diff options
Diffstat (limited to 'src/libcharon/encoding')
| -rw-r--r-- | src/libcharon/encoding/generator.c | 80 | ||||
| -rw-r--r-- | src/libcharon/encoding/generator.h | 26 | ||||
| -rw-r--r-- | src/libcharon/encoding/message.c | 973 | ||||
| -rw-r--r-- | src/libcharon/encoding/message.h | 48 | ||||
| -rw-r--r-- | src/libcharon/encoding/payloads/delete_payload.c | 213 | ||||
| -rw-r--r-- | src/libcharon/encoding/payloads/delete_payload.h | 9 | ||||
| -rw-r--r-- | src/libcharon/encoding/payloads/encryption_payload.c | 610 | ||||
| -rw-r--r-- | src/libcharon/encoding/payloads/encryption_payload.h | 118 | ||||
| -rw-r--r-- | src/libcharon/encoding/payloads/notify_payload.c | 56 | ||||
| -rw-r--r-- | src/libcharon/encoding/payloads/notify_payload.h | 24 | ||||
| -rw-r--r-- | src/libcharon/encoding/payloads/proposal_substructure.c | 321 | ||||
| -rw-r--r-- | src/libcharon/encoding/payloads/proposal_substructure.h | 33 | ||||
| -rw-r--r-- | src/libcharon/encoding/payloads/sa_payload.c | 277 | ||||
| -rw-r--r-- | src/libcharon/encoding/payloads/sa_payload.h | 22 |
14 files changed, 1053 insertions, 1757 deletions
diff --git a/src/libcharon/encoding/generator.c b/src/libcharon/encoding/generator.c index 6485da492..224f76fce 100644 --- a/src/libcharon/encoding/generator.c +++ b/src/libcharon/encoding/generator.c @@ -42,6 +42,16 @@ #include <encoding/payloads/configuration_attribute.h> #include <encoding/payloads/eap_payload.h> +/** + * Generating is done in a data buffer. + * This is the start size of this buffer in bytes. + */ +#define GENERATOR_DATA_BUFFER_SIZE 500 + +/** + * Number of bytes to increase the buffer, if it is too small. + */ +#define GENERATOR_DATA_BUFFER_INCREASE_VALUE 500 typedef struct private_generator_t private_generator_t; @@ -453,36 +463,19 @@ static void generate_from_chunk(private_generator_t *this, u_int32_t offset) write_bytes_to_buffer(this, value->ptr, value->len); } -/** - * Implementation of private_generator_t.write_to_chunk. - */ -static void write_to_chunk(private_generator_t *this,chunk_t *data) +METHOD(generator_t, get_chunk, chunk_t, + private_generator_t *this, u_int32_t **lenpos) { - int data_length = get_length(this); - u_int32_t header_length_field = data_length; - - /* write length into header length field */ - if (this->header_length_position_offset > 0) - { - u_int32_t val = htonl(header_length_field); - write_bytes_to_buffer_at_offset(this, &val, sizeof(u_int32_t), - this->header_length_position_offset); - } + chunk_t data; - if (this->current_bit > 0) - { - data_length++; - } - *data = chunk_alloc(data_length); - memcpy(data->ptr, this->buffer, data_length); - - DBG3(DBG_ENC, "generated data of this generator %B", data); + *lenpos = (u_int32_t*)(this->buffer + this->header_length_position_offset); + data = chunk_create(this->buffer, get_length(this)); + DBG3(DBG_ENC, "generated data of this generator %B", &data); + return data; } -/** - * Implementation of private_generator_t.generate_payload. - */ -static void generate_payload (private_generator_t *this,payload_t *payload) +METHOD(generator_t, generate_payload, void, + private_generator_t *this,payload_t *payload) { int i, offset_start; size_t rule_count; @@ -846,14 +839,11 @@ static void generate_payload (private_generator_t *this,payload_t *payload) this->out_position - this->buffer - offset_start); } -/** - * Implementation of generator_t.destroy. - */ -static status_t destroy(private_generator_t *this) +METHOD(generator_t, destroy, void, + private_generator_t *this) { free(this->buffer); free(this); - return SUCCESS; } /* @@ -863,26 +853,18 @@ generator_t *generator_create() { private_generator_t *this; - this = malloc_thing(private_generator_t); - - /* initiate public functions */ - this->public.generate_payload = (void(*)(generator_t*, payload_t *))generate_payload; - this->public.destroy = (void(*)(generator_t*)) destroy; - this->public.write_to_chunk = (void (*) (generator_t *,chunk_t *))write_to_chunk; + INIT(this, + .public = { + .get_chunk = _get_chunk, + .generate_payload = _generate_payload, + .destroy = _destroy, + }, + .buffer = malloc(GENERATOR_DATA_BUFFER_SIZE), + ); - /* allocate memory for buffer */ - this->buffer = malloc(GENERATOR_DATA_BUFFER_SIZE); - - /* initiate private variables */ this->out_position = this->buffer; this->roof_position = this->buffer + GENERATOR_DATA_BUFFER_SIZE; - this->data_struct = NULL; - this->current_bit = 0; - this->last_payload_length_position_offset = 0; - this->header_length_position_offset = 0; - this->attribute_format = FALSE; - this->attribute_length = 0; - - return &(this->public); + + return &this->public; } diff --git a/src/libcharon/encoding/generator.h b/src/libcharon/encoding/generator.h index 2221c84af..fe561fdfd 100644 --- a/src/libcharon/encoding/generator.h +++ b/src/libcharon/encoding/generator.h @@ -29,24 +29,12 @@ typedef struct generator_t generator_t; #include <encoding/payloads/payload.h> /** - * Generating is done in a data buffer. - * This is the start size of this buffer in bytes. - */ -#define GENERATOR_DATA_BUFFER_SIZE 500 - -/** - * Number of bytes to increase the buffer, if it is too small. - */ -#define GENERATOR_DATA_BUFFER_INCREASE_VALUE 500 - - -/** * A generator_t class used to generate IKEv2 payloads. * * After creation, multiple payloads can be generated with the generate_payload * method. The generated bytes are appended. After all payloads are added, * the write_to_chunk method writes out all generated data since - * the creation of the generator. After that, the generator must be destroyed. + * the creation of the generator. * The generater uses a set of encoding rules, which it can get from * the supplied payload. With this rules, the generater can generate * the payload and all substructures automatically. @@ -56,18 +44,20 @@ struct generator_t { /** * Generates a specific payload from given payload object. * - * Remember: Header and substructures are also handled as payloads. - * * @param payload interface payload_t implementing object */ void (*generate_payload) (generator_t *this,payload_t *payload); /** - * Writes all generated data of the generator to a chunk. + * Return a chunk for the currently generated data. + * + * The returned length pointer must be filled in with the length of + * the generated chunk (in network order). * - * @param data chunk to write the data to + * @param lenpos receives a pointer to fill in length value + * @param return chunk to internal buffer. */ - void (*write_to_chunk) (generator_t *this,chunk_t *data); + chunk_t (*get_chunk) (generator_t *this, u_int32_t **lenpos); /** * Destroys a generator_t object. diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c index ee49a6686..d41ad4697 100644 --- a/src/libcharon/encoding/message.c +++ b/src/libcharon/encoding/message.c @@ -1,6 +1,7 @@ /* * Copyright (C) 2006-2007 Tobias Brunner - * Copyright (C) 2005-2009 Martin Willi + * Copyright (C) 2005-2010 Martin Willi + * Copyright (C) 2010 revosec AG * Copyright (C) 2006 Daniel Roethlisberger * Copyright (C) 2005 Jan Hutter * Hochschule fuer Technik Rapperswil @@ -43,111 +44,61 @@ */ #define MAX_DELETE_PAYLOADS 20 - -typedef struct payload_rule_t payload_rule_t; - /** * A payload rule defines the rules for a payload * in a specific message rule. It defines if and how * many times a payload must/can occur in a message * and if it must be encrypted. */ -struct payload_rule_t { - /** - * Payload type. - */ - payload_type_t payload_type; - - /** - * Minimal occurence of this payload. - */ - size_t min_occurence; - - /** - * Max occurence of this payload. - */ - size_t max_occurence; - - /** - * TRUE if payload must be encrypted - */ - bool encrypted; - - /** - * If this payload occurs, the message rule is - * fullfilled in any case. This applies e.g. to - * notify_payloads. - */ - bool sufficient; -}; - -typedef struct payload_order_t payload_order_t; +typedef struct { + /* Payload type */ + payload_type_t type; + /* Minimal occurence of this payload. */ + size_t min_occurence; + /* Max occurence of this payload. */ + size_t max_occurence; + /* TRUE if payload must be encrypted */ + bool encrypted; + /* If payload occurs, the message rule is fullfilled */ + bool sufficient; +} payload_rule_t; /** * payload ordering structure allows us to reorder payloads according to RFC. */ -struct payload_order_t { - - /** - * payload type - */ +typedef struct { + /** payload type */ payload_type_t type; - - /** - * notify type, if payload == NOTIFY - */ + /** notify type, if payload == NOTIFY */ notify_type_t notify; -}; - - -typedef struct message_rule_t message_rule_t; +} payload_order_t; /** * A message rule defines the kind of a message, * if it has encrypted contents and a list * of payload ordering rules and payload parsing rules. */ -struct message_rule_t { - /** - * Type of message. - */ +typedef struct { + /** Type of message. */ exchange_type_t exchange_type; - - /** - * Is message a request or response. - */ + /** Is message a request or response. */ bool is_request; - - /** - * Message contains encrypted content. - */ - bool encrypted_content; - - /** - * Number of payload rules which will follow - */ - int payload_rule_count; - - /** - * Pointer to first payload rule - */ - payload_rule_t *payload_rules; - - /** - * Number of payload order rules - */ - int payload_order_count; - - /** - * payload ordering rules - */ - payload_order_t *payload_order; -}; + /** Message contains encrypted payloads. */ + bool encrypted; + /** Number of payload rules which will follow */ + int rule_count; + /** Pointer to first payload rule */ + payload_rule_t *rules; + /** Number of payload order rules */ + int order_count; + /** payload ordering rules */ + payload_order_t *order; +} message_rule_t; /** * Message rule for IKE_SA_INIT from initiator. */ -static payload_rule_t ike_sa_init_i_payload_rules[] = { +static payload_rule_t ike_sa_init_i_rules[] = { /* payload type min max encr suff */ {NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, FALSE}, {SECURITY_ASSOCIATION, 1, 1, FALSE, FALSE}, @@ -159,7 +110,7 @@ static payload_rule_t ike_sa_init_i_payload_rules[] = { /** * payload order for IKE_SA_INIT initiator */ -static payload_order_t ike_sa_init_i_payload_order[] = { +static payload_order_t ike_sa_init_i_order[] = { /* payload type notify type */ {NOTIFY, COOKIE}, {SECURITY_ASSOCIATION, 0}, @@ -174,7 +125,7 @@ static payload_order_t ike_sa_init_i_payload_order[] = { /** * Message rule for IKE_SA_INIT from responder. */ -static payload_rule_t ike_sa_init_r_payload_rules[] = { +static payload_rule_t ike_sa_init_r_rules[] = { /* payload type min max encr suff */ {NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, TRUE}, {SECURITY_ASSOCIATION, 1, 1, FALSE, FALSE}, @@ -186,7 +137,7 @@ static payload_rule_t ike_sa_init_r_payload_rules[] = { /** * payload order for IKE_SA_INIT responder */ -static payload_order_t ike_sa_init_r_payload_order[] = { +static payload_order_t ike_sa_init_r_order[] = { /* payload type notify type */ {SECURITY_ASSOCIATION, 0}, {KEY_EXCHANGE, 0}, @@ -202,7 +153,7 @@ static payload_order_t ike_sa_init_r_payload_order[] = { /** * Message rule for IKE_AUTH from initiator. */ -static payload_rule_t ike_auth_i_payload_rules[] = { +static payload_rule_t ike_auth_i_rules[] = { /* payload type min max encr suff */ {NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE}, {EXTENSIBLE_AUTHENTICATION, 0, 1, TRUE, TRUE}, @@ -227,7 +178,7 @@ static payload_rule_t ike_auth_i_payload_rules[] = { /** * payload order for IKE_AUTH initiator */ -static payload_order_t ike_auth_i_payload_order[] = { +static payload_order_t ike_auth_i_order[] = { /* payload type notify type */ {ID_INITIATOR, 0}, {CERTIFICATE, 0}, @@ -256,7 +207,7 @@ static payload_order_t ike_auth_i_payload_order[] = { /** * Message rule for IKE_AUTH from responder. */ -static payload_rule_t ike_auth_r_payload_rules[] = { +static payload_rule_t ike_auth_r_rules[] = { /* payload type min max encr suff */ {NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE}, {EXTENSIBLE_AUTHENTICATION, 0, 1, TRUE, TRUE}, @@ -273,7 +224,7 @@ static payload_rule_t ike_auth_r_payload_rules[] = { /** * payload order for IKE_AUTH responder */ -static payload_order_t ike_auth_r_payload_order[] = { +static payload_order_t ike_auth_r_order[] = { /* payload type notify type */ {ID_RESPONDER, 0}, {CERTIFICATE, 0}, @@ -299,7 +250,7 @@ static payload_order_t ike_auth_r_payload_order[] = { /** * Message rule for INFORMATIONAL from initiator. */ -static payload_rule_t informational_i_payload_rules[] = { +static payload_rule_t informational_i_rules[] = { /* payload type min max encr suff */ {NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE}, {CONFIGURATION, 0, 1, TRUE, FALSE}, @@ -310,7 +261,7 @@ static payload_rule_t informational_i_payload_rules[] = { /** * payload order for INFORMATIONAL initiator */ -static payload_order_t informational_i_payload_order[] = { +static payload_order_t informational_i_order[] = { /* payload type notify type */ {NOTIFY, UPDATE_SA_ADDRESSES}, {NOTIFY, NAT_DETECTION_SOURCE_IP}, @@ -324,7 +275,7 @@ static payload_order_t informational_i_payload_order[] = { /** * Message rule for INFORMATIONAL from responder. */ -static payload_rule_t informational_r_payload_rules[] = { +static payload_rule_t informational_r_rules[] = { /* payload type min max encr suff */ {NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE}, {CONFIGURATION, 0, 1, TRUE, FALSE}, @@ -335,7 +286,7 @@ static payload_rule_t informational_r_payload_rules[] = { /** * payload order for INFORMATIONAL responder */ -static payload_order_t informational_r_payload_order[] = { +static payload_order_t informational_r_order[] = { /* payload type notify type */ {NOTIFY, UPDATE_SA_ADDRESSES}, {NOTIFY, NAT_DETECTION_SOURCE_IP}, @@ -349,7 +300,7 @@ static payload_order_t informational_r_payload_order[] = { /** * Message rule for CREATE_CHILD_SA from initiator. */ -static payload_rule_t create_child_sa_i_payload_rules[] = { +static payload_rule_t create_child_sa_i_rules[] = { /* payload type min max encr suff */ {NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE}, {SECURITY_ASSOCIATION, 1, 1, TRUE, FALSE}, @@ -364,7 +315,7 @@ static payload_rule_t create_child_sa_i_payload_rules[] = { /** * payload order for CREATE_CHILD_SA from initiator. */ -static payload_order_t create_child_sa_i_payload_order[] = { +static payload_order_t create_child_sa_i_order[] = { /* payload type notify type */ {NOTIFY, REKEY_SA}, {NOTIFY, IPCOMP_SUPPORTED}, @@ -382,7 +333,7 @@ static payload_order_t create_child_sa_i_payload_order[] = { /** * Message rule for CREATE_CHILD_SA from responder. */ -static payload_rule_t create_child_sa_r_payload_rules[] = { +static payload_rule_t create_child_sa_r_rules[] = { /* payload type min max encr suff */ {NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE}, {SECURITY_ASSOCIATION, 1, 1, TRUE, FALSE}, @@ -397,7 +348,7 @@ static payload_rule_t create_child_sa_r_payload_rules[] = { /** * payload order for CREATE_CHILD_SA from responder. */ -static payload_order_t create_child_sa_r_payload_order[] = { +static payload_order_t create_child_sa_r_order[] = { /* payload type notify type */ {NOTIFY, IPCOMP_SUPPORTED}, {NOTIFY, USE_TRANSPORT_MODE}, @@ -416,7 +367,7 @@ static payload_order_t create_child_sa_r_payload_order[] = { /** * Message rule for ME_CONNECT from initiator. */ -static payload_rule_t me_connect_i_payload_rules[] = { +static payload_rule_t me_connect_i_rules[] = { /* payload type min max encr suff */ {NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE}, {ID_PEER, 1, 1, TRUE, FALSE}, @@ -426,7 +377,7 @@ static payload_rule_t me_connect_i_payload_rules[] = { /** * payload order for ME_CONNECT from initiator. */ -static payload_order_t me_connect_i_payload_order[] = { +static payload_order_t me_connect_i_order[] = { /* payload type notify type */ {NOTIFY, 0}, {ID_PEER, 0}, @@ -436,7 +387,7 @@ static payload_order_t me_connect_i_payload_order[] = { /** * Message rule for ME_CONNECT from responder. */ -static payload_rule_t me_connect_r_payload_rules[] = { +static payload_rule_t me_connect_r_rules[] = { /* payload type min max encr suff */ {NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE}, {VENDOR_ID, 0, 10, TRUE, FALSE} @@ -445,7 +396,7 @@ static payload_rule_t me_connect_r_payload_rules[] = { /** * payload order for ME_CONNECT from responder. */ -static payload_order_t me_connect_r_payload_order[] = { +static payload_order_t me_connect_r_order[] = { /* payload type notify type */ {NOTIFY, 0}, {VENDOR_ID, 0}, @@ -457,65 +408,45 @@ static payload_order_t me_connect_r_payload_order[] = { */ static message_rule_t