enumerator);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
/* we always destroy the obsolete IKE_SA */
return DESTROY_ME;
}
METHOD(task_t, get_type, task_type_t,
private_ike_reauth_t *this)
{
return TASK_IKE_REAUTH;
}
METHOD(task_t, migrate, void,
private_ike_reauth_t *this, ike_sa_t *ike_sa)
{
this->ike_delete->task.migrate(&this->ike_delete->task, ike_sa);
this->ike_sa = ike_sa;
}
METHOD(task_t, destroy, void,
private_ike_reauth_t *this)
{
this->ike_delete->task.destroy(&this->ike_delete->task);
free(this);
}
/*
* Described in header.
*/
ike_reauth_t *ike_reauth_create(ike_sa_t *ike_sa)
{
private_ike_reauth_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.migrate = _migrate,
.build = _build_i,
.process = _process_i,
.destroy = _destroy,
},
},
.ike_sa = ike_sa,
.ike_delete = ike_delete_create(ike_sa, TRUE),
);
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_reauth.h
+51
View File
@@ -0,0 +1,51 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_reauth ike_reauth
* @{ @ingroup tasks
*/
#ifndef IKE_REAUTH_H_
#define IKE_REAUTH_H_
typedef struct ike_reauth_t ike_reauth_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type ike_reauth, reestablishes an IKE_SA.
*/
struct ike_reauth_t {
/**
* Implements the task_t interface
*/
task_t task;
};
/**
* Create a new ike_reauth task.
*
* This task is initiator only.
*
* @param ike_sa IKE_SA this task works for
* @return ike_reauth task to handle by the task_manager
*/
ike_reauth_t *ike_reauth_create(ike_sa_t *ike_sa);
#endif /** IKE_REAUTH_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_rekey.c
+412
View File
@@ -0,0 +1,412 @@
/*
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_rekey.h"
#include <daemon.h>
#include <encoding/payloads/notify_payload.h>
#include <sa/ikev2/tasks/ike_init.h>
#include <sa/ikev2/tasks/ike_delete.h>
#include <processing/jobs/delete_ike_sa_job.h>
#include <processing/jobs/rekey_ike_sa_job.h>
typedef struct private_ike_rekey_t private_ike_rekey_t;
/**
* Private members of a ike_rekey_t task.
*/
struct private_ike_rekey_t {
/**
* Public methods and task_t interface.
*/
ike_rekey_t public;
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
/**
* New IKE_SA which replaces the current one
*/
ike_sa_t *new_sa;
/**
* Are we the initiator?
*/
bool initiator;
/**
* the TASK_IKE_INIT task which is reused to simplify rekeying
*/
ike_init_t *ike_init;
/**
* IKE_DELETE task to delete the old IKE_SA after rekeying was successful
*/
ike_delete_t *ike_delete;
/**
* colliding task detected by the task manager
*/
task_t *collision;
};
/**
* Establish the new replacement IKE_SA
*/
static void establish_new(private_ike_rekey_t *this)
{
if (this->new_sa)
{
this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
DBG0(DBG_IKE, "IKE_SA %s[%d] rekeyed between %H[%Y]...%H[%Y]",
this->new_sa->get_name(this->new_sa),
this->new_sa->get_unique_id(this->new_sa),
this->ike_sa->get_my_host(this->ike_sa),
this->ike_sa->get_my_id(this->ike_sa),
this->ike_sa->get_other_host(this->ike_sa),
this->ike_sa->get_other_id(this->ike_sa));
this->new_sa->inherit(this->new_sa, this->ike_sa);
charon->bus->ike_rekey(charon->bus, this->ike_sa, this->new_sa);
charon->ike_sa_manager->checkin(charon->ike_sa_manager, this->new_sa);
this->new_sa = NULL;
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
}
}
METHOD(task_t, process_r_delete, status_t,
private_ike_rekey_t *this, message_t *message)
{
establish_new(this);
return this->ike_delete->task.process(&this->ike_delete->task, message);
}
METHOD(task_t, build_r_delete, status_t,
private_ike_rekey_t *this, message_t *message)
{
return this->ike_delete->task.build(&this->ike_delete->task, message);
}
METHOD(task_t, build_i_delete, status_t,
private_ike_rekey_t *this, message_t *message)
{
/* update exchange type to INFORMATIONAL for the delete */
message->set_exchange_type(message, INFORMATIONAL);
return this->ike_delete->task.build(&this->ike_delete->task, message);
}
METHOD(task_t, process_i_delete, status_t,
