Annotation of embedaddon/strongswan/src/libcharon/sa/ikev1/tasks/isakmp_vendor.c, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (C) 2012-2013 Tobias Brunner
! 3: * Copyright (C) 2009 Martin Willi
! 4: * HSR Hochschule fuer Technik Rapperswil
! 5: *
! 6: * This program is free software; you can redistribute it and/or modify it
! 7: * under the terms of the GNU General Public License as published by the
! 8: * Free Software Foundation; either version 2 of the License, or (at your
! 9: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
! 10: *
! 11: * This program is distributed in the hope that it will be useful, but
! 12: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
! 13: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
! 14: * for more details.
! 15: */
! 16:
! 17: /*
! 18: * Copyright (C) 2012-2014 Volker Rümelin
! 19: *
! 20: * Permission is hereby granted, free of charge, to any person obtaining a copy
! 21: * of this software and associated documentation files (the "Software"), to deal
! 22: * in the Software without restriction, including without limitation the rights
! 23: * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
! 24: * copies of the Software, and to permit persons to whom the Software is
! 25: * furnished to do so, subject to the following conditions:
! 26: *
! 27: * The above copyright notice and this permission notice shall be included in
! 28: * all copies or substantial portions of the Software.
! 29: *
! 30: * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
! 31: * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
! 32: * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
! 33: * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
! 34: * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
! 35: * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
! 36: * THE SOFTWARE.
! 37: */
! 38:
! 39: #include "isakmp_vendor.h"
! 40:
! 41: #include <daemon.h>
! 42: #include <encoding/payloads/vendor_id_payload.h>
! 43:
! 44: typedef struct private_isakmp_vendor_t private_isakmp_vendor_t;
! 45:
! 46: /**
! 47: * Private data of an isakmp_vendor_t object.
! 48: */
! 49: struct private_isakmp_vendor_t {
! 50:
! 51: /**
! 52: * Public isakmp_vendor_t interface.
! 53: */
! 54: isakmp_vendor_t public;
! 55:
! 56: /**
! 57: * Associated IKE_SA
! 58: */
! 59: ike_sa_t *ike_sa;
! 60:
! 61: /**
! 62: * Are we the initiator of this task
! 63: */
! 64: bool initiator;
! 65:
! 66: /**
! 67: * Index of best nat traversal VID found
! 68: */
! 69: int best_natt_ext;
! 70:
! 71: /**
! 72: * Number of times we have been invoked
! 73: */
! 74: int count;
! 75: };
! 76:
! 77: /**
! 78: * IKEv1 Vendor ID database
! 79: */
! 80: static struct {
! 81: /* Description */
! 82: char *desc;
! 83: /* extension flag negotiated with vendor ID, if any */
! 84: ike_extension_t extension;
! 85: /* send yourself? */
! 86: bool send;
! 87: /* length of vendor ID string */
! 88: int len;
! 89: /* vendor ID string */
! 90: char *id;
! 91: } vendor_ids[] = {
! 92:
! 93: /* strongSwan MD5("strongSwan") */
! 94: { "strongSwan", EXT_STRONGSWAN, FALSE, 16,
! 95: "\x88\x2f\xe5\x6d\x6f\xd2\x0d\xbc\x22\x51\x61\x3b\x2e\xbe\x5b\xeb"},
! 96:
! 97: /* XAuth, MD5("draft-ietf-ipsra-isakmp-xauth-06.txt") */
! 98: { "XAuth", EXT_XAUTH, TRUE, 8,
! 99: "\x09\x00\x26\x89\xdf\xd6\xb7\x12"},
! 100:
! 101: /* Dead peer detection, RFC 3706 */
! 102: { "DPD", EXT_DPD, TRUE, 16,