message_rules[] = { {IKE_SA_INIT, TRUE, FALSE, - (sizeof(ike_sa_init_i_payload_rules)/sizeof(payload_rule_t)), - ike_sa_init_i_payload_rules, - (sizeof(ike_sa_init_i_payload_order)/sizeof(payload_order_t)), - ike_sa_init_i_payload_order, + countof(ike_sa_init_i_rules), ike_sa_init_i_rules, + countof(ike_sa_init_i_order), ike_sa_init_i_order, }, {IKE_SA_INIT, FALSE, FALSE, - (sizeof(ike_sa_init_r_payload_rules)/sizeof(payload_rule_t)), - ike_sa_init_r_payload_rules, - (sizeof(ike_sa_init_r_payload_order)/sizeof(payload_order_t)), - ike_sa_init_r_payload_order, + countof(ike_sa_init_r_rules), ike_sa_init_r_rules, + countof(ike_sa_init_r_order), ike_sa_init_r_order, }, {IKE_AUTH, TRUE, TRUE, - (sizeof(ike_auth_i_payload_rules)/sizeof(payload_rule_t)), - ike_auth_i_payload_rules, - (sizeof(ike_auth_i_payload_order)/sizeof(payload_order_t)), - ike_auth_i_payload_order, + countof(ike_auth_i_rules), ike_auth_i_rules, + countof(ike_auth_i_order), ike_auth_i_order, }, {IKE_AUTH, FALSE, TRUE, - (sizeof(ike_auth_r_payload_rules)/sizeof(payload_rule_t)), - ike_auth_r_payload_rules, - (sizeof(ike_auth_r_payload_order)/sizeof(payload_order_t)), - ike_auth_r_payload_order, + countof(ike_auth_r_rules), ike_auth_r_rules, + countof(ike_auth_r_order), ike_auth_r_order, }, {INFORMATIONAL, TRUE, TRUE, - (sizeof(informational_i_payload_rules)/sizeof(payload_rule_t)), - informational_i_payload_rules, - (sizeof(informational_i_payload_order)/sizeof(payload_order_t)), - informational_i_payload_order, + countof(informational_i_rules), informational_i_rules, + countof(informational_i_order), informational_i_order, }, {INFORMATIONAL, FALSE, TRUE, - (sizeof(informational_r_payload_rules)/sizeof(payload_rule_t)), - informational_r_payload_rules, - (sizeof(informational_r_payload_order)/sizeof(payload_order_t)), - informational_r_payload_order, + countof(informational_r_rules), informational_r_rules, + countof(informational_r_order), informational_r_order, }, {CREATE_CHILD_SA, TRUE, TRUE, - (sizeof(create_child_sa_i_payload_rules)/sizeof(payload_rule_t)), - create_child_sa_i_payload_rules, - (sizeof(create_child_sa_i_payload_order)/sizeof(payload_order_t)), - create_child_sa_i_payload_order, + countof(create_child_sa_i_rules), create_child_sa_i_rules, + countof(create_child_sa_i_order), create_child_sa_i_order, }, {CREATE_CHILD_SA, FALSE, TRUE, - (sizeof(create_child_sa_r_payload_rules)/sizeof(payload_rule_t)), - create_child_sa_r_payload_rules, - (sizeof(create_child_sa_r_payload_order)/sizeof(payload_order_t)), - create_child_sa_r_payload_order, + countof(create_child_sa_r_rules), create_child_sa_r_rules, + countof(create_child_sa_r_order), create_child_sa_r_order, }, #ifdef ME {ME_CONNECT, TRUE, TRUE, - (sizeof(me_connect_i_payload_rules)/sizeof(payload_rule_t)), - me_connect_i_payload_rules, - (sizeof(me_connect_i_payload_order)/sizeof(payload_order_t)), - me_connect_i_payload_order, + countof(me_connect_i_rules), me_connect_i_rules, + countof(me_connect_i_order), me_connect_i_order, }, {ME_CONNECT, FALSE, TRUE, - (sizeof(me_connect_r_payload_rules)/sizeof(payload_rule_t)), - me_connect_r_payload_rules, - (sizeof(me_connect_r_payload_order)/sizeof(payload_order_t)), - me_connect_r_payload_order, + countof(me_connect_r_rules), me_connect_r_rules, + countof(me_connect_r_order), me_connect_r_order, }, #endif /* ME */ }; @@ -586,169 +517,132 @@ struct private_message_t { /** * The message rule for this message instance */ - message_rule_t *message_rule; + message_rule_t *rule; }; /** - * Implementation of private_message_t.set_message_rule. + * Get the message rule that applies to this message */ -static status_t set_message_rule(private_message_t *this) +static message_rule_t* get_message_rule(private_message_t *this) { int i; - for (i = 0; i < (sizeof(message_rules) / sizeof(message_rule_t)); i++) + for (i = 0; i < countof(message_rules); i++) { if ((this->exchange_type == message_rules[i].exchange_type) && (this->is_request == message_rules[i].is_request)) { - /* found rule for given exchange_type*/ - this->message_rule = &(message_rules[i]); - return SUCCESS; + return &message_rules[i]; } } - this->message_rule = NULL; - return NOT_FOUND; + return NULL; } /** - * Implementation of private_message_t.get_payload_rule. + * Look up a payload rule */ -static status_t get_payload_rule(private_message_t *this, - payload_type_t payload_type, payload_rule_t **payload_rule) +static payload_rule_t* get_payload_rule(private_message_t *this, + payload_type_t type) { int i; - for (i = 0; i < this->message_rule->payload_rule_count;i++) + for (i = 0; i < this->rule->rule_count;i++) { - if (this->message_rule->payload_rules[i].payload_type == payload_type) + if (this->rule->rules[i].type == type) { - *payload_rule = &(this->message_rule->payload_rules[i]); - return SUCCESS; + return &this->rule->rules[i]; } } - - *payload_rule = NULL; - return NOT_FOUND; + return NULL; } -/** - * Implementation of message_t.set_ike_sa_id. - */ -static void set_ike_sa_id(private_message_t *this,ike_sa_id_t *ike_sa_id) +METHOD(message_t, set_ike_sa_id, void, + private_message_t *this,ike_sa_id_t *ike_sa_id) { DESTROY_IF(this->ike_sa_id); this->ike_sa_id = ike_sa_id->clone(ike_sa_id); } -/** - * Implementation of message_t.get_ike_sa_id. - */ -static ike_sa_id_t* get_ike_sa_id(private_message_t *this) +METHOD(message_t, get_ike_sa_id, ike_sa_id_t*, + private_message_t *this) { return this->ike_sa_id; } -/** - * Implementation of message_t.set_message_id. - */ -static void set_message_id(private_message_t *this,u_int32_t message_id) +METHOD(message_t, set_message_id, void, + private_message_t *this,u_int32_t message_id) { this->message_id = message_id; } -/** - * Implementation of message_t.get_message_id. - */ -static u_int32_t get_message_id(private_message_t *this) +METHOD(message_t, get_message_id, u_int32_t, + private_message_t *this) { return this->message_id; } -/** - * Implementation of message_t.get_initiator_spi. - */ -static u_int64_t get_initiator_spi(private_message_t *this) +METHOD(message_t, get_initiator_spi, u_int64_t, + private_message_t *this) { return (this->ike_sa_id->get_initiator_spi(this->ike_sa_id)); } -/** - * Implementation of message_t.get_responder_spi. - */ -static u_int64_t get_responder_spi(private_message_t *this) +METHOD(message_t, get_responder_spi, u_int64_t, + private_message_t *this) { return (this->ike_sa_id->get_responder_spi(this->ike_sa_id)); } -/** - * Implementation of message_t.set_major_version. - */ -static void set_major_version(private_message_t *this,u_int8_t major_version) +METHOD(message_t, set_major_version, void, + private_message_t *this, u_int8_t major_version) { this->major_version = major_version; } -/** - * Implementation of message_t.set_major_version. - */ -static u_int8_t get_major_version(private_message_t *this) +METHOD(message_t, get_major_version, u_int8_t, + private_message_t *this) { return this->major_version; } -/** - * Implementation of message_t.set_minor_version. - */ -static void set_minor_version(private_message_t *this,u_int8_t minor_version) +METHOD(message_t, set_minor_version, void, + private_message_t *this,u_int8_t minor_version) { this->minor_version = minor_version; } -/** - * Implementation of message_t.get_minor_version. - */ -static u_int8_t get_minor_version(private_message_t *this) +METHOD(message_t, get_minor_version, u_int8_t, + private_message_t *this) { return this->minor_version; } -/** - * Implementation of message_t.set_exchange_type. - */ -static void set_exchange_type(private_message_t *this, - exchange_type_t exchange_type) +METHOD(message_t, set_exchange_type, void, + private_message_t *this, exchange_type_t exchange_type) { this->exchange_type = exchange_type; } -/** - * Implementation of message_t.get_exchange_type. - */ -static exchange_type_t get_exchange_type(private_message_t *this) +METHOD(message_t, get_exchange_type, exchange_type_t, + private_message_t *this) { return this->exchange_type; } -/** - * Implementation of message_t.get_first_payload_type. - */ -static payload_type_t get_first_payload_type(private_message_t *this) +METHOD(message_t, get_first_payload_type, payload_type_t, + private_message_t *this) { return this->first_payload; } -/** - * Implementation of message_t.set_request. - */ -static void set_request(private_message_t *this, bool request) +METHOD(message_t, set_request, void, + private_message_t *this, bool request) { this->is_request = request; } -/** - * Implementation of message_t.get_request. - */ -static exchange_type_t get_request(private_message_t *this) +METHOD(message_t, get_request, bool, + private_message_t *this) { return this->is_request; } @@ -767,10 +661,8 @@ static bool is_encoded(private_message_t *this) return TRUE; } -/** - * Implementation of message_t.add_payload. - */ -static void add_payload(private_message_t *this, payload_t *payload) +METHOD(message_t, add_payload, void, + private_message_t *this, payload_t *payload) { payload_t *last_payload; @@ -790,11 +682,8 @@ static void add_payload(private_message_t *this, payload_t *payload) payload_type_names, payload->get_type(payload)); } -/** - * Implementation of message_t.add_notify. - */ -static void add_notify(private_message_t *this, bool flush, notify_type_t type, - chunk_t data) +METHOD(message_t, add_notify, void, + private_message_t *this, bool flush, notify_type_t type, chunk_t data) { notify_payload_t *notify; payload_t *payload; @@ -813,50 +702,38 @@ static void add_notify(private_message_t *this, bool flush, notify_type_t type, add_payload(this, (payload_t*)notify); } -/** - * Implementation of message_t.set_source. - */ -static void set_source(private_message_t *this, host_t *host) +METHOD(message_t, set_source, void, + private_message_t *this, host_t *host) { this->packet->set_source(this->packet, host); } -/** - * Implementation of message_t.set_destination. - */ -static void set_destination(private_message_t *this, host_t *host) +METHOD(message_t, set_destination, void, + private_message_t *this, host_t *host) { this->packet->set_destination(this->packet, host); } -/** - * Implementation of message_t.get_source. - */ -static host_t* get_source(private_message_t *this) +METHOD(message_t, get_source, host_t*, + private_message_t *this) { return this->packet->get_source(this->packet); } -/** - * Implementation of message_t.get_destination. - */ -static host_t * get_destination(private_message_t *this) +METHOD(message_t, get_destination, host_t*, + private_message_t *this) { return this->packet->get_destination(this->packet); } -/** - * Implementation of message_t.create_payload_enumerator. - */ -static enumerator_t *create_payload_enumerator(private_message_t *this) +METHOD(message_t, create_payload_enumerator, enumerator_t*, + private_message_t *this) { return this->payloads->create_enumerator(this->payloads); } -/** - * Implementation of message_t.get_payload. - */ -static payload_t *get_payload(private_message_t *this, payload_type_t type) +METHOD(message_t, get_payload, payload_t*, + private_message_t *this, payload_type_t type) { payload_t *current, *found = NULL; enumerator_t *enumerator; @@ -874,10 +751,8 @@ static payload_t *get_payload(private_message_t *this, payload_type_t type) return found; } -/** - * Implementation of message_t.get_notify - */ -static notify_payload_t* get_notify(private_message_t *this, notify_type_t type) +METHOD(message_t, get_notify, notify_payload_t*, + private_message_t *this, notify_type_t type) { enumerator_t *enumerator; notify_payload_t *notify = NULL; @@ -1034,11 +909,13 @@ static void order_payloads(private_message_t *this) list->insert_first(list, payload); } /* for each rule, ... */ - for (i = 0; i < this->message_rule->payload_order_count; i++) + for (i = 0; i < this->rule->order_count; i++) { enumerator_t *enumerator; notify_payload_t *notify; - payload_order_t order = this->message_rule->payload_order[i]; + payload_order_t order; + + order = this->rule->order[i]; /* ... find all payload ... */ enumerator = list->create_enumerator(list); @@ -1068,8 +945,8 @@ static void order_payloads(private_message_t *this) { DBG1(DBG_ENC, "payload %N has no ordering rule in %N %s", payload_type_names, payload->get_type(payload), - exchange_type_names, this->message_rule->exchange_type, - this->message_rule->is_request ? "request" : "response"); + exchange_type_names, this->rule->exchange_type, + this->rule->is_request ? "request" : "response"); } add_payload(this, payload); } @@ -1077,98 +954,67 @@ static void order_payloads(private_message_t *this) } /** - * Implementation of private_message_t.encrypt_payloads. + * Wrap payloads in a encryption payload */ -static status_t encrypt_payloads(private_message_t *this, - crypter_t *crypter, signer_t* signer) +static encryption_payload_t* wrap_payloads(private_message_t *this) { encryption_payload_t *encryption; linked_list_t *payloads; payload_t *current; - status_t status; - if (!this->message_rule->encrypted_content) - { - DBG2(DBG_ENC, "message doesn't have to be encrypted"); - /* message contains no content to encrypt */ - return SUCCESS; - } - - if (!crypter || !signer) - { - DBG2(DBG_ENC, "no crypter or signer specified, do not encrypt message"); - /* message contains no content to encrypt */ - return SUCCESS; - } - - DBG2(DBG_ENC, "copy all payloads to a temporary list"); + /* copy all payloads in a temporary list */ payloads = linked_list_create(); - - /* first copy all payloads in a temporary list */ - while (this->payloads->get_count(this->payloads) > 0) + while (this->payloads->remove_first(this->payloads, + (void**)¤t) == SUCCESS) { - this->payloads->remove_first(this->payloads, (void**)¤t); payloads->insert_last(payloads, current); } encryption = encryption_payload_create(); - - DBG2(DBG_ENC, "check each payloads if they have to get encrypted"); - while (payloads->get_count(payloads) > 0) + while (payloads->remove_first(payloads, (void**)¤t) == SUCCESS) { payload_rule_t *rule; payload_type_t type; - bool to_encrypt = TRUE; - - payloads->remove_first(payloads, (void**)¤t); + bool encrypt = TRUE; type = current->get_type(current); - if (get_payload_rule(this, type, &rule) == SUCCESS) + rule = get_payload_rule(this, type); + if (rule) { - to_encrypt = rule->encrypted; + encrypt = rule->encrypted; } - if (to_encrypt) + if (encrypt) { DBG2(DBG_ENC, "insert payload %N to encryption payload", - payload_type_names, current->get_type(current)); + payload_type_names, type); encryption->add_payload(encryption, current); } else { DBG2(DBG_ENC, "insert payload %N unencrypted", - payload_type_names, current->get_type(current)); - add_payload(this, (payload_t*)current); + payload_type_names, type); + add_payload(this, current); } } - - DBG2(DBG_ENC, "encrypting encryption payload"); - encryption->set_transforms(encryption, crypter, signer); - status = encryption->encrypt(encryption); - DBG2(DBG_ENC, "add encrypted payload to payload list"); - add_payload(this, (payload_t*)encryption); - payloads->destroy(payloads); - return status; + return encryption; } -/** - * Implementation of message_t.generate. - */ -static status_t generate(private_message_t *this, crypter_t *crypter, - signer_t* signer, packet_t **packet) +METHOD(message_t, generate, status_t, + private_message_t *this, aead_t *aead, packet_t **packet) { generator_t *generator; ike_header_t *ike_header; - payload_t *payload, *next_payload; + payload_t *payload, *next; + encryption_payload_t *encryption = NULL; enumerator_t *enumerator; - status_t status; - chunk_t packet_data; + chunk_t chunk; char str[256]; + u_int32_t *lenpos; if (is_encoded(this)) - { - /* already generated, return a new packet clone */ + { /* already generated, return a new packet clone */ *packet = this->packet->clone(this->packet); return SUCCESS; } @@ -1182,14 +1028,12 @@ static status_t generate(private_message_t *this, crypter_t *crypter, if (this->packet->get_source(this->packet) == NULL || this->packet->get_destination(this->packet) == NULL) { - DBG1(DBG_ENC, "%s not defined", - !this->packet->get_source(this->packet) ? "source" : "destination"); + DBG1(DBG_ENC, "source/destination not defined"); return INVALID_STATE; } - /* set the rules for this messge */ - status = set_message_rule(this); - if (status != SUCCESS) + this->rule = get_message_rule(this); + if (!this->rule) { DBG1(DBG_ENC, "no message rules specified for this message type"); return NOT_SUPPORTED; @@ -1199,17 +1043,16 @@ static status_t generate(private_message_t *this, crypter_t *crypter, DBG1(DBG_ENC, "generating %s", get_string(this, str, sizeof(str))); - /* going to encrypt all content which have to be encrypted */ - status = encrypt_payloads(this, crypter, signer); - if (status != SUCCESS) + if (aead && this->rule->encrypted) { - DBG1(DBG_ENC, "payload encryption failed"); - return status; + encryption = wrap_payloads(this); + } + else + { + DBG2(DBG_ENC, "not encrypting payloads"); } - /* build ike header */ ike_header = ike_header_create(); - ike_header->set_exchange_type(ike_header, this->exchange_type); ike_header->set_message_id(ike_header, this->message_id); ike_header->set_response_flag(ike_header, !this->is_request); @@ -1222,54 +1065,49 @@ static status_t generate(private_message_t *this, crypter_t *crypter, generator = generator_create(); + /* generate all payloads with proper next type */ payload = (payload_t*)ike_header; - - /* generate every payload expect last one, this is done later*/ enumerator = create_payload_enumerator(this); - while (enumerator->enumerate(enumerator, &next_payload)) + while (enumerator->enumerate(enumerator, &next)) { - payload->set_next_type(payload, next_payload->get_type(next_payload)); + payload->set_next_type(payload, next->get_type(next)); generator->generate_payload(generator, payload); - payload = next_payload; + payload = next; } enumerator->destroy(enumerator); - - /* last payload has no next payload*/ - payload->set_next_type(payload, NO_PAYLOAD); - + payload->set_next_type(payload, encryption ? ENCRYPTED : NO_PAYLOAD); generator->generate_payload(generator, payload); - ike_header->destroy(ike_header); - /* build packet */ - generator->write_to_chunk(generator, &packet_data); - generator->destroy(generator); - - /* if last payload is of type encrypted, integrity checksum if necessary */ - if (payload->get_type(payload) == ENCRYPTED) + if (encryption) { - DBG2(DBG_ENC, "build signature on whole message"); - encryption_payload_t *encryption_payload = (encryption_payload_t*)payload; - status = encryption_payload->build_signature(encryption_payload, packet_data); - if (status != SUCCESS) + u_int32_t *lenpos; + + /* build associated data (without header of encryption payload) */ + chunk = generator->get_chunk(generator, &lenpos); + encryption->set_transform(encryption, aead); + /* fill in length, including encryption payload */ + htoun32(lenpos, chunk.len + encryption->get_length(encryption)); + + this->payloads->insert_last(this->payloads, encryption); + if (!encryption->encrypt(encryption, chunk)) { - return status; + generator->destroy(generator); + return INVALID_STATE; } + generator->generate_payload(generator, &encryption->payload_interface); } + chunk = generator->get_chunk(generator, &lenpos); + htoun32(lenpos, chunk.len); + this->packet->set_data(this->packet, chunk_clone(chunk)); + generator->destroy(generator); - this->packet->set_data(this->packet, packet_data); - - /* clone packet for caller */ *packet = this->packet->clone(this->packet); - - DBG2(DBG_ENC, "message generated successfully"); return SUCCESS; } -/** - * Implementation of message_t.get_packet. - */ -static packet_t *get_packet(private_message_t *this) +METHOD(message_t, get_packet, packet_t*, + private_message_t *this) { if (this->packet == NULL) { @@ -1278,10 +1116,8 @@ static packet_t *get_packet(private_message_t *this) return this->packet->clone(this->packet); } -/** - * Implementation of message_t.get_packet_data. - */ -static chunk_t get_packet_data(private_message_t *this) +METHOD(message_t, get_packet_data, chunk_t, + private_message_t *this) { if (this->packet == NULL) { @@ -1290,10 +1126,8 @@ static chunk_t get_packet_data(private_message_t *this) return chunk_clone(this->packet->get_data(this->packet)); } -/** - * Implementation of message_t.parse_header. - */ -static status_t parse_header(private_message_t *this) +METHOD(message_t, parse_header, status_t, + private_message_t *this) { ike_header_t *ike_header; status_t status; @@ -1310,7 +1144,6 @@ static status_t parse_header(private_message_t *this) } - /* verify payload */ status = ike_header->payload_interface.verify( &ike_header->payload_interface); if (status != SUCCESS) @@ -1320,18 +1153,14 @@ static status_t parse_header(private_message_t *this) return status; } - if (this->ike_sa_id != NULL) - { - this->ike_sa_id->destroy(this->ike_sa_id); - } - + DESTROY_IF(this->ike_sa_id); this->ike_sa_id = ike_sa_id_create(ike_header->get_initiator_spi(ike_header), ike_header->get_responder_spi(ike_header), ike_header->get_initiator_flag(ike_header)); this->exchange_type = ike_header->get_exchange_type(ike_header); this->message_id = ike_header->get_message_id(ike_header); - this->is_request = (!