aboutsummaryrefslogtreecommitdiffstats
path: root/Source/charon/sa/ike_sa.c
diff options
context:
space:
mode:
Diffstat (limited to 'Source/charon/sa/ike_sa.c')
-rw-r--r--Source/charon/sa/ike_sa.c1199
1 files changed, 0 insertions, 1199 deletions
diff --git a/Source/charon/sa/ike_sa.c b/Source/charon/sa/ike_sa.c
deleted file mode 100644
index 6322eb8e9..000000000
--- a/Source/charon/sa/ike_sa.c
+++ /dev/null
@@ -1,1199 +0,0 @@
-/**
- * @file ike_sa.c
- *
- * @brief Implementation of ike_sa_t.
- *
- */
-
-/*
- * Copyright (C) 2005 Jan Hutter, Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
- * for more details.
- */
-#include <string.h>
-
-#include "ike_sa.h"
-
-#include <types.h>
-#include <daemon.h>
-#include <definitions.h>
-#include <utils/linked_list.h>
-#include <utils/logger_manager.h>
-#include <utils/randomizer.h>
-#include <crypto/diffie_hellman.h>
-#include <crypto/prf_plus.h>
-#include <crypto/crypters/crypter.h>
-#include <encoding/payloads/sa_payload.h>
-#include <encoding/payloads/nonce_payload.h>
-#include <encoding/payloads/ke_payload.h>
-#include <encoding/payloads/delete_payload.h>
-#include <encoding/payloads/transform_substructure.h>
-#include <encoding/payloads/transform_attribute.h>
-#include <sa/states/initiator_init.h>
-#include <sa/states/responder_init.h>
-#include <queues/jobs/retransmit_request_job.h>
-#include <queues/jobs/delete_established_ike_sa_job.h>
-
-
-
-
-typedef struct private_ike_sa_t private_ike_sa_t;
-
-/**
- * Private data of an ike_sa_t object.
- */
-struct private_ike_sa_t {
-
- /**
- * Protected part of a ike_sa_t object.
- */
- protected_ike_sa_t protected;
-
- /**
- * Identifier for the current IKE_SA.
- */
- ike_sa_id_t *ike_sa_id;
-
- /**
- * Linked List containing the child sa's of the current IKE_SA.
- */
- linked_list_t *child_sas;
-
- /**
- * Current state of the IKE_SA represented as state_t object.
- *
- * A state object representates one of the following states and is processing
- * messages in the specific state:
- * - INITIATOR_INIT
- * - RESPONDER_INIT
- * - IKE_SA_INIT_REQUESTED
- * - IKE_SA_INIT_RESPONDED
- * - IKE_AUTH_REQUESTED
- * -IKE_SA_ESTABLISHED
- */
- state_t *current_state;
-
- /**
- * INIT configuration, needed for the IKE_SA_INIT exchange.
- *
- * Gets set in states:
- * - INITATOR_INIT
- * - RESPONDER_INIT
- *
- * Available in states:
- * - IKE_SA_INIT_REQUESTED
- * - IKE_SA_INIT_RESPONDED
- * - IKE_AUTH_REQUESTED
- * -IKE_SA_ESTABLISHED
- */
- connection_t *connection;
-
- /**
- * SA configuration, needed for all other exchanges after IKE_SA_INIT exchange.
- *
- * Gets set in states:
- * - IKE_SA_INIT_REQUESTED
- * - IKE_SA_INIT_RESPONDED
- *
- * Available in states:
- * - IKE_AUTH_REQUESTED
- * -IKE_SA_ESTABLISHED
- */
- policy_t *policy;
-
- /**
- * This SA's source for random data.
- *
- * Is available in every state.
- */
- randomizer_t *randomizer;
-
- /**
- * The last responded message.
- */
- message_t *last_responded_message;
-
- /**
- * The ast requested message.
- */
- message_t *last_requested_message;
-
- /**
- * Crypter object for initiator.
- */
- crypter_t *crypter_initiator;
-
- /**
- * Crypter object for responder.
- */
- crypter_t *crypter_responder;
-
- /**
- * Signer object for initiator.
- */
- signer_t *signer_initiator;
-
- /**
- * Signer object for responder.
- */
- signer_t *signer_responder;
-
- /**
- * Multi purpose prf, set key, use it, forget it
- */
- prf_t *prf;
-
- /**
- * Prf function for derivating keymat child SAs
- */
- prf_t *child_prf;
-
- /**
- * PRF, with key set to pi_key, used for authentication
- */
- prf_t *prf_auth_i;
-
- /**
- * PRF, with key set to pr_key, used for authentication
- */
- prf_t *prf_auth_r;
-
- /**
- * Next message id to receive.
- */
- u_int32_t message_id_in;
-
- /**
- * Next message id to send.
- */
- u_int32_t message_id_out;
-
- /**
- * Last reply id which was successfully received.
- */
- int32_t last_replied_message_id;
-
- /**
- * A logger for this IKE_SA.
- */
- logger_t *logger;
-
- /**
- * Resends the last sent reply.
