denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merged the modularization branch (credentials) back to trunk

Browse Source
This commit is contained in:
Martin Willi
2008-03-13 14:14:44 +00:00
parent 2df655134c
commit 552cc11b1f
495 changed files with 30378 additions and 23843 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Doxyfile.in
+2 -2
View File
@@ -70,12 +70,12 @@ WARN_LOGFILE =
#---------------------------------------------------------------------------
# configuration options related to the input files
#---------------------------------------------------------------------------
INPUT = src/libstrongswan src/charon
INPUT = src/libstrongswan src/charon src/libfast src/manager
FILE_PATTERNS = *.h
RECURSIVE = YES
EXCLUDE =
EXCLUDE_SYMLINKS = NO
EXCLUDE_PATTERNS =
EXCLUDE_PATTERNS = */.svn/*
EXAMPLE_PATH =
EXAMPLE_PATTERNS =
EXAMPLE_RECURSIVE = NO
configure.in
+197 -39
View File
@@ -72,6 +72,7 @@ AC_ARG_WITH(
[AC_SUBST(ipsecdir, "$withval")],
[AC_SUBST(ipsecdir, "${libexecdir}/ipsec")]
)
AC_SUBST(plugindir, "${ipsecdir}/plugins")
AC_ARG_WITH(
[plugindir],
@@ -80,32 +81,11 @@ AC_ARG_WITH(
[AC_SUBST(plugindir, "${ipsecdir}/plugins")]
)
AC_ARG_WITH(
[eapdir],
AS_HELP_STRING([--with-eapdir=dir],[path for pluggable EAP modules other than "plugindir/eap"]),
[AC_SUBST(eapdir, "$withval")],
[AC_SUBST(eapdir, "${plugindir}/eap")]
)
AC_ARG_WITH(
[backenddir],
AS_HELP_STRING([--with-backenddir=dir],[path for pluggable configuration backend modules other than "plugindir/backends"]),
[AC_SUBST(backenddir, "$withval")],
[AC_SUBST(backenddir, "${plugindir}/backends")]
)
AC_ARG_WITH(
[interfacedir],
AS_HELP_STRING([--with-interfacedir=dir],[path for pluggable control interface modules other than "plugindir/interfaces"]),
[AC_SUBST(interfacedir, "$withval")],
[AC_SUBST(interfacedir, "${plugindir}/interfaces")]
)
AC_ARG_WITH(
[sim-reader],
AS_HELP_STRING([--with-sim-reader=library.so],[library containing the sim_run_alg()/sim_get_triplet() function for EAP-SIM]),
[AC_SUBST(simreader, "$withval")],
[AC_SUBST(simreader, "${plugindir}/libcharon-eapsim-file.so")]
[AC_SUBST(simreader, "${plugindir}/libeapsim-file.so")]
)
AC_ARG_WITH(
@@ -144,24 +124,148 @@ AC_ARG_WITH(
)
AC_ARG_ENABLE(
[http],
AS_HELP_STRING([--enable-http],[enable OCSP and fetching of Certificates and CRLs over HTTP (default is NO). Requires libcurl.]),
[curl],
AS_HELP_STRING([--enable-curl],[enable CURL fetcher plugin to fetch files via libcurl (default is NO). Requires libcurl.]),
[if test x$enableval = xyes; then
http=true
AC_DEFINE(LIBCURL)
curl=true
fi]
)
AM_CONDITIONAL(USE_LIBCURL, test x$http = xtrue)
AM_CONDITIONAL(USE_CURL, test x$curl = xtrue)
AC_ARG_ENABLE(
[ldap],
AS_HELP_STRING([--enable-ldap],[enable fetching of CRLs from LDAP (default is NO). Requires openLDAP.]),
AS_HELP_STRING([--enable-ldap],[enable LDAP fetching plugin to fetch files via libldap (default is NO). Requires openLDAP.]),
[if test x$enableval = xyes; then
ldap=true
AC_DEFINE(LIBLDAP)
fi]
)
AM_CONDITIONAL(USE_LIBLDAP, test x$ldap = xtrue)
AM_CONDITIONAL(USE_LDAP, test x$ldap = xtrue)
AC_ARG_ENABLE(
[aes],
AS_HELP_STRING([--disable-aes],[disable own AES software implementation plugin. (default is NO).]),
[if test x$enableval = xyes; then
aes=true
else
aes=false
fi],
aes=true
)
AM_CONDITIONAL(USE_AES, test x$aes = xtrue)
AC_ARG_ENABLE(
[des],
AS_HELP_STRING([--disable-des],[disable own DES/3DES software implementation plugin. (default is NO).]),
[if test x$enableval = xyes; then
des=true
else
des=false
fi],
des=true
)
AM_CONDITIONAL(USE_DES, test x$des = xtrue)
AC_ARG_ENABLE(
[md5],
AS_HELP_STRING([--disable-md5],[disable own MD5 software implementation plugin. (default is NO).]),
[if test x$enableval = xyes; then
md5=true
else
md5=false
fi],
md5=true
)
AM_CONDITIONAL(USE_MD5, test x$md5 = xtrue)
AC_ARG_ENABLE(
[sha1],
AS_HELP_STRING([--disable-sha1],[disable own SHA1 software implementation plugin. (default is NO).]),
[if test x$enableval = xyes; then
sha1=true
else
sha1=false
fi],
sha1=true
)
AM_CONDITIONAL(USE_SHA1, test x$sha1 = xtrue)
AC_ARG_ENABLE(
[sha2],
AS_HELP_STRING([--disable-sha2],[disable own SHA256/SHA384/SHA512 software implementation plugin. (default is NO).]),
[if test x$enableval = xyes; then
sha2=true
else
sha2=false
fi],
sha2=true
)
AM_CONDITIONAL(USE_SHA2, test x$sha2 = xtrue)
AC_ARG_ENABLE(
[fips-prf],
AS_HELP_STRING([--disable-fips-prf],[disable FIPS PRF software implementation plugin. (default is NO).]),
[if test x$enableval = xyes; then
fips_prf=true
else
fips_prf=false
fi],
fips_prf=true
)
AM_CONDITIONAL(USE_FIPS_PRF, test x$fips_prf = xtrue)
AC_ARG_ENABLE(
[gmp],
AS_HELP_STRING([--disable-gmp],[disable own GNU MP (libgmp) based crypto implementation plugin. (default is NO).]),
[if test x$enableval = xyes; then
gmp=true
else
gmp=false
fi],
gmp=true
)
AM_CONDITIONAL(USE_GMP, test x$gmp = xtrue)
AC_ARG_ENABLE(
[x509],
AS_HELP_STRING([--disable-x509],[disable own X509 certificate implementation plugin. (default is NO).]),
[if test x$enableval = xyes; then
x509=true
else
x509=false
fi],
x509=true
)
AM_CONDITIONAL(USE_X509, test x$x509 = xtrue)
AC_ARG_ENABLE(
[hmac],
AS_HELP_STRING([--disable-hmac],[disable HMAC crypto implementation plugin. (default is NO).]),
[if test x$enableval = xyes; then
hmac=true
else
hmac=false
fi],
hmac=true
)
AM_CONDITIONAL(USE_HMAC, test x$hmac = xtrue)
AC_ARG_ENABLE(
[mysql],
AS_HELP_STRING([--enable-mysql],[enable MySQL database support (default is NO). Requires libmysqlclient_r.]),
[if test x$enableval = xyes; then
mysql=true
fi]
)
AM_CONDITIONAL(USE_MYSQL, test x$mysql = xtrue)
AC_ARG_ENABLE(
[sqlite],
AS_HELP_STRING([--enable-sqlite],[enable SQLite database support (default is NO). Requires libsqlite3.]),
[if test x$enableval = xyes; then
sqlite=true
fi]
)
AM_CONDITIONAL(USE_SQLITE, test x$sqlite = xtrue)
AC_ARG_ENABLE(
[stroke],
@@ -175,6 +279,16 @@ AC_ARG_ENABLE(
)
AM_CONDITIONAL(USE_STROKE, test x$stroke = xtrue)
AC_ARG_ENABLE(
[med-db],
AS_HELP_STRING([--enable-med-db],[enable MySQL mediation database plugin (default is NO).]),
[if test x$enableval = xyes; then
med_db=true
AC_DEFINE(LIBDBUS)
fi]
)
AM_CONDITIONAL(USE_MED_DB, test x$med_db = xtrue)
AC_ARG_ENABLE(
[dbus],
AS_HELP_STRING([--enable-dbus],[enable DBUS configuration and control interface (default is NO). Requires libdbus.]),
@@ -196,14 +310,13 @@ AC_ARG_ENABLE(
AM_CONDITIONAL(USE_LIBXML, test x$xml = xtrue)
AC_ARG_ENABLE(
[sqlite],
AS_HELP_STRING([--enable-sqlite],[enable SQLite configuration backend (default is NO). Requires libsqlite3.]),
[sql],
AS_HELP_STRING([--enable-sql],[enable SQL database configuration backend (default is NO).]),
[if test x$enableval = xyes; then
sqlite=true
AC_DEFINE(LIBSQLITE)
sql=true
fi]
)
AM_CONDITIONAL(USE_LIBSQLITE, test x$sqlite = xtrue)
AM_CONDITIONAL(USE_SQL, test x$sql = xtrue)
AC_ARG_ENABLE(
[smartcard],
@@ -233,6 +346,15 @@ AC_ARG_ENABLE(
)
AM_CONDITIONAL(USE_LEAK_DETECTIVE, test x$leak_detective = xtrue)
AC_ARG_ENABLE(
[unit-tests],
AS_HELP_STRING([--enable-unit-tests],[enable unit tests on IKEv2 daemon startup (default is NO).]),
[if test x$enableval = xyes; then
unittest=true
fi]
)
AM_CONDITIONAL(USE_UNIT_TESTS, test x$unittest = xtrue)
AC_ARG_ENABLE(
[eap-sim],
AS_HELP_STRING([--enable-eap-sim],[build SIM authenication module for EAP (default is NO).]),
@@ -311,6 +433,15 @@ AC_ARG_ENABLE(
)
AM_CONDITIONAL(USE_UML, test x$uml = xtrue)
AC_ARG_ENABLE(
[fast],
AS_HELP_STRING([--enable-fast],[build libfast (FastCGI Application Server w/ templates (default is NO).]),
[if test x$enableval = xyes; then
fast=true
fi]
)
AM_CONDITIONAL(USE_FAST, test x$fast = xtrue)
AC_ARG_ENABLE(
[manager],
AS_HELP_STRING([--enable-manager],[build web management console (default is NO).]),
@@ -409,7 +540,10 @@ dnl ==========================
dnl check required libraries
dnl ==========================
AC_HAVE_LIBRARY(dl)
AC_CHECK_FUNCS(backtrace)
AC_CHECK_FUNCS(dladdr)
AC_CHECK_FUNCS(getifaddrs)
AC_HAVE_LIBRARY([gmp],[LIBS="$LIBS"],[AC_MSG_ERROR([GNU Multi Precision library gmp not found])])
@@ -417,8 +551,8 @@ if test "$ldap" = "true"; then
AC_HAVE_LIBRARY([ldap],[LIBS="$LIBS"],[AC_MSG_ERROR([LDAP enabled, but library ldap not found])])
AC_HAVE_LIBRARY([lber],[LIBS="$LIBS"],[AC_MSG_ERROR([LDAP enabled, but library lber not found])])
fi
if test "$http" = "true"; then
AC_HAVE_LIBRARY([curl],[LIBS="$LIBS"],[AC_MSG_ERROR([HTTP enabled, but library curl not found])])
if test "$curl" = "true"; then
AC_HAVE_LIBRARY([curl],[LIBS="$LIBS"],[AC_MSG_ERROR([CURL enabled, but library curl not found])])
fi
if test "$xml" = "true"; then
@@ -460,8 +594,8 @@ AC_TRY_COMPILE(
if test "$ldap" = "true"; then
AC_CHECK_HEADER([ldap.h],,[AC_MSG_ERROR([LDAP enabled, but ldap.h not found!])])
