![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to message.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / encoding|
Return to message.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / encoding |
1.1 misho 1: /*
2: * Copyright (C) 2006-2018 Tobias Brunner
3: * Copyright (C) 2005-2010 Martin Willi
4: * Copyright (C) 2010 revosec AG
5: * Copyright (C) 2006 Daniel Roethlisberger
6: * Copyright (C) 2005 Jan Hutter
7: * HSR Hochschule fuer Technik Rapperswil
8: *
9: * This program is free software; you can redistribute it and/or modify it
10: * under the terms of the GNU General Public License as published by the
11: * Free Software Foundation; either version 2 of the License, or (at your
12: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13: *
14: * This program is distributed in the hope that it will be useful, but
15: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
16: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17: * for more details.
18: */
19:
20: #include <stdlib.h>
21: #include <string.h>
22:
23: #include "message.h"
24:
25: #include <library.h>
26: #include <bio/bio_writer.h>
27: #include <collections/array.h>
28: #include <daemon.h>
29: #include <sa/ikev1/keymat_v1.h>
30: #include <encoding/generator.h>
31: #include <encoding/parser.h>
32: #include <encoding/payloads/encodings.h>
33: #include <encoding/payloads/payload.h>
34: #include <encoding/payloads/hash_payload.h>
35: #include <encoding/payloads/encrypted_payload.h>
36: #include <encoding/payloads/encrypted_fragment_payload.h>
37: #include <encoding/payloads/unknown_payload.h>
38: #include <encoding/payloads/cp_payload.h>
39: #include <encoding/payloads/fragment_payload.h>
40:
41: /**
42: * Max number of notify payloads per IKEv2 message
43: */
44: #define MAX_NOTIFY_PAYLOADS 20
45:
46: /**
47: * Max number of delete payloads per IKEv2 message
48: */
49: #define MAX_DELETE_PAYLOADS 20
50:
51: /**
52: * Max number of certificate payloads per IKEv2 message
53: */
54: #define MAX_CERT_PAYLOADS 8
55:
56: /**
57: * Max number of vendor ID payloads per IKEv2 message
58: */
59: #define MAX_VID_PAYLOADS 20
60:
61: /**
62: * Max number of certificate request payloads per IKEv1 message
63: */
64: #define MAX_CERTREQ_PAYLOADS 20
65:
66: /**
67: * Max number of NAT-D payloads per IKEv1 message
68: */
69: #define MAX_NAT_D_PAYLOADS 10
70:
71: /**
72: * A payload rule defines the rules for a payload
73: * in a specific message rule. It defines if and how
74: * many times a payload must/can occur in a message
75: * and if it must be encrypted.
76: */
77: typedef struct {
78: /* Payload type */
79: payload_type_t type;
80: /* Minimal occurrence of this payload. */
81: size_t min_occurrence;
82: /* Max occurrence of this payload. */
83: size_t max_occurrence;
84: /* TRUE if payload must be encrypted */
85: bool encrypted;
86: /* If payload occurs, the message rule is fulfilled */
87: bool sufficient;
88: } payload_rule_t;
89:
90: /**
91: * payload ordering structure allows us to reorder payloads according to RFC.
92: */
93: typedef struct {
94: /** payload type */
95: payload_type_t type;
96: /** notify type, if payload == PLV2_NOTIFY */
97: notify_type_t notify;
98: } payload_order_t;
99:
100: /**
101: * A message rule defines the kind of a message,
102: * if it has encrypted contents and a list
103: * of payload ordering rules and payload parsing rules.
104: */
105: typedef struct {
106: /** Type of message. */
107: exchange_type_t exchange_type;
108: /** Is message a request or response. */
109: bool is_request;
110: /** Message contains encrypted payloads. */
111: bool encrypted;
112: /** Number of payload rules which will follow */
113: int rule_count;
114: /** Pointer to first payload rule */
115: payload_rule_t *rules;
116: /** Number of payload order rules */
117: int order_count;
118: /** payload ordering rules */
119: payload_order_t *order;
120: } message_rule_t;
121:
122: /**
123: * Message rule for IKE_SA_INIT from initiator.
124: */
125: static payload_rule_t ike_sa_init_i_rules[] = {
126: /* payload type min max encr suff */
127: {PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, FALSE},
128: {PLV2_SECURITY_ASSOCIATION, 1, 1, FALSE, FALSE},
129: {PLV2_KEY_EXCHANGE, 1, 1, FALSE, FALSE},
130: {PLV2_NONCE, 1, 1, FALSE, FALSE},
131: {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
132: };
133:
134: /**
135: * payload order for IKE_SA_INIT initiator
136: */
137: static payload_order_t ike_sa_init_i_order[] = {
138: /* payload type notify type */
139: {PLV2_NOTIFY, COOKIE},
140: {PLV2_SECURITY_ASSOCIATION, 0},
141: {PLV2_KEY_EXCHANGE, 0},
142: {PLV2_NONCE, 0},
143: {PLV2_NOTIFY, NAT_DETECTION_SOURCE_IP},
144: {PLV2_NOTIFY, NAT_DETECTION_DESTINATION_IP},
145: {PLV2_NOTIFY, 0},
146: {PLV2_VENDOR_ID, 0},
147: };
148:
149: /**
150: * Message rule for IKE_SA_INIT from responder.
151: */
152: static payload_rule_t ike_sa_init_r_rules[] = {
153: /* payload type min max encr suff */
154: {PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, TRUE},
155: {PLV2_SECURITY_ASSOCIATION, 1, 1, FALSE, FALSE},
156: {PLV2_KEY_EXCHANGE, 1, 1, FALSE, FALSE},
157: {PLV2_NONCE, 1, 1, FALSE, FALSE},
158: {PLV2_CERTREQ, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
159: {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
160: };
161:
162: /**
163: * payload order for IKE_SA_INIT responder
164: */
165: static payload_order_t ike_sa_init_r_order[] = {
166: /* payload type notify type */
167: {PLV2_SECURITY_ASSOCIATION, 0},
168: {PLV2_KEY_EXCHANGE, 0},
169: {PLV2_NONCE, 0},
170: {PLV2_NOTIFY, NAT_DETECTION_SOURCE_IP},
171: {PLV2_NOTIFY, NAT_DETECTION_DESTINATION_IP},
172: {PLV2_NOTIFY, HTTP_CERT_LOOKUP_SUPPORTED},
173: {PLV2_CERTREQ, 0},
174: {PLV2_NOTIFY, 0},
175: {PLV2_VENDOR_ID, 0},
176: };
177:
178: /**
179: * Message rule for IKE_AUTH from initiator.
180: */
181: static payload_rule_t ike_auth_i_rules[] = {
182: /* payload type min max encr suff */
183: {PLV2_FRAGMENT, 0, 1, TRUE, TRUE},
184: {PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
185: {PLV2_EAP, 0, 1, TRUE, TRUE},
186: {PLV2_AUTH, 0, 1, TRUE, TRUE},
187: {PLV2_ID_INITIATOR, 0, 1, TRUE, FALSE},
188: {PLV2_CERTIFICATE, 0, MAX_CERT_PAYLOADS, TRUE, FALSE},
189: {PLV2_CERTREQ, 0, MAX_CERTREQ_PAYLOADS, TRUE, FALSE},
190: {PLV2_ID_RESPONDER, 0, 1, TRUE, FALSE},
191: #ifdef ME
192: {PLV2_SECURITY_ASSOCIATION, 0, 1, TRUE, FALSE},
193: {PLV2_TS_INITIATOR, 0, 1, TRUE, FALSE},
194: {PLV2_TS_RESPONDER, 0, 1, TRUE, FALSE},
195: #else
196: {PLV2_SECURITY_ASSOCIATION, 0, 1, TRUE, FALSE},
197: {PLV2_TS_INITIATOR, 0, 1, TRUE, FALSE},
198: {PLV2_TS_RESPONDER, 0, 1, TRUE, FALSE},
199: #endif /* ME */
200: {PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
201: {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
202: };
203:
204: /**
205: * payload order for IKE_AUTH initiator
206: */
207: static payload_order_t ike_auth_i_order[] = {
208: /* payload type notify type */
209: {PLV2_ID_INITIATOR, 0},
210: {PLV2_CERTIFICATE, 0},
211: {PLV2_NOTIFY, INITIAL_CONTACT},
212: {PLV2_NOTIFY, HTTP_CERT_LOOKUP_SUPPORTED},
213: {PLV2_CERTREQ, 0},
214: {PLV2_ID_RESPONDER, 0},
215: {PLV2_AUTH, 0},
216: {PLV2_EAP, 0},
217: {PLV2_CONFIGURATION, 0},
218: {PLV2_NOTIFY, IPCOMP_SUPPORTED},
219: {PLV2_NOTIFY, USE_TRANSPORT_MODE},
220: {PLV2_NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
221: {PLV2_NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
222: {PLV2_SECURITY_ASSOCIATION, 0},
223: {PLV2_TS_INITIATOR, 0},
224: {PLV2_TS_RESPONDER, 0},
225: {PLV2_NOTIFY, MOBIKE_SUPPORTED},
226: {PLV2_NOTIFY, ADDITIONAL_IP4_ADDRESS},
227: {PLV2_NOTIFY, ADDITIONAL_IP6_ADDRESS},
228: {PLV2_NOTIFY, NO_ADDITIONAL_ADDRESSES},
229: {PLV2_NOTIFY, 0},
230: {PLV2_VENDOR_ID, 0},
231: {PLV2_FRAGMENT, 0},
232: };
233:
234: /**
235: * Message rule for IKE_AUTH from responder.
236: */
237: static payload_rule_t ike_auth_r_rules[] = {
238: /* payload type min max encr suff */
239: {PLV2_FRAGMENT, 0, 1, TRUE, TRUE},
240: {PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
241: {PLV2_EAP, 0, 1, TRUE, TRUE},
242: {PLV2_AUTH, 0, 1, TRUE, TRUE},
243: {PLV2_CERTIFICATE, 0, MAX_CERT_PAYLOADS, TRUE, FALSE},
244: {PLV2_ID_RESPONDER, 0, 1, TRUE, FALSE},
245: {PLV2_SECURITY_ASSOCIATION, 0, 1, TRUE, FALSE},
246: {PLV2_TS_INITIATOR, 0, 1, TRUE, FALSE},
247: {PLV2_TS_RESPONDER, 0, 1, TRUE, FALSE},
248: {PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
249: {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
250: };
251:
252: /**
253: * payload order for IKE_AUTH responder
254: */
255: static payload_order_t ike_auth_r_order[] = {
256: /* payload type notify type */
257: {PLV2_ID_RESPONDER, 0},
258: {PLV2_CERTIFICATE, 0},
259: {PLV2_AUTH, 0},
260: {PLV2_EAP, 0},
261: {PLV2_CONFIGURATION, 0},
262: {PLV2_NOTIFY, IPCOMP_SUPPORTED},
263: {PLV2_NOTIFY, USE_TRANSPORT_MODE},
264: {PLV2_NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
265: {PLV2_NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
266: {PLV2_SECURITY_ASSOCIATION, 0},
267: {PLV2_TS_INITIATOR, 0},
268: {PLV2_TS_RESPONDER, 0},
269: {PLV2_NOTIFY, AUTH_LIFETIME},
270: {PLV2_NOTIFY, MOBIKE_SUPPORTED},
271: {PLV2_NOTIFY, ADDITIONAL_IP4_ADDRESS},
272: {PLV2_NOTIFY, ADDITIONAL_IP6_ADDRESS},
273: {PLV2_NOTIFY, NO_ADDITIONAL_ADDRESSES},
274: {PLV2_NOTIFY, 0},
275: {PLV2_VENDOR_ID, 0},
276: {PLV2_FRAGMENT, 0},
277: };
278:
279: /**
280: * Message rule for INFORMATIONAL from initiator.
281: */
282: static payload_rule_t informational_i_rules[] = {
283: /* payload type min max encr suff */
284: {PLV2_FRAGMENT, 0, 1, TRUE, TRUE},
285: {PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
286: {PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
287: {PLV2_DELETE, 0, MAX_DELETE_PAYLOADS, TRUE, FALSE},
288: {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
289: };
290:
291: /**
292: * payload order for INFORMATIONAL initiator
293: */
294: static payload_order_t informational_i_order[] = {
295: /* payload type notify type */
296: {PLV2_NOTIFY, UPDATE_SA_ADDRESSES},
297: {PLV2_NOTIFY, NAT_DETECTION_SOURCE_IP},
298: {PLV2_NOTIFY, NAT_DETECTION_DESTINATION_IP},
299: {PLV2_NOTIFY, COOKIE2},
300: {PLV2_NOTIFY, 0},
301: {PLV2_DELETE, 0},
302: {PLV2_CONFIGURATION, 0},
303: {PLV2_FRAGMENT, 0},
304: };
305:
306: /**
307: * Message rule for INFORMATIONAL from responder.
308: */
309: static payload_rule_t informational_r_rules[] = {
310: /* payload type min max encr suff */
311: {PLV2_FRAGMENT, 0, 1, TRUE, TRUE},
312: {PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
313: {PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
314: {PLV2_DELETE, 0, MAX_DELETE_PAYLOADS, TRUE, FALSE},
315: {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
316: };
317:
318: /**
319: * payload order for INFORMATIONAL responder
320: */
321: static payload_order_t informational_r_order[] = {
322: /* payload type notify type */
323: {PLV2_NOTIFY, UPDATE_SA_ADDRESSES},
324: {PLV2_NOTIFY, NAT_DETECTION_SOURCE_IP},
325: {PLV2_NOTIFY, NAT_DETECTION_DESTINATION_IP},
326: {PLV2_NOTIFY, COOKIE2},
327: {PLV2_NOTIFY, 0},
328: {PLV2_DELETE, 0},
329: {PLV2_CONFIGURATION, 0},
330: {PLV2_FRAGMENT, 0},
331: };
332:
333: /**
334: * Message rule for CREATE_CHILD_SA from initiator.
