Annotation of embedaddon/strongswan/src/libcharon/sa/ikev2/tasks/ike_cert_pre.c, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (C) 2008 Tobias Brunner
! 3: * Copyright (C) 2006-2009 Martin Willi
! 4: * HSR Hochschule fuer Technik Rapperswil
! 5: *
! 6: * This program is free software; you can redistribute it and/or modify it
! 7: * under the terms of the GNU General Public License as published by the
! 8: * Free Software Foundation; either version 2 of the License, or (at your
! 9: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
! 10: *
! 11: * This program is distributed in the hope that it will be useful, but
! 12: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
! 13: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
! 14: * for more details.
! 15: */
! 16:
! 17: #include "ike_cert_pre.h"
! 18:
! 19: #include <daemon.h>
! 20: #include <sa/ike_sa.h>
! 21: #include <encoding/payloads/cert_payload.h>
! 22: #include <encoding/payloads/certreq_payload.h>
! 23: #include <credentials/certificates/x509.h>
! 24:
! 25:
! 26: typedef struct private_ike_cert_pre_t private_ike_cert_pre_t;
! 27:
! 28: /**
! 29: * Private members of a ike_cert_pre_t task.
! 30: */
! 31: struct private_ike_cert_pre_t {
! 32:
! 33: /**
! 34: * Public methods and task_t interface.
! 35: */
! 36: ike_cert_pre_t public;
! 37:
! 38: /**
! 39: * Assigned IKE_SA.
! 40: */
! 41: ike_sa_t *ike_sa;
! 42:
! 43: /**
! 44: * Are we the initiator?
! 45: */
! 46: bool initiator;
! 47:
! 48: /**
! 49: * Do we accept HTTP certificate lookup requests
! 50: */
! 51: bool do_http_lookup;
! 52:
! 53: /**
! 54: * whether this is the final authentication round
! 55: */
! 56: bool final;
! 57: };
! 58:
! 59: /**
! 60: * Process a single certificate request payload
! 61: */
! 62: static void process_certreq(private_ike_cert_pre_t *this,
! 63: certreq_payload_t *certreq, auth_cfg_t *auth)
! 64: {
! 65: enumerator_t *enumerator;
! 66: u_int unknown = 0;
! 67: chunk_t keyid;
! 68:
! 69: this->ike_sa->set_condition(this->ike_sa, COND_CERTREQ_SEEN, TRUE);
! 70:
! 71: if (certreq->get_cert_type(certreq) != CERT_X509)
! 72: {
! 73: DBG1(DBG_IKE, "cert payload %N not supported - ignored",
! 74: certificate_type_names, certreq->get_cert_type(certreq));
! 75: return;
! 76: }
! 77:
! 78: enumerator = certreq->create_keyid_enumerator(certreq);
! 79: while (enumerator->enumerate(enumerator, &keyid))
! 80: {
! 81: identification_t *id;
! 82: certificate_t *cert;
! 83:
! 84: id = identification_create_from_encoding(ID_KEY_ID, keyid);
! 85: cert = lib->credmgr->get_cert(lib->credmgr,
! 86: CERT_X509, KEY_ANY, id, TRUE);
! 87: if (cert)
! 88: {
! 89: DBG1(DBG_IKE, "received cert request for \"%Y\"",
! 90: cert->get_subject(cert));
! 91: auth->add(auth, AUTH_RULE_CA_CERT, cert);
! 92: }
! 93: else
! 94: {
! 95: DBG2(DBG_IKE, "received cert request for unknown ca with keyid %Y",
! 96: id);
! 97: unknown++;
! 98: }
! 99: id->destroy(id);
! 100: }
! 101: enumerator->destroy(enumerator);
! 102: if (unknown)
! 103: {
! 104: DBG1(DBG_IKE, "received %u cert requests for an unknown ca",
! 105: unknown);
! 106: }
! 107: }
! 108:
! 109: /**
! 110: * Process a single notify payload
! 111: */
