diff options
author | Jan Hutter <jhutter@hsr.ch> | 2005-12-01 12:18:20 +0000 |
---|---|---|
committer | Jan Hutter <jhutter@hsr.ch> | 2005-12-01 12:18:20 +0000 |
commit | 343acebe859146bc7ae9af539d8a55ba666820ad (patch) | |
tree | 95e4517257cfd44c60f574bf62f1f4400f420e90 /Source/charon/encoding | |
parent | 47cf33820d58f4eb803587ca6b6d31ab09f95457 (diff) | |
download | strongswan-343acebe859146bc7ae9af539d8a55ba666820ad.tar.bz2 strongswan-343acebe859146bc7ae9af539d8a55ba666820ad.tar.xz |
- implemented functionality to generate sa payload from
child_proposal_t's and vice versa...
Diffstat (limited to 'Source/charon/encoding')
-rw-r--r-- | Source/charon/encoding/payloads/sa_payload.c | 383 | ||||
-rw-r--r-- | Source/charon/encoding/payloads/sa_payload.h | 29 | ||||
-rw-r--r-- | Source/charon/encoding/payloads/transform_substructure.c | 4 | ||||
-rw-r--r-- | Source/charon/encoding/payloads/transform_substructure.h | 2 |
4 files changed, 414 insertions, 4 deletions
diff --git a/Source/charon/encoding/payloads/sa_payload.c b/Source/charon/encoding/payloads/sa_payload.c index d2aecf875..d2bfc9c17 100644 --- a/Source/charon/encoding/payloads/sa_payload.c +++ b/Source/charon/encoding/payloads/sa_payload.c @@ -394,6 +394,298 @@ static status_t get_ike_proposals (private_sa_payload_t *this,ike_proposal_t ** } /** + * Implementation of sa_payload_t.get_child_proposals. + */ +static status_t get_child_proposals (private_sa_payload_t *this,child_proposal_t ** proposals, size_t *proposal_count) +{ + int found_child_proposals = 0; + int found_suites = 1; + int current_suite_number = 0; + + iterator_t *iterator; + child_proposal_t *tmp_proposals; + + iterator = this->proposals->create_iterator(this->proposals,TRUE); + + /* first find out the number of child proposals and check their number of transforms and + * if the SPI is 4 byte long!*/ + current_suite_number = 1; + while (iterator->has_next(iterator)) + { + proposal_substructure_t *current_proposal; + iterator->current(iterator,(void **)&(current_proposal)); + if ((current_proposal->get_protocol_id(current_proposal) == AH) || + (current_proposal->get_protocol_id(current_proposal) == ESP)) + { + if (current_proposal->get_spi_size(current_proposal) != 4) + { + iterator->destroy(iterator); + return FAILED; + } + if (current_proposal->get_proposal_number(current_proposal) == (current_suite_number + 1)) + { + found_suites++; + current_suite_number = current_proposal->get_proposal_number(current_proposal); + } + found_child_proposals++; + } + } + iterator->reset(iterator); + + if (found_child_proposals == 0) + { + iterator->destroy(iterator); + return NOT_FOUND; + } + + /* allocate memory to hold each proposal as child_proposal_t */ + + tmp_proposals = allocator_alloc(found_child_proposals * sizeof(child_proposal_t)); + + current_suite_number = 1; + tmp_proposals[current_suite_number - 1].ah.extended_sequence_numbers = NO_EXT_SEQ_NUMBERS; + tmp_proposals[current_suite_number - 1].ah.diffie_hellman_group = MODP_UNDEFINED; + + tmp_proposals[current_suite_number - 1].esp.integrity_algorithm = AUTH_UNDEFINED; + tmp_proposals[current_suite_number - 1].esp.diffie_hellman_group = MODP_UNDEFINED; + tmp_proposals[current_suite_number - 1].esp.extended_sequence_numbers = NO_EXT_SEQ_NUMBERS; + + /* create from each proposal_substructure a child_proposal_t data area*/ + while (iterator->has_next(iterator)) + { + proposal_substructure_t *current_proposal; + iterator->current(iterator,(void **)&(current_proposal)); + + if (current_proposal->get_proposal_number(current_proposal) == (current_suite_number + 1)) + { + current_suite_number++; + if (current_suite_number > found_suites) + { + /* inconsistent situation */ + return FAILED; + } + tmp_proposals[current_suite_number - 1].ah.extended_sequence_numbers = NO_EXT_SEQ_NUMBERS; + tmp_proposals[current_suite_number - 1].ah.diffie_hellman_group = MODP_UNDEFINED; + + tmp_proposals[current_suite_number - 1].esp.integrity_algorithm = AUTH_UNDEFINED; + tmp_proposals[current_suite_number - 1].esp.diffie_hellman_group = MODP_UNDEFINED; + tmp_proposals[current_suite_number - 1].esp.extended_sequence_numbers = NO_EXT_SEQ_NUMBERS; + } + + if (current_proposal->get_protocol_id(current_proposal) == AH) + { + bool integrity_algorithm_found = FALSE; + bool diffie_hellman_group_found = FALSE; + bool extended_sequence_numbers_found = FALSE; + iterator_t *transforms; + status_t status; + + chunk_t spi; + + tmp_proposals[current_suite_number - 1].ah.is_set = TRUE; + + spi = current_proposal->get_spi(current_proposal); + memcpy(tmp_proposals[current_suite_number - 1].ah.spi,spi.ptr,min(spi.len,4)); + + transforms = current_proposal->create_transform_substructure_iterator(current_proposal,TRUE); + while (transforms->has_next(transforms)) + { + transform_substructure_t *current_transform; + transforms->current(transforms,(void **)&(current_transform)); + + switch (current_transform->get_transform_type(current_transform)) + { + case INTEGRITY_ALGORITHM: + { + u_int16_t key_size; + + if (integrity_algorithm_found) + { + transforms->destroy(transforms); + iterator->destroy(iterator); + allocator_free(tmp_proposals); + return FAILED; + } + tmp_proposals[current_suite_number - 1].ah.integrity_algorithm = current_transform->get_transform_id(current_transform); + status = current_transform->get_key_length(current_transform,&key_size); + tmp_proposals[current_suite_number - 1].ah.integrity_algorithm_key_size = key_size; + if (status == SUCCESS) + { + integrity_algorithm_found = TRUE; + } + break; + } + case EXTENDED_SEQUENCE_NUMBERS: + { + if (extended_sequence_numbers_found) + { + transforms->destroy(transforms); + iterator->destroy(iterator); + allocator_free(tmp_proposals); + return FAILED; + } + tmp_proposals[current_suite_number - 1].ah.extended_sequence_numbers = current_transform->get_transform_id(current_transform); + extended_sequence_numbers_found = TRUE; + break; + } + case DIFFIE_HELLMAN_GROUP: + { + if (diffie_hellman_group_found) + { + transforms->destroy(transforms); + iterator->destroy(iterator); + allocator_free(tmp_proposals); + return FAILED; + } + tmp_proposals[current_suite_number - 1].ah.diffie_hellman_group = current_transform->get_transform_id(current_transform); + diffie_hellman_group_found = TRUE; + break; + } + default: + { + /* not a transform of an child proposal. return here */ + transforms->destroy(transforms); + iterator->destroy(iterator); + allocator_free(tmp_proposals); + return FAILED; + } + } + + } + transforms->destroy(transforms); + + if (!integrity_algorithm_found) + { + /* one of needed transforms could not be found */ + iterator->reset(iterator); + allocator_free(tmp_proposals); + return FAILED; + } + } + else if (current_proposal->get_protocol_id(current_proposal) == ESP) + { + bool encryption_algorithm_found = FALSE; + bool integrity_algorithm_found = FALSE; + bool diffie_hellman_group_found = FALSE; + bool extended_sequence_numbers_found = FALSE; + iterator_t *transforms; + status_t status; + chunk_t spi; + + spi = current_proposal->get_spi(current_proposal); + memcpy(tmp_proposals[current_suite_number - 1].esp.spi,spi.ptr,min(spi.len,4)); + tmp_proposals[current_suite_number - 1].esp.is_set = TRUE; + + + transforms = current_proposal->create_transform_substructure_iterator(current_proposal,TRUE); + while (transforms->has_next(transforms)) + { + transform_substructure_t *current_transform; + transforms->current(transforms,(void **)&(current_transform)); + + switch (current_transform->get_transform_type(current_transform)) + { + case ENCRYPTION_ALGORITHM: + { + u_int16_t key_size; + + if (encryption_algorithm_found) + { + transforms->destroy(transforms); + iterator->destroy(iterator); + allocator_free(tmp_proposals); + return FAILED; + } + tmp_proposals[current_suite_number - 1].esp.encryption_algorithm = current_transform->get_transform_id(current_transform); + status = current_transform->get_key_length(current_transform,&key_size); + tmp_proposals[current_suite_number - 1].esp.encryption_algorithm_key_size = key_size; + if (status == SUCCESS) + { + encryption_algorithm_found = TRUE; + } + break; + } + case INTEGRITY_ALGORITHM: + { + u_int16_t key_size; + + if (integrity_algorithm_found) + { + transforms->destroy(transforms); + iterator->destroy(iterator); + allocator_free(tmp_proposals); + return FAILED; + } + tmp_proposals[current_suite_number - 1].esp.integrity_algorithm = current_transform->get_transform_id(current_transform); + status = current_transform->get_key_length(current_transform,&key_size); + tmp_proposals[current_suite_number - 1].esp.integrity_algorithm_key_size = key_size; + if (status == SUCCESS) + { + integrity_algorithm_found = TRUE; + } + break; + } + case EXTENDED_SEQUENCE_NUMBERS: + { + if (extended_sequence_numbers_found) + { + transforms->destroy(transforms); + iterator->destroy(iterator); + allocator_free(tmp_proposals); + return FAILED; + } + tmp_proposals[current_suite_number - 1].esp.extended_sequence_numbers = current_transform->get_transform_id(current_transform); + extended_sequence_numbers_found = TRUE; + break; + } + case DIFFIE_HELLMAN_GROUP: + { + if (diffie_hellman_group_found) + { + transforms->destroy(transforms); + iterator->destroy(iterator); + allocator_free(tmp_proposals); + return FAILED; + } + tmp_proposals[current_suite_number - 1].esp.diffie_hellman_group = current_transform->get_transform_id(current_transform); + diffie_hellman_group_found = TRUE; + break; + } + default: + { + /* not a transform of an child proposal. return here */ + transforms->destroy(transforms); + iterator->destroy(iterator); + allocator_free(tmp_proposals); + return FAILED; + } + } + + } + transforms->destroy(transforms); + + + if (!encryption_algorithm_found) + { + /* one of needed transforms could not be found */ + iterator->reset(iterator); + allocator_free(tmp_proposals); + return FAILED; + } + + } + } + + iterator->destroy(iterator); + + *proposals = tmp_proposals; + *proposal_count = found_suites; + + return SUCCESS; +} + + +/** * Implementation of private_sa_payload_t.compute_length. */ static void compute_length (private_sa_payload_t *this) @@ -432,6 +724,7 @@ sa_payload_t *sa_payload_create() this->public.create_proposal_substructure_iterator = (iterator_t* (*) (sa_payload_t *,bool)) create_proposal_substructure_iterator; this->public.add_proposal_substructure = (void (*) (sa_payload_t *,proposal_substructure_t *)) add_proposal_substructure; this->public.get_ike_proposals = (status_t (*) (sa_payload_t *, ike_proposal_t **, size_t *)) get_ike_proposals; + this->public.get_child_proposals = (status_t (*) (sa_payload_t *, child_proposal_t **, size_t *)) get_child_proposals; this->public.destroy = (void (*) (sa_payload_t *)) destroy; /* private functions */ @@ -486,3 +779,93 @@ sa_payload_t *sa_payload_create_from_ike_proposals(ike_proposal_t *proposals, si return sa_payload; } + +/* + * Described in header. + */ +sa_payload_t *sa_payload_create_from_child_proposals(child_proposal_t *proposals, size_t proposal_count) +{ + int i; + sa_payload_t *sa_payload= sa_payload_create(); + + for (i = 0; i < proposal_count; i++) + { + /* first the AH part is created */ + if (proposals[i].ah.is_set) + { + transform_substructure_t *integrity_algorithm; + proposal_substructure_t *proposal_substructure; + chunk_t spi; + + proposal_substructure = proposal_substructure_create(); + proposal_substructure->set_protocol_id(proposal_substructure,AH); + proposal_substructure->set_proposal_number(proposal_substructure,(i + 1)); + spi.ptr = proposals[i].ah.spi; + spi.len = 4; + proposal_substructure->set_spi(proposal_substructure,spi); + + integrity_algorithm = transform_substructure_create_type(INTEGRITY_ALGORITHM,proposals[i].ah.integrity_algorithm,proposals[i].ah.integrity_algorithm_key_size); + proposal_substructure->add_transform_substructure(proposal_substructure,integrity_algorithm); + if (proposals[i].ah.diffie_hellman_group != MODP_UNDEFINED) + { + transform_substructure_t *diffie_hellman_group; + diffie_hellman_group = transform_substructure_create_type(DIFFIE_HELLMAN_GROUP,proposals[i].ah.diffie_hellman_group,0); + proposal_substructure->add_transform_substructure(proposal_substructure,diffie_hellman_group); + + } + if (proposals[i].ah.extended_sequence_numbers == EXT_SEQ_NUMBERS) + { + transform_substructure_t *extended_sequence_numbers; + extended_sequence_numbers = transform_substructure_create_type(EXTENDED_SEQUENCE_NUMBERS,proposals[i].ah.extended_sequence_numbers,0); + proposal_substructure->add_transform_substructure(proposal_substructure,extended_sequence_numbers); + } + + sa_payload->add_proposal_substructure(sa_payload,proposal_substructure); + } + + /* then the ESP part is created */ + if (proposals[i].esp.is_set) + { + transform_substructure_t *encryption_algorithm; + proposal_substructure_t *proposal_substructure; + chunk_t spi; + + proposal_substructure = proposal_substructure_create(); + proposal_substructure->set_protocol_id(proposal_substructure,ESP); + proposal_substructure->set_proposal_number(proposal_substructure,(i + 1)); + spi.ptr = proposals[i].esp.spi; + spi.len = 4; + proposal_substructure->set_spi(proposal_substructure,spi); + + encryption_algorithm = transform_substructure_create_type(ENCRYPTION_ALGORITHM,proposals[i].esp.encryption_algorithm,proposals[i].esp.encryption_algorithm_key_size); + proposal_substructure->add_transform_substructure(proposal_substructure,encryption_algorithm); + + if (proposals[i].esp.integrity_algorithm != AUTH_UNDEFINED) + { + transform_substructure_t *integrity_algorithm; + integrity_algorithm = transform_substructure_create_type(INTEGRITY_ALGORITHM,proposals[i].esp.integrity_algorithm,proposals[i].esp.integrity_algorithm_key_size); + proposal_substructure->add_transform_substructure(proposal_substructure,integrity_algorithm); + + } + + if (proposals[i].esp.diffie_hellman_group != MODP_UNDEFINED) + { + transform_substructure_t *diffie_hellman_group; + diffie_hellman_group = transform_substructure_create_type(DIFFIE_HELLMAN_GROUP,proposals[i].esp.diffie_hellman_group,0); + proposal_substructure->add_transform_substructure(proposal_substructure,diffie_hellman_group); + + } + if (proposals[i].esp.extended_sequence_numbers == EXT_SEQ_NUMBERS) + { + transform_substructure_t *extended_sequence_numbers; + extended_sequence_numbers = transform_substructure_create_type(EXTENDED_SEQUENCE_NUMBERS,proposals[i].esp.extended_sequence_numbers,0); + proposal_substructure->add_transform_substructure(proposal_substructure,extended_sequence_numbers); + } + + sa_payload->add_proposal_substructure(sa_payload,proposal_substructure); + } + + } + + return sa_payload; +} diff --git a/Source/charon/encoding/payloads/sa_payload.h b/Source/charon/encoding/payloads/sa_payload.h index ad450b356..fff214255 100644 --- a/Source/charon/encoding/payloads/sa_payload.h +++ b/Source/charon/encoding/payloads/sa_payload.h @@ -28,6 +28,7 @@ #include <encoding/payloads/proposal_substructure.h> #include <utils/linked_list.h> #include <config/init_config.h> +#include <config/sa_config.h> /** * Critical flag must not be set. @@ -98,7 +99,19 @@ struct sa_payload_t { * - FAILED if a proposal does not contain all needed transforms * for a IKE_PROPOSAL */ - status_t (*get_ike_proposals) (sa_payload_t *this, ike_proposal_t **proposals, size_t *proposal_count); + status_t (*get_ike_proposals) (sa_payload_t *this, ike_proposal_t **proposals, size_t *proposal_count); + + /** + * Creates an array of child_proposal_t's in this SA payload. + * + * @param proposals the pointer to the first entry of child_proposal_t's is set + * @param proposal_count the number of found proposals is written at this location + * @return + * - SUCCESS if child proposals could be found + * - NOT_FOUND if no child proposal could be found + * - FAILED if a proposal does not contain all needed transforms + */ + status_t (*get_child_proposals) (sa_payload_t *this, child_proposal_t **proposals, size_t *proposal_count); /** * @brief Destroys an sa_payload_t object. @@ -128,4 +141,18 @@ sa_payload_t *sa_payload_create(); */ sa_payload_t *sa_payload_create_from_ike_proposals(ike_proposal_t *proposals, size_t proposal_count); +/** + * @brief Creates a sa_payload_t object from array of child_proposal_t's. + * + * @warning for proposals where AH and ESP is not set, an empty proposal is created. + * + * + * @return created sa_payload_t object + * @param proposals pointer to first proposal in array of type child_proposal_t + * @param proposal_count number of child_proposal_t's in array + * + * @ingroup payloads + */ +sa_payload_t *sa_payload_create_from_child_proposals(child_proposal_t *proposals, size_t proposal_count); + #endif /*SA_PAYLOAD_H_*/ diff --git a/Source/charon/encoding/payloads/transform_substructure.c b/Source/charon/encoding/payloads/transform_substructure.c index 99af36c8d..c519c6777 100644 --- a/Source/charon/encoding/payloads/transform_substructure.c +++ b/Source/charon/encoding/payloads/transform_substructure.c @@ -89,7 +89,7 @@ mapping_t transform_type_m[] = { {PSEUDO_RANDOM_FUNCTION, "PSEUDO_RANDOM_FUNCTION"}, {INTEGRITY_ALGORITHM, "INTEGRITY_ALGORITHM"}, {DIFFIE_HELLMAN_GROUP, "DIFFIE_HELLMAN_GROUP"}, - {EXTENDED_SEQUENCE_NUNBERS, "EXTENDED_SEQUENCE_NUNBERS"}, + {EXTENDED_SEQUENCE_NUMBERS, "EXTENDED_SEQUENCE_NUMBERS"}, {MAPPING_END, NULL} }; @@ -207,7 +207,7 @@ static status_t verify(private_transform_substructure_t *this) break; } - case EXTENDED_SEQUENCE_NUNBERS: + case EXTENDED_SEQUENCE_NUMBERS: { if ((this->transform_id != NO_EXT_SEQ_NUMBERS) && (this->transform_id != EXT_SEQ_NUMBERS)) { diff --git a/Source/charon/encoding/payloads/transform_substructure.h b/Source/charon/encoding/payloads/transform_substructure.h index 6671dbc7b..b108f6312 100644 --- a/Source/charon/encoding/payloads/transform_substructure.h +++ b/Source/charon/encoding/payloads/transform_substructure.h @@ -62,7 +62,7 @@ enum transform_type_t { PSEUDO_RANDOM_FUNCTION = 2, INTEGRITY_ALGORITHM = 3, DIFFIE_HELLMAN_GROUP = 4, - EXTENDED_SEQUENCE_NUNBERS = 5 + EXTENDED_SEQUENCE_NUMBERS = 5 }; /** |