335: */
336: static payload_rule_t create_child_sa_i_rules[] = {
337: /* payload type min max encr suff */
338: {PLV2_FRAGMENT, 0, 1, TRUE, TRUE},
339: {PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
340: {PLV2_SECURITY_ASSOCIATION, 1, 1, TRUE, FALSE},
341: {PLV2_NONCE, 1, 1, TRUE, FALSE},
342: {PLV2_KEY_EXCHANGE, 0, 1, TRUE, FALSE},
343: {PLV2_TS_INITIATOR, 0, 1, TRUE, FALSE},
344: {PLV2_TS_RESPONDER, 0, 1, TRUE, FALSE},
345: {PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
346: {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
347: };
348:
349: /**
350: * payload order for CREATE_CHILD_SA from initiator.
351: */
352: static payload_order_t create_child_sa_i_order[] = {
353: /* payload type notify type */
354: {PLV2_NOTIFY, REKEY_SA},
355: {PLV2_NOTIFY, IPCOMP_SUPPORTED},
356: {PLV2_NOTIFY, USE_TRANSPORT_MODE},
357: {PLV2_NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
358: {PLV2_NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
359: {PLV2_SECURITY_ASSOCIATION, 0},
360: {PLV2_NONCE, 0},
361: {PLV2_KEY_EXCHANGE, 0},
362: {PLV2_TS_INITIATOR, 0},
363: {PLV2_TS_RESPONDER, 0},
364: {PLV2_NOTIFY, 0},
365: {PLV2_FRAGMENT, 0},
366: };
367:
368: /**
369: * Message rule for CREATE_CHILD_SA from responder.
370: */
371: static payload_rule_t create_child_sa_r_rules[] = {
372: /* payload type min max encr suff */
373: {PLV2_FRAGMENT, 0, 1, TRUE, TRUE},
374: {PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
375: {PLV2_SECURITY_ASSOCIATION, 1, 1, TRUE, FALSE},
376: {PLV2_NONCE, 1, 1, TRUE, FALSE},
377: {PLV2_KEY_EXCHANGE, 0, 1, TRUE, FALSE},
378: {PLV2_TS_INITIATOR, 0, 1, TRUE, FALSE},
379: {PLV2_TS_RESPONDER, 0, 1, TRUE, FALSE},
380: {PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
381: {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
382: };
383:
384: /**
385: * payload order for CREATE_CHILD_SA from responder.
386: */
387: static payload_order_t create_child_sa_r_order[] = {
388: /* payload type notify type */
389: {PLV2_NOTIFY, IPCOMP_SUPPORTED},
390: {PLV2_NOTIFY, USE_TRANSPORT_MODE},
391: {PLV2_NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
392: {PLV2_NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
393: {PLV2_SECURITY_ASSOCIATION, 0},
394: {PLV2_NONCE, 0},
395: {PLV2_KEY_EXCHANGE, 0},
396: {PLV2_TS_INITIATOR, 0},
397: {PLV2_TS_RESPONDER, 0},
398: {PLV2_NOTIFY, ADDITIONAL_TS_POSSIBLE},
399: {PLV2_NOTIFY, 0},
400: {PLV2_FRAGMENT, 0},
401: };
402:
403: #ifdef ME
404: /**
405: * Message rule for ME_CONNECT from initiator.
406: */
407: static payload_rule_t me_connect_i_rules[] = {
408: /* payload type min max encr suff */
409: {PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
410: {PLV2_ID_PEER, 1, 1, TRUE, FALSE},
411: {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE}
412: };
413:
414: /**
415: * payload order for ME_CONNECT from initiator.
416: */
417: static payload_order_t me_connect_i_order[] = {
418: /* payload type notify type */
419: {PLV2_NOTIFY, 0},
420: {PLV2_ID_PEER, 0},
421: {PLV2_VENDOR_ID, 0},
422: };
423:
424: /**
425: * Message rule for ME_CONNECT from responder.
426: */
427: static payload_rule_t me_connect_r_rules[] = {
428: /* payload type min max encr suff */
429: {PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
430: {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE}
431: };
432:
433: /**
434: * payload order for ME_CONNECT from responder.
435: */
436: static payload_order_t me_connect_r_order[] = {
437: /* payload type notify type */
438: {PLV2_NOTIFY, 0},
439: {PLV2_VENDOR_ID, 0},
440: };
441: #endif /* ME */
442:
443: #ifdef USE_IKEV1
444: /**
445: * Message rule for ID_PROT from initiator.
446: */
447: static payload_rule_t id_prot_i_rules[] = {
448: /* payload type min max encr suff */
449: {PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, FALSE},
450: {PLV1_SECURITY_ASSOCIATION, 0, 1, FALSE, FALSE},
451: {PLV1_KEY_EXCHANGE, 0, 1, FALSE, FALSE},
452: {PLV1_NONCE, 0, 1, FALSE, FALSE},
453: {PLV1_VENDOR_ID, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
454: {PLV1_CERTREQ, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
455: {PLV1_NAT_D, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
456: {PLV1_NAT_D_DRAFT_00_03, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
457: {PLV1_ID, 0, 1, TRUE, FALSE},
458: {PLV1_CERTIFICATE, 0, MAX_CERT_PAYLOADS, TRUE, FALSE},
459: {PLV1_SIGNATURE, 0, 1, TRUE, FALSE},
460: {PLV1_HASH, 0, 1, TRUE, FALSE},
461: {PLV1_FRAGMENT, 0, 1, FALSE, TRUE},
462: };
463:
464: /**
465: * payload order for ID_PROT from initiator.
466: */
467: static payload_order_t id_prot_i_order[] = {
468: /* payload type notify type */
469: {PLV1_SECURITY_ASSOCIATION, 0},
470: {PLV1_KEY_EXCHANGE, 0},
471: {PLV1_NONCE, 0},
472: {PLV1_ID, 0},
473: {PLV1_CERTIFICATE, 0},
474: {PLV1_SIGNATURE, 0},
475: {PLV1_HASH, 0},
476: {PLV1_CERTREQ, 0},
477: {PLV1_NOTIFY, 0},
478: {PLV1_VENDOR_ID, 0},
479: {PLV1_NAT_D, 0},
480: {PLV1_NAT_D_DRAFT_00_03, 0},
481: {PLV1_FRAGMENT, 0},
482: };
483:
484: /**
485: * Message rule for ID_PROT from responder.
486: */
487: static payload_rule_t id_prot_r_rules[] = {
488: /* payload type min max encr suff */
489: {PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, FALSE},
490: {PLV1_SECURITY_ASSOCIATION, 0, 1, FALSE, FALSE},
491: {PLV1_KEY_EXCHANGE, 0, 1, FALSE, FALSE},
492: {PLV1_NONCE, 0, 1, FALSE, FALSE},
493: {PLV1_VENDOR_ID, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
494: {PLV1_CERTREQ, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
495: {PLV1_NAT_D, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
496: {PLV1_NAT_D_DRAFT_00_03, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
497: {PLV1_ID, 0, 1, TRUE, FALSE},
498: {PLV1_CERTIFICATE, 0, MAX_CERT_PAYLOADS, TRUE, FALSE},
499: {PLV1_SIGNATURE, 0, 1, TRUE, FALSE},
500: {PLV1_HASH, 0, 1, TRUE, FALSE},
501: {PLV1_FRAGMENT, 0, 1, FALSE, TRUE},
502: };
503:
504: /**
505: * payload order for ID_PROT from responder.
506: */
507: static payload_order_t id_prot_r_order[] = {
508: /* payload type notify type */
509: {PLV1_SECURITY_ASSOCIATION, 0},
510: {PLV1_KEY_EXCHANGE, 0},
511: {PLV1_NONCE, 0},
512: {PLV1_ID, 0},
513: {PLV1_CERTIFICATE, 0},
514: {PLV1_SIGNATURE, 0},
515: {PLV1_HASH, 0},
516: {PLV1_CERTREQ, 0},
517: {PLV1_NOTIFY, 0},
518: {PLV1_VENDOR_ID, 0},
519: {PLV1_NAT_D, 0},
520: {PLV1_NAT_D_DRAFT_00_03, 0},
521: {PLV1_FRAGMENT, 0},
522: };
523:
524: /**
525: * Message rule for AGGRESSIVE from initiator.
526: */
527: static payload_rule_t aggressive_i_rules[] = {
528: /* payload type min max encr suff */
529: {PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, FALSE},
530: {PLV1_SECURITY_ASSOCIATION, 0, 1, FALSE, FALSE},
531: {PLV1_KEY_EXCHANGE, 0, 1, FALSE, FALSE},
532: {PLV1_NONCE, 0, 1, FALSE, FALSE},
533: {PLV1_VENDOR_ID, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
534: {PLV1_CERTREQ, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
535: {PLV1_NAT_D, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
536: {PLV1_NAT_D_DRAFT_00_03, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
537: {PLV1_ID, 0, 1, FALSE, FALSE},
538: {PLV1_CERTIFICATE, 0, MAX_CERT_PAYLOADS, TRUE, FALSE},
539: {PLV1_SIGNATURE, 0, 1, TRUE, FALSE},
540: {PLV1_HASH, 0, 1, TRUE, FALSE},
541: {PLV1_FRAGMENT, 0, 1, FALSE, TRUE},
542: };
543:
544: /**
545: * payload order for AGGRESSIVE from initiator.
546: */
547: static payload_order_t aggressive_i_order[] = {
548: /* payload type notify type */
549: {PLV1_SECURITY_ASSOCIATION, 0},
550: {PLV1_KEY_EXCHANGE, 0},
551: {PLV1_NONCE, 0},
552: {PLV1_ID, 0},
553: {PLV1_CERTIFICATE, 0},
554: {PLV1_CERTREQ, 0},
555: {PLV1_NOTIFY, 0},
556: {PLV1_VENDOR_ID, 0},
557: {PLV1_HASH, 0},
558: {PLV1_NAT_D, 0},
559: {PLV1_NAT_D_DRAFT_00_03, 0},
560: {PLV1_SIGNATURE, 0},
561: {PLV1_FRAGMENT, 0},
562: };
563:
564: /**
565: * Message rule for AGGRESSIVE from responder.
566: */
567: static payload_rule_t aggressive_r_rules[] = {
568: /* payload type min max encr suff */
569: {PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, FALSE},
570: {PLV1_SECURITY_ASSOCIATION, 0, 1, FALSE, FALSE},
571: {PLV1_KEY_EXCHANGE, 0, 1, FALSE, FALSE},
572: {PLV1_NONCE, 0, 1, FALSE, FALSE},
573: {PLV1_VENDOR_ID, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
574: {PLV1_CERTREQ, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
575: {PLV1_NAT_D, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
576: {PLV1_NAT_D_DRAFT_00_03, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
577: {PLV1_ID, 0, 1, FALSE, FALSE},
578: {PLV1_CERTIFICATE, 0, MAX_CERT_PAYLOADS, FALSE, FALSE},
579: {PLV1_SIGNATURE, 0, 1, FALSE, FALSE},
580: {PLV1_HASH, 0, 1, FALSE, FALSE},
581: {PLV1_FRAGMENT, 0, 1, FALSE, TRUE},
582: };
583:
584: /**
585: * payload order for AGGRESSIVE from responder.
586: */
587: static payload_order_t aggressive_r_order[] = {
588: /* payload type notify type */
589: {PLV1_SECURITY_ASSOCIATION, 0},
590: {PLV1_KEY_EXCHANGE, 0},
591: {PLV1_NONCE, 0},
592: {PLV1_ID, 0},
593: {PLV1_CERTIFICATE, 0},
594: {PLV1_CERTREQ, 0},
595: {PLV1_NOTIFY, 0},
596: {PLV1_VENDOR_ID, 0},
597: {PLV1_NAT_D, 0},
598: {PLV1_NAT_D_DRAFT_00_03, 0},
599: {PLV1_SIGNATURE, 0},
600: {PLV1_HASH, 0},
601: {PLV1_FRAGMENT, 0},
602: };
603:
604: /**
605: * Message rule for INFORMATIONAL_V1 from initiator.
606: */
607: static payload_rule_t informational_i_rules_v1[] = {
608: /* payload type min max encr suff */
609: {PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, FALSE},
610: {PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
611: {PLV1_DELETE, 0, MAX_DELETE_PAYLOADS, TRUE, FALSE},
612: {PLV1_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
613: };
614:
615: /**
616: * payload order for INFORMATIONAL_V1 from initiator.
617: */
618: static payload_order_t informational_i_order_v1[] = {
619: /* payload type notify type */
620: {PLV1_NOTIFY, 0},
621: {PLV1_DELETE, 0},
622: {PLV1_VENDOR_ID, 0},
623: };
624:
625: /**
626: * Message rule for INFORMATIONAL_V1 from responder.
627: */
628: static payload_rule_t informational_r_rules_v1[] = {
629: /* payload type min max encr suff */
630: {PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, FALSE},
631: {PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
632: {PLV1_DELETE, 0, MAX_DELETE_PAYLOADS, TRUE, FALSE},
633: {PLV1_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
634: };
635:
636: /**
637: * payload order for INFORMATIONAL_V1 from responder.
638: */
639: static payload_order_t informational_r_order_v1[] = {
640: /* payload type notify type */
641: {PLV1_NOTIFY, 0},
642: {PLV1_DELETE, 0},
643: {PLV1_VENDOR_ID, 0},
644: };
645:
646: /**
647: * Message rule for QUICK_MODE from initiator.