fi
if test "$http" = "true"; then
AC_CHECK_HEADER([curl/curl.h],,[AC_MSG_ERROR([HTTP enabled, but curl.h not found!])])
if test "$curl" = "true"; then
AC_CHECK_HEADER([curl/curl.h],,[AC_MSG_ERROR([CURL enabled, but curl.h not found!])])
fi
dnl ==============================
@@ -473,11 +607,34 @@ AC_OUTPUT(
src/Makefile
src/include/Makefile
src/libstrongswan/Makefile
src/libstrongswan/plugins/aes/Makefile
src/libstrongswan/plugins/des/Makefile
src/libstrongswan/plugins/md5/Makefile
src/libstrongswan/plugins/sha1/Makefile
src/libstrongswan/plugins/sha2/Makefile
src/libstrongswan/plugins/fips_prf/Makefile
src/libstrongswan/plugins/gmp/Makefile
src/libstrongswan/plugins/hmac/Makefile
src/libstrongswan/plugins/x509/Makefile
src/libstrongswan/plugins/curl/Makefile
src/libstrongswan/plugins/ldap/Makefile
src/libstrongswan/plugins/mysql/Makefile
src/libstrongswan/plugins/sqlite/Makefile
src/libcrypto/Makefile
src/libfreeswan/Makefile
src/pluto/Makefile
src/whack/Makefile
src/charon/Makefile
src/charon/plugins/eap_aka/Makefile
src/charon/plugins/eap_identity/Makefile
src/charon/plugins/eap_md5/Makefile
src/charon/plugins/eap_sim/Makefile
src/charon/plugins/dbus/Makefile
src/charon/plugins/xml/Makefile
src/charon/plugins/sql/Makefile
src/charon/plugins/med_db/Makefile
src/charon/plugins/stroke/Makefile
src/charon/plugins/unit_tester/Makefile
src/stroke/Makefile
src/ipsec/Makefile
src/starter/Makefile
@@ -487,6 +644,7 @@ AC_OUTPUT(
src/openac/Makefile
src/scepclient/Makefile
src/dumm/Makefile
src/libfast/Makefile
src/manager/Makefile
testing/Makefile
)
scripts/cfg-leak
+2 -2
View File
@@ -1,4 +1,4 @@
#!/bin/bash
CFLAGS="-Wall -Wno-format -Wno-pointer-sign -Wno-strict-aliasing -g -O2" ./configure \
--sysconfdir=/etc --with-random-device=/dev/urandom \
--enable-leak-detective
--sysconfdir=/etc --disable-tools --disable-pluto --enable-leak-detective --with-random-device=/dev/urandom \
$1 $2 $3 $4 $5
src/Makefile.am
+4
View File
@@ -31,6 +31,10 @@ if USE_UML
SUBDIRS += dumm
endif
if USE_FAST
SUBDIRS += libfast
endif
if USE_MANAGER
SUBDIRS += manager
endif
src/charon/Makefile.am
+47 -81
View File
@@ -4,16 +4,13 @@ charon_SOURCES = \
bus/bus.c bus/bus.h \
bus/listeners/file_logger.c bus/listeners/file_logger.h \
bus/listeners/sys_logger.c bus/listeners/sys_logger.h \
config/backends/backend.h config/backends/writeable_backend.h \
config/backend_manager.c config/backend_manager.h \
config/backend_manager.c config/backend_manager.h config/backend.h \
config/child_cfg.c config/child_cfg.h \
config/credentials/local_credential_store.c config/credentials/local_credential_store.h \
config/ike_cfg.c config/ike_cfg.h \
config/peer_cfg.c config/peer_cfg.h \
config/proposal.c config/proposal.h \
config/traffic_selector.c config/traffic_selector.h \
control/interfaces/interface.h \
control/interface_manager.c control/interface_manager.h \
control/controller.c control/controller.h \
daemon.c daemon.h \
encoding/generator.c encoding/generator.h \
encoding/message.c encoding/message.h \
@@ -63,6 +60,7 @@ processing/processor.c processing/processor.h \
sa/authenticators/authenticator.c sa/authenticators/authenticator.h \
sa/authenticators/eap_authenticator.c sa/authenticators/eap_authenticator.h \
sa/authenticators/eap/eap_method.c sa/authenticators/eap/eap_method.h \
sa/authenticators/eap/eap_manager.c sa/authenticators/eap/eap_manager.h \
sa/authenticators/psk_authenticator.c sa/authenticators/psk_authenticator.h \
sa/authenticators/rsa_authenticator.c sa/authenticators/rsa_authenticator.h \
sa/child_sa.c sa/child_sa.h \
@@ -74,7 +72,8 @@ sa/tasks/child_create.c sa/tasks/child_create.h \
sa/tasks/child_delete.c sa/tasks/child_delete.h \
sa/tasks/child_rekey.c sa/tasks/child_rekey.h \
sa/tasks/ike_auth.c sa/tasks/ike_auth.h \
sa/tasks/ike_cert.c sa/tasks/ike_cert.h \
sa/tasks/ike_cert_pre.c sa/tasks/ike_cert_pre.h \
sa/tasks/ike_cert_post.c sa/tasks/ike_cert_post.h \
sa/tasks/ike_config.c sa/tasks/ike_config.h \
sa/tasks/ike_delete.c sa/tasks/ike_delete.h \
sa/tasks/ike_dpd.c sa/tasks/ike_dpd.h \
@@ -84,7 +83,10 @@ sa/tasks/ike_mobike.c sa/tasks/ike_mobike.h \
sa/tasks/ike_rekey.c sa/tasks/ike_rekey.h \
sa/tasks/ike_reauth.c sa/tasks/ike_reauth.h \
sa/tasks/ike_auth_lifetime.c sa/tasks/ike_auth_lifetime.h \
sa/tasks/task.c sa/tasks/task.h
sa/tasks/task.c sa/tasks/task.h \
credentials/credential_manager.c credentials/credential_manager.h \
credentials/auth_info.c credentials/auth_info.h \
credentials/credential_set.h
# Use RAW socket if pluto gets built
if USE_PLUTO
@@ -102,89 +104,53 @@ if USE_P2P
sa/tasks/ike_p2p.c sa/tasks/ike_p2p.h
endif
INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon -I$(top_srcdir)/src/stroke
AM_CFLAGS = -rdynamic -DIPSEC_CONFDIR=\"${confdir}\" -DIPSEC_DIR=\"${ipsecdir}\" -DIPSEC_PIDDIR=\"${piddir}\" \
-DIPSEC_EAPDIR=\"${eapdir}\" -DIPSEC_BACKENDDIR=\"${backenddir}\" -DIPSEC_INTERFACEDIR=\"${interfacedir}\" \
-DSIM_READER_LIB=\"${simreader}\"
charon_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la -lgmp -lpthread -lm -ldl
INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
AM_CFLAGS = -rdynamic -DIPSEC_DIR=\"${ipsecdir}\" \
-DIPSEC_PIDDIR=\"${piddir}\" -DIPSEC_PLUGINDIR=\"${plugindir}\"
charon_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la -lpthread -lm -ldl
if USE_LIBCURL
charon_LDADD += -lcurl
# build optional plugins
########################
SUBDIRS =
if USE_UNIT_TESTS
SUBDIRS += plugins/unit_tester
endif
# build EAP plugins
###################
eap_LTLIBRARIES =
if USE_EAP_IDENTITY
eap_LTLIBRARIES += libcharon-eapidentity.la
libcharon_eapidentity_la_SOURCES = sa/authenticators/eap/eap_identity.h sa/authenticators/eap/eap_identity.c
libcharon_eapidentity_la_LDFLAGS = -module
endif
if USE_EAP_SIM
eap_LTLIBRARIES += libcharon-eapsim.la
libcharon_eapsim_la_SOURCES = sa/authenticators/eap/eap_sim.h sa/authenticators/eap/eap_sim.c
libcharon_eapsim_la_LDFLAGS = -module
plugin_LTLIBRARIES = libcharon-eapsim-file.la
libcharon_eapsim_file_la_SOURCES = sa/authenticators/eap/sim/eap_sim_file.c
libcharon_eapsim_file_la_LDFLAGS = -module
endif
if USE_EAP_MD5
eap_LTLIBRARIES += libcharon-eapmd5.la
libcharon_eapmd5_la_SOURCES = sa/authenticators/eap/eap_md5.h sa/authenticators/eap/eap_md5.c
libcharon_eapmd5_la_LDFLAGS = -module
endif
if USE_EAP_AKA
eap_LTLIBRARIES += libcharon-eapaka.la
libcharon_eapaka_la_SOURCES = sa/authenticators/eap/eap_aka.h sa/authenticators/eap/eap_aka.c
libcharon_eapaka_la_LDFLAGS = -module
endif
# build backends
################
backend_LTLIBRARIES =
if USE_STROKE
backend_LTLIBRARIES += libcharon-local.la
libcharon_local_la_SOURCES = config/backends/local_backend.h config/backends/local_backend.c
libcharon_local_la_LDFLAGS = -module
endif
if USE_LIBSQLITE
backend_LTLIBRARIES += libcharon-sqlite.la
libcharon_sqlite_la_SOURCES = config/backends/sqlite_backend.h config/backends/sqlite_backend.c
libcharon_sqlite_la_LIBADD = -lsqlite3
libcharon_sqlite_la_LDFLAGS = -module
endif
# build control interfaces
##########################
interface_LTLIBRARIES =
if USE_STROKE
interface_LTLIBRARIES += libcharon-stroke.la
libcharon_stroke_la_SOURCES = control/interfaces/stroke_interface.h control/interfaces/stroke_interface.c
libcharon_stroke_la_LDFLAGS = -module
SUBDIRS += plugins/stroke
endif
if USE_LIBDBUS
interface_LTLIBRARIES += libcharon-dbus.la
libcharon_dbus_la_SOURCES = control/interfaces/dbus_interface.h control/interfaces/dbus_interface.c
libcharon_dbus_la_LDFLAGS = -module
libcharon_dbus_la_LIBADD = ${dbus_LIBS}
INCLUDES += ${dbus_CFLAGS}
SUBDIRS += plugins/dbus
endif
if USE_LIBXML
interface_LTLIBRARIES += libcharon-xml.la
libcharon_xml_la_SOURCES = control/interfaces/xml_interface.h control/interfaces/xml_interface.c
libcharon_xml_la_LDFLAGS = -module
libcharon_xml_la_LIBADD = ${xml_LIBS}
INCLUDES += ${xml_CFLAGS}
SUBDIRS += plugins/xml
endif
if USE_SQL
SUBDIRS += plugins/sql
endif
if USE_EAP_IDENTITY
SUBDIRS += plugins/eap_identity
endif
if USE_EAP_SIM
SUBDIRS += plugins/eap_sim
endif
if USE_EAP_MD5
SUBDIRS += plugins/eap_md5
endif
if USE_EAP_AKA
SUBDIRS += plugins/eap_aka
endif
if USE_MED_DB
SUBDIRS += plugins/med_db
endif
src/charon/bus/bus.c
+34 -27
View File
@@ -1,10 +1,3 @@
/**
* @file bus.c
*
* @brief Implementation of bus_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "bus.h"
@@ -25,6 +20,7 @@
#include <pthread.h>
#include <daemon.h>
#include <utils/mutex.h>
ENUM(signal_names, SIG_ANY, SIG_MAX,
/** should not get printed */
@@ -72,9 +68,9 @@ struct private_bus_t {
linked_list_t *listeners;
/**
* mutex to synchronize active listeners
* mutex to synchronize active listeners, recursively
*/
pthread_mutex_t mutex;
mutex_t *mutex;
/**
* Thread local storage for a unique, simple thread ID
@@ -107,7 +103,7 @@ struct entry_t {
/**
* condvar where active listeners wait
*/
pthread_cond_t cond;
condvar_t *condvar;
};
/**
@@ -119,11 +115,20 @@ static entry_t *entry_create(bus_listener_t *listener, bool blocker)
this->listener = listener;
this->blocker = blocker;
pthread_cond_init(&this->cond, NULL);
this->condvar = condvar_create(CONDVAR_DEFAULT);
return this;
}
/**
* destroy an entry_t
*/
static void entry_destroy(entry_t *entry)
{
entry->condvar->destroy(entry->condvar);
free(entry);
}
/**
* Get a unique thread number for a calling thread. Since
* pthread_self returns large and ugly numbers, use this function
@@ -151,9 +156,9 @@ static int get_thread_number(private_bus_t *this)
*/
static void add_listener(private_bus_t *this, bus_listener_t *listener)
{
pthread_mutex_lock(&this->mutex);
this->mutex->lock(this->mutex);
this->listeners->insert_last(this->listeners, entry_create(listener, FALSE));
pthread_mutex_unlock(&this->mutex);
this->mutex->unlock(this->mutex);
}
/**
@@ -164,19 +169,19 @@ static void remove_listener(private_bus_t *this, bus_listener_t *listener)
iterator_t *iterator;
entry_t *entry;
pthread_mutex_lock(&this->mutex);
this->mutex->lock(this->mutex);
iterator = this->listeners->create_iterator(this->listeners, TRUE);
while (iterator->iterate(iterator, (void**)&entry))
{
if (entry->listener == listener)
{
iterator->remove(iterator);
free(entry);
entry_destroy(entry);
break;
}
}
iterator->destroy(iterator);
pthread_mutex_unlock(&this->mutex);
this->mutex->unlock(this->mutex);
}
typedef struct cleanup_data_t cleanup_data_t;
@@ -205,7 +210,7 @@ static void listener_cleanup(cleanup_data_t *data)
if (entry == data->entry)
{
iterator->remove(iterator);
free(entry);
entry_destroy(entry);
break;
}
}
@@ -223,21 +228,21 @@ static void listen_(private_bus_t *this, bus_listener_t *listener, job_t *job)
data.this = this;
data.entry = entry_create(listener, TRUE);
pthread_mutex_lock(&this->mutex);
this->mutex->lock(this->mutex);
this->listeners->insert_last(this->listeners, data.entry);
charon->processor->queue_job(charon->processor, job);
pthread_cleanup_push((void*)pthread_mutex_unlock, &this->mutex);
pthread_cleanup_push((void*)this->mutex->unlock, this->mutex);
pthread_cleanup_push((void*)listener_cleanup, &data);
pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &old);
while (data.entry->blocker)
{
pthread_cond_wait(&data.entry->cond, &this->mutex);
data.entry->condvar->wait(data.entry->condvar, this->mutex);
}
pthread_setcancelstate(old, NULL);
pthread_cleanup_pop(FALSE);
/* unlock mutex */
pthread_cleanup_pop(TRUE);
free(data.entry);
entry_destroy(data.entry);
}
/**
@@ -248,6 +253,7 @@ static void set_sa(private_bus_t *this, ike_sa_t *ike_sa)
pthread_setspecific(this->thread_sa, ike_sa);
}
/**
* Implementation of bus_t.vsignal.
