diff options
Diffstat (limited to 'src/charon/encoding')
-rw-r--r-- | src/charon/encoding/generator.c | 4 | ||||
-rw-r--r-- | src/charon/encoding/message.c | 14 | ||||
-rw-r--r-- | src/charon/encoding/parser.c | 52 | ||||
-rw-r--r-- | src/charon/encoding/payloads/eap_payload.c | 181 | ||||
-rw-r--r-- | src/charon/encoding/payloads/eap_payload.h | 90 | ||||
-rw-r--r-- | src/charon/encoding/payloads/encodings.h | 2 | ||||
-rw-r--r-- | src/charon/encoding/payloads/notify_payload.c | 4 | ||||
-rw-r--r-- | src/charon/encoding/payloads/notify_payload.h | 4 |
8 files changed, 252 insertions, 99 deletions
diff --git a/src/charon/encoding/generator.c b/src/charon/encoding/generator.c index 07db45f1b..efa845bb3 100644 --- a/src/charon/encoding/generator.c +++ b/src/charon/encoding/generator.c @@ -738,7 +738,7 @@ static void generate_payload (private_generator_t *this,payload_t *payload) case SPIS: case CONFIGURATION_ATTRIBUTE_VALUE: case VID_DATA: - case EAP_MESSAGE: + case EAP_DATA: { u_int32_t payload_length_position_offset; u_int16_t length_of_payload; @@ -777,7 +777,7 @@ static void generate_payload (private_generator_t *this,payload_t *payload) case CONFIGURATION_ATTRIBUTE_VALUE: header_length = CONFIGURATION_ATTRIBUTE_HEADER_LENGTH; break; - case EAP_MESSAGE: + case EAP_DATA: header_length = EAP_PAYLOAD_HEADER_LENGTH; break; default: diff --git a/src/charon/encoding/message.c b/src/charon/encoding/message.c index f1b92e934..fb37c996d 100644 --- a/src/charon/encoding/message.c +++ b/src/charon/encoding/message.c @@ -142,11 +142,12 @@ static payload_rule_t ike_sa_init_r_payload_rules[] = { */ static payload_rule_t ike_auth_i_payload_rules[] = { {NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,FALSE}, + {EXTENSIBLE_AUTHENTICATION,0,1,TRUE,TRUE}, + {AUTHENTICATION,0,1,TRUE,TRUE}, {ID_INITIATOR,1,1,TRUE,FALSE}, {CERTIFICATE,0,1,TRUE,FALSE}, {CERTIFICATE_REQUEST,0,1,TRUE,FALSE}, {ID_RESPONDER,0,1,TRUE,FALSE}, - {AUTHENTICATION,1,1,TRUE,FALSE}, {SECURITY_ASSOCIATION,1,1,TRUE,FALSE}, {TRAFFIC_SELECTOR_INITIATOR,1,1,TRUE,FALSE}, {TRAFFIC_SELECTOR_RESPONDER,1,1,TRUE,FALSE}, @@ -158,12 +159,13 @@ static payload_rule_t ike_auth_i_payload_rules[] = { */ static payload_rule_t ike_auth_r_payload_rules[] = { {NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,TRUE}, + {EXTENSIBLE_AUTHENTICATION,0,1,TRUE,TRUE}, {CERTIFICATE,0,1,TRUE,FALSE}, - {ID_RESPONDER,1,1,TRUE,FALSE}, - {AUTHENTICATION,1,1,TRUE,FALSE}, - {SECURITY_ASSOCIATION,1,1,TRUE,FALSE}, - {TRAFFIC_SELECTOR_INITIATOR,1,1,TRUE,FALSE}, - {TRAFFIC_SELECTOR_RESPONDER,1,1,TRUE,FALSE}, + {ID_RESPONDER,0,1,TRUE,FALSE}, + {AUTHENTICATION,0,1,TRUE,FALSE}, + {SECURITY_ASSOCIATION,0,1,TRUE,FALSE}, + {TRAFFIC_SELECTOR_INITIATOR,0,1,TRUE,FALSE}, + {TRAFFIC_SELECTOR_RESPONDER,0,1,TRUE,FALSE}, {CONFIGURATION,0,1,TRUE,FALSE}, }; diff --git a/src/charon/encoding/parser.c b/src/charon/encoding/parser.c index d7f10f711..d7caf7099 100644 --- a/src/charon/encoding/parser.c +++ b/src/charon/encoding/parser.c @@ -626,7 +626,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case U_INT_32: { @@ -635,7 +635,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case U_INT_64: { @@ -644,7 +644,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case IKE_SPI: { @@ -653,7 +653,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case RESERVED_BIT: { @@ -662,7 +662,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case RESERVED_BYTE: { @@ -680,7 +680,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case PAYLOAD_LENGTH: { @@ -690,7 +690,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ return PARSE_ERROR; } payload_length = *(u_int16_t*)(output + rule->offset); - break; + break; } case HEADER_LENGTH: { @@ -699,7 +699,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case SPI_SIZE: { @@ -709,7 +709,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ return PARSE_ERROR; } spi_size = *(u_int8_t*)(output + rule->offset); - break; + break; } case SPI: { @@ -718,7 +718,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case PROPOSALS: { @@ -728,7 +728,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case TRANSFORMS: { @@ -738,7 +738,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case TRANSFORM_ATTRIBUTES: { @@ -748,7 +748,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case CONFIGURATION_ATTRIBUTES: { @@ -758,7 +758,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case ATTRIBUTE_FORMAT: { @@ -789,7 +789,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ } attribute_length = *(u_int16_t*)(output + rule->offset); break; - } + } case ATTRIBUTE_LENGTH_OR_VALUE: { if (this->parse_uint16(this, rule_number, output + rule->offset) != SUCCESS) @@ -820,7 +820,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case ID_DATA: { @@ -830,7 +830,7 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ pld->destroy(pld); return PARSE_ERROR; } - break; + break; } case AUTH_DATA: { @@ -839,8 +839,8 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ { pld->destroy(pld); return PARSE_ERROR; - } - break; + } + break; } case CERT_DATA: { @@ -849,8 +849,8 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ { pld->destroy(pld); return PARSE_ERROR; - } - break; + } + break; } case CERTREQ_DATA: { @@ -859,18 +859,18 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ { pld->destroy(pld); return PARSE_ERROR; - } - break; + } + break; } - case EAP_MESSAGE: + case EAP_DATA: { size_t data_length = payload_length - EAP_PAYLOAD_HEADER_LENGTH; if (this->parse_chunk(this, rule_number, output + rule->offset, data_length) != SUCCESS) { pld->destroy(pld); return PARSE_ERROR; - } - break; + } + break; } case SPIS: { diff --git a/src/charon/encoding/payloads/eap_payload.c b/src/charon/encoding/payloads/eap_payload.c index aa886e9c4..79ab32fe5 100644 --- a/src/charon/encoding/payloads/eap_payload.c +++ b/src/charon/encoding/payloads/eap_payload.c @@ -25,6 +25,7 @@ #include "eap_payload.h" +#include <daemon.h> typedef struct private_eap_payload_t private_eap_payload_t; @@ -54,9 +55,9 @@ struct private_eap_payload_t { u_int16_t payload_length; /** - * The contained message. + * EAP message data, if available */ - chunk_t message; + chunk_t data; }; /** @@ -80,21 +81,21 @@ encoding_rule_t eap_payload_encodings[] = { { RESERVED_BIT, 0 }, { RESERVED_BIT, 0 }, /* Length of the whole payload*/ - { PAYLOAD_LENGTH, offsetof(private_eap_payload_t, payload_length)}, - /* some eap data bytes, length is defined in PAYLOAD_LENGTH */ - { EAP_MESSAGE, offsetof(private_eap_payload_t, message) } + { PAYLOAD_LENGTH, offsetof(private_eap_payload_t, payload_length) }, + /* chunt to data, starting at "code" */ + { EAP_DATA, offsetof(private_eap_payload_t, data) }, }; /* - 1 2 3 + 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ! Next Payload !C! RESERVED ! Payload Length ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - ! ! - ~ EAP Message ~ - ! ! + ! Code ! Identifier ! Length ! +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + ! Type ! Type_Data... + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- */ /** @@ -102,6 +103,47 @@ encoding_rule_t eap_payload_encodings[] = { */ static status_t verify(private_eap_payload_t *this) { + u_int16_t length; + u_int8_t code; + + if (this->data.len < 4) + { + DBG1(DBG_ENC, "EAP payloads EAP message too short (%d)", this->data.len); + return FAILED; + } + code = *this->data.ptr; + length = htons(*(u_int16_t*)(this->data.ptr + 2)); + if (this->data.len != length) + { + DBG1(DBG_ENC, "EAP payload length (%d) does not match contained message length (%d)", + this->data.len, length); + return FAILED; + } + switch (code) + { + case EAP_REQUEST: + case EAP_RESPONSE: + { + if (this->data.len < 4) + { + DBG1(DBG_ENC, "EAP Request/Response does not have any data"); + return FAILED; + } + break; + } + case EAP_SUCCESS: + case EAP_FAILURE: + { + if (this->data.len != 4) + { + DBG1(DBG_ENC, "EAP Success/Failure has data"); + return FAILED; + } + break; + } + default: + return FAILED; + } return SUCCESS; } @@ -147,40 +189,59 @@ static size_t get_length(private_eap_payload_t *this) } /** - * Implementation of eap_payload_t.set_message. + * Implementation of eap_payload_t.get_data. + */ +static chunk_t get_data(private_eap_payload_t *this) +{ + return this->data; +} + +/** + * Implementation of eap_payload_t.set_data. */ -static void set_message (private_eap_payload_t *this, chunk_t message) +static void set_data(private_eap_payload_t *this, chunk_t data) { - if (this->message.ptr != NULL) + chunk_free(&this->data); + this->data = chunk_clone(data); + this->payload_length = this->data.len + 4; +} + +/** + * Implementation of eap_payload_t.get_code. + */ +static eap_code_t get_code(private_eap_payload_t *this) +{ + if (this->data.len > 0) { - chunk_free(&(this->message)); + return *this->data.ptr; } - this->message.ptr = clalloc(message.ptr,message.len); - this->message.len = message.len; - this->payload_length = EAP_PAYLOAD_HEADER_LENGTH + this->message.len; + /* should not happen, as it is verified */ + return 0; } /** - * Implementation of eap_payload_t.get_message. + * Implementation of eap_payload_t.get_identifier. */ -static chunk_t get_message (private_eap_payload_t *this) +static u_int8_t get_identifier(private_eap_payload_t *this) { - return (this->message); + if (this->data.len > 1) + { + return *(this->data.ptr + 1); + } + /* should not happen, as it is verified */ + return 0; } /** - * Implementation of eap_payload_t.get_data_clone. + * Implementation of eap_payload_t.get_type. */ -static chunk_t get_message_clone (private_eap_payload_t *this) +static eap_type_t get_type(private_eap_payload_t *this) { - chunk_t cloned_message; - if (this->message.ptr == NULL) + if (this->data.len > 4) { - return (this->message); + return *(this->data.ptr + 4); } - cloned_message.ptr = clalloc(this->message.ptr,this->message.len); - cloned_message.len = this->message.len; - return cloned_message; + return 0; } /** @@ -188,12 +249,8 @@ static chunk_t get_message_clone (private_eap_payload_t *this) */ static void destroy(private_eap_payload_t *this) { - if (this->message.ptr != NULL) - { - chunk_free(&(this->message)); - } - - free(this); + chunk_free(&this->data); + free(this); } /* @@ -202,7 +259,7 @@ static void destroy(private_eap_payload_t *this) eap_payload_t *eap_payload_create() { private_eap_payload_t *this = malloc_thing(private_eap_payload_t); - + /* interface functions */ this->public.payload_interface.verify = (status_t (*) (payload_t *))verify; this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules; @@ -214,15 +271,61 @@ eap_payload_t *eap_payload_create() /* public functions */ this->public.destroy = (void (*) (eap_payload_t *)) destroy; - this->public.set_message = (void (*) (eap_payload_t *,chunk_t)) set_message; - this->public.get_message_clone = (chunk_t (*) (eap_payload_t *)) get_message_clone; - this->public.get_message = (chunk_t (*) (eap_payload_t *)) get_message; + this->public.get_data = (chunk_t (*) (eap_payload_t*))get_data; + this->public.set_data = (void (*) (eap_payload_t *,chunk_t))set_data; + this->public.get_code = (eap_code_t (*) (eap_payload_t*))get_code; + this->public.get_identifier = (u_int8_t (*) (eap_payload_t*))get_identifier; + this->public.get_type = (eap_type_t (*) (eap_payload_t*))get_type; /* private variables */ this->critical = FALSE; this->next_payload = NO_PAYLOAD; this->payload_length = EAP_PAYLOAD_HEADER_LENGTH; - this->message = chunk_empty; + this->data = chunk_empty; + + return &(this->public); +} + +/* + * Described in header + */ +eap_payload_t *eap_payload_create_data(chunk_t data) +{ + eap_payload_t *this = eap_payload_create(); + + this->set_data(this, data); + return this; +} - return (&(this->public)); +/* + * Described in header + */ +eap_payload_t *eap_payload_create_code(eap_code_t code) +{ + eap_payload_t *this = eap_payload_create(); + chunk_t data = chunk_alloca(4); + + *(data.ptr + 0) = code; + *(data.ptr + 1) = 0; + *(u_int16_t*)(data.ptr + 2) = htons(data.len); + + this->set_data(this, data); + return this; +} + +/* + * Described in header + */ +eap_payload_t *eap_payload_create_nak() +{ + eap_payload_t *this = eap_payload_create(); + chunk_t data = chunk_alloca(5); + + *(data.ptr + 0) = EAP_RESPONSE; + *(data.ptr + 1) = 0; + *(u_int16_t*)(data.ptr + 2) = htons(data.len); + *(data.ptr + 4) = EAP_NAK; + + this->set_data(this, data); + return this; } diff --git a/src/charon/encoding/payloads/eap_payload.h b/src/charon/encoding/payloads/eap_payload.h index bf493eb7f..13c0ade80 100644 --- a/src/charon/encoding/payloads/eap_payload.h +++ b/src/charon/encoding/payloads/eap_payload.h @@ -28,6 +28,7 @@ typedef struct eap_payload_t eap_payload_t; #include <library.h> #include <encoding/payloads/payload.h> +#include <sa/authenticators/eap/eap_method.h> /** * Length of a EAP payload without the EAP Message in bytes. @@ -44,62 +45,105 @@ typedef struct eap_payload_t eap_payload_t; * @b Constructors: * - eap_payload_create() * - * @todo Implement functionality for this payload - * * @ingroup payloads */ struct eap_payload_t { + /** * The payload_t interface. */ payload_t payload_interface; /** - * @brief Set the EAP Message. - * - * Data are getting cloned. + * @brief Set the contained EAP data. + * + * This contains the FULL EAP message starting with "code". + * Chunk gets cloned. + * + * @param this calling eap_payload_t object + * @param message EAP data + */ + void (*set_data) (eap_payload_t *this, chunk_t data); + + /** + * @brief Get the contained EAP data. + * + * This contains the FULL EAP message starting with "code". * - * @param this calling eap_payload_t object - * @param message EAP message as chunk_t + * @param this calling eap_payload_t object + * @return EAP data (pointer to internal data) */ - void (*set_message) (eap_payload_t *this, chunk_t message); + chunk_t (*get_data) (eap_payload_t *this); /** - * @brief Get the EAP message. - * - * Returned data are a copy of the internal one. + * @brief Get the EAP code. * - * @param this calling eap_payload_t object - * @return