denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merged EAP framework from branch into trunk

Browse Source 
includes a lot of other modifications
This commit is contained in:
Martin Willi
2007-02-12 15:56:47 +00:00
parent 6fda18d99d
commit f27f6296e6
64 changed files with 8538 additions and 481 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/encoding/generator.c
+2 -2
View File
@@ -738,7 +738,7 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
case SPIS:
case CONFIGURATION_ATTRIBUTE_VALUE:
case VID_DATA:
case EAP_MESSAGE:
case EAP_DATA:
{
u_int32_t payload_length_position_offset;
u_int16_t length_of_payload;
@@ -777,7 +777,7 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
case CONFIGURATION_ATTRIBUTE_VALUE:
header_length = CONFIGURATION_ATTRIBUTE_HEADER_LENGTH;
break;
case EAP_MESSAGE:
case EAP_DATA:
header_length = EAP_PAYLOAD_HEADER_LENGTH;
break;
default:
src/charon/encoding/message.c
+8 -6
View File
@@ -142,11 +142,12 @@ static payload_rule_t ike_sa_init_r_payload_rules[] = {
*/
static payload_rule_t ike_auth_i_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,FALSE},
{EXTENSIBLE_AUTHENTICATION,0,1,TRUE,TRUE},
{AUTHENTICATION,0,1,TRUE,TRUE},
{ID_INITIATOR,1,1,TRUE,FALSE},
{CERTIFICATE,0,1,TRUE,FALSE},
{CERTIFICATE_REQUEST,0,1,TRUE,FALSE},
{ID_RESPONDER,0,1,TRUE,FALSE},
{AUTHENTICATION,1,1,TRUE,FALSE},
{SECURITY_ASSOCIATION,1,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_INITIATOR,1,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_RESPONDER,1,1,TRUE,FALSE},
@@ -158,12 +159,13 @@ static payload_rule_t ike_auth_i_payload_rules[] = {
*/
static payload_rule_t ike_auth_r_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,TRUE},
{EXTENSIBLE_AUTHENTICATION,0,1,TRUE,TRUE},
{CERTIFICATE,0,1,TRUE,FALSE},
{ID_RESPONDER,1,1,TRUE,FALSE},
{AUTHENTICATION,1,1,TRUE,FALSE},
{SECURITY_ASSOCIATION,1,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_INITIATOR,1,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_RESPONDER,1,1,TRUE,FALSE},
{ID_RESPONDER,0,1,TRUE,FALSE},
{AUTHENTICATION,0,1,TRUE,FALSE},
{SECURITY_ASSOCIATION,0,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_INITIATOR,0,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_RESPONDER,0,1,TRUE,FALSE},
{CONFIGURATION,0,1,TRUE,FALSE},
};
src/charon/encoding/parser.c
+26 -26
View File
@@ -626,7 +626,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case U_INT_32:
{
@@ -635,7 +635,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case U_INT_64:
{
@@ -644,7 +644,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case IKE_SPI:
{
@@ -653,7 +653,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case RESERVED_BIT:
{
@@ -662,7 +662,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case RESERVED_BYTE:
{
@@ -680,7 +680,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case PAYLOAD_LENGTH:
{
@@ -690,7 +690,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
return PARSE_ERROR;
}
payload_length = *(u_int16_t*)(output + rule->offset);
break;
break;
}
case HEADER_LENGTH:
{
@@ -699,7 +699,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case SPI_SIZE:
{
@@ -709,7 +709,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
return PARSE_ERROR;
}
spi_size = *(u_int8_t*)(output + rule->offset);
break;
break;
}
case SPI:
{
@@ -718,7 +718,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case PROPOSALS:
{
@@ -728,7 +728,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case TRANSFORMS:
{
@@ -738,7 +738,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case TRANSFORM_ATTRIBUTES:
{
@@ -748,7 +748,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case CONFIGURATION_ATTRIBUTES:
{
@@ -758,7 +758,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case ATTRIBUTE_FORMAT:
{
@@ -789,7 +789,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
}
attribute_length = *(u_int16_t*)(output + rule->offset);
break;
}
}
case ATTRIBUTE_LENGTH_OR_VALUE:
{
if (this->parse_uint16(this, rule_number, output + rule->offset) != SUCCESS)
@@ -820,7 +820,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case ID_DATA:
{
@@ -830,7 +830,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
pld->destroy(pld);
return PARSE_ERROR;
}
break;
break;
}
case AUTH_DATA:
{
@@ -839,8 +839,8 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
{
pld->destroy(pld);
return PARSE_ERROR;
}
break;
}
break;
}
case CERT_DATA:
{
@@ -849,8 +849,8 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
{
pld->destroy(pld);
return PARSE_ERROR;
}
break;
}
break;
}
case CERTREQ_DATA:
{
@@ -859,18 +859,18 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
{
pld->destroy(pld);
return PARSE_ERROR;
}
break;
}
break;
}
case EAP_MESSAGE:
case EAP_DATA:
{
size_t data_length = payload_length - EAP_PAYLOAD_HEADER_LENGTH;
if (this->parse_chunk(this, rule_number, output + rule->offset, data_length) != SUCCESS)
{
pld->destroy(pld);
return PARSE_ERROR;
}
break;
}
break;
}
case SPIS:
{
src/charon/encoding/payloads/eap_payload.c
+144 -41
View File
@@ -25,6 +25,7 @@
#include "eap_payload.h"
#include <daemon.h>
typedef struct private_eap_payload_t private_eap_payload_t;
@@ -54,9 +55,9 @@ struct private_eap_payload_t {
u_int16_t payload_length;
/**
* The contained message.