648: */
649: static payload_rule_t quick_mode_i_rules[] = {
650: /* payload type min max encr suff */
651: {PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
652: {PLV1_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
653: {PLV1_HASH, 0, 1, TRUE, FALSE},
654: {PLV1_SECURITY_ASSOCIATION, 0, 2, TRUE, FALSE},
655: {PLV1_NONCE, 0, 1, TRUE, FALSE},
656: {PLV1_KEY_EXCHANGE, 0, 1, TRUE, FALSE},
657: {PLV1_ID, 0, 2, TRUE, FALSE},
658: {PLV1_NAT_OA, 0, 2, TRUE, FALSE},
659: {PLV1_NAT_OA_DRAFT_00_03, 0, 2, TRUE, FALSE},
660: {PLV1_FRAGMENT, 0, 1, FALSE, TRUE},
661: };
662:
663: /**
664: * payload order for QUICK_MODE from initiator.
665: */
666: static payload_order_t quick_mode_i_order[] = {
667: /* payload type notify type */
668: {PLV1_NOTIFY, 0},
669: {PLV1_VENDOR_ID, 0},
670: {PLV1_HASH, 0},
671: {PLV1_SECURITY_ASSOCIATION, 0},
672: {PLV1_NONCE, 0},
673: {PLV1_KEY_EXCHANGE, 0},
674: {PLV1_ID, 0},
675: {PLV1_NAT_OA, 0},
676: {PLV1_NAT_OA_DRAFT_00_03, 0},
677: {PLV1_FRAGMENT, 0},
678: };
679:
680: /**
681: * Message rule for QUICK_MODE from responder.
682: */
683: static payload_rule_t quick_mode_r_rules[] = {
684: /* payload type min max encr suff */
685: {PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
686: {PLV1_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
687: {PLV1_HASH, 0, 1, TRUE, FALSE},
688: {PLV1_SECURITY_ASSOCIATION, 0, 2, TRUE, FALSE},
689: {PLV1_NONCE, 0, 1, TRUE, FALSE},
690: {PLV1_KEY_EXCHANGE, 0, 1, TRUE, FALSE},
691: {PLV1_ID, 0, 2, TRUE, FALSE},
692: {PLV1_NAT_OA, 0, 2, TRUE, FALSE},
693: {PLV1_NAT_OA_DRAFT_00_03, 0, 2, TRUE, FALSE},
694: {PLV1_FRAGMENT, 0, 1, FALSE, TRUE},
695: };
696:
697: /**
698: * payload order for QUICK_MODE from responder.
699: */
700: static payload_order_t quick_mode_r_order[] = {
701: /* payload type notify type */
702: {PLV1_NOTIFY, 0},
703: {PLV1_VENDOR_ID, 0},
704: {PLV1_HASH, 0},
705: {PLV1_SECURITY_ASSOCIATION, 0},
706: {PLV1_NONCE, 0},
707: {PLV1_KEY_EXCHANGE, 0},
708: {PLV1_ID, 0},
709: {PLV1_NAT_OA, 0},
710: {PLV1_NAT_OA_DRAFT_00_03, 0},
711: {PLV1_FRAGMENT, 0},
712: };
713:
714: /**
715: * Message rule for TRANSACTION.
716: */
717: static payload_rule_t transaction_payload_rules_v1[] = {
718: /* payload type min max encr suff */
719: {PLV1_HASH, 0, 1, TRUE, FALSE},
720: {PLV1_CONFIGURATION, 1, 1, FALSE, FALSE},
721: };
722:
723: /**
724: * Payload order for TRANSACTION.
725: */
726: static payload_order_t transaction_payload_order_v1[] = {
727: /* payload type notify type */
728: {PLV1_HASH, 0},
729: {PLV1_CONFIGURATION, 0},
730: };
731:
732: #endif /* USE_IKEV1 */
733:
734: /**
735: * Message rules, defines allowed payloads.
736: */
737: static message_rule_t message_rules[] = {
738: {IKE_SA_INIT, TRUE, FALSE,
739: countof(ike_sa_init_i_rules), ike_sa_init_i_rules,
740: countof(ike_sa_init_i_order), ike_sa_init_i_order,
741: },
742: {IKE_SA_INIT, FALSE, FALSE,
743: countof(ike_sa_init_r_rules), ike_sa_init_r_rules,
744: countof(ike_sa_init_r_order), ike_sa_init_r_order,
745: },
746: {IKE_AUTH, TRUE, TRUE,
747: countof(ike_auth_i_rules), ike_auth_i_rules,
748: countof(ike_auth_i_order), ike_auth_i_order,
749: },
750: {IKE_AUTH, FALSE, TRUE,
751: countof(ike_auth_r_rules), ike_auth_r_rules,
752: countof(ike_auth_r_order), ike_auth_r_order,
753: },
754: {INFORMATIONAL, TRUE, TRUE,
755: countof(informational_i_rules), informational_i_rules,
756: countof(informational_i_order), informational_i_order,
757: },
758: {INFORMATIONAL, FALSE, TRUE,
759: countof(informational_r_rules), informational_r_rules,
760: countof(informational_r_order), informational_r_order,
761: },
762: {CREATE_CHILD_SA, TRUE, TRUE,
763: countof(create_child_sa_i_rules), create_child_sa_i_rules,
764: countof(create_child_sa_i_order), create_child_sa_i_order,
765: },
766: {CREATE_CHILD_SA, FALSE, TRUE,
767: countof(create_child_sa_r_rules), create_child_sa_r_rules,
768: countof(create_child_sa_r_order), create_child_sa_r_order,
769: },
770: #ifdef ME
771: {ME_CONNECT, TRUE, TRUE,
772: countof(me_connect_i_rules), me_connect_i_rules,
773: countof(me_connect_i_order), me_connect_i_order,
774: },
775: {ME_CONNECT, FALSE, TRUE,
776: countof(me_connect_r_rules), me_connect_r_rules,
777: countof(me_connect_r_order), me_connect_r_order,
778: },
779: #endif /* ME */
780: #ifdef USE_IKEV1
781: {ID_PROT, TRUE, FALSE,
782: countof(id_prot_i_rules), id_prot_i_rules,
783: countof(id_prot_i_order), id_prot_i_order,
784: },
785: {ID_PROT, FALSE, FALSE,
786: countof(id_prot_r_rules), id_prot_r_rules,
787: countof(id_prot_r_order), id_prot_r_order,
788: },
789: {AGGRESSIVE, TRUE, FALSE,
790: countof(aggressive_i_rules), aggressive_i_rules,
791: countof(aggressive_i_order), aggressive_i_order,
792: },
793: {AGGRESSIVE, FALSE, FALSE,
794: countof(aggressive_r_rules), aggressive_r_rules,
795: countof(aggressive_r_order), aggressive_r_order,
796: },
797: {INFORMATIONAL_V1, TRUE, TRUE,
798: countof(informational_i_rules_v1), informational_i_rules_v1,
799: countof(informational_i_order_v1), informational_i_order_v1,
800: },
801: {INFORMATIONAL_V1, FALSE, TRUE,
802: countof(informational_r_rules_v1), informational_r_rules_v1,
803: countof(informational_r_order_v1), informational_r_order_v1,
804: },
805: {QUICK_MODE, TRUE, TRUE,
806: countof(quick_mode_i_rules), quick_mode_i_rules,
807: countof(quick_mode_i_order), quick_mode_i_order,
808: },
809: {QUICK_MODE, FALSE, TRUE,
810: countof(quick_mode_r_rules), quick_mode_r_rules,
811: countof(quick_mode_r_order), quick_mode_r_order,
812: },
813: {TRANSACTION, TRUE, TRUE,
814: countof(transaction_payload_rules_v1), transaction_payload_rules_v1,
815: countof(transaction_payload_order_v1), transaction_payload_order_v1,
816: },
817: {TRANSACTION, FALSE, TRUE,
818: countof(transaction_payload_rules_v1), transaction_payload_rules_v1,
819: countof(transaction_payload_order_v1), transaction_payload_order_v1,
820: },
821: /* TODO-IKEv1: define rules for other exchanges */
822: #endif /* USE_IKEV1 */
823: };
824:
825: /**
826: * Data for fragment reassembly.
827: */
828: typedef struct {
829:
830: /**
831: * For IKEv1 the number of the last fragment (in case we receive them out
832: * of order), since the first one starts with 1 this defines the number of
833: * fragments we expect.
834: * For IKEv2 we store the total number of fragment we received last.
835: */
836: uint16_t last;
837:
838: /**
839: * Length of all currently received fragments.
840: */
841: size_t len;
842:
843: /**
844: * Maximum length of a fragmented packet.
845: */
846: size_t max_packet;
847:
848: } fragment_data_t;
849:
850: typedef struct private_message_t private_message_t;
851:
852: /**
853: * Private data of an message_t object.
854: */
855: struct private_message_t {
856:
857: /**
858: * Public part of a message_t object.
859: */
860: message_t public;
861:
862: /**
863: * Minor version of message.
864: */
865: uint8_t major_version;
866:
867: /**
868: * Major version of message.
869: */
870: uint8_t minor_version;
871:
872: /**
873: * First Payload in message.
874: */
875: payload_type_t first_payload;
876:
877: /**
878: * Assigned exchange type.
879: */
880: exchange_type_t exchange_type;
881:
882: /**
883: * TRUE if message is a request, FALSE if a reply.
884: */
885: bool is_request;
886:
887: /**
888: * The message is encrypted (IKEv1)
889: */
890: bool is_encrypted;
891:
892: /**
893: * Higher version supported?
894: */
895: bool version_flag;
896:
897: /**
898: * Reserved bits in IKE header
899: */
900: bool reserved[2];
901:
902: /**
903: * Sorting of message disabled?
904: */
905: bool sort_disabled;
906:
907: /**
908: * Message ID of this message.
909: */
910: uint32_t message_id;
911:
912: /**
913: * ID of assigned IKE_SA.
914: */
915: ike_sa_id_t *ike_sa_id;
916:
917: /**
918: * Assigned UDP packet, stores incoming packet or last generated one.
919: */
920: packet_t *packet;
921:
922: /**
923: * Array of generated fragments (if any), as packet_t*.
924: * If defragmenting (i.e. frag != NULL) this contains fragment_t*
925: */
926: array_t *fragments;
927:
928: /**
929: * Linked List where payload data are stored in.
930: */
931: linked_list_t *payloads;
932:
933: /**
934: * Assigned parser to parse Header and Body of this message.