private_ike_rekey_t *this, message_t *message)
{
return this->ike_delete->task.process(&this->ike_delete->task, message);
}
METHOD(task_t, build_i, status_t,
private_ike_rekey_t *this, message_t *message)
{
ike_version_t version;
peer_cfg_t *peer_cfg;
host_t *other_host;
/* create new SA only on first try */
if (this->new_sa == NULL)
{
version = this->ike_sa->get_version(this->ike_sa);
this->new_sa = charon->ike_sa_manager->checkout_new(
charon->ike_sa_manager, version, TRUE);
if (!this->new_sa)
{ /* shouldn't happen */
return FAILED;
}
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
other_host = this->ike_sa->get_other_host(this->ike_sa);
this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
this->new_sa->set_other_host(this->new_sa, other_host->clone(other_host));
this->ike_init = ike_init_create(this->new_sa, TRUE, this->ike_sa);
this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
}
this->ike_init->task.build(&this->ike_init->task, message);
return NEED_MORE;
}
METHOD(task_t, process_r, status_t,
private_ike_rekey_t *this, message_t *message)
{
enumerator_t *enumerator;
peer_cfg_t *peer_cfg;
child_sa_t *child_sa;
if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
{
DBG1(DBG_IKE, "peer initiated rekeying, but we are deleting");
return NEED_MORE;
}
enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
while (enumerator->enumerate(enumerator, (void**)&child_sa))
{
switch (child_sa->get_state(child_sa))
{
case CHILD_CREATED:
case CHILD_REKEYING:
case CHILD_DELETING:
/* we do not allow rekeying while we have children in-progress */
DBG1(DBG_IKE, "peer initiated rekeying, but a child is half-open");
enumerator->destroy(enumerator);
return NEED_MORE;
default:
break;
}
}
enumerator->destroy(enumerator);
this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
this->ike_sa->get_version(this->ike_sa), FALSE);
if (!this->new_sa)
{ /* shouldn't happen */
return FAILED;
}
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
this->ike_init = ike_init_create(this->new_sa, FALSE, this->ike_sa);
this->ike_init->task.process(&this->ike_init->task, message);
return NEED_MORE;
}
METHOD(task_t, build_r, status_t,
private_ike_rekey_t *this, message_t *message)
{
if (this->new_sa == NULL)
{
/* IKE_SA/a CHILD_SA is in an inacceptable state, deny rekeying */
message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
return SUCCESS;
}
if (this->ike_init->task.build(&this->ike_init->task, message) == FAILED)
{
return SUCCESS;
}
this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
/* rekeying successful, delete the IKE_SA using a subtask */
this->ike_delete = ike_delete_create(this->ike_sa, FALSE);
this->public.task.build = _build_r_delete;
this->public.task.process = _process_r_delete;
return NEED_MORE;
}
METHOD(task_t, process_i, status_t,
private_ike_rekey_t *this, message_t *message)
{
if (message->get_notify(message, NO_ADDITIONAL_SAS))
{
DBG1(DBG_IKE, "peer seems to not support IKE rekeying, "
"starting reauthentication");
this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
lib->processor->queue_job(lib->processor,
(job_t*)rekey_ike_sa_job_create(
this->ike_sa->get_id(this->ike_sa), TRUE));
return SUCCESS;
}
switch (this->ike_init->task.process(&this->ike_init->task, message))
{
case FAILED:
/* rekeying failed, fallback to old SA */
if (!(this->collision && (
this->collision->get_type(this->collision) == TASK_IKE_DELETE ||
this->collision->get_type(this->collision) == TASK_IKE_REAUTH)))
{
job_t *job;
u_int32_t retry = RETRY_INTERVAL - (random() % RETRY_JITTER);
job = (job_t*)rekey_ike_sa_job_create(
this->ike_sa->get_id(this->ike_sa), FALSE);
DBG1(DBG_IKE, "IKE_SA rekeying failed, "
"trying again in %d seconds", retry);
this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
lib->scheduler->schedule_job(lib->scheduler, job, retry);
}
return SUCCESS;
case NEED_MORE:
/* bad dh group, try again */
this->ike_init->task.migrate(&this->ike_init->task, this->new_sa);
return NEED_MORE;
default:
break;
}
/* check for collisions */
if (this->collision &&