*/
@@ -259,7 +265,7 @@ static void vsignal(private_bus_t *this, signal_t signal, level_t level,
ike_sa_t *ike_sa;
long thread;
pthread_mutex_lock(&this->mutex);
this->mutex->lock(this->mutex);
ike_sa = pthread_getspecific(this->thread_sa);
thread = get_thread_number(this);
@@ -275,18 +281,18 @@ static void vsignal(private_bus_t *this, signal_t signal, level_t level,
if (entry->blocker)
{
entry->blocker = FALSE;
pthread_cond_signal(&entry->cond);
entry->condvar->signal(entry->condvar);
}
else
{
free(entry);
entry_destroy(entry);
}
}
va_end(args_copy);
}
iterator->destroy(iterator);
pthread_mutex_unlock(&this->mutex);
this->mutex->unlock(this->mutex);
}
/**
@@ -307,7 +313,8 @@ static void signal_(private_bus_t *this, signal_t signal, level_t level,
*/
static void destroy(private_bus_t *this)
{
this->listeners->destroy_function(this->listeners, free);
this->mutex->destroy(this->mutex);
this->listeners->destroy_function(this->listeners, (void*)entry_destroy);
free(this);
}
@@ -327,7 +334,7 @@ bus_t *bus_create()
this->public.destroy = (void(*)(bus_t*)) destroy;
this->listeners = linked_list_create();
pthread_mutex_init(&this->mutex, NULL);
this->mutex = mutex_create(MUTEX_DEFAULT);
pthread_key_create(&this->thread_id, NULL);
pthread_key_create(&this->thread_sa, NULL);
src/charon/bus/bus.h
+26 -40
View File
@@ -1,10 +1,3 @@
/**
* @file bus.h
*
* @brief Interface of bus_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup bus bus
* @{ @ingroup charon
*/
#ifndef BUS_H_
@@ -36,7 +36,7 @@ typedef struct bus_t bus_t;
/**
* @brief signals emitted by the daemon.
* signals emitted by the daemon.
*
* Signaling is for different purporses. First, it allows debugging via
* "debugging signal messages", sencondly, it allows to follow certain
@@ -52,8 +52,6 @@ typedef struct bus_t bus_t;
* Debug signal betwee a START and a SUCCESS/FAILED belongs to that operation
* if the IKE_SA is the same. The thread may change, as multiple threads
* may be involved in a complex scenario.
*
* @ingroup bus
*/
enum signal_t {
/** pseudo signal, representing any other signal */
@@ -157,7 +155,7 @@ enum level_t {
#if DEBUG_LEVEL >= 1
/**
* @brief Log a debug message via the signal bus.
* Log a debug message via the signal bus.
*
* @param signal signal_t signal description
* @param format printf() style format string
@@ -189,7 +187,7 @@ enum level_t {
#endif /* DBG4 */
/**
* @brief Raise a signal for an occured event.
* Raise a signal for an occured event.
*
* @param sig signal_t signal description
* @param format printf() style format string
@@ -198,7 +196,7 @@ enum level_t {
#define SIG(sig, format, ...) charon->bus->signal(charon->bus, sig, LEVEL_0, format, ##__VA_ARGS__)
/**
* @brief Get the type of a signal.
* Get the type of a signal.
*
* A signal may be a debugging signal with a specific context. They have
* a level specific for their context > 0. All audit signals use the
@@ -211,17 +209,15 @@ enum level_t {
/**
* @brief Interface for registering at the signal bus.
* Interface for registering at the signal bus.
*
* To receive signals from the bus, the client implementing the
* bus_listener_t interface registers itself at the signal bus.
*
* @ingroup bus
*/
struct bus_listener_t {
/**
* @brief Send a signal to a bus listener.
* Send a signal to a bus listener.
*
* A numerical identification for the thread is included, as the
* associated IKE_SA, if any. Signal specifies the type of
@@ -231,8 +227,10 @@ struct bus_listener_t {
* a "..." parameters to functions is not (cleanly) possible.
* The implementing signal function returns TRUE to stay registered
* to the bus, or FALSE to unregister itself.
* You should not call bus_t.signal() inside of a registered listener,
* as it WILL call itself recursively. If you do so, make shure to
* avoid infinite recursion. Watch your stack!
*
* @param this listener
* @param singal kind of the signal (up, down, rekeyed, ...)
* @param level verbosity level of the signal
* @param thread ID of the thread raised this signal
@@ -246,40 +244,36 @@ struct bus_listener_t {
};
/**
* @brief Signal bus which sends signals to registered listeners.
* Signal bus which sends signals to registered listeners.
*
* The signal bus is not much more than a multiplexer. A listener interested
* in receiving event signals registers at the bus. Any signals sent to
* are delivered to all registered listeners.
* To deliver signals to threads, the blocking listen() call may be used
* to wait for a signal.
*
* @ingroup bus
*/
struct bus_t {
/**
* @brief Register a listener to the bus.
* Register a listener to the bus.
*
* A registered listener receives all signals which are sent to the bus.
* The listener is passive; the thread which emitted the signal
* processes the listener routine.
*
* @param this bus
* @param listener listener to register.
*/
void (*add_listener) (bus_t *this, bus_listener_t *listener);
/**
* @brief Unregister a listener from the bus.
* Unregister a listener from the bus.
*
* @param this bus
* @param listener listener to unregister.
*/
void (*remove_listener) (bus_t *this, bus_listener_t *listener);
/**
* @brief Register a listener and block the calling thread.
* Register a listener and block the calling thread.
*
* This call registers a listener and blocks the calling thread until
* its listeners function returns FALSE. This allows to wait for certain
@@ -287,14 +281,13 @@ struct bus_t {
* registered, this allows to listen on events we initiate with the job
* without missing any signals.
*
* @param this bus
* @param listener listener to register
* @param job job to execute asynchronously when registered, or NULL
*/
void (*listen)(bus_t *this, bus_listener_t *listener, job_t *job);
/**
* @brief Set the IKE_SA the calling thread is using.
* Set the IKE_SA the calling thread is using.
*
* To associate an received signal to an IKE_SA without passing it as
* parameter each time, the thread registers it's used IKE_SA each
@@ -302,13 +295,12 @@ struct bus_t {
* the IKE_SA (by passing NULL). This IKE_SA is stored per-thread, so each
* thread has one IKE_SA registered (or not).
*
* @param this bus
* @param ike_sa ike_sa to register, or NULL to unregister
*/
void (*set_sa) (bus_t *this, ike_sa_t *ike_sa);
/**
* @brief Send a signal to the bus.
* Send a signal to the bus.
*
* The signal specifies the type of the event occured. The format string
* specifies an additional informational or error message with a
@@ -316,7 +308,6 @@ struct bus_t {
* Some useful macros are available to shorten this call.
* @see SIG(), DBG1()
*
* @param this bus
* @param singal kind of the signal (up, down, rekeyed, ...)
* @param level verbosity level of the signal
* @param format printf() style format string
@@ -325,7 +316,7 @@ struct bus_t {
void (*signal) (bus_t *this, signal_t signal, level_t level, char* format, ...);
/**
* @brief Send a signal to the bus using va_list arguments.
* Send a signal to the bus using va_list arguments.
*
* Same as bus_t.signal(), but uses va_list argument list.
*
@@ -333,7 +324,6 @@ struct bus_t {
* called extensively and therefore shouldn't allocate heap memory or
* do other expensive tasks!
*
* @param this bus
* @param singal kind of the signal (up, down, rekeyed, ...)
* @param level verbosity level of the signal
* @param format printf() style format string
@@ -342,20 +332,16 @@ struct bus_t {
void (*vsignal) (bus_t *this, signal_t signal, level_t level, char* format, va_list args);
/**
* @brief Destroy the signal bus.
*
* @param this bus to destroy
* Destroy the signal bus.
*/
void (*destroy) (bus_t *this);
};
/**
* @brief Create the signal bus which multiplexes signals to its listeners.
* Create the signal bus which multiplexes signals to its listeners.
*
* @return signal bus instance
*
* @ingroup bus
*/
bus_t *bus_create();
#endif /* BUS_H_ */
#endif /* BUS_H_ @} */
src/charon/bus/listeners/file_logger.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file file_logger.c
*
* @brief Implementation of file_logger_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stdio.h>
src/charon/bus/listeners/file_logger.h
+12 -23
View File
@@ -1,10 +1,3 @@
/**
* @file file_logger.h
*
* @brief Interface of file_logger_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup file_logger file_logger
* @{ @ingroup listeners
*/
#ifndef FILE_LOGGER_H_
@@ -28,12 +28,7 @@ typedef struct file_logger_t file_logger_t;
#include <bus/bus.h>
/**
* @brief Logger to files which implements bus_listener_t.
