Merge branch 'ikev1'
Conflicts: configure.in man/ipsec.conf.5.in src/libcharon/encoding/generator.c src/libcharon/encoding/payloads/notify_payload.c src/libcharon/encoding/payloads/notify_payload.h src/libcharon/encoding/payloads/payload.c src/libcharon/network/receiver.c src/libcharon/sa/authenticator.c src/libcharon/sa/authenticator.h src/libcharon/sa/ikev2/tasks/ike_init.c src/libcharon/sa/task_manager.c src/libstrongswan/credentials/auth_cfg.c
This commit is contained in:
Martin Willi
@@ -0,0 +1,698 @@
|
||||
/*
|
||||
* Copyright (C) 2006-2009 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
#include "eap_authenticator.h"
|
||||
|
||||
#include <daemon.h>
|
||||
#include <sa/ikev2/keymat_v2.h>
|
||||
#include <sa/eap/eap_method.h>
|
||||
#include <encoding/payloads/auth_payload.h>
|
||||
#include <encoding/payloads/eap_payload.h>
|
||||
|
||||
typedef struct private_eap_authenticator_t private_eap_authenticator_t;
|
||||
|
||||
/**
|
||||
* Private data of an eap_authenticator_t object.
|
||||
*/
|
||||
struct private_eap_authenticator_t {
|
||||
|
||||
/**
|
||||
* Public authenticator_t interface.
|
||||
*/
|
||||
eap_authenticator_t public;
|
||||
|
||||
/**
|
||||
* Assigned IKE_SA
|
||||
*/
|
||||
ike_sa_t *ike_sa;
|
||||
|
||||
/**
|
||||
* others nonce to include in AUTH calculation
|
||||
*/
|
||||
chunk_t received_nonce;
|
||||
|
||||
/**
|
||||
* our nonce to include in AUTH calculation
|
||||
*/
|
||||
chunk_t sent_nonce;
|
||||
|
||||
/**
|
||||
* others IKE_SA_INIT message data to include in AUTH calculation
|
||||
*/
|
||||
chunk_t received_init;
|
||||
|
||||
/**
|
||||
* our IKE_SA_INIT message data to include in AUTH calculation
|
||||
*/
|
||||
chunk_t sent_init;
|
||||
|
||||
/**
|
||||
* Reserved bytes of ID payload
|
||||
*/
|
||||
char reserved[3];
|
||||
|
||||
/**
|
||||
* Current EAP method processing
|
||||
*/
|
||||
eap_method_t *method;
|
||||
|
||||
/**
|
||||
* MSK used to build and verify auth payload
|
||||
*/
|
||||
chunk_t msk;
|
||||
|
||||
/**
|
||||
* EAP authentication method completed successfully
|
||||
*/
|
||||
bool eap_complete;
|
||||
|
||||
/**
|
||||
* Set if we require mutual EAP due EAP-only authentication
|
||||
*/
|
||||
bool require_mutual;
|
||||
|
||||
/**
|
||||
* authentication payload verified successfully
|
||||
*/
|
||||
bool auth_complete;
|
||||
|
||||
/**
|
||||
* generated EAP payload
|
||||
*/
|
||||
eap_payload_t *eap_payload;
|
||||
|
||||
/**
|
||||
* EAP identity of peer
|
||||
*/
|
||||
identification_t *eap_identity;
|
||||
};
|
||||
|
||||
/**
|
||||
* load an EAP method
|
||||
*/
|
||||
static eap_method_t *load_method(private_eap_authenticator_t *this,
|
||||
eap_type_t type, u_int32_t vendor, eap_role_t role)
|
||||
{
|
||||
identification_t *server, *peer, *aaa;
|
||||
auth_cfg_t *auth;
|
||||
|
||||
if (role == EAP_SERVER)
|
||||
{
|
||||
server = this->ike_sa->get_my_id(this->ike_sa);
|
||||
peer = this->ike_sa->get_other_id(this->ike_sa);
|
||||
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
|
||||
}
|
||||
else
|
||||
{
|
||||
server = this->ike_sa->get_other_id(this->ike_sa);
|
||||
peer = this->ike_sa->get_my_id(this->ike_sa);
|
||||
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
|
||||
}
|
||||
if (this->eap_identity)
|
||||
{
|
||||
peer = this->eap_identity;
|
||||
}
|
||||
aaa = auth->get(auth, AUTH_RULE_AAA_IDENTITY);
|
||||
if (aaa)
|
||||
{
|
||||
server = aaa;
|
||||
}
|
||||
return charon->eap->create_instance(charon->eap, type, vendor,
|
||||
role, server, peer);
|
||||
}
|
||||
|
||||
/**
|
||||
* Initiate EAP conversation as server
|
||||
*/
|
||||
static eap_payload_t* server_initiate_eap(private_eap_authenticator_t *this,
|
||||
bool do_identity)
|
||||
{
|
||||
auth_cfg_t *auth;
|
||||
eap_type_t type;
|
||||
identification_t *id;
|
||||
u_int32_t vendor;
|
||||
eap_payload_t *out;
|
||||
char *action;
|
||||
|
||||
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
|
||||
|
||||
/* initiate EAP-Identity exchange if required */
|
||||
if (!this->eap_identity && do_identity)
|
||||
{
|
||||
id = auth->get(auth, AUTH_RULE_EAP_IDENTITY);
|
||||
if (id)
|
||||
{
|
||||
if (id->get_type(id) == ID_ANY)
|
||||
{
|
||||
this->method = load_method(this, EAP_IDENTITY, 0, EAP_SERVER);
|
||||
if (this->method)
|
||||
{
|
||||
if (this->method->initiate(this->method, &out) == NEED_MORE)
|
||||
{
|
||||
DBG1(DBG_IKE, "initiating %N method (id 0x%02X)",
|
||||
eap_type_names, EAP_IDENTITY,
|
||||
this->method->get_identifier(this->method));
|
||||
return out;
|
||||
}
|
||||
this->method->destroy(this->method);
|
||||
}
|
||||
DBG1(DBG_IKE, "EAP-Identity request configured, "
|
||||
"but not supported");
|
||||
}
|
||||
else
|
||||
{
|
||||
DBG1(DBG_IKE, "using configured EAP-Identity %Y", id);
|
||||
this->eap_identity = id->clone(id);
|
||||
}
|
||||
}
|
||||
}
|
||||
/* invoke real EAP method */
|
||||
type = (uintptr_t)auth->get(auth, AUTH_RULE_EAP_TYPE);
