summaryrefslogtreecommitdiff
path: root/src/charon-tkm
diff options
context:
space:
mode:
Diffstat (limited to 'src/charon-tkm')
-rw-r--r--src/charon-tkm/Makefile.in5
-rw-r--r--src/charon-tkm/src/charon-tkm.c4
-rw-r--r--src/charon-tkm/src/ees/ees_callbacks.c22
-rw-r--r--src/charon-tkm/src/tkm/tkm.c4
-rw-r--r--src/charon-tkm/src/tkm/tkm.h8
-rw-r--r--src/charon-tkm/src/tkm/tkm_diffie_hellman.c15
-rw-r--r--src/charon-tkm/src/tkm/tkm_encoder.c~106
-rw-r--r--src/charon-tkm/src/tkm/tkm_id_manager.c2
-rw-r--r--src/charon-tkm/src/tkm/tkm_kernel_ipsec.c39
-rw-r--r--src/charon-tkm/src/tkm/tkm_kernel_sad.c66
-rw-r--r--src/charon-tkm/src/tkm/tkm_kernel_sad.h19
-rw-r--r--src/charon-tkm/src/tkm/tkm_keymat.c29
-rw-r--r--src/charon-tkm/src/tkm/tkm_listener.c20
-rw-r--r--src/charon-tkm/tests/diffie_hellman_tests.c2
-rw-r--r--src/charon-tkm/tests/kernel_sad_tests.c40
-rw-r--r--src/charon-tkm/tests/keymat_tests.c4
-rw-r--r--src/charon-tkm/tests/tests.c4
17 files changed, 314 insertions, 75 deletions
diff --git a/src/charon-tkm/Makefile.in b/src/charon-tkm/Makefile.in
index fe6606bc5..bff198ab8 100644
--- a/src/charon-tkm/Makefile.in
+++ b/src/charon-tkm/Makefile.in
@@ -142,6 +142,7 @@ DLLIB = @DLLIB@
DLLTOOL = @DLLTOOL@
DSYMUTIL = @DSYMUTIL@
DUMPBIN = @DUMPBIN@
+EASY_INSTALL = @EASY_INSTALL@
ECHO_C = @ECHO_C@
ECHO_N = @ECHO_N@
ECHO_T = @ECHO_T@
@@ -202,10 +203,12 @@ PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
PLUGIN_CFLAGS = @PLUGIN_CFLAGS@
PTHREADLIB = @PTHREADLIB@
PYTHON = @PYTHON@
+PYTHONEGGINSTALLDIR = @PYTHONEGGINSTALLDIR@
PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
PYTHON_PLATFORM = @PYTHON_PLATFORM@
PYTHON_PREFIX = @PYTHON_PREFIX@
PYTHON_VERSION = @PYTHON_VERSION@
+PY_TEST = @PY_TEST@
RANLIB = @RANLIB@
RTLIB = @RTLIB@
RUBY = @RUBY@
@@ -279,6 +282,8 @@ json_CFLAGS = @json_CFLAGS@
json_LIBS = @json_LIBS@
libdir = @libdir@
libexecdir = @libexecdir@
+libiptc_CFLAGS = @libiptc_CFLAGS@
+libiptc_LIBS = @libiptc_LIBS@
linux_headers = @linux_headers@
localedir = @localedir@
localstatedir = @localstatedir@
diff --git a/src/charon-tkm/src/charon-tkm.c b/src/charon-tkm/src/charon-tkm.c
index a6770fc50..7c60f0ca8 100644
--- a/src/charon-tkm/src/charon-tkm.c
+++ b/src/charon-tkm/src/charon-tkm.c
@@ -276,6 +276,10 @@ int main(int argc, char *argv[])
goto deinit;
}
+ /* the authorize hook currently does not support RFC 7427 signature auth */
+ lib->settings->set_bool(lib->settings, "%s.signature_authentication", FALSE,
+ dmn_name);
+
/* make sure we log to the DAEMON facility by default */
lib->settings->set_int(lib->settings, "%s.syslog.daemon.default",
lib->settings->get_int(lib->settings, "%s.syslog.daemon.default", 1,
diff --git a/src/charon-tkm/src/ees/ees_callbacks.c b/src/charon-tkm/src/ees/ees_callbacks.c
index 2d9653837..74c0d3618 100644
--- a/src/charon-tkm/src/ees/ees_callbacks.c
+++ b/src/charon-tkm/src/ees/ees_callbacks.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2012 Reto Buerki
+ * Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -19,11 +19,12 @@
#include <tkm/constants.h>
#include <tkm/types.h>
+#include "tkm.h"
#include "ees_callbacks.h"
void charon_esa_acquire(result_type *res, const sp_id_type sp_id)
{
- DBG1(DBG_KNL, "ees: acquire received for reqid {%d}", sp_id);
+ DBG1(DBG_KNL, "ees: acquire received for reqid %u", sp_id);
hydra->kernel_interface->acquire(hydra->kernel_interface, sp_id, NULL,
NULL);
*res = TKM_OK;
@@ -33,8 +34,19 @@ void charon_esa_expire(result_type *res, const sp_id_type sp_id,
const esp_spi_type spi_rem, const protocol_type protocol,
const expiry_flag_type hard)
{
- DBG1(DBG_KNL, "ees: expire received for reqid {%d}", sp_id);
- hydra->kernel_interface->expire(hydra->kernel_interface, sp_id, protocol,
- spi_rem, hard != 0);