- *
- * @param this calling object
- */
- status_t (*resend_last_reply) (private_ike_sa_t *this);
-};
-
-/**
- * Implementation of ike_sa_t.process_message.
- */
-static status_t process_message (private_ike_sa_t *this, message_t *message)
-{
- u_int32_t message_id;
- exchange_type_t exchange_type;
- bool is_request;
-
- /* We must process each request or response from remote host */
-
- /* Find out type of message (request or response) */
- is_request = message->get_request(message);
- exchange_type = message->get_exchange_type(message);
-
- this->logger->log(this->logger, CONTROL|LEVEL1, "Process %s of exchange type %s",
- (is_request) ? "request" : "response",mapping_find(exchange_type_m,exchange_type));
-
- message_id = message->get_message_id(message);
-
- /*
- * It has to be checked, if the message has to be resent cause of lost packets!
- */
- if (is_request && (message_id == (this->message_id_in - 1)))
- {
- /* Message can be resent ! */
- this->logger->log(this->logger, CONTROL|LEVEL1, "Resent request detected. Send stored reply.");
- return (this->resend_last_reply(this));
- }
-
- /* Now, the message id is checked for request AND reply */
- if (is_request)
- {
- /* In a request, the message has to be this->message_id_in (other case is already handled) */
- if (message_id != this->message_id_in)
- {
- this->logger->log(this->logger, ERROR | LEVEL1,
- "Message request with message id %d received, but %d expected",
- message_id,this->message_id_in);
- return FAILED;
- }
- }
- else
- {
- /* In a reply, the message has to be this->message_id_out -1 cause it is the reply to the last sent message*/
- if (message_id != (this->message_id_out - 1))
- {
- this->logger->log(this->logger, ERROR | LEVEL1,
- "Message reply with message id %d received, but %d expected",
- message_id,this->message_id_in);
- return FAILED;
- }
- }
-
- /* now the message is processed by the current state object.
- * The specific state object is responsible to check if a message can be received in
- * the state it represents.
- * The current state is also responsible to change the state object to the next state
- * by calling protected_ike_sa_t.set_new_state*/
- return this->current_state->process_message(this->current_state,message);
-}
-
-/**
- * Implementation of protected_ike_sa_t.build_message.
- */
-static void build_message(private_ike_sa_t *this, exchange_type_t type, bool request, message_t **message)
-{
- message_t *new_message;
- host_t *me, *other;
-
- me = this->connection->get_my_host(this->connection);
- other = this->connection->get_other_host(this->connection);
-
- this->logger->log(this->logger, CONTROL|LEVEL2, "Build empty message");
- new_message = message_create();
- new_message->set_source(new_message, me->clone(me));
- new_message->set_destination(new_message, other->clone(other));
- new_message->set_exchange_type(new_message, type);
- new_message->set_request(new_message, request);
- new_message->set_message_id(new_message, (request) ? this->message_id_out : this->message_id_in);
- new_message->set_ike_sa_id(new_message, this->ike_sa_id);
-
- *message = new_message;
-}
-
-/**
- * Implementation of protected_ike_sa_t.initiate_connection.
- */
-static status_t initiate_connection(private_ike_sa_t *this, connection_t *connection)
-{
- initiator_init_t *current_state;
-
- /* Work is done in state object of type INITIATOR_INIT. All other states are not
- * initial states and so don't have a initiate_connection function */
-
- if (this->current_state->get_state(this->current_state) != INITIATOR_INIT)
- {
- return FAILED;
- }
-
- current_state = (initiator_init_t *) this->current_state;
-
- return current_state->initiate_connection(current_state, connection);
-}
-
-/**
- * Implementation of ike_sa_t.send_delete_ike_sa_request.
- */
-static void send_delete_ike_sa_request (private_ike_sa_t *this)
-{
- message_t *informational_request;
- delete_payload_t *delete_payload;
- crypter_t *crypter;
- signer_t *signer;
- packet_t *packet;
- status_t status;
-
- if (this->current_state->get_state(this->current_state) != IKE_SA_ESTABLISHED)
- {
- return;
- }
-
- /* build empty INFORMATIONAL message */
- this->protected.build_message(&(this->protected), INFORMATIONAL, TRUE, &informational_request);
-
- delete_payload = delete_payload_create();
- delete_payload->set_protocol_id(delete_payload, PROTO_IKE);
-
- informational_request->add_payload(informational_request,(payload_t *)delete_payload);
-
- if (this->ike_sa_id->is_initiator(this->ike_sa_id))
- {
- crypter = this->crypter_initiator;
- signer = this->signer_initiator;
- }
- else
- {
- crypter = this->crypter_responder;
- signer = this->signer_responder;
- }
-
- status = informational_request->generate(informational_request,
- crypter,
- signer, &packet);
- informational_request->destroy(informational_request);
- if (status != SUCCESS)
- {
- this->logger->log(this->logger, ERROR, "Could not generate packet from message");
- return ;
- }
-
- charon->send_queue->add(charon->send_queue,packet);
-}
-
-/**
- * Implementation of ike_sa_t.get_id.