935: */
936: parser_t *parser;
937:
938: /**
939: * The message rule for this message instance
940: */
941: message_rule_t *rule;
942:
943: /**
944: * Data used to reassemble a fragmented message
945: */
946: fragment_data_t *frag;
947: };
948:
949: /**
950: * Maximum number of fragments we will handle
951: */
952: #define MAX_FRAGMENTS 255
953:
954: /**
955: * A single fragment within a fragmented message
956: */
957: typedef struct {
958:
959: /** fragment number */
960: uint8_t num;
961:
962: /** fragment data */
963: chunk_t data;
964:
965: } fragment_t;
966:
967: static void fragment_destroy(fragment_t *this)
968: {
969: chunk_free(&this->data);
970: free(this);
971: }
972:
973: static void reset_defrag(private_message_t *this)
974: {
975: array_destroy_function(this->fragments, (void*)fragment_destroy, NULL);
976: this->fragments = NULL;
977: this->frag->last = 0;
978: this->frag->len = 0;
979: }
980:
981: /**
982: * Get the message rule that applies to this message
983: */
984: static message_rule_t* get_message_rule(private_message_t *this)
985: {
986: int i;
987:
988: for (i = 0; i < countof(message_rules); i++)
989: {
990: if ((this->exchange_type == message_rules[i].exchange_type) &&
991: (this->is_request == message_rules[i].is_request))
992: {
993: return &message_rules[i];
994: }
995: }
996: return NULL;
997: }
998:
999: /**
1000: * Look up a payload rule
1001: */
1002: static payload_rule_t* get_payload_rule(private_message_t *this,
1003: payload_type_t type)
1004: {
1005: int i;
1006:
1007: for (i = 0; i < this->rule->rule_count;i++)
1008: {
1009: if (this->rule->rules[i].type == type)
1010: {
1011: return &this->rule->rules[i];
1012: }
1013: }
1014: return NULL;
1015: }
1016:
1017: METHOD(message_t, set_ike_sa_id, void,
1018: private_message_t *this,ike_sa_id_t *ike_sa_id)
1019: {
1020: DESTROY_IF(this->ike_sa_id);
1021: this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
1022: }
1023:
1024: METHOD(message_t, get_ike_sa_id, ike_sa_id_t*,
1025: private_message_t *this)
1026: {
1027: return this->ike_sa_id;
1028: }
1029:
1030: METHOD(message_t, set_message_id, void,
1031: private_message_t *this,uint32_t message_id)
1032: {
1033: this->message_id = message_id;
1034: }
1035:
1036: METHOD(message_t, get_message_id, uint32_t,
1037: private_message_t *this)
1038: {
1039: return this->message_id;
1040: }
1041:
1042: METHOD(message_t, get_initiator_spi, uint64_t,
1043: private_message_t *this)
1044: {
1045: return (this->ike_sa_id->get_initiator_spi(this->ike_sa_id));
1046: }
1047:
1048: METHOD(message_t, get_responder_spi, uint64_t,
1049: private_message_t *this)
1050: {
1051: return (this->ike_sa_id->get_responder_spi(this->ike_sa_id));
1052: }
1053:
1054: METHOD(message_t, set_major_version, void,
1055: private_message_t *this, uint8_t major_version)
1056: {
1057: this->major_version = major_version;
1058: }
1059:
1060: METHOD(message_t, get_major_version, uint8_t,
1061: private_message_t *this)
1062: {
1063: return this->major_version;
1064: }
1065:
1066: METHOD(message_t, set_minor_version, void,
1067: private_message_t *this,uint8_t minor_version)
1068: {
1069: this->minor_version = minor_version;
1070: }
1071:
1072: METHOD(message_t, get_minor_version, uint8_t,
1073: private_message_t *this)
1074: {
1075: return this->minor_version;
1076: }
1077:
1078: METHOD(message_t, set_exchange_type, void,
1079: private_message_t *this, exchange_type_t exchange_type)
1080: {
1081: this->exchange_type = exchange_type;
1082: }
1083:
1084: METHOD(message_t, get_exchange_type, exchange_type_t,
1085: private_message_t *this)
1086: {
1087: return this->exchange_type;
1088: }
1089:
1090: METHOD(message_t, get_first_payload_type, payload_type_t,
1091: private_message_t *this)
1092: {
1093: return this->first_payload;
1094: }
1095:
1096: METHOD(message_t, set_request, void,
1097: private_message_t *this, bool request)
1098: {
1099: this->is_request = request;
1100: }
1101:
1102: METHOD(message_t, get_request, bool,
1103: private_message_t *this)
1104: {
1105: return this->is_request;
1106: }
1107:
1108: METHOD(message_t, set_version_flag, void,
1109: private_message_t *this)
1110: {
1111: this->version_flag = TRUE;
1112: }
1113:
1114: METHOD(message_t, get_reserved_header_bit, bool,
1115: private_message_t *this, u_int nr)
1116: {
1117: if (nr < countof(this->reserved))
1118: {
1119: return this->reserved[nr];
1120: }
1121: return FALSE;
1122: }
1123:
1124: METHOD(message_t, set_reserved_header_bit, void,
1125: private_message_t *this, u_int nr)
1126: {
1127: if (nr < countof(this->reserved))
1128: {
1129: this->reserved[nr] = TRUE;
1130: }
1131: }
1132:
1133: METHOD(message_t, is_encoded, bool,
1134: private_message_t *this)
1135: {
1136: return this->packet->get_data(this->packet).ptr != NULL;
1137: }
1138:
1139: METHOD(message_t, is_fragmented, bool,
1140: private_message_t *this)
1141: {
1142: return array_count(this->fragments) > 0;
1143: }
1144:
1145: METHOD(message_t, add_payload, void,
1146: private_message_t *this, payload_t *payload)
1147: {
1148: payload_t *last_payload;
1149:
1150: if (this->payloads->get_count(this->payloads) > 0)
1151: {
1152: this->payloads->get_last(this->payloads, (void **)&last_payload);
1153: last_payload->set_next_type(last_payload, payload->get_type(payload));
1154: }
1155: else
1156: {
1157: this->first_payload = payload->get_type(payload);
1158: }
1159: payload->set_next_type(payload, PL_NONE);
1160: this->payloads->insert_last(this->payloads, payload);
1161:
1162: DBG2(DBG_ENC ,"added payload of type %N to message",
1163: payload_type_names, payload->get_type(payload));
1164: }
1165:
1166: METHOD(message_t, add_notify, void,
1167: private_message_t *this, bool flush, notify_type_t type, chunk_t data)
1168: {
1169: notify_payload_t *notify;
1170: payload_t *payload;
1171:
1172: if (flush)
1173: {
1174: while (this->payloads->remove_last(this->payloads,
1175: (void**)&payload) == SUCCESS)
1176: {
1177: payload->destroy(payload);
1178: }
1179: }
1180: if (this->major_version == IKEV2_MAJOR_VERSION)
1181: {
1182: notify = notify_payload_create(PLV2_NOTIFY);
1183: }
1184: else
1185: {
1186: notify = notify_payload_create(PLV1_NOTIFY);
1187: }
1188: notify->set_notify_type(notify, type);
1189: notify->set_notification_data(notify, data);
1190: add_payload(this, (payload_t*)notify);
1191: }
1192:
1193: METHOD(message_t, set_source, void,
1194: private_message_t *this, host_t *host)
1195: {
1196: this->packet->set_source(this->packet, host);
1197: }
1198:
1199: METHOD(message_t, set_destination, void,
1200: private_message_t *this, host_t *host)
1201: {
1202: this->packet->set_destination(this->packet, host);
1203: }
1204:
1205: METHOD(message_t, get_source, host_t*,
1206: private_message_t *this)
1207: {
1208: return this->packet->get_source(this->packet);
1209: }
1210:
1211: METHOD(message_t, get_destination, host_t*,
1212: private_message_t *this)
1213: {
1214: return this->packet->get_destination(this->packet);
1215: }
1216:
1217: METHOD(message_t, create_payload_enumerator, enumerator_t*,
1218: private_message_t *this)
1219: {
1220: return this->payloads->create_enumerator(this->payloads);
1221: }
1222:
1223: METHOD(message_t, remove_payload_at, void,
1224: private_message_t *this, enumerator_t *enumerator)
1225: {
1226: this->payloads->remove_at(this->payloads, enumerator);
1227: }
1228:
1229: METHOD(message_t, get_payload, payload_t*,
1230: private_message_t *this, payload_type_t type)
1231: {
1232: payload_t *current, *found = NULL;
1233: enumerator_t *enumerator;
1234:
1235: enumerator = create_payload_enumerator(this);
1236: while (enumerator->enumerate(enumerator, ¤t))
1237: {
1238: if (current->get_type(current) == type)
1239: {
1240: found = current;
1241: break;
1242: }
1243: }
1244: enumerator->destroy(enumerator);
1245: return found;
1246: }
1247:
1248: METHOD(message_t, get_notify, notify_payload_t*,
1249: private_message_t *this, notify_type_t type)
1250: {
1251: enumerator_t *enumerator;
1252: notify_payload_t *notify = NULL;
1253: payload_t *payload;
1254:
1255: enumerator = create_payload_enumerator(this);
1256: while (enumerator->enumerate(enumerator, &payload))
1257: {
1258: if (payload->get_type(payload) == PLV2_NOTIFY ||
1259: payload->get_type(payload) == PLV1_NOTIFY)
1260: {
1261: notify = (notify_payload_t*)payload;
1262: if (notify->get_notify_type(notify) == type)
1263: {
1264: break;
1265: }
1266: notify = NULL;
1267: }
1268: }
1269: enumerator->destroy(enumerator);
1270: return notify;
1271: }
1272:
1273: /**
1274: * get a string representation of the message
1275: */
1276: static char* get_string(private_message_t *this, char *buf, int len)
1277: {
1278: enumerator_t *enumerator;
1279: payload_t *payload;
1280: int written;
1281: char *pos = buf;
1282:
1283: memset(buf, 0, len);
1284: len--;
1285:
1286: written = snprintf(pos, len, "%N %s %u [",
1287: exchange_type_names, this->exchange_type,
1288: this->is_request ? "request" : "response",
1289: this->message_id);
1290: if (written >= len || written < 0)
1291: {
1292: return "";
1293: }
1294: pos += written;
1295: len -= written;
1296:
1297: enumerator = create_payload_enumerator(this);
1298: while (enumerator->enumerate(enumerator, &payload))
1299: {
1300: written = snprintf(pos, len, " %N", payload_type_short_names,
1301: payload->get_type(payload));
1302: if (written >= len || written < 0)
1303: {
1304: return buf;
1305: }
1306: pos += written;
1307: len -= written;
1308: if (payload->get_type(payload) == PLV2_NOTIFY ||
1309: payload->get_type(payload) == PLV1_NOTIFY)
1310: {
1311: notify_payload_t *notify;
1312: notify_type_t type;
1313: chunk_t data;
1314:
1315: notify = (notify_payload_t*)payload;
1316: type = notify->get_notify_type(notify);
1317: data = notify->get_notification_data(notify);
1318: if (type == MS_NOTIFY_STATUS && data.len == 4)
1319: {
1320: written = snprintf(pos, len, "(%N(%d))", notify_type_short_names,
1321: type, untoh32(data.ptr));
1322: }
1323: else
1324: {
1325: written = snprintf(pos, len, "(%N)", notify_type_short_names,
1326: type);
1327: }
1328: if (written >= len || written < 0)
1329: {
1330: return buf;
1331: }
1332: pos += written;
1333: len -= written;
1334: }
1335: if (payload->get_type(payload) == PLV2_EAP)
1336: {
1337: eap_payload_t *eap = (eap_payload_t*)payload;
1338: uint32_t vendor;
1339: eap_type_t type;
1340: char method[64] = "";
1341:
1342: type = eap->get_type(eap, &vendor);
1343: if (type)
1344: {
1345: if (vendor)
1346: {
1347: snprintf(method, sizeof(method), "/%d-%d", type, vendor);
1348: }
1349: else
1350: {
1351: snprintf(method, sizeof(method), "/%N",
1352: eap_type_short_names, type);
1353: }
1354: }
1355: written = snprintf(pos, len, "/%N%s", eap_code_short_names,
1356: eap->get_code(eap), method);
1357: if (written >= len || written < 0)
1358: {
1359: return buf;
1360: }
1361: pos += written;
1362: len -= written;
1363: }
1364: if (payload->get_type(payload) == PLV2_CONFIGURATION ||
1365: payload->get_type(payload) == PLV1_CONFIGURATION)
1366: {
1367: cp_payload_t *cp = (cp_payload_t*)payload;
1368: enumerator_t *attributes;
1369: configuration_attribute_t *attribute;
1370: bool first = TRUE;
1371: char *pfx;
1372:
1373: switch (cp->get_type(cp))
1374: {
1375: case CFG_REQUEST:
1376: pfx = "RQ(";
1377: break;
1378: case CFG_REPLY:
1379: pfx = "RP(";
1380: break;
1381: case CFG_SET:
1382: pfx = "S(";
1383: break;
1384: case CFG_ACK:
1385: pfx = "A(";
1386: break;
1387: default:
1388: pfx = "(";
1389: break;
1390: }
1391:
1392: attributes = cp->create_attribute_enumerator(cp);
1393: while (attributes->enumerate(attributes, &attribute))
1394: {
1395: written = snprintf(pos, len, "%s%N", first ? pfx : " ",
1396: configuration_attribute_type_short_names,
1397: attribute->get_type(attribute));
1398: if (written >= len || written < 0)
1399: {
1400: return buf;