+ host_t *dst;
+
+ dst = tkm->sad->get_dst_host(tkm->sad, sp_id, spi_rem, protocol);
*res = TKM_OK;
+ if (dst == NULL)
+ {
+ DBG3(DBG_KNL, "ees: destination host not found for reqid %u, spi %x, "
+ "proto %u", sp_id, ntohl(spi_rem), protocol);
+ return;
+ }
+
+ DBG1(DBG_KNL, "ees: expire received for reqid %u, spi %x, dst %H", sp_id,
+ ntohl(spi_rem), dst);
+ hydra->kernel_interface->expire(hydra->kernel_interface, protocol,
+ spi_rem, dst, hard != 0);
}
diff --git a/src/charon-tkm/src/tkm/tkm.c b/src/charon-tkm/src/tkm/tkm.c
index 61eb6056c..333b699a0 100644
--- a/src/charon-tkm/src/tkm/tkm.c
+++ b/src/charon-tkm/src/tkm/tkm.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2012 Reto Buerki
+ * Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -95,6 +95,7 @@ bool tkm_init()
.public = {
.idmgr = tkm_id_manager_create(limits),
.chunk_map = tkm_chunk_map_create(),
+ .sad = tkm_kernel_sad_create(),
},
);
tkm = &this->public;
@@ -114,6 +115,7 @@ void tkm_deinit()
private_tkm_t *this = (private_tkm_t*)tkm;
this->public.idmgr->destroy(this->public.idmgr);
this->public.chunk_map->destroy(this->public.chunk_map);
+ this->public.sad->destroy(this->public.sad);
ees_server_finalize();
diff --git a/src/charon-tkm/src/tkm/tkm.h b/src/charon-tkm/src/tkm/tkm.h
index fb5acd117..4aed08602 100644
--- a/src/charon-tkm/src/tkm/tkm.h
+++ b/src/charon-tkm/src/tkm/tkm.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2012 Reto Buerki
+ * Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -72,6 +72,7 @@
#include "tkm_id_manager.h"
#include "tkm_chunk_map.h"
+#include "tkm_kernel_sad.h"
typedef struct tkm_t tkm_t;
@@ -90,6 +91,11 @@ struct tkm_t {
*/
tkm_chunk_map_t *chunk_map;
+ /**
+ * CHILD/ESP SA database.
+ */
+ tkm_kernel_sad_t *sad;
+
};
/**
diff --git a/src/charon-tkm/src/tkm/tkm_diffie_hellman.c b/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
index 67db5e6d8..c4953b6aa 100644
--- a/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
+++ b/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
@@ -41,7 +41,7 @@ struct private_tkm_diffie_hellman_t {
/**
* Diffie Hellman group number.
*/
- u_int16_t group;
+ diffie_hellman_group_t group;
/**
* Diffie Hellman public value.
@@ -55,30 +55,29 @@ struct private_tkm_diffie_hellman_t {
};
-METHOD(diffie_hellman_t, get_my_public_value, void,
+METHOD(diffie_hellman_t, get_my_public_value, bool,
private_tkm_diffie_hellman_t *this, chunk_t *value)
{
sequence_to_chunk(this->pubvalue.data, this->pubvalue.size, value);
+ return TRUE;
}
-METHOD(diffie_hellman_t, get_shared_secret, status_t,
+METHOD(diffie_hellman_t, get_shared_secret, bool,
private_tkm_diffie_hellman_t *this, chunk_t *secret)
{
*secret = chunk_empty;
- return SUCCESS;
+ return TRUE;
}
-METHOD(diffie_hellman_t, set_other_public_value, void,
+METHOD(diffie_hellman_t, set_other_public_value, bool,
private_tkm_diffie_hellman_t *this, chunk_t value)
{
- // TODO: unvoid this function
-
dh_pubvalue_type othervalue;
othervalue.size = value.len;
memcpy(&othervalue.data, value.ptr, value.len);
- ike_dh_generate_key(this->context_id, othervalue);
+ return ike_dh_generate_key(this->context_id, othervalue) == TKM_OK;
}
METHOD(diffie_hellman_t, get_dh_group, diffie_hellman_group_t,
diff --git a/src/charon-tkm/src/tkm/tkm_encoder.c~ b/src/charon-tkm/src/tkm/tkm_encoder.c~
new file mode 100644
index 000000000..145615f14
--- /dev/null
+++ b/src/charon-tkm/src/tkm/tkm_encoder.c~
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2013 Reto Buerki
+ * Copyright (C) 2013 Adrian-Ken Rueegsegger
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include <utils/debug.h>
+#include <asn1/asn1.h>
+#include <asn1/oid.h>
+
+#include "tkm_encoder.h"
+
+/**
+ * Build the SHA1 hash of pubkey(info) ASN.1 data.