- */
-static ike_sa_id_t* get_id(private_ike_sa_t *this)
-{
- return this->ike_sa_id;
-}
-
-/**
- * Implementation of ike_sa_t.get_my_host.
- */
-static host_t* get_my_host(private_ike_sa_t *this)
-{
- return this->connection->get_my_host(this->connection);;
-}
-
-/**
- * Implementation of ike_sa_t.get_other_host.
- */
-static host_t* get_other_host(private_ike_sa_t *this)
-{
- return this->connection->get_other_host(this->connection);;
-}
-
-/**
- * Implementation of ike_sa_t.get_my_id.
- */
-static identification_t* get_my_id(private_ike_sa_t *this)
-{
- return this->connection->get_my_id(this->connection);;
-}
-
-/**
- * Implementation of ike_sa_t.get_other_id.
- */
-static identification_t* get_other_id(private_ike_sa_t *this)
-{
- return this->connection->get_other_id(this->connection);;
-}
-
-/**
- * Implementation of private_ike_sa_t.resend_last_reply.
- */
-static status_t resend_last_reply(private_ike_sa_t *this)
-{
- packet_t *packet;
-
- this->logger->log(this->logger, CONTROL | LEVEL1, "Going to retransmit last reply");
- packet = this->last_responded_message->get_packet(this->last_responded_message);
- charon->send_queue->add(charon->send_queue, packet);
-
- return SUCCESS;
-}
-
-/**
- * Implementation of ike_sa_t.retransmit_request.
- */
-status_t retransmit_request (private_ike_sa_t *this, u_int32_t message_id)
-{
- packet_t *packet;
-
- if (this->last_requested_message == NULL)
- {
- return NOT_FOUND;
- }
-
- if (message_id == this->last_replied_message_id)
- {
- return NOT_FOUND;
- }
-
- if ((this->last_requested_message->get_message_id(this->last_requested_message)) != message_id)
- {
- return NOT_FOUND;
- }
-
- this->logger->log(this->logger, CONTROL | LEVEL1, "Going to retransmit message with id %d",message_id);
- packet = this->last_requested_message->get_packet(this->last_requested_message);
- charon->send_queue->add(charon->send_queue, packet);
-
- return SUCCESS;
-}
-
-/**
- * Implementation of protected_ike_sa_t.set_new_state.
- */
-static void set_new_state (private_ike_sa_t *this, state_t *state)
-{
- this->logger->log(this->logger, CONTROL, "statechange: %s => %s",
- mapping_find(ike_sa_state_m,this->current_state->get_state(this->current_state)),
- mapping_find(ike_sa_state_m,state->get_state(state)));
- this->current_state = state;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_connection.
- */
-static connection_t *get_connection (private_ike_sa_t *this)
-{
- return this->connection;
-}
-
-/**
- * Implementation of protected_ike_sa_t.set_connection.
- */
-static void set_connection (private_ike_sa_t *this,connection_t * connection)
-{
- this->connection = connection;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_policy.
- */
-static policy_t *get_policy (private_ike_sa_t *this)
-{
- return this->policy;
-}
-
-/**
- * Implementation of protected_ike_sa_t.set_policy.
- */
-static void set_policy (private_ike_sa_t *this,policy_t * policy)
-{
- this->policy = policy;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_prf.
- */
-static prf_t *get_prf (private_ike_sa_t *this)
-{
- return this->prf;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_prf.
- */
-static prf_t *get_child_prf (private_ike_sa_t *this)
-{
- return this->child_prf;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_prf_auth_i.
- */
-static prf_t *get_prf_auth_i (private_ike_sa_t *this)
-{
- return this->prf_auth_i;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_prf_auth_r.
- */
-static prf_t *get_prf_auth_r (private_ike_sa_t *this)
-{
- return this->prf_auth_r;
-}
-
-
-/**
- * Implementation of protected_ike_sa_t.build_transforms.