! 112: static void process_notify(private_ike_cert_pre_t *this,
! 113: notify_payload_t *notify)
! 114: {
! 115: switch (notify->get_notify_type(notify))
! 116: {
! 117: case HTTP_CERT_LOOKUP_SUPPORTED:
! 118: this->ike_sa->enable_extension(this->ike_sa, EXT_HASH_AND_URL);
! 119: break;
! 120: default:
! 121: break;
! 122: }
! 123: }
! 124:
! 125: /**
! 126: * read certificate requests
! 127: */
! 128: static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
! 129: {
! 130: enumerator_t *enumerator;
! 131: payload_t *payload;
! 132: auth_cfg_t *auth;
! 133:
! 134: auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
! 135:
! 136: enumerator = message->create_payload_enumerator(message);
! 137: while (enumerator->enumerate(enumerator, &payload))
! 138: {
! 139: switch (payload->get_type(payload))
! 140: {
! 141: case PLV2_CERTREQ:
! 142: process_certreq(this, (certreq_payload_t*)payload, auth);
! 143: break;
! 144: case PLV2_NOTIFY:
! 145: process_notify(this, (notify_payload_t*)payload);
! 146: break;
! 147: default:
! 148: /* ignore other payloads here, these are handled elsewhere */
! 149: break;
! 150: }
! 151: }
! 152: enumerator->destroy(enumerator);
! 153: }
! 154:
! 155: /**
! 156: * tries to extract a certificate from the cert payload or the credential
! 157: * manager (based on the hash of a "Hash and URL" encoded cert).
! 158: * Note: the returned certificate (if any) has to be destroyed
! 159: */
! 160: static certificate_t *try_get_cert(cert_payload_t *cert_payload)
! 161: {
! 162: certificate_t *cert = NULL;
! 163:
! 164: switch (cert_payload->get_cert_encoding(cert_payload))
! 165: {
! 166: case ENC_X509_SIGNATURE:
! 167: {
! 168: cert = cert_payload->get_cert(cert_payload);
! 169: break;
! 170: }
! 171: case ENC_X509_HASH_AND_URL:
! 172: {
! 173: identification_t *id;
! 174: chunk_t hash = cert_payload->get_hash(cert_payload);
! 175: if (!hash.ptr)
! 176: {
! 177: /* invalid "Hash and URL" data (logged elsewhere) */
! 178: break;
! 179: }
! 180: id = identification_create_from_encoding(ID_KEY_ID, hash);
! 181: cert = lib->credmgr->get_cert(lib->credmgr,
! 182: CERT_X509, KEY_ANY, id, FALSE);
! 183: id->destroy(id);
! 184: break;
! 185: }
! 186: default:
! 187: {
! 188: break;
! 189: }
! 190: }
! 191: return cert;
! 192: }
! 193:
! 194: /**
! 195: * Process a X509 certificate payload
! 196: */
! 197: static void process_x509(cert_payload_t *payload, auth_cfg_t *auth,
! 198: cert_encoding_t encoding, bool *first)
! 199: {
! 200: certificate_t *cert;
! 201: char *url;
! 202:
! 203: cert = try_get_cert(payload);
! 204: if (cert)
! 205: {
! 206: if (*first)
! 207: { /* the first is an end entity certificate */
! 208: DBG1(DBG_IKE, "received end entity cert \"%Y\"",
! 209: cert->get_subject(cert));
! 210: auth->add(auth, AUTH_HELPER_SUBJECT_CERT, cert);
! 211: *first = FALSE;
! 212: }
! 213: else
! 214: {
! 215: DBG1(DBG_IKE, "received issuer cert \"%Y\"",
! 216: cert->get_subject(cert));
! 217: auth->add(auth, AUTH_HELPER_IM_CERT, cert);
! 218: }
! 219: }
! 220: else if (encoding == ENC_X509_HASH_AND_URL)
! 221: {
! 222: /* we fetch the certificate not yet, but only if
! 223: * it is really needed during authentication */
! 224: url = payload->get_url(payload);
! 225: if (!url)