*
* @b Constructors:
* - file_logger_create()
*
* @ingroup listeners
* Logger to files which implements bus_listener_t.
*/
struct file_logger_t {
@@ -43,31 +38,25 @@ struct file_logger_t {
bus_listener_t listener;
/**
* @brief Set the loglevel for a signal type.
* Set the loglevel for a signal type.
*
* @param this stream_logger_t object
* @param singal type of signal
* @param level max level to log (0..4)
*/
void (*set_level) (file_logger_t *this, signal_t signal, level_t level);
/**
* @brief Destroys a file_logger_t object.
*
* @param this file_logger_t object
* Destroys a file_logger_t object.
*/
void (*destroy) (file_logger_t *this);
};
/**
* @brief Constructor to create a file_logger_t object.
* Constructor to create a file_logger_t object.
*
* @param out FILE to write to
* @return file_logger_t object
*
* @ingroup listeners
*/
file_logger_t *file_logger_create(FILE *out);
#endif /* FILE_LOGGER_H_ */
#endif /* FILE_LOGGER_H_ @} */
src/charon/bus/listeners/sys_logger.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file sys_logger.c
*
* @brief Implementation of sys_logger_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stdio.h>
src/charon/bus/listeners/sys_logger.h
+12 -23
View File
@@ -1,10 +1,3 @@
/**
* @file sys_logger.h
*
* @brief Interface of sys_logger_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup sys_logger sys_logger
* @{ @ingroup listeners
*/
#ifndef SYS_LOGGER_H_
@@ -30,12 +30,7 @@ typedef struct sys_logger_t sys_logger_t;
#include <bus/bus.h>
/**
* @brief Logger for syslog which implements bus_listener_t.
*
* @b Constructors:
* - sys_logger_create()
*
* @ingroup listeners
* Logger for syslog which implements bus_listener_t.
*/
struct sys_logger_t {
@@ -45,31 +40,25 @@ struct sys_logger_t {
bus_listener_t listener;
/**
* @brief Set the loglevel for a signal type.
* Set the loglevel for a signal type.
*
* @param this stream_logger_t object
* @param singal type of signal
* @param level max level to log
*/
void (*set_level) (sys_logger_t *this, signal_t signal, level_t level);
/**
* @brief Destroys a sys_logger_t object.
*
* @param this sys_logger_t object
* Destroys a sys_logger_t object.
*/
void (*destroy) (sys_logger_t *this);
};
/**
* @brief Constructor to create a sys_logger_t object.
* Constructor to create a sys_logger_t object.
*
* @param facility syslog facility to use
* @return sys_logger_t object
*
* @ingroup listeners
*/
sys_logger_t *sys_logger_create(int facility);
#endif /* SYS_LOGGER_H_ */
#endif /* SYS_LOGGER_H_ @} */
src/charon/config/backend.h
+75
View File
@@ -0,0 +1,75 @@
/*
* Copyright (C) 2007-2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup backend backend
* @{ @ingroup config
*/
#ifndef BACKEND_H_
#define BACKEND_H_
typedef struct backend_t backend_t;
#include <library.h>
#include <config/ike_cfg.h>
#include <config/peer_cfg.h>
#include <credentials/auth_info.h>
#include <utils/linked_list.h>
/**
* The interface for a configuration backend.
*
* A configuration backend is loaded into the backend_manager. It does the actual
* configuration lookup for the method it implements. See backend_manager_t for
* more information.
*/
struct backend_t {
/**
* Create an enumerator over all IKE configs matching two hosts.
*
* Hosts may be NULL to get all.
*
* @param me address of local host
* @param other address of remote host
* @return enumerator over ike_cfg_t's
*/
enumerator_t* (*create_ike_cfg_enumerator)(backend_t *this,
host_t *me, host_t *other);
/**
* Create an enumerator over all Peer configs matching two IDs.
*
* IDs may be NULL to get all.
*
* @param me identity of ourself
* @param other identity of remote host
* @return enumerator over peer_cfg_t
*/
enumerator_t* (*create_peer_cfg_enumerator)(backend_t *this,
identification_t *me,
identification_t *other);
/**
* Get a peer_cfg identified by it's name, or a name of its child.
*
* @param name name of peer/child cfg
* @return matching peer_config, or NULL if none found
*/
peer_cfg_t *(*get_peer_cfg_by_name)(backend_t *this, char *name);
};
#endif /* BACKEND_H_ @} */
src/charon/config/backend_manager.c
+216 -141
View File
@@ -1,10 +1,3 @@
/**
* @file backend_manager.c
*
* @brief Implementation of backend_manager_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,18 +11,18 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "backend_manager.h"
#include <sys/types.h>
#include <dirent.h>
#include <sys/stat.h>
#include <dlfcn.h>
#include <pthread.h>
#include <daemon.h>
#include <utils/linked_list.h>
#include <config/backends/writeable_backend.h>
#include <utils/mutex.h>
typedef struct private_backend_manager_t private_backend_manager_t;
@@ -50,49 +43,209 @@ struct private_backend_manager_t {
linked_list_t *backends;
/**
* Additional list of writable backends.
* locking mutex
*/
linked_list_t *writeable;
/**
* List of dlopen() handles we used to open backends
*/
linked_list_t *handles;
mutex_t *mutex;
};
/**
* data to pass nested IKE enumerator
*/
typedef struct {
private_backend_manager_t *this;
host_t *me;
host_t *other;
} ike_data_t;
/**
* data to pass nested peer enumerator
*/
typedef struct {
private_backend_manager_t *this;
identification_t *me;
identification_t *other;
} peer_data_t;
/**
* destroy IKE enumerator data and unlock list
*/
static void ike_enum_destroy(ike_data_t *data)
{
data->this->mutex->unlock(data->this->mutex);
free(data);
}
/**
* destroy PEER enumerator data and unlock list
*/
static void peer_enum_destroy(peer_data_t *data)
{
data->this->mutex->unlock(data->this->mutex);
free(data);
}
/**
* inner enumerator constructor for IKE cfgs
*/
static enumerator_t *ike_enum_create(backend_t *backend, ike_data_t *data)
{
return backend->create_ike_cfg_enumerator(backend, data->me, data->other);
}
/**
* inner enumerator constructor for Peer cfgs
*/
static enumerator_t *peer_enum_create(backend_t *backend, peer_data_t *data)
{
return backend->create_peer_cfg_enumerator(backend, data->me, data->other);
}
/**
* inner enumerator constructor for all Peer cfgs
*/
static enumerator_t *peer_enum_create_all(backend_t *backend)
{
return backend->create_peer_cfg_enumerator(backend, NULL, NULL);
}
/**
* implements backend_manager_t.get_ike_cfg.
*/
static ike_cfg_t *get_ike_cfg(private_backend_manager_t *this,
host_t *my_host, host_t *other_host)
host_t *me, host_t *other)
{
backend_t *backend;
ike_cfg_t *config = NULL;
iterator_t *iterator = this->backends->create_iterator(this->backends, TRUE);
while (config == NULL && iterator->iterate(iterator, (void**)&backend))
ike_cfg_t *current, *found = NULL;
enumerator_t *enumerator;
host_t *my_candidate, *other_candidate;
ike_data_t *data;
enum {
MATCH_NONE = 0x00,
MATCH_ANY = 0x01,
MATCH_ME = 0x04,
MATCH_OTHER = 0x08,
} prio, best = MATCH_ANY;
data = malloc_thing(ike_data_t);
data->this = this;
data->me = me;
data->other = other;
DBG2(DBG_CFG, "looking for a config for %H...%H", me, other);
this->mutex->lock(this->mutex);
enumerator = enumerator_create_nested(
this->backends->create_enumerator(this->backends),
(void*)ike_enum_create, data, (void*)ike_enum_destroy);
while (enumerator->enumerate(enumerator, (void**)&current))
{
config = backend->get_ike_cfg(backend, my_host, other_host);
prio = MATCH_NONE;
my_candidate = current->get_my_host(current);
other_candidate = current->get_other_host(current);
if (my_candidate->ip_equals(my_candidate, me))
{
prio += MATCH_ME;
}
else if (my_candidate->is_anyaddr(my_candidate))
{
prio += MATCH_ANY;
}
if (other_candidate->ip_equals(other_candidate, other))
{
prio += MATCH_OTHER;
}
else if (other_candidate->is_anyaddr(other_candidate))
{
prio += MATCH_ANY;
}
DBG2(DBG_CFG, " candidate: %H...%H, prio %d",
my_candidate, other_candidate, prio);
/* we require at least two MATCH_ANY */
if (prio > best)
{
best = prio;
DESTROY_IF(found);
found = current;
found->get_ref(found);
}
}
iterator->destroy(iterator);
return config;
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
return found;
}
static enumerator_t *create_peer_cfg_enumerator(private_backend_manager_t *this)
{
this->mutex->lock(this->mutex);
return enumerator_create_nested(
this->backends->create_enumerator(this->backends),
(void*)peer_enum_create_all, this->mutex,
(void*)this->mutex->unlock);
}
/**
* implements backend_manager_t.get_peer_cfg.
*/
static peer_cfg_t *get_peer_cfg(private_backend_manager_t *this,
identification_t *my_id, identification_t *other_id,
ca_info_t *other_ca_info)
identification_t *me, identification_t *other,
auth_info_t *auth)
{
backend_t *backend;
peer_cfg_t *config = NULL;
iterator_t *iterator = this->backends->create_iterator(this->backends, TRUE);
while (config == NULL && iterator->iterate(iterator, (void**)&backend))
peer_cfg_t *current, *found = NULL;
enumerator_t *enumerator;
identification_t *my_candidate, *other_candidate;
id_match_t best = ID_MATCH_NONE;
peer_data_t *data;
DBG2(DBG_CFG, "looking for a config for %D...%D", me, other);
data = malloc_thing(peer_data_t);
data->this = this;
data->me = me;
data->other = other;
this->mutex->lock(this->mutex);
enumerator = enumerator_create_nested(
this->backends->create_enumerator(this->backends),
(void*)peer_enum_create, data, (void*)peer_enum_destroy);
while (enumerator->enumerate(enumerator, &current))
{
config = backend->get_peer_cfg(backend, my_id, other_id, other_ca_info);
id_match_t m1, m2, sum;
my_candidate = current->get_my_id(current);
other_candidate = current->get_other_id(current);
m1 = my_candidate->matches(my_candidate, me);
m2 = other->matches(other, other_candidate);
sum = m1 + m2;
if (m1 && m2)
{
if (auth->complies(auth, current->get_auth(current)))
{
DBG2(DBG_CFG, " candidate '%s': %D...%D, prio %d",
current->get_name(current), my_candidate,
other_candidate, sum);
if (sum > best)
{
DESTROY_IF(found);
found = current;
found->get_ref(found);
best = sum;
}
}
}
}
iterator->destroy(iterator);
return config;
if (found)
{
DBG1(DBG_CFG, "found matching config \"%s\": %D...%D, prio %d",
found->get_name(found), found->get_my_id(found),
found->get_other_id(found), best);
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
return found;
}
/**
@@ -102,112 +255,37 @@ static peer_cfg_t *get_peer_cfg_by_name(private_backend_manager_t *this, char *n
{
backend_t *backend;
peer_cfg_t *config = NULL;
iterator_t *iterator = this->backends->create_iterator(this->backends, TRUE);
while (config == NULL && iterator->iterate(iterator, (void**)&backend))
enumerator_t *enumerator;
this->mutex->lock(this->mutex);
enumerator = this->backends->create_enumerator(this->backends);
while (config == NULL && enumerator->enumerate(enumerator, (void**)&backend))
{
config = backend->get_peer_cfg_by_name(backend, name);
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
return config;
}
/**
* implements backend_manager_t.add_peer_cfg.