this->collision->get_type(this->collision) == TASK_IKE_REKEY)
{
private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision;
/* ike_init can be NULL, if child_sa is half-open */
if (other->ike_init)
{
host_t *host;
chunk_t this_nonce, other_nonce;
this_nonce = this->ike_init->get_lower_nonce(this->ike_init);
other_nonce = other->ike_init->get_lower_nonce(other->ike_init);
/* if we have the lower nonce, delete rekeyed SA. If not, delete
* the redundant. */
if (memcmp(this_nonce.ptr, other_nonce.ptr,
min(this_nonce.len, other_nonce.len)) > 0)
{
/* peer should delete this SA. Add a timeout just in case. */
job_t *job = (job_t*)delete_ike_sa_job_create(
other->new_sa->get_id(other->new_sa), TRUE);
lib->scheduler->schedule_job(lib->scheduler, job, 10);
DBG1(DBG_IKE, "IKE_SA rekey collision won, waiting for delete");
charon->ike_sa_manager->checkin(charon->ike_sa_manager, other->new_sa);
other->new_sa = NULL;
}
else
{
DBG1(DBG_IKE, "IKE_SA rekey collision lost, "
"deleting redundant IKE_SA");
/* apply host for a proper delete */
host = this->ike_sa->get_my_host(this->ike_sa);
this->new_sa->set_my_host(this->new_sa, host->clone(host));
host = this->ike_sa->get_other_host(this->ike_sa);
this->new_sa->set_other_host(this->new_sa, host->clone(host));
this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
this->new_sa->set_state(this->new_sa, IKE_REKEYING);
if (this->new_sa->delete(this->new_sa) == DESTROY_ME)
{
this->new_sa->destroy(this->new_sa);
}
else
{
charon->ike_sa_manager->checkin(
charon->ike_sa_manager, this->new_sa);
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
}
this->new_sa = NULL;
establish_new(other);
return SUCCESS;
}
}
/* set threads active IKE_SA after checkin */
charon->bus->set_sa(charon->bus, this->ike_sa);
}
establish_new(this);
/* rekeying successful, delete the IKE_SA using a subtask */
this->ike_delete = ike_delete_create(this->ike_sa, TRUE);
this->public.task.build = _build_i_delete;
this->public.task.process = _process_i_delete;
return NEED_MORE;
}
METHOD(task_t, get_type, task_type_t,
private_ike_rekey_t *this)
{
return TASK_IKE_REKEY;
}
METHOD(ike_rekey_t, collide, void,
private_ike_rekey_t* this, task_t *other)
{
DBG1(DBG_IKE, "detected %N collision with %N", task_type_names,
TASK_IKE_REKEY, task_type_names, other->get_type(other));
DESTROY_IF(this->collision);
this->collision = other;
}
METHOD(task_t, migrate, void,
private_ike_rekey_t *this, ike_sa_t *ike_sa)
{
if (this->ike_init)
{
this->ike_init->task.destroy(&this->ike_init->task);
}
if (this->ike_delete)
{
this->ike_delete->task.destroy(&this->ike_delete->task);
}
DESTROY_IF(this->new_sa);
DESTROY_IF(this->collision);
this->collision = NULL;
this->ike_sa = ike_sa;
this->new_sa = NULL;
this->ike_init = NULL;
this->ike_delete = NULL;
}
METHOD(task_t, destroy, void,
private_ike_rekey_t *this)
{
if (this->ike_init)
{
this->ike_init->task.destroy(&this->ike_init->task);
}
if (this->ike_delete)
{
this->ike_delete->task.destroy(&this->ike_delete->task);
}
DESTROY_IF(this->new_sa);
DESTROY_IF(this->collision);
free(this);
}
/*
* Described in header.
*/
ike_rekey_t *ike_rekey_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_rekey_t *this;
INIT(this,
.public = {
.task = {
.get_type = _get_type,
.build = _build_r,
.process = _process_r,
.migrate = _migrate,
.destroy = _destroy,
},
.collide = _collide,
},
.ike_sa = ike_sa,
.initiator = initiator,
);
if (initiator)
{
this->public.task.build = _build_i;
this->public.task.process = _process_i;
}
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_rekey.h
+61
View File
@@ -0,0 +1,61 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_rekey ike_rekey
* @{ @ingroup tasks
*/
#ifndef IKE_REKEY_H_
#define IKE_REKEY_H_
typedef struct ike_rekey_t ike_rekey_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Task of type TASK_IKE_REKEY, rekey an established IKE_SA.
*/
struct ike_rekey_t {
/**
* Implements the task_t interface
*/
task_t task;
/**
* Register a rekeying task which collides with this one.