|
||||
vendor = (uintptr_t)auth->get(auth, AUTH_RULE_EAP_VENDOR);
|
||||
action = "loading";
|
||||
this->method = load_method(this, type, vendor, EAP_SERVER);
|
||||
if (this->method)
|
||||
{
|
||||
action = "initiating";
|
||||
type = this->method->get_type(this->method, &vendor);
|
||||
if (this->method->initiate(this->method, &out) == NEED_MORE)
|
||||
{
|
||||
if (vendor)
|
||||
{
|
||||
DBG1(DBG_IKE, "initiating EAP vendor type %d-%d method (id 0x%02X)",
|
||||
type, vendor, out->get_identifier(out));
|
||||
}
|
||||
else
|
||||
{
|
||||
DBG1(DBG_IKE, "initiating %N method (id 0x%02X)", eap_type_names,
|
||||
type, out->get_identifier(out));
|
||||
}
|
||||
return out;
|
||||
}
|
||||
}
|
||||
if (vendor)
|
||||
{
|
||||
DBG1(DBG_IKE, "%s EAP vendor type %d-%d method failed",
|
||||
action, type, vendor);
|
||||
}
|
||||
else
|
||||
{
|
||||
DBG1(DBG_IKE, "%s %N method failed", action, eap_type_names, type);
|
||||
}
|
||||
return eap_payload_create_code(EAP_FAILURE, 0);
|
||||
}
|
||||
|
||||
/**
|
||||
* Replace the existing EAP-Identity in other auth config
|
||||
*/
|
||||
static void replace_eap_identity(private_eap_authenticator_t *this)
|
||||
{
|
||||
identification_t *eap_identity;
|
||||
auth_cfg_t *cfg;
|
||||
|
||||
eap_identity = this->eap_identity->clone(this->eap_identity);
|
||||
cfg = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
|
||||
cfg->add(cfg, AUTH_RULE_EAP_IDENTITY, eap_identity);
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle EAP exchange as server
|
||||
*/
|
||||
static eap_payload_t* server_process_eap(private_eap_authenticator_t *this,
|
||||
eap_payload_t *in)
|
||||
{
|
||||
eap_type_t type, received_type;
|
||||
u_int32_t vendor, received_vendor;
|
||||
eap_payload_t *out;
|
||||
|
||||
if (in->get_code(in) != EAP_RESPONSE)
|
||||
{
|
||||
DBG1(DBG_IKE, "received %N, sending %N",
|
||||
eap_code_names, in->get_code(in), eap_code_names, EAP_FAILURE);
|
||||
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
|
||||
}
|
||||
|
||||
type = this->method->get_type(this->method, &vendor);
|
||||
received_type = in->get_type(in, &received_vendor);
|
||||
if (type != received_type || vendor != received_vendor)
|
||||
{
|
||||
if (received_vendor == 0 && received_type == EAP_NAK)
|
||||
{
|
||||
DBG1(DBG_IKE, "received %N, sending %N",
|
||||
eap_type_names, EAP_NAK, eap_code_names, EAP_FAILURE);
|
||||
}
|
||||
else
|
||||
{
|
||||
DBG1(DBG_IKE, "received invalid EAP response, sending %N",
|
||||
eap_code_names, EAP_FAILURE);
|
||||
}
|
||||
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
|
||||
}
|
||||
|
||||
switch (this->method->process(this->method, in, &out))
|
||||
{
|
||||
case NEED_MORE:
|
||||
return out;
|
||||
case SUCCESS:
|
||||
if (!vendor && type == EAP_IDENTITY)
|
||||
{
|
||||
chunk_t data;
|
||||
|
||||
if (this->method->get_msk(this->method, &data) == SUCCESS)
|
||||
{
|
||||
this->eap_identity = identification_create_from_data(data);
|
||||
DBG1(DBG_IKE, "received EAP identity '%Y'",
|
||||
this->eap_identity);
|
||||
replace_eap_identity(this);
|
||||
}
|
||||
/* restart EAP exchange, but with real method */
|
||||
this->method->destroy(this->method);
|
||||
return server_initiate_eap(this, FALSE);
|
||||
}
|
||||
if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
|
||||
{
|
||||
this->msk = chunk_clone(this->msk);
|
||||
}
|
||||
if (vendor)
|
||||
{
|
||||
DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeeded, "
|
||||
"%sMSK established", type, vendor,
|
||||
this->msk.ptr ? "" : "no ");
|
||||
}
|
||||
else
|
||||
{
|
||||
DBG1(DBG_IKE, "EAP method %N succeeded, %sMSK established",
|
||||
eap_type_names, type, this->msk.ptr ? "" : "no ");
|
||||
}
|
||||
this->ike_sa->set_condition(this->ike_sa, COND_EAP_AUTHENTICATED,
|
||||
TRUE);
|
||||
this->eap_complete = TRUE;
|
||||
return eap_payload_create_code(EAP_SUCCESS, in->get_identifier(in));
|
||||
case FAILED:
|
||||
default:
|
||||
if (vendor)
|
||||
{
|
||||
DBG1(DBG_IKE, "EAP vendor specific method %d-%d failed for "
|
||||
"peer %Y", type, vendor,
|
||||
this->ike_sa->get_other_id(this->ike_sa));
|
||||
}
|
||||
else
|
||||
{
|
||||
DBG1(DBG_IKE, "EAP method %N failed for peer %Y",
|
||||
eap_type_names, type,
|
||||
this->ike_sa->get_other_id(this->ike_sa));
|
||||
}
|
||||
return eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Processing method for a peer
|
||||
*/
|
||||
static eap_payload_t* client_process_eap(private_eap_authenticator_t *this,
|
||||
eap_payload_t *in)
|
||||
{
|
||||
eap_type_t type;
|
||||
u_int32_t vendor;
|
||||
auth_cfg_t *auth;
|
||||
eap_payload_t *out;
|
||||
identification_t *id;
|
||||
|
||||
type = in->get_type(in, &vendor);
|
||||
|
||||
if (!vendor && type == EAP_IDENTITY)
|
||||
{
|
||||
DESTROY_IF(this->eap_identity);
|
||||
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
|
||||
id = auth->get(auth, AUTH_RULE_EAP_IDENTITY);
|
||||