1401: }
1402: pos += written;
1403: len -= written;
1404: first = FALSE;
1405: }
1406: attributes->destroy(attributes);
1407: if (!first)
1408: {
1409: written = snprintf(pos, len, ")");
1410: if (written >= len || written < 0)
1411: {
1412: return buf;
1413: }
1414: pos += written;
1415: len -= written;
1416: }
1417: }
1418: if (payload->get_type(payload) == PLV1_FRAGMENT)
1419: {
1420: fragment_payload_t *frag;
1421:
1422: frag = (fragment_payload_t*)payload;
1423: if (frag->is_last(frag))
1424: {
1425: written = snprintf(pos, len, "(%u/%u)",
1426: frag->get_number(frag), frag->get_number(frag));
1427: }
1428: else
1429: {
1430: written = snprintf(pos, len, "(%u)", frag->get_number(frag));
1431: }
1432: if (written >= len || written < 0)
1433: {
1434: return buf;
1435: }
1436: pos += written;
1437: len -= written;
1438: }
1439: if (payload->get_type(payload) == PLV2_FRAGMENT)
1440: {
1441: encrypted_fragment_payload_t *frag;
1442:
1443: frag = (encrypted_fragment_payload_t*)payload;
1444: written = snprintf(pos, len, "(%u/%u)",
1445: frag->get_fragment_number(frag),
1446: frag->get_total_fragments(frag));
1447: if (written >= len || written < 0)
1448: {
1449: return buf;
1450: }
1451: pos += written;
1452: len -= written;
1453: }
1454: if (payload->get_type(payload) == PL_UNKNOWN)
1455: {
1456: unknown_payload_t *unknown;
1457:
1458: unknown = (unknown_payload_t*)payload;
1459: written = snprintf(pos, len, "(%d)", unknown->get_type(unknown));
1460: if (written >= len || written < 0)
1461: {
1462: return buf;
1463: }
1464: pos += written;
1465: len -= written;
1466: }
1467: }
1468: enumerator->destroy(enumerator);
1469:
1470: /* remove last space */
1471: snprintf(pos, len, " ]");
1472: return buf;
1473: }
1474:
1475: METHOD(message_t, disable_sort, void,
1476: private_message_t *this)
1477: {
1478: this->sort_disabled = TRUE;
1479: }
1480:
1481: /**
1482: * reorder payloads depending on reordering rules
1483: */
1484: static void order_payloads(private_message_t *this)
1485: {
1486: linked_list_t *list;
1487: payload_t *payload;
1488: int i;
1489:
1490: DBG2(DBG_ENC, "order payloads in message");
1491:
1492: /* move to temp list */
1493: list = linked_list_create();
1494: while (this->payloads->remove_last(this->payloads,
1495: (void**)&payload) == SUCCESS)
1496: {
1497: list->insert_first(list, payload);
1498: }
1499: /* for each rule, ... */
1500: for (i = 0; i < this->rule->order_count; i++)
1501: {
1502: enumerator_t *enumerator;
1503: notify_payload_t *notify;
1504: payload_order_t order;
1505:
1506: order = this->rule->order[i];
1507:
1508: /* ... find all payload ... */
1509: enumerator = list->create_enumerator(list);
1510: while (enumerator->enumerate(enumerator, &payload))
1511: {
1512: /* ... with that type ... */
1513: if (payload->get_type(payload) == order.type)
1514: {
1515: notify = (notify_payload_t*)payload;
1516:
1517: /**... and check notify for type. */
1518: if (order.type != PLV2_NOTIFY || order.notify == 0 ||
1519: order.notify == notify->get_notify_type(notify))
1520: {
1521: list->remove_at(list, enumerator);
1522: add_payload(this, payload);
1523: }
1524: }
1525: }
1526: enumerator->destroy(enumerator);
1527: }
1528: /* append all payloads without a rule to the end */
1529: while (list->remove_last(list, (void**)&payload) == SUCCESS)
1530: {
1531: /* do not complain about payloads in private use space */
1532: if (payload->get_type(payload) < 128)
1533: {
1534: DBG1(DBG_ENC, "payload %N has no ordering rule in %N %s",
1535: payload_type_names, payload->get_type(payload),
1536: exchange_type_names, this->rule->exchange_type,
1537: this->rule->is_request ? "request" : "response");
1538: }
1539: add_payload(this, payload);
1540: }
1541: list->destroy(list);
1542: }
1543:
1544: /**
1545: * Wrap payloads in an encrypted payload
1546: */
1547: static encrypted_payload_t* wrap_payloads(private_message_t *this)
1548: {
1549: encrypted_payload_t *encrypted = NULL;
1550: linked_list_t *payloads;
1551: payload_t *current;
1552:
1553: /* move all payloads to a temporary list */
1554: payloads = linked_list_create();
1555: while (this->payloads->remove_first(this->payloads,
1556: (void**)¤t) == SUCCESS)
1557: {
1558: if (current->get_type(current) == PLV2_FRAGMENT)
1559: { /* treat encrypted fragment payload as encrypted payload */
1560: encrypted = (encrypted_payload_t*)current;
1561: }
1562: else
1563: {
1564: payloads->insert_last(payloads, current);
1565: }
1566: }
1567: if (encrypted)
1568: { /* simply adopt all the unencrypted payloads */
1569: this->payloads->destroy(this->payloads);
1570: this->payloads = payloads;
1571: return encrypted;
1572: }
1573:
1574: if (this->is_encrypted)
1575: {
1576: encrypted = encrypted_payload_create(PLV1_ENCRYPTED);
1577: }
1578: else
1579: {
1580: encrypted = encrypted_payload_create(PLV2_ENCRYPTED);
1581: }
1582: while (payloads->remove_first(payloads, (void**)¤t) == SUCCESS)
1583: {
1584: payload_rule_t *rule;
1585: payload_type_t type;
1586: bool encrypt = TRUE;
1587:
1588: type = current->get_type(current);
1589: rule = get_payload_rule(this, type);
1590: if (rule)
1591: {
1592: encrypt = rule->encrypted;
1593: }
1594: if (encrypt || this->is_encrypted)
1595: { /* encryption is forced for IKEv1 */
1596: DBG2(DBG_ENC, "insert payload %N into encrypted payload",
1597: payload_type_names, type);
1598: encrypted->add_payload(encrypted, current);
1599: }
1600: else
1601: {
1602: DBG2(DBG_ENC, "insert payload %N unencrypted",
1603: payload_type_names, type);
1604: add_payload(this, current);
1605: }
1606: }
1607: payloads->destroy(payloads);
1608:
1609: return encrypted;
1610: }
1611:
1612: /**
1613: * Creates the IKE header for this message
1614: */
1615: static ike_header_t *create_header(private_message_t *this)
1616: {
1617: ike_header_t *ike_header;
1618: bool *reserved;
1619: int i;
1620:
1621: ike_header = ike_header_create_version(this->major_version,
1622: this->minor_version);
1623: ike_header->set_exchange_type(ike_header, this->exchange_type);
1624: ike_header->set_message_id(ike_header, this->message_id);
1625: if (this->major_version == IKEV2_MAJOR_VERSION)
1626: {
1627: ike_header->set_response_flag(ike_header, !this->is_request);
1628: ike_header->set_version_flag(ike_header, this->version_flag);
1629: ike_header->set_initiator_flag(ike_header,
1630: this->ike_sa_id->is_initiator(this->ike_sa_id));
1631: }
1632: else
1633: {
1634: ike_header->set_encryption_flag(ike_header, this->is_encrypted);
1635: }
1636: ike_header->set_initiator_spi(ike_header,
1637: this->ike_sa_id->get_initiator_spi(this->ike_sa_id));
1638: ike_header->set_responder_spi(ike_header,
1639: this->ike_sa_id->get_responder_spi(this->ike_sa_id));
1640:
1641: for (i = 0; i < countof(this->reserved); i++)
1642: {
1643: reserved = payload_get_field(&ike_header->payload_interface,
1644: RESERVED_BIT, i);
1645: if (reserved)
1646: {
1647: *reserved = this->reserved[i];
1648: }
1649: }
1650: return ike_header;
1651: }
1652:
1653: /**
1654: * Generates the message, if needed, wraps the payloads in an encrypted payload.
1655: *
1656: * The generator and the possible encrypted payload are returned. The latter
1657: * is not yet encrypted (but the transform is set). It is also not added to
1658: * the payload list (so unless there are unencrypted payloads that list will
1659: * be empty afterwards).
1660: */
1661: static status_t generate_message(private_message_t *this, keymat_t *keymat,
1662: generator_t **out_generator, encrypted_payload_t **encrypted)
1663: {
1664: keymat_v1_t *keymat_v1 = (keymat_v1_t*)keymat;
1665: generator_t *generator;
1666: payload_type_t next_type;
1667: enumerator_t *enumerator;
1668: aead_t *aead = NULL;
1669: chunk_t hash = chunk_empty;
1670: char str[BUF_LEN];
1671: ike_header_t *ike_header;
1672: payload_t *payload, *next;
1673: bool encrypting = FALSE;
1674:
1675: if (this->exchange_type == EXCHANGE_TYPE_UNDEFINED)
1676: {
1677: DBG1(DBG_ENC, "exchange type is not defined");
1678: return INVALID_STATE;
1679: }
1680:
1681: if (this->packet->get_source(this->packet) == NULL ||
1682: this->packet->get_destination(this->packet) == NULL)
1683: {
1684: DBG1(DBG_ENC, "source/destination not defined");
1685: return INVALID_STATE;
1686: }
1687:
1688: this->rule = get_message_rule(this);
1689: if (!this->rule)
1690: {
1691: DBG1(DBG_ENC, "no message rules specified for this message type");
1692: return NOT_SUPPORTED;
1693: }
1694:
1695: if (!this->sort_disabled)
1696: {
1697: order_payloads(this);
1698: }
1699:
1700: if (keymat && keymat->get_version(keymat) == IKEV1)
1701: {
1702: /* get a hash for this message, if any is required */
1703: if (keymat_v1->get_hash_phase2(keymat_v1, &this->public, &hash))
1704: { /* insert a HASH payload as first payload */
1705: hash_payload_t *hash_payload;
1706:
1707: hash_payload = hash_payload_create(PLV1_HASH);
1708: hash_payload->set_hash(hash_payload, hash);
1709: this->payloads->insert_first(this->payloads, hash_payload);
1710: if (this->exchange_type == INFORMATIONAL_V1)
1711: {
1712: this->is_encrypted = encrypting = TRUE;
1713: }
1714: chunk_free(&hash);
1715: }
1716: }
1717:
1718: if (this->major_version == IKEV2_MAJOR_VERSION)
1719: {
1720: encrypting = this->rule->encrypted;
1721: }
1722: else if (!encrypting)
1723: {
1724: /* If at least one payload requires encryption, encrypt the message.
1725: * If no key material is available, the flag will be reset below. */
1726: enumerator = this->payloads->create_enumerator(this->payloads);
1727: while (enumerator->enumerate(enumerator, (void**)&payload))
1728: {
1729: payload_rule_t *rule;
1730:
1731: rule = get_payload_rule(this, payload->get_type(payload));
1732: if (rule && rule->encrypted)
1733: {
1734: this->is_encrypted = encrypting = TRUE;
1735: break;
1736: }
1737: }
1738: enumerator->destroy(enumerator);
1739: }
1740:
1741: DBG1(DBG_ENC, "generating %s", get_string(this, str, sizeof(str)));
1742:
1743: if (keymat)
1744: {
1745: aead = keymat->get_aead(keymat, FALSE);
1746: }
1747: if (encrypting)
1748: {
1749: if (aead)
1750: {
1751: *encrypted = wrap_payloads(this);
1752: (*encrypted)->set_transform(*encrypted, aead);
1753: }
1754: else if (this->exchange_type == INFORMATIONAL ||
1755: this->exchange_type == INFORMATIONAL_V1)
1756: { /* allow sending unencrypted INFORMATIONALs */
1757: encrypting = FALSE;
1758: }
1759: else
1760: {
1761: DBG1(DBG_ENC, "unable to encrypt payloads without AEAD transform");
1762: return FAILED;
1763: }
1764: }
1765: if (!encrypting)
1766: {
1767: DBG2(DBG_ENC, "not encrypting payloads");
1768: this->is_encrypted = FALSE;
1769: }
1770:
1771: /* generate all payloads with proper next type */
1772: *out_generator = generator = generator_create();
1773: ike_header = create_header(this);
1774: payload = (payload_t*)ike_header;
1775: enumerator = create_payload_enumerator(this);
1776: while (enumerator->enumerate(enumerator, &next))
1777: {
1778: payload->set_next_type(payload, next->get_type(next));
1779: generator->generate_payload(generator, payload);
1780: payload = next;
1781: }
1782: enumerator->destroy(enumerator);
1783:
1784: next_type = PL_NONE;
1785: if (this->is_encrypted)
1786: { /* for encrypted IKEv1 messages */
1787: next_type = (*encrypted)->payload_interface.get_next_type(
1788: (payload_t*)*encrypted);
1789: }
1790: else if (*encrypted)
1791: { /* use proper IKEv2 encrypted (fragment) payload type */
1792: next_type = (*encrypted)->payload_interface.get_type(
1793: (payload_t*)*encrypted);
1794: }
1795: payload->set_next_type(payload, next_type);
1796: generator->generate_payload(generator, payload);
1797: ike_header->destroy(ike_header);
1798: return SUCCESS;
1799: }
1800:
1801: /**
1802: * Encrypts and adds the encrypted payload (if any) to the payload list and
1803: * finalizes the message generation. Destroys the given generator.