+ */
+static bool hash_pubkey(chunk_t pubkey, chunk_t *hash)
+{
+ hasher_t *hasher;
+
+ hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
+ if (!hasher || !hasher->allocate_hash(hasher, pubkey, hash))
+ {
+ DBG1(DBG_LIB, "SHA1 hash algorithm not supported, "
+ "fingerprinting failed");
+ DESTROY_IF(hasher);
+ chunk_free(&pubkey);
+ return FALSE;
+ }
+ hasher->destroy(hasher);
+ chunk_free(&pubkey);
+ return TRUE;
+}
+
+/**
+ * Encode the public key blob into subjectPublicKeyInfo.
+ */
+static bool build_pub_info(chunk_t *encoding, va_list args)
+{
+ chunk_t blob;
+
+ if (cred_encoding_args(args, CRED_PART_RSA_PUB_ASN1_DER, &blob,
+ CRED_PART_END))
+ {
+ *encoding = asn1_wrap(ASN1_SEQUENCE, "mm",
+ asn1_algorithmIdentifier(OID_RSA_ENCRYPTION),
+ asn1_bitstring("c", blob, 0));
+ return TRUE;
+ }
+ return FALSE;
+}
+
+/**
+ * Build the fingerprint of the subjectPublicKeyInfo object.
+ */
+static bool build_info_sha1(chunk_t *encoding, va_list args)
+{
+ chunk_t pubkey;
+
+ if (build_pub_info(&pubkey, args))
+ {
+ return hash_pubkey(pubkey, encoding);
+ }
+ return FALSE;
+}
+
+/**
+ * Build the fingerprint of the subjectPublicKey object.
+ */
+static bool build_sha1(chunk_t *encoding, va_list args)
+{
+ chunk_t blob;
+
+ if (cred_encoding_args(args, CRED_PART_RSA_PUB_ASN1_DER, &blob,
+ CRED_PART_END))
+ {
+ return hash_pubkey(chunk_clone(blob), encoding);
+ }
+ return FALSE;
+}
+
+/**
+ * See header.
+ */
+bool tkm_encoder_encode(cred_encoding_type_t type, chunk_t *encoding,
+ va_list args)
+{
+ switch (type)
+ {
+ case KEYID_PUBKEY_INFO_SHA1:
+ return build_info_sha1(encoding, args);
+ case KEYID_PUBKEY_SHA1:
+ return build_sha1(encoding, args);
+ default:
+ return FALSE;
+ }
+}
diff --git a/src/charon-tkm/src/tkm/tkm_id_manager.c b/src/charon-tkm/src/tkm/tkm_id_manager.c
index 0fadf1acf..e6d571b83 100644
--- a/src/charon-tkm/src/tkm/tkm_id_manager.c
+++ b/src/charon-tkm/src/tkm/tkm_id_manager.c
@@ -24,7 +24,7 @@
ENUM_BEGIN(tkm_context_kind_names, TKM_CTX_NONCE, TKM_CTX_ESA,
"NONCE_CONTEXT",
"DH_CONTEXT",
- "CC_CONTEXT"
+ "CC_CONTEXT",
"ISA_CONTEXT",
"AE_CONTEXT",
"ESA_CONTEXT");
diff --git a/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c b/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c
index dbeea93f2..734b1ec55 100644
--- a/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c
+++ b/src/charon-tkm/src/tkm/tkm_kernel_ipsec.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2012 Reto Buerki
+ * Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -26,7 +26,6 @@
#include "tkm_utils.h"
#include "tkm_types.h"
#include "tkm_keymat.h"
-#include "tkm_kernel_sad.h"
#include "tkm_kernel_ipsec.h"
/** From linux/in.h */
@@ -51,16 +50,11 @@ struct private_tkm_kernel_ipsec_t {
*/
rng_t *rng;
- /**
- * CHILD/ESP SA database.