(ike_header->get_response_flag(ike_header))); + this->is_request = !ike_header->get_response_flag(ike_header); this->major_version = ike_header->get_maj_version(ike_header); this->minor_version = ike_header->get_min_version(ike_header); this->first_payload = ike_header->payload_interface.get_next_type( @@ -1342,232 +1171,151 @@ static status_t parse_header(private_message_t *this) ike_header->destroy(ike_header); - /* get the rules for this messge */ - status = set_message_rule(this); - if (status != SUCCESS) + this->rule = get_message_rule(this); + if (!this->rule) { DBG1(DBG_ENC, "no message rules specified for a %N %s", exchange_type_names, this->exchange_type, this->is_request ? "request" : "response"); } - return status; } /** - * Implementation of private_message_t.decrypt_and_verify_payloads. + * Decrypt payload from the encryption payload */ -static status_t decrypt_payloads(private_message_t *this, crypter_t *crypter, - signer_t* signer) +static status_t decrypt_payloads(private_message_t *this, aead_t *aead) { - bool current_payload_was_encrypted = FALSE; - payload_t *previous_payload = NULL; - int payload_number = 1; - iterator_t *iterator; - payload_t *current_payload; - status_t status; - - iterator = this->payloads->create_iterator(this->payloads,TRUE); + bool was_encrypted = FALSE; + payload_t *payload, *previous = NULL; + enumerator_t *enumerator; + payload_rule_t *rule; + payload_type_t type; + status_t status = SUCCESS; - /* process each payload and decrypt a encryption payload */ - while(iterator->iterate(iterator, (void**)¤t_payload)) + enumerator = this->payloads->create_enumerator(this->payloads); + while (enumerator->enumerate(enumerator, &payload)) { - payload_rule_t *payload_rule; - payload_type_t current_payload_type; + type = payload->get_type(payload); - /* needed to check */ - current_payload_type = current_payload->get_type(current_payload); + DBG2(DBG_ENC, "process payload of type %N", payload_type_names, type); - DBG2(DBG_ENC, "process payload of type %N", - payload_type_names, current_payload_type); - - if (current_payload_type == ENCRYPTED) + if (type == ENCRYPTED) { - encryption_payload_t *encryption_payload; - payload_t *current_encrypted_payload; + encryption_payload_t *encryption; + payload_t *encrypted; + chunk_t chunk; - encryption_payload = (encryption_payload_t*)current_payload; + encryption = (encryption_payload_t*)payload; DBG2(DBG_ENC, "found an encryption payload"); - if (payload_number != this->payloads->get_count(this->payloads)) + if (enumerator->enumerate(enumerator, &payload)) { - /* encrypted payload is not last one */ DBG1(DBG_ENC, "encrypted payload is not last payload"); - iterator->destroy(iterator); - return VERIFY_ERROR; + status = VERIFY_ERROR; + break; } - /* decrypt */ - encryption_payload->set_transforms(encryption_payload, - crypter, signer); - DBG2(DBG_ENC, "verify signature of encryption payload"); - status = encryption_payload->verify_signature(encryption_payload, - this->packet->get_data(this->packet)); - if (status != SUCCESS) + encryption->set_transform(encryption, aead); + chunk = this->packet->get_data(this->packet); + if (chunk.len < encryption->get_length(encryption)) { - DBG1(DBG_ENC, "encryption payload signature invalid"); - iterator->destroy(iterator); - return FAILED; + DBG1(DBG_ENC, "invalid payload length"); + status = VERIFY_ERROR; + break; } - DBG2(DBG_ENC, "decrypting content of encryption payload"); - status = encryption_payload->decrypt(encryption_payload); + chunk.len -= encryption->get_length(encryption); + status = encryption->decrypt(encryption, chunk); if (status != SUCCESS) { - DBG1(DBG_ENC, "encrypted payload could not be decrypted and parsed"); - iterator->destroy(iterator); - return PARSE_ERROR; - } - - /* needed later to find out if a payload was encrypted */ - current_payload_was_encrypted = TRUE; - - /* check if there are payloads contained in the encryption payload */ - if (encryption_payload->get_payload_count(encryption_payload) == 0) - { - DBG2(DBG_ENC, "encrypted payload is empty"); - /* remove the encryption payload, is not needed anymore */ - iterator->remove(iterator); - /* encrypted payload contains no other payload */ - current_payload_type = NO_PAYLOAD; - } - else - { - /* encryption_payload is replaced with first payload contained - * in encryption_payload */ - encryption_payload->remove_first_payload(encryption_payload, - ¤t_encrypted_payload); - iterator->replace(iterator, NULL, - (void *)current_encrypted_payload); - current_payload_type = current_encrypted_payload->get_type( - current_encrypted_payload); + break; } - /* is the current paylad the first in the message? */ - if (previous_payload == NULL) - { - /* yes, set the first payload type of the message to the - * current type */ - this->first_payload = current_payload_type; - } - else - { - /* no, set the next_type of the previous payload to the - * current type */ - previous_payload->set_next_type(previous_payload, - current_payload_type); - } + was_encrypted = TRUE; + this->payloads->remove_at(this->payloads, enumerator); - /* all encrypted payloads are added to the payload list */ - while (encryption_payload->get_payload_count(encryption_payload) > 0) + while ((encrypted = encryption->remove_payload(encryption))) { - encryption_payload->remove_first_payload(encryption_payload, - ¤t_encrypted_payload); - DBG2(DBG_ENC, "insert unencrypted payload of type " - "%N at end of list", payload_type_names, - current_encrypted_payload->get_type( - current_encrypted_payload)); - this->payloads->insert_last(this->payloads, - current_encrypted_payload); + type = encrypted->get_type(encrypted); + if (previous) + { + previous->set_next_type(previous, type); + } + else + { + this->first_payload = type; + } + DBG2(DBG_ENC, "insert decrypted payload of type " + "%N at end of list", payload_type_names, type); + this->payloads->insert_last(this->payloads, encrypted); + previous = encrypted; } - - /* encryption payload is processed, payloads are moved. Destroy it. */ - encryption_payload->destroy(encryption_payload); + encryption->destroy(encryption); } - - /* we allow unknown payloads of any type and don't bother if it was - * encrypted. Not our problem. */ - if (current_payload_type != UNKNOWN_PAYLOAD && - current_payload_type != NO_PAYLOAD) + if (type != UNKNOWN_PAYLOAD && !was_encrypted) { - /* get the ruleset for found payload */ - status = get_payload_rule(this, current_payload_type, &payload_rule); - if (status != SUCCESS) - { - /* payload is not allowed */ - DBG1(DBG_ENC, "payload type %N not allowed", - payload_type_names, current_payload_type); - iterator->destroy(iterator); - return VERIFY_ERROR; - } - - /* check if the payload was encrypted, and if it should been have - * encrypted */ - if (payload_rule->encrypted != current_payload_was_encrypted) + rule = get_payload_rule(this, type); + if (!rule || rule->encrypted) { - /* payload was not encrypted, but should have been. - * or vice-versa */ - DBG1(DBG_ENC, "payload type %N should be %s!", - payload_type_names, current_payload_type, - (payload_rule->encrypted) ? "encrypted" : "not encrypted"); - iterator->destroy(iterator); - return VERIFY_ERROR; + DBG1(DBG_ENC, "payload type %N was not encrypted", + payload_type_names, type); + status = VERIFY_ERROR; + break; } } - /* advance to the next payload */ - payload_number++; - /* is stored to set next payload in case of found encryption payload */ - previous_payload = current_payload; + previous = payload; } - iterator->destroy(iterator); - return SUCCESS; + enumerator->destroy(enumerator); + return status; } /** - * Implementation of private_message_t.verify. + * Verify a message and all payload according to message/payload rules */ static status_t verify(private_message_t *this) { int i; - enumerator_t *enumerator; - payload_t *current_payload; - size_t total_found_payloads = 0; DBG2(DBG_ENC, "verifying message structure"); /* check for payloads with wrong count*/ - for (i = 0; i < this->message_rule->payload_rule_count; i++) + for (i = 0; i < this->rule->rule_count; i++) { - size_t found_payloads = 0; + enumerator_t *enumerator; + payload_t *payload; payload_rule_t *rule; + int found = 0; - rule = &this->message_rule->payload_rules[i]; + rule = &this->rule->rules[i]; enumerator = create_payload_enumerator(this); - - /* check all payloads for specific rule */ - while (enumerator->enumerate(enumerator, ¤t_payload)) + while (enumerator->enumerate(enumerator, &payload)) { - payload_type_t current_payload_type; - unknown_payload_t *unknown_payload; + payload_type_t type; + unknown_payload_t *unknown; - current_payload_type = current_payload->get_type(current_payload); - if (current_payload_type == UNKNOWN_PAYLOAD) + type = payload->get_type(payload); + if (type == UNKNOWN_PAYLOAD) { - /* unknown payloads are ignored, IF they are not critical */ - unknown_payload = (unknown_payload_t*)current_payload; - if (unknown_payload->is_critical(unknown_payload)) + /* unknown payloads are ignored if they are not critical */ + unknown = (unknown_payload_t*)payload; + if (unknown->is_critical(unknown)) { DBG1(DBG_ENC, "%N is not supported, but its critical!", - payload_type_names, current_payload_type); + payload_type_names, type); enumerator->destroy(enumerator); return NOT_SUPPORTED; } } - else if (current_payload_type == rule->payload_type) + else if (type == rule->type) { - found_payloads++; - total_found_payloads++; - DBG2(DBG_ENC, "found payload of type %N", payload_type_names, - rule->payload_type); - - /* as soon as ohe payload occures more then specified, - * the verification fails */ - if (found_payloads > - rule->max_occurence) + found++; + DBG2(DBG_ENC, "found payload of type %N", + payload_type_names, type); + if (found > rule->max_occurence) { DBG1(DBG_ENC, "payload of type %N more than %d times (%d) " "occured in current message", payload_type_names, - current_payload_type, rule->max_occurence, - found_payloads); + type, rule->max_occurence, found); enumerator->destroy(enumerator); return VERIFY_ERROR; } @@ -1575,11 +1323,10 @@ static status_t verify(private_message_t *this) } enumerator->destroy(enumerator); - if (found_payloads < rule->min_occurence) + if (found < rule->min_occurence) { DBG1(DBG_ENC, "payload of type %N not occured %d times (%d)", - payload_type_names, rule->payload_type, rule->min_occurence, - found_payloads); + payload_type_names, rule->type, rule->min_occurence, found); return VERIFY_ERROR; } if (rule->sufficient) @@ -1590,72 +1337,60 @@ static status_t verify(private_message_t *this) return SUCCESS; } -/** - * Implementation of message_t.parse_body. - */ -static status_t parse_body(private_message_t *this, crypter_t *crypter, - signer_t *signer) +METHOD(message_t, parse_body, status_t, + private_message_t *this, aead_t *aead) { status_t status = SUCCESS; - payload_type_t current_payload_type; + payload_t *payload; + payload_type_t type; char str[256]; - current_payload_type = this->first_payload; + type = this->first_payload; DBG2(DBG_ENC, "parsing body of message, first payload is %N", - payload_type_names, current_payload_type); + payload_type_names, type); - /* parse payload for payload, while there are more available */ - while ((current_payload_type != NO_PAYLOAD)) + while (type != NO_PAYLOAD) { - payload_t *current_payload; - DBG2(DBG_ENC, "starting parsing a %N payload", - payload_type_names, current_payload_type); + payload_type_names, type); - /* parse current payload */ - status = this->parser->parse_payload(this->parser, current_payload_type, - (payload_t**)¤t_payload); + status = this->parser->parse_payload(this->parser, type, &payload); if (status != SUCCESS) { DBG1(DBG_ENC, "payload type %N could not be parsed", - payload_type_names, current_payload_type); + payload_type_names, type); return PARSE_ERROR; } - DBG2(DBG_ENC, "verifying payload of type %N", - payload_type_names, current_payload_type); - - /* verify it, stop parsig if its invalid */ - status = current_payload->verify(current_payload); + DBG2(DBG_ENC, "verifying payload of type %N", payload_type_names, type); + status = payload->verify(payload); if (status != SUCCESS) { DBG1(DBG_ENC, "%N payload verification failed", - payload_type_names, current_payload_type); - current_payload->destroy(current_payload); + payload_type_names, type); + payload->destroy(payload); return VERIFY_ERROR; } DBG2(DBG_ENC, "%N payload verified. Adding to payload list", - payload_type_names, current_payload_type); - this->payloads->insert_last(this->payloads,current_payload); + payload_type_names, type); + this->payloads->insert_last(this->payloads, payload); /* an encryption payload is the last one, so STOP here. decryption is * done later */ - if (current_payload_type == ENCRYPTED) + if (type == ENCRYPTED) { DBG2(DBG_ENC, "%N payload found. Stop parsing", - payload_type_names, current_payload_type); + payload_type_names, type); break; } - - /* get next payload type */ - current_payload_type = current_payload->get_next_type(current_payload); + type = payload->get_next_type(payload); } - if (current_payload_type == ENCRYPTED) + if (type == ENCRYPTED) { - status = decrypt_payloads(this,crypter,signer); + status = decrypt_payloads(this, aead); if (status != SUCCESS) { DBG1(DBG_ENC, "could not decrypt payloads"); @@ -1674,10 +1409,8 @@ static status_t parse_body(private_message_t *this, crypter_t *crypter, return SUCCESS; } -/** - * Implementation of message_t.destroy. - */ -static void destroy (private_message_t *this) +METHOD(message_t, destroy, void, + private_message_t *this) { DESTROY_IF(this->ike_sa_id); this->payloads->destroy_offset(this->payloads, offsetof(payload_t, destroy)); @@ -1691,58 +1424,48 @@ static void destroy (private_message_t *this) */ message_t *message_create_from_packet(packet_t *packet) { - private_message_t *this = malloc_thing(private_message_t); - - /* public functions */ - this->public.set_major_version = (void(*)(message_t*, u_int8_t))set_major_version; - this->public.get_major_version = (u_int8_t(*)(message_t*))get_major_version; - this->public.set_minor_version = (void(*)(message_t*, u_int8_t))set_minor_version; - this->public.get_minor_version = (u_int8_t(*)(message_t*))get_minor_version; - this->public.set_message_id = (void(*)(message_t*, u_int32_t))set_message_id; - this->public.get_message_id = (u_int32_t(*)(message_t*))get_message_id; - this->public.get_initiator_spi = (u_int64_t(*)(message_t*))get_initiator_spi; - this->public.get_responder_spi = (u_int64_t(*)(message_t*))get_responder_spi; - this->public.set_ike_sa_id = (void(*)(message_t*, ike_sa_id_t *))set_ike_sa_id; - this->public.get_ike_sa_id = (ike_sa_id_t*(*)(message_t*))get_ike_sa_id; - this->public.set_exchange_type = (void(*)(message_t*, exchange_type_t))set_exchange_type; - this->public.get_exchange_type = (exchange_type_t(*)(message_t*))get_exchange_type; - this->public.get_first_payload_type = (payload_type_t(*)(message_t*))get_first_payload_type; - this->public.set_request = (void(*)(message_t*, bool))set_request; - this->public.get_request = (bool(*)(message_t*))get_request; - this->public.add_payload = (void(*)(message_t*,payload_t*))add_payload; - this->public.add_notify = (void(*)(message_t*,bool,notify_type_t,chunk_t))add_notify; - this->public.generate = (status_t (*) (message_t *,crypter_t*,signer_t*,packet_t**)) generate; - this->public.set_source = (void (*) (message_t*,host_t*)) set_source; - this->public.get_source = (host_t * (*) (message_t*)) get_source; - this->public.set_destination = (void (*) (message_t*,host_t*)) set_destination; - this->public.get_destination = (host_t * (*) (message_t*)) get_destination; - this->public.create_payload_enumerator = (enumerator_t * (*) (message_t *)) create_payload_enumerator; - this->public.get_payload = (payload_t * (*) (message_t *, payload_type_t)) get_payload; - this->public.get_notify = (notify_payload_t*(*)(message_t*, notify_type_t type))get_notify; - this->public.parse_header = (status_t (*) (message_t *)) parse_header; - this->public.parse_body = (status_t (*) (message_t *,crypter_t*,signer_t*)) parse_body; - this->public.get_packet = (packet_t * (*) (message_t*)) get_packet; - this->public.get_packet_data = (chunk_t (*) (message_t *this)) get_packet_data; - this->public.destroy = (void(*)(message_t*))destroy; - - /* private values */ - this->exchange_type = EXCHANGE_TYPE_UNDEFINED; - this->is_request = TRUE; - this->ike_sa_id = NULL; - this->first_payload = NO_PAYLOAD; - this->message_id = 0; - - /* private values */ - if (packet == NULL) - { - packet = packet_create(); - } - this->message_rule = NULL; - this->packet = packet; - this->payloads = linked_list_create(); - - /* parser is created from data of packet */ - this->parser = parser_create(this->packet->get_data(this->packet)); + private_message_t *this; + + INIT(this, + .public = { + .set_major_version = _set_major_version, + .get_major_version = _get_major_version, + .set_minor_version = _set_minor_version, + .get_minor_version = _get_minor_version, + .set_message_id = _set_message_id, + .get_message_id = _get_message_id, + .get_initiator_spi = _get_initiator_spi, + .get_responder_spi = _get_responder_spi, + .set_ike_sa_id = _set_ike_sa_id, + .get_ike_sa_id = _get_ike_sa_id, + .set_exchange_type = _set_exchange_type, + .get_exchange_type = _get_exchange_type, + .get_first_payload_type = _get_first_payload_type, + .set_request = _set_request, + .get_request = _get_request, + .add_payload = _add_payload, + .add_notify = _add_notify, + .generate = _generate, + .set_source = _set_source, + .get_source = _get_source, + .set_destination = _set_destination, + .get_destination = _get_destination, + .create_payload_enumerator = _create_payload_enumerator, + .get_payload = _get_payload, + .get_notify = _get_notify, + .parse_header = _parse_header, + .parse_body = _parse_body, + .get_packet = _get_packet, + .get_packet_data = _get_packet_data, + .destroy = _destroy, + }, + .exchange_type = EXCHANGE_TYPE_UNDEFINED, + .is_request = TRUE, + .first_payload = NO_PAYLOAD, + .packet = packet, + .payloads = linked_list_create(), + .parser = parser_create(packet->get_data(packet)), + ); return (&this->public); } @@ -1752,6 +1475,6 @@ message_t *message_create_from_packet(packet_t *packet) */ message_t *message_create() { - return message_create_from_packet(NULL); + return message_create_from_packet(packet_create()); } diff --git a/src/libcharon/encoding/message.h b/src/libcharon/encoding/message.h index 2c7718f49..8c1cbcd09 100644 --- a/src/libcharon/encoding/message.h +++ b/src/libcharon/encoding/message.h @@ -32,8 +32,7 @@ typedef struct message_t message_t; #include <encoding/payloads/ike_header.h> #include <encoding/payloads/notify_payload.h> #include <utils/linked_list.h> -#include <crypto/crypters/crypter.h> -#include <crypto/signers/signer.h> +#include <crypto/aead.h> /** * This class is used to represent an IKEv2-Message. @@ -201,14 +200,10 @@ struct message_t { * The body gets not only parsed, but rather it gets verified. * All payloads are verified if they are allowed to exist in the message * of this type and if their own structure is ok. - * If there are encrypted payloads, they get decrypted via the supplied - * crypter. Also the message integrity gets verified with the supplied - * signer. - * Crypter/signer can be omitted (by passing NULL) when no encryption - * payload is expected. - * - * @param crypter crypter to decrypt encryption payloads - * @param signer signer to verifiy a message with an encryption payload + * If there are encrypted payloads, they get decrypted and verified using + * the given aead transform (if given). + * + * @param aead aead transform to verify/decrypt message * @return * - SUCCESS if parsing successful * - NOT_SUPPORTED if ciritcal unknown payloads found @@ -216,32 +211,28 @@ struct message_t { * - PARSE_ERROR if message parsing failed * - VERIFY_ERROR if message verification failed (bad syntax) * - FAILED if integrity check failed - * - INVALID_STATE if crypter/signer not supplied, but needed + * - INVALID_STATE if aead not supplied, but needed */ - status_t (*parse_body) (message_t *this, crypter_t *crypter, signer_t *signer); + status_t (*parse_body) (message_t *this, aead_t *aead); /** * Generates the UDP packet of specific message. * * Payloads which must be encrypted are generated first and added to - * an encryption payload. This encryption payload will get encrypted via - * the supplied crypter. Then all other payloads and the header get generated. - * After that, the checksum is added to the encryption payload over the full - * message. - * Crypter/signer can be omitted (by passing NULL) when no encryption - * payload is expected. - * Generation is only done once, multiple calls will just return a packet copy. - * - * @param crypter crypter to use when a payload must be encrypted - * @param signer signer to build a mac + * an encryption payload. This encryption payload will get encrypted and + * signed via the supplied aead transform (if given). + * Generation is only done once, multiple calls will just return a copy + * of the packet. + * + * @param aead aead transform to encrypt/sign message * @param packet copy of generated packet * @return * - SUCCESS if packet could be generated * - INVALID_STATE if exchange type is currently not set * - NOT_FOUND if no rules found for message generation - * - INVALID_STATE if crypter/signer not supplied but needed. + * - INVALID_STATE if aead not supplied but needed. */ - status_t (*generate) (message_t *this, crypter_t *crypter, signer_t *signer, packet_t **packet); + status_t (*generate) (message_t *this, aead_t *aead, packet_t **packet); /** * Gets the source host informations. @@ -331,13 +322,8 @@ struct message_t { /** * Creates an message_t object from a incoming UDP Packet. * - * @warning the given packet_t object is not copied and gets - * destroyed in message_t's destroy call. - * - * - exchange_type is set to NOT_SET - * - original_initiator is set to TRUE - * - is_request is set to TRUE - * Call message_t.parse_header afterwards. + * The given packet gets owned by the message. The message is uninitialized, + * call parse_header() to populate header fields. * * @param packet packet_t object which is assigned to message * @return message_t object diff --git a/src/libcharon/encoding/payloads/delete_payload.c b/src/libcharon/encoding/payloads/delete_payload.c index 97b4743b2..5fc3b7c88 100644 --- a/src/libcharon/encoding/payloads/delete_payload.c +++ b/src/libcharon/encoding/payloads/delete_payload.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2005-2006 Martin Willi + * Copyright (C) 2005-2010 Martin Willi + * Copyright (C) 2010 revosec AG * Copyright (C) 2005 Jan Hutter * Hochschule fuer Technik Rapperswil * @@ -65,11 +66,6 @@ struct private_delete_payload_t { * The contained SPI's. */ chunk_t spis; - - /** - * List containing u_int32_t spis - */ - linked_list_t *spi_list; }; /** @@ -77,7 +73,6 @@ struct private_delete_payload_t { * * The defined offsets are the positions in a object of type * private_delete_payload_t. - * */ encoding_rule_t delete_payload_encodings[] = { /* 1 Byte next payload type, stored in the field next_payload */ @@ -85,20 +80,20 @@ encoding_rule_t delete_payload_encodings[] = { /* the critical bit */ { FLAG, offsetof(private_delete_payload_t, critical) }, /* 7 Bit reserved bits, nowhere stored */ - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, /* Length of the whole payload*/ - { PAYLOAD_LENGTH, offsetof(private_delete_payload_t, payload_length)}, + { PAYLOAD_LENGTH, offsetof(private_delete_payload_t, payload_length) }, { U_INT_8, offsetof(private_delete_payload_t, protocol_id) }, { U_INT_8, offsetof(private_delete_payload_t, spi_size) }, { U_INT_16, offsetof(private_delete_payload_t, spi_count) }, /* some delete data bytes, length is defined in PAYLOAD_LENGTH */ - { SPIS, offsetof(private_delete_payload_t, spis) } + { SPIS, offsetof(private_delete_payload_t, spis) } }; /* @@ -115,10 +110,8 @@ encoding_rule_t delete_payload_encodings[] = { +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ -/** - * Implementation of payload_t.verify. - */ -static status_t verify(private_delete_payload_t *this) +METHOD(payload_t, verify, status_t, + private_delete_payload_t *this) { switch (this->protocol_id) { @@ -147,112 +140,104 @@ static status_t verify(private_delete_payload_t *this) return SUCCESS; } -/** - * Implementation of delete_payload_t.get_encoding_rules. - */ -static void get_encoding_rules(private_delete_payload_t *this, encoding_rule_t **rules, size_t *rule_count) +METHOD(payload_t, get_encoding_rules, void, + private_delete_payload_t *this, encoding_rule_t **rules, size_t *rule_count) { *rules = delete_payload_encodings; - *rule_count = sizeof(delete_payload_encodings) / sizeof(encoding_rule_t); + *rule_count = countof(delete_payload_encodings); } -/** - * Implementation of payload_t.get_type. - */ -static payload_type_t get_payload_type(private_delete_payload_t *this) +METHOD(payload_t, get_payload_type, payload_type_t, + private_delete_payload_t *this) { return DELETE; } -/** - * Implementation of payload_t.get_next_type. - */ -static payload_type_t get_next_type(private_delete_payload_t *this) +METHOD(payload_t, get_next_type, payload_type_t, + private_delete_payload_t *this) { - return (this->next_payload); + return this->next_payload; } -/** - * Implementation of payload_t.set_next_type. - */ -static void set_next_type(private_delete_payload_t *this,payload_type_t type) +METHOD(payload_t, set_next_type, void, + private_delete_payload_t *this,payload_type_t type) { this->next_payload = type; } -/** - * Implementation of payload_t.get_length. - */ -static size_t get_length(private_delete_payload_t *this) +METHOD(payload_t, get_length, size_t, + private_delete_payload_t *this) { return this->payload_length; } -/** - * Implementation of delete_payload_t.get_protocol_id. - */ -static protocol_id_t get_protocol_id (private_delete_payload_t *this) +METHOD(delete_payload_t, get_protocol_id, protocol_id_t, + private_delete_payload_t *this) { - return (this->protocol_id); + return this->protocol_id; } -/** - * Implementation of delete_payload_t.add_spi. - */ -static void add_spi(private_delete_payload_t *this, u_int32_t spi) +METHOD(delete_payload_t, add_spi, void, + private_delete_payload_t *this, u_int32_t spi) { - /* only add SPIs if AH|ESP, ignore others */ - if (this->protocol_id == PROTO_AH || this->protocol_id == PROTO_ESP) + switch (this->protocol_id) { - this->spi_count += 1; - this->spis.len += this->spi_size; - this->spis.ptr = realloc(this->spis.ptr, this->spis.len); - *(u_int32_t*)(this->spis.ptr + (this->spis.len / this->spi_size - 1)) = spi; - if (this->spi_list) - { - /* reset SPI iterator list */ - this->spi_list->destroy(this->spi_list); - this->spi_list = NULL; - } + case PROTO_AH: + case PROTO_ESP: + this->spi_count++; + this->payload_length += sizeof(spi); + this->spis = chunk_cat("mc", this->spis, chunk_from_thing(spi)); + break; + default: + break; } } /** - * Implementation of delete_payload_t.create_spi_iterator. + * SPI enumerator implementation */ -static iterator_t* create_spi_iterator(private_delete_payload_t *this) -{ - int i; +typedef struct { + /** implements enumerator_t */ + enumerator_t public; + /** remaining SPIs */ + chunk_t spis; +} spi_enumerator_t; - if (this->spi_list == NULL) +METHOD(enumerator_t, spis_enumerate, bool, + spi_enumerator_t *this, u_int32_t *spi) +{ + if (this->spis.len >= sizeof(*spi)) { - this->spi_list = linked_list_create(); - /* only parse SPIs if AH|ESP */ - if (this->protocol_id == PROTO_AH || this->protocol_id == PROTO_ESP) - { - for (i = 0; i < this->spi_count; i++) - { - this->spi_list->insert_last(this->spi_list, this->spis.ptr + i * - this->spi_size); - } - } + memcpy(spi, this->spis.ptr, sizeof(*spi)); + this->spis = chunk_skip(this->spis, sizeof(*spi)); + return TRUE; } - return this->spi_list->create_iterator(this->spi_list, TRUE); + return FALSE; } -/** - * Implementation of payload_t.destroy and delete_payload_t.destroy. - */ -static void destroy(private_delete_payload_t *this) +METHOD(delete_payload_t, create_spi_enumerator, enumerator_t*, + private_delete_payload_t *this) { - if (this->spis.ptr != NULL) - { - chunk_free(&this->spis); - } - if (this->spi_list) + spi_enumerator_t *e; + + if (this->spi_size != sizeof(u_int32_t)) { - this->spi_list->destroy(this->spi_list); + return enumerator_create_empty(); } + INIT(e, + .public = { + .enumerate = (void*)_spis_enumerate, + .destroy = (void*)free, + }, + .spis = this->spis, + ); + return &e->public; +} + +METHOD2(payload_t, delete_payload_t, destroy, void, + private_delete_payload_t *this) +{ + free(this->spis.ptr); free(this); } @@ -261,32 +246,28 @@ static void destroy(private_delete_payload_t *this) */ delete_payload_t *delete_payload_create(protocol_id_t protocol_id) { - private_delete_payload_t *this = malloc_thing(private_delete_payload_t); - - /* interface functions */ - this->public.payload_interface.verify = (status_t (*) (payload_t *))verify; - this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules; - this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length; - this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type; - this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type; - this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type; - this->public.payload_interface.destroy = (void (*) (payload_t *))destroy; - - /* public functions */ - this->public.destroy = (void (*) (delete_payload_t *)) destroy; - this->public.get_protocol_id = (protocol_id_t (*) (delete_payload_t *)) get_protocol_id; - this->public.add_spi = (void (*) (delete_payload_t *,u_int32_t))add_spi; - this->public.create_spi_iterator = (iterator_t* (*) (delete_payload_t *)) create_spi_iterator; - - /* private variables */ - this->critical = FALSE; - this->next_payload = NO_PAYLOAD; - this->payload_length = DELETE_PAYLOAD_HEADER_LENGTH; - this->protocol_id = protocol_id; - this->spi_size = protocol_id == PROTO_AH || protocol_id == PROTO_ESP ? 4 : 0; - this->spi_count = 0; - this->spis = chunk_empty; - this->spi_list = NULL; + private_delete_payload_t *this; - return (&this->public); + INIT(this, + .public = { + .payload_interface = { + .verify = _verify, + .get_encoding_rules = _get_encoding_rules, + .get_length = _get_length, + .get_next_type = _get_next_type, + .set_next_type = _set_next_type, + .get_type = _get_payload_type, + .destroy = _destroy, + }, + .get_protocol_id = _get_protocol_id, + .add_spi = _add_spi, + .create_spi_enumerator = _create_spi_enumerator, + .destroy = _destroy, + }, + .next_payload = NO_PAYLOAD, + .payload_length = DELETE_PAYLOAD_HEADER_LENGTH, + .protocol_id = protocol_id, + .spi_size = protocol_id == PROTO_AH || protocol_id == PROTO_ESP ? 4 : 0, + ); + return &this->public; } diff --git a/src/libcharon/encoding/payloads/delete_payload.h b/src/libcharon/encoding/payloads/delete_payload.h index 3b62c1af1..026829f97 100644 --- a/src/libcharon/encoding/payloads/delete_payload.h +++ b/src/libcharon/encoding/payloads/delete_payload.h @@ -39,6 +39,7 @@ typedef struct delete_payload_t delete_payload_t; * The DELETE payload format is described in RFC section 3.11. */ struct delete_payload_t { + /** * The payload_t interface. */ @@ -59,13 +60,11 @@ struct delete_payload_t { void (*add_spi) (delete_payload_t *this, u_int32_t spi); /** - * Get an iterator over the SPIs. - * - * The iterate() function returns a pointer to a u_int32_t SPI. + * Get an enumerator over the SPIs in network order. * - * @return iterator over SPIs + * @return enumerator over SPIs, u_int32_t */ - iterator_t *(*create_spi_iterator) (delete_payload_t *this); + enumerator_t *(*create_spi_enumerator) (delete_payload_t *this); /** * Destroys an delete_payload_t object. diff --git a/src/libcharon/encoding/payloads/encryption_payload.c b/src/libcharon/encoding/payloads/encryption_payload.c index 2adbb88b9..3b23ea9fb 100644 --- a/src/libcharon/encoding/payloads/encryption_payload.c +++ b/src/libcharon/encoding/payloads/encryption_payload.