- */
-static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, diffie_hellman_t *dh, chunk_t nonce_i, chunk_t nonce_r)
-{
- chunk_t nonces, nonces_spis, skeyseed, key, secret;
- u_int64_t spi_i, spi_r;
- prf_plus_t *prf_plus;
- algorithm_t *algo;
- size_t key_size;
-
- /*
- * Build the PRF+ instance for deriving keys
- */
- if (this->prf != NULL)
- {
- this->prf->destroy(this->prf);
- }
- proposal->get_algorithm(proposal, PROTO_IKE, PSEUDO_RANDOM_FUNCTION, &algo);
- if (algo == NULL)
- {
- this->logger->log(this->logger, ERROR|LEVEL2, "No PRF algoithm selected!?");
- return FAILED;
- }
- this->prf = prf_create(algo->algorithm);
- if (this->prf == NULL)
- {
- this->logger->log(this->logger, ERROR|LEVEL1,
- "PSEUDO_RANDOM_FUNCTION %s not supported!",
- mapping_find(pseudo_random_function_m, algo->algorithm));
- return FAILED;
- }
-
- /* concatenate nonces = nonce_i | nonce_r */
- nonces = chunk_alloc(nonce_i.len + nonce_r.len);
- memcpy(nonces.ptr, nonce_i.ptr, nonce_i.len);
- memcpy(nonces.ptr + nonce_i.len, nonce_r.ptr, nonce_r.len);
-
- /* concatenate prf_seed = nonce_i | nonce_r | spi_i | spi_r */
- nonces_spis = chunk_alloc(nonces.len + 16);
- memcpy(nonces_spis.ptr, nonces.ptr, nonces.len);
- spi_i = this->ike_sa_id->get_initiator_spi(this->ike_sa_id);
- spi_r = this->ike_sa_id->get_responder_spi(this->ike_sa_id);
- memcpy(nonces_spis.ptr + nonces.len, &spi_i, 8);
- memcpy(nonces_spis.ptr + nonces.len + 8, &spi_r, 8);
-
- /* SKEYSEED = prf(Ni | Nr, g^ir) */
- dh->get_shared_secret(dh, &secret);
- this->logger->log_chunk(this->logger, PRIVATE, "Shared Diffie Hellman secret", secret);
- this->prf->set_key(this->prf, nonces);
- this->prf->allocate_bytes(this->prf, secret, &skeyseed);
- this->logger->log_chunk(this->logger, PRIVATE | LEVEL1, "SKEYSEED", skeyseed);
- chunk_free(&secret);
-
- /* prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr )
- * = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr
- *
- * we use the prf directly for prf+
- */
- this->prf->set_key(this->prf, skeyseed);
- prf_plus = prf_plus_create(this->prf, nonces_spis);
-
- /* clean up unused stuff */
- chunk_free(&nonces);
- chunk_free(&nonces_spis);
- chunk_free(&skeyseed);
-
-
- /*
- * We now can derive all of our key. We build the transforms
- * directly.
- */
-
-
- /* SK_d used for prf+ to derive keys for child SAs */
- this->child_prf = prf_create(algo->algorithm);
- key_size = this->child_prf->get_key_size(this->child_prf);
- prf_plus->allocate_bytes(prf_plus, key_size, &key);
- this->logger->log_chunk(this->logger, PRIVATE, "Sk_d secret", key);
- this->child_prf->set_key(this->child_prf, key);
- chunk_free(&key);
-
-
- /* SK_ai/SK_ar used for integrity protection */
- proposal->get_algorithm(proposal, PROTO_IKE, INTEGRITY_ALGORITHM, &algo);
- if (algo == NULL)
- {
- this->logger->log(this->logger, ERROR|LEVEL2, "No integrity algoithm selected?!");
- return FAILED;
- }
- if (this->signer_initiator != NULL)
- {
- this->signer_initiator->destroy(this->signer_initiator);
- }
- if (this->signer_responder != NULL)
- {
- this->signer_responder->destroy(this->signer_responder);
- }
-
- this->signer_initiator = signer_create(algo->algorithm);
- this->signer_responder = signer_create(algo->algorithm);
- if (this->signer_initiator == NULL || this->signer_responder == NULL)
- {
- this->logger->log(this->logger, ERROR|LEVEL1,
- "INTEGRITY_ALGORITHM %s not supported!",
- mapping_find(integrity_algorithm_m,algo->algorithm));
- return FAILED;
- }
- key_size = this->signer_initiator->get_key_size(this->signer_initiator);
-
- prf_plus->allocate_bytes(prf_plus, key_size, &key);
- this->logger->log_chunk(this->logger, PRIVATE, "Sk_ai secret", key);
- this->signer_initiator->set_key(this->signer_initiator, key);
- chunk_free(&key);
-
- prf_plus->allocate_bytes(prf_plus, key_size, &key);
- this->logger->log_chunk(this->logger, PRIVATE, "Sk_ar secret", key);
- this->signer_responder->set_key(this->signer_responder, key);
- chunk_free(&key);
-
-
- /* SK_ei/SK_er used for encryption */
- proposal->get_algorithm(proposal, PROTO_IKE, ENCRYPTION_ALGORITHM, &algo);
- if (algo == NULL)
- {
- this->logger->log(this->logger, ERROR|LEVEL2, "No encryption algoithm selected!?");
- return FAILED;
- }
- if (this->crypter_initiator != NULL)
- {
- this->crypter_initiator->destroy(this->crypter_initiator);
- }
- if (this->crypter_responder != NULL)
- {
- this->crypter_responder->destroy(this->crypter_responder);
- }
-
- this->crypter_initiator = crypter_create(algo->algorithm, algo->key_size);
- this->crypter_responder = crypter_create(algo->algorithm, algo->key_size);
- if (this->crypter_initiator == NULL || this->crypter_responder == NULL)
- {
- this->logger->log(this->logger, ERROR|LEVEL1,
- "ENCRYPTION_ALGORITHM %s (key size %d) not supported!",
- mapping_find(encryption_algorithm_m, algo->algorithm),