! 103: "\xaf\xca\xd7\x13\x68\xa1\xf1\xc9\x6b\x86\x96\xfc\x77\x57\x01\x00"},
! 104:
! 105: /* CISCO-UNITY, similar to DPD the last two bytes indicate the version */
! 106: { "Cisco Unity", EXT_CISCO_UNITY, FALSE, 16,
! 107: "\x12\xf5\xf2\x8c\x45\x71\x68\xa9\x70\x2d\x9f\xe2\x74\xcc\x01\x00"},
! 108:
! 109: /* Proprietary IKE fragmentation extension. Capabilities are handled
! 110: * specially on receipt of this VID. Windows peers send this VID
! 111: * without capabilities, but accept it with and without capabilities. */
! 112: { "FRAGMENTATION", EXT_IKE_FRAGMENTATION, FALSE, 20,
! 113: "\x40\x48\xb7\xd5\x6e\xbc\xe8\x85\x25\xe7\xde\x7f\x00\xd6\xc2\xd3\x80\x00\x00\x00"},
! 114:
! 115: /* Windows peers send this VID and a version number */
! 116: { "MS NT5 ISAKMPOAKLEY", EXT_MS_WINDOWS, FALSE, 20,
! 117: "\x1e\x2b\x51\x69\x05\x99\x1c\x7d\x7c\x96\xfc\xbf\xb5\x87\xe4\x61\x00\x00\x00\x00"},
! 118:
! 119: }, vendor_natt_ids[] = {
! 120:
! 121: /* NAT-Traversal VIDs ordered by preference */
! 122:
! 123: /* NAT-Traversal, MD5("RFC 3947") */
! 124: { "NAT-T (RFC 3947)", EXT_NATT, TRUE, 16,
! 125: "\x4a\x13\x1c\x81\x07\x03\x58\x45\x5c\x57\x28\xf2\x0e\x95\x45\x2f"},
! 126:
! 127: { "draft-ietf-ipsec-nat-t-ike-03", EXT_NATT | EXT_NATT_DRAFT_02_03,
! 128: FALSE, 16,
! 129: "\x7d\x94\x19\xa6\x53\x10\xca\x6f\x2c\x17\x9d\x92\x15\x52\x9d\x56"},
! 130:
! 131: { "draft-ietf-ipsec-nat-t-ike-02", EXT_NATT | EXT_NATT_DRAFT_02_03,
! 132: FALSE, 16,
! 133: "\xcd\x60\x46\x43\x35\xdf\x21\xf8\x7c\xfd\xb2\xfc\x68\xb6\xa4\x48"},
! 134:
! 135: { "draft-ietf-ipsec-nat-t-ike-02\\n", EXT_NATT | EXT_NATT_DRAFT_02_03,
! 136: TRUE, 16,
! 137: "\x90\xcb\x80\x91\x3e\xbb\x69\x6e\x08\x63\x81\xb5\xec\x42\x7b\x1f"},
! 138:
! 139: { "draft-ietf-ipsec-nat-t-ike-08", 0, FALSE, 16,
! 140: "\x8f\x8d\x83\x82\x6d\x24\x6b\x6f\xc7\xa8\xa6\xa4\x28\xc1\x1d\xe8"},
! 141:
! 142: { "draft-ietf-ipsec-nat-t-ike-07", 0, FALSE, 16,
! 143: "\x43\x9b\x59\xf8\xba\x67\x6c\x4c\x77\x37\xae\x22\xea\xb8\xf5\x82"},
! 144:
! 145: { "draft-ietf-ipsec-nat-t-ike-06", 0, FALSE, 16,
! 146: "\x4d\x1e\x0e\x13\x6d\xea\xfa\x34\xc4\xf3\xea\x9f\x02\xec\x72\x85"},
! 147:
! 148: { "draft-ietf-ipsec-nat-t-ike-05", 0, FALSE, 16,
! 149: "\x80\xd0\xbb\x3d\xef\x54\x56\x5e\xe8\x46\x45\xd4\xc8\x5c\xe3\xee"},
! 150:
! 151: { "draft-ietf-ipsec-nat-t-ike-04", 0, FALSE, 16,
! 152: "\x99\x09\xb6\x4e\xed\x93\x7c\x65\x73\xde\x52\xac\xe9\x52\xfa\x6b"},
! 153:
! 154: { "draft-ietf-ipsec-nat-t-ike-00", 0, FALSE, 16,
! 155: "\x44\x85\x15\x2d\x18\xb6\xbb\xcd\x0b\xe8\xa8\x46\x95\x79\xdd\xcc"},
! 156:
! 157: { "draft-ietf-ipsec-nat-t-ike", 0, FALSE, 16,
! 158: "\x4d\xf3\x79\x28\xe9\xfc\x4f\xd1\xb3\x26\x21\x70\xd5\x15\xc6\x62"},
! 159:
! 160: { "draft-stenberg-ipsec-nat-traversal-02", 0, FALSE, 16,
! 161: "\x61\x05\xc4\x22\xe7\x68\x47\xe4\x3f\x96\x84\x80\x12\x92\xae\xcd"},
! 162:
! 163: { "draft-stenberg-ipsec-nat-traversal-01", 0, FALSE, 16,
! 164: "\x27\xba\xb5\xdc\x01\xea\x07\x60\xea\x4e\x31\x90\xac\x27\xc0\xd0"},
! 165:
! 166: };
! 167:
! 168: /**
! 169: * According to racoon 0x80000000 seems to indicate support for fragmentation
! 170: * of Aggressive and Main mode messages. 0x40000000 seems to indicate support
! 171: * for fragmentation of base ISAKMP messages (Cisco adds that and thus sends
! 172: * 0xc0000000)
! 173: */
! 174: static const uint32_t fragmentation_ike = 0x80000000;
! 175:
! 176: static bool is_known_vid(chunk_t data, int i)
! 177: {
! 178: switch (vendor_ids[i].extension)
! 179: {
! 180: case EXT_IKE_FRAGMENTATION:
! 181: if (data.len >= 16 && memeq(data.ptr, vendor_ids[i].id, 16))
! 182: {
! 183: switch (data.len)
! 184: {
! 185: case 16:
! 186: return TRUE;
! 187: case 20:
! 188: return untoh32(&data.ptr[16]) & fragmentation_ike;
! 189: }
! 190: }
! 191: break;
! 192: case EXT_MS_WINDOWS:
! 193: return data.len == 20 && memeq(data.ptr, vendor_ids[i].id, 16);
! 194: case EXT_CISCO_UNITY:
! 195: return data.len == 16 && memeq(data.ptr, vendor_ids[i].id, 14);
! 196: default:
! 197: return chunk_equals(data, chunk_create(vendor_ids[i].id,
! 198: vendor_ids[i].len));
! 199: }
! 200: return FALSE;
! 201: }
! 202:
! 203: /**
! 204: * Add supported vendor ID payloads
! 205: */
! 206: static void build(private_isakmp_vendor_t *this, message_t *message)
! 207: {
! 208: vendor_id_payload_t *vid_payload;
! 209: bool strongswan, cisco_unity, fragmentation;
! 210: ike_cfg_t *ike_cfg;
! 211: int i;
! 212:
! 213: strongswan = lib->settings->get_bool(lib->settings,
! 214: "%s.send_vendor_id", FALSE, lib->ns);
! 215: cisco_unity = lib->settings->get_bool(lib->settings,
! 216: "%s.cisco_unity", FALSE, lib->ns);
! 217: ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
! 218: fragmentation = ike_cfg->fragmentation(ike_cfg) != FRAGMENTATION_NO;
! 219: if (!this->initiator && fragmentation)
! 220: {
! 221: fragmentation = this->ike_sa->supports_extension(this->ike_sa,
! 222: EXT_IKE_FRAGMENTATION);
! 223: }
! 224: for (i = 0; i < countof(vendor_ids); i++)
! 225: {
! 226: if (vendor_ids[i].send ||
! 227: (vendor_ids[i].extension == EXT_STRONGSWAN && strongswan) ||
! 228: (vendor_ids[i].extension == EXT_CISCO_UNITY && cisco_unity) ||
! 229: (vendor_ids[i].extension == EXT_IKE_FRAGMENTATION && fragmentation))
! 230: {
! 231: DBG2(DBG_IKE, "sending %s vendor ID", vendor_ids[i].desc);
! 232: vid_payload = vendor_id_payload_create_data(PLV1_VENDOR_ID,
! 233: chunk_clone(chunk_create(vendor_ids[i].id, vendor_ids[i].len)));
! 234: message->add_payload(message, &vid_payload->payload_interface);
! 235: }
! 236: }
! 237: for (i = 0; i < countof(vendor_natt_ids); i++)
! 238: {
! 239: if ((this->initiator && vendor_natt_ids[i].send) ||
! 240: this->best_natt_ext == i)
! 241: {
! 242: DBG2(DBG_IKE, "sending %s vendor ID", vendor_natt_ids[i].desc);
! 243: vid_payload = vendor_id_payload_create_data(PLV1_VENDOR_ID,
! 244: chunk_clone(chunk_create(vendor_natt_ids[i].id,
! 245: vendor_natt_ids[i].len)));
! 246: message->add_payload(message, &vid_payload->payload_interface);
! 247: }
! 248: }
! 249: }
! 250:
! 251: /**
! 252: * Process vendor ID payloads
! 253: */
! 254: static void process(private_isakmp_vendor_t *this, message_t *message)
! 255: {
! 256: enumerator_t *enumerator;
! 257: payload_t *payload;
! 258: int i;
! 259:
! 260: enumerator = message->create_payload_enumerator(message);
! 261: while (enumerator->enumerate(enumerator, &payload))
! 262: {
! 263: if (payload->get_type(payload) == PLV1_VENDOR_ID)
! 264: {
! 265: vendor_id_payload_t *vid;
! 266: bool found = FALSE;
! 267: chunk_t data;
! 268:
! 269: vid = (vendor_id_payload_t*)payload;
! 270: data = vid->get_data(vid);
! 271:
! 272: for (i = 0; i < countof(vendor_ids); i++)
! 273: {
! 274: if (is_known_vid(data, i))
! 275: {
! 276: DBG1(DBG_IKE, "received %s vendor ID", vendor_ids[i].desc);
! 277: if (vendor_ids[i].extension)
! 278: {
! 279: this->ike_sa->enable_extension(this->ike_sa,
! 280: vendor_ids[i].extension);
! 281: }
! 282: found = TRUE;
! 283: break;
! 284: }
! 285: }