*/
static void add_peer_cfg(private_backend_manager_t *this, peer_cfg_t *config)
{
writeable_backend_t *backend;
if (this->writeable->get_first(this->writeable, (void**)&backend) == SUCCESS)
{
backend->add_cfg(backend, config);
}
}
/**
* implements backend_manager_t.create_iterator.
*/
static iterator_t* create_iterator(private_backend_manager_t *this)
{
writeable_backend_t *backend;
if (this->writeable->get_first(this->writeable, (void**)&backend) == SUCCESS)
{
return backend->create_iterator(backend);
}
/* give out an empty iterator if we have no writable backend*/
return this->writeable->create_iterator(this->writeable, TRUE);
}
/**
* load the configuration backend modules
* Implementation of backend_manager_t.remove_backend.
*/
static void load_backends(private_backend_manager_t *this)
static void remove_backend(private_backend_manager_t *this, backend_t *backend)
{
struct dirent* entry;
DIR* dir;
this->mutex->lock(this->mutex);
this->backends->remove(this->backends, backend, NULL);
this->mutex->unlock(this->mutex);
}
dir = opendir(IPSEC_BACKENDDIR);
if (dir == NULL)
{
DBG1(DBG_CFG, "error opening backend modules directory "IPSEC_BACKENDDIR);
return;
}
DBG1(DBG_CFG, "loading backend modules from '"IPSEC_BACKENDDIR"'");
while ((entry = readdir(dir)) != NULL)
{
char file[256];
backend_t *backend;
backend_constructor_t constructor;
void *handle;
char *ending;
snprintf(file, sizeof(file), IPSEC_BACKENDDIR"/%s", entry->d_name);
ending = entry->d_name + strlen(entry->d_name) - 3;
if (ending <= entry->d_name || !streq(ending, ".so"))
{
/* skip anything which does not look like a library */
DBG2(DBG_CFG, " skipping %s, doesn't look like a library",
entry->d_name);
continue;
}
/* try to load the library */
handle = dlopen(file, RTLD_LAZY);
if (handle == NULL)
{
DBG1(DBG_CFG, " opening backend module %s failed: %s",
entry->d_name, dlerror());
continue;
}
constructor = dlsym(handle, "backend_create");
if (constructor == NULL)
{
DBG1(DBG_CFG, " backend module %s has no backend_create() "
"function, skipped", entry->d_name);
dlclose(handle);
continue;
}
backend = constructor();
if (backend == NULL)
{
DBG1(DBG_CFG, " unable to create instance of backend "
"module %s, skipped", entry->d_name);
dlclose(handle);
continue;
}
DBG1(DBG_CFG, " loaded backend module successfully from %s", entry->d_name);
this->backends->insert_last(this->backends, backend);
if (backend->is_writeable(backend))
{
this->writeable->insert_last(this->writeable, backend);
}
this->handles->insert_last(this->handles, handle);
}
closedir(dir);
/**
* Implementation of backend_manager_t.add_backend.
*/
static void add_backend(private_backend_manager_t *this, backend_t *backend)
{
this->mutex->lock(this->mutex);
this->backends->insert_last(this->backends, backend);
this->mutex->unlock(this->mutex);
}
/**
@@ -215,9 +293,8 @@ static void load_backends(private_backend_manager_t *this)
*/
static void destroy(private_backend_manager_t *this)
{
this->backends->destroy_offset(this->backends, offsetof(backend_t, destroy));
this->writeable->destroy(this->writeable);
this->handles->destroy_function(this->handles, (void*)dlclose);
this->backends->destroy(this->backends);
this->mutex->destroy(this->mutex);
free(this);
}
@@ -229,17 +306,15 @@ backend_manager_t *backend_manager_create()
private_backend_manager_t *this = malloc_thing(private_backend_manager_t);
this->public.get_ike_cfg = (ike_cfg_t* (*)(backend_manager_t*, host_t*, host_t*))get_ike_cfg;
this->public.get_peer_cfg = (peer_cfg_t* (*)(backend_manager_t*,identification_t*,identification_t*,ca_info_t*))get_peer_cfg;
this->public.get_peer_cfg = (peer_cfg_t* (*)(backend_manager_t*,identification_t*,identification_t*,auth_info_t*))get_peer_cfg;
this->public.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_manager_t*,char*))get_peer_cfg_by_name;
this->public.add_peer_cfg = (void (*)(backend_manager_t*,peer_cfg_t*))add_peer_cfg;
this->public.create_iterator = (iterator_t* (*)(backend_manager_t*))create_iterator;
this->public.create_peer_cfg_enumerator = (enumerator_t* (*)(backend_manager_t*))create_peer_cfg_enumerator;
this->public.add_backend = (void(*)(backend_manager_t*, backend_t *backend))add_backend;
this->public.remove_backend = (void(*)(backend_manager_t*, backend_t *backend))remove_backend;
this->public.destroy = (void (*)(backend_manager_t*))destroy;
this->backends = linked_list_create();
this->writeable = linked_list_create();
this->handles = linked_list_create();
load_backends(this);
this->mutex = mutex_create(MUTEX_RECURSIVE);
return &this->public;
}
src/charon/config/backend_manager.h
+31 -44
View File
@@ -1,10 +1,3 @@
/**
* @file backend_manager.h
*
* @brief Interface backend_manager_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup backend_manager backend_manager
* @{ @ingroup config
*/
#ifndef BACKEND_MANAGER_H_
@@ -30,20 +30,15 @@ typedef struct backend_manager_t backend_manager_t;
#include <utils/identification.h>
#include <config/ike_cfg.h>
#include <config/peer_cfg.h>
#include <config/backends/backend.h>
#include <config/backend.h>
/**
* @brief A loader and multiplexer to use multiple backends.
* A loader and multiplexer to use multiple backends.
*
* Charon allows the use of multiple configuration backends simultaneously. To
* access all this backends by a single call, this class wraps multiple
* backends behind a single object. It is also responsible for loading
* the backend modules and cleaning them up.
* A backend may be writeable or not. All backends implement the backend_t
* interface, those who are writeable additionally implement the
* writeable_backend_t interface. Adding configs to the backend_manager will
* be redirected to the first writeable backend.
* backends behind a single object.
* @verbatim
+---------+ +-----------+ +--------------+ |
@@ -55,18 +50,12 @@ typedef struct backend_manager_t backend_manager_t;
+---------+ +-----------+ |
@endverbatim
*
* @b Constructors:
* - backend_manager_create()
*
* @ingroup config
*/
struct backend_manager_t {
/**
* @brief Get an ike_config identified by two hosts.
* Get an ike_config identified by two hosts.
*
* @param this calling object
* @param my_host address of own host
* @param other_host address of remote host
* @return matching ike_config, or NULL if none found
@@ -75,59 +64,57 @@ struct backend_manager_t {
host_t *my_host, host_t *other_host);
/**
* @brief Get a peer_config identified by two IDs and the peer's certificate issuer
* Get a peer_config identified by two IDs and authorization info.
*
* @param this calling object
* @param my_id own ID
* @param other_id peer ID
* @param other_ca_info info record on issuer of peer certificate
* @param auth_info authorization info
* @return matching peer_config, or NULL if none found
*/
peer_cfg_t* (*get_peer_cfg)(backend_manager_t *this,
identification_t *my_id, identification_t *other_id,
ca_info_t *other_ca_info);
peer_cfg_t* (*get_peer_cfg)(backend_manager_t *this, identification_t *my_id,
identification_t *other_id, auth_info_t *auth);
/**
* @brief Get a peer_config identified by it's name.
* Get a peer_config identified by it's name.
*
* @param this calling object
* @param name name of the peer_config
* @return matching peer_config, or NULL if none found
*/
peer_cfg_t* (*get_peer_cfg_by_name)(backend_manager_t *this, char *name);
/**
* @brief Add a peer_config to the first found writable backend.
* Create an enumerator over all peer configs.
*
* @param this calling object
* @param config peer_config to add to the backend
* @return enumerator over peer configs
*/
void (*add_peer_cfg)(backend_manager_t *this, peer_cfg_t *config);
enumerator_t* (*create_peer_cfg_enumerator)(backend_manager_t *this);
/**
* @brief Create an iterator over all peer configs of the writable backend.
* Register a backend on the manager.
*
* @param this calling object
* @return iterator over peer configs
* @param backend backend to register
*/
iterator_t* (*create_iterator)(backend_manager_t *this);
void (*add_backend)(backend_manager_t *this, backend_t *backend);
/**
* @brief Destroys a backend_manager_t object.
* Unregister a backend.
*
* @param this calling object
* @param backend backend to unregister
*/
void (*remove_backend)(backend_manager_t *this, backend_t *backend);
/**
* Destroys a backend_manager_t object.
*/
void (*destroy) (backend_manager_t *this);
};
/**
* @brief Creates a new instance of the manager and loads all backends.
* Create an instance of the backend manager
*
* @return backend_manager instance
*
* @ingroup config
*/
backend_manager_t* backend_manager_create(void);
#endif /*BACKEND_MANAGER_H_*/
#endif /*BACKEND_MANAGER_H_ @} */
src/charon/config/backends/backend.h
-105
View File
@@ -1,105 +0,0 @@
/**
* @file backend.h
*
* @brief Interface backend_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef BACKEND_H_
#define BACKEND_H_
typedef struct backend_t backend_t;
#include <library.h>
#include <config/ike_cfg.h>
#include <config/peer_cfg.h>
#include <utils/linked_list.h>
/**
* @brief The interface for a configuration backend.
*
* A configuration backend is loaded by the backend_manager. It does the actual
* configuration lookup for the method it implements. See backend_manager_t for
* more information.
*
* @b Constructors:
* - implementations constructors
*
* @ingroup backends
*/
struct backend_t {
/**
* @brief Get an ike_cfg identified by two hosts.
*
* @param this calling object
* @param my_host address of own host
* @param other_host address of remote host
* @return matching ike_config, or NULL if none found
*/
ike_cfg_t *(*get_ike_cfg)(backend_t *this,
host_t *my_host, host_t *other_host);
/**
* @brief Get a peer_cfg identified by two IDs.
*
* Select a config based on the two IDs and the other's certificate issuer
*
* @param this calling object
* @param my_id own ID
* @param other_id peer ID
* @param other_ca_info info record on issuer of peer certificate
* @return matching peer_config, or NULL if none found
*/
peer_cfg_t *(*get_peer_cfg)(backend_t *this,
identification_t *my_id, identification_t *other_id,
ca_info_t *other_ca_info);
/**
* @brief Get a peer_cfg identified by it's name, or a name of its child.
*
* @param this calling object
* @param name
* @return matching peer_config, or NULL if none found
*/
peer_cfg_t *(*get_peer_cfg_by_name)(backend_t *this, char *name);
/**
* @brief Check if a backend is writable and implements writable_backend_t.
*
* @param this calling object
* @return TRUE if backend implements writable_backend_t.
*/
bool (*is_writeable)(backend_t *this);
/**
* @brief Destroy a backend.
*
* @param this calling object
*/
void (*destroy)(backend_t *this);
};
/**
* Construction to create a backend.