- algo->key_size);
- return FAILED;
- }
- key_size = this->crypter_initiator->get_key_size(this->crypter_initiator);
-
- prf_plus->allocate_bytes(prf_plus, key_size, &key);
- this->logger->log_chunk(this->logger, PRIVATE, "Sk_ei secret", key);
- this->crypter_initiator->set_key(this->crypter_initiator, key);
- chunk_free(&key);
-
- prf_plus->allocate_bytes(prf_plus, key_size, &key);
- this->logger->log_chunk(this->logger, PRIVATE, "Sk_er secret", key);
- this->crypter_responder->set_key(this->crypter_responder, key);
- chunk_free(&key);
-
- /* SK_pi/SK_pr used for authentication */
- proposal->get_algorithm(proposal, PROTO_IKE, PSEUDO_RANDOM_FUNCTION, &algo);
- if (this->prf_auth_i != NULL)
- {
- this->prf_auth_i->destroy(this->prf_auth_i);
- }
- if (this->prf_auth_r != NULL)
- {
- this->prf_auth_r->destroy(this->prf_auth_r);
- }
-
- this->prf_auth_i = prf_create(algo->algorithm);
- this->prf_auth_r = prf_create(algo->algorithm);
-
- key_size = this->prf_auth_i->get_key_size(this->prf_auth_i);
- prf_plus->allocate_bytes(prf_plus, key_size, &key);
- this->logger->log_chunk(this->logger, PRIVATE, "Sk_pi secret", key);
- this->prf_auth_i->set_key(this->prf_auth_i, key);
- chunk_free(&key);
-
- prf_plus->allocate_bytes(prf_plus, key_size, &key);
- this->logger->log_chunk(this->logger, PRIVATE, "Sk_pr secret", key);
- this->prf_auth_r->set_key(this->prf_auth_r, key);
- chunk_free(&key);
-
- /* all done, prf_plus not needed anymore */
- prf_plus->destroy(prf_plus);
-
- return SUCCESS;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_randomizer.
- */
-static randomizer_t *get_randomizer (private_ike_sa_t *this)
-{
- return this->randomizer;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_crypter_initiator.
- */
-static crypter_t *get_crypter_initiator (private_ike_sa_t *this)
-{
- return this->crypter_initiator;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_signer_initiator.
- */
-static signer_t *get_signer_initiator (private_ike_sa_t *this)
-{
- return this->signer_initiator;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_crypter_responder.
- */
-static crypter_t *get_crypter_responder(private_ike_sa_t *this)
-{
- return this->crypter_responder;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_signer_responder.
- */
-static signer_t *get_signer_responder (private_ike_sa_t *this)
-{
- return this->signer_responder;
-}
-
-/**
- * Implementation of protected_ike_sa_t.send_request.
- */
-static status_t send_request (private_ike_sa_t *this,message_t * message)
-{
- retransmit_request_job_t *retransmit_job;
- u_int32_t timeout;
- crypter_t *crypter;
- signer_t *signer;
- packet_t *packet;
- status_t status;
-
- if (message->get_message_id(message) != this->message_id_out)
- {
- this->logger->log(this->logger, ERROR, "Message could not be sent cause id (%d) was not as expected (%d)",
- message->get_message_id(message),this->message_id_out);
- return FAILED;
- }
-
- /* generate packet */
- this->logger->log(this->logger, CONTROL|LEVEL2, "Generate packet from message");
-
- if (this->ike_sa_id->is_initiator(this->ike_sa_id))
- {
- crypter = this->crypter_initiator;
- signer = this->signer_initiator;
- }
- else
- {
- crypter = this->crypter_responder;
- signer =this->signer_responder;
- }
-
- status = message->generate(message, crypter,signer, &packet);
- if (status != SUCCESS)
- {
- this->logger->log(this->logger, ERROR, "Could not generate packet from message");
- return FAILED;
- }
-
- this->logger->log(this->logger, CONTROL|LEVEL3,
- "Add request packet with message id %d to global send queue",
- this->message_id_out);
- charon->send_queue->add(charon->send_queue, packet);
-
- if (this->last_requested_message != NULL)
- {
- /* destroy message */
- this->last_requested_message->destroy(this->last_requested_message);
- }
-
- this->logger->log(this->logger, CONTROL|LEVEL3, "Replace last requested message with new one");
- this->last_requested_message = message;
-
- retransmit_job = retransmit_request_job_create(this->message_id_out,this->ike_sa_id);
-
- status = charon->configuration->get_retransmit_timeout (charon->configuration,
- retransmit_job->get_retransmit_count(retransmit_job),&timeout);
-
- if (status != SUCCESS)
- {
- this->logger->log(this->logger, CONTROL|LEVEL2, "No retransmit job for message created!");
- retransmit_job->destroy(retransmit_job);
- }
- else
- {
- this->logger->log(this->logger, CONTROL|LEVEL2, "Request will be retransmitted in %d ms.",timeout);
- charon->event_queue->add_relative(charon->event_queue,(job_t *) retransmit_job,timeout);
- }
-
- /* message counter can now be increased */
- this->logger->log(this->logger, CONTROL|LEVEL3,
- "Increase message counter for outgoing messages from %d",
- this->message_id_out);
- this->message_id_out++;
- return SUCCESS;
-}
-
-/**
- * Implementation of protected_ike_sa_t.send_response.