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2005-2006 Martin Willi + * Copyright (C) 2005-2010 Martin Willi + * Copyright (C) 2010 revosec AG * Copyright (C) 2005 Jan Hutter * Hochschule fuer Technik Rapperswil * @@ -24,9 +25,6 @@ #include <utils/linked_list.h> #include <encoding/generator.h> #include <encoding/parser.h> -#include <utils/iterator.h> -#include <crypto/signers/signer.h> - typedef struct private_encryption_payload_t private_encryption_payload_t; @@ -50,9 +48,9 @@ struct private_encryption_payload_t { u_int8_t next_payload; /** - * Critical flag. + * Flags, including reserved bits */ - bool critical; + u_int8_t flags; /** * Length of this payload @@ -60,28 +58,17 @@ struct private_encryption_payload_t { u_int16_t payload_length; /** - * Chunk containing the iv, data, padding, - * and (an eventually not calculated) signature. + * Chunk containing the IV, plain, padding and ICV. */ chunk_t encrypted; /** - * Chunk containing the data in decrypted (unpadded) form. - */ - chunk_t decrypted; - - /** - * Signer set by set_signer. + * AEAD transform to use */ - signer_t *signer; + aead_t *aead; /** - * Crypter, supplied by encrypt/decrypt - */ - crypter_t *crypter; - - /** - * Contained payloads of this encrpytion_payload. + * Contained payloads */ linked_list_t *payloads; }; @@ -91,25 +78,16 @@ struct private_encryption_payload_t { * * The defined offsets are the positions in a object of type * private_encryption_payload_t. - * */ encoding_rule_t encryption_payload_encodings[] = { /* 1 Byte next payload type, stored in the field next_payload */ { U_INT_8, offsetof(private_encryption_payload_t, next_payload) }, - /* the critical bit */ - { FLAG, offsetof(private_encryption_payload_t, critical) }, - /* 7 Bit reserved bits, nowhere stored */ - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, + /* Critical and 7 reserved bits, all stored for reconstruction */ + { U_INT_8, offsetof(private_encryption_payload_t, flags) }, /* Length of the whole encryption payload*/ { PAYLOAD_LENGTH, offsetof(private_encryption_payload_t, payload_length) }, /* encrypted data, stored in a chunk. contains iv, data, padding */ - { ENCRYPTED_DATA, offsetof(private_encryption_payload_t, encrypted) }, + { ENCRYPTED_DATA, offsetof(private_encryption_payload_t, encrypted) }, }; /* @@ -131,108 +109,90 @@ encoding_rule_t encryption_payload_encodings[] = { +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ -/** - * Implementation of payload_t.verify. - */ -static status_t verify(private_encryption_payload_t *this) +METHOD(payload_t, verify, status_t, + private_encryption_payload_t *this) { return SUCCESS; } -/** - * Implementation of payload_t.get_encoding_rules. - */ -static void get_encoding_rules(private_encryption_payload_t *this, encoding_rule_t **rules, size_t *rule_count) +METHOD(payload_t, get_encoding_rules, void, + private_encryption_payload_t *this, encoding_rule_t **rules, + size_t *count) { *rules = encryption_payload_encodings; - *rule_count = sizeof(encryption_payload_encodings) / sizeof(encoding_rule_t); + *count = countof(encryption_payload_encodings); } -/** - * Implementation of payload_t.get_type. - */ -static payload_type_t get_type(private_encryption_payload_t *this) +METHOD(payload_t, get_type, payload_type_t, + private_encryption_payload_t *this) { return ENCRYPTED; } -/** - * Implementation of payload_t.get_next_type. - */ -static payload_type_t get_next_type(private_encryption_payload_t *this) +METHOD(payload_t, get_next_type, payload_type_t, + private_encryption_payload_t *this) { - /* returns first contained payload here */ - return (this->next_payload); + return this->next_payload; } -/** - * Implementation of payload_t.set_next_type. - */ -static void set_next_type(private_encryption_payload_t *this, payload_type_t type) +METHOD(payload_t, set_next_type, void, + private_encryption_payload_t *this, payload_type_t type) { - /* set next type is not allowed, since this payload MUST be the last one - * and so nothing is done in here*/ + /* the next payload is set during add */ } /** - * (re-)compute the lenght of the whole payload + * Compute the lenght of the whole payload */ static void compute_length(private_encryption_payload_t *this) { - iterator_t *iterator; - payload_t *current_payload; - size_t block_size, length = 0; - iterator = this->payloads->create_iterator(this->payloads, TRUE); + enumerator_t *enumerator; + payload_t *payload; + size_t bs, length = 0; - /* count payload length */ - while (iterator->iterate(iterator, (void **) ¤t_payload)) + if (this->encrypted.len) { - length += current_payload->get_length(current_payload); + length = this->encrypted.len; } - iterator->destroy(iterator); - - if (this->crypter && this->signer) + else { - /* append one byte for padding length */ - length++; - /* append padding */ - block_size = this->crypter->get_block_size(this->crypter); - length += block_size - length % block_size; - /* add iv */ - length += block_size; - /* add signature */ - length += this->signer->get_block_size(this->signer); + enumerator = this->payloads->create_enumerator(this->payloads); + while (enumerator->enumerate(enumerator, &payload)) + { + length += payload->get_length(payload); + } + enumerator->destroy(enumerator); + + if (this->aead) + { + /* append padding */ + bs = this->aead->get_block_size(this->aead); + length += bs - (length % bs); + /* add iv */ + length += this->aead->get_iv_size(this->aead); + /* add icv */ + length += this->aead->get_icv_size(this->aead); + } } length += ENCRYPTION_PAYLOAD_HEADER_LENGTH; this->payload_length = length; } -/** - * Implementation of payload_t.get_length. - */ -static size_t get_length(private_encryption_payload_t *this) +METHOD2(payload_t, encryption_payload_t, get_length, size_t, + private_encryption_payload_t *this) { compute_length(this); return this->payload_length; } -/** - * Implementation of payload_t.create_payload_iterator. - */ -static iterator_t *create_payload_iterator (private_encryption_payload_t *this, bool forward) -{ - return (this->payloads->create_iterator(this->payloads, forward)); -} - -/** - * Implementation of payload_t.add_payload. - */ -static void add_payload(private_encryption_payload_t *this, payload_t *payload) +METHOD(encryption_payload_t, add_payload, void, + private_encryption_payload_t *this, payload_t *payload) { payload_t *last_payload; + if (this->payloads->get_count(this->payloads) > 0) { - this->payloads->get_last(this->payloads,(void **) &last_payload); + this->payloads->get_last(this->payloads, (void **)&last_payload); last_payload->set_next_type(last_payload, payload->get_type(payload)); } else @@ -240,339 +200,255 @@ static void add_payload(private_encryption_payload_t *this, payload_t *payload) this->next_payload = payload->get_type(payload); } payload->set_next_type(payload, NO_PAYLOAD); - this->payloads->insert_last(this->payloads, (void*)payload); + this->payloads->insert_last(this->payloads, payload); compute_length(this); } -/** - * Implementation of encryption_payload_t.remove_first_payload. - */ -static status_t remove_first_payload(private_encryption_payload_t *this, payload_t **payload) +METHOD(encryption_payload_t, remove_payload, payload_t *, + private_encryption_payload_t *this) { - return this->payloads->remove_first(this->payloads, (void**)payload); -} + payload_t *payload; -/** - * Implementation of encryption_payload_t.get_payload_count. - */ -static size_t get_payload_count(private_encryption_payload_t *this) -{ - return this->payloads->get_count(this->payloads); + if (this->payloads->remove_first(this->payloads, + (void**)&payload) == SUCCESS) + { + return payload; + } + return NULL; } /** - * Generate payload before encryption. + * Generate payload before encryption */ -static void generate(private_encryption_payload_t *this) +static chunk_t generate(private_encryption_payload_t *this, + generator_t *generator) { - payload_t *current_payload, *next_payload; - generator_t *generator; - iterator_t *iterator; - - /* recalculate length before generating */ - compute_length(this); + payload_t *current, *next; + enumerator_t *enumerator; + u_int32_t *lenpos; + chunk_t chunk = chunk_empty; - /* create iterator */ - iterator = this->payloads->create_iterator(this->payloads, TRUE); - - /* get first payload */ - if (iterator->iterate(iterator, (void**)¤t_payload)) - { - this->next_payload = current_payload->get_type(current_payload); - } - else + enumerator = this->payloads->create_enumerator(this->payloads); + if (enumerator->enumerate(enumerator, ¤t)) { - /* no paylads? */ - DBG2(DBG_ENC, "generating contained payloads, but none available"); - free(this->decrypted.ptr); - this->decrypted = chunk_empty; - iterator->destroy(iterator); - return; - } + this->next_payload = current->get_type(current); - generator = generator_create(); + while (enumerator->enumerate(enumerator, &next)) + { + current->set_next_type(current, next->get_type(next)); + generator->generate_payload(generator, current); + current = next; + } + current->set_next_type(current, NO_PAYLOAD); + generator->generate_payload(generator, current); - /* build all payload, except last */ - while(iterator->iterate(iterator, (void**)&next_payload)) - { - current_payload->set_next_type(current_payload, next_payload->get_type(next_payload)); - generator->generate_payload(generator, current_payload); - current_payload = next_payload; + chunk = generator->get_chunk(generator, &lenpos); + DBG2(DBG_ENC, "generated content in encryption payload"); } - iterator->destroy(iterator); - - /* build last payload */ - current_payload->set_next_type(current_payload, NO_PAYLOAD); - generator->generate_payload(generator, current_payload); - - /* free already generated data */ - free(this->decrypted.ptr); - - generator->write_to_chunk(generator, &(this->decrypted)); - generator->destroy(generator); - DBG2(DBG_ENC, "successfully generated content in encryption payload"); + enumerator->destroy(enumerator); + return chunk; } /** - * Implementation of encryption_payload_t.encrypt. + * Append the encryption payload header to the associated data */ -static status_t encrypt(private_encryption_payload_t *this) +static chunk_t append_header(private_encryption_payload_t *this, chunk_t assoc) { - chunk_t iv, padding, to_crypt, result; + struct { + u_int8_t next_payload; + u_int8_t flags; + u_int16_t length; + } __attribute__((packed)) header = { + .next_payload = this->next_payload, + .flags = this->flags, + .length = htons(get_length(this)), + }; + return chunk_cat("cc", assoc, chunk_from_thing(header)); +} + +METHOD(encryption_payload_t, encrypt, bool, + private_encryption_payload_t *this, chunk_t assoc) +{ + chunk_t iv, plain, padding, icv, crypt; + generator_t *generator; rng_t *rng; - size_t block_size; + size_t bs; - if (this->signer == NULL || this->crypter == NULL) + if (this->aead == NULL) { - DBG1(DBG_ENC, "could not encrypt, signer/crypter not set"); - return INVALID_STATE; + DBG1(DBG_ENC, "encrypting encryption payload failed, transform missing"); + return FALSE; } - /* for random data in iv and padding */ rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK); if (!rng) { - DBG1(DBG_ENC, "could not encrypt, no RNG found"); - return FAILED; + DBG1(DBG_ENC, "encrypting encryption payload failed, no RNG found"); + return FALSE; } - /* build payload chunk */ - generate(this); - DBG2(DBG_ENC, "encrypting payloads"); - DBG3(DBG_ENC, "data to encrypt %B", &this->decrypted); + assoc = append_header(this, assoc); - /* build padding */ - block_size = this->crypter->get_block_size(this->crypter); - padding.len = block_size - ((this->decrypted.len + 1) % block_size); - rng->allocate_bytes(rng, padding.len, &padding); - - /* concatenate payload data, padding, padding len */ - to_crypt.len = this->decrypted.len + padding.len + 1; - to_crypt.ptr = malloc(to_crypt.len); - - memcpy(to_crypt.ptr, this->decrypted.ptr, this->decrypted.len); - memcpy(to_crypt.ptr + this->decrypted.len, padding.ptr, padding.len); - *(to_crypt.ptr + to_crypt.len - 1) = padding.len; + generator = generator_create(); + plain = generate(this, generator); + bs = this->aead->get_block_size(this->aead); + /* we need at least one byte padding to store the padding length */ + padding.len = bs - (plain.len % bs); + iv.len = this->aead->get_iv_size(this->aead); + icv.len = this->aead->get_icv_size(this->aead); + + /* prepare data to authenticate-encrypt: + * | IV | plain | padding | ICV | + * \____crypt______/ ^ + * | / + * v / + * assoc -> + ------->/ + */ + free(this->encrypted.ptr); + this->encrypted = chunk_alloc(iv.len + plain.len + padding.len + icv.len); + iv.ptr = this->encrypted.ptr; + memcpy(iv.ptr + iv.len, plain.ptr, plain.len); + plain.ptr = iv.ptr + iv.len; + padding.ptr = plain.ptr + plain.len; + icv.ptr = padding.ptr + padding.len; + crypt = chunk_create(plain.ptr, plain.len + padding.len); + generator->destroy(generator); - /* build iv */ - iv.len = block_size; - rng->allocate_bytes(rng, iv.len, &iv); + rng->get_bytes(rng, iv.len, iv.ptr); + rng->get_bytes(rng, padding.len - 1, padding.ptr); + padding.ptr[padding.len - 1] = padding.len - 1; rng->destroy(rng); - DBG3(DBG_ENC, "data before encryption with padding %B", &to_crypt); + DBG3(DBG_ENC, "encryption payload encryption:"); + DBG3(DBG_ENC, "IV %B", &iv); + DBG3(DBG_ENC, "plain %B", &plain); + DBG3(DBG_ENC, "padding %B", &padding); + DBG3(DBG_ENC, "assoc %B", &assoc); - /* encrypt to_crypt chunk */ - free(this->encrypted.ptr); - this->crypter->encrypt(this->crypter, to_crypt, iv, &result); - free(padding.ptr); - free(to_crypt.ptr); - - DBG3(DBG_ENC, "data after encryption %B", &result); - - /* build encrypted result with iv and signature */ - this->encrypted.len = iv.len + result.len + this->signer->get_block_size(this->signer); - free(this->encrypted.ptr); - this->encrypted.ptr = malloc(this->encrypted.len); + this->aead->encrypt(this->aead, crypt, assoc, iv, NULL); - /* fill in result, signature is left out */ - memcpy(this->encrypted.ptr, iv.ptr, iv.len); - memcpy(this->encrypted.ptr + iv.len, result.ptr, result.len); + DBG3(DBG_ENC, "encrypted %B", &crypt); + DBG3(DBG_ENC, "ICV %B", &icv); - free(result.ptr); - free(iv.ptr); - DBG3(DBG_ENC, "data after encryption with IV and (invalid) signature %B", - &this->encrypted); + free(assoc.ptr); - return SUCCESS; + return TRUE; } /** * Parse the payloads after decryption. */ -static status_t parse(private_encryption_payload_t *this) +static status_t parse(private_encryption_payload_t *this, chunk_t plain) { parser_t *parser; - status_t status; - payload_type_t current_payload_type; - - /* build a parser on the decrypted data */ - parser = parser_create(this->decrypted); + payload_type_t type; - current_payload_type = this->next_payload; - /* parse all payloads */ - while (current_payload_type != NO_PAYLOAD) + parser = parser_create(plain); + type = this->next_payload; + while (type != NO_PAYLOAD) { - payload_t *current_payload; + payload_t *payload; - status = parser->parse_payload(parser, current_payload_type, (payload_t**)¤t_payload); - if (status != SUCCESS) + if (parser->parse_payload(parser, type, &payload) != SUCCESS) { parser->destroy(parser); return PARSE_ERROR; } - - status = current_payload->verify(current_payload); - if (status != SUCCESS) + if (payload->verify(payload) != SUCCESS) { DBG1(DBG_ENC, "%N verification failed", - payload_type_names, current_payload->get_type(current_payload)); - current_payload->destroy(current_payload); + payload_type_names, payload->get_type(payload)); + payload->destroy(payload); parser->destroy(parser); return VERIFY_ERROR; } - - /* get next payload type */ - current_payload_type = current_payload->get_next_type(current_payload); - - this->payloads->insert_last(this->payloads,current_payload); + type = payload->get_next_type(payload); + this->payloads->insert_last(this->payloads, payload); } parser->destroy(parser); - DBG2(DBG_ENC, "succesfully parsed content of encryption payload"); + DBG2(DBG_ENC, "parsed content of encryption payload"); return SUCCESS; } -/** - * Implementation of encryption_payload_t.encrypt. - */ -static status_t decrypt(private_encryption_payload_t *this) +METHOD(encryption_payload_t, decrypt, status_t, + private_encryption_payload_t *this, chunk_t assoc) { - chunk_t iv, concatenated; - u_int8_t padding_length; - - DBG2(DBG_ENC, "decrypting encryption payload"); - DBG3(DBG_ENC, "data before decryption with IV and (invalid) signature %B", - &this->encrypted); + chunk_t iv, plain, padding, icv, crypt; + size_t bs; - if (this->signer == NULL || this->crypter == NULL) + if (this->aead == NULL) { - DBG1(DBG_ENC, "could not decrypt, no crypter/signer set"); + DBG1(DBG_ENC, "decrypting encryption payload failed, transform missing"); return INVALID_STATE; } - /* get IV */ - iv.len = this->crypter->get_block_size(this->crypter); + /* prepare data to authenticate-decrypt: + * | IV | plain | padding | ICV | + * \____crypt______/ ^ + * | / + * v / + * assoc -> + ------->/ + */ + bs = this->aead->get_block_size(this->aead); + iv.len = this->aead->get_iv_size(this->aead); iv.ptr = this->encrypted.ptr; + icv.len = this->aead->get_icv_size(this->aead); + icv.ptr = this->encrypted.ptr + this->encrypted.len - icv.len; + crypt.ptr = iv.ptr + iv.len; + crypt.len = this->encrypted.len - iv.len; - /* point concatenated to data + padding + padding_length*/ - concatenated.ptr = this->encrypted.ptr + iv.len; - concatenated.len = this->encrypted.len - iv.len - - this->signer->get_block_size(this->signer); - - /* concatenated must be a multiple of block_size of crypter */ - if (concatenated.len < iv.len || concatenated.len % iv.len) + if (iv.len + icv.len > this->encrypted.len || + (crypt.len - icv.len) % bs) { - DBG1(DBG_ENC, "could not decrypt, invalid input"); + DBG1(DBG_ENC, "decrypting encryption payload failed, invalid length"); return FAILED; } - /* free previus data, if any */ - free(this->decrypted.ptr); - - DBG3(DBG_ENC, "data before decryption %B", &concatenated); - - this->crypter->decrypt(this->crypter, concatenated, iv, &this->decrypted); + assoc = append_header(this, assoc); - DBG3(DBG_ENC, "data after decryption with padding %B", &this->decrypted); + DBG3(DBG_ENC, "encryption payload decryption:"); + DBG3(DBG_ENC, "IV %B", &iv); + DBG3(DBG_ENC, "encrypted %B", &crypt); + DBG3(DBG_ENC, "ICV %B", &icv); + DBG3(DBG_ENC, "assoc %B", &assoc); - /* get padding