diff options
| -rw-r--r-- | Source/charon/sa/states/ike_sa_init_responded.c | 200 | ||||
| -rw-r--r-- | Source/charon/sa/states/ike_sa_init_responded.h | 20 |
2 files changed, 138 insertions, 82 deletions
diff --git a/Source/charon/sa/states/ike_sa_init_responded.c b/Source/charon/sa/states/ike_sa_init_responded.c index 732c5cc23..60068382a 100644 --- a/Source/charon/sa/states/ike_sa_init_responded.c +++ b/Source/charon/sa/states/ike_sa_init_responded.c @@ -43,12 +43,12 @@ typedef struct private_ike_sa_init_responded_t private_ike_sa_init_responded_t; */ struct private_ike_sa_init_responded_t { /** - * methods of the state_t interface + * Public interface of ike_sa_init_responded_t. */ ike_sa_init_responded_t public; /** - * Assigned IKE_SA + * Assigned IKE_SA. */ protected_ike_sa_t *ike_sa; @@ -63,34 +63,74 @@ struct private_ike_sa_init_responded_t { chunk_t sent_nonce; /** - * Data of the IKE_SA_INIT response. + * Binary representation of the IKE_SA_INIT response. */ chunk_t ike_sa_init_response_data; /** - * Data of the IKE_SA_INIT request. + * Binary representation of the IKE_SA_INIT request. */ chunk_t ike_sa_init_request_data; /** - * sa config to use + * SA config to use. */ sa_config_t *sa_config; /** - * Logger used to log data + * Assigned logger. * * Is logger of ike_sa! */ logger_t *logger; - status_t (*build_idr_payload) (private_ike_sa_init_responded_t *this, id_payload_t *request_idi, id_payload_t *request_idr, message_t *response,id_payload_t **response_idr); + /** + * Process received IDi and IDr payload and build IDr payload for IKE_AUTH response. + * + * @param this calling object + * @param request_idi ID payload representing initiator + * @param request_idr ID payload representing responder (May be zero) + * @param response The created IDr payload is added to this message_t object + * @param response_idr The created IDr payload is also written to this location + */ + status_t (*build_idr_payload) (private_ike_sa_init_responded_t *this, + id_payload_t *request_idi, + id_payload_t *request_idr, + message_t *response, + id_payload_t **response_idr); + + /** + * Process received SA payload and build SA payload for IKE_AUTH response. + * + * @param this calling object + * @param request SA payload received in IKE_AUTH request + * @param response The created SA payload is added to this message_t object + */ status_t (*build_sa_payload) (private_ike_sa_init_responded_t *this, sa_payload_t *request, message_t *response); + + /** + * Process received AUTH payload and build AUTH payload for IKE_AUTH response. + * + * @param this calling object + * @param request AUTH payload received in IKE_AUTH request + * @param other_id_payload other ID payload needed to verify AUTH data + * @param my_id_payload my ID payload needed to compute AUTH data + * @param response The created AUTH payload is added to this message_t object + */ status_t (*build_auth_payload) (private_ike_sa_init_responded_t *this, auth_payload_t *request,id_payload_t *other_id_payload,id_payload_t *my_id_payload, message_t* response); + + /** + * Process received TS payload and build TS payload for IKE_AUTH response. + * + * @param this calling object + * @param is_initiator type of TS payload. TRUE for TSi, FALSE for TSr + * @param request TS payload received in IKE_AUTH request + * @param response the created TS payload is added to this message_t object + */ status_t (*build_ts_payload) (private_ike_sa_init_responded_t *this, bool ts_initiator, ts_payload_t *request, message_t *response); /** - * Sends a IKE_AUTH reply with a notify payload. + * Sends a IKE_AUTH reply containing a notify payload. * * @param this calling object * @param type type of notify message @@ -104,23 +144,21 @@ struct private_ike_sa_init_responded_t { */ static status_t process_message(private_ike_sa_init_responded_t *this, message_t *request) { - status_t status; - signer_t *signer; - crypter_t *crypter; - iterator_t *payloads; - exchange_type_t exchange_type; id_payload_t *idi_request, *idr_request = NULL,*idr_response; + ts_payload_t *tsi_request, *tsr_request; auth_payload_t *auth_request; sa_payload_t *sa_request; - ts_payload_t *tsi_request, *tsr_request; - notify_payload_t *notify_payload = NULL; + iterator_t *payloads; message_t *response; + crypter_t *crypter; + signer_t *signer; + status_t status; - exchange_type = request->get_exchange_type(request); - if (exchange_type != IKE_AUTH) + + if (request->get_exchange_type(request) != IKE_AUTH) { this->logger->log(this->logger, ERROR | MORE, "Message of type %s not supported in state ike_sa_init_responded", - mapping_find(exchange_type_m,exchange_type)); + mapping_find(exchange_type_m,request->get_exchange_type(request))); return FAILED; } @@ -134,12 +172,22 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t signer = this->ike_sa->get_signer_initiator(this->ike_sa); crypter = this->ike_sa->get_crypter_initiator(this->ike_sa); - /* parse incoming message */ - status = request->parse_body(request, crypter, signer); if (status != SUCCESS) { - this->logger->log(this->logger, ERROR | MORE, "Could not parse body of request message"); + if (status == NOT_SUPPORTED) + { + this->logger->log(this->logger, ERROR | MORE, "Message contains unsupported payload with critical flag set"); + /** + * TODO send unsupported type. + */ + this->send_notify_reply(this,UNSUPPORTED_CRITICAL_PAYLOAD,CHUNK_INITIALIZER); + return DELETE_ME; + } + else + { + this->logger->log(this->logger, ERROR | MORE, "Could not parse body of request message"); + } return status; } @@ -175,11 +223,13 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t case CERTIFICATE: { /* TODO handle cert payloads */ + this->logger->log(this->logger, ERROR | MORE, "Payload type CERTIFICATE currently not supported and so not handled"); break; } case CERTIFICATE_REQUEST: { /* TODO handle certrequest payloads */ + this->logger->log(this->logger, ERROR | MORE, "Payload type CERTIFICATE_REQUEST currently not supported and so not handled"); break; } case TRAFFIC_SELECTOR_INITIATOR: @@ -194,52 +244,47 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t } case NOTIFY: { - notify_payload = (notify_payload_t *) payload; + notify_payload_t *notify_payload = (notify_payload_t *) payload; + + this->logger->log(this->logger, CONTROL|MORE, "Process notify type %s for protocol %s", + mapping_find(notify_message_type_m, notify_payload->get_notify_message_type(notify_payload)), + mapping_find(protocol_id_m, notify_payload->get_protocol_id(notify_payload))); + + if (notify_payload->get_protocol_id(notify_payload) != IKE) + { + this->logger->log(this->logger, ERROR | MORE, "Notify not for IKE protocol."); + payloads->destroy(payloads); + return DELETE_ME; + } + switch (notify_payload->get_notify_message_type(notify_payload)) + { + case SET_WINDOW_SIZE: + /* + * TODO Increase window size. + */ + case INITIAL_CONTACT: + /* + * TODO Delete existing IKE_SA's with other Identity. + */ + default: + { + this->logger->log(this->logger, CONTROL|MORE, "Handling of notify type %s not implemented", + notify_payload->get_notify_message_type(notify_payload)); + } + } + break; } default: { - this->logger->log(this->logger, ERROR, "Payload type %s not supported in state ike_auth_requested!", mapping_find(payload_type_m, payload->get_type(payload))); - payloads->destroy(payloads); - return DELETE_ME; + this->logger->log(this->logger, ERROR, "Payload ID %d not handled in state IKE_AUTH_RESPONDED!", payload->get_type(payload)); + break; } } } /* iterator can be destroyed */ payloads->destroy(payloads); - - - if (notify_payload != NULL) - { - this->logger->log(this->logger, CONTROL|MORE, "Process notify type %s for protocol %s", - mapping_find(notify_message_type_m, notify_payload->get_notify_message_type(notify_payload)), - mapping_find(protocol_id_m, notify_payload->get_protocol_id(notify_payload))); - - if (notify_payload->get_protocol_id(notify_payload) != IKE) - { - this->logger->log(this->logger, ERROR | MORE, "Notify not for IKE protocol."); - payloads->destroy(payloads); - return DELETE_ME; - } - switch (notify_payload->get_notify_message_type(notify_payload)) - { - case SET_WINDOW_SIZE: - /* - * TODO Increase window size. - */ - case INITIAL_CONTACT: - /* - * TODO Delete existing IKE_SA's with other Identity. - */ - default: - { - this->logger->log(this->logger, CONTROL|MORE, "Handling of notify type %s not implemented", - notify_payload->get_notify_message_type(notify_payload)); - } - } - } - - + /* build response */ this->ike_sa->build_message(this->ike_sa, IKE_AUTH, FALSE, &response); @@ -248,35 +293,35 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t status = this->build_idr_payload(this, idi_request, idr_request, response,&idr_response); if (status != SUCCESS) { - this->logger->log(this->logger, ERROR, "Building idr payload failed"); + this->logger->log(this->logger, ERROR, "Building IDr payload failed"); response->destroy(response); return status; } status = this->build_sa_payload(this, sa_request, response); if (status != SUCCESS) { - this->logger->log(this->logger, ERROR, "Building sa payload failed"); + this->logger->log(this->logger, ERROR, "Building SA payload failed"); response->destroy(response); return status; } status = this->build_auth_payload(this, auth_request,idi_request, idr_response,response); if (status != SUCCESS) { - this->logger->log(this->logger, ERROR, "Building auth payload failed"); + this->logger->log(this->logger, ERROR, "Building AUTH payload failed"); response->destroy(response); return status; } status = this->build_ts_payload(this, TRUE, tsi_request, response); if (status != SUCCESS) { - this->logger->log(this->logger, ERROR, "Building tsi payload failed"); + this->logger->log(this->logger, ERROR, "Building TSi payload failed"); response->destroy(response); return status; } status = this->build_ts_payload(this, FALSE, tsr_request, response); if (status != SUCCESS) { - this->logger->log(this->logger, ERROR, "Building tsr payload failed"); + this->logger->log(this->logger, ERROR, "Building TSr payload failed"); response->destroy(response); return status; } @@ -301,7 +346,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t } /** - * Implements private_ike_sa_init_responded_t.build_idr_payload + * Implementation of private_ike_sa_init_responded_t.build_idr_payload. */ static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payload_t *request_idi, id_payload_t *request_idr, message_t *response,id_payload_t **response_idr) { @@ -331,7 +376,7 @@ static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payl { my_id->destroy(my_id); } - return NOT_FOUND; + return DELETE_ME; } /* get my id, if not requested */ @@ -349,7 +394,7 @@ static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payl } /** - * Implements private_ike_sa_init_responded_t.build_sa_payload + * Implementation of private_ike_sa_init_responded_t.build_sa_payload. */ static status_t build_sa_payload(private_ike_sa_init_responded_t *this, sa_payload_t *request, message_t *response) { @@ -374,25 +419,26 @@ static status_t build_sa_payload(private_ike_sa_init_responded_t *this, sa_paylo else { this->logger->log(this->logger, ERROR, "no matching proposal found"); - status = NOT_FOUND; + this->send_notify_reply(this,NO_PROPOSAL_CHOSEN,CHUNK_INITIALIZER); + status = DELETE_ME; } } else { this->logger->log(this->logger, ERROR, "requestor's sa payload contained no proposals"); - status = NOT_FOUND; + this->send_notify_reply(this,NO_PROPOSAL_CHOSEN,CHUNK_INITIALIZER); + status = DELETE_ME; } allocator_free(proposal_chosen); allocator_free(proposals); - return status; } /** - * Implements private_ike_sa_init_responded_t.build_auth_payload + * Implementation of private_ike_sa_init_responded_t.build_auth_payload. */ static status_t build_auth_payload(private_ike_sa_init_responded_t *this, auth_payload_t *auth_request,id_payload_t *other_id_payload,id_payload_t *my_id_payload, message_t* response) { @@ -414,7 +460,7 @@ static status_t build_auth_payload(private_ike_sa_init_responded_t *this, auth_p */ this->logger->log(this->logger, CONTROL | MORE, "Send notify message of type AUTHENTICATION_FAILED"); this->send_notify_reply (this,AUTHENTICATION_FAILED,CHUNK_INITIALIZER); - return status; + return DELETE_ME; } @@ -423,7 +469,7 @@ static status_t build_auth_payload(private_ike_sa_init_responded_t *this, auth_p if (status != SUCCESS) { this->logger->log(this->logger, ERROR, "Could not compute AUTH payload."); - return FAILED; + return DELETE_ME; } @@ -432,7 +478,7 @@ static status_t build_auth_payload(private_ike_sa_init_responded_t *this, auth_p } /** - * Implements private_ike_sa_init_responded_t.build_ts_payload + * Implementation of private_ike_sa_init_responded_t.build_ts_payload. */ static status_t build_ts_payload(private_ike_sa_init_responded_t *this, bool ts_initiator, ts_payload_t *request, message_t* response) { @@ -454,7 +500,7 @@ static status_t build_ts_payload(private_ike_sa_init_responded_t *this, bool ts_ } if(ts_selected_count == 0) { - status = NOT_FOUND; + status = DELETE_ME; } else { @@ -479,7 +525,7 @@ static status_t build_ts_payload(private_ike_sa_init_responded_t *this, bool ts_ } /** - * Implementation of private_responder_init_t.send_notify_reply. + * Implementation of of private_responder_init_t.send_notify_reply. */ static void send_notify_reply (private_ike_sa_init_responded_t *this,notify_message_type_t type, chunk_t data) { @@ -517,7 +563,7 @@ static void send_notify_reply (private_ike_sa_init_responded_t *this,notify_mess } /** - * Implements state_t.get_state + * Implementation of state_t.get_state. */ static ike_sa_state_t get_state(private_ike_sa_init_responded_t *this) { @@ -525,7 +571,7 @@ static ike_sa_state_t get_state(private_ike_sa_init_responded_t *this) } /** - * Implements state_t.get_state + * Implementation of state_t.get_state. */ static void destroy(private_ike_sa_init_responded_t *this) { diff --git a/Source/charon/sa/states/ike_sa_init_responded.h b/Source/charon/sa/states/ike_sa_init_responded.h index 6dd634288..f63bb1183 100644 --- a/Source/charon/sa/states/ike_sa_init_responded.h +++ b/Source/charon/sa/states/ike_sa_init_responded.h @@ -34,13 +34,16 @@ typedef struct ike_sa_init_responded_t ike_sa_init_responded_t; * * The state accpets IKE_AUTH requests. It proves the authenticity * and sets up the first child sa. Then it sends back an IKE_AUTH - * reply and processes to the IKE_SA_ESTABLISHED state. + * reply and changes to the IKE_SA_ESTABLISHED state. + * + * @b Constructors: + * - ike_sa_init_response_data() * * @ingroup states */ struct ike_sa_init_responded_t { /** - * methods of the state_t interface + * The state_t interface. */ state_t state_interface; @@ -49,11 +52,18 @@ struct ike_sa_init_responded_t { /** * @brief Constructor of class ike_sa_init_responded_t * - * @param ike_sa assigned IKE_SA - * @param received_nonce received nonce data + * @param ike_sa assigned IKE_SA + * @param received_nonce received nonce data in IKE_SA_INIT request + * @param received_nonce sent nonce data in IKE_SA_INIT response + * @param ike_sa_init_request_data binary representation of received IKE_SA_INIT request + * @param ike_sa_init_response_data binary representation of sent IKE_SA_INIT response * * @ingroup states */ -ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa, chunk_t received_nonce,chunk_t sent_nonce,chunk_t ike_sa_init_request_data,chunk_t ike_sa_init_response_data); +ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa, + chunk_t received_nonce, + chunk_t sent_nonce, + chunk_t ike_sa_init_request_data, + chunk_t ike_sa_init_response_data); #endif /*IKE_SA_INIT_RESPONDED_H_*/ |