EAP message as chunk_t + * @param this calling eap_payload_t object + * @return EAP message as chunk_t */ - chunk_t (*get_message_clone) (eap_payload_t *this); + eap_code_t (*get_code) (eap_payload_t *this); /** - * @brief Get the EAP message. - * - * Returned data are NOT copied. + * @brief Get the EAP identifier. * - * @param this calling eap_payload_t object - * @return EAP message as chunk_t + * @param this calling eap_payload_t object + * @return unique identifier */ - chunk_t (*get_message) (eap_payload_t *this); + u_int8_t (*get_identifier) (eap_payload_t *this); + + /** + * @brief Get the EAP method type. + * + * @param this calling eap_payload_t object + * @return EAP method type + */ + eap_type_t (*get_type) (eap_payload_t *this); /** * @brief Destroys an eap_payload_t object. * - * @param this eap_payload_t object to destroy + * @param this eap_payload_t object to destroy */ void (*destroy) (eap_payload_t *this); }; /** * @brief Creates an empty eap_payload_t object. - * + * * @return eap_payload_t object - * + * * @ingroup payloads */ eap_payload_t *eap_payload_create(void); +/** + * @brief Creates an eap_payload_t object with data. + * + * @return eap_payload_t object + * + * @ingroup payloads + */ +eap_payload_t *eap_payload_create_data(chunk_t data); + +/** + * @brief Creates an eap_payload_t object with a code. + * + * Could should be either EAP_SUCCESS/EAP_FAILURE, use + * constructor above otherwise. + * + * @return eap_payload_t object + * + * @ingroup payloads + */ +eap_payload_t *eap_payload_create_code(eap_code_t code); + +/** + * @brief Creates an eap_payload_t EAP_RESPONSE containing an EAP_NAK. + * + * @return eap_payload_t object + * + * @ingroup payloads + */ +eap_payload_t *eap_payload_create_nak(); #endif /* EAP_PAYLOAD_H_ */ diff --git a/src/charon/encoding/payloads/encodings.h b/src/charon/encoding/payloads/encodings.h index ed5596ecd..5e07fbfab 100644 --- a/src/charon/encoding/payloads/encodings.h +++ b/src/charon/encoding/payloads/encodings.h @@ -449,7 +449,7 @@ enum encoding_type_t { * * When parsing (Payload Length - 4) bytes are read and written into the chunk pointing to. */ - EAP_MESSAGE, + EAP_DATA, /** * Representating the SPIS field in a DELETE payload. diff --git a/src/charon/encoding/payloads/notify_payload.c b/src/charon/encoding/payloads/notify_payload.c index b11d8f206..38ee0946d 100644 --- a/src/charon/encoding/payloads/notify_payload.c +++ b/src/charon/encoding/payloads/notify_payload.c @@ -75,7 +75,9 @@ ENUM_NEXT(notify_type_names, INITIAL_CONTACT, AUTH_LIFETIME, INVALID_SELECTORS, "COOKIE2", "NO_NATS_ALLOWED", "AUTH_LIFETIME"); -ENUM_END(notify_type_names, AUTH_LIFETIME); +ENUM_NEXT(notify_type_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, AUTH_LIFETIME, + "EAP_ONLY_AUTHENTICATION"); +ENUM_END(notify_type_names, EAP_ONLY_AUTHENTICATION); typedef struct private_notify_payload_t private_notify_payload_t; diff --git a/src/charon/encoding/payloads/notify_payload.h b/src/charon/encoding/payloads/notify_payload.h index 8861b9f4b..431932631 100644 --- a/src/charon/encoding/payloads/notify_payload.h +++ b/src/charon/encoding/payloads/notify_payload.h @@ -88,8 +88,10 @@ enum notify_type_t { NO_NATS_ALLOWED = 16402, /* repeated authentication extension, RFC4478 */ AUTH_LIFETIME = 16403, + /* draft-eronen-ipsec-ikev2-eap-auth, not assigned by IANA yet */ + EAP_ONLY_AUTHENTICATION = 40960, /* BEET mode, not even a draft yet. private use */ - USE_BEET_MODE = 40960, + USE_BEET_MODE = 40961, }; /** |