- */
-static status_t send_response (private_ike_sa_t *this,message_t * message)
-{
- crypter_t *crypter;
- signer_t *signer;
- packet_t *packet;
- status_t status;
-
- if (message->get_message_id(message) != this->message_id_in)
- {
- this->logger->log(this->logger, ERROR, "Message could not be sent cause id was not as expected");
- return FAILED;
- }
-
-
- if (this->ike_sa_id->is_initiator(this->ike_sa_id))
- {
- crypter = this->crypter_initiator;
- signer = this->signer_initiator;
- }
- else
- {
- crypter = this->crypter_responder;
- signer =this->signer_responder;
- }
-
- status = message->generate(message, crypter,signer, &packet);
- if (status != SUCCESS)
- {
- this->logger->log(this->logger, ERROR, "Could not generate packet from message");
- return FAILED;
- }
-
- this->logger->log(this->logger, CONTROL|LEVEL3,
- "Add response packet with message id %d to global send queue",
- this->message_id_in);
- charon->send_queue->add(charon->send_queue, packet);
-
- if (this->last_responded_message != NULL)
- {
- /* destroy message */
- this->last_responded_message->destroy(this->last_responded_message);
- }
-
- this->logger->log(this->logger, CONTROL|LEVEL3, "Replace last responded message with new one");
- this->last_responded_message = message;
-
- /* message counter can now be increased */
- this->logger->log(this->logger, CONTROL|LEVEL3, "Increase message counter for incoming messages");
- this->message_id_in++;
-
- return SUCCESS;
-}
-
-/**
- * Implementation of of private_responder_init_t.send_notify_reply.
- */
-static void send_notify(private_ike_sa_t *this, exchange_type_t exchange_type, notify_message_type_t type, chunk_t data)
-{
- notify_payload_t *payload;
- message_t *response;
- packet_t *packet;
- status_t status;
-
- this->logger->log(this->logger, CONTROL|LEVEL2, "Going to build message with notify payload");
- /* set up the reply */
- this->protected.build_message(&(this->protected), exchange_type, FALSE, &response);
- payload = notify_payload_create_from_protocol_and_type(PROTO_IKE, type);
- if ((data.ptr != NULL) && (data.len > 0))
- {
- this->logger->log(this->logger, CONTROL|LEVEL2, "Add Data to notify payload");
- payload->set_notification_data(payload,data);
- }
-
- this->logger->log(this->logger, CONTROL|LEVEL2, "Add Notify payload to message");
- response->add_payload(response,(payload_t *) payload);
-
- /* generate packet */
- this->logger->log(this->logger, CONTROL|LEVEL2, "Generate packet from message");
- status = response->generate(response, this->crypter_responder, this->signer_responder, &packet);
- if (status != SUCCESS)
- {
- this->logger->log(this->logger, ERROR|LEVEL1, "Could not generate notify message");
- response->destroy(response);
- return;
- }
-
- this->logger->log(this->logger, CONTROL|LEVEL2, "Add packet to global send queue");
- charon->send_queue->add(charon->send_queue, packet);
- this->logger->log(this->logger, CONTROL|LEVEL2, "Destroy message");
- response->destroy(response);
-}
-
-/**
- * Implementation of protected_ike_sa_t.set_last_replied_message_id.
- */
-static void set_last_replied_message_id (private_ike_sa_t *this,u_int32_t message_id)
-{
- this->last_replied_message_id = message_id;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_last_responded_message.
- */
-static message_t * get_last_responded_message (private_ike_sa_t *this)
-{
- return this->last_responded_message;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_last_requested_message.
- */
-static message_t * get_last_requested_message (private_ike_sa_t *this)
-{
- return this->last_requested_message;
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_state.
- */
-static ike_sa_state_t get_state (private_ike_sa_t *this)
-{
- return this->current_state->get_state(this->current_state);
-}
-
-/**
- * Implementation of protected_ike_sa_t.get_state.
- */
-static void add_child_sa (private_ike_sa_t *this, child_sa_t *child_sa)
-{
- this->child_sas->insert_last(this->child_sas, child_sa);
-}
-
-/**
- * Implementation of protected_ike_sa_t.reset_message_buffers.
- */
-static void reset_message_buffers (private_ike_sa_t *this)
-{
- this->logger->log(this->logger, CONTROL|LEVEL2, "Reset message counters and destroy stored messages");
- /* destroy stored requested message */
- if (this->last_requested_message != NULL)
- {
- this->last_requested_message->destroy(this->last_requested_message);
- this->last_requested_message = NULL;
- }
-
- /* destroy stored responded messages */
- if (this->last_responded_message != NULL)
- {
- this->last_responded_message->destroy(this->last_responded_message);
- this->last_responded_message = NULL;
- }
-
- this->message_id_out = 0;
- this->message_id_in = 0;
- this->last_replied_message_id = -1;
-}
-
-/**
- * Implementation of protected_ike_sa_t.log_status.