if (!id || id->get_type(id) == ID_ANY)
|
||||
{
|
||||
id = this->ike_sa->get_my_id(this->ike_sa);
|
||||
}
|
||||
DBG1(DBG_IKE, "server requested %N (id 0x%02X), sending '%Y'",
|
||||
eap_type_names, type, in->get_identifier(in), id);
|
||||
this->eap_identity = id->clone(id);
|
||||
|
||||
this->method = load_method(this, type, vendor, EAP_PEER);
|
||||
if (this->method)
|
||||
{
|
||||
if (this->method->process(this->method, in, &out) == SUCCESS)
|
||||
{
|
||||
this->method->destroy(this->method);
|
||||
this->method = NULL;
|
||||
return out;
|
||||
}
|
||||
this->method->destroy(this->method);
|
||||
this->method = NULL;
|
||||
}
|
||||
DBG1(DBG_IKE, "%N not supported, sending EAP_NAK",
|
||||
eap_type_names, type);
|
||||
return eap_payload_create_nak(in->get_identifier(in));
|
||||
}
|
||||
if (this->method == NULL)
|
||||
{
|
||||
if (vendor)
|
||||
{
|
||||
DBG1(DBG_IKE, "server requested vendor specific EAP method %d-%d ",
|
||||
"(id 0x%02X)", type, vendor, in->get_identifier(in));
|
||||
}
|
||||
else
|
||||
{
|
||||
DBG1(DBG_IKE, "server requested %N authentication (id 0x%02X)",
|
||||
eap_type_names, type, in->get_identifier(in));
|
||||
}
|
||||
this->method = load_method(this, type, vendor, EAP_PEER);
|
||||
if (!this->method)
|
||||
{
|
||||
DBG1(DBG_IKE, "EAP method not supported, sending EAP_NAK");
|
||||
return eap_payload_create_nak(in->get_identifier(in));
|
||||
}
|
||||
}
|
||||
|
||||
type = this->method->get_type(this->method, &vendor);
|
||||
|
||||
if (this->method->process(this->method, in, &out) == NEED_MORE)
|
||||
{ /* client methods should never return SUCCESS */
|
||||
return out;
|
||||
}
|
||||
|
||||
if (vendor)
|
||||
{
|
||||
DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed", type, vendor);
|
||||
}
|
||||
else
|
||||
{
|
||||
DBG1(DBG_IKE, "%N method failed", eap_type_names, type);
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/**
|
||||
* Verify AUTH payload
|
||||
*/
|
||||
static bool verify_auth(private_eap_authenticator_t *this, message_t *message,
|
||||
chunk_t nonce, chunk_t init)
|
||||
{
|
||||
auth_payload_t *auth_payload;
|
||||
chunk_t auth_data, recv_auth_data;
|
||||
identification_t *other_id;
|
||||
auth_cfg_t *auth;
|
||||
keymat_v2_t *keymat;
|
||||
|
||||
auth_payload = (auth_payload_t*)message->get_payload(message,
|
||||
AUTHENTICATION);
|
||||
if (!auth_payload)
|
||||
{
|
||||
DBG1(DBG_IKE, "AUTH payload missing");
|
||||
return FALSE;
|
||||
}
|
||||
other_id = this->ike_sa->get_other_id(this->ike_sa);
|
||||
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
|
||||
auth_data = keymat->get_psk_sig(keymat, TRUE, init, nonce,
|
||||
this->msk, other_id, this->reserved);
|
||||
recv_auth_data = auth_payload->get_data(auth_payload);
|
||||
if (!auth_data.len || !chunk_equals(auth_data, recv_auth_data))
|
||||
{
|
||||
DBG1(DBG_IKE, "verification of AUTH payload with%s EAP MSK failed",
|
||||
this->msk.ptr ? "" : "out");
|
||||
chunk_free(&auth_data);
|
||||
return FALSE;
|
||||
}
|
||||
chunk_free(&auth_data);
|
||||
|
||||
DBG1(DBG_IKE, "authentication of '%Y' with %N successful",
|
||||
other_id, auth_class_names, AUTH_CLASS_EAP);
|
||||
this->auth_complete = TRUE;
|
||||
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
|
||||
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Build AUTH payload
|
||||
*/
|
||||
static void build_auth(private_eap_authenticator_t *this, message_t *message,
|
||||
chunk_t nonce, chunk_t init)
|
||||
{
|
||||
auth_payload_t *auth_payload;
|
||||
identification_t *my_id;
|
||||
chunk_t auth_data;
|
||||
keymat_v2_t *keymat;
|
||||
|
||||
my_id = this->ike_sa->get_my_id(this->ike_sa);
|
||||
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
|
||||
|
||||
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N",
|
||||
my_id, auth_class_names, AUTH_CLASS_EAP);
|
||||
|
||||
auth_data = keymat->get_psk_sig(keymat, FALSE, init, nonce,
|
||||
this->msk, my_id, this->reserved);
|
||||
auth_payload = auth_payload_create();
|
||||
auth_payload->set_auth_method(auth_payload, AUTH_PSK);
|
||||
auth_payload->set_data(auth_payload, auth_data);
|
||||
message->add_payload(message, (payload_t*)auth_payload);
|
||||
chunk_free(&auth_data);
|
||||
}
|
||||
|
||||
METHOD(authenticator_t, process_server, status_t,
|
||||
private_eap_authenticator_t *this, message_t *message)
|
||||
{
|
||||
eap_payload_t *eap_payload;
|
||||
|
||||
if (this->eap_complete)
|
||||
{
|
||||
if (!verify_auth(this, message, this->sent_nonce, this->received_init))
|
||||
{
|
||||
return FAILED;
|
||||
}
|
||||
return NEED_MORE;
|
||||
}
|
||||
|
||||
if (!this->method)
|
||||
{
|
||||
this->eap_payload = server_initiate_eap(this, TRUE);
|
||||
}
|
||||
else
|
||||
{
|
||||
eap_payload = (eap_payload_t*)message->get_payload(message,
|
||||
EXTENSIBLE_AUTHENTICATION);
|
||||
if (!eap_payload)
|
||||
{
|
||||
return FAILED;
|
||||
}
|
||||