*
* If two peers initiate rekeying at the same time, the collision must
* be handled gracefully. The task manager is aware of what exchanges
* are going on and notifies the outgoing task by passing the incoming.
*
* @param other incoming task
*/
void (*collide)(ike_rekey_t* this, task_t *other);
};
/**
* Create a new TASK_IKE_REKEY task.
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE for initiator, FALSE for responder
* @return TASK_IKE_REKEY task to handle by the task_manager
*/
ike_rekey_t *ike_rekey_create(ike_sa_t *ike_sa, bool initiator);
#endif /** IKE_REKEY_H_ @}*/
src/libcharon/sa/ikev2/tasks/ike_vendor.c
+141
View File
@@ -0,0 +1,141 @@
/*
* Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "ike_vendor.h"
#include <daemon.h>
#include <encoding/payloads/vendor_id_payload.h>
typedef struct private_ike_vendor_t private_ike_vendor_t;
/**
* Private data of an ike_vendor_t object.
*/
struct private_ike_vendor_t {
/**
* Public ike_vendor_t interface.
*/
ike_vendor_t public;
/**
* Associated IKE_SA
*/
ike_sa_t *ike_sa;
/**
* Are we the inititator of this task
*/
bool initiator;
};
/**
* strongSwan specific vendor ID without version, MD5("strongSwan")
*/
static chunk_t strongswan_vid = chunk_from_chars(
0x88,0x2f,0xe5,0x6d,0x6f,0xd2,0x0d,0xbc,
0x22,0x51,0x61,0x3b,0x2e,0xbe,0x5b,0xeb
);
METHOD(task_t, build, status_t,
private_ike_vendor_t *this, message_t *message)
{
if (lib->settings->get_bool(lib->settings,
"charon.send_vendor_id", FALSE))
{
vendor_id_payload_t *vid;
vid = vendor_id_payload_create_data(VENDOR_ID,
chunk_clone(strongswan_vid));
message->add_payload(message, &vid->payload_interface);
}
return this->initiator ? NEED_MORE : SUCCESS;
}
METHOD(task_t, process, status_t,
private_ike_vendor_t *this, message_t *message)
{
enumerator_t *enumerator;
payload_t *payload;
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
if (payload->get_type(payload) == VENDOR_ID)
{
vendor_id_payload_t *vid;
chunk_t data;
vid = (vendor_id_payload_t*)payload;
data = vid->get_data(vid);
if (chunk_equals(data, strongswan_vid))
{
DBG1(DBG_IKE, "received strongSwan vendor id");
this->ike_sa->enable_extension(this->ike_sa, EXT_STRONGSWAN);
}
else
{
DBG1(DBG_ENC, "received unknown vendor id: %#B", &data);
}
}
}
enumerator->destroy(enumerator);
return this->initiator ? SUCCESS : NEED_MORE;
}
METHOD(task_t, migrate, void,
private_ike_vendor_t *this, ike_sa_t *ike_sa)
{
this->ike_sa = ike_sa;
}
METHOD(task_t, get_type, task_type_t,
private_ike_vendor_t *this)
{
return TASK_IKE_VENDOR;
}
METHOD(task_t, destroy, void,
private_ike_vendor_t *this)
{
free(this);
}
/**
* See header
*/
ike_vendor_t *ike_vendor_create(ike_sa_t *ike_sa, bool initiator)
{
private_ike_vendor_t *this;
INIT(this,
.public = {
.task = {
.build = _build,
.process = _process,
.migrate = _migrate,
.get_type = _get_type,
.destroy = _destroy,
},
},
.initiator = initiator,
.ike_sa = ike_sa,
);
return &this->public;
}
src/libcharon/sa/ikev2/tasks/ike_vendor.h
+49
View File
@@ -0,0 +1,49 @@
/*
* Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup ike_vendor ike_vendor
* @{ @ingroup tasks
*/
#ifndef IKE_VENDOR_H_
#define IKE_VENDOR_H_
typedef struct ike_vendor_t ike_vendor_t;
#include <library.h>
#include <sa/ike_sa.h>
#include <sa/task.h>
/**
* Vendor ID processing task.
*/
struct ike_vendor_t {
/**
* Implements task interface.
*/
task_t task;
};
/**
* Create a ike_vendor instance.
*
* @param ike_sa IKE_SA this task works for
* @param initiator TRUE if task is the original initiator
*/
ike_vendor_t *ike_vendor_create(ike_sa_t *ike_sa, bool initiator);
#endif /** IKE_VENDOR_H_ @}*/