! 226: {
! 227: DBG1(DBG_IKE, "received invalid hash-and-url "
! 228: "encoded cert, ignore");
! 229: return;
! 230: }
! 231: url = strdup(url);
! 232: if (*first)
! 233: { /* first URL is for an end entity certificate */
! 234: DBG1(DBG_IKE, "received hash-and-url for end entity cert \"%s\"",
! 235: url);
! 236: auth->add(auth, AUTH_HELPER_SUBJECT_HASH_URL, url);
! 237: *first = FALSE;
! 238: }
! 239: else
! 240: {
! 241: DBG1(DBG_IKE, "received hash-and-url for issuer cert \"%s\"", url);
! 242: auth->add(auth, AUTH_HELPER_IM_HASH_URL, url);
! 243: }
! 244: }
! 245: }
! 246:
! 247: /**
! 248: * Process a CRL certificate payload
! 249: */
! 250: static void process_crl(cert_payload_t *payload, auth_cfg_t *auth)
! 251: {
! 252: certificate_t *cert;
! 253:
! 254: cert = payload->get_cert(payload);
! 255: if (cert)
! 256: {
! 257: DBG1(DBG_IKE, "received CRL \"%Y\"", cert->get_subject(cert));
! 258: auth->add(auth, AUTH_HELPER_REVOCATION_CERT, cert);
! 259: }
! 260: }
! 261:
! 262: /**
! 263: * Process an attribute certificate payload
! 264: */
! 265: static void process_ac(cert_payload_t *payload, auth_cfg_t *auth)
! 266: {
! 267: certificate_t *cert;
! 268:
! 269: cert = payload->get_cert(payload);
! 270: if (cert)
! 271: {
! 272: if (cert->get_issuer(cert))
! 273: {
! 274: DBG1(DBG_IKE, "received attribute certificate issued by \"%Y\"",
! 275: cert->get_issuer(cert));
! 276: }
! 277: else if (cert->get_subject(cert))
! 278: {
! 279: DBG1(DBG_IKE, "received attribute certificate for \"%Y\"",
! 280: cert->get_subject(cert));
! 281: }
! 282: auth->add(auth, AUTH_HELPER_AC_CERT, cert);
! 283: }
! 284: }
! 285:
! 286: /**
! 287: * Process certificate payloads
! 288: */
! 289: static void process_certs(private_ike_cert_pre_t *this, message_t *message)
! 290: {
! 291: enumerator_t *enumerator;
! 292: payload_t *payload;
! 293: auth_cfg_t *auth;
! 294: bool first = TRUE;
! 295:
! 296: auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
! 297:
! 298: enumerator = message->create_payload_enumerator(message);
! 299: while (enumerator->enumerate(enumerator, &payload))
! 300: {
! 301: if (payload->get_type(payload) == PLV2_CERTIFICATE)
! 302: {
! 303: cert_payload_t *cert_payload;
! 304: cert_encoding_t encoding;
! 305:
! 306: cert_payload = (cert_payload_t*)payload;
! 307: encoding = cert_payload->get_cert_encoding(cert_payload);
! 308:
! 309: switch (encoding)
! 310: {
! 311: case ENC_X509_HASH_AND_URL:
! 312: if (!this->do_http_lookup)
! 313: {
! 314: DBG1(DBG_IKE, "received hash-and-url encoded cert, but "
! 315: "we don't accept them, ignore");
! 316: break;
! 317: }
! 318: /* FALL */
! 319: case ENC_X509_SIGNATURE:
! 320: process_x509(cert_payload, auth, encoding, &first);
! 321: break;
! 322: case ENC_CRL:
! 323: process_crl(cert_payload, auth);
! 324: break;
! 325: case ENC_X509_ATTRIBUTE:
! 326: process_ac(cert_payload, auth);
! 327: break;
! 328: case ENC_PKCS7_WRAPPED_X509:
! 329: case ENC_PGP:
! 330: case ENC_DNS_SIGNED_KEY:
! 331: case ENC_KERBEROS_TOKEN:
! 332: case ENC_ARL:
! 333: case ENC_SPKI:
! 334: case ENC_RAW_RSA_KEY:
! 335: case ENC_X509_HASH_AND_URL_BUNDLE:
! 336: case ENC_OCSP_CONTENT:
! 337: default:
! 338: DBG1(DBG_ENC, "certificate encoding %N not supported",