- */
-static void log_status(private_ike_sa_t *this, logger_t *logger, char *name)
-{
- iterator_t *iterator;
- child_sa_t *child_sa;
-
- /* only log if name == NULL or name == connection_name */
- if (name)
- {
- if (strcmp(this->connection->get_name(this->connection), name) != 0)
- {
- return;
- }
- }
- else
- {
- name = this->connection->get_name(this->connection);
- }
-
- host_t *my_host = this->connection->get_my_host(this->connection);
- host_t *other_host = this->connection->get_other_host(this->connection);
-
- identification_t *my_id = this->connection->get_my_id(this->connection);
- identification_t *other_id = this->connection->get_other_id(this->connection);
-
- if (logger == NULL)
- {
- logger = this->logger;
- }
- logger->log(logger, CONTROL|LEVEL1, "\"%s\": IKE_SA in state %s, SPIs: 0x%.16llx 0x%.16llx",
- name,
- mapping_find(ike_sa_state_m, this->current_state->get_state(this->current_state)),
- this->ike_sa_id->get_initiator_spi(this->ike_sa_id),
- this->ike_sa_id->get_responder_spi(this->ike_sa_id));
- logger->log(logger, CONTROL, "\"%s\": %s[%s]...%s[%s]",
- name,
- my_host->get_address(my_host),
- my_id->get_string(my_id),
- other_host->get_address(other_host),
- other_id->get_string(other_id));
-
- iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
- while (iterator->has_next(iterator))
- {
- iterator->current(iterator, (void**)&child_sa);
- child_sa->log_status(child_sa, logger, name);
- }
- iterator->destroy(iterator);
-}
-
-/**
- * Implementation of protected_ike_sa_t.destroy.
- */
-static void destroy (private_ike_sa_t *this)
-{
- child_sa_t *child_sa;
-
- this->logger->log(this->logger, CONTROL|LEVEL2, "Going to destroy IKE SA %llu:%llu, role %s",
- this->ike_sa_id->get_initiator_spi(this->ike_sa_id),
- this->ike_sa_id->get_responder_spi(this->ike_sa_id),
- this->ike_sa_id->is_initiator(this->ike_sa_id) ? "initiator" : "responder");
-
- /* inform other peer of delete */
- send_delete_ike_sa_request(this);
- while (this->child_sas->remove_last(this->child_sas, (void**)&child_sa) == SUCCESS)
- {
- child_sa->destroy(child_sa);
- }
- this->child_sas->destroy(this->child_sas);
-
- if (this->crypter_initiator)
- {
- this->crypter_initiator->destroy(this->crypter_initiator);
- }
- if (this->crypter_responder)
- {
- this->crypter_responder->destroy(this->crypter_responder);
- }
- if (this->signer_initiator)
- {
- this->signer_initiator->destroy(this->signer_initiator);
- }
- if (this->signer_responder)
- {
- this->signer_responder->destroy(this->signer_responder);
- }
- if (this->prf)
- {
- this->prf->destroy(this->prf);
- }
- if (this->child_prf)
- {
- this->child_prf->destroy(this->child_prf);
- }
- if (this->prf_auth_i)
- {
- this->prf_auth_i->destroy(this->prf_auth_i);
- }
- if (this->prf_auth_r)
- {
- this->prf_auth_r->destroy(this->prf_auth_r);
- }
- if (this->connection)
- {
- host_t *me, *other;
- me = this->connection->get_my_host(this->connection);
- other = this->connection->get_other_host(this->connection);
-
- this->logger->log(this->logger, AUDIT, "IKE_SA deleted between %s - %s",
- me->get_address(me), other->get_address(other));
- this->connection->destroy(this->connection);
- }
- if (this->policy)
- {
- this->policy->destroy(this->policy);
- }
- if (this->last_requested_message)
- {
- this->last_requested_message->destroy(this->last_requested_message);
- }
- if (this->last_responded_message)
- {
- this->last_responded_message->destroy(this->last_responded_message);
- }
- this->ike_sa_id->destroy(this->ike_sa_id);
- this->randomizer->destroy(this->randomizer);
- this->current_state->destroy(this->current_state);
-
- free(this);
-}
-
-/*
- * Described in header.