length, sits just bevore signature */ - padding_length = *(this->decrypted.ptr + this->decrypted.len - 1); - /* add one byte to the padding length, since the padding_length field is - * not included */ - padding_length++; - - /* check size again */ - if (padding_length > concatenated.len || padding_length > this->decrypted.len) + if (!this->aead->decrypt(this->aead, crypt, assoc, iv, NULL)) { - DBG1(DBG_ENC, "decryption failed, invalid padding length found. Invalid key?"); - /* decryption failed :-/ */ + DBG1(DBG_ENC, "verifying encryption payload integrity failed"); + free(assoc.ptr); return FAILED; } - this->decrypted.len -= padding_length; - - /* free padding */ - this->decrypted.ptr = realloc(this->decrypted.ptr, this->decrypted.len); - DBG3(DBG_ENC, "data after decryption without padding %B", &this->decrypted); - DBG2(DBG_ENC, "decryption successful, trying to parse content"); - return parse(this); -} + free(assoc.ptr); -/** - * Implementation of encryption_payload_t.set_transforms. - */ -static void set_transforms(private_encryption_payload_t *this, crypter_t* crypter, signer_t* signer) -{ - this->signer = signer; - this->crypter = crypter; -} - -/** - * Implementation of encryption_payload_t.build_signature. - */ -static status_t build_signature(private_encryption_payload_t *this, chunk_t data) -{ - chunk_t data_without_sig = data; - chunk_t sig; - - if (this->signer == NULL) + plain = chunk_create(crypt.ptr, crypt.len - icv.len); + padding.len = plain.ptr[plain.len - 1] + 1; + if (padding.len > plain.len) { - DBG1(DBG_ENC, "unable to build signature, no signer set"); - return INVALID_STATE; + DBG1(DBG_ENC, "decrypting encryption payload failed, " + "padding invalid %B", &crypt); + return PARSE_ERROR; } + plain.len -= padding.len; + padding.ptr = plain.ptr + plain.len; - sig.len = this->signer->get_block_size(this->signer); - data_without_sig.len -= sig.len; - sig.ptr = data.ptr + data_without_sig.len; - DBG2(DBG_ENC, "building signature"); - this->signer->get_signature(this->signer, data_without_sig, sig.ptr); - return SUCCESS; + DBG3(DBG_ENC, "plain %B", &plain); + DBG3(DBG_ENC, "padding %B", &padding); + + return parse(this, plain); } -/** - * Implementation of encryption_payload_t.verify_signature. - */ -static status_t verify_signature(private_encryption_payload_t *this, chunk_t data) +METHOD(encryption_payload_t, set_transform, void, + private_encryption_payload_t *this, aead_t* aead) { - chunk_t sig, data_without_sig; - bool valid; - - if (this->signer == NULL) - { - DBG1(DBG_ENC, "unable to verify signature, no signer set"); - return INVALID_STATE; - } - /* find signature in data chunk */ - sig.len = this->signer->get_block_size(this->signer); - if (data.len <= sig.len) - { - DBG1(DBG_ENC, "unable to verify signature, invalid input"); - return FAILED; - } - sig.ptr = data.ptr + data.len - sig.len; - - /* verify it */ - data_without_sig.len = data.len - sig.len; - data_without_sig.ptr = data.ptr; - valid = this->signer->verify_signature(this->signer, data_without_sig, sig); - - if (!valid) - { - DBG1(DBG_ENC, "signature verification failed"); - return FAILED; - } - - DBG2(DBG_ENC, "signature verification successful"); - return SUCCESS; + this->aead = aead; } -/** - * Implementation of payload_t.destroy. - */ -static void destroy(private_encryption_payload_t *this) +METHOD2(payload_t, encryption_payload_t, destroy, void, + private_encryption_payload_t *this) { this->payloads->destroy_offset(this->payloads, offsetof(payload_t, destroy)); free(this->encrypted.ptr); - free(this->decrypted.ptr); free(this); } @@ -581,39 +457,31 @@ static void destroy(private_encryption_payload_t *this) */ encryption_payload_t *encryption_payload_create() { - private_encryption_payload_t *this = malloc_thing(private_encryption_payload_t); - - /* payload_t interface functions */ - this->public.payload_interface.verify = (status_t (*) (payload_t *))verify; - this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules; - this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length; - this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type; - this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type; - this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type; - this->public.payload_interface.destroy = (void (*) (payload_t *))destroy; - - /* public functions */ - this->public.create_payload_iterator = (iterator_t * (*) (encryption_payload_t *,bool)) create_payload_iterator; - this->public.add_payload = (void (*) (encryption_payload_t *,payload_t *)) add_payload; - this->public.remove_first_payload = (status_t (*)(encryption_payload_t*, payload_t **)) remove_first_payload; - this->public.get_payload_count = (size_t (*)(encryption_payload_t*)) get_payload_count; - - this->public.encrypt = (status_t (*) (encryption_payload_t *)) encrypt; - this->public.decrypt = (status_t (*) (encryption_payload_t *)) decrypt; - this->public.set_transforms = (void (*) (encryption_payload_t*,crypter_t*,signer_t*)) set_transforms; - this->public.build_signature = (status_t (*) (encryption_payload_t*, chunk_t)) build_signature; - this->public.verify_signature = (status_t (*) (encryption_payload_t*, chunk_t)) verify_signature; - this->public.destroy = (void (*) (encryption_payload_t *)) destroy; - - /* set default values of the fields */ - this->critical = FALSE; - this->next_payload = NO_PAYLOAD; - this->payload_length = ENCRYPTION_PAYLOAD_HEADER_LENGTH; - this->encrypted = chunk_empty; - this->decrypted = chunk_empty; - this->signer = NULL; - this->crypter = NULL; - this->payloads = linked_list_create(); - - return (&(this->public)); + private_encryption_payload_t *this; + + INIT(this, + .public = { + .payload_interface = { + .verify = _verify, + .get_encoding_rules = _get_encoding_rules, + .get_length = _get_length, + .get_next_type = _get_next_type, + .set_next_type = _set_next_type, + .get_type = _get_type, + .destroy = _destroy, + }, + .get_length = _get_length, + .add_payload = _add_payload, + .remove_payload = _remove_payload, + .set_transform = _set_transform, + .encrypt = _encrypt, + .decrypt = _decrypt, + .destroy = _destroy, + }, + .next_payload = NO_PAYLOAD, + .payload_length = ENCRYPTION_PAYLOAD_HEADER_LENGTH, + .payloads = linked_list_create(), + ); + + return &this->public; } diff --git a/src/libcharon/encoding/payloads/encryption_payload.h b/src/libcharon/encoding/payloads/encryption_payload.h index ac5326b87..e99c42fb7 100644 --- a/src/libcharon/encoding/payloads/encryption_payload.h +++ b/src/libcharon/encoding/payloads/encryption_payload.h @@ -1,5 +1,6 @@ /* - * Copyright (C) 2005-2006 Martin Willi + * Copyright (C) 2005-2010 Martin Willi + * Copyright (C) 2010 revosec AG * Copyright (C) 2005 Jan Hutter * Hochschule fuer Technik Rapperswil * @@ -25,45 +26,30 @@ typedef struct encryption_payload_t encryption_payload_t; #include <library.h> -#include <crypto/crypters/crypter.h> -#include <crypto/signers/signer.h> +#include <crypto/aead.h> #include <encoding/payloads/payload.h> -#include <utils/linked_list.h> /** * Encrpytion payload length in bytes without IV and following data. */ #define ENCRYPTION_PAYLOAD_HEADER_LENGTH 4 - /** * The encryption payload as described in RFC section 3.14. - * - * Before any crypt/decrypt/sign/verify operation can occur, - * the transforms must be set. After that, a parsed encryption payload - * can be decrypted, which also will parse the contained payloads. - * Encryption is done the same way, added payloads will get generated - * and then encrypted. - * For signature building, there is the FULL packet needed. Meaning it - * must be builded after generation of all payloads and the encryption - * of the encryption payload. - * Signature verificatin is done before decryption. */ struct encryption_payload_t { + /** * Implements payload_t interface. */ payload_t payload_interface; /** - * Creates an iterator for all contained payloads. + * Get the payload length. * - * iterator_t object has to get destroyed by the caller. - * - * @param forward iterator direction (TRUE: front to end) - * return created iterator_t object + * @return (expected) payload length */ - iterator_t *(*create_payload_iterator) (encryption_payload_t *this, bool forward); + size_t (*get_length)(encryption_payload_t *this); /** * Adds a payload to this encryption payload. @@ -73,89 +59,39 @@ struct encryption_payload_t { void (*add_payload) (encryption_payload_t *this, payload_t *payload); /** - * Reove the last payload in the contained payload list. + * Remove the first payload in the list * * @param payload removed payload - * @return - * - SUCCESS, or - * - NOT_FOUND if list empty - */ - status_t (*remove_first_payload) (encryption_payload_t *this, payload_t **payload); - - /** - * Get the number of payloads. - * - * @return number of contained payloads + * @return payload, NULL if none left */ - size_t (*get_payload_count) (encryption_payload_t *this); + payload_t* (*remove_payload)(encryption_payload_t *this); /** - * Set transforms to use. - * - * To decryption, encryption, signature building and verifying, - * the payload needs a crypter and a signer object. + * Set the AEAD transform to use. * - * @warning Do NOT call this function again after encryption, since - * the signer must be the same while encrypting and signature building! - * - * @param crypter crypter_t to use for data de-/encryption - * @param signer signer_t to use for data signing/verifying + * @param aead aead transform to use */ - void (*set_transforms) (encryption_payload_t *this, crypter_t *crypter, signer_t *signer); + void (*set_transform) (encryption_payload_t *this, aead_t *aead); /** - * Generate and encrypt contained payloads. - * - * This function generates the content for added payloads - * and encrypts them. Signature is not built, since we need - * additional data (the full message). + * Generate, encrypt and sign contained payloads. * - * @return SUCCESS, or INVALID_STATE if transforms not set + * @param assoc associated data + * @return TRUE if encrypted */ - status_t (*encrypt) (encryption_payload_t *this); + bool (*encrypt) (encryption_payload_t *this, chunk_t assoc); /** - * Decrypt and parse contained payloads. - * - * This function decrypts the contained data. After, - * the payloads are parsed internally and are accessible - * via the iterator. - * - * @return - * - SUCCESS, or - * - INVALID_STATE if transforms not set, or - * - FAILED if data is invalid - */ - status_t (*decrypt) (encryption_payload_t *this); - - /** - * Build the signature. - * - * The signature is built over the FULL message, so the header - * and every payload (inclusive this one) must already be generated. - * The generated message is supplied via the data paramater. - * - * @param data chunk contains the already generated message - * @return - * - SUCCESS, or - * - INVALID_STATE if transforms not set - */ - status_t (*build_signature) (encryption_payload_t *this, chunk_t data); - - /** - * Verify the signature. - * - * Since the signature is built over the full message, we need - * this data to do the verification. The message data - * is supplied via the data argument. - * - * @param data chunk contains the message - * @return - * - SUCCESS, or - * - FAILED if signature invalid, or - * - INVALID_STATE if transforms not set + * Decrypt, verify and parse contained payloads. + * + * @param assoc associated data + * - SUCCESS if parsing successful + * - PARSE_ERROR if sub-payload parsing failed + * - VERIFY_ERROR if sub-payload verification failed + * - FAILED if integrity check failed + * - INVALID_STATE if aead not supplied, but needed */ - status_t (*verify_signature) (encryption_payload_t *this, chunk_t data); + status_t (*decrypt) (encryption_payload_t *this, chunk_t assoc); /** * Destroys an encryption_payload_t object. @@ -166,7 +102,7 @@ struct encryption_payload_t { /** * Creates an empty encryption_payload_t object. * - * @return encryption_payload_t object + * @return encryption_payload_t object */ encryption_payload_t *encryption_payload_create(void); diff --git a/src/libcharon/encoding/payloads/notify_payload.c b/src/libcharon/encoding/payloads/notify_payload.c index 469698ef5..a56fd1869 100644 --- a/src/libcharon/encoding/payloads/notify_payload.c +++ b/src/libcharon/encoding/payloads/notify_payload.c @@ -41,7 +41,7 @@ ENUM_NEXT(notify_type_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL "INVALID_KE_PAYLOAD"); ENUM_NEXT(notify_type_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD, "AUTHENTICATION_FAILED"); -ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHENTICATION_FAILED, +ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, CHILD_SA_NOT_FOUND, AUTHENTICATION_FAILED, "SINGLE_PAIR_REQUIRED", "NO_ADDITIONAL_SAS", "INTERNAL_ADDRESS_FAILURE", @@ -50,10 +50,12 @@ ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHENTICAT "INVALID_SELECTORS", "UNACCEPTABLE_ADDRESSES", "UNEXPECTED_NAT_DETECTED", - "USE_ASSIGNED_HoA"); -ENUM_NEXT(notify_type_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, USE_ASSIGNED_HoA, + "USE_ASSIGNED_HoA", + "TEMPORARY_FAILURE", + "CHILD_SA_NOT_FOUND"); +ENUM_NEXT(notify_type_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, CHILD_SA_NOT_FOUND, "ME_CONNECT_FAILED"); -ENUM_NEXT(notify_type_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED, +ENUM_NEXT(notify_type_names, INITIAL_CONTACT, EAP_ONLY_AUTHENTICATION, ME_CONNECT_FAILED, "INITIAL_CONTACT", "SET_WINDOW_SIZE", "ADDITIONAL_TS_POSSIBLE", @@ -84,8 +86,9 @@ ENUM_NEXT(notify_type_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED, "TICKET_ACK", "TICKET_NACK", "TICKET_OPAQUE", - "LINK_ID"); -ENUM_NEXT(notify_type_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, LINK_ID, + "LINK_ID", + "USE_WESP_MODE", + "ROHC_SUPPORTED", "EAP_ONLY_AUTHENTICATION"); ENUM_NEXT(notify_type_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION, "USE_BEET_MODE"); @@ -117,7 +120,7 @@ ENUM_NEXT(notify_type_short_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PR "INVAL_KE"); ENUM_NEXT(notify_type_short_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD, "AUTH_FAILED"); -ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHENTICATION_FAILED, +ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, CHILD_SA_NOT_FOUND, AUTHENTICATION_FAILED, "SINGLE_PAIR", "NO_ADD_SAS", "INT_ADDR_FAIL", @@ -126,10 +129,12 @@ ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHE "INVAL_SEL", "UNACCEPT_ADDR", "UNEXPECT_NAT", - "ASSIGNED_HoA"); -ENUM_NEXT(notify_type_short_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, USE_ASSIGNED_HoA, + "ASSIGNED_HoA", + "TEMP_FAIL", + "NO_CHILD_SA"); +ENUM_NEXT(notify_type_short_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, CHILD_SA_NOT_FOUND, "ME_CONN_FAIL"); -ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED, +ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, EAP_ONLY_AUTHENTICATION, ME_CONNECT_FAILED, "INIT_CONTACT", "SET_WINSIZE", "ADD_TS_POSS", @@ -160,8 +165,9 @@ ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED, "TKT_ACK", "TKT_NACK", "TKT_OPAK", - "LINK_ID"); -ENUM_NEXT(notify_type_short_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, LINK_ID, + "LINK_ID", + "WESP_MODE", + "ROHC_SUP", "EAP_ONLY"); ENUM_NEXT(notify_type_short_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION, "BEET_MODE"); @@ -238,29 +244,29 @@ struct private_notify_payload_t { */ encoding_rule_t notify_payload_encodings[] = { /* 1 Byte next payload type, stored in the field next_payload */ - { U_INT_8, offsetof(private_notify_payload_t, next_payload) }, + { U_INT_8, offsetof(private_notify_payload_t, next_payload) }, /* the critical bit */ - { FLAG, offsetof(private_notify_payload_t, critical) }, + { FLAG, offsetof(private_notify_payload_t, critical) }, /* 7 Bit reserved bits, nowhere stored */ - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, /* Length of the whole payload*/ - { PAYLOAD_LENGTH, offsetof(private_notify_payload_t, payload_length) }, + { PAYLOAD_LENGTH, offsetof(private_notify_payload_t, payload_length) }, /* Protocol ID as 8 bit field*/ - { U_INT_8, offsetof(private_notify_payload_t, protocol_id) }, + { U_INT_8, offsetof(private_notify_payload_t, protocol_id) }, /* SPI Size as 8 bit field*/ - { SPI_SIZE, offsetof(private_notify_payload_t, spi_size) }, + { SPI_SIZE, offsetof(private_notify_payload_t, spi_size) }, /* Notify message type as 16 bit field*/ { U_INT_16, offsetof(private_notify_payload_t, notify_type) }, /* SPI as variable length field*/ { SPI, offsetof(private_notify_payload_t, spi) }, /* Key Exchange Data is from variable size */ - { NOTIFICATION_DATA, offsetof(private_notify_payload_t, notification_data) } + { NOTIFICATION_DATA, offsetof(private_notify_payload_t, notification_data) } }; /* diff --git a/src/libcharon/encoding/payloads/notify_payload.h b/src/libcharon/encoding/payloads/notify_payload.h index 0e1bc23b8..8abc236e1 100644 --- a/src/libcharon/encoding/payloads/notify_payload.h +++ b/src/libcharon/encoding/payloads/notify_payload.h @@ -64,6 +64,9 @@ enum notify_type_t { UNEXPECTED_NAT_DETECTED = 41, /* mobile IPv6 bootstrapping, RFC 5026 */ USE_ASSIGNED_HoA = 42, + /* IKEv2 RFC 5996 */ + TEMPORARY_FAILURE = 43, + CHILD_SA_NOT_FOUND = 44, /* IKE-ME, private use */ ME_CONNECT_FAILED = 8192, @@ -98,16 +101,21 @@ enum notify_type_t { REDIRECT_SUPPORTED = 16406, REDIRECT = 16407, REDIRECTED_FROM = 16408, - /* draft-ietf-ipsecme-ikev2-resumption, assigned by IANA */ + /* session resumption, RFC 5723 */ TICKET_LT_OPAQUE = 16409, TICKET_REQUEST = 16410, TICKET_ACK = 16411, TICKET_NACK = 16412, TICKET_OPAQUE = 16413, + /* IPv6 configuration, RFC 5739 */ LINK_ID = 16414, + /* wrapped esp, RFC 5840 */ + USE_WESP_MODE = 16415, + /* robust header compression, RFC 5857 */ + ROHC_SUPPORTED = 16416, + /* EAP-only authentication, RFC 5998 */ + EAP_ONLY_AUTHENTICATION = 16417, - /* draft-eronen-ipsec-ikev2-eap-auth, not assigned by IANA yet */ - EAP_ONLY_AUTHENTICATION = 40960, /* BEET mode, not even a draft yet. private use */ USE_BEET_MODE = 40961, /* IKE-ME, private use */ @@ -144,7 +152,7 @@ struct notify_payload_t { /** * Gets the protocol id of this payload. * - * @return protocol id of this payload + * @return protocol id of this payload */ u_int8_t (*get_protocol_id) (notify_payload_t *this); @@ -158,7 +166,7 @@ struct notify_payload_t { /** * Gets the notify message type of this payload. * - * @return notify message type of this payload + * @return notify message type of this payload */ notify_type_t (*get_notify_type) (notify_payload_t *this); @@ -174,7 +182,7 @@ struct notify_payload_t { * * This is only valid for notifys with protocol AH|ESP * - * @return SPI value + * @return SPI value */ u_int32_t (*get_spi) (notify_payload_t *this); @@ -192,7 +200,7 @@ struct notify_payload_t { * * Returned data are not copied. * - * @return chunk_t pointing to the value + * @return chunk_t pointing to the value */ chunk_t (*get_notification_data) (notify_payload_t *this); @@ -201,7 +209,7 @@ struct notify_payload_t { * * @warning Value is getting copied. * - * @param notification_data chunk_t pointing to the value to set + * @param notification_data chunk_t pointing to the value to set */ void (*set_notification_data) (notify_payload_t *this, chunk_t notification_data); diff --git a/src/libcharon/encoding/payloads/proposal_substructure.c b/src/libcharon/encoding/payloads/proposal_substructure.c index c93f73a68..985b03255 100644 --- a/src/libcharon/encoding/payloads/proposal_substructure.c +++ b/src/libcharon/encoding/payloads/proposal_substructure.