! 286: if (!found)
! 287: {
! 288: for (i = 0; i < countof(vendor_natt_ids); i++)
! 289: {
! 290: if (chunk_equals(data, chunk_create(vendor_natt_ids[i].id,
! 291: vendor_natt_ids[i].len)))
! 292: {
! 293: DBG1(DBG_IKE, "received %s vendor ID",
! 294: vendor_natt_ids[i].desc);
! 295: if (vendor_natt_ids[i].extension &&
! 296: (i < this->best_natt_ext || this->best_natt_ext < 0))
! 297: {
! 298: this->best_natt_ext = i;
! 299: }
! 300: found = TRUE;
! 301: break;
! 302: }
! 303: }
! 304: }
! 305: if (!found)
! 306: {
! 307: DBG1(DBG_ENC, "received unknown vendor ID: %#B", &data);
! 308: }
! 309: }
! 310: }
! 311: enumerator->destroy(enumerator);
! 312:
! 313: if (this->best_natt_ext >= 0)
! 314: {
! 315: this->ike_sa->enable_extension(this->ike_sa,
! 316: vendor_natt_ids[this->best_natt_ext].extension);
! 317: }
! 318: }
! 319:
! 320: METHOD(task_t, build_i, status_t,
! 321: private_isakmp_vendor_t *this, message_t *message)
! 322: {
! 323: if (this->count++ == 0)
! 324: {
! 325: build(this, message);
! 326: }
! 327: if (message->get_exchange_type(message) == AGGRESSIVE && this->count > 1)
! 328: {
! 329: return SUCCESS;
! 330: }
! 331: return NEED_MORE;
! 332: }
! 333:
! 334: METHOD(task_t, process_r, status_t,
! 335: private_isakmp_vendor_t *this, message_t *message)
! 336: {
! 337: this->count++;
! 338: process(this, message);
! 339: if (message->get_exchange_type(message) == AGGRESSIVE && this->count > 1)
! 340: {
! 341: return SUCCESS;
! 342: }
! 343: return NEED_MORE;
! 344: }
! 345:
! 346: METHOD(task_t, build_r, status_t,
! 347: private_isakmp_vendor_t *this, message_t *message)
! 348: {
! 349: if (this->count == 1)
! 350: {
! 351: build(this, message);
! 352: }
! 353: if (message->get_exchange_type(message) == ID_PROT && this->count > 2)
! 354: {
! 355: return SUCCESS;
! 356: }
! 357: return NEED_MORE;
! 358: }
! 359:
! 360: METHOD(task_t, process_i, status_t,
! 361: private_isakmp_vendor_t *this, message_t *message)
! 362: {
! 363: process(this, message);
! 364: if (message->get_exchange_type(message) == ID_PROT && this->count > 2)
! 365: {
! 366: return SUCCESS;
! 367: }
! 368: return NEED_MORE;
! 369: }
! 370:
! 371: METHOD(task_t, migrate, void,
! 372: private_isakmp_vendor_t *this, ike_sa_t *ike_sa)
! 373: {
! 374: this->ike_sa = ike_sa;
! 375: this->count = 0;
! 376: }
! 377:
! 378: METHOD(task_t, get_type, task_type_t,
! 379: private_isakmp_vendor_t *this)
! 380: {
! 381: return TASK_ISAKMP_VENDOR;
! 382: }
! 383:
! 384: METHOD(task_t, destroy, void,
! 385: private_isakmp_vendor_t *this)
! 386: {
! 387: free(this);
! 388: }
! 389:
! 390: /**
! 391: * See header
! 392: */
! 393: isakmp_vendor_t *isakmp_vendor_create(ike_sa_t *ike_sa, bool initiator)
! 394: {
! 395: private_isakmp_vendor_t *this;
! 396:
! 397: INIT(this,
! 398: .public = {
! 399: .task = {
! 400: .migrate = _migrate,
! 401: .get_type = _get_type,
! 402: .destroy = _destroy,
! 403: },
! 404: },
! 405: .initiator = initiator,
! 406: .ike_sa = ike_sa,
! 407: .best_natt_ext = -1,
! 408: );
! 409:
! 410: if (initiator)
! 411: {
! 412: this->public.task.build = _build_i;
! 413: this->public.task.process = _process_i;
! 414: }
! 415: else
! 416: {
! 417: this->public.task.build = _build_r;
! 418: this->public.task.process = _process_r;
! 419: }
! 420:
! 421: return &this->public;
! 422: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to isakmp_vendor.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / sa / ikev1 / tasks