- */
- tkm_kernel_sad_t *sad;
-
};
METHOD(kernel_ipsec_t, get_spi, status_t,
private_tkm_kernel_ipsec_t *this, host_t *src, host_t *dst,
- u_int8_t protocol, u_int32_t reqid, u_int32_t *spi)
+ u_int8_t protocol, u_int32_t *spi)
{
bool result;
@@ -74,7 +68,6 @@ METHOD(kernel_ipsec_t, get_spi, status_t,
}
}
- DBG1(DBG_KNL, "getting SPI for reqid {%u}", reqid);
result = this->rng->get_bytes(this->rng, sizeof(u_int32_t),
(u_int8_t *)spi);
return result ? SUCCESS : FAILED;
@@ -82,7 +75,7 @@ METHOD(kernel_ipsec_t, get_spi, status_t,
METHOD(kernel_ipsec_t, get_cpi, status_t,
private_tkm_kernel_ipsec_t *this, host_t *src, host_t *dst,
- u_int32_t reqid, u_int16_t *cpi)
+ u_int16_t *cpi)
{
return NOT_SUPPORTED;
}
@@ -93,11 +86,10 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
u_int32_t tfc, lifetime_cfg_t *lifetime, u_int16_t enc_alg, chunk_t enc_key,
u_int16_t int_alg, chunk_t int_key, ipsec_mode_t mode,
u_int16_t ipcomp, u_int16_t cpi, u_int32_t replay_window,
- bool _initiator, bool encap, bool esn, bool inbound,
- traffic_selector_t* src_ts, traffic_selector_t* dst_ts)
+ bool initiator, bool encap, bool esn, bool inbound, bool update,
+ linked_list_t* src_ts, linked_list_t* dst_ts)
{
esa_info_t esa;
- bool initiator;
esp_spi_type spi_loc, spi_rem;
host_t *local, *peer;
chunk_t *nonce_loc, *nonce_rem;
@@ -120,9 +112,6 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
return SUCCESS;
}
- /* Initiator if encr_r is passed as enc_key to the inbound add_sa call */
- /* TODO: does the new _initiator parameter have the same meaning? */
- initiator = esa.is_encr_r && inbound;
if (initiator)
{
spi_loc = spi;
@@ -143,7 +132,8 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
}
esa_id = tkm->idmgr->acquire_id(tkm->idmgr, TKM_CTX_ESA);
- if (!this->sad->insert(this->sad, esa_id, peer, local, spi_loc, protocol))
+ if (!tkm->sad->insert(tkm->sad, reqid, esa_id, local, peer, spi_rem,
+ protocol))
{
DBG1(DBG_KNL, "unable to add entry (%llu) to SAD", esa_id);
goto sad_failure;
@@ -207,7 +197,7 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
return SUCCESS;
failure:
- this->sad->remove(this->sad, esa_id);
+ tkm->sad->remove(tkm->sad, esa_id);
sad_failure:
tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_ESA, esa_id);
chunk_free(&esa.nonce_i);
@@ -229,7 +219,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
{
esa_id_type esa_id;
- esa_id = this->sad->get_esa_id(this->sad, src, dst, spi, protocol);
+ esa_id = tkm->sad->get_esa_id(tkm->sad, src, dst, spi, protocol);
if (esa_id)
{
DBG1(DBG_KNL, "deleting child SA (esa: %llu, spi: %x)", esa_id,
@@ -239,7 +229,7 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
DBG1(DBG_KNL, "child SA (%llu) deletion failed", esa_id);
return FAILED;
}
- this->sad->remove(this->sad, esa_id);
+ tkm->sad->remove(tkm->sad, esa_id);
tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_ESA, esa_id);
}
return SUCCESS;
@@ -350,7 +340,6 @@ METHOD(kernel_ipsec_t, destroy, void,
private_tkm_kernel_ipsec_t *this)
{
DESTROY_IF(this->rng);
- DESTROY_IF(this->sad);
free(this);
}
@@ -380,15 +369,7 @@ tkm_kernel_ipsec_t *tkm_kernel_ipsec_create()
.destroy = _destroy,
},
},
- .sad = tkm_kernel_sad_create(),
);
- if (!this->sad)
- {
- DBG1(DBG_KNL, "unable to create SAD");
- destroy(this);
- return NULL;
- }
-
return &this->public;
}
diff --git a/src/charon-tkm/src/tkm/tkm_kernel_sad.c b/src/charon-tkm/src/tkm/tkm_kernel_sad.c
index 360a47bdc..3394b58af 100644
--- a/src/charon-tkm/src/tkm/tkm_kernel_sad.c
+++ b/src/charon-tkm/src/tkm/tkm_kernel_sad.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2012 Reto Buerki
+ * Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -57,6 +57,11 @@ struct sad_entry_t {
esa_id_type esa_id;
/**
+ * Reqid.
