denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- refactored ike proposal

Browse Source 
- uses now proposal_t, wich is also used by child proposals
- ike key derivation refactored
- crypter_t api has get_key_size now
- some other improvements here and there
This commit is contained in:
Martin Willi
2006-02-14 14:52:00 +00:00
parent 409d010131
commit ce461bbd13
43 changed files with 967 additions and 1278 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Source/charon/encoding/payloads/notify_payload.c
+15 -1
View File
@@ -180,8 +180,22 @@ static status_t verify(private_notify_payload_t *this)
return FAILED;
}
/* notify message types and data is not getting checked in here */
/* TODO: Check all kinds of notify */
if (this->notify_message_type == INVALID_KE_PAYLOAD)
{
/* check notification data */
diffie_hellman_group_t dh_group;
if (this->notification_data.len != 2)
{
return FAILED;
}
dh_group = ntohs(*((u_int16_t*)this->notification_data.ptr));
if (dh_group < MODP_1024_BIT || dh_group > MODP_8192_BIT)
{
return FAILED;
}
}
return SUCCESS;
}
Source/charon/encoding/payloads/proposal_substructure.c
+4 -4
View File
@@ -406,9 +406,9 @@ static size_t get_spi_size (private_proposal_substructure_t *this)
}
/**
* Implementation of proposal_substructure_t.add_to_child_proposal.
* Implementation of proposal_substructure_t.add_to_proposal.
*/
void add_to_child_proposal(private_proposal_substructure_t *this, child_proposal_t *proposal)
void add_to_proposal(private_proposal_substructure_t *this, proposal_t *proposal)
{
iterator_t *iterator = this->transforms->create_iterator(this->transforms, TRUE);
@@ -525,7 +525,7 @@ proposal_substructure_t *proposal_substructure_create()
this->public.get_protocol_id = (u_int8_t (*) (proposal_substructure_t *)) get_protocol_id;
this->public.get_info_for_transform_type = (status_t (*) (proposal_substructure_t *,transform_type_t,u_int16_t *, u_int16_t *))get_info_for_transform_type;
this->public.set_is_last_proposal = (void (*) (proposal_substructure_t *,bool)) set_is_last_proposal;
this->public.add_to_child_proposal = (void (*) (proposal_substructure_t*,child_proposal_t*))add_to_child_proposal;
this->public.add_to_proposal = (void (*) (proposal_substructure_t*,proposal_t*))add_to_proposal;
this->public.set_spi = (void (*) (proposal_substructure_t *,chunk_t))set_spi;
this->public.get_spi = (chunk_t (*) (proposal_substructure_t *)) get_spi;
this->public.get_transform_count = (size_t (*) (proposal_substructure_t *)) get_transform_count;
@@ -554,7 +554,7 @@ proposal_substructure_t *proposal_substructure_create()
/*
* Described in header.
*/
proposal_substructure_t *proposal_substructure_create_from_child_proposal(child_proposal_t *proposal, protocol_id_t proto)
proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *proposal, protocol_id_t proto)
{
private_proposal_substructure_t *this = (private_proposal_substructure_t*)proposal_substructure_create();
iterator_t *iterator;
Source/charon/encoding/payloads/proposal_substructure.h
+4 -4
View File
@@ -26,7 +26,7 @@
#include <types.h>
#include <encoding/payloads/payload.h>
#include <encoding/payloads/transform_substructure.h>
#include <config/child_proposal.h>
#include <config/proposal.h>
#include <utils/linked_list.h>
@@ -173,7 +173,7 @@ struct proposal_substructure_t {
*/
void (*set_spi) (proposal_substructure_t *this, chunk_t spi);
void (*add_to_child_proposal) (proposal_substructure_t *this, child_proposal_t *proposal);
void (*add_to_proposal) (proposal_substructure_t *this, proposal_t *proposal);
/**
* @brief Clones an proposal_substructure_t object.
@@ -201,7 +201,7 @@ struct proposal_substructure_t {
proposal_substructure_t *proposal_substructure_create();
/**
* @brief Creates a proposal substructure from a child_proposal.
* @brief Creates a proposal substructure from a proposal.
*
* Since a child proposal may contain data for both AH and ESP,
* the protocol must be specified. If the proposal does not contain
@@ -215,7 +215,7 @@ proposal_substructure_t *proposal_substructure_create();
*
* @ingroup payloads
*/
proposal_substructure_t *proposal_substructure_create_from_child_proposal(child_proposal_t *proposal, protocol_id_t proto);
proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *proposal, protocol_id_t proto);
#endif /*PROPOSAL_SUBSTRUCTURE_H_*/
Source/charon/encoding/payloads/sa_payload.c
+15 -193
View File
@@ -257,9 +257,9 @@ static void add_proposal_substructure (private_sa_payload_t *this,proposal_subst
}
/**
* Implementation of sa_payload_t.add_child_proposal.