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2005-2006 Martin Willi + * Copyright (C) 2005-2010 Martin Willi * Copyright (C) 2005 Jan Hutter * Hochschule fuer Technik Rapperswil * @@ -24,20 +24,18 @@ #include <utils/linked_list.h> #include <daemon.h> - /** * IKEv1 Value for a proposal payload. */ #define PROPOSAL_TYPE_VALUE 2 - typedef struct private_proposal_substructure_t private_proposal_substructure_t; /** * Private data of an proposal_substructure_t object. - * */ struct private_proposal_substructure_t { + /** * Public proposal_substructure_t interface. */ @@ -92,24 +90,24 @@ struct private_proposal_substructure_t { */ encoding_rule_t proposal_substructure_encodings[] = { /* 1 Byte next payload type, stored in the field next_payload */ - { U_INT_8, offsetof(private_proposal_substructure_t, next_payload) }, + { U_INT_8, offsetof(private_proposal_substructure_t, next_payload) }, /* Reserved Byte is skipped */ - { RESERVED_BYTE, 0 }, + { RESERVED_BYTE, 0 }, /* Length of the whole proposal substructure payload*/ - { PAYLOAD_LENGTH, offsetof(private_proposal_substructure_t, proposal_length) }, + { PAYLOAD_LENGTH, offsetof(private_proposal_substructure_t, proposal_length) }, /* proposal number is a number of 8 bit */ - { U_INT_8, offsetof(private_proposal_substructure_t, proposal_number) }, + { U_INT_8, offsetof(private_proposal_substructure_t, proposal_number) }, /* protocol ID is a number of 8 bit */ - { U_INT_8, offsetof(private_proposal_substructure_t, protocol_id) }, + { U_INT_8, offsetof(private_proposal_substructure_t, protocol_id) }, /* SPI Size has its own type */ - { SPI_SIZE, offsetof(private_proposal_substructure_t, spi_size) }, + { SPI_SIZE, offsetof(private_proposal_substructure_t, spi_size) }, /* Number of transforms is a number of 8 bit */ - { U_INT_8, offsetof(private_proposal_substructure_t, transforms_count) }, + { U_INT_8, offsetof(private_proposal_substructure_t, transforms_count) }, /* SPI is a chunk of variable size*/ - { SPI, offsetof(private_proposal_substructure_t, spi) }, + { SPI, offsetof(private_proposal_substructure_t, spi) }, /* Transforms are stored in a transform substructure, offset points to a linked_list_t pointer */ - { TRANSFORMS, offsetof(private_proposal_substructure_t, transforms) } + { TRANSFORMS, offsetof(private_proposal_substructure_t, transforms) } }; /* @@ -128,16 +126,14 @@ encoding_rule_t proposal_substructure_encodings[] = { +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ -/** - * Implementation of payload_t.verify. - */ -static status_t verify(private_proposal_substructure_t *this) +METHOD(payload_t, verify, status_t, + private_proposal_substructure_t *this) { status_t status = SUCCESS; - iterator_t *iterator; - payload_t *current_transform; + enumerator_t *enumerator; + payload_t *current; - if ((this->next_payload != NO_PAYLOAD) && (this->next_payload != 2)) + if (this->next_payload != NO_PAYLOAD && this->next_payload != 2) { /* must be 0 or 2 */ DBG1(DBG_ENC, "inconsistent next payload"); @@ -169,61 +165,46 @@ static status_t verify(private_proposal_substructure_t *this) } break; default: - DBG1(DBG_ENC, "invalid proposal protocol (%d)", this->protocol_id); - return FAILED; - } - if ((this->protocol_id == 0) || (this->protocol_id >= 4)) - { - /* reserved are not supported */ - DBG1(DBG_ENC, "invalid protocol"); - return FAILED; + break; } - - iterator = this->transforms->create_iterator(this->transforms,TRUE); - while(iterator->iterate(iterator, (void**)¤t_transform)) + enumerator = this->transforms->create_enumerator(this->transforms); + while (enumerator->enumerate(enumerator, ¤t)) { - status = current_transform->verify(current_transform); + status = current->verify(current); if (status != SUCCESS) { DBG1(DBG_ENC, "TRANSFORM_SUBSTRUCTURE verification failed"); break; } } - iterator->destroy(iterator); + enumerator->destroy(enumerator); /* proposal number is checked in SA payload */ return status; } -/** - * Implementation of payload_t.get_encoding_rules. - */ -static void get_encoding_rules(private_proposal_substructure_t *this, encoding_rule_t **rules, size_t *rule_count) +METHOD(payload_t, get_encoding_rules, void, + private_proposal_substructure_t *this, encoding_rule_t **rules, + size_t *rule_count) { *rules = proposal_substructure_encodings; - *rule_count = sizeof(proposal_substructure_encodings) / sizeof(encoding_rule_t); + *rule_count = countof(proposal_substructure_encodings); } -/** - * Implementation of payload_t.get_type. - */ -static payload_type_t get_type(private_proposal_substructure_t *this) +METHOD(payload_t, get_type, payload_type_t, + private_proposal_substructure_t *this) { return PROPOSAL_SUBSTRUCTURE; } -/** - * Implementation of payload_t.get_next_type. - */ -static payload_type_t get_next_type(private_proposal_substructure_t *this) +METHOD(payload_t, get_next_type, payload_type_t, + private_proposal_substructure_t *this) { - return (this->next_payload); + return this->next_payload; } -/** - * Implementation of payload_t.set_next_type. - */ -static void set_next_type(private_proposal_substructure_t *this,payload_type_t type) +METHOD(payload_t, set_next_type, void, + private_proposal_substructure_t *this, payload_type_t type) { } @@ -250,145 +231,88 @@ static void compute_length(private_proposal_substructure_t *this) this->proposal_length = length; } -/** - * Implementation of payload_t.get_length. - */ -static size_t get_length(private_proposal_substructure_t *this) +METHOD(payload_t, get_length, size_t, + private_proposal_substructure_t *this) { compute_length(this); return this->proposal_length; } /** - * Implementation of proposal_substructure_t.create_transform_substructure_iterator. - */ -static iterator_t *create_transform_substructure_iterator (private_proposal_substructure_t *this,bool forward) -{ - return (this->transforms->create_iterator(this->transforms,forward)); -} - -/** - * Implementation of proposal_substructure_t.add_transform_substructure. + * Add a transform substructure to the proposal */ -static void add_transform_substructure (private_proposal_substructure_t *this,transform_substructure_t *transform) +static void add_transform_substructure(private_proposal_substructure_t *this, + transform_substructure_t *transform) { - status_t status; if (this->transforms->get_count(this->transforms) > 0) { - transform_substructure_t *last_transform; - status = this->transforms->get_last(this->transforms,(void **) &last_transform); - /* last transform is now not anymore last one */ - last_transform->set_is_last_transform(last_transform,FALSE); + transform_substructure_t *last; + this->transforms->get_last(this->transforms, (void **)&last); + last->set_is_last_transform(last, FALSE); } transform->set_is_last_transform(transform,TRUE); - - this->transforms->insert_last(this->transforms,(void *) transform); + this->transforms->insert_last(this->transforms, transform); compute_length(this); } -/** - * Implementation of proposal_substructure_t.proposal_substructure_t. - */ -static void set_is_last_proposal (private_proposal_substructure_t *this, bool is_last) +METHOD(proposal_substructure_t, set_is_last_proposal, void, + private_proposal_substructure_t *this, bool is_last) { - this->next_payload = (is_last) ? 0: PROPOSAL_TYPE_VALUE; + this->next_payload = is_last ? 0 : PROPOSAL_TYPE_VALUE; } -/** - * Implementation of proposal_substructure_t.set_proposal_number. - */ -static void set_proposal_number(private_proposal_substructure_t *this,u_int8_t proposal_number) +METHOD(proposal_substructure_t, set_proposal_number, void, + private_proposal_substructure_t *this,u_int8_t proposal_number) { this->proposal_number = proposal_number; } -/** - * Implementation of proposal_substructure_t.get_proposal_number. - */ -static u_int8_t get_proposal_number (private_proposal_substructure_t *this) +METHOD(proposal_substructure_t, get_proposal_number, u_int8_t, + private_proposal_substructure_t *this) { - return (this->proposal_number); + return this->proposal_number; } -/** - * Implementation of proposal_substructure_t.set_protocol_id. - */ -static void set_protocol_id(private_proposal_substructure_t *this,u_int8_t protocol_id) +METHOD(proposal_substructure_t, set_protocol_id, void, + private_proposal_substructure_t *this,u_int8_t protocol_id) { this->protocol_id = protocol_id; } -/** - * Implementation of proposal_substructure_t.get_protocol_id. - */ -static u_int8_t get_protocol_id(private_proposal_substructure_t *this) +METHOD(proposal_substructure_t, get_protocol_id, u_int8_t, + private_proposal_substructure_t *this) { - return (this->protocol_id); + return this->protocol_id; } -/** - * Implementation of proposal_substructure_t.set_spi. - */ -static void set_spi(private_proposal_substructure_t *this, chunk_t spi) +METHOD(proposal_substructure_t, set_spi, void, + private_proposal_substructure_t *this, chunk_t spi) { - /* first delete already set spi value */ - if (this->spi.ptr != NULL) - { - free(this->spi.ptr); - this->spi.ptr = NULL; - this->spi.len = 0; - compute_length(this); - } - - this->spi.ptr = clalloc(spi.ptr,spi.len); - this->spi.len = spi.len; + free(this->spi.ptr); + this->spi = chunk_clone(spi); this->spi_size = spi.len; compute_length(this); } -/** - * Implementation of proposal_substructure_t.get_spi. - */ -static chunk_t get_spi(private_proposal_substructure_t *this) -{ - chunk_t spi; - spi.ptr = this->spi.ptr; - spi.len = this->spi.len; - - return spi; -} - -/** - * Implementation of proposal_substructure_t.get_transform_count. - */ -static size_t get_transform_count (private_proposal_substructure_t *this) -{ - return this->transforms->get_count(this->transforms); -} - -/** - * Implementation of proposal_substructure_t.get_spi_size. - */ -static size_t get_spi_size (private_proposal_substructure_t *this) +METHOD(proposal_substructure_t, get_spi, chunk_t, + private_proposal_substructure_t *this) { - return this->spi.len; + return this->spi; } -/** - * Implementation of proposal_substructure_t.get_proposal. - */ -proposal_t* get_proposal(private_proposal_substructure_t *this) +METHOD(proposal_substructure_t, get_proposal, proposal_t*, + private_proposal_substructure_t *this) { - iterator_t *iterator; + enumerator_t *enumerator; transform_substructure_t *transform; proposal_t *proposal; u_int64_t spi; - proposal = proposal_create(this->protocol_id); + proposal = proposal_create(this->protocol_id, this->proposal_number); - iterator = this->transforms->create_iterator(this->transforms, TRUE); - while (iterator->iterate(iterator, (void**)&transform)) + enumerator = this->transforms->create_enumerator(this->transforms); + while (enumerator->enumerate(enumerator, &transform)) { transform_type_t transform_type; u_int16_t transform_id; @@ -400,7 +324,7 @@ proposal_t* get_proposal(private_proposal_substructure_t *this) proposal->add_algorithm(proposal, transform_type, transform_id, key_length); } - iterator->destroy(iterator); + enumerator->destroy(enumerator); switch (this->spi.len) { @@ -418,42 +342,36 @@ proposal_t* get_proposal(private_proposal_substructure_t *this) return proposal; } -/** - * Implementation of proposal_substructure_t.clone. - */ -static private_proposal_substructure_t* clone_(private_proposal_substructure_t *this) +METHOD(proposal_substructure_t, clone_, proposal_substructure_t*, + private_proposal_substructure_t *this) { private_proposal_substructure_t *clone; - iterator_t *transforms; - transform_substructure_t *current_transform; + enumerator_t *enumerator; + transform_substructure_t *current; - clone = (private_proposal_substructure_t *) proposal_substructure_create(); + clone = (private_proposal_substructure_t*)proposal_substructure_create(); clone->next_payload = this->next_payload; clone->proposal_number = this->proposal_number; clone->protocol_id = this->protocol_id; clone->spi_size = this->spi_size; if (this->spi.ptr != NULL) { - clone->spi.ptr = clalloc(this->spi.ptr,this->spi.len); + clone->spi.ptr = clalloc(this->spi.ptr, this->spi.len); clone->spi.len = this->spi.len; } - - transforms = this->transforms->create_iterator(this->transforms,FALSE); - while (transforms->iterate(transforms, (void**)¤t_transform)) + enumerator = this->transforms->create_enumerator(this->transforms); + while (enumerator->enumerate(enumerator, ¤t)) { - current_transform = current_transform->clone(current_transform); - clone->public.add_transform_substructure(&clone->public, current_transform); + current = current->clone(current); + add_transform_substructure(clone, current); } - transforms->destroy(transforms); + enumerator->destroy(enumerator); - return clone; + return &clone->public; } -/** - * Implements payload_t's and proposal_substructure_t's destroy function. - * See #payload_s.destroy or proposal_substructure_s.destroy for description. - */ -static void destroy(private_proposal_substructure_t *this) +METHOD2(payload_t, proposal_substructure_t, destroy, void, + private_proposal_substructure_t *this) { this->transforms->destroy_offset(this->transforms, offsetof(transform_substructure_t, destroy)); @@ -466,53 +384,42 @@ static void destroy(private_proposal_substructure_t *this) */ proposal_substructure_t *proposal_substructure_create() { - private_proposal_substructure_t *this = malloc_thing(private_proposal_substructure_t); - - /* interface functions */ - this->public.payload_interface.verify = (status_t (*) (payload_t *))verify; - this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules; - this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length; - this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type; - this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type; - this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type; - this->public.payload_interface.destroy = (void (*) (payload_t *))destroy; - - - /* public functions */ - this->public.create_transform_substructure_iterator = (iterator_t* (*) (proposal_substructure_t *,bool)) create_transform_substructure_iterator; - this->public.add_transform_substructure = (void (*) (proposal_substructure_t *,transform_substructure_t *)) add_transform_substructure; - this->public.set_proposal_number = (void (*) (proposal_substructure_t *,u_int8_t))set_proposal_number; - this->public.get_proposal_number = (u_int8_t (*) (proposal_substructure_t *)) get_proposal_number; - this->public.set_protocol_id = (void (*) (proposal_substructure_t *,u_int8_t))set_protocol_id; - this->public.get_protocol_id = (u_int8_t (*) (proposal_substructure_t *)) get_protocol_id; - this->public.set_is_last_proposal = (void (*) (proposal_substructure_t *,bool)) set_is_last_proposal; - this->public.get_proposal = (proposal_t* (*) (proposal_substructure_t*))get_proposal; - this->public.set_spi = (void (*) (proposal_substructure_t *,chunk_t))set_spi; - this->public.get_spi = (chunk_t (*) (proposal_substructure_t *)) get_spi; - this->public.get_transform_count = (size_t (*) (proposal_substructure_t *)) get_transform_count; - this->public.get_spi_size = (size_t (*) (proposal_substructure_t *)) get_spi_size; - this->public.clone = (proposal_substructure_t * (*) (proposal_substructure_t *)) clone_; - this->public.destroy = (void (*) (proposal_substructure_t *)) destroy; - - /* set default values of the fields */ - this->next_payload = NO_PAYLOAD; - this->proposal_length = 0; - this->proposal_number = 0; - this->protocol_id = 0; - this->transforms_count = 0; - this->spi_size = 0; - this->spi.ptr = NULL; - this->spi.len = 0; - - this->transforms = linked_list_create(); - - return (&(this->public)); + private_proposal_substructure_t *this; + + INIT(this, + .public = { + .payload_interface = { + .verify = _verify, + .get_encoding_rules = _get_encoding_rules, + .get_length = _get_length, + .get_next_type = _get_next_type, + .set_next_type = _set_next_type, + .get_type = _get_type, + .destroy = _destroy, + }, + .set_proposal_number = _set_proposal_number, + .get_proposal_number = _get_proposal_number, + .set_protocol_id = _set_protocol_id, + .get_protocol_id = _get_protocol_id, + .set_is_last_proposal = _set_is_last_proposal, + .get_proposal = _get_proposal, + .set_spi = _set_spi, + .get_spi = _get_spi, + .clone = _clone_, + .destroy = _destroy, + }, + .next_payload = NO_PAYLOAD, + .transforms = linked_list_create(), + ); + + return &this->public; } /* * Described in header. */ -proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *proposal) +proposal_substructure_t *proposal_substructure_create_from_proposal( + proposal_t *proposal) { transform_substructure_t *transform; private_proposal_substructure_t *this; @@ -591,7 +498,7 @@ proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t * default: break; } - this->proposal_number = 0; + this->proposal_number = proposal->get_number(proposal); this->protocol_id = proposal->get_protocol(proposal); return &this->public; diff --git a/src/libcharon/encoding/payloads/proposal_substructure.h b/src/libcharon/encoding/payloads/proposal_substructure.h index 4934802af..56e7184b6 100644 --- a/src/libcharon/encoding/payloads/proposal_substructure.h +++ b/src/libcharon/encoding/payloads/proposal_substructure.h @@ -42,36 +42,19 @@ typedef struct proposal_substructure_t proposal_substructure_t; * The PROPOSAL SUBSTRUCTURE format is described in RFC section 3.3.1. */ struct proposal_substructure_t { + /** * The payload_t interface. */ payload_t payload_interface; /** - * Creates an iterator of stored transform_substructure_t objects. - * - * @param forward iterator direction (TRUE: front to end) - * @return created iterator_t object - */ - iterator_t *(*create_transform_substructure_iterator) ( - proposal_substructure_t *this, bool forward); - - /** - * Adds a transform_substructure_t object to this object. - * - * @param transform transform_substructure_t object to add - */ - void (*add_transform_substructure) (proposal_substructure_t *this, - transform_substructure_t *transform); - - /** * Sets the proposal number of current proposal. * * @param id proposal number to set */ void (*set_proposal_number) (proposal_substructure_t *this, u_int8_t proposal_number); - /** * get proposal number of current proposal. * @@ -80,20 +63,6 @@ struct proposal_substructure_t { u_int8_t (*get_proposal_number) (proposal_substructure_t *this); /** - * get the number of transforms in current proposal. - * - * @return transform count in current proposal - */ - size_t (*get_transform_count) (proposal_substructure_t *this); - - /** - * get size of the set spi in bytes. - * - * @return size of the spi in bytes - */ - size_t (*get_spi_size) (proposal_substructure_t *this); - - /** * Sets the protocol id of current proposal. * * @param id protocol id to set diff --git a/src/libcharon/encoding/payloads/sa_payload.c b/src/libcharon/encoding/payloads/sa_payload.c index 187a8fee0..4fbd4cac0 100644 --- a/src/libcharon/encoding/payloads/sa_payload.c +++ b/src/libcharon/encoding/payloads/sa_payload.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2005-2006 Martin Willi + * Copyright (C) 2005-2010 Martin Willi * Copyright (C) 2005 Jan Hutter * Hochschule fuer Technik Rapperswil * @@ -27,9 +27,9 @@ typedef struct private_sa_payload_t private_sa_payload_t; /** * Private data of an sa_payload_t object. - * */ struct private_sa_payload_t { + /** * Public sa_payload_t interface. */ @@ -61,26 +61,25 @@ struct private_sa_payload_t { * * The defined offsets are the positions in a object of type * private_sa_payload_t. - * */ encoding_rule_t sa_payload_encodings[] = { /* 1 Byte next payload type, stored in the field next_payload */ - { U_INT_8, offsetof(private_sa_payload_t, next_payload) }, + { U_INT_8, offsetof(private_sa_payload_t, next_payload) }, /* the critical bit */ - { FLAG, offsetof(private_sa_payload_t, critical) }, + { FLAG, offsetof(private_sa_payload_t, critical) }, /* 7 Bit reserved bits, nowhere stored */ - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, - { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, + { RESERVED_BIT, 0 }, /* Length of the whole SA payload*/ - { PAYLOAD_LENGTH, offsetof(private_sa_payload_t, payload_length) }, + { PAYLOAD_LENGTH, offsetof(private_sa_payload_t, payload_length) }, /* Proposals are stored in a proposal substructure, offset points to a linked_list_t pointer */ - { PROPOSALS, offsetof(private_sa_payload_t, proposals) } + { PROPOSALS, offsetof(private_sa_payload_t, proposals) }, }; /* @@ -95,26 +94,23 @@ encoding_rule_t sa_payload_encodings[] = { +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ -/** - * Implementation of payload_t.verify. - */ -static status_t verify(private_sa_payload_t *this) +METHOD(payload_t, verify, status_t, + private_sa_payload_t *this) { int expected_number = 1, current_number; status_t status = SUCCESS; - iterator_t *iterator; - proposal_substructure_t *current_proposal; + enumerator_t *enumerator; + proposal_substructure_t *substruct; bool first = TRUE; /* check proposal numbering */ - iterator = this->proposals->create_iterator(this->proposals,TRUE); - - while(iterator->iterate(iterator, (void**)¤t_proposal)) + enumerator = this->proposals->create_enumerator(this->proposals); + while (enumerator->enumerate(enumerator, (void**)&substruct)) { - current_number = current_proposal->get_proposal_number(current_proposal); + current_number = substruct->get_proposal_number(substruct); if (current_number < expected_number) { - if (current_number != (expected_number + 1)) + if (current_number != expected_number + 1) { DBG1(DBG_ENC, "proposal number is %d, expected %d or %d", current_number, expected_number, expected_number + 1); @@ -124,13 +120,12 @@ static status_t verify(private_sa_payload_t *this) } else if (current_number < expected_number) { - /* must not be smaller then proceeding one */ - DBG1(DBG_ENC, "proposal number smaller than that of previous proposal"); + DBG1(DBG_ENC, "proposal number smaller than previous"); status = FAILED; break; } - status = current_proposal->payload_interface.verify(&(current_proposal->payload_interface)); + status = substruct->payload_interface.verify(&substruct->payload_interface); if (status != SUCCESS) { DBG1(DBG_ENC, "PROPOSAL_SUBSTRUCTURE verification failed"); @@ -139,52 +134,31 @@ static status_t verify(private_sa_payload_t *this) first = FALSE; expected_number = current_number; } - - iterator->destroy(iterator); + enumerator->destroy(enumerator); return status; } - -/** - * Implementation of payload_t.destroy and sa_payload_t.destroy. - */ -static status_t destroy(private_sa_payload_t *this) -{ - this->proposals->destroy_offset(this->proposals, - offsetof(proposal_substructure_t, destroy)); - free(this); - return SUCCESS; -} - -/** - * Implementation of payload_t.get_encoding_rules. - */ -static void get_encoding_rules(private_sa_payload_t *this, encoding_rule_t **rules, size_t *rule_count) +METHOD(payload_t, get_encoding_rules, void, + private_sa_payload_t *this, encoding_rule_t **rules, size_t *rule_count) { *rules = sa_payload_encodings; - *rule_count = sizeof(sa_payload_encodings) / sizeof(encoding_rule_t); + *rule_count = countof(sa_payload_encodings); } -/** - * Implementation of payload_t.get_type. - */ -static payload_type_t get_type(private_sa_payload_t *this) +METHOD(payload_t, get_type, payload_type_t, + private_sa_payload_t *this) { return SECURITY_ASSOCIATION; } -/** - * Implementation of payload_t.get_next_type. - */ -static payload_type_t get_next_type(private_sa_payload_t *this) +METHOD(payload_t, get_next_type, payload_type_t, + private_sa_payload_t *this) { - return (this->next_payload); + return this->next_payload; } -/** - * Implementation of payload_t.set_next_type. - */ -static void set_next_type(private_sa_payload_t *this,payload_type_t type) +METHOD(payload_t, set_next_type, void, + private_sa_payload_t *this,payload_type_t type) { this->next_payload = type; } @@ -192,116 +166,104 @@ static void set_next_type(private_sa_payload_t *this,payload_type_t type) /** * recompute length of the payload. */ -static void compute_length (private_sa_payload_t *this) +static void compute_length(private_sa_payload_t *this) { - iterator_t *iterator; - payload_t *current_proposal; + enumerator_t *enumerator; + payload_t *current; size_t length = SA_PAYLOAD_HEADER_LENGTH; - iterator = this->proposals->create_iterator(this->proposals,TRUE); - while (iterator->iterate(iterator, (void **)¤t_proposal)) + enumerator = this->proposals->create_enumerator(this->proposals); + while (enumerator->enumerate(enumerator, (void **)¤t)) { - length += current_proposal->get_length(current_proposal); + length += current->get_length(current); } - iterator->destroy(iterator); + enumerator->destroy(enumerator); this->payload_length = length; } -/** - * Implementation of payload_t.get_length. - */ -static size_t get_length(private_sa_payload_t *this) +METHOD(payload_t, get_length, size_t, + private_sa_payload_t *this) { compute_length(this); return this->payload_length; } -/** - * Implementation of sa_payload_t.create_proposal_substructure_iterator. - */ -static iterator_t *create_proposal_substructure_iterator (private_sa_payload_t *this,bool forward) +METHOD(sa_payload_t, add_proposal, void, + private_sa_payload_t *this, proposal_t *proposal) { - return this->proposals->create_iterator(this->proposals,forward); -} + proposal_substructure_t *substruct, *last; + u_int count; -/** - * Implementation of sa_payload_t.add_proposal_substructure. - */ -static void add_proposal_substructure(private_sa_payload_t *this,proposal_substructure_t *proposal) -{ - status_t status; - u_int proposal_count = this->proposals->get_count(this->proposals); - - if (proposal_count > 0) + count = this->proposals->get_count(this->proposals); + substruct = proposal_substructure_create_from_proposal(proposal); + if (count > 0) { - proposal_substructure_t *last_proposal; - status = this->proposals->get_last(this->proposals,(void **) &last_proposal); + this->proposals->get_last(this->proposals, (void**)&last); /* last transform is now not anymore last one */ - last_proposal->set_is_last_proposal(last_proposal, FALSE); + last->set_is_last_proposal(last, FALSE); + } + substruct->set_is_last_proposal(substruct, TRUE); + if (proposal->get_number(proposal)) + { /* use the selected proposals number, if any */ + substruct->set_proposal_number(substruct, proposal->get_number(proposal)); + } + else + { + substruct->set_proposal_number(substruct, count + 1); } - proposal->set_is_last_proposal(proposal, TRUE); - proposal->set_proposal_number(proposal, proposal_count + 1); - this->proposals->insert_last(this->proposals,(void *) proposal); + this->proposals->insert_last(this->proposals, substruct); compute_length(this); } -/** - * Implementation of sa_payload_t.add_proposal. - */ -static void add_proposal(private_sa_payload_t *this, proposal_t *proposal) -{ - proposal_substructure_t *substructure; - - substructure = proposal_substructure_create_from_proposal(proposal); - add_proposal_substructure(this, substructure); -} - -/** - * Implementation of sa_payload_t.get_proposals. - */ -static linked_list_t *get_proposals(private_sa_payload_t *this) +METHOD(sa_payload_t, get_proposals, linked_list_t*, + private_sa_payload_t *this) { int struct_number = 0; int ignore_struct_number = 0; - iterator_t *iterator; - proposal_substructure_t *proposal_struct; - linked_list_t *proposal_list; - - /* this list will hold our proposals */ - proposal_list = linked_list_create(); + enumerator_t *enumerator; + proposal_substructure_t *substruct; + linked_list_t *list; + proposal_t *proposal; + list = linked_list_create(); /* we do not support proposals split up to two proposal substructures, as * AH+ESP bundles are not supported in RFC4301 anymore. * To handle such structures safely, we just skip proposals with multiple * protocols. */ - iterator = this->proposals->create_iterator(this->proposals, TRUE); - while (iterator->iterate(iterator, (void **)&proposal_struct)) + enumerator = this->proposals->create_enumerator(this->proposals); + while (enumerator->enumerate(enumerator, &substruct)) { - proposal_t *proposal; - /* check if a proposal has a single protocol */ - if (proposal_struct->get_proposal_number(proposal_struct) == struct_number) + if (substruct->get_proposal_number(substruct) == struct_number) { if (ignore_struct_number < struct_number) { - /* remova an already added, if first of series */ - proposal_list->remove_last(proposal_list, (void**)&proposal); + /* remove an already added, if first of series */ + list->remove_last(list, (void**)&proposal); proposal->destroy(proposal); ignore_struct_number = struct_number; } continue; } struct_number++; - proposal = proposal_struct->get_proposal(proposal_struct); + proposal = substruct->get_proposal(substruct); if (proposal) { - proposal_list->insert_last(proposal_list, proposal); + list->insert_last(list, proposal); } } - iterator->destroy(iterator); - return proposal_list; + enumerator->destroy(enumerator); + return list; +} + +METHOD2(payload_t, sa_payload_t, destroy, void, + private_sa_payload_t *this) +{ + this->proposals->destroy_offset(this->proposals, + offsetof(proposal_substructure_t, destroy)); + free(this); } /* @@ -309,29 +271,27 @@ static linked_list_t *get_proposals(private_sa_payload_t *this) */ sa_payload_t *sa_payload_create() { - private_sa_payload_t *this = malloc_thing(private_sa_payload_t); - - /* public interface */ - this->public.payload_interface.verify = (status_t (*) (payload_t *))verify; - this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules; - this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length; - this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type; - this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type; - this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type; - this->public.payload_interface.destroy = (void (*) (payload_t *))destroy; - - /* public functions */ - this->public.create_proposal_substructure_iterator = (iterator_t* (*) (sa_payload_t *,bool)) create_proposal_substructure_iterator; - this->public.add_proposal_substructure = (void (*) (sa_payload_t *,proposal_substructure_t *)) add_proposal_substructure; - this->public.add_proposal = (void (*) (sa_payload_t*,proposal_t*))add_proposal; - this->public.get_proposals = (linked_list_t* (*) (sa_payload_t *)) get_proposals; - this->public.destroy = (void (*) (sa_payload_t *)) destroy; - - /* set default values of the fields */ - this->critical = FALSE; - this->next_payload = NO_PAYLOAD; - this->payload_length = SA_PAYLOAD_HEADER_LENGTH; - this->proposals = linked_list_create(); + private_sa_payload_t *this; + + INIT(this, + .public = { + .payload_interface = { + .verify = _verify, + .get_encoding_rules = _get_encoding_rules, + .get_length = _get_length, + .get_next_type = _get_next_type, + .set_next_type = _set_next_type, + .get_type = _get_type, + .destroy = _destroy, + }, + .add_proposal = _add_proposal, + .get_proposals = _get_proposals, + .destroy = _destroy, + }, + .next_payload = NO_PAYLOAD, + .payload_length = SA_PAYLOAD_HEADER_LENGTH, + .proposals = linked_list_create(), + ); return &this->public; } @@ -340,19 +300,19 @@ sa_payload_t *sa_payload_create() */ sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals) { - iterator_t *iterator; + private_sa_payload_t *this; + enumerator_t *enumerator; proposal_t *proposal; - sa_payload_t *sa_payload = sa_payload_create(); - /* add every payload from the list */ - iterator = proposals->create_iterator(proposals, TRUE); - while (iterator->iterate(iterator, (void**)&proposal)) + this = (private_sa_payload_t*)sa_payload_create(); + enumerator = proposals->create_enumerator(proposals); + while (enumerator->enumerate(enumerator, &proposal)) { - add_proposal((private_sa_payload_t*)sa_payload, proposal); + add_proposal(this, proposal); } - iterator->destroy(iterator); + enumerator->destroy(enumerator); - return sa_payload; + return &this->public; } /* @@ -360,9 +320,10 @@ sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals) */ sa_payload_t *sa_payload_create_from_proposal(proposal_t *proposal) { - sa_payload_t *sa_payload = sa_payload_create(); + private_sa_payload_t *this; - add_proposal((private_sa_payload_t*)sa_payload, proposal); + this = (private_sa_payload_t*)sa_payload_create(); + add_proposal(this, proposal); - return sa_payload; + return &this->public; } diff --git a/src/libcharon/encoding/payloads/sa_payload.h b/src/libcharon/encoding/payloads/sa_payload.h index 25f5a2407..801a70738 100644 --- a/src/libcharon/encoding/payloads/sa_payload.h +++ b/src/libcharon/encoding/payloads/sa_payload.h @@ -40,33 +40,13 @@ typedef struct sa_payload_t sa_payload_t; * The SA Payload format is described in RFC section 3.3. */ struct sa_payload_t { + /** * The payload_t interface. */ payload_t payload_interface; /** - * Creates an iterator of stored proposal_substructure_t objects. - * - * When deleting an proposal using this iterator, - * the length of this transform substructure has to be refreshed - * by calling get_length()! - * - * @param forward iterator direction (TRUE: front to end) - * @return created iterator_t object - */ - iterator_t *(*create_proposal_substructure_iterator) (sa_payload_t *this, - bool forward); - - /** - * Adds a proposal_substructure_t object to this object. - * - * @param proposal proposal_substructure_t object to add - */ - void (*add_proposal_substructure) (sa_payload_t *this, - proposal_substructure_t *proposal); - - /** * Gets the proposals in this payload as a list. * * @return a list containing proposal_t s |