+ */
+ u_int32_t reqid;
+
+ /**
* Source address of CHILD SA.
*/
host_t *src;
@@ -109,6 +114,19 @@ static bool sad_entry_match(sad_entry_t * const entry, const host_t * const src,
}
/**
+ * Find a list entry with given reqid, spi and proto values.
+ */
+static bool sad_entry_match_dst(sad_entry_t * const entry,
+ const u_int32_t * const reqid,
+ const u_int32_t * const spi,
+ const u_int8_t * const proto)
+{
+ return entry->reqid == *reqid &&
+ entry->spi == *spi &&
+ entry->proto == *proto;
+}
+
+/**
* Compare two SAD entries for equality.
*/
static bool sad_entry_equal(sad_entry_t * const left, sad_entry_t * const right)
@@ -119,6 +137,7 @@ static bool sad_entry_equal(sad_entry_t * const left, sad_entry_t * const right)
return FALSE;
}
return left->esa_id == right->esa_id &&
+ left->reqid == right->reqid &&
left->src->ip_equals(left->src, right->src) &&
left->dst->ip_equals(left->dst, right->dst) &&
left->spi == right->spi && left->proto == right->proto;
@@ -126,14 +145,15 @@ static bool sad_entry_equal(sad_entry_t * const left, sad_entry_t * const right)
METHOD(tkm_kernel_sad_t, insert, bool,
private_tkm_kernel_sad_t * const this, const esa_id_type esa_id,
- const host_t * const src, const host_t * const dst, const u_int32_t spi,
- const u_int8_t proto)
+ const u_int32_t reqid, const host_t * const src, const host_t * const dst,
+ const u_int32_t spi, const u_int8_t proto)
{
status_t result;
sad_entry_t *new_entry;
INIT(new_entry,
.esa_id = esa_id,
+ .reqid = reqid,
.src = (host_t *)src,
.dst = (host_t *)dst,
.spi = spi,
@@ -146,8 +166,9 @@ METHOD(tkm_kernel_sad_t, insert, bool,
new_entry);
if (result == NOT_FOUND)
{
- DBG3(DBG_KNL, "inserting SAD entry (esa: %llu, src: %H, dst: %H, "
- "spi: %x, proto: %u)", esa_id, src, dst, ntohl(spi), proto);
+ DBG3(DBG_KNL, "inserting SAD entry (esa: %llu, reqid: %u, src: %H, "
+ "dst: %H, spi: %x, proto: %u)", esa_id, reqid, src, dst,
+ ntohl(spi), proto);
new_entry->src = src->clone((host_t *)src);
new_entry->dst = dst->clone((host_t *)dst);
this->data->insert_last(this->data, new_entry);
@@ -176,18 +197,44 @@ METHOD(tkm_kernel_sad_t, get_esa_id, esa_id_type,
if (res == SUCCESS && entry)
{
id = entry->esa_id;
- DBG3(DBG_KNL, "getting ESA id of SAD entry (esa: %llu, src: %H, "
- "dst: %H, spi: %x, proto: %u)", id, src, dst, ntohl(spi),
- proto);
+ DBG3(DBG_KNL, "returning ESA id %llu of SAD entry (src: %H, dst: %H, "
+ "spi: %x, proto: %u)", id, src, dst, ntohl(spi), proto);
}
else
{
- DBG3(DBG_KNL, "no SAD entry found");
+ DBG3(DBG_KNL, "no SAD entry found for src %H, dst %H, spi %x, proto %u",
+ src, dst, ntohl(spi), proto);
}
this->mutex->unlock(this->mutex);
return id;
}
+METHOD(tkm_kernel_sad_t, get_dst_host, host_t *,
+ private_tkm_kernel_sad_t * const this, const u_int32_t reqid,
+ const u_int32_t spi, const u_int8_t proto)
+{
+ host_t *dst = NULL;
+ sad_entry_t *entry = NULL;
+
+ this->mutex->lock(this->mutex);
+ const status_t res = this->data->find_first(this->data,
+ (linked_list_match_t)sad_entry_match_dst,
+ (void**)&entry, &reqid, &spi, &proto);
+ if (res == SUCCESS && entry)
+ {
+ dst = entry->dst;
+ DBG3(DBG_KNL, "returning destination host %H of SAD entry (reqid: %u,"
+ " spi: %x, proto: %u)", dst, reqid, ntohl(spi), proto);
+ }
+ else
+ {
+ DBG3(DBG_KNL, "no SAD entry found for reqid %u, spi %x, proto: %u",
+ reqid, ntohl(spi), proto);
+ }
+ this->mutex->unlock(this->mutex);
+ return dst;
+}
+
METHOD(tkm_kernel_sad_t, _remove, bool,
private_tkm_kernel_sad_t * const this, const esa_id_type esa_id)
{
@@ -242,6 +289,7 @@ tkm_kernel_sad_t *tkm_kernel_sad_create()
.public = {
.insert = _insert,
.get_esa_id = _get_esa_id,
+ .get_dst_host = _get_dst_host,
.remove = __remove,
.destroy = _destroy,
},
diff --git a/src/charon-tkm/src/tkm/tkm_kernel_sad.h b/src/charon-tkm/src/tkm/tkm_kernel_sad.h
index 0194cd3bc..38b19dd01 100644
--- a/src/charon-tkm/src/tkm/tkm_kernel_sad.h
+++ b/src/charon-tkm/src/tkm/tkm_kernel_sad.h
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2012 Reto Buerki
+ * Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -37,6 +37,7 @@ struct tkm_kernel_sad_t {
* Insert new SAD entry with specified parameters.