1804: */
1805: static status_t finalize_message(private_message_t *this, keymat_t *keymat,
1806: generator_t *generator, encrypted_payload_t *encrypted)
1807: {
1808: keymat_v1_t *keymat_v1 = (keymat_v1_t*)keymat;
1809: chunk_t chunk;
1810: uint32_t *lenpos;
1811:
1812: if (encrypted)
1813: {
1814: if (this->is_encrypted)
1815: { /* for IKEv1 instead of associated data we provide the IV */
1816: if (!keymat_v1->get_iv(keymat_v1, this->message_id, &chunk))
1817: {
1818: generator->destroy(generator);
1819: encrypted->destroy(encrypted);
1820: return FAILED;
1821: }
1822: }
1823: else
1824: { /* build associated data (without header of encrypted payload) */
1825: chunk = generator->get_chunk(generator, &lenpos);
1826: /* fill in length, including encrypted payload */
1827: htoun32(lenpos, chunk.len + encrypted->get_length(encrypted));
1828: }
1829: this->payloads->insert_last(this->payloads, encrypted);
1830: if (encrypted->encrypt(encrypted, this->message_id, chunk) != SUCCESS)
1831: {
1832: generator->destroy(generator);
1833: return INVALID_STATE;
1834: }
1835: generator->generate_payload(generator, &encrypted->payload_interface);
1836: }
1837: chunk = generator->get_chunk(generator, &lenpos);
1838: htoun32(lenpos, chunk.len);
1839: this->packet->set_data(this->packet, chunk_clone(chunk));
1840: if (this->is_encrypted && this->exchange_type != INFORMATIONAL_V1)
1841: {
1842: /* update the IV for the next IKEv1 message */
1843: chunk_t last_block;
1844: aead_t *aead;
1845: size_t bs;
1846:
1847: aead = keymat->get_aead(keymat, FALSE);
1848: bs = aead->get_block_size(aead);
1849: last_block = chunk_create(chunk.ptr + chunk.len - bs, bs);
1850: if (!keymat_v1->update_iv(keymat_v1, this->message_id, last_block) ||
1851: !keymat_v1->confirm_iv(keymat_v1, this->message_id))
1852: {
1853: generator->destroy(generator);
1854: return FAILED;
1855: }
1856: }
1857: generator->destroy(generator);
1858: return SUCCESS;
1859: }
1860:
1861: METHOD(message_t, generate, status_t,
1862: private_message_t *this, keymat_t *keymat, packet_t **packet)
1863: {
1864: generator_t *generator = NULL;
1865: encrypted_payload_t *encrypted = NULL;
1866: status_t status;
1867:
1868: status = generate_message(this, keymat, &generator, &encrypted);
1869: if (status != SUCCESS)
1870: {
1871: DESTROY_IF(generator);
1872: return status;
1873: }
1874: status = finalize_message(this, keymat, generator, encrypted);
1875: if (status != SUCCESS)
1876: {
1877: return status;
1878: }
1879: if (packet)
1880: {
1881: *packet = this->packet->clone(this->packet);
1882: }
1883: return SUCCESS;
1884: }
1885:
1886: /**
1887: * Creates a (basic) clone of the given message
1888: */
1889: static message_t *clone_message(private_message_t *this)
1890: {
1891: message_t *message;
1892: host_t *src, *dst;
1893:
1894: src = this->packet->get_source(this->packet);
1895: dst = this->packet->get_destination(this->packet);
1896:
1897: message = message_create(this->major_version, this->minor_version);
1898: message->set_ike_sa_id(message, this->ike_sa_id);
1899: message->set_message_id(message, this->message_id);
1900: message->set_request(message, this->is_request);
1901: message->set_source(message, src->clone(src));
1902: message->set_destination(message, dst->clone(dst));
1903: message->set_exchange_type(message, this->exchange_type);
1904: memcpy(((private_message_t*)message)->reserved, this->reserved,
1905: sizeof(this->reserved));
1906: return message;
1907: }
1908:
1909: /**
1910: * Create a single fragment with the given data
1911: */
1912: static message_t *create_fragment(private_message_t *this, payload_type_t next,
1913: uint16_t num, uint16_t count, chunk_t data)
1914: {
1915: enumerator_t *enumerator;
1916: payload_t *fragment, *payload;
1917: message_t *message;
1918: peer_cfg_t *peer_cfg;
1919: ike_sa_t *ike_sa;
1920:
1921: message = clone_message(this);
1922: if (this->major_version == IKEV1_MAJOR_VERSION)
1923: {
1924: /* other implementations seem to just use 0 as message ID, so here we go */
1925: message->set_message_id(message, 0);
1926: /* always use the initial message type for fragments, even for quick mode
1927: * or transaction messages. */
1928: ike_sa = charon->bus->get_sa(charon->bus);
1929: if (ike_sa && (peer_cfg = ike_sa->get_peer_cfg(ike_sa)) &&
1930: peer_cfg->use_aggressive(peer_cfg))
1931: {
1932: message->set_exchange_type(message, AGGRESSIVE);
1933: }
1934: else
1935: {
1936: message->set_exchange_type(message, ID_PROT);
1937: }
1938: fragment = (payload_t*)fragment_payload_create_from_data(
1939: num, num == count, data);
1940: }
1941: else
1942: {
1943: fragment = (payload_t*)encrypted_fragment_payload_create_from_data(
1944: num, count, data);
1945: if (num == 1)
1946: {
1947: /* only in the first fragment is this set to the type of the first
1948: * payload in the encrypted payload */
1949: fragment->set_next_type(fragment, next);
1950: /* move unencrypted payloads to the first fragment */
1951: enumerator = this->payloads->create_enumerator(this->payloads);
1952: while (enumerator->enumerate(enumerator, &payload))
1953: {
1954: if (payload->get_type(payload) != PLV2_ENCRYPTED)
1955: {
1956: this->payloads->remove_at(this->payloads, enumerator);
1957: message->add_payload(message, payload);
1958: }
1959: }
1960: enumerator->destroy(enumerator);
1961: }
1962: }
1963: message->add_payload(message, (payload_t*)fragment);
1964: return message;
1965: }
1966:
1967: /**
1968: * Destroy all fragments
1969: */
1970: static void clear_fragments(private_message_t *this)
1971: {
1972: array_destroy_offset(this->fragments, offsetof(packet_t, destroy));
1973: this->fragments = NULL;
1974: }
1975:
1976: /**
1977: * Reduce the fragment length but ensure it stays > 0
1978: */
1979: #define REDUCE_FRAG_LEN(fl, amount) ({ \
1980: fl = max(1, (ssize_t)fl - (amount)); \
1981: })
1982:
1983: METHOD(message_t, fragment, status_t,
1984: private_message_t *this, keymat_t *keymat, size_t frag_len,
1985: enumerator_t **fragments)
1986: {
1987: encrypted_payload_t *encrypted = NULL;
1988: generator_t *generator = NULL;
1989: message_t *fragment;
1990: packet_t *packet;
1991: payload_type_t next = PL_NONE;
1992: uint16_t num, count;
1993: host_t *src, *dst;
1994: chunk_t data;
1995: status_t status;
1996: uint32_t *lenpos;
1997: size_t len;
1998:
1999: src = this->packet->get_source(this->packet);
2000: dst = this->packet->get_destination(this->packet);
2001: if (!frag_len)
2002: {
2003: frag_len = (src->get_family(src) == AF_INET) ? 576 : 1280;
2004: }
2005: /* frag_len is the complete IP datagram length, account for overhead (we
2006: * assume no IP options/extension headers are used) */
2007: REDUCE_FRAG_LEN(frag_len, (src->get_family(src) == AF_INET) ? 20 : 40);
2008: /* 8 (UDP header) */
2009: REDUCE_FRAG_LEN(frag_len, 8);
2010: if (dst->get_port(dst) != IKEV2_UDP_PORT &&
2011: src->get_port(src) != IKEV2_UDP_PORT)
2012: { /* reduce length due to non-ESP marker */
2013: REDUCE_FRAG_LEN(frag_len, 4);
2014: }
2015:
2016: if (is_encoded(this))
2017: {
2018: if (this->major_version == IKEV2_MAJOR_VERSION)
2019: {
2020: encrypted = (encrypted_payload_t*)get_payload(this, PLV2_ENCRYPTED);
2021: }
2022: data = this->packet->get_data(this->packet);
2023: len = data.len;
2024: }
2025: else
2026: {
2027: status = generate_message(this, keymat, &generator, &encrypted);
2028: if (status != SUCCESS)
2029: {
2030: DESTROY_IF(generator);
2031: return status;
2032: }
2033: data = generator->get_chunk(generator, &lenpos);
2034: len = data.len + (encrypted ? encrypted->get_length(encrypted) : 0);
2035: }
2036:
2037: /* check if we actually need to fragment the message and if we have an
2038: * encrypted payload for IKEv2 */
2039: if (len <= frag_len ||
2040: (this->major_version == IKEV2_MAJOR_VERSION && !encrypted))
2041: {
2042: if (generator)
2043: {
2044: status = finalize_message(this, keymat, generator, encrypted);
2045: if (status != SUCCESS)
2046: {
2047: return status;
2048: }
2049: }
2050: *fragments = enumerator_create_single(this->packet, NULL);
2051: return SUCCESS;
2052: }
2053:
2054: /* frag_len denoted the maximum IKE message size so far, later on it will
2055: * denote the maximum content size of a fragment payload, therefore,
2056: * account for IKE header */
2057: REDUCE_FRAG_LEN(frag_len, 28);
2058:
2059: if (this->major_version == IKEV1_MAJOR_VERSION)
2060: {
2061: if (generator)
2062: {
2063: status = finalize_message(this, keymat, generator, encrypted);
2064: if (status != SUCCESS)
2065: {
2066: return status;
2067: }
2068: data = this->packet->get_data(this->packet);
2069: generator = NULL;
2070: }
2071: /* overhead for the fragmentation payload header */
2072: REDUCE_FRAG_LEN(frag_len, 8);
2073: }
2074: else
2075: {
2076: aead_t *aead;
2077:
2078: if (generator)
2079: {
2080: generator->destroy(generator);
2081: generator = generator_create();
2082: }
2083: else
2084: { /* do not log again if it was generated previously */
2085: generator = generator_create_no_dbg();
2086: }
2087: next = encrypted->payload_interface.get_next_type((payload_t*)encrypted);
2088: encrypted->generate_payloads(encrypted, generator);
2089: data = generator->get_chunk(generator, &lenpos);
2090: if (!is_encoded(this))
2091: {
2092: encrypted->destroy(encrypted);
2093: }
2094: aead = keymat->get_aead(keymat, FALSE);
2095: /* overhead for the encrypted fragment payload */
2096: REDUCE_FRAG_LEN(frag_len, aead->get_iv_size(aead));
2097: REDUCE_FRAG_LEN(frag_len, aead->get_icv_size(aead));
2098: /* header */
2099: REDUCE_FRAG_LEN(frag_len, 8);
2100: /* padding and padding length */
2101: frag_len = round_down(frag_len, aead->get_block_size(aead));
2102: REDUCE_FRAG_LEN(frag_len, 1);
2103: /* TODO-FRAG: if there are unencrypted payloads, should we account for
2104: * their length in the first fragment? we still would have to add
2105: * an encrypted fragment payload (albeit empty), even so we couldn't
2106: * prevent IP fragmentation in every case */
2107: }
2108:
2109: count = data.len / frag_len + (data.len % frag_len ? 1 : 0);
2110: this->fragments = array_create(0, count);
2111: DBG1(DBG_ENC, "splitting IKE message (%zu bytes) into %hu fragments", len,
2112: count);
2113: for (num = 1; num <= count; num++)
2114: {
2115: len = min(data.len, frag_len);
2116: fragment = create_fragment(this, next, num, count,
2117: chunk_create(data.ptr, len));
2118: status = fragment->generate(fragment, keymat, &packet);
2119: fragment->destroy(fragment);
2120: if (status != SUCCESS)
2121: {
2122: DBG1(DBG_ENC, "failed to generate IKE fragment");
2123: clear_fragments(this);
2124: DESTROY_IF(generator);
2125: return FAILED;
2126: }
2127: array_insert(this->fragments, ARRAY_TAIL, packet);
2128: data = chunk_skip(data, len);
2129: }
2130: *fragments = array_create_enumerator(this->fragments);
2131: DESTROY_IF(generator);
2132: return SUCCESS;
2133: }
2134:
2135: METHOD(message_t, get_packet, packet_t*,
2136: private_message_t *this)
2137: {
2138: return this->packet->clone(this->packet);
2139: }
2140:
2141: METHOD(message_t, get_packet_data, chunk_t,
2142: private_message_t *this)
2143: {
2144: return this->packet->get_data(this->packet);
2145: }
2146:
2147: METHOD(message_t, get_fragments, enumerator_t*,
2148: private_message_t *this)
2149: {
2150: return array_create_enumerator(this->fragments);
2151: }
2152:
2153: METHOD(message_t, parse_header, status_t,
2154: private_message_t *this)
2155: {
2156: ike_header_t *ike_header;
2157: status_t status;
2158: bool *reserved;
2159: int i;
2160:
2161: DBG2(DBG_ENC, "parsing header of message");
2162:
2163: if (!this->parser)
2164: { /* reassembled IKEv2 message, header is inherited from fragments */
2165: return SUCCESS;
2166: }
2167: this->parser->reset_context(this->parser);
2168: status = this->parser->parse_payload(this->parser, PL_HEADER,
2169: (payload_t**)&ike_header);
2170: if (status != SUCCESS)
2171: {
2172: DBG1(DBG_ENC, "header could not be parsed");
2173: return status;
2174:
2175: }
2176:
2177: status = ike_header->payload_interface.verify(
2178: &ike_header->payload_interface);
2179: if (status != SUCCESS)
2180: {
2181: DBG1(DBG_ENC, "header verification failed");
2182: ike_header->destroy(ike_header);
2183: return status;
2184: }
2185:
2186: DESTROY_IF(this->ike_sa_id);
2187: this->ike_sa_id = ike_sa_id_create(
2188: ike_header->get_maj_version(ike_header),
2189: ike_header->get_initiator_spi(ike_header),
2190: ike_header->get_responder_spi(ike_header),
2191: ike_header->get_initiator_flag(ike_header));
2192:
2193: this->exchange_type = ike_header->get_exchange_type(ike_header);
2194: this->message_id = ike_header->get_message_id(ike_header);
2195: this->major_version = ike_header->get_maj_version(ike_header);
2196: this->minor_version = ike_header->get_min_version(ike_header);
2197: if (this->major_version == IKEV2_MAJOR_VERSION)
2198: {
2199: this->is_request = !ike_header->get_response_flag(ike_header);
2200: }
2201: else
2202: {
2203: this->is_encrypted = ike_header->get_encryption_flag(ike_header);
2204: }
2205: this->first_payload = ike_header->payload_interface.get_next_type(
2206: &ike_header->payload_interface);
2207: if (this->first_payload == PLV1_FRAGMENT && this->is_encrypted)
2208: { /* racoon sets the encrypted bit when sending a fragment, but these
2209: * messages are really not encrypted */
2210: this->is_encrypted = FALSE;
2211: }
2212:
2213: for (i = 0; i < countof(this->reserved); i++)
2214: {
2215: reserved = payload_get_field(&ike_header->payload_interface,
2216: RESERVED_BIT, i);
2217: if (reserved)
2218: {
2219: this->reserved[i] = *reserved;
2220: }
2221: }
2222: ike_header->destroy(ike_header);
2223:
2224: this->parser->set_major_version(this->parser, this->major_version);
2225:
2226: DBG2(DBG_ENC, "parsed a %N %s header", exchange_type_names,
2227: this->exchange_type, this->major_version == IKEV1_MAJOR_VERSION ?
2228: "message" : (this->is_request ? "request" : "response"));
2229: return SUCCESS;
2230: }
2231:
2232: /**
2233: * Check if a payload is for a mediation extension connectivity check
2234: */
2235: static bool is_connectivity_check(private_message_t *this, payload_t *payload)
2236: {
2237: #ifdef ME
2238: if (this->exchange_type == INFORMATIONAL &&
2239: payload->get_type(payload) == PLV2_NOTIFY)
2240: {
2241: notify_payload_t *notify = (notify_payload_t*)payload;
2242:
2243: switch (notify->get_notify_type(notify))
2244: {
2245: case ME_CONNECTID:
2246: case ME_ENDPOINT:
2247: case ME_CONNECTAUTH:
2248: return TRUE;
2249: default:
2250: break;
2251: }
2252: }
2253: #endif /* !ME */
2254: return FALSE;
2255: }
2256:
2257: /**
2258: * Parses and verifies the unencrypted payloads contained in the message
2259: */
2260: static status_t parse_payloads(private_message_t *this)
2261: {
2262: payload_type_t type = this->first_payload;
2263: payload_t *payload;
2264: status_t status;
2265:
2266: if (this->is_encrypted)
2267: { /* wrap the whole encrypted IKEv1 message in a special encrypted
2268: * payload which is then handled just like a regular payload */
2269: encrypted_payload_t *encryption;
2270:
2271: status = this->parser->parse_payload(this->parser, PLV1_ENCRYPTED,
2272: (payload_t**)&encryption);
2273: if (status != SUCCESS)
2274: {
2275: DBG1(DBG_ENC, "failed to wrap encrypted IKEv1 message");
2276: return PARSE_ERROR;
2277: }
2278: encryption->payload_interface.set_next_type((payload_t*)encryption,
2279: this->first_payload);
2280: this->payloads->insert_last(this->payloads, encryption);
2281: return SUCCESS;
2282: }
2283:
2284: while (type != PL_NONE)
2285: {
2286: DBG2(DBG_ENC, "starting parsing a %N payload",
2287: payload_type_names, type);
2288:
2289: status = this->parser->parse_payload(this->parser, type, &payload);
2290: if (status != SUCCESS)
2291: {
2292: DBG1(DBG_ENC, "payload type %N could not be parsed",
2293: payload_type_names, type);
2294: return PARSE_ERROR;
2295: }
2296:
2297: DBG2(DBG_ENC, "verifying payload of type %N", payload_type_names, type);
2298: status = payload->verify(payload);
2299: if (status != SUCCESS)
2300: {
2301: DBG1(DBG_ENC, "%N payload verification failed",
2302: payload_type_names, type);
2303: payload->destroy(payload);
2304: return VERIFY_ERROR;
2305: }
2306: if (payload->get_type(payload) == PL_UNKNOWN)
2307: {
2308: DBG2(DBG_ENC, "%N payload unknown or not allowed",
2309: payload_type_names, type);
2310: }
2311: else
2312: {
2313: DBG2(DBG_ENC, "%N payload verified, adding to payload list",
2314: payload_type_names, type);
2315: }
2316: this->payloads->insert_last(this->payloads, payload);
2317:
2318: /* an encrypted (fragment) payload MUST be the last one, so STOP here.