* EAP message data, if available
*/
chunk_t message;
chunk_t data;
};
/**
@@ -80,21 +81,21 @@ encoding_rule_t eap_payload_encodings[] = {
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
/* Length of the whole payload*/
{ PAYLOAD_LENGTH, offsetof(private_eap_payload_t, payload_length)},
/* some eap data bytes, length is defined in PAYLOAD_LENGTH */
{ EAP_MESSAGE, offsetof(private_eap_payload_t, message) }
{ PAYLOAD_LENGTH, offsetof(private_eap_payload_t, payload_length) },
/* chunt to data, starting at "code" */
{ EAP_DATA, offsetof(private_eap_payload_t, data) },
};
/*
1 2 3
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload !C! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! !
~ EAP Message ~
! !
! Code ! Identifier ! Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Type ! Type_Data...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
*/
/**
@@ -102,6 +103,47 @@ encoding_rule_t eap_payload_encodings[] = {
*/
static status_t verify(private_eap_payload_t *this)
{
u_int16_t length;
u_int8_t code;
if (this->data.len < 4)
{
DBG1(DBG_ENC, "EAP payloads EAP message too short (%d)", this->data.len);
return FAILED;
}
code = *this->data.ptr;
length = htons(*(u_int16_t*)(this->data.ptr + 2));
if (this->data.len != length)
{
DBG1(DBG_ENC, "EAP payload length (%d) does not match contained message length (%d)",
this->data.len, length);
return FAILED;
}
switch (code)
{
case EAP_REQUEST:
case EAP_RESPONSE:
{
if (this->data.len < 4)
{
DBG1(DBG_ENC, "EAP Request/Response does not have any data");
return FAILED;
}
break;
}
case EAP_SUCCESS:
case EAP_FAILURE:
{
if (this->data.len != 4)
{
DBG1(DBG_ENC, "EAP Success/Failure has data");
return FAILED;
}
break;
}
default:
return FAILED;
}
return SUCCESS;
}
@@ -147,40 +189,59 @@ static size_t get_length(private_eap_payload_t *this)
}
/**
* Implementation of eap_payload_t.set_message.
* Implementation of eap_payload_t.get_data.
*/
static void set_message (private_eap_payload_t *this, chunk_t message)
static chunk_t get_data(private_eap_payload_t *this)
{
if (this->message.ptr != NULL)
{
chunk_free(&(this->message));
}
this->message.ptr = clalloc(message.ptr,message.len);
this->message.len = message.len;
this->payload_length = EAP_PAYLOAD_HEADER_LENGTH + this->message.len;
return this->data;
}
/**
* Implementation of eap_payload_t.get_message.
* Implementation of eap_payload_t.set_data.
*/
static chunk_t get_message (private_eap_payload_t *this)
static void set_data(private_eap_payload_t *this, chunk_t data)
{
return (this->message);
chunk_free(&this->data);
this->data = chunk_clone(data);
this->payload_length = this->data.len + 4;
}
/**
* Implementation of eap_payload_t.get_data_clone.
* Implementation of eap_payload_t.get_code.