- */
-ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
-{
- private_ike_sa_t *this = malloc_thing(private_ike_sa_t);
-
- /* Public functions */
- this->protected.public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
- this->protected.public.initiate_connection = (status_t(*)(ike_sa_t*,connection_t*)) initiate_connection;
- this->protected.public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
- this->protected.public.get_my_host = (host_t*(*)(ike_sa_t*)) get_my_host;
- this->protected.public.get_other_host = (host_t*(*)(ike_sa_t*)) get_other_host;
- this->protected.public.get_my_id = (identification_t*(*)(ike_sa_t*)) get_my_id;
- this->protected.public.get_other_id = (identification_t*(*)(ike_sa_t*)) get_other_id;
- this->protected.public.get_connection = (connection_t*(*)(ike_sa_t*)) get_connection;
- this->protected.public.retransmit_request = (status_t (*) (ike_sa_t *, u_int32_t)) retransmit_request;
- this->protected.public.get_state = (ike_sa_state_t (*) (ike_sa_t *this)) get_state;
- this->protected.public.send_delete_ike_sa_request = (void (*)(ike_sa_t*)) send_delete_ike_sa_request;
- this->protected.public.log_status = (void (*) (ike_sa_t*,logger_t*,char*))log_status;
- this->protected.public.destroy = (void(*)(ike_sa_t*))destroy;
-
- /* protected functions */
- this->protected.build_message = (void (*) (protected_ike_sa_t *, exchange_type_t , bool , message_t **)) build_message;
- this->protected.get_prf = (prf_t *(*) (protected_ike_sa_t *)) get_prf;
- this->protected.get_child_prf = (prf_t *(*) (protected_ike_sa_t *)) get_child_prf;
- this->protected.get_prf_auth_i = (prf_t *(*) (protected_ike_sa_t *)) get_prf_auth_i;
- this->protected.get_prf_auth_r = (prf_t *(*) (protected_ike_sa_t *)) get_prf_auth_r;
- this->protected.add_child_sa = (void (*) (protected_ike_sa_t*,child_sa_t*)) add_child_sa;
- this->protected.set_connection = (void (*) (protected_ike_sa_t *,connection_t *)) set_connection;
- this->protected.get_connection = (connection_t *(*) (protected_ike_sa_t *)) get_connection;
- this->protected.set_policy = (void (*) (protected_ike_sa_t *,policy_t *)) set_policy;
- this->protected.get_policy = (policy_t *(*) (protected_ike_sa_t *)) get_policy;
- this->protected.get_randomizer = (randomizer_t *(*) (protected_ike_sa_t *)) get_randomizer;
- this->protected.send_request = (status_t (*) (protected_ike_sa_t *,message_t *)) send_request;
- this->protected.send_response = (status_t (*) (protected_ike_sa_t *,message_t *)) send_response;
- this->protected.send_notify = (void (*)(protected_ike_sa_t*,exchange_type_t,notify_message_type_t,chunk_t)) send_notify;
- this->protected.build_transforms = (status_t (*) (protected_ike_sa_t *,proposal_t*,diffie_hellman_t*,chunk_t,chunk_t)) build_transforms;
- this->protected.set_new_state = (void (*) (protected_ike_sa_t *,state_t *)) set_new_state;
- this->protected.get_crypter_initiator = (crypter_t *(*) (protected_ike_sa_t *)) get_crypter_initiator;
- this->protected.get_signer_initiator = (signer_t *(*) (protected_ike_sa_t *)) get_signer_initiator;
- this->protected.get_crypter_responder = (crypter_t *(*) (protected_ike_sa_t *)) get_crypter_responder;
- this->protected.get_signer_responder = (signer_t *(*) (protected_ike_sa_t *)) get_signer_responder;
- this->protected.reset_message_buffers = (void (*) (protected_ike_sa_t *)) reset_message_buffers;
- this->protected.get_last_responded_message = (message_t * (*) (protected_ike_sa_t *this)) get_last_responded_message;
- this->protected.get_last_requested_message = (message_t * (*) (protected_ike_sa_t *this)) get_last_requested_message;
-
- this->protected.set_last_replied_message_id = (void (*) (protected_ike_sa_t *,u_int32_t)) set_last_replied_message_id;
-
- /* private functions */
- this->resend_last_reply = resend_last_reply;
-
- /* initialize private fields */
- this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
-
- this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
- this->child_sas = linked_list_create();
- this->randomizer = randomizer_create();
-
- this->last_requested_message = NULL;
- this->last_responded_message = NULL;
- this->message_id_out = 0;
- this->message_id_in = 0;
- this->last_replied_message_id = -1;
- this->crypter_initiator = NULL;
- this->crypter_responder = NULL;
- this->signer_initiator = NULL;
- this->signer_responder = NULL;
- this->prf = NULL;
- this->prf_auth_i = NULL;
- this->prf_auth_r = NULL;
- this->child_prf = NULL;
- this->connection = NULL;
- this->policy = NULL;
-
- /* at creation time, IKE_SA is in a initiator state */
- if (ike_sa_id->is_initiator(ike_sa_id))
- {
- this->logger->log(this->logger, CONTROL | LEVEL2, "Create first state_t object of type INITIATOR_INIT");
- this->current_state = (state_t *) initiator_init_create(&(this->protected));
- }
- else
- {
- this->logger->log(this->logger, CONTROL | LEVEL2, "Create first state_t object of type RESPONDER_INIT");
- this->current_state = (state_t *) responder_init_create(&(this->protected));
- }
- return &(this->protected.public);
-}