this->eap_payload = server_process_eap(this, eap_payload);
|
||||
}
|
||||
return NEED_MORE;
|
||||
}
|
||||
|
||||
METHOD(authenticator_t, build_server, status_t,
|
||||
private_eap_authenticator_t *this, message_t *message)
|
||||
{
|
||||
if (this->eap_payload)
|
||||
{
|
||||
eap_code_t code;
|
||||
|
||||
code = this->eap_payload->get_code(this->eap_payload);
|
||||
message->add_payload(message, (payload_t*)this->eap_payload);
|
||||
this->eap_payload = NULL;
|
||||
if (code == EAP_FAILURE)
|
||||
{
|
||||
return FAILED;
|
||||
}
|
||||
return NEED_MORE;
|
||||
}
|
||||
if (this->eap_complete && this->auth_complete)
|
||||
{
|
||||
build_auth(this, message, this->received_nonce, this->sent_init);
|
||||
return SUCCESS;
|
||||
}
|
||||
return FAILED;
|
||||
}
|
||||
|
||||
METHOD(authenticator_t, process_client, status_t,
|
||||
private_eap_authenticator_t *this, message_t *message)
|
||||
{
|
||||
eap_payload_t *eap_payload;
|
||||
|
||||
if (this->eap_complete)
|
||||
{
|
||||
if (!verify_auth(this, message, this->sent_nonce, this->received_init))
|
||||
{
|
||||
return FAILED;
|
||||
}
|
||||
if (this->require_mutual && !this->method->is_mutual(this->method))
|
||||
{ /* we require mutual authentication due to EAP-only */
|
||||
u_int32_t vendor;
|
||||
|
||||
DBG1(DBG_IKE, "EAP-only authentication requires a mutual and "
|
||||
"MSK deriving EAP method, but %N is not",
|
||||
eap_type_names, this->method->get_type(this->method, &vendor));
|
||||
return FAILED;
|
||||
}
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
eap_payload = (eap_payload_t*)message->get_payload(message,
|
||||
EXTENSIBLE_AUTHENTICATION);
|
||||
if (eap_payload)
|
||||
{
|
||||
switch (eap_payload->get_code(eap_payload))
|
||||
{
|
||||
case EAP_REQUEST:
|
||||
{
|
||||
this->eap_payload = client_process_eap(this, eap_payload);
|
||||
if (this->eap_payload)
|
||||
{
|
||||
return NEED_MORE;
|
||||
}
|
||||
return FAILED;
|
||||
}
|
||||
case EAP_SUCCESS:
|
||||
{
|
||||
eap_type_t type;
|
||||
u_int32_t vendor;
|
||||
auth_cfg_t *cfg;
|
||||
|
||||
if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
|
||||
{
|
||||
this->msk = chunk_clone(this->msk);
|
||||
}
|
||||
type = this->method->get_type(this->method, &vendor);
|
||||
if (vendor)
|
||||
{
|
||||
DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeeded, "
|
||||
"%sMSK established", type, vendor,
|
||||
this->msk.ptr ? "" : "no ");
|
||||
}
|
||||
else
|
||||
{
|
||||
DBG1(DBG_IKE, "EAP method %N succeeded, %sMSK established",
|
||||
eap_type_names, type, this->msk.ptr ? "" : "no ");
|
||||
}
|
||||
cfg = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
|
||||
cfg->add(cfg, AUTH_RULE_EAP_TYPE, type);
|
||||
if (vendor)
|
||||
{
|
||||
cfg->add(cfg, AUTH_RULE_EAP_VENDOR, vendor);
|
||||
}
|
||||
this->eap_complete = TRUE;
|
||||
return NEED_MORE;
|
||||
}
|
||||
case EAP_FAILURE:
|
||||
default:
|
||||
{
|
||||
DBG1(DBG_IKE, "received %N, EAP authentication failed",
|
||||
eap_code_names, eap_payload->get_code(eap_payload));
|
||||
return FAILED;
|
||||
}
|
||||
}
|
||||
}
|
||||
return FAILED;
|
||||
}
|
||||
|
||||
METHOD(authenticator_t, build_client, status_t,
|
||||
private_eap_authenticator_t *this, message_t *message)
|
||||
{
|
||||
if (this->eap_payload)
|
||||
{
|
||||
message->add_payload(message, (payload_t*)this->eap_payload);
|
||||
this->eap_payload = NULL;
|
||||
return NEED_MORE;
|
||||
}
|
||||
if (this->eap_complete)
|
||||
{
|
||||
build_auth(this, message, this->received_nonce, this->sent_init);
|
||||
return NEED_MORE;
|
||||
}
|
||||
return NEED_MORE;
|
||||
}
|
||||
|
||||
METHOD(authenticator_t, is_mutual, bool,
|
||||
private_eap_authenticator_t *this)
|
||||
{
|
||||
/* we don't know yet, but insist on it after EAP is complete */
|
||||
this->require_mutual = TRUE;
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
METHOD(authenticator_t, destroy, void,
|
||||
private_eap_authenticator_t *this)
|
||||
{
|
||||
DESTROY_IF(this->method);
|
||||
DESTROY_IF(this->eap_payload);
|
||||
DESTROY_IF(this->eap_identity);
|
||||
chunk_free(&this->msk);
|
||||
free(this);
|
||||
}
|
||||
|
||||
/*
|
||||
* Described in header.
|
||||
*/
|
||||
eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
chunk_t received_nonce, chunk_t sent_nonce,
|
||||
chunk_t received_init, chunk_t sent_init,
|
||||
char reserved[3])
|
||||
{
|
||||
private_eap_authenticator_t *this;
|
||||
|
||||
INIT(this,
|
||||
.public = {
|
||||
.authenticator = {
|
||||
.build = _build_client,
|
||||
.process = _process_client,
|
||||
.is_mutual = _is_mutual,
|
||||
.destroy = _destroy,
|
||||
},
|
||||
},
|
||||
.ike_sa = ike_sa,
|
||||
.received_init = received_init,
|
||||
.received_nonce = received_nonce,
|
||||
.sent_init = sent_init,
|
||||
.sent_nonce = sent_nonce,
|
||||
);
|
||||
memcpy(this->reserved, reserved, sizeof(this->reserved));
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
/*
|
||||
* Described in header.
