denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- added payload CERT

Browse Source 
- cleaned code of different states
- added additional notify handling
This commit is contained in:
Jan Hutter
2005-12-05 12:21:38 +00:00
parent 3ebebc5e96
commit f6ba78c370
29 changed files with 861 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Source/charon/sa/states/ike_auth_requested.c
+22 -9
View File
@@ -194,13 +194,33 @@ static status_t process_message(private_ike_auth_requested_t *this, message_t *i
if (notify_payload->get_protocol_id(notify_payload) != IKE)
{
this->logger->log(this->logger, ERROR | MORE, "Notify reply not for IKE protocol.");
this->logger->log(this->logger, ERROR | MORE, "Notify reply not for IKE protocol");
payloads->destroy(payloads);
return FAILED;
}
switch (notify_payload->get_notify_message_type(notify_payload))
{
case INVALID_SYNTAX:
{
this->logger->log(this->logger, ERROR, "Going to destroy IKE_SA");
payloads->destroy(payloads);
return DELETE_ME;
}
case AUTHENTICATION_FAILED:
{
this->logger->log(this->logger, ERROR, "Keys invalid?. Going to destroy IKE_SA");
payloads->destroy(payloads);
return DELETE_ME;
}
case SINGLE_PAIR_REQUIRED:
{
this->logger->log(this->logger, ERROR, "Please reconfigure CHILD_SA. Going to destroy IKE_SA");
payloads->destroy(payloads);
return DELETE_ME;
}
default:
{
/*
@@ -348,12 +368,11 @@ static status_t process_auth_payload(private_ike_auth_requested_t *this, auth_pa
{
authenticator_t *authenticator;
status_t status;
bool verified;
/* TODO VERIFY auth here */
authenticator = authenticator_create(this->ike_sa);
status = authenticator->verify_auth_data(authenticator,auth_payload,this->ike_sa_init_reply_data,this->sent_nonce,other_id_payload,FALSE,&verified);
status = authenticator->verify_auth_data(authenticator,auth_payload,this->ike_sa_init_reply_data,this->sent_nonce,other_id_payload,FALSE);
authenticator->destroy(authenticator);
if (status != SUCCESS)
{
@@ -361,12 +380,6 @@ static status_t process_auth_payload(private_ike_auth_requested_t *this, auth_pa
return FAILED;
}
if (!verified)
{
this->logger->log(this->logger, ERROR | MORE, "AUTH data could not be verified");
return FAILED;
}
this->logger->log(this->logger, CONTROL | MORE, "AUTH data verified");
return SUCCESS;
}
Source/charon/sa/states/ike_sa_init_requested.c
+7 -1
View File
@@ -251,10 +251,16 @@ static status_t process_message(private_ike_sa_init_requested_t *this, message_t
{
case NO_PROPOSAL_CHOSEN:
{
this->logger->log(this->logger, ERROR, "Peer didn't choose a proposal!!!");
this->logger->log(this->logger, ERROR, "Peer didn't choose a proposal!");
payloads->destroy(payloads);
return DELETE_ME;
}
case INVALID_MAJOR_VERSION:
{
this->logger->log(this->logger, ERROR, "Peer doesn't support IKEv2!");
payloads->destroy(payloads);
return DELETE_ME;
}
case INVALID_KE_PAYLOAD:
{
initiator_init_t *initiator_init_state;
Source/charon/sa/states/ike_sa_init_responded.c
+96 -10
View File
@@ -29,6 +29,7 @@
#include <encoding/payloads/sa_payload.h>
#include <encoding/payloads/id_payload.h>
#include <encoding/payloads/auth_payload.h>
#include <encoding/payloads/notify_payload.h>
#include <transforms/signers/signer.h>
#include <transforms/crypters/crypter.h>
#include <sa/states/ike_sa_established.h>
@@ -87,6 +88,15 @@ struct private_ike_sa_init_responded_t {
status_t (*build_sa_payload) (private_ike_sa_init_responded_t *this, sa_payload_t *request, message_t *response);
status_t (*build_auth_payload) (private_ike_sa_init_responded_t *this, auth_payload_t *request,id_payload_t *other_id_payload,id_payload_t *my_id_payload, message_t* response);
status_t (*build_ts_payload) (private_ike_sa_init_responded_t *this, bool ts_initiator, ts_payload_t *request, message_t *response);
/**
* Sends a IKE_AUTH reply with a notify payload.