*/
typedef backend_t*(*backend_constructor_t)(void);
#endif /* BACKEND_H_ */
src/charon/config/backends/local_backend.c
-322
View File
@@ -1,322 +0,0 @@
/**
* @file local_backend.c
*
* @brief Implementation of local_backend_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <string.h>
#include "local_backend.h"
#include <daemon.h>
#include <utils/linked_list.h>
#include <crypto/ca.h>
typedef struct private_local_backend_t private_local_backend_t;
/**
* Private data of an local_backend_t object
*/
struct private_local_backend_t {
/**
* Public part
*/
local_backend_t public;
/**
* list of configs
*/
linked_list_t *cfgs;
/**
* Mutex to exclusivly access list
*/
pthread_mutex_t mutex;
};
/**
* implements backen_t.get_ike_cfg.
*/
static ike_cfg_t *get_ike_cfg(private_local_backend_t *this,
host_t *my_host, host_t *other_host)
{
peer_cfg_t *peer;
ike_cfg_t *current, *found = NULL;
iterator_t *iterator;
host_t *my_candidate, *other_candidate;
enum {
MATCH_NONE = 0x00,
MATCH_ANY = 0x01,
MATCH_ME = 0x04,
MATCH_OTHER = 0x08,
} prio, best = MATCH_ANY;
DBG2(DBG_CFG, "looking for a config for %H...%H",
my_host, other_host);
iterator = this->cfgs->create_iterator_locked(this->cfgs, &this->mutex);
while (iterator->iterate(iterator, (void**)&peer))
{
prio = MATCH_NONE;
current = peer->get_ike_cfg(peer);
my_candidate = current->get_my_host(current);
other_candidate = current->get_other_host(current);
if (my_candidate->ip_equals(my_candidate, my_host))
{
prio += MATCH_ME;
}
else if (my_candidate->is_anyaddr(my_candidate))
{
prio += MATCH_ANY;
}
if (other_candidate->ip_equals(other_candidate, other_host))
{
prio += MATCH_OTHER;
}
else if (other_candidate->is_anyaddr(other_candidate))
{
prio += MATCH_ANY;
}
DBG2(DBG_CFG, " candidate '%s': %H...%H, prio %d",
peer->get_name(peer), my_candidate, other_candidate, prio);
/* we require at least two MATCH_ANY */
if (prio > best)
{
best = prio;
found = current;
}
}
if (found)
{
found->get_ref(found);
}
iterator->destroy(iterator);
return found;
}
#define PRIO_NO_MATCH_FOUND 256
/**
* implements backend_t.get_peer.
*/
static peer_cfg_t *get_peer_cfg(private_local_backend_t *this,
identification_t *my_id, identification_t *other_id,
ca_info_t *other_ca_info)
{
peer_cfg_t *current, *found = NULL;
iterator_t *iterator;
identification_t *my_candidate, *other_candidate;
int best = PRIO_NO_MATCH_FOUND;
DBG2(DBG_CFG, "looking for a config for %D...%D", my_id, other_id);
iterator = this->cfgs->create_iterator_locked(this->cfgs, &this->mutex);
while (iterator->iterate(iterator, (void**)&current))
{
int wc1, wc2;
my_candidate = current->get_my_id(current);
other_candidate = current->get_other_id(current);
if (my_candidate->matches(my_candidate, my_id, &wc1)
&& other_id->matches(other_id, other_candidate, &wc2))
{
int prio = (wc1 + wc2) * (MAX_CA_PATH_LEN + 1);
int pathlen = 0;
identification_t *other_candidate_ca = current->get_other_ca(current);
linked_list_t *groups = current->get_groups(current);
/* is a group membership required? */
if (groups->get_count(groups) > 0)
{
DBG1(DBG_CFG, " group membership required");
}
/* are there any ca constraints? */
if (other_candidate_ca->get_type(other_candidate_ca) != ID_ANY)
{
ca_info_t *ca_info = other_ca_info;
for (pathlen = 0; pathlen < MAX_CA_PATH_LEN; pathlen++)
{
if (ca_info == NULL)
{
prio = PRIO_NO_MATCH_FOUND;
break;
}
else
{
x509_t *cacert = ca_info->get_certificate(ca_info);
identification_t *other_ca = cacert->get_subject(cacert);
if (other_candidate_ca->equals(other_candidate_ca, other_ca))
{
/* found a ca match */
break;
}
if (cacert->is_self_signed(cacert))
{
/* reached the root ca without a match */
prio = PRIO_NO_MATCH_FOUND;
break;
}
/* move a level upward in the trust path hierarchy */
ca_info = charon->credentials->get_issuer(charon->credentials, cacert);
}
}
if (pathlen == MAX_CA_PATH_LEN)
{
DBG1(DBG_CFG, "maximum ca path length of %d levels reached", MAX_CA_PATH_LEN);
prio = PRIO_NO_MATCH_FOUND;
}
}
if (prio == PRIO_NO_MATCH_FOUND)
{
DBG2(DBG_CFG, " candidate '%s': %D...%D, no ca match",
current->get_name(current), my_candidate, other_candidate);
}
else
{
prio += pathlen;
DBG2(DBG_CFG, " candidate '%s': %D...%D, prio %d",
current->get_name(current), my_candidate, other_candidate, prio);
if (prio < best)
{
found = current;
best = prio;
}
}
}
}
if (found)
{
DBG1(DBG_CFG, "found matching config \"%s\": %D...%D, prio %d",
found->get_name(found),
found->get_my_id(found),
found->get_other_id(found),
best);
found->get_ref(found);
}
iterator->destroy(iterator);
return found;
}
/**
* implements backend_t.get_peer_cfg_by_name.
*/
static peer_cfg_t *get_peer_cfg_by_name(private_local_backend_t *this, char *name)
{
iterator_t *i1, *i2;
peer_cfg_t *current, *found = NULL;
child_cfg_t *child;
i1 = this->cfgs->create_iterator(this->cfgs, TRUE);
while (i1->iterate(i1, (void**)&current))
{
/* compare peer_cfgs name first */
if (streq(current->get_name(current), name))
{
found = current;
found->get_ref(found);
break;
}
/* compare all child_cfg names otherwise */
i2 = current->create_child_cfg_iterator(current);
while (i2->iterate(i2, (void**)&child))
{
if (streq(child->get_name(child), name))
{
found = current;
found->get_ref(found);
break;
}
}
i2->destroy(i2);
if (found)
{
break;
}
}
i1->destroy(i1);
return found;
}
/**
* Implementation of backend_t.is_writable.
*/
static bool is_writeable(private_local_backend_t *this)
{
return TRUE;
}
/**
* Implementation of writable_backend_t.create_iterator.
*/
static iterator_t* create_iterator(private_local_backend_t *this)
{
return this->cfgs->create_iterator_locked(this->cfgs, &this->mutex);
}
/**
* Implementation of writable_backend_t.add_peer_cfg.
*/
static void add_cfg(private_local_backend_t *this, peer_cfg_t *config)
{
pthread_mutex_lock(&this->mutex);
this->cfgs->insert_last(this->cfgs, config);
pthread_mutex_unlock(&this->mutex);
}
/**
* Implementation of backend_t.destroy.
*/
static void destroy(private_local_backend_t *this)
{
this->cfgs->destroy_offset(this->cfgs, offsetof(peer_cfg_t, destroy));
free(this);
}
/**
* Described in header.
*/
backend_t *backend_create(void)
{
private_local_backend_t *this = malloc_thing(private_local_backend_t);
this->public.backend.backend.get_ike_cfg = (ike_cfg_t* (*)(backend_t*, host_t*, host_t*))get_ike_cfg;
this->public.backend.backend.get_peer_cfg = (peer_cfg_t* (*)(backend_t*,identification_t*,identification_t*,ca_info_t*))get_peer_cfg;
this->public.backend.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
this->public.backend.backend.is_writeable = (bool(*) (backend_t*))is_writeable;
this->public.backend.backend.destroy = (void (*)(backend_t*))destroy;
this->public.backend.create_iterator = (iterator_t* (*)(writeable_backend_t*))create_iterator;
this->public.backend.add_cfg = (void (*)(writeable_backend_t*,peer_cfg_t*))add_cfg;
/* private variables */
this->cfgs = linked_list_create();
pthread_mutex_init(&this->mutex, NULL);
return &this->public.backend.backend;
}
src/charon/config/backends/local_backend.h
-60
View File
@@ -1,60 +0,0 @@
/**
* @file local_backend.h
*
* @brief Interface of local_backend_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef LOCAL_BACKEND_H_
#define LOCAL_BACKEND_H_
typedef struct local_backend_t local_backend_t;
#include <library.h>
#include <config/backends/writeable_backend.h>
/**
* @brief An in-memory backend to store configurations.
*
* The local_backend_t stores the configuration in a simple list. It
* implements both, backend_t and writeable_backend_t.
*
* @b Constructors:
* - local_backend_create()
*
* @ingroup backends
*/
struct local_backend_t {
/**
* Implements writable_backend_t interface
*/
writeable_backend_t backend;
};
/**
* @brief Create a backend_t instance implemented as local backend.
*
* @return backend instance
*
* @ingroup backends
*/
backend_t *backend_create(void);
#endif /* LOCAL_BACKEND_H_ */
src/charon/config/backends/sqlite_backend.c
-309
View File
@@ -1,309 +0,0 @@
/**
* @file sqlite_backend.c
*
* @brief Implementation of sqlite_backend_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <string.h>
#include <sqlite3.h>
#include "sqlite_backend.h"
#include <daemon.h>
typedef struct private_sqlite_backend_t private_sqlite_backend_t;
/**
* Private data of an sqlite_backend_t object
*/
struct private_sqlite_backend_t {
/**
* Public part
*/
sqlite_backend_t public;
/**
* SQLite database handle
*/
sqlite3 *db;
};
/**
* implements backen_t.get_ike_cfg.