|
||||
*/
|
||||
eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
|
||||
chunk_t received_nonce, chunk_t sent_nonce,
|
||||
chunk_t received_init, chunk_t sent_init,
|
||||
char reserved[3])
|
||||
{
|
||||
private_eap_authenticator_t *this;
|
||||
|
||||
INIT(this,
|
||||
.public = {
|
||||
.authenticator = {
|
||||
.build = _build_server,
|
||||
.process = _process_server,
|
||||
.is_mutual = _is_mutual,
|
||||
.destroy = _destroy,
|
||||
},
|
||||
},
|
||||
.ike_sa = ike_sa,
|
||||
.received_init = received_init,
|
||||
.received_nonce = received_nonce,
|
||||
.sent_init = sent_init,
|
||||
.sent_nonce = sent_nonce,
|
||||
);
|
||||
memcpy(this->reserved, reserved, sizeof(this->reserved));
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
@@ -0,0 +1,102 @@
|
||||
/*
|
||||
* Copyright (C) 2006-2009 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @defgroup eap_authenticator eap_authenticator
|
||||
* @{ @ingroup authenticators
|
||||
*/
|
||||
|
||||
#ifndef EAP_AUTHENTICATOR_H_
|
||||
#define EAP_AUTHENTICATOR_H_
|
||||
|
||||
typedef struct eap_authenticator_t eap_authenticator_t;
|
||||
|
||||
#include <sa/authenticator.h>
|
||||
|
||||
/**
|
||||
* Implementation of authenticator_t using EAP authentication.
|
||||
*
|
||||
* Authentication using EAP involves the most complex authenticator. It stays
|
||||
* alive over multiple ike_auth transactions and handles multiple EAP
|
||||
* messages.
|
||||
*
|
||||
* @verbatim
|
||||
ike_sa_init
|
||||
------------------------->
|
||||
<-------------------------
|
||||
followed by multiple ike_auth:
|
||||
|
||||
+--------+ +--------+
|
||||
| EAP | IDi, [IDr,] SA, TS | EAP |
|
||||
| client | ---------------------------> | server |
|
||||
| | ID, AUTH, EAP | |
|
||||
| | <--------------------------- | |
|
||||
| | EAP | |
|
||||
| | ---------------------------> | |
|
||||
| | EAP | |
|
||||
| | <--------------------------- | |
|
||||
| | EAP | |
|
||||
| | ---------------------------> | |
|
||||
| | EAP(SUCCESS) | |
|
||||
| | <--------------------------- | |
|
||||
| | AUTH | | If EAP establishes
|
||||
| | ---------------------------> | | a session key, AUTH
|
||||
| | AUTH, SA, TS | | payloads use this
|
||||
| | <--------------------------- | | key, not SK_pi/pr
|
||||
+--------+ +--------+
|
||||
|
||||
@endverbatim
|
||||
*/
|
||||
struct eap_authenticator_t {
|
||||
|
||||
/**
|
||||
* Implemented authenticator_t interface.
|
||||
*/
|
||||
authenticator_t authenticator;
|
||||
};
|
||||
|
||||
/**
|
||||
* Create an authenticator to authenticate against an EAP server.
|
||||
*
|
||||
* @param ike_sa associated ike_sa
|
||||
* @param received_nonce nonce received in IKE_SA_INIT
|
||||
* @param sent_nonce nonce sent in IKE_SA_INIT
|
||||
* @param received_init received IKE_SA_INIT message data
|
||||
* @param sent_init sent IKE_SA_INIT message data
|
||||
* @param reserved reserved bytes of ID payload
|
||||
* @return EAP authenticator
|
||||
*/
|
||||
eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
chunk_t received_nonce, chunk_t sent_nonce,
|
||||
chunk_t received_init, chunk_t sent_init,
|
||||
char reserved[3]);
|
||||
|
||||
/**
|
||||
* Create an authenticator to authenticate EAP clients.
|
||||
*
|
||||
* @param ike_sa associated ike_sa
|
||||
* @param received_nonce nonce received in IKE_SA_INIT
|
||||
* @param sent_nonce nonce sent in IKE_SA_INIT
|
||||
* @param received_init received IKE_SA_INIT message data
|
||||
* @param sent_init sent IKE_SA_INIT message data
|
||||
* @param reserved reserved bytes of ID payload
|
||||
* @return EAP authenticator
|
||||
*/
|
||||
eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
|
||||
chunk_t received_nonce, chunk_t sent_nonce,
|
||||
chunk_t received_init, chunk_t sent_init,
|
||||
char reserved[3]);
|
||||
|
||||
#endif /** EAP_AUTHENTICATOR_H_ @}*/
|
||||
@@ -0,0 +1,204 @@
|
||||
/*
|
||||
* Copyright (C) 2005-2009 Martin Willi
|
||||
* Copyright (C) 2005 Jan Hutter
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
#include "psk_authenticator.h"
|
||||
|
||||
#include <daemon.h>
|
||||
#include <encoding/payloads/auth_payload.h>
|
||||
#include <sa/ikev2/keymat_v2.h>
|
||||
|
||||
typedef struct private_psk_authenticator_t private_psk_authenticator_t;
|
||||
|
||||
/**
|
||||
* Private data of an psk_authenticator_t object.
|
||||
*/
|
||||
struct private_psk_authenticator_t {
|
||||
|
||||
/**
|
||||
* Public authenticator_t interface.