2319: * decryption is done later */
2320: if (type == PLV2_ENCRYPTED || type == PLV2_FRAGMENT)
2321: {
2322: DBG2(DBG_ENC, "%N payload found, stop parsing",
2323: payload_type_names, type);
2324: break;
2325: }
2326: type = payload->get_next_type(payload);
2327: }
2328: return SUCCESS;
2329: }
2330:
2331: /**
2332: * Decrypt an encrypted payload and extract all contained payloads.
2333: */
2334: static status_t decrypt_and_extract(private_message_t *this, keymat_t *keymat,
2335: payload_t *previous, encrypted_payload_t *encryption)
2336: {
2337: payload_t *encrypted;
2338: payload_type_t type;
2339: chunk_t chunk;
2340: aead_t *aead;
2341: size_t bs;
2342: status_t status = SUCCESS;
2343:
2344: if (!keymat)
2345: {
2346: DBG1(DBG_ENC, "found encrypted payload, but no keymat");
2347: return INVALID_ARG;
2348: }
2349: aead = keymat->get_aead(keymat, TRUE);
2350: if (!aead)
2351: {
2352: DBG1(DBG_ENC, "found encrypted payload, but no transform set");
2353: return INVALID_ARG;
2354: }
2355: if (!this->parser)
2356: {
2357: /* reassembled IKEv2 messages are already decrypted, we still call
2358: * decrypt() to parse the contained payloads */
2359: status = encryption->decrypt(encryption, chunk_empty);
2360: }
2361: else
2362: {
2363: bs = aead->get_block_size(aead);
2364: encryption->set_transform(encryption, aead);
2365: chunk = this->packet->get_data(this->packet);
2366: if (chunk.len < encryption->get_length(encryption) ||
2367: chunk.len < bs)
2368: {
2369: DBG1(DBG_ENC, "invalid payload length");
2370: return VERIFY_ERROR;
2371: }
2372: if (keymat->get_version(keymat) == IKEV1)
2373: { /* instead of associated data we provide the IV, we also update
2374: * the IV with the last encrypted block */
2375: keymat_v1_t *keymat_v1 = (keymat_v1_t*)keymat;
2376: chunk_t iv;
2377:
2378: if (keymat_v1->get_iv(keymat_v1, this->message_id, &iv))
2379: {
2380: status = encryption->decrypt(encryption, iv);
2381: if (status == SUCCESS)
2382: {
2383: if (!keymat_v1->update_iv(keymat_v1, this->message_id,
2384: chunk_create(chunk.ptr + chunk.len - bs, bs)))
2385: {
2386: status = FAILED;
2387: }
2388: }
2389: }
2390: else
2391: {
2392: status = FAILED;
2393: }
2394: }
2395: else
2396: {
2397: chunk.len -= encryption->get_length(encryption);
2398: status = encryption->decrypt(encryption, chunk);
2399: }
2400: }
2401: if (status != SUCCESS)
2402: {
2403: return status;
2404: }
2405:
2406: while ((encrypted = encryption->remove_payload(encryption)))
2407: {
2408: type = encrypted->get_type(encrypted);
2409: if (previous)
2410: {
2411: previous->set_next_type(previous, type);
2412: }
2413: else
2414: {
2415: this->first_payload = type;
2416: }
2417: DBG2(DBG_ENC, "insert decrypted payload of type %N at end of list",
2418: payload_type_names, type);
2419: this->payloads->insert_last(this->payloads, encrypted);
2420: previous = encrypted;
2421: }
2422: return SUCCESS;
2423: }
2424:
2425: /**
2426: * Decrypt an encrypted fragment payload.
2427: */
2428: static status_t decrypt_fragment(private_message_t *this, keymat_t *keymat,
2429: encrypted_fragment_payload_t *fragment)
2430: {
2431: encrypted_payload_t *encrypted = (encrypted_payload_t*)fragment;
2432: chunk_t chunk;
2433: aead_t *aead;
2434: size_t bs;
2435:
2436: if (!keymat)
2437: {
2438: DBG1(DBG_ENC, "found encrypted fragment payload, but no keymat");
2439: return INVALID_ARG;
2440: }
2441: aead = keymat->get_aead(keymat, TRUE);
2442: if (!aead)
2443: {
2444: DBG1(DBG_ENC, "found encrypted fragment payload, but no transform set");
2445: return INVALID_ARG;
2446: }
2447: bs = aead->get_block_size(aead);
2448: encrypted->set_transform(encrypted, aead);
2449: chunk = this->packet->get_data(this->packet);
2450: if (chunk.len < encrypted->get_length(encrypted) ||
2451: chunk.len < bs)
2452: {
2453: DBG1(DBG_ENC, "invalid payload length");
2454: return VERIFY_ERROR;
2455: }
2456: chunk.len -= encrypted->get_length(encrypted);
2457: return encrypted->decrypt(encrypted, chunk);
2458: }
2459:
2460: /**
2461: * Do we accept unencrypted ID/HASH payloads in Main Mode, as seen from
2462: * some SonicWall boxes?
2463: */
2464: static bool accept_unencrypted_mm(private_message_t *this, payload_type_t type)
2465: {
2466: if (this->exchange_type == ID_PROT)
2467: {
2468: if (type == PLV1_ID || type == PLV1_HASH)
2469: {
2470: return lib->settings->get_bool(lib->settings,
2471: "%s.accept_unencrypted_mainmode_messages",
2472: FALSE, lib->ns);
2473: }
2474: }
2475: return FALSE;
2476: }
2477:
2478: /**
2479: * Decrypt payload from the encrypted payload
2480: */
2481: static status_t decrypt_payloads(private_message_t *this, keymat_t *keymat)
2482: {
2483: payload_t *payload, *previous = NULL;
2484: enumerator_t *enumerator;
2485: payload_rule_t *rule;
2486: payload_type_t type;
2487: status_t status = SUCCESS;
2488: char *was_encrypted = NULL;
2489:
2490: enumerator = this->payloads->create_enumerator(this->payloads);
2491: while (enumerator->enumerate(enumerator, &payload))
2492: {
2493: type = payload->get_type(payload);
2494:
2495: DBG2(DBG_ENC, "process payload of type %N", payload_type_names, type);
2496:
2497: if (type == PLV2_ENCRYPTED || type == PLV1_ENCRYPTED ||
2498: type == PLV2_FRAGMENT)
2499: {
2500: if (was_encrypted)
2501: {
2502: DBG1(DBG_ENC, "%s can't contain other payloads of type %N",
2503: was_encrypted, payload_type_names, type);
2504: status = VERIFY_ERROR;
2505: break;
2506: }
2507: }
2508:
2509: if (type == PLV2_ENCRYPTED || type == PLV1_ENCRYPTED)
2510: {
2511: encrypted_payload_t *encryption;
2512:
2513: DBG2(DBG_ENC, "found an encrypted payload");
2514: encryption = (encrypted_payload_t*)payload;
2515: this->payloads->remove_at(this->payloads, enumerator);
2516:
2517: if (enumerator->enumerate(enumerator, NULL))
2518: {
2519: DBG1(DBG_ENC, "encrypted payload is not last payload");
2520: encryption->destroy(encryption);
2521: status = VERIFY_ERROR;
2522: break;
2523: }
2524: status = decrypt_and_extract(this, keymat, previous, encryption);
2525: encryption->destroy(encryption);
2526: if (status != SUCCESS)
2527: {
2528: break;
2529: }
2530: was_encrypted = "encrypted payload";
2531: }
2532: else if (type == PLV2_FRAGMENT)
2533: {
2534: encrypted_fragment_payload_t *fragment;
2535:
2536: DBG2(DBG_ENC, "found an encrypted fragment payload");
2537: fragment = (encrypted_fragment_payload_t*)payload;
2538:
2539: if (enumerator->enumerate(enumerator, NULL))
2540: {
2541: DBG1(DBG_ENC, "encrypted fragment payload is not last payload");
2542: status = VERIFY_ERROR;
2543: break;
2544: }
2545: status = decrypt_fragment(this, keymat, fragment);
2546: if (status != SUCCESS)
2547: {
2548: break;
2549: }
2550: was_encrypted = "encrypted fragment payload";
2551: }
2552:
2553: if (type != PL_UNKNOWN && !was_encrypted &&
2554: !is_connectivity_check(this, payload) &&
2555: this->exchange_type != AGGRESSIVE)
2556: {
2557: rule = get_payload_rule(this, type);
2558: if ((!rule || rule->encrypted) &&
2559: !accept_unencrypted_mm(this, type))
2560: {
2561: DBG1(DBG_ENC, "payload type %N was not encrypted",
2562: payload_type_names, type);
2563: status = FAILED;
2564: break;
2565: }
2566: }
2567: previous = payload;
2568: }
2569: enumerator->destroy(enumerator);
2570: return status;
2571: }
2572:
2573: /**
2574: * Verify a message and all payload according to message/payload rules
2575: */
2576: static status_t verify(private_message_t *this)
2577: {
2578: bool complete = FALSE;
2579: int i;
2580:
2581: DBG2(DBG_ENC, "verifying message structure");
2582:
2583: /* check for payloads with wrong count */
2584: for (i = 0; i < this->rule->rule_count; i++)
2585: {
2586: enumerator_t *enumerator;
2587: payload_t *payload;
2588: payload_rule_t *rule;
2589: int found = 0;
2590:
2591: rule = &this->rule->rules[i];
2592: enumerator = create_payload_enumerator(this);
2593: while (enumerator->enumerate(enumerator, &payload))
2594: {
2595: payload_type_t type;
2596:
2597: type = payload->get_type(payload);
2598: if (type == rule->type)
2599: {
2600: found++;
2601: DBG2(DBG_ENC, "found payload of type %N",
2602: payload_type_names, type);
2603: if (found > rule->max_occurrence)
2604: {
2605: DBG1(DBG_ENC, "payload of type %N more than %d times (%d) "
2606: "occurred in current message", payload_type_names,
2607: type, rule->max_occurrence, found);
2608: enumerator->destroy(enumerator);
2609: return VERIFY_ERROR;
2610: }
2611: }
2612: }
2613: enumerator->destroy(enumerator);
2614:
2615: if (!complete && found < rule->min_occurrence)
2616: {
2617: DBG1(DBG_ENC, "payload of type %N not occurred %d times (%d)",
2618: payload_type_names, rule->type, rule->min_occurrence, found);
2619: return VERIFY_ERROR;
2620: }
2621: if (found && rule->sufficient)
2622: {
2623: complete = TRUE;
2624: }
2625: }
2626: return SUCCESS;
2627: }
2628:
2629: METHOD(message_t, parse_body, status_t,
2630: private_message_t *this, keymat_t *keymat)
2631: {
2632: status_t status = SUCCESS;
2633: char str[BUF_LEN];
2634:
2635: DBG2(DBG_ENC, "parsing body of message, first payload is %N",
2636: payload_type_names, this->first_payload);
2637:
2638: this->rule = get_message_rule(this);
2639: if (!this->rule)
2640: {
2641: DBG1(DBG_ENC, "no message rules specified for a %N %s",
2642: exchange_type_names, this->exchange_type,
2643: this->is_request ? "request" : "response");
2644: return NOT_SUPPORTED;
2645: }
2646:
2647: /* reassembled IKEv2 messages are already parsed (except for the payloads
2648: * contained in the encrypted payload, which are handled below) */
2649: if (this->parser)
2650: {
2651: status = parse_payloads(this);
2652: if (status != SUCCESS)
2653: { /* error is already logged */
2654: return status;
2655: }
2656: }
2657:
2658: status = decrypt_payloads(this, keymat);
2659: if (status != SUCCESS)
2660: {
2661: DBG1(DBG_ENC, "could not decrypt payloads");
2662: return status;
2663: }
2664:
2665: status = verify(this);
2666: if (status != SUCCESS)
2667: {
2668: return status;
2669: }
2670:
2671: DBG1(DBG_ENC, "parsed %s", get_string(this, str, sizeof(str)));
2672:
2673: if (keymat && keymat->get_version(keymat) == IKEV1)
2674: {
2675: keymat_v1_t *keymat_v1 = (keymat_v1_t*)keymat;
2676: chunk_t hash;
2677:
2678: if (keymat_v1->get_hash_phase2(keymat_v1, &this->public, &hash))
2679: {
2680: hash_payload_t *hash_payload;
2681: chunk_t other_hash;
2682:
2683: if (this->first_payload != PLV1_HASH)
2684: {
2685: if (this->exchange_type == INFORMATIONAL_V1)
2686: {
2687: DBG1(DBG_ENC, "ignoring unprotected INFORMATIONAL from %H",
2688: this->packet->get_source(this->packet));
2689: }
2690: else
2691: {
2692: DBG1(DBG_ENC, "expected HASH payload as first payload");
2693: }
2694: chunk_free(&hash);
2695: return VERIFY_ERROR;
2696: }
2697: hash_payload = (hash_payload_t*)get_payload(this, PLV1_HASH);
2698: other_hash = hash_payload->get_hash(hash_payload);
2699: DBG3(DBG_ENC, "HASH received %B\nHASH expected %B",
2700: &other_hash, &hash);
2701: if (!chunk_equals_const(hash, other_hash))
2702: {
2703: DBG1(DBG_ENC, "received HASH payload does not match");
2704: chunk_free(&hash);
2705: return FAILED;
2706: }
2707: chunk_free(&hash);
2708: }
2709: if (this->is_encrypted && this->exchange_type != INFORMATIONAL_V1)
2710: { /* message verified, confirm IV */
2711: if (!keymat_v1->confirm_iv(keymat_v1, this->message_id))
2712: {
2713: return FAILED;
2714: }
2715: }
2716: }
2717: return SUCCESS;
2718: }
2719:
2720: /**
2721: * Store the fragment data for the fragment with the given fragment number.