! 339: cert_encoding_names, encoding);
! 340: }
! 341: }
! 342: }
! 343: enumerator->destroy(enumerator);
! 344: }
! 345:
! 346: /**
! 347: * add the keyid of a certificate to the certificate request payload
! 348: */
! 349: static void add_certreq(certreq_payload_t **req, certificate_t *cert)
! 350: {
! 351: switch (cert->get_type(cert))
! 352: {
! 353: case CERT_X509:
! 354: {
! 355: public_key_t *public;
! 356: chunk_t keyid;
! 357: x509_t *x509 = (x509_t*)cert;
! 358:
! 359: if (!(x509->get_flags(x509) & X509_CA))
! 360: { /* no CA cert, skip */
! 361: break;
! 362: }
! 363: public = cert->get_public_key(cert);
! 364: if (!public)
! 365: {
! 366: break;
! 367: }
! 368: if (*req == NULL)
! 369: {
! 370: *req = certreq_payload_create_type(CERT_X509);
! 371: }
! 372: if (public->get_fingerprint(public, KEYID_PUBKEY_INFO_SHA1, &keyid))
! 373: {
! 374: (*req)->add_keyid(*req, keyid);
! 375: DBG1(DBG_IKE, "sending cert request for \"%Y\"",
! 376: cert->get_subject(cert));
! 377: }
! 378: public->destroy(public);
! 379: break;
! 380: }
! 381: default:
! 382: break;
! 383: }
! 384: }
! 385:
! 386: /**
! 387: * add a auth_cfg's CA certificates to the certificate request
! 388: */
! 389: static void add_certreqs(certreq_payload_t **req, auth_cfg_t *auth)
! 390: {
! 391: enumerator_t *enumerator;
! 392: auth_rule_t type;
! 393: void *value;
! 394:
! 395: enumerator = auth->create_enumerator(auth);
! 396: while (enumerator->enumerate(enumerator, &type, &value))
! 397: {
! 398: switch (type)
! 399: {
! 400: case AUTH_RULE_CA_CERT:
! 401: add_certreq(req, (certificate_t*)value);
! 402: break;
! 403: default:
! 404: break;
! 405: }
! 406: }
! 407: enumerator->destroy(enumerator);
! 408: }
! 409:
! 410: /**
! 411: * build certificate requests
! 412: */
! 413: static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
! 414: {
! 415: enumerator_t *enumerator;
! 416: ike_cfg_t *ike_cfg;
! 417: peer_cfg_t *peer_cfg;
! 418: certificate_t *cert;
! 419: auth_cfg_t *auth;
! 420: certreq_payload_t *req = NULL;
! 421:
! 422: ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
! 423: if (!ike_cfg->send_certreq(ike_cfg))
! 424: {
! 425: return;
! 426: }
! 427:
! 428: /* check if we require a specific CA for that peer */
! 429: peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
! 430: if (peer_cfg)
! 431: {
! 432: enumerator = peer_cfg->create_auth_cfg_enumerator(peer_cfg, FALSE);
! 433: while (enumerator->enumerate(enumerator, &auth))
! 434: {
! 435: add_certreqs(&req, auth);
! 436: }
! 437: enumerator->destroy(enumerator);
! 438: }
! 439:
! 440: if (!req)
! 441: {
! 442: /* otherwise add all trusted CA certificates */
! 443: enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
! 444: CERT_ANY, KEY_ANY, NULL, TRUE);
! 445: while (enumerator->enumerate(enumerator, &cert))
! 446: {
! 447: add_certreq(&req, cert);
! 448: }
! 449: enumerator->destroy(enumerator);
! 450: }
! 451:
! 452: if (req)
! 453: {
! 454: message->add_payload(message, (payload_t*)req);
! 455:
! 456: if (lib->settings->get_bool(lib->settings,
! 457: "%s.hash_and_url", FALSE, lib->ns))
! 458: {
! 459: message->add_notify(message, FALSE, HTTP_CERT_LOOKUP_SUPPORTED,
! 460: chunk_empty);