|
||||
*/
|
||||
psk_authenticator_t public;
|
||||
|
||||
/**
|
||||
* Assigned IKE_SA
|
||||
*/
|
||||
ike_sa_t *ike_sa;
|
||||
|
||||
/**
|
||||
* nonce to include in AUTH calculation
|
||||
*/
|
||||
chunk_t nonce;
|
||||
|
||||
/**
|
||||
* IKE_SA_INIT message data to include in AUTH calculation
|
||||
*/
|
||||
chunk_t ike_sa_init;
|
||||
|
||||
/**
|
||||
* Reserved bytes of ID payload
|
||||
*/
|
||||
char reserved[3];
|
||||
};
|
||||
|
||||
METHOD(authenticator_t, build, status_t,
|
||||
private_psk_authenticator_t *this, message_t *message)
|
||||
{
|
||||
identification_t *my_id, *other_id;
|
||||
auth_payload_t *auth_payload;
|
||||
shared_key_t *key;
|
||||
chunk_t auth_data;
|
||||
keymat_v2_t *keymat;
|
||||
|
||||
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
|
||||
my_id = this->ike_sa->get_my_id(this->ike_sa);
|
||||
other_id = this->ike_sa->get_other_id(this->ike_sa);
|
||||
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N",
|
||||
my_id, auth_method_names, AUTH_PSK);
|
||||
key = lib->credmgr->get_shared(lib->credmgr, SHARED_IKE, my_id, other_id);
|
||||
if (key == NULL)
|
||||
{
|
||||
DBG1(DBG_IKE, "no shared key found for '%Y' - '%Y'", my_id, other_id);
|
||||
return NOT_FOUND;
|
||||
}
|
||||
auth_data = keymat->get_psk_sig(keymat, FALSE, this->ike_sa_init,
|
||||
this->nonce, key->get_key(key), my_id, this->reserved);
|
||||
key->destroy(key);
|
||||
DBG2(DBG_IKE, "successfully created shared key MAC");
|
||||
auth_payload = auth_payload_create();
|
||||
auth_payload->set_auth_method(auth_payload, AUTH_PSK);
|
||||
auth_payload->set_data(auth_payload, auth_data);
|
||||
chunk_free(&auth_data);
|
||||
message->add_payload(message, (payload_t*)auth_payload);
|
||||
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
METHOD(authenticator_t, process, status_t,
|
||||
private_psk_authenticator_t *this, message_t *message)
|
||||
{
|
||||
chunk_t auth_data, recv_auth_data;
|
||||
identification_t *my_id, *other_id;
|
||||
auth_payload_t *auth_payload;
|
||||
auth_cfg_t *auth;
|
||||
shared_key_t *key;
|
||||
enumerator_t *enumerator;
|
||||
bool authenticated = FALSE;
|
||||
int keys_found = 0;
|
||||
keymat_v2_t *keymat;
|
||||
|
||||
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
|
||||
if (!auth_payload)
|
||||
{
|
||||
return FAILED;
|
||||
}
|
||||
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
|
||||
recv_auth_data = auth_payload->get_data(auth_payload);
|
||||
my_id = this->ike_sa->get_my_id(this->ike_sa);
|
||||
other_id = this->ike_sa->get_other_id(this->ike_sa);
|
||||
enumerator = lib->credmgr->create_shared_enumerator(lib->credmgr,
|
||||
SHARED_IKE, my_id, other_id);
|
||||
while (!authenticated && enumerator->enumerate(enumerator, &key, NULL, NULL))
|
||||
{
|
||||
keys_found++;
|
||||
|
||||
auth_data = keymat->get_psk_sig(keymat, TRUE, this->ike_sa_init,
|
||||
this->nonce, key->get_key(key), other_id, this->reserved);
|
||||
if (auth_data.len && chunk_equals(auth_data, recv_auth_data))
|
||||
{
|
||||
DBG1(DBG_IKE, "authentication of '%Y' with %N successful",
|
||||
other_id, auth_method_names, AUTH_PSK);
|
||||
authenticated = TRUE;
|
||||
}
|
||||
chunk_free(&auth_data);
|
||||
}
|
||||
enumerator->destroy(enumerator);
|
||||
|
||||
if (!authenticated)
|
||||
{
|
||||
if (keys_found == 0)
|
||||
{
|
||||
DBG1(DBG_IKE, "no shared key found for '%Y' - '%Y'", my_id, other_id);
|
||||
return NOT_FOUND;
|
||||
}
|
||||
DBG1(DBG_IKE, "tried %d shared key%s for '%Y' - '%Y', but MAC mismatched",
|
||||
keys_found, keys_found == 1 ? "" : "s", my_id, other_id);
|
||||
return FAILED;
|
||||
}
|
||||
|
||||
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
|
||||
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
|
||||
return SUCCESS;
|
||||
}
|
||||
|
||||
METHOD(authenticator_t, destroy, void,
|
||||
private_psk_authenticator_t *this)
|
||||
{
|
||||
free(this);
|
||||
}
|
||||
|
||||
/*
|
||||
* Described in header.
|
||||
*/
|
||||
psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
chunk_t received_nonce, chunk_t sent_init,
|
||||
char reserved[3])
|
||||
{
|
||||
private_psk_authenticator_t *this;
|
||||
|
||||
INIT(this,
|
||||
.public = {
|
||||
.authenticator = {
|
||||
.build = _build,
|
||||
.process = (void*)return_failed,
|
||||
.is_mutual = (void*)return_false,
|
||||
.destroy = _destroy,
|
||||
},
|
||||
},
|
||||
.ike_sa = ike_sa,
|
||||
.ike_sa_init = sent_init,
|
||||
.nonce = received_nonce,
|
||||
);
|
||||
memcpy(this->reserved, reserved, sizeof(this->reserved));
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
/*
|
||||
* Described in header.
|
||||
*/
|
||||
psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
|
||||
chunk_t sent_nonce, chunk_t received_init,
|
||||
char reserved[3])
|
||||
{
|
||||
private_psk_authenticator_t *this;
|
||||
|
||||
INIT(this,
|
||||
.public = {
|
||||
.authenticator = {
|
||||
.build = (void*)return_failed,
|
||||
.process = _process,
|
||||
.is_mutual = (void*)return_false,
|
||||
.destroy = _destroy,
|
||||
},
|
||||
},
|
||||
.ike_sa = ike_sa,
|
||||
.ike_sa_init = received_init,
|
||||
.nonce = sent_nonce,
|
||||
);
|
||||
memcpy(this->reserved, reserved, sizeof(this->reserved));
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
/*
|
||||
* Copyright (C) 2006-2009 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @defgroup psk_authenticator psk_authenticator
|
||||
* @{ @ingroup authenticators
|
||||
*/
|
||||
|
||||
#ifndef PSK_AUTHENTICATOR_H_
|
||||
#define PSK_AUTHENTICATOR_H_
|
||||
|
||||
typedef struct psk_authenticator_t psk_authenticator_t;
|
||||
|
||||
#include <sa/authenticator.h>
|
||||
|
||||
/**
|
||||
* Implementation of authenticator_t using pre-shared keys.
|
||||
*/
|
||||
struct psk_authenticator_t {
|
||||
|
||||
/**
|
||||
* Implemented authenticator_t interface.
|
||||
*/
|
||||
authenticator_t authenticator;
|
||||
};
|
||||
|
||||
/**
|
||||
* Create an authenticator to build PSK signatures.