2722: */
2723: static status_t add_fragment(private_message_t *this, uint16_t num,
2724: chunk_t data)
2725: {
2726: fragment_t *fragment;
2727: int i, insert_at = -1;
2728:
2729: for (i = 0; i < array_count(this->fragments); i++)
2730: {
2731: array_get(this->fragments, i, &fragment);
2732: if (fragment->num == num)
2733: {
2734: /* ignore a duplicate fragment */
2735: DBG1(DBG_ENC, "received duplicate fragment #%hu", num);
2736: return NEED_MORE;
2737: }
2738: if (fragment->num > num)
2739: {
2740: insert_at = i;
2741: break;
2742: }
2743: }
2744: this->frag->len += data.len;
2745: if (this->frag->len > this->frag->max_packet)
2746: {
2747: DBG1(DBG_ENC, "fragmented IKE message is too large");
2748: reset_defrag(this);
2749: return FAILED;
2750: }
2751: INIT(fragment,
2752: .num = num,
2753: .data = chunk_clone(data),
2754: );
2755: array_insert(this->fragments, insert_at, fragment);
2756: return SUCCESS;
2757: }
2758:
2759: /**
2760: * Merge the cached fragment data and resets the defragmentation state.
2761: * Also updates the IP addresses to those of the last received fragment.
2762: */
2763: static chunk_t merge_fragments(private_message_t *this, message_t *last)
2764: {
2765: fragment_t *fragment;
2766: bio_writer_t *writer;
2767: host_t *src, *dst;
2768: chunk_t data;
2769: int i;
2770:
2771: writer = bio_writer_create(this->frag->len);
2772: for (i = 0; i < array_count(this->fragments); i++)
2773: {
2774: array_get(this->fragments, i, &fragment);
2775: writer->write_data(writer, fragment->data);
2776: }
2777: data = writer->extract_buf(writer);
2778: writer->destroy(writer);
2779:
2780: /* set addresses to those of the last fragment we received */
2781: src = last->get_source(last);
2782: dst = last->get_destination(last);
2783: this->packet->set_source(this->packet, src->clone(src));
2784: this->packet->set_destination(this->packet, dst->clone(dst));
2785:
2786: reset_defrag(this);
2787: free(this->frag);
2788: this->frag = NULL;
2789: return data;
2790: }
2791:
2792: METHOD(message_t, add_fragment_v1, status_t,
2793: private_message_t *this, message_t *message)
2794: {
2795: fragment_payload_t *payload;
2796: chunk_t data;
2797: uint8_t num;
2798: status_t status;
2799:
2800: if (!this->frag)
2801: {
2802: return INVALID_STATE;
2803: }
2804: payload = (fragment_payload_t*)message->get_payload(message, PLV1_FRAGMENT);
2805: if (!payload)
2806: {
2807: return INVALID_ARG;
2808: }
2809: if (!this->fragments || this->message_id != payload->get_id(payload))
2810: {
2811: reset_defrag(this);
2812: this->message_id = payload->get_id(payload);
2813: /* we don't know the total number of fragments, assume something */
2814: this->fragments = array_create(0, 4);
2815: }
2816:
2817: num = payload->get_number(payload);
2818: data = payload->get_data(payload);
2819: if (!this->frag->last && payload->is_last(payload))
2820: {
2821: this->frag->last = num;
2822: }
2823: status = add_fragment(this, num, data);
2824: if (status != SUCCESS)
2825: {
2826: return status;
2827: }
2828:
2829: if (array_count(this->fragments) != this->frag->last)
2830: {
2831: /* there are some fragments missing */
2832: DBG1(DBG_ENC, "received fragment #%hhu, waiting for complete IKE "
2833: "message", num);
2834: return NEED_MORE;
2835: }
2836:
2837: data = merge_fragments(this, message);
2838: this->packet->set_data(this->packet, data);
2839: DBG1(DBG_ENC, "received fragment #%hhu, reassembled fragmented IKE "
2840: "message (%zu bytes)", num, data.len);
2841:
2842: this->parser = parser_create(data);
2843:
2844: if (parse_header(this) != SUCCESS)
2845: {
2846: DBG1(DBG_IKE, "failed to parse header of reassembled IKE message");
2847: return FAILED;
2848: }
2849: return SUCCESS;
2850: }
2851:
2852: METHOD(message_t, add_fragment_v2, status_t,
2853: private_message_t *this, message_t *message)
2854: {
2855: encrypted_fragment_payload_t *encrypted_fragment;
2856: encrypted_payload_t *encrypted;
2857: payload_t *payload;
2858: aead_t *aead;
2859: enumerator_t *enumerator;
2860: chunk_t data;
2861: uint16_t total, num;
2862: size_t len;
2863: status_t status;
2864:
2865: if (!this->frag)
2866: {
2867: return INVALID_STATE;
2868: }
2869: payload = message->get_payload(message, PLV2_FRAGMENT);
2870: if (!payload || this->message_id != message->get_message_id(message))
2871: {
2872: return INVALID_ARG;
2873: }
2874: encrypted_fragment = (encrypted_fragment_payload_t*)payload;
2875: total = encrypted_fragment->get_total_fragments(encrypted_fragment);
2876: if (total > MAX_FRAGMENTS)
2877: {
2878: DBG1(DBG_IKE, "maximum fragment count exceeded");
2879: reset_defrag(this);
2880: return FAILED;
2881: }
2882: if (!this->fragments || total > this->frag->last)
2883: {
2884: reset_defrag(this);
2885: this->frag->last = total;
2886: this->fragments = array_create(0, total);
2887: }
2888: num = encrypted_fragment->get_fragment_number(encrypted_fragment);
2889: data = encrypted_fragment->get_content(encrypted_fragment);
2890: status = add_fragment(this, num, data);
2891: if (status != SUCCESS)
2892: {
2893: return status;
2894: }
2895:
2896: if (num == 1)
2897: {
2898: /* the first fragment denotes the payload type of the first payload in
2899: * the original encrypted payload, cache that */
2900: this->first_payload = payload->get_next_type(payload);
2901: /* move all unencrypted payloads contained in the first fragment */
2902: enumerator = message->create_payload_enumerator(message);
2903: while (enumerator->enumerate(enumerator, &payload))
2904: {
2905: if (payload->get_type(payload) != PLV2_FRAGMENT)
2906: {
2907: message->remove_payload_at(message, enumerator);
2908: this->payloads->insert_last(this->payloads, payload);
2909: }
2910: }
2911: enumerator->destroy(enumerator);
2912: }
2913:
2914: if (array_count(this->fragments) != total)
2915: {
2916: /* there are some fragments missing */
2917: DBG1(DBG_ENC, "received fragment #%hu of %hu, waiting for complete IKE "
2918: "message", num, total);
2919: return NEED_MORE;
2920: }
2921:
2922: encrypted = (encrypted_payload_t*)encrypted_fragment;
2923: aead = encrypted->get_transform(encrypted);
2924:
2925: data = merge_fragments(this, message);
2926:
2927: encrypted = encrypted_payload_create_from_plain(this->first_payload, data);
2928: encrypted->set_transform(encrypted, aead);
2929: this->payloads->insert_last(this->payloads, encrypted);
2930: /* update next payload type (could be an unencrypted payload) */
2931: this->payloads->get_first(this->payloads, (void**)&payload);
2932: this->first_payload = payload->get_type(payload);
2933:
2934: /* we report the length of the complete IKE message when splitting, do the
2935: * same here, so add the IKEv2 header len to the reassembled payload data */
2936: len = 28;
2937: enumerator = create_payload_enumerator(this);
2938: while (enumerator->enumerate(enumerator, &payload))
2939: {
2940: len += payload->get_length(payload);
2941: }
2942: enumerator->destroy(enumerator);
2943:
2944: DBG1(DBG_ENC, "received fragment #%hu of %hu, reassembled fragmented IKE "
2945: "message (%zu bytes)", num, total, len);
2946: return SUCCESS;
2947: }
2948:
2949: METHOD(message_t, destroy, void,
2950: private_message_t *this)
2951: {
2952: DESTROY_IF(this->ike_sa_id);
2953: DESTROY_IF(this->parser);
2954: this->payloads->destroy_offset(this->payloads, offsetof(payload_t, destroy));
2955: this->packet->destroy(this->packet);
2956: if (this->frag)
2957: {
2958: reset_defrag(this);
2959: free(this->frag);
2960: }
2961: else
2962: {
2963: array_destroy_offset(this->fragments, offsetof(packet_t, destroy));
2964: }
2965: free(this);
2966: }
2967:
2968: /*
2969: * Described in header.
2970: */
2971: message_t *message_create_from_packet(packet_t *packet)
2972: {
2973: private_message_t *this;
2974:
2975: INIT(this,
2976: .public = {
2977: .set_major_version = _set_major_version,
2978: .get_major_version = _get_major_version,
2979: .set_minor_version = _set_minor_version,
2980: .get_minor_version = _get_minor_version,
2981: .set_message_id = _set_message_id,
2982: .get_message_id = _get_message_id,
2983: .get_initiator_spi = _get_initiator_spi,
2984: .get_responder_spi = _get_responder_spi,
2985: .set_ike_sa_id = _set_ike_sa_id,
2986: .get_ike_sa_id = _get_ike_sa_id,
2987: .set_exchange_type = _set_exchange_type,
2988: .get_exchange_type = _get_exchange_type,
2989: .get_first_payload_type = _get_first_payload_type,
2990: .set_request = _set_request,
2991: .get_request = _get_request,
2992: .set_version_flag = _set_version_flag,
2993: .get_reserved_header_bit = _get_reserved_header_bit,
2994: .set_reserved_header_bit = _set_reserved_header_bit,
2995: .add_payload = _add_payload,
2996: .add_notify = _add_notify,
2997: .disable_sort = _disable_sort,
2998: .generate = _generate,
2999: .is_encoded = _is_encoded,
3000: .is_fragmented = _is_fragmented,
3001: .fragment = _fragment,
3002: .add_fragment = _add_fragment_v2,
3003: .set_source = _set_source,
3004: .get_source = _get_source,
3005: .set_destination = _set_destination,
3006: .get_destination = _get_destination,
3007: .create_payload_enumerator = _create_payload_enumerator,
3008: .remove_payload_at = _remove_payload_at,
3009: .get_payload = _get_payload,
3010: .get_notify = _get_notify,
3011: .parse_header = _parse_header,
3012: .parse_body = _parse_body,
3013: .get_packet = _get_packet,
3014: .get_packet_data = _get_packet_data,
3015: .get_fragments = _get_fragments,
3016: .destroy = _destroy,
3017: },
3018: .exchange_type = EXCHANGE_TYPE_UNDEFINED,
3019: .is_request = TRUE,
3020: .first_payload = PL_NONE,
3021: .packet = packet,
3022: .payloads = linked_list_create(),
3023: .parser = parser_create(packet->get_data(packet)),
3024: );
3025:
3026: return &this->public;
3027: }
3028:
3029: /*
3030: * Described in header.
3031: */
3032: message_t *message_create(int major, int minor)
3033: {
3034: message_t *this = message_create_from_packet(packet_create());
3035:
3036: this->set_major_version(this, major);
3037: this->set_minor_version(this, minor);
3038:
3039: return this;
3040: }
3041:
3042: /*
3043: * Described in header.
3044: */
3045: message_t *message_create_defrag(message_t *fragment)
3046: {
3047: private_message_t *this;
3048:
3049: if (!fragment->get_payload(fragment, PLV1_FRAGMENT) &&
3050: !fragment->get_payload(fragment, PLV2_FRAGMENT))
3051: {
3052: return NULL;
3053: }
3054: this = (private_message_t*)clone_message((private_message_t*)fragment);
3055: /* we don't need a parser for IKEv2, the one for IKEv1 is created after
3056: * reassembling the original message */
3057: this->parser->destroy(this->parser);
3058: this->parser = NULL;
3059: if (fragment->get_major_version(fragment) == IKEV1_MAJOR_VERSION)
3060: {
3061: /* we store the fragment ID in the message ID field, which should be
3062: * zero for fragments, but make sure */
3063: this->message_id = 0;
3064: this->public.add_fragment = _add_fragment_v1;
3065: }
3066: INIT(this->frag,
3067: .max_packet = lib->settings->get_int(lib->settings,
3068: "%s.max_packet", PACKET_MAX_DEFAULT, lib->ns),
3069: );
3070: return &this->public;
3071: }