*/
static ike_cfg_t *get_ike_cfg(private_sqlite_backend_t *this,
host_t *my_host, host_t *other_host)
{
return NULL;
}
/**
* add TS with child "id" to "child_cfg"
*/
static void add_ts(private_sqlite_backend_t *this, child_cfg_t *child_cfg, int id)
{
sqlite3_stmt *stmt;
if (sqlite3_prepare_v2(this->db,
"SELECT type, protocol, start_addr, end_addr, start_port, end_port, kind "
"FROM traffic_selectors, child_config_traffic_selector "
"ON traffic_selectors.oid = child_config_traffic_selector.traffic_selector "
"WHERE child_config_traffic_selector.child_cfg = ?;",
-1, &stmt, NULL) == SQLITE_OK &&
sqlite3_bind_int(stmt, 1, id) == SQLITE_OK)
{
while (sqlite3_step(stmt) == SQLITE_ROW)
{
traffic_selector_t *ts;
bool local = FALSE;
enum {
TS_LOCAL = 0,
TS_REMOTE = 1,
TS_LOCAL_DYNAMIC = 2,
TS_REMOTE_DYNAMIC = 3,
} kind;
kind = sqlite3_column_int(stmt, 6);
switch (kind)
{
case TS_LOCAL:
local = TRUE;
/* FALL */
case TS_REMOTE:
ts = traffic_selector_create_from_string(
sqlite3_column_int(stmt, 1), /* protocol */
sqlite3_column_int(stmt, 0), /* type */
(char*)sqlite3_column_text(stmt, 2), /* from addr */
sqlite3_column_int(stmt, 4), /* from port */
(char*)sqlite3_column_text(stmt, 3), /* to addr */
sqlite3_column_int(stmt, 5)); /* to port */
break;
case TS_LOCAL_DYNAMIC:
local = TRUE;
/* FALL */
case TS_REMOTE_DYNAMIC:
ts = traffic_selector_create_dynamic(
sqlite3_column_int(stmt, 1), /* protocol */
sqlite3_column_int(stmt, 0), /* type */
sqlite3_column_int(stmt, 4), /* from port */
sqlite3_column_int(stmt, 5)); /* to port */
break;
default:
continue;
}
if (ts)
{
child_cfg->add_traffic_selector(child_cfg, local, ts);
}
}
}
sqlite3_finalize(stmt);
}
/**
* add childrens belonging to config with "id" to "peer_cfg"
*/
static void add_children(private_sqlite_backend_t *this, peer_cfg_t *peer_cfg, int id)
{
sqlite3_stmt *stmt;
child_cfg_t *child_cfg;
if (sqlite3_prepare_v2(this->db,
"SELECT child_configs.oid, name, updown, hostaccess, mode, "
"lifetime, rekeytime, jitter "
"FROM child_configs, peer_config_child_config "
"ON child_configs.oid = peer_config_child_config.child_cfg "
"WHERE peer_config_child_config.peer_cfg = ?;",
-1, &stmt, NULL) == SQLITE_OK &&
sqlite3_bind_int(stmt, 1, id) == SQLITE_OK)
{
while (sqlite3_step(stmt) == SQLITE_ROW)
{
child_cfg = child_cfg_create(
(char*)sqlite3_column_text(stmt, 1), /* name */
sqlite3_column_int(stmt, 5), /* lifetime */
sqlite3_column_int(stmt, 6), /* rekeytime */
sqlite3_column_int(stmt, 7), /* jitter */
(char*)sqlite3_column_text(stmt, 2), /* updown */
sqlite3_column_int(stmt, 3), /* hostaccess */
sqlite3_column_int(stmt, 4)); /* mode */
add_ts(this, child_cfg, sqlite3_column_int(stmt, 0));
child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
peer_cfg->add_child_cfg(peer_cfg, child_cfg);
}
}
sqlite3_finalize(stmt);
}
/**
* processing function for get_peer_cfg and get_peer_cfg_by_name
*/
static peer_cfg_t *process_peer_cfg_row(private_sqlite_backend_t *this,
sqlite3_stmt *stmt)
{
host_t *local_host, *remote_host, *local_vip = NULL, *remote_vip = NULL;
identification_t *local_id, *remote_id;
peer_cfg_t *peer_cfg;
ike_cfg_t *ike_cfg;
local_host = host_create_from_string((char*)sqlite3_column_text(stmt, 17), IKEV2_UDP_PORT);
remote_host = host_create_from_string((char*)sqlite3_column_text(stmt, 18), IKEV2_UDP_PORT);
if (sqlite3_column_text(stmt, 15))
{
local_vip = host_create_from_string((char*)sqlite3_column_text(stmt, 15), 0);
}
if (sqlite3_column_text(stmt, 16))
{
remote_vip = host_create_from_string((char*)sqlite3_column_text(stmt, 16), 0);
}
local_id = identification_create_from_string((char*)sqlite3_column_text(stmt, 2));
remote_id = identification_create_from_string((char*)sqlite3_column_text(stmt, 3));
if (local_host && remote_host && local_id && remote_id)
{
ike_cfg = ike_cfg_create(sqlite3_column_int(stmt, 19), FALSE,
local_host, remote_host);
ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
peer_cfg = peer_cfg_create(
(char*)sqlite3_column_text(stmt, 1), /* name */
2, ike_cfg, local_id, remote_id, NULL, NULL, linked_list_create(),
sqlite3_column_int(stmt, 4), /* cert_policy */
sqlite3_column_int(stmt, 5), /* auth_method */
sqlite3_column_int(stmt, 6), 0 /* eap_type, vendor */
sqlite3_column_int(stmt, 7), /* keyingtries */
sqlite3_column_int(stmt, 8), /* rekey_time */
sqlite3_column_int(stmt, 9), /* reauth_time */
sqlite3_column_int(stmt, 10), /* jitter_time */
sqlite3_column_int(stmt, 11), /* over_time */
sqlite3_column_int(stmt, 14), /* mobike */
sqlite3_column_int(stmt, 12), /* dpd_delay */
sqlite3_column_int(stmt, 13), /* dpd_action */
local_vip, remote_vip, FALSE, NULL, NULL);
add_children(this, peer_cfg, sqlite3_column_int(stmt, 0));
return peer_cfg;
}
DESTROY_IF(local_host);
DESTROY_IF(remote_host);
DESTROY_IF(local_id);
DESTROY_IF(remote_id);
DESTROY_IF(local_vip);
DESTROY_IF(remote_vip);
return NULL;
}
/**
* implements backend_t.get_peer_cfg.
*/
static peer_cfg_t *get_peer_cfg(private_sqlite_backend_t *this,
identification_t *my_id, identification_t *other_id,
ca_info_t *other_ca_info)
{
sqlite3_stmt *stmt;
char local[256], remote[256];
peer_cfg_t *peer_cfg = NULL;
snprintf(local, sizeof(local), "%D", my_id);
snprintf(remote, sizeof(remote), "%D", other_id);
if (sqlite3_prepare_v2(this->db,
"SELECT peer_configs.oid, name, local_id, remote_id, cert_policy, "
"auth_method, eap_type, keyingtries, "
"rekey_time, reauth_time, jitter_time, over_time, "
"dpd_delay, dpd_action, mobike, local_vip, remote_vip, "
"local, remote, certreq "
"FROM peer_configs, ike_configs "
"ON peer_configs.ike_cfg = ike_configs.oid "
"WHERE local_id = ? and remote_id = ?;", -1, &stmt, NULL) == SQLITE_OK &&
sqlite3_bind_text(stmt, 1, local, -1, SQLITE_STATIC) == SQLITE_OK &&
sqlite3_bind_text(stmt, 2, remote, -1, SQLITE_STATIC) == SQLITE_OK &&
sqlite3_step(stmt) == SQLITE_ROW)
{
peer_cfg = process_peer_cfg_row(this, stmt);
}
sqlite3_finalize(stmt);
return peer_cfg;
}
/**
* implements backend_t.get_peer_cfg_by_name.
*/
static peer_cfg_t *get_peer_cfg_by_name(private_sqlite_backend_t *this, char *name)
{
sqlite3_stmt *stmt;
peer_cfg_t *peer_cfg = NULL;
if (sqlite3_prepare_v2(this->db,
"SELECT peer_configs.oid, name, local_id, remote_id, cert_policy, "
"auth_method, eap_type, keyingtries, lifetime, rekeytime, jitter, "
"dpd_delay, dpd_action, reauth, mobike, local_vip, remote_vip, "
"local, remote, certreq "
"FROM peer_configs, ike_configs "
"ON peer_configs.ike_cfg = ike_configs.oid "
"WHERE name = ? ;", -1, &stmt, NULL) == SQLITE_OK &&
sqlite3_bind_text(stmt, 1, name, -1, SQLITE_STATIC) == SQLITE_OK &&
sqlite3_step(stmt) == SQLITE_ROW)
{
peer_cfg = process_peer_cfg_row(this, stmt);
}
sqlite3_finalize(stmt);
return peer_cfg;
}
/**
* Implementation of backend_t.is_writable.
*/
static bool is_writeable(private_sqlite_backend_t *this)
{
return FALSE;
}
/**
* Implementation of backend_t.destroy.
*/
static void destroy(private_sqlite_backend_t *this)
{
sqlite3_close(this->db);
free(this);
}
/**
* Described in header.
*/
backend_t *backend_create(void)
{
private_sqlite_backend_t *this = malloc_thing(private_sqlite_backend_t);
this->public.backend.get_ike_cfg = (ike_cfg_t* (*)(backend_t*, host_t*, host_t*))get_ike_cfg;
this->public.backend.get_peer_cfg = (peer_cfg_t* (*)(backend_t*,identification_t*,identification_t*,ca_info_t*))get_peer_cfg;
this->public.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
this->public.backend.is_writeable = (bool(*) (backend_t*))is_writeable;
this->public.backend.destroy = (void (*)(backend_t*))destroy;
if (sqlite3_open(IPSEC_DIR "/manager.db", &this->db) != SQLITE_OK)
{
DBG1(DBG_CFG, "opening SQLite database '" IPSEC_DIR "/manager.db' failed.");
destroy(this);
return NULL;
}
return &this->public.backend;
}
src/charon/config/backends/writeable_backend.h
-64
View File
@@ -1,64 +0,0 @@
/**
* @file writeable_backend.h
*
* @brief Interface of writeable_backend_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef WRITEABLE_BACKEND_H_
#define WRITEABLE_BACKEND_H_
typedef struct writeable_backend_t writeable_backend_t;
#include <library.h>
#include <config/backends/backend.h>
/**
* @brief A writeable backend extends backend_t by modification functions.
*
* @b Constructors:
* - writeable_backend_create()
*
* @ingroup backends
*/
struct writeable_backend_t {
/**
* Implements backend_t interface
*/
backend_t backend;
/**
* @brief Add a peer_config to the backend.
*
* @param this calling object
* @param config peer_config to add to the backend
*/
void (*add_cfg)(writeable_backend_t *this, peer_cfg_t *config);
/**
* @brief Create an iterator over all peer configs.
*
* @param this calling object
* @return iterator over peer configs
*/
iterator_t* (*create_iterator)(writeable_backend_t *this);
};
#endif /* WRITEABLE_BACKEND_H_ */
src/charon/config/child_cfg.c
+2 -8
View File
@@ -1,10 +1,3 @@
/**
* @file child_cfg.c
*
* @brief Implementation of child_cfg_t.
*
*/
/*
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,9 +12,10 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "child_cfg.h"
#include <daemon.h>
src/charon/config/child_cfg.h
+25 -49
View File
@@ -1,10 +1,3 @@
/**
* @file child_cfg.h
*
* @brief Interface of child_cfg_t.
*
*/
/*
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup child_cfg child_cfg
* @{ @ingroup config
*/
#ifndef CHILD_CFG_H_
@@ -32,11 +32,9 @@ typedef struct child_cfg_t child_cfg_t;
#include <config/traffic_selector.h>
/**
* @brief Mode of an CHILD_SA.
* Mode of an CHILD_SA.
*
* These are equal to those defined in XFRM, so don't change.
*
* @ingroup config
*/
enum mode_t {
/** transport mode, no inner address */
@@ -53,7 +51,7 @@ enum mode_t {
extern enum_name_t *mode_names;
/**
* @brief A child_cfg_t defines the config template for a CHILD_SA.
* A child_cfg_t defines the config template for a CHILD_SA.
*
* After creation, proposals and traffic selectors may be added to the config.
* A child_cfg object is referenced multiple times, and is not thread save.
@@ -62,51 +60,42 @@ extern enum_name_t *mode_names;
* A reference counter handles the number of references hold to this config.
*
* @see peer_cfg_t to get an overview over the configurations.
*
* @b Constructors:
* - child_cfg_create()
*
* @ingroup config
*/
struct child_cfg_t {
/**
* @brief Get the name of the child_cfg.
* Get the name of the child_cfg.
*
* @param this calling object
* @return child_cfg's name
*/
char *(*get_name) (child_cfg_t *this);
/**
* @brief Add a proposal to the list.
* Add a proposal to the list.
*
* The proposals are stored by priority, first added
* is the most prefered.
* After add, proposal is owned by child_cfg.
*
* @param this calling object
* @param proposal proposal to add
*/
void (*add_proposal) (child_cfg_t *this, proposal_t *proposal);
/**
* @brief Get the list of proposals for the CHILD_SA.
* Get the list of proposals for the CHILD_SA.
*
* Resulting list and all of its proposals must be freed after use.
*
* @param this calling object
* @param strip_dh TRUE strip out diffie hellman groups
* @return list of proposals
*/
linked_list_t* (*get_proposals)(child_cfg_t *this, bool strip_dh);
/**
* @brief Select a proposal from a supplied list.
* Select a proposal from a supplied list.
*
* Returned propsal is newly created and must be destroyed after usage.
*
* @param this calling object
* @param proposals list from from wich proposals are selected
* @param strip_dh TRUE strip out diffie hellman groups
* @return selected proposal, or NULL if nothing matches
@@ -115,12 +104,11 @@ struct child_cfg_t {
bool strip_dh);
/**
* @brief Add a traffic selector to the config.