|
||||
*
|
||||
* @param ike_sa associated ike_sa
|
||||
* @param received_nonce nonce received in IKE_SA_INIT
|
||||
* @param sent_init sent IKE_SA_INIT message data
|
||||
* @param reserved reserved bytes of ID payload
|
||||
* @return PSK authenticator
|
||||
*/
|
||||
psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
chunk_t received_nonce, chunk_t sent_init,
|
||||
char reserved[3]);
|
||||
|
||||
/**
|
||||
* Create an authenticator to verify PSK signatures.
|
||||
*
|
||||
* @param ike_sa associated ike_sa
|
||||
* @param sent_nonce nonce sent in IKE_SA_INIT
|
||||
* @param received_init received IKE_SA_INIT message data
|
||||
* @param reserved reserved bytes of ID payload
|
||||
* @return PSK authenticator
|
||||
*/
|
||||
psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
|
||||
chunk_t sent_nonce, chunk_t received_init,
|
||||
char reserved[3]);
|
||||
|
||||
#endif /** PSK_AUTHENTICATOR_H_ @}*/
|
||||
@@ -0,0 +1,269 @@
|
||||
/*
|
||||
* Copyright (C) 2008 Tobias Brunner
|
||||
* Copyright (C) 2005-2009 Martin Willi
|
||||
* Copyright (C) 2005 Jan Hutter
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
#include "pubkey_authenticator.h"
|
||||
|
||||
#include <daemon.h>
|
||||
#include <encoding/payloads/auth_payload.h>
|
||||
#include <sa/ikev2/keymat_v2.h>
|
||||
|
||||
typedef struct private_pubkey_authenticator_t private_pubkey_authenticator_t;
|
||||
|
||||
/**
|
||||
* Private data of an pubkey_authenticator_t object.
|
||||
*/
|
||||
struct private_pubkey_authenticator_t {
|
||||
|
||||
/**
|
||||
* Public authenticator_t interface.
|
||||
*/
|
||||
pubkey_authenticator_t public;
|
||||
|
||||
/**
|
||||
* Assigned IKE_SA
|
||||
*/
|
||||
ike_sa_t *ike_sa;
|
||||
|
||||
/**
|
||||
* nonce to include in AUTH calculation
|
||||
*/
|
||||
chunk_t nonce;
|
||||
|
||||
/**
|
||||
* IKE_SA_INIT message data to include in AUTH calculation
|
||||
*/
|
||||
chunk_t ike_sa_init;
|
||||
|
||||
/**
|
||||
* Reserved bytes of ID payload
|
||||
*/
|
||||
char reserved[3];
|
||||
};
|
||||
|
||||
METHOD(authenticator_t, build, status_t,
|
||||
private_pubkey_authenticator_t *this, message_t *message)
|
||||
{
|
||||
chunk_t octets, auth_data;
|
||||
status_t status = FAILED;
|
||||
private_key_t *private;
|
||||
identification_t *id;
|
||||
auth_cfg_t *auth;
|
||||
auth_payload_t *auth_payload;
|
||||
auth_method_t auth_method;
|
||||
signature_scheme_t scheme;
|
||||
keymat_v2_t *keymat;
|
||||
|
||||
id = this->ike_sa->get_my_id(this->ike_sa);
|
||||
auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
|
||||
private = lib->credmgr->get_private(lib->credmgr, KEY_ANY, id, auth);
|
||||
if (private == NULL)
|
||||
{
|
||||
DBG1(DBG_IKE, "no private key found for '%Y'", id);
|
||||
return NOT_FOUND;
|
||||
}
|
||||
|
||||
switch (private->get_type(private))
|
||||
{
|
||||
case KEY_RSA:
|
||||
/* we currently use always SHA1 for signatures,
|
||||
* TODO: support other hashes depending on configuration/auth */
|
||||
scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
|
||||
auth_method = AUTH_RSA;
|
||||
break;
|
||||
case KEY_ECDSA:
|
||||
/* we try to deduct the signature scheme from the keysize */
|
||||
switch (private->get_keysize(private))
|
||||
{
|
||||
case 256:
|
||||
scheme = SIGN_ECDSA_256;
|
||||
auth_method = AUTH_ECDSA_256;
|
||||
break;
|
||||
case 384:
|
||||
scheme = SIGN_ECDSA_384;
|
||||
auth_method = AUTH_ECDSA_384;
|
||||
break;
|
||||
case 521:
|
||||
scheme = SIGN_ECDSA_521;
|
||||
auth_method = AUTH_ECDSA_521;
|
||||
break;
|
||||
default:
|
||||
DBG1(DBG_IKE, "%d bit ECDSA private key size not supported",
|
||||
private->get_keysize(private));
|
||||
return status;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
DBG1(DBG_IKE, "private key of type %N not supported",
|
||||
key_type_names, private->get_type(private));
|
||||
return status;
|
||||
}
|
||||
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
|
||||
octets = keymat->get_auth_octets(keymat, FALSE, this->ike_sa_init,
|
||||
this->nonce, id, this->reserved);
|
||||
if (private->sign(private, scheme, octets, &auth_data))
|
||||
{
|
||||
auth_payload = auth_payload_create();
|
||||
auth_payload->set_auth_method(auth_payload, auth_method);
|
||||
auth_payload->set_data(auth_payload, auth_data);
|
||||
chunk_free(&auth_data);
|
||||
message->add_payload(message, (payload_t*)auth_payload);
|
||||
status = SUCCESS;
|
||||
}
|
||||
DBG1(DBG_IKE, "authentication of '%Y' (myself) with %N %s", id,
|
||||
auth_method_names, auth_method,
|
||||
(status == SUCCESS)? "successful":"failed");
|
||||
chunk_free(&octets);
|
||||
private->destroy(private);
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
METHOD(authenticator_t, process, status_t,
|
||||
private_pubkey_authenticator_t *this, message_t *message)
|
||||
{
|
||||
public_key_t *public;
|
||||
auth_method_t auth_method;
|
||||
auth_payload_t *auth_payload;
|
||||
chunk_t auth_data, octets;
|
||||
identification_t *id;
|
||||
auth_cfg_t *auth, *current_auth;
|
||||
enumerator_t *enumerator;
|
||||
key_type_t key_type = KEY_ECDSA;
|
||||
signature_scheme_t scheme;
|
||||
status_t status = NOT_FOUND;
|
||||
keymat_v2_t *keymat;
|
||||
|
||||
auth_payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
|
||||