* Implementation of sa_payload_t.add_proposal.
*/
static void add_child_proposal(private_sa_payload_t *this, child_proposal_t *proposal)
static void add_proposal(private_sa_payload_t *this, proposal_t *proposal)
{
proposal_substructure_t *substructure;
protocol_id_t proto[2];
@@ -271,161 +271,26 @@ static void add_child_proposal(private_sa_payload_t *this, child_proposal_t *pro
{
if (proto[i] != UNDEFINED_PROTOCOL_ID)
{
substructure = proposal_substructure_create_from_child_proposal(proposal, proto[i]);
substructure = proposal_substructure_create_from_proposal(proposal, proto[i]);
add_proposal_substructure(this, substructure);
}
}
}
/**
* Implementation of sa_payload_t.get_ike_proposals.
* Implementation of sa_payload_t.get_proposals.
*/
static status_t get_ike_proposals (private_sa_payload_t *this,ike_proposal_t ** proposals, size_t *proposal_count)
{
int found_ike_proposals = 0;
int current_proposal_number = 0;
iterator_t *iterator;
ike_proposal_t *tmp_proposals;
iterator = this->proposals->create_iterator(this->proposals,TRUE);
/* first find out the number of ike proposals and check their number of transforms and
* if the SPI is empty!*/
while (iterator->has_next(iterator))
{
proposal_substructure_t *current_proposal;
iterator->current(iterator,(void **)&(current_proposal));
if (current_proposal->get_protocol_id(current_proposal) == IKE)
{
/* a ike proposal consists of an empty spi*/
if (current_proposal->get_spi_size(current_proposal) != 0)
{
iterator->destroy(iterator);
return FAILED;
}
found_ike_proposals++;
}
}
iterator->reset(iterator);
if (found_ike_proposals == 0)
{
iterator->destroy(iterator);
return NOT_FOUND;
}
/* allocate memory to hold each proposal as ike_proposal_t */
tmp_proposals = allocator_alloc(found_ike_proposals * sizeof(ike_proposal_t));
/* create from each proposal_substructure a ike_proposal_t data area*/
while (iterator->has_next(iterator))
{
proposal_substructure_t *current_proposal;
iterator->current(iterator,(void **)&(current_proposal));
if (current_proposal->get_protocol_id(current_proposal) == IKE)
{
bool encryption_algorithm_found = FALSE;
bool integrity_algorithm_found = FALSE;
bool pseudo_random_function_found = FALSE;
bool diffie_hellman_group_found = FALSE;
status_t status;
iterator_t *transforms;
transforms = current_proposal->create_transform_substructure_iterator(current_proposal,TRUE);
while (transforms->has_next(transforms))
{
transform_substructure_t *current_transform;
transforms->current(transforms,(void **)&(current_transform));
switch (current_transform->get_transform_type(current_transform))
{
case ENCRYPTION_ALGORITHM:
{
tmp_proposals[current_proposal_number].encryption_algorithm = current_transform->get_transform_id(current_transform);
status = current_transform->get_key_length(current_transform,&(tmp_proposals[current_proposal_number].encryption_algorithm_key_length));
if (status == SUCCESS)
{
encryption_algorithm_found = TRUE;
}
break;
}
case INTEGRITY_ALGORITHM:
{
tmp_proposals[current_proposal_number].integrity_algorithm = current_transform->get_transform_id(current_transform);
status = current_transform->get_key_length(current_transform,&(tmp_proposals[current_proposal_number].integrity_algorithm_key_length));
if (status == SUCCESS)
{
integrity_algorithm_found = TRUE;
}
break;
}
case PSEUDO_RANDOM_FUNCTION:
{
tmp_proposals[current_proposal_number].pseudo_random_function = current_transform->get_transform_id(current_transform);
status = current_transform->get_key_length(current_transform,&(tmp_proposals[current_proposal_number].pseudo_random_function_key_length));
if (status == SUCCESS)
{
pseudo_random_function_found = TRUE;
}
break;
}
case DIFFIE_HELLMAN_GROUP:
{
tmp_proposals[current_proposal_number].diffie_hellman_group = current_transform->get_transform_id(current_transform);
diffie_hellman_group_found = TRUE;
break;
}
default:
{
/* not a transform of an ike proposal. Break here */
break;
}
}
}
transforms->destroy(transforms);
if ((!encryption_algorithm_found) ||
(!integrity_algorithm_found) ||
(!pseudo_random_function_found) ||
(!diffie_hellman_group_found))
{
/* one of needed transforms could not be found */
iterator->reset(iterator);
allocator_free(tmp_proposals);
return FAILED;
}
current_proposal_number++;
}
}
iterator->destroy(iterator);
*proposals = tmp_proposals;
*proposal_count = found_ike_proposals;
return SUCCESS;
}
/**
* Implementation of sa_payload_t.get_child_proposals.