*
* @param this calling object
* @param type type of notify message
* @param data data of notify message
*/
void (*send_notify_reply) (private_ike_sa_init_responded_t *this,notify_message_type_t type, chunk_t data);
};
/**
@@ -103,6 +113,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
auth_payload_t *auth_request;
sa_payload_t *sa_request;
ts_payload_t *tsi_request, *tsr_request;
notify_payload_t *notify_payload = NULL;
message_t *response;
exchange_type = request->get_exchange_type(request);
@@ -181,17 +192,54 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
tsr_request = (ts_payload_t*)payload;
break;
}
case NOTIFY:
{
notify_payload = (notify_payload_t *) payload;
break;
}
default:
{
this->logger->log(this->logger, ERROR, "Payload type %s not supported in state ike_auth_requested!", mapping_find(payload_type_m, payload->get_type(payload)));
payloads->destroy(payloads);
return FAILED;
return DELETE_ME;
}
}
}
/* iterator can be destroyed */
payloads->destroy(payloads);
if (notify_payload != NULL)
{
this->logger->log(this->logger, CONTROL|MORE, "Process notify type %s for protocol %s",
mapping_find(notify_message_type_m, notify_payload->get_notify_message_type(notify_payload)),
mapping_find(protocol_id_m, notify_payload->get_protocol_id(notify_payload)));
if (notify_payload->get_protocol_id(notify_payload) != IKE)
{
this->logger->log(this->logger, ERROR | MORE, "Notify not for IKE protocol.");
payloads->destroy(payloads);
return DELETE_ME;
}
switch (notify_payload->get_notify_message_type(notify_payload))
{
case SET_WINDOW_SIZE:
/*
* TODO Increase window size.
*/
case INITIAL_CONTACT:
/*
* TODO Delete existing IKE_SA's with other Identity.
*/
default:
{
this->logger->log(this->logger, CONTROL|MORE, "Handling of notify type %s not implemented",
notify_payload->get_notify_message_type(notify_payload));
}
}
}
/* build response */
this->ike_sa->build_message(this->ike_sa, IKE_AUTH, FALSE, &response);
@@ -351,25 +399,24 @@ static status_t build_auth_payload(private_ike_sa_init_responded_t *this, auth_p
authenticator_t *authenticator;
auth_payload_t *auth_reply;
status_t status;
bool verified;
authenticator = authenticator_create(this->ike_sa);
status = authenticator->verify_auth_data(authenticator,auth_request, this->ike_sa_init_request_data,this->sent_nonce,other_id_payload,TRUE,&verified);
status = authenticator->verify_auth_data(authenticator,auth_request, this->ike_sa_init_request_data,this->sent_nonce,other_id_payload,TRUE);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR, "Verification of AUTH payload returned status %s",mapping_find(status_m,status));
authenticator->destroy(authenticator);
/*
* Send notify message of type AUTHENTICATION_FAILED
*/
this->logger->log(this->logger, CONTROL | MORE, "Send notify message of type AUTHENTICATION_FAILED");
this->send_notify_reply (this,AUTHENTICATION_FAILED,CHUNK_INITIALIZER);
return status;
}
if (!verified)
{
this->logger->log(this->logger, ERROR, "Verification of AUTH failed.");
authenticator->destroy(authenticator);
return FAILED;
}
status = authenticator->compute_auth_data(authenticator,&auth_reply, this->ike_sa_init_response_data,this->received_nonce,my_id_payload,FALSE);
authenticator->destroy(authenticator);
@@ -431,6 +478,44 @@ static status_t build_ts_payload(private_ike_sa_init_responded_t *this, bool ts_
return status;
}
/**
* Implementation of private_responder_init_t.send_notify_reply.