if (!auth_payload)
|
||||
{
|
||||
return FAILED;
|
||||
}
|
||||
auth_method = auth_payload->get_auth_method(auth_payload);
|
||||
switch (auth_method)
|
||||
{
|
||||
case AUTH_RSA:
|
||||
/* We currently accept SHA1 signatures only
|
||||
* TODO: allow other hash algorithms and note it in "auth" */
|
||||
key_type = KEY_RSA;
|
||||
scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
|
||||
break;
|
||||
case AUTH_ECDSA_256:
|
||||
scheme = SIGN_ECDSA_256;
|
||||
break;
|
||||
case AUTH_ECDSA_384:
|
||||
scheme = SIGN_ECDSA_384;
|
||||
break;
|
||||
case AUTH_ECDSA_521:
|
||||
scheme = SIGN_ECDSA_521;
|
||||
break;
|
||||
default:
|
||||
return INVALID_ARG;
|
||||
}
|
||||
auth_data = auth_payload->get_data(auth_payload);
|
||||
id = this->ike_sa->get_other_id(this->ike_sa);
|
||||
keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
|
||||
octets = keymat->get_auth_octets(keymat, TRUE, this->ike_sa_init,
|
||||
this->nonce, id, this->reserved);
|
||||
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
|
||||
enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
|
||||
key_type, id, auth);
|
||||
while (enumerator->enumerate(enumerator, &public, ¤t_auth))
|
||||
{
|
||||
if (public->verify(public, scheme, octets, auth_data))
|
||||
{
|
||||
DBG1(DBG_IKE, "authentication of '%Y' with %N successful",
|
||||
id, auth_method_names, auth_method);
|
||||
status = SUCCESS;
|
||||
auth->merge(auth, current_auth, FALSE);
|
||||
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
|
||||
break;
|
||||
}
|
||||
else
|
||||
{
|
||||
status = FAILED;
|
||||
DBG1(DBG_IKE, "signature validation failed, looking for another key");
|
||||
}
|
||||
}
|
||||
enumerator->destroy(enumerator);
|
||||
chunk_free(&octets);
|
||||
if (status == NOT_FOUND)
|
||||
{
|
||||
DBG1(DBG_IKE, "no trusted %N public key found for '%Y'",
|
||||
key_type_names, key_type, id);
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
METHOD(authenticator_t, destroy, void,
|
||||
private_pubkey_authenticator_t *this)
|
||||
{
|
||||
free(this);
|
||||
}
|
||||
|
||||
/*
|
||||
* Described in header.
|
||||
*/
|
||||
pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
chunk_t received_nonce, chunk_t sent_init,
|
||||
char reserved[3])
|
||||
{
|
||||
private_pubkey_authenticator_t *this;
|
||||
|
||||
INIT(this,
|
||||
.public = {
|
||||
.authenticator = {
|
||||
.build = _build,
|
||||
.process = (void*)return_failed,
|
||||
.is_mutual = (void*)return_false,
|
||||
.destroy = _destroy,
|
||||
},
|
||||
},
|
||||
.ike_sa = ike_sa,
|
||||
.ike_sa_init = sent_init,
|
||||
.nonce = received_nonce,
|
||||
);
|
||||
memcpy(this->reserved, reserved, sizeof(this->reserved));
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
||||
/*
|
||||
* Described in header.
|
||||
*/
|
||||
pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
|
||||
chunk_t sent_nonce, chunk_t received_init,
|
||||
char reserved[3])
|
||||
{
|
||||
private_pubkey_authenticator_t *this;
|
||||
|
||||
INIT(this,
|
||||
.public = {
|
||||
.authenticator = {
|
||||
.build = (void*)return_failed,
|
||||
.process = _process,
|
||||
.is_mutual = (void*)return_false,
|
||||
.destroy = _destroy,
|
||||
},
|
||||
},
|
||||
.ike_sa = ike_sa,
|
||||
.ike_sa_init = received_init,
|
||||
.nonce = sent_nonce,
|
||||
);
|
||||
memcpy(this->reserved, reserved, sizeof(this->reserved));
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
/*
|
||||
* Copyright (C) 2008 Tobias Brunner
|
||||
* Copyright (C) 2006-2009 Martin Willi
|
||||
* Hochschule fuer Technik Rapperswil
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @defgroup pubkey_authenticator pubkey_authenticator
|
||||
* @{ @ingroup authenticators
|
||||
*/
|
||||
|
||||
#ifndef PUBKEY_AUTHENTICATOR_H_
|
||||
#define PUBKEY_AUTHENTICATOR_H_
|
||||
|
||||
typedef struct pubkey_authenticator_t pubkey_authenticator_t;
|
||||
|
||||
#include <sa/authenticator.h>
|
||||
|
||||
/**
|
||||
* Implementation of authenticator_t using public key authenitcation.
|
||||
*/
|
||||
struct pubkey_authenticator_t {
|
||||
|
||||
/**
|
||||
* Implemented authenticator_t interface.
|
||||
*/
|
||||
authenticator_t authenticator;
|
||||
};
|
||||
|
||||
/**
|
||||
* Create an authenticator to build public key signatures.
|
||||
*
|
||||
* @param ike_sa associated ike_sa
|
||||
* @param received_nonce nonce received in IKE_SA_INIT
|
||||
* @param sent_init sent IKE_SA_INIT message data
|
||||
* @param reserved reserved bytes of ID payload
|
||||
* @return public key authenticator
|
||||
*/
|
||||
pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
|
||||
chunk_t received_nonce, chunk_t sent_init,
|
||||
char reserved[3]);
|
||||
|
||||
/**
|
||||
* Create an authenticator to verify public key signatures.
|
||||
*
|
||||
* @param ike_sa associated ike_sa
|
||||
* @param sent_nonce nonce sent in IKE_SA_INIT
|
||||
* @param received_init received IKE_SA_INIT message data
|
||||
* @param reserved reserved bytes of ID payload
|
||||
* @return public key authenticator
|
||||
*/
|
||||
pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
|
||||
chunk_t sent_nonce, chunk_t received_init,
|
||||
char reserved[3]);
|
||||
|
||||
#endif /** PUBKEY_AUTHENTICATOR_H_ @}*/
|
||||
Reference in New Issue
Block a user