*
* @param esa_id ESP SA context identifier
+ * @param reqid reqid of the SA
* @param src source address of CHILD SA
* @param dst destination address of CHILD SA
* @param spi SPI of CHILD SA
@@ -44,8 +45,9 @@ struct tkm_kernel_sad_t {
* @return TRUE if entry was inserted, FALSE otherwise
*/
bool (*insert)(tkm_kernel_sad_t * const this, const esa_id_type esa_id,
- const host_t * const src, const host_t * const dst,
- const u_int32_t spi, const u_int8_t proto);
+ const u_int32_t reqid, const host_t * const src,
+ const host_t * const dst, const u_int32_t spi,
+ const u_int8_t proto);
/**
* Get ESA id for entry with given parameters.
@@ -61,6 +63,17 @@ struct tkm_kernel_sad_t {
const u_int32_t spi, const u_int8_t proto);
/**
+ * Get destination host for entry with given parameters.
+ *
+ * @param reqid reqid of CHILD SA
+ * @param spi SPI of CHILD SA
+ * @param proto protocol of CHILD SA (ESP/AH)
+ * @return destination host of entry if found, NULL otherwise
+ */
+ host_t * (*get_dst_host)(tkm_kernel_sad_t * const this,
+ const u_int32_t reqid, const u_int32_t spi, const u_int8_t proto);
+
+ /**
* Remove entry with given ESA id from SAD.
*
* @param esa_id ESA identifier of entry to remove
diff --git a/src/charon-tkm/src/tkm/tkm_keymat.c b/src/charon-tkm/src/tkm/tkm_keymat.c
index 772fac8b0..80721fafe 100644
--- a/src/charon-tkm/src/tkm/tkm_keymat.c
+++ b/src/charon-tkm/src/tkm/tkm_keymat.c
@@ -1,4 +1,5 @@
/*
+ * Copyright (C) 2015 Tobias Brunner
* Copyrigth (C) 2012 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
@@ -17,6 +18,7 @@
#include <daemon.h>
#include <tkm/constants.h>
#include <tkm/client.h>
+#include <crypto/hashers/hash_algorithm_set.h>
#include "tkm.h"
#include "tkm_types.h"
@@ -71,6 +73,10 @@ struct private_tkm_keymat_t {
*/
chunk_t other_init_msg;
+ /**
+ * Set of hash algorithms supported by peer for signature authentication
+ */
+ hash_algorithm_set_t *hash_algorithms;
};
/**
@@ -417,6 +423,26 @@ METHOD(keymat_v2_t, get_psk_sig, bool,
return FALSE;
}
+METHOD(keymat_v2_t, hash_algorithm_supported, bool,
+ private_tkm_keymat_t *this, hash_algorithm_t hash)
+{
+ if (!this->hash_algorithms)
+ {
+ return FALSE;
+ }
+ return this->hash_algorithms->contains(this->hash_algorithms, hash);
+}
+
+METHOD(keymat_v2_t, add_hash_algorithm, void,
+ private_tkm_keymat_t *this, hash_algorithm_t hash)
+{
+ if (!this->hash_algorithms)
+ {
+ this->hash_algorithms = hash_algorithm_set_create();
+ }
+ this->hash_algorithms->add(this->hash_algorithms, hash);
+}
+
METHOD(keymat_t, destroy, void,
private_tkm_keymat_t *this)
{
@@ -435,6 +461,7 @@ METHOD(keymat_t, destroy, void,
tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_AE, this->ae_ctx_id);
}
+ DESTROY_IF(this->hash_algorithms);
DESTROY_IF(this->aead_in);
DESTROY_IF(this->aead_out);
chunk_free(&this->auth_payload);
@@ -488,6 +515,8 @@ tkm_keymat_t *tkm_keymat_create(bool initiator)
.get_skd = _get_skd,
.get_auth_octets = _get_auth_octets,
.get_psk_sig = _get_psk_sig,
+ .add_hash_algorithm = _add_hash_algorithm,
+ .hash_algorithm_supported = _hash_algorithm_supported,
},
.get_isa_id = _get_isa_id,
.set_auth_payload = _set_auth_payload,
diff --git a/src/charon-tkm/src/tkm/tkm_listener.c b/src/charon-tkm/src/tkm/tkm_listener.c
index b2692a586..bb1218266 100644
