denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bus: Add new hooks for derived IKE_SA and CHILD_SA keys

Browse Source
This commit is contained in:
Tobias Brunner
2016-10-04 10:01:49 +02:00
parent a28c6269a4
commit f5fe0ffa2a
3 changed files with 131 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/bus/bus.c
+68 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2011-2015 Tobias Brunner
* Copyright (C) 2011-2016 Tobias Brunner
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
*
@@ -601,6 +601,38 @@ METHOD(bus_t, ike_keys, void,
this->mutex->unlock(this->mutex);
}
METHOD(bus_t, ike_derived_keys, void,
private_bus_t *this, chunk_t sk_ei, chunk_t sk_er, chunk_t sk_ai,
chunk_t sk_ar)
{
enumerator_t *enumerator;
ike_sa_t *ike_sa;
entry_t *entry;
bool keep;
ike_sa = this->thread_sa->get(this->thread_sa);
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
{
if (entry->calling || !entry->listener->ike_derived_keys)
{
continue;
}
entry->calling++;
keep = entry->listener->ike_derived_keys(entry->listener, ike_sa, sk_ei,
sk_er, sk_ai, sk_ar);
entry->calling--;
if (!keep)
{
unregister_listener(this, entry, enumerator);
}
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
}
METHOD(bus_t, child_keys, void,
private_bus_t *this, child_sa_t *child_sa, bool initiator,
diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r)
@@ -633,6 +665,39 @@ METHOD(bus_t, child_keys, void,
this->mutex->unlock(this->mutex);
}
METHOD(bus_t, child_derived_keys, void,
private_bus_t *this, child_sa_t *child_sa, bool initiator,
chunk_t encr_i, chunk_t encr_r, chunk_t integ_i, chunk_t integ_r)
{
enumerator_t *enumerator;
ike_sa_t *ike_sa;
entry_t *entry;
bool keep;
ike_sa = this->thread_sa->get(this->thread_sa);
this->mutex->lock(this->mutex);
enumerator = this->listeners->create_enumerator(this->listeners);
while (enumerator->enumerate(enumerator, &entry))
{
if (entry->calling || !entry->listener->child_derived_keys)
{
continue;
}
entry->calling++;
keep = entry->listener->child_derived_keys(entry->listener, ike_sa,
child_sa, initiator, encr_i, encr_r,
integ_i, integ_r);
entry->calling--;
if (!keep)
{
unregister_listener(this, entry, enumerator);
}
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
}
METHOD(bus_t, child_updown, void,
private_bus_t *this, child_sa_t *child_sa, bool up)
{
@@ -1069,7 +1134,9 @@ bus_t *bus_create()
.child_state_change = _child_state_change,
.message = _message,
.ike_keys = _ike_keys,
.ike_derived_keys = _ike_derived_keys,
.child_keys = _child_keys,
.child_derived_keys = _child_derived_keys,
.ike_updown = _ike_updown,
.ike_rekey = _ike_rekey,
.ike_update = _ike_update,
src/libcharon/bus/bus.h
+30 -5
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2012-2015 Tobias Brunner
* Copyright (C) 2012-2016 Tobias Brunner
* Copyright (C) 2006-2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
@@ -349,8 +349,8 @@ struct bus_t {
* @param ike_sa IKE_SA this keymat belongs to
* @param dh diffie hellman shared secret
* @param dh_other others DH public value (IKEv1 only)
* @param nonce_i initiators nonce
* @param nonce_r responders nonce
* @param nonce_i initiator's nonce
* @param nonce_r responder's nonce
* @param rekey IKE_SA we are rekeying, if any (IKEv2 only)
* @param shared shared key used for key derivation (IKEv1-PSK only)
*/
@@ -358,18 +358,43 @@ struct bus_t {
chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r,
ike_sa_t *rekey, shared_key_t *shared);
/**
* IKE_SA derived keys hook.