*/
static chunk_t get_message_clone (private_eap_payload_t *this)
static eap_code_t get_code(private_eap_payload_t *this)
{
chunk_t cloned_message;
if (this->message.ptr == NULL)
if (this->data.len > 0)
{
return (this->message);
return *this->data.ptr;
}
cloned_message.ptr = clalloc(this->message.ptr,this->message.len);
cloned_message.len = this->message.len;
return cloned_message;
/* should not happen, as it is verified */
return 0;
}
/**
* Implementation of eap_payload_t.get_identifier.
*/
static u_int8_t get_identifier(private_eap_payload_t *this)
{
if (this->data.len > 1)
{
return *(this->data.ptr + 1);
}
/* should not happen, as it is verified */
return 0;
}
/**
* Implementation of eap_payload_t.get_type.
*/
static eap_type_t get_type(private_eap_payload_t *this)
{
if (this->data.len > 4)
{
return *(this->data.ptr + 4);
}
return 0;
}
/**
@@ -188,12 +249,8 @@ static chunk_t get_message_clone (private_eap_payload_t *this)
*/
static void destroy(private_eap_payload_t *this)
{
if (this->message.ptr != NULL)
{
chunk_free(&(this->message));
}
free(this);
chunk_free(&this->data);
free(this);
}
/*
@@ -202,7 +259,7 @@ static void destroy(private_eap_payload_t *this)
eap_payload_t *eap_payload_create()
{
private_eap_payload_t *this = malloc_thing(private_eap_payload_t);
/* interface functions */
this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
@@ -214,15 +271,61 @@ eap_payload_t *eap_payload_create()
/* public functions */
this->public.destroy = (void (*) (eap_payload_t *)) destroy;
this->public.set_message = (void (*) (eap_payload_t *,chunk_t)) set_message;
this->public.get_message_clone = (chunk_t (*) (eap_payload_t *)) get_message_clone;
this->public.get_message = (chunk_t (*) (eap_payload_t *)) get_message;
this->public.get_data = (chunk_t (*) (eap_payload_t*))get_data;
this->public.set_data = (void (*) (eap_payload_t *,chunk_t))set_data;
this->public.get_code = (eap_code_t (*) (eap_payload_t*))get_code;
this->public.get_identifier = (u_int8_t (*) (eap_payload_t*))get_identifier;
this->public.get_type = (eap_type_t (*) (eap_payload_t*))get_type;
/* private variables */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
this->payload_length = EAP_PAYLOAD_HEADER_LENGTH;
this->message = chunk_empty;
this->data = chunk_empty;
return &(this->public);
}
return (&(this->public));
/*
* Described in header
*/
eap_payload_t *eap_payload_create_data(chunk_t data)
{
eap_payload_t *this = eap_payload_create();
this->set_data(this, data);
return this;
}
/*
* Described in header
*/
eap_payload_t *eap_payload_create_code(eap_code_t code)
{
eap_payload_t *this = eap_payload_create();
chunk_t data = chunk_alloca(4);
*(data.ptr + 0) = code;
*(data.ptr + 1) = 0;
*(u_int16_t*)(data.ptr + 2) = htons(data.len);
this->set_data(this, data);
return this;
}
/*
* Described in header
*/
eap_payload_t *eap_payload_create_nak()
{
eap_payload_t *this = eap_payload_create();
chunk_t data = chunk_alloca(5);
*(data.ptr + 0) = EAP_RESPONSE;
*(data.ptr + 1) = 0;
*(u_int16_t*)(data.ptr + 2) = htons(data.len);
*(data.ptr + 4) = EAP_NAK;
this->set_data(this, data);
return this;
}
src/charon/encoding/payloads/eap_payload.h
+67 -23
View File
@@ -28,6 +28,7 @@ typedef struct eap_payload_t eap_payload_t;
#include <library.h>
#include <encoding/payloads/payload.h>
#include <sa/authenticators/eap/eap_method.h>
/**
* Length of a EAP payload without the EAP Message in bytes.
@@ -44,62 +45,105 @@ typedef struct eap_payload_t eap_payload_t;
* @b Constructors:
* - eap_payload_create()
*
* @todo Implement functionality for this payload
*
* @ingroup payloads
*/
struct eap_payload_t {
/**
* The payload_t interface.
*/
payload_t payload_interface;
/**
* @brief Set the EAP Message.
*
* Data are getting cloned.
* @brief Set the contained EAP data.