--- a/src/charon-tkm/src/tkm/tkm_listener.c
+++ b/src/charon-tkm/src/tkm/tkm_listener.c
@@ -240,6 +240,8 @@ METHOD(listener_t, authorize, bool,
return TRUE;
}
+ *success = FALSE;
+
keymat = (tkm_keymat_t*)ike_sa->get_keymat(ike_sa);
isa_id = keymat->get_isa_id(keymat);
DBG1(DBG_IKE, "TKM authorize listener called for ISA context %llu", isa_id);
@@ -248,28 +250,26 @@ METHOD(listener_t, authorize, bool,
if (!cc_id)
{
DBG1(DBG_IKE, "unable to acquire CC context id");
- *success = FALSE;
return TRUE;
}
if (!build_cert_chain(ike_sa, cc_id))
{
DBG1(DBG_IKE, "unable to build certificate chain");
- *success = FALSE;
- return TRUE;
+ goto cc_reset;
}
auth = keymat->get_auth_payload(keymat);
if (!auth->ptr)
{
DBG1(DBG_IKE, "no AUTHENTICATION data available");
- *success = FALSE;
+ goto cc_reset;
}
other_init_msg = keymat->get_peer_init_msg(keymat);
if (!other_init_msg->ptr)
{
DBG1(DBG_IKE, "no peer init message available");
- *success = FALSE;
+ goto cc_reset;
}
chunk_to_sequence(auth, &signature, sizeof(signature_type));
@@ -279,7 +279,7 @@ METHOD(listener_t, authorize, bool,
{
DBG1(DBG_IKE, "TKM based authentication failed"
" for ISA context %llu", isa_id);
- *success = FALSE;
+ goto cc_reset;
}
else
{
@@ -288,7 +288,13 @@ METHOD(listener_t, authorize, bool,
*success = TRUE;
}
- return TRUE;
+cc_reset:
+ if (ike_cc_reset(cc_id) != TKM_OK)
+ {
+ DBG1(DBG_IKE, "unable to reset CC context %llu", cc_id);
+ }
+ tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_CC, cc_id);
+ return TRUE; /* stay registered */
}
METHOD(listener_t, message, bool,
diff --git a/src/charon-tkm/tests/diffie_hellman_tests.c b/src/charon-tkm/tests/diffie_hellman_tests.c
index 89658a770..5ef6f41ab 100644
--- a/src/charon-tkm/tests/diffie_hellman_tests.c
+++ b/src/charon-tkm/tests/diffie_hellman_tests.c
@@ -40,7 +40,7 @@ START_TEST(test_dh_get_my_pubvalue)
fail_if(!dh, "Unable to create DH");
chunk_t value;
- dh->dh.get_my_public_value(&dh->dh, &value);
+ ck_assert(dh->dh.get_my_public_value(&dh->dh, &value));
dh->dh.destroy(&dh->dh);
fail_if(value.ptr == NULL, "Pubvalue is NULL");
diff --git a/src/charon-tkm/tests/kernel_sad_tests.c b/src/charon-tkm/tests/kernel_sad_tests.c
index 6f0b396d3..b9ab3cb5e 100644
--- a/src/charon-tkm/tests/kernel_sad_tests.c
+++ b/src/charon-tkm/tests/kernel_sad_tests.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2012 Reto Buerki
+ * Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -34,7 +34,7 @@ START_TEST(test_insert)
host_t *addr = host_create_from_string("127.0.0.1", 1024);
tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
- fail_unless(sad->insert(sad, 1, addr, addr, 42, 50),
+ fail_unless(sad->insert(sad, 1, 2, addr, addr, 42, 50),
"Error inserting SAD entry");
sad->destroy(sad);
@@ -47,9 +47,9 @@ START_TEST(test_insert_duplicate)
host_t *addr = host_create_from_string("127.0.0.1", 1024);
tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
- fail_unless(sad->insert(sad, 1, addr, addr, 42, 50),
+ fail_unless(sad->insert(sad, 1, 2, addr, addr, 42, 50),
"Error inserting SAD entry");
- fail_if(sad->insert(sad, 1, addr, addr, 42, 50),
+ fail_if(sad->insert(sad, 1, 2, addr, addr, 42, 50),
"Expected error inserting duplicate entry");
sad->destroy(sad);
@@ -61,7 +61,7 @@ START_TEST(test_get_esa_id)
{