*/
static void send_notify_reply (private_ike_sa_init_responded_t *this,notify_message_type_t type, chunk_t data)
{
notify_payload_t *payload;
message_t *response;
packet_t *packet;
status_t status;
this->logger->log(this->logger, CONTROL|MOST, "Going to build message with notify payload");
/* set up the reply */
this->ike_sa->build_message(this->ike_sa, IKE_AUTH, FALSE, &response);
payload = notify_payload_create_from_protocol_and_type(IKE,type);
if ((data.ptr != NULL) && (data.len > 0))
{
this->logger->log(this->logger, CONTROL|MOST, "Add Data to notify payload");
payload->set_notification_data(payload,data);
}
this->logger->log(this->logger, CONTROL|MOST, "Add Notify payload to message");
response->add_payload(response,(payload_t *) payload);
/* generate packet */
this->logger->log(this->logger, CONTROL|MOST, "Gnerate packet from message");
status = response->generate(response, NULL, NULL, &packet);
if (status != SUCCESS)
{
this->logger->log(this->logger, ERROR, "Could not generate packet from message");
return;
}
this->logger->log(this->logger, CONTROL|MOST, "Add packet to global send queue");
charon->send_queue->add(charon->send_queue, packet);
this->logger->log(this->logger, CONTROL|MOST, "Destroy message");
response->destroy(response);
}
/**
* Implements state_t.get_state
*/
@@ -475,6 +560,7 @@ ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa
this->build_sa_payload = build_sa_payload;
this->build_auth_payload = build_auth_payload;
this->build_ts_payload = build_ts_payload;
this->send_notify_reply = send_notify_reply;
/* private data */
this->ike_sa = ike_sa;
Source/charon/sa/states/initiator_init.c
+3 -2
View File
@@ -117,7 +117,8 @@ struct private_initiator_init_t {
void (*build_nonce_payload) (private_initiator_init_t *this, payload_t **payload);
/**
* Destroy function called internally of this class after state change succeeded.
* Destroy function called internally of this class after state change to state
* IKE_SA_INIT_REQUESTED succeeded.
*
* This destroy function does not destroy objects which were passed to the new state.
*
@@ -164,7 +165,7 @@ static status_t initiate_connection (private_initiator_init_t *this, char *name)
this->dh_group_number = init_config->get_dh_group_number(init_config,this->dh_group_priority);
if (this->dh_group_number == MODP_UNDEFINED)
{
this->logger->log(this->logger, ERROR | MORE, "Diffie hellman group could not be retrieved with priority %d", this->dh_group_priority);
this->logger->log(this->logger, ERROR | MORE, "Diffie hellman group could not be retrieved with priority %d", this->dh_group_priority);
return DELETE_ME;
}
Source/charon/sa/states/responder_init.c
+27 -2
View File
@@ -189,6 +189,7 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
{
/* no configuration matches given host */
this->logger->log(this->logger, ERROR | MORE, "No INIT configuration found for given remote and local hosts");
return DELETE_ME;
}
@@ -243,7 +244,7 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
{
this->logger->log(this->logger, ERROR | MORE, "No proposal of suggested proposals selected");
payloads->destroy(payloads);
this->send_notify_reply(this,NO_PROPOSAL_CHOSEN,CHUNK_INITIALIZER);
this->send_notify_reply(this,NO_PROPOSAL_CHOSEN,CHUNK_INITIALIZER);
return DELETE_ME;
}
@@ -258,7 +259,6 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
}
this->logger->log(this->logger, CONTROL | MORE, "SA Payload processed");
/* ok, we have what we need for sa_payload (proposals are stored in this->proposals)*/
break;
}
case KEY_EXCHANGE:
@@ -321,6 +321,31 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
this->logger->log(this->logger, CONTROL | MORE, "Nonce Payload processed");
break;
}
case NOTIFY:
{
notify_payload_t *notify_payload = (notify_payload_t *) payload;
this->logger->log(this->logger, CONTROL|MORE, "Process notify type %s for protocol %s",
mapping_find(notify_message_type_m, notify_payload->get_notify_message_type(notify_payload)),
mapping_find(protocol_id_m, notify_payload->get_protocol_id(notify_payload)));
if (notify_payload->get_protocol_id(notify_payload) != IKE)
{
this->logger->log(this->logger, ERROR | MORE, "Notify not for IKE protocol.");
payloads->destroy(payloads);
return FAILED;
}
switch (notify_payload->get_notify_message_type(notify_payload))
{
default:
{
this->logger->log(this->logger, CONTROL|MORE, "Processing of notify type %s not yet implemented",
mapping_find(notify_message_type_m, notify_payload->get_notify_message_type(notify_payload)));
break;
}
}
}
default:
{
this->logger->log(this->logger, ERROR | MORE, "Payload type not supported!");