*
* @param this calling eap_payload_t object
* @param message EAP message as chunk_t
* This contains the FULL EAP message starting with "code".
* Chunk gets cloned.
*
* @param this calling eap_payload_t object
* @param message EAP data
*/
void (*set_message) (eap_payload_t *this, chunk_t message);
void (*set_data) (eap_payload_t *this, chunk_t data);
/**
* @brief Get the EAP message.
*
* Returned data are a copy of the internal one.
* @brief Get the contained EAP data.
*
* @param this calling eap_payload_t object
* @return EAP message as chunk_t
* This contains the FULL EAP message starting with "code".
*
* @param this calling eap_payload_t object
* @return EAP data (pointer to internal data)
*/
chunk_t (*get_message_clone) (eap_payload_t *this);
chunk_t (*get_data) (eap_payload_t *this);
/**
* @brief Get the EAP message.
*
* Returned data are NOT copied.
* @brief Get the EAP code.
*
* @param this calling eap_payload_t object
* @return EAP message as chunk_t
* @param this calling eap_payload_t object
* @return EAP message as chunk_t
*/
chunk_t (*get_message) (eap_payload_t *this);
eap_code_t (*get_code) (eap_payload_t *this);
/**
* @brief Get the EAP identifier.
*
* @param this calling eap_payload_t object
* @return unique identifier
*/
u_int8_t (*get_identifier) (eap_payload_t *this);
/**
* @brief Get the EAP method type.
*
* @param this calling eap_payload_t object
* @return EAP method type
*/
eap_type_t (*get_type) (eap_payload_t *this);
/**
* @brief Destroys an eap_payload_t object.
*
* @param this eap_payload_t object to destroy
* @param this eap_payload_t object to destroy
*/
void (*destroy) (eap_payload_t *this);
};
/**
* @brief Creates an empty eap_payload_t object.
*
*
* @return eap_payload_t object
*
*
* @ingroup payloads
*/
eap_payload_t *eap_payload_create(void);
/**
* @brief Creates an eap_payload_t object with data.
*
* @return eap_payload_t object
*
* @ingroup payloads
*/
eap_payload_t *eap_payload_create_data(chunk_t data);
/**
* @brief Creates an eap_payload_t object with a code.
*
* Could should be either EAP_SUCCESS/EAP_FAILURE, use
* constructor above otherwise.
*
* @return eap_payload_t object
*
* @ingroup payloads
*/
eap_payload_t *eap_payload_create_code(eap_code_t code);
/**
* @brief Creates an eap_payload_t EAP_RESPONSE containing an EAP_NAK.
*
* @return eap_payload_t object
*
* @ingroup payloads
*/
eap_payload_t *eap_payload_create_nak();
#endif /* EAP_PAYLOAD_H_ */
src/charon/encoding/payloads/encodings.h
+1 -1
View File
@@ -449,7 +449,7 @@ enum encoding_type_t {
*
* When parsing (Payload Length - 4) bytes are read and written into the chunk pointing to.
*/
EAP_MESSAGE,
EAP_DATA,
/**
* Representating the SPIS field in a DELETE payload.
src/charon/encoding/payloads/notify_payload.c
+3 -1
View File
@@ -75,7 +75,9 @@ ENUM_NEXT(notify_type_names, INITIAL_CONTACT, AUTH_LIFETIME, INVALID_SELECTORS,
"COOKIE2",
"NO_NATS_ALLOWED",
"AUTH_LIFETIME");
ENUM_END(notify_type_names, AUTH_LIFETIME);
ENUM_NEXT(notify_type_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, AUTH_LIFETIME,
"EAP_ONLY_AUTHENTICATION");
ENUM_END(notify_type_names, EAP_ONLY_AUTHENTICATION);
typedef struct private_notify_payload_t private_notify_payload_t;
src/charon/encoding/payloads/notify_payload.h
+3 -1
View File
@@ -88,8 +88,10 @@ enum notify_type_t {
NO_NATS_ALLOWED = 16402,
/* repeated authentication extension, RFC4478 */
AUTH_LIFETIME = 16403,
/* draft-eronen-ipsec-ikev2-eap-auth, not assigned by IANA yet */
EAP_ONLY_AUTHENTICATION = 40960,
/* BEET mode, not even a draft yet. private use */
USE_BEET_MODE = 40960,
USE_BEET_MODE = 40961,
};
/**