*/
static linked_list_t *get_child_proposals(private_sa_payload_t *this)
static linked_list_t *get_proposals(private_sa_payload_t *this)
{
int proposal_struct_number = 0;
iterator_t *iterator;
child_proposal_t *proposal;
proposal_t *proposal;
linked_list_t *proposal_list;
/* this list will hold our proposals */
proposal_list = linked_list_create();
/* iterate over structures, one OR MORE structures will result in a child_proposal */
/* iterate over structures, one OR MORE structures will result in a proposal */
iterator = this->proposals->create_iterator(this->proposals,TRUE);
while (iterator->has_next(iterator))
{
@@ -436,11 +301,11 @@ static linked_list_t *get_child_proposals(private_sa_payload_t *this)
{
/* here starts a new proposal, create a new one and add it to the list */
proposal_struct_number = proposal_struct->get_proposal_number(proposal_struct);
proposal = child_proposal_create(proposal_struct_number);
proposal = proposal_create(proposal_struct_number);
proposal_list->insert_last(proposal_list, proposal);
}
/* proposal_substructure_t does the dirty work and builds up the proposal */
proposal_struct->add_to_child_proposal(proposal_struct, proposal);
proposal_struct->add_to_proposal(proposal_struct, proposal);
}
iterator->destroy(iterator);
return proposal_list;
@@ -484,8 +349,7 @@ sa_payload_t *sa_payload_create()
/* public functions */
this->public.create_proposal_substructure_iterator = (iterator_t* (*) (sa_payload_t *,bool)) create_proposal_substructure_iterator;
this->public.add_proposal_substructure = (void (*) (sa_payload_t *,proposal_substructure_t *)) add_proposal_substructure;
this->public.get_ike_proposals = (status_t (*) (sa_payload_t *, ike_proposal_t **, size_t *)) get_ike_proposals;
this->public.get_child_proposals = (linked_list_t* (*) (sa_payload_t *)) get_child_proposals;
this->public.get_proposals = (linked_list_t* (*) (sa_payload_t *)) get_proposals;
this->public.destroy = (void (*) (sa_payload_t *)) destroy;
/* private functions */
@@ -503,52 +367,10 @@ sa_payload_t *sa_payload_create()
/*
* Described in header.
*/
sa_payload_t *sa_payload_create_from_ike_proposals(ike_proposal_t *proposals, size_t proposal_count)
{
int i;
sa_payload_t *sa_payload= sa_payload_create();
for (i = 0; i < proposal_count; i++)
{
proposal_substructure_t *proposal_substructure;
transform_substructure_t *encryption_algorithm;
transform_substructure_t *integrity_algorithm;
transform_substructure_t *pseudo_random_function;
transform_substructure_t *diffie_hellman_group;
/* create proposal substructure */
proposal_substructure = proposal_substructure_create();
proposal_substructure->set_protocol_id(proposal_substructure,IKE);
proposal_substructure->set_proposal_number(proposal_substructure,(i + 1));
/* create transform substructures to hold each specific transform for an ike proposal */
encryption_algorithm = transform_substructure_create_type(ENCRYPTION_ALGORITHM,proposals[i].encryption_algorithm,proposals[i].encryption_algorithm_key_length);
proposal_substructure->add_transform_substructure(proposal_substructure,encryption_algorithm);
pseudo_random_function = transform_substructure_create_type(PSEUDO_RANDOM_FUNCTION,proposals[i].pseudo_random_function,proposals[i].pseudo_random_function_key_length);
proposal_substructure->add_transform_substructure(proposal_substructure,pseudo_random_function);
integrity_algorithm = transform_substructure_create_type(INTEGRITY_ALGORITHM,proposals[i].integrity_algorithm,proposals[i].integrity_algorithm_key_length);
proposal_substructure->add_transform_substructure(proposal_substructure,integrity_algorithm);
diffie_hellman_group = transform_substructure_create_type(DIFFIE_HELLMAN_GROUP,proposals[i].diffie_hellman_group,0);
proposal_substructure->add_transform_substructure(proposal_substructure,diffie_hellman_group);
/* add proposal to sa payload */
sa_payload->add_proposal_substructure(sa_payload,proposal_substructure);
}
return sa_payload;
}
/*
* Described in header.