host_t *addr = host_create_from_string("127.0.0.1", 1024);
tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
- fail_unless(sad->insert(sad, 23, addr, addr, 42, 50),
+ fail_unless(sad->insert(sad, 23, 54, addr, addr, 42, 50),
"Error inserting SAD entry");
fail_unless(sad->get_esa_id(sad, addr, addr, 42, 50) == 23,
"Error getting esa id");
@@ -81,11 +81,34 @@ START_TEST(test_get_esa_id_nonexistent)
}
END_TEST
+START_TEST(test_get_dst_host)
+{
+ host_t *addr = host_create_from_string("127.0.0.1", 1024);
+ tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
+ fail_unless(sad->insert(sad, 23, 54, addr, addr, 42, 50),
+ "Error inserting SAD entry");
+
+ host_t *dst = sad->get_dst_host(sad, 54, 42, 50);
+ fail_unless(addr->equals(addr, dst), "Error getting dst host");
+ sad->destroy(sad);
+ addr->destroy(addr);
+}
+END_TEST
+
+START_TEST(test_get_dst_host_nonexistent)
+{
+ tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
+ fail_unless(sad->get_dst_host(sad, 1, 12, 50) == NULL,
+ "Got dst for nonexistent SAD entry");
+ sad->destroy(sad);
+}
+END_TEST
+
START_TEST(test_remove)
{
host_t *addr = host_create_from_string("127.0.0.1", 1024);
tkm_kernel_sad_t *sad = tkm_kernel_sad_create();
- fail_unless(sad->insert(sad, 23, addr, addr, 42, 50),
+ fail_unless(sad->insert(sad, 23, 54, addr, addr, 42, 50),
"Error inserting SAD entry");
fail_unless(sad->get_esa_id(sad, addr, addr, 42, 50) == 23,
"Error getting esa id");
@@ -128,6 +151,11 @@ Suite *make_kernel_sad_tests()
tcase_add_test(tc, test_get_esa_id_nonexistent);
suite_add_tcase(s, tc);
+ tc = tcase_create("get_dst_host");
+ tcase_add_test(tc, test_get_dst_host);
+ tcase_add_test(tc, test_get_dst_host_nonexistent);
+ suite_add_tcase(s, tc);
+
tc = tcase_create("remove");
tcase_add_test(tc, test_remove);
tcase_add_test(tc, test_remove_nonexistent);
diff --git a/src/charon-tkm/tests/keymat_tests.c b/src/charon-tkm/tests/keymat_tests.c
index 1982671d3..889965a78 100644
--- a/src/charon-tkm/tests/keymat_tests.c
+++ b/src/charon-tkm/tests/keymat_tests.c
@@ -53,8 +53,8 @@ START_TEST(test_derive_ike_keys)
/* Use the same pubvalue for both sides */
chunk_t pubvalue;
- dh->dh.get_my_public_value(&dh->dh, &pubvalue);
- dh->dh.set_other_public_value(&dh->dh, pubvalue);
+ ck_assert(dh->dh.get_my_public_value(&dh->dh, &pubvalue));
+ ck_assert(dh->dh.set_other_public_value(&dh->dh, pubvalue));
fail_unless(keymat->keymat_v2.derive_ike_keys(&keymat->keymat_v2, proposal,
&dh->dh, nonce, nonce, ike_sa_id, PRF_UNDEFINED, chunk_empty),
diff --git a/src/charon-tkm/tests/tests.c b/src/charon-tkm/tests/tests.c
index 80894a133..669f4d500 100644
--- a/src/charon-tkm/tests/tests.c
+++ b/src/charon-tkm/tests/tests.c
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2013 Tobias Brunner
- * Copyright (C) 2012 Reto Buerki
+ * Copyright (C) 2012-2014 Reto Buerki
* Copyright (C) 2012 Adrian-Ken Rueegsegger
* Hochschule fuer Technik Rapperswil
*
@@ -53,7 +53,7 @@ static bool test_runner_init(bool init)
libhydra_init();
libcharon_init();
lib->settings->set_int(lib->settings,
- "test_runner.filelog.stdout.default", 0);
+ "test-runner.filelog.stdout.default", 0);
charon->load_loggers(charon, NULL, FALSE);
/* Register TKM specific plugins */
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-10 14:35:44 +0000