*
* @param sk_ei SK_ei, or Ka for IKEv1
* @param sk_er SK_er
* @param sk_ai SK_ai, or SKEYID_a for IKEv1
* @param sk_ar SK_ar
*/
void (*ike_derived_keys)(bus_t *this, chunk_t sk_ei, chunk_t sk_er,
chunk_t sk_ai, chunk_t sk_ar);
/**
* CHILD_SA keymat hook.
*
* @param child_sa CHILD_SA this keymat is used for
* @param initiator initiator of the CREATE_CHILD_SA exchange
* @param dh diffie hellman shared secret
* @param nonce_i initiators nonce
* @param nonce_r responders nonce
* @param nonce_i initiator's nonce
* @param nonce_r responder's nonce
*/
void (*child_keys)(bus_t *this, child_sa_t *child_sa, bool initiator,
diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r);
/**
* CHILD_SA derived keys hook.
*
* @param child_sa CHILD_SA these keys are used for
* @param initiator initiator of the CREATE_CHILD_SA exchange
* @param encr_i initiator's encryption key
* @param encr_o responder's encryption key
* @param integ_i initiator's integrity key
* @param integ_r responder's integrity key
*/
void (*child_derived_keys)(bus_t *this, child_sa_t *child_sa,
bool initiator, chunk_t encr_i, chunk_t encr_r,
chunk_t integ_i, chunk_t integ_r);
/**
* IKE_SA up/down hook.
*
src/libcharon/bus/listeners/listener.h
+33 -5
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2011-2015 Tobias Brunner
* Copyright (C) 2011-2016 Tobias Brunner
* Copyright (C) 2009 Martin Willi
* Hochschule fuer Technik Rapperswil
*
@@ -84,8 +84,8 @@ struct listener_t {
* @param ike_sa IKE_SA this keymat belongs to
* @param dh diffie hellman shared secret
* @param dh_other others DH public value (IKEv1 only)
* @param nonce_i initiators nonce
* @param nonce_r responders nonce
* @param nonce_i initiator's nonce
* @param nonce_r responder's nonce
* @param rekey IKE_SA we are rekeying, if any (IKEv2 only)
* @param shared shared key used for key derivation (IKEv1-PSK only)
* @return TRUE to stay registered, FALSE to unregister
@@ -94,6 +94,18 @@ struct listener_t {
chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r,
ike_sa_t *rekey, shared_key_t *shared);
/**
* Hook called with derived IKE_SA keys.
*
* @param ike_sa IKE_SA these keys belong to
* @param sk_ei SK_ei, or Ka for IKEv1
* @param sk_er SK_er
* @param sk_ai SK_ai, or SKEYID_a for IKEv1
* @param sk_ar SK_ar
*/
bool (*ike_derived_keys)(listener_t *this, ike_sa_t *ike_sa, chunk_t sk_ei,
chunk_t sk_er, chunk_t sk_ai, chunk_t sk_ar);
/**
* Hook called with CHILD_SA key material.
*
@@ -101,14 +113,30 @@ struct listener_t {
* @param child_sa CHILD_SA this keymat is used for
* @param initiator initiator of the CREATE_CHILD_SA exchange
* @param dh diffie hellman shared secret
* @param nonce_i initiators nonce
* @param nonce_r responders nonce
* @param nonce_i initiator's nonce
* @param nonce_r responder's nonce
* @return TRUE to stay registered, FALSE to unregister
*/
bool (*child_keys)(listener_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
bool initiator, diffie_hellman_t *dh,
chunk_t nonce_i, chunk_t nonce_r);
/**
* Hook called with derived CHILD_SA keys.
*
* @param ike_sa IKE_SA the child sa belongs to
* @param child_sa CHILD_SA these keys are used for
* @param initiator initiator of the CREATE_CHILD_SA exchange
* @param encr_i initiator's encryption key
* @param encr_o responder's encryption key
* @param integ_i initiator's integrity key
* @param integ_r responder's integrity key
*/
bool (*child_derived_keys)(listener_t *this, ike_sa_t *ike_sa,
child_sa_t *child_sa, bool initiator,
chunk_t encr_i, chunk_t encr_r,
chunk_t integ_i, chunk_t integ_r);
/**
* Hook called if an IKE_SA gets up or down.
*