*/
sa_payload_t *sa_payload_create_from_child_proposal_list(linked_list_t *proposals)
sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals)
{
iterator_t *iterator;
child_proposal_t *proposal;
proposal_t *proposal;
sa_payload_t *sa_payload = sa_payload_create();
/* add every payload from the list */
@@ -556,7 +378,7 @@ sa_payload_t *sa_payload_create_from_child_proposal_list(linked_list_t *proposal
while (iterator->has_next(iterator))
{
iterator->current(iterator, (void**)&proposal);
add_child_proposal((private_sa_payload_t*)sa_payload, proposal);
add_proposal((private_sa_payload_t*)sa_payload, proposal);
}
iterator->destroy(iterator);
@@ -566,11 +388,11 @@ sa_payload_t *sa_payload_create_from_child_proposal_list(linked_list_t *proposal
/*
* Described in header.
*/
sa_payload_t *sa_payload_create_from_child_proposal(child_proposal_t *proposal)
sa_payload_t *sa_payload_create_from_proposal(proposal_t *proposal)
{
sa_payload_t *sa_payload = sa_payload_create();
add_child_proposal((private_sa_payload_t*)sa_payload, proposal);
add_proposal((private_sa_payload_t*)sa_payload, proposal);
return sa_payload;
}
Source/charon/encoding/payloads/sa_payload.h
+22 -31
View File
@@ -54,9 +54,9 @@ typedef struct sa_payload_t sa_payload_t;
* @b Constructors:
* - sa_payload_create()
* - sa_payload_create_from_ike_proposals()
* - sa_payload_create_from_child_proposal()
* - sa_payload_create_from_proposal()
*
* @todo Add support of algorithms without specified keylength in get_child_proposals and get_ike_proposals.
* @todo Add support of algorithms without specified keylength in get_proposals and get_ike_proposals.
*
* @ingroup payloads
*/
@@ -91,36 +91,20 @@ struct sa_payload_t {
* @param proposal proposal_substructure_t object to add
*/
void (*add_proposal_substructure) (sa_payload_t *this,proposal_substructure_t *proposal);
/**
* @brief Creates an array of ike_proposal_t's in this SA payload.
* @brief Gets the proposals in this payload as a list.
*
* An IKE proposal consist of transform of type ENCRYPTION_ALGORITHM,
* PSEUDO_RANDOM_FUNCTION, INTEGRITY_ALGORITHM and DIFFIE_HELLMAN_GROUP
*
* @param proposals the pointer to the first entry of ike_proposal_t's is set
* @param proposal_count the number of found proposals is written at this location
* @return
* - SUCCESS if an IKE proposal could be found
* - NOT_FOUND if no IKE proposal could be found
* - FAILED if a proposal does not contain all needed transforms
* for a IKE_PROPOSAL
* @return a list containing proposal_t s
*/
status_t (*get_ike_proposals) (sa_payload_t *this, ike_proposal_t **proposals, size_t *proposal_count);
/**
* @brief Creates an array of child_proposal_t's in this SA payload.
*
* @return a list containing child_proposal_t s
*/
linked_list_t *(*get_child_proposals) (sa_payload_t *this);
linked_list_t *(*get_proposals) (sa_payload_t *this);
/**
* @brief Add a child proposal (AH/ESP) to the payload.
*
* @param proposal child proposal to add to the payload
*/
void (*add_child_proposal) (sa_payload_t *this, child_proposal_t *proposal);
void (*add_proposal) (sa_payload_t *this, proposal_t *proposal);
/**
* @brief Destroys an sa_payload_t object.
@@ -140,19 +124,26 @@ struct sa_payload_t {
sa_payload_t *sa_payload_create();
/**
* @brief Creates a sa_payload_t object from array of ike_proposal_t's.
* @brief Creates a sa_payload_t object from a list of proposals.
*
* @return created sa_payload_t object
* @param proposals pointer to first proposal in array of type ike_proposal_t
* @param proposal_count number of ike_proposal_t's in array
* @param proposals list of proposals to build the payload from
* @return sa_payload_t object
*
* @ingroup payloads
*/
sa_payload_t *sa_payload_create_from_ike_proposals(ike_proposal_t *proposals, size_t proposal_count);
sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals);
sa_payload_t *sa_payload_create_from_child_proposal_list(linked_list_t *proposals);
sa_payload_t *sa_payload_create_from_child_proposal(child_proposal_t *proposal);
/**
* @brief Creates a sa_payload_t object from a single proposal.
*
* This is only for convenience. Use sa_payload_create_from_proposal_list
* if you want to add more than one proposal.
*
* @param proposal proposal from which the payload should be built.
* @return sa_payload_t object
*
* @ingroup payloads
*/
sa_payload_t *sa_payload_create_from_proposal(proposal_t *proposal);
#endif /*SA_PAYLOAD_H_*/
Source/charon/encoding/payloads/transform_substructure.h
+1 -1
View File
@@ -32,7 +32,7 @@
#include <transforms/signers/signer.h>
#include <transforms/prfs/prf.h>
#include <transforms/crypters/crypter.h>
#include <config/child_proposal.h>
#include <config/proposal.h>
/**