! 461: this->do_http_lookup = TRUE;
! 462: }
! 463: }
! 464: }
! 465:
! 466: /**
! 467: * Check if this is the final authentication round
! 468: */
! 469: static bool final_auth(message_t *message)
! 470: {
! 471: /* we check for an AUTH payload without a ANOTHER_AUTH_FOLLOWS notify */
! 472: if (message->get_payload(message, PLV2_AUTH) == NULL)
! 473: {
! 474: return FALSE;
! 475: }
! 476: if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS))
! 477: {
! 478: return FALSE;
! 479: }
! 480: return TRUE;
! 481: }
! 482:
! 483: METHOD(task_t, build_i, status_t,
! 484: private_ike_cert_pre_t *this, message_t *message)
! 485: {
! 486: if (message->get_message_id(message) == 1)
! 487: { /* initiator sends CERTREQs in first IKE_AUTH */
! 488: build_certreqs(this, message);
! 489: }
! 490: return NEED_MORE;
! 491: }
! 492:
! 493: METHOD(task_t, process_r, status_t,
! 494: private_ike_cert_pre_t *this, message_t *message)
! 495: {
! 496: if (message->get_exchange_type(message) != IKE_SA_INIT)
! 497: { /* handle certreqs/certs in any IKE_AUTH, just in case */
! 498: process_certreqs(this, message);
! 499: process_certs(this, message);
! 500: }
! 501: this->final = final_auth(message);
! 502: return NEED_MORE;
! 503: }
! 504:
! 505: METHOD(task_t, build_r, status_t,
! 506: private_ike_cert_pre_t *this, message_t *message)
! 507: {
! 508: if (message->get_exchange_type(message) == IKE_SA_INIT)
! 509: {
! 510: build_certreqs(this, message);
! 511: }
! 512: if (this->final)
! 513: {
! 514: return SUCCESS;
! 515: }
! 516: return NEED_MORE;
! 517: }
! 518:
! 519: METHOD(task_t, process_i, status_t,
! 520: private_ike_cert_pre_t *this, message_t *message)
! 521: {
! 522: if (message->get_exchange_type(message) == IKE_SA_INIT)
! 523: {
! 524: process_certreqs(this, message);
! 525: }
! 526: process_certs(this, message);
! 527:
! 528: if (final_auth(message))
! 529: {
! 530: return SUCCESS;
! 531: }
! 532: return NEED_MORE;
! 533: }
! 534:
! 535: METHOD(task_t, get_type, task_type_t,
! 536: private_ike_cert_pre_t *this)
! 537: {
! 538: return TASK_IKE_CERT_PRE;
! 539: }
! 540:
! 541: METHOD(task_t, migrate, void,
! 542: private_ike_cert_pre_t *this, ike_sa_t *ike_sa)
! 543: {
! 544: this->ike_sa = ike_sa;
! 545: }
! 546:
! 547: METHOD(task_t, destroy, void,
! 548: private_ike_cert_pre_t *this)
! 549: {
! 550: free(this);
! 551: }
! 552:
! 553: /*
! 554: * Described in header.
! 555: */
! 556: ike_cert_pre_t *ike_cert_pre_create(ike_sa_t *ike_sa, bool initiator)
! 557: {
! 558: private_ike_cert_pre_t *this;
! 559:
! 560: INIT(this,
! 561: .public = {
! 562: .task = {
! 563: .get_type = _get_type,
! 564: .migrate = _migrate,
! 565: .destroy = _destroy,
! 566: },
! 567: },
! 568: .ike_sa = ike_sa,
! 569: .initiator = initiator,
! 570: );
! 571:
! 572: if (initiator)
! 573: {
! 574: this->public.task.build = _build_i;
! 575: this->public.task.process = _process_i;
! 576: }
! 577: else
! 578: {
! 579: this->public.task.build = _build_r;
! 580: this->public.task.process = _process_r;
! 581: }
! 582:
! 583: return &this->public;
! 584: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to ike_cert_pre.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / sa / ikev2 / tasks