* Add a traffic selector to the config.
*
* Use the "local" parameter to add it for the local or the remote side.
* After add, traffic selector is owned by child_cfg.
*
* @param this calling object
* @param local TRUE for local side, FALSE for remote
* @param ts traffic_selector to add
*/
@@ -128,7 +116,7 @@ struct child_cfg_t {
traffic_selector_t *ts);
/**
* @brief Get a list of traffic selectors to use for the CHILD_SA.
* Get a list of traffic selectors to use for the CHILD_SA.
*
* The config contains two set of traffic selectors, one for the local
* side, one for the remote side.
@@ -139,7 +127,6 @@ struct child_cfg_t {
* the "host" parameter to narrow such traffic selectors to that address.
* Resulted list and its traffic selectors must be destroyed after use.
*
* @param this calling object
* @param local TRUE for TS on local side, FALSE for remote
* @param supplied list with TS to select from, or NULL
* @param host address to use for narrowing "dynamic" TS', or NULL
@@ -150,23 +137,21 @@ struct child_cfg_t {
host_t *host);
/**
* @brief Get the updown script to run for the CHILD_SA.
* Get the updown script to run for the CHILD_SA.
*
* @param this calling object
* @return path to updown script
*/
char* (*get_updown)(child_cfg_t *this);
/**
* @brief Should we allow access to the local host (gateway)?
* Should we allow access to the local host (gateway)?
*
* @param this calling object
* @return value of hostaccess flag
*/
bool (*get_hostaccess) (child_cfg_t *this);
/**
* @brief Get the lifetime of a CHILD_SA.
* Get the lifetime of a CHILD_SA.
*
* If "rekey" is set to TRUE, a lifetime is returned before the first
* rekeying should be started. If it is FALSE, the actual lifetime is
@@ -174,57 +159,50 @@ struct child_cfg_t {
* The rekey time automatically contains a jitter to avoid simlutaneous
* rekeying.
*
* @param this child_cfg
* @param rekey TRUE to get rekey time
* @return lifetime in seconds
*/
u_int32_t (*get_lifetime) (child_cfg_t *this, bool rekey);
/**
* @brief Get the mode to use for the CHILD_SA.
* Get the mode to use for the CHILD_SA.
*
* The mode is either tunnel, transport or BEET. The peer must agree
* on the method, fallback is tunnel mode.
*
* @param this child_cfg
* @return lifetime in seconds
*/
mode_t (*get_mode) (child_cfg_t *this);
/**
* @brief Get the DH group to use for CHILD_SA setup.
* Get the DH group to use for CHILD_SA setup.
*
* @param this calling object
* @return dh group to use
* @return dh group to use
*/
diffie_hellman_group_t (*get_dh_group)(child_cfg_t *this);
/**
* @brief Get a new reference.
* Get a new reference.
*
* Get a new reference to this child_cfg by increasing
* it's internal reference counter.
* Do not call get_ref or any other function until you
* already have a reference. Otherwise the object may get
* destroyed while calling get_ref(),
*
* @param this calling object
*/
void (*get_ref) (child_cfg_t *this);
/**
* @brief Destroys the child_cfg object.
* Destroys the child_cfg object.
*
* Decrements the internal reference counter and
* destroys the child_cfg when it reaches zero.
*
* @param this calling object
*/
void (*destroy) (child_cfg_t *this);
};
/**
* @brief Create a configuration template for CHILD_SA setup.
* Create a configuration template for CHILD_SA setup.
*
* The "name" string gets cloned.
* Lifetimes are in seconds. To prevent to peers to start rekeying at the
@@ -241,11 +219,9 @@ struct child_cfg_t {
* @param hostaccess TRUE to allow access to the local host
* @param mode mode to propose for CHILD_SA, transport, tunnel or BEET
* @return child_cfg_t object
*
* @ingroup config
*/
child_cfg_t *child_cfg_create(char *name, u_int32_t lifetime,
u_int32_t rekeytime, u_int32_t jitter,
char *updown, bool hostaccess, mode_t mode);
#endif /* CHILD_CFG_H_ */
#endif /* CHILD_CFG_H_ @} */
src/charon/config/credentials/local_credential_store.c
-1620
View File
File diff suppressed because it is too large Load Diff
src/charon/config/credentials/local_credential_store.h
-63
View File
@@ -1,63 +0,0 @@
/**
* @file local_credential_store.h
*
* @brief Interface of local_credential_store_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef LOCAL_CREDENTIAL_H_
#define LOCAL_CREDENTIAL_H_
typedef struct local_credential_store_t local_credential_store_t;
#include <library.h>
#include <credential_store.h>
#include <daemon.h>
/**
* @brief A credential_store_t implementation using simple credentail lists.
*
* The local_credential_store_t class implements the credential_store_t interface
* as simple as possible. The credentials are stored in lists, and are loaded from
* files on the disk.
* Shared secret are not handled yet, so get_shared_secret always returns NOT_FOUND.
*
* @b Constructors:
* - local_credential_store_create(bool strict)
*
* @ingroup config
*/
struct local_credential_store_t {
/**
* Implements credential_store_t interface
*/
credential_store_t credential_store;
};
/**
* @brief Creates a local_credential_store_t instance.
*
* @return credential store instance.
*
* @ingroup config
*/
local_credential_store_t *local_credential_store_create(void);
#endif /* LOCAL_CREDENTIAL_H_ */
src/charon/config/ike_cfg.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file ike_cfg.c
*
* @brief Implementation of ike_cfg_t.
*
*/
/*
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "ike_cfg.h"
src/charon/config/ike_cfg.h
+20 -39
View File
@@ -1,10 +1,3 @@
/**
* @file ike_cfg.h
*
* @brief Interface of ike_cfg_t.
*
*/
/*
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup ike_cfg ike_cfg
* @{ @ingroup config
*/
#ifndef IKE_CFG_H_
@@ -34,115 +34,98 @@ typedef struct ike_cfg_t ike_cfg_t;
#include <crypto/diffie_hellman.h>
/**
* @brief An ike_cfg_t defines the rules to set up an IKE_SA.
* An ike_cfg_t defines the rules to set up an IKE_SA.
*
* @see peer_cfg_t to get an overview over the configurations.
*
* @b Constructors:
* - ike_cfg_create()
*
* @ingroup config
*/
struct ike_cfg_t {
/**
* @brief Get own address.
* Get own address.
*
* @param this calling object
* @return host information as host_t object
*/
host_t* (*get_my_host) (ike_cfg_t *this);
/**
* @brief Get peers address.
* Get peers address.
*
* @param this calling object
* @return host information as host_t object
*/
host_t* (*get_other_host) (ike_cfg_t *this);
/**
* @brief Adds a proposal to the list.
* Adds a proposal to the list.
*
* The first added proposal has the highest priority, the last
* added the lowest.
*
* @param this calling object
* @param proposal proposal to add
*/
void (*add_proposal) (ike_cfg_t *this, proposal_t *proposal);
/**
* @brief Returns a list of all supported proposals.
* Returns a list of all supported proposals.
*
* Returned list and its proposals must be destroyed after use.
*
* @param this calling object
* @return list containing all the proposals
*/
linked_list_t* (*get_proposals) (ike_cfg_t *this);
/**
* @brief Select a proposed from suggested proposals.
* Select a proposed from suggested proposals.
*
* Returned proposal must be destroyed after use.
*
* @param this calling object
* @param proposals list of proposals to select from
* @return selected proposal, or NULL if none matches.
*/
proposal_t *(*select_proposal) (ike_cfg_t *this, linked_list_t *proposals);
/**
* @brief Should we send a certificate request in IKE_SA_INIT?
* Should we send a certificate request in IKE_SA_INIT?
*
* @param this calling object
* @return certificate request sending policy
*/
bool (*send_certreq) (ike_cfg_t *this);
/**
* @brief Enforce UDP encapsulation by faking NATD notifies?
* Enforce UDP encapsulation by faking NATD notifies?
*
* @param this calling object
* @return TRUE to enfoce UDP encapsulation
*/
bool (*force_encap) (ike_cfg_t *this);
/**
* @brief Get the DH group to use for IKE_SA setup.
* Get the DH group to use for IKE_SA setup.
*
* @param this calling object
* @return dh group to use for initialization
*/
diffie_hellman_group_t (*get_dh_group)(ike_cfg_t *this);
/**
* @brief Get a new reference to this ike_cfg.
* Get a new reference to this ike_cfg.
*
* Get a new reference to this ike_cfg by increasing
* it's internal reference counter.
* Do not call get_ref or any other function until you
* already have a reference. Otherwise the object may get
* destroyed while calling get_ref(),
*
* @param this calling object
*/
void (*get_ref) (ike_cfg_t *this);
/**
* @brief Destroys a ike_cfg_t object.
* Destroys a ike_cfg_t object.
*
* Decrements the internal reference counter and
* destroys the ike_cfg when it reaches zero.
*
* @param this calling object
*/
void (*destroy) (ike_cfg_t *this);
};
/**
* @brief Creates a ike_cfg_t object.
* Creates a ike_cfg_t object.
*
* Supplied hosts become owned by ike_cfg, the name gets cloned.
*
@@ -152,10 +135,8 @@ struct ike_cfg_t {
* @param my_host host_t representing local address
* @param other_host host_t representing remote address
* @return ike_cfg_t object.
*
* @ingroup config
*/
ike_cfg_t *ike_cfg_create(bool certreq, bool force_encap,
host_t *my_host, host_t *other_host);
#endif /* IKE_CFG_H_ */
#endif /* IKE_CFG_H_ @} */
src/charon/config/peer_cfg.c
+46 -67
View File
@@ -1,10 +1,3 @@
/**
* @file peer_cfg.c
*
* @brief Implementation of peer_cfg_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2007 Martin Willi
@@ -20,6 +13,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <string.h>
@@ -29,7 +24,6 @@
#include <utils/linked_list.h>
#include <utils/identification.h>
#include <crypto/ietf_attr_list.h>
ENUM(cert_policy_names, CERT_ALWAYS_SEND, CERT_NEVER_SEND,
"CERT_ALWAYS_SEND",
@@ -96,21 +90,6 @@ struct private_peer_cfg_t {
*/
identification_t *other_id;
/**
* we have a cert issued by this CA
*/
identification_t *my_ca;
/**
* we require the other end to have a cert issued by this CA
*/
identification_t *other_ca;
/**
* we require the other end to belong to at least one group
*/
linked_list_t *groups;
/**
* should we send a certificate
*/
@@ -180,6 +159,11 @@ struct private_peer_cfg_t {
* virtual IP to use remotly
*/
host_t *other_virtual_ip;
/**
* required authorization constraints
*/
auth_info_t *auth;
#ifdef P2P
/**
@@ -235,12 +219,26 @@ static void add_child_cfg(private_peer_cfg_t *this, child_cfg_t *child_cfg)
}
/**
* Implementation of peer_cfg_t.create_child_cfg_iterator.
* Implementation of peer_cfg_t.remove_child_cfg.
*/
static iterator_t* create_child_cfg_iterator(private_peer_cfg_t *this)
static void remove_child_cfg(private_peer_cfg_t *this, enumerator_t *enumerator)
{
return this->child_cfgs->create_iterator_locked(this->child_cfgs,
&this->mutex);
pthread_mutex_lock(&this->mutex);
this->child_cfgs->remove_at(this->child_cfgs, enumerator);
pthread_mutex_unlock(&this->mutex);
}
/**
* Implementation of peer_cfg_t.create_child_cfg_enumerator.
*/
static enumerator_t* create_child_cfg_enumerator(private_peer_cfg_t *this)
{
enumerator_t *enumerator;
pthread_mutex_lock(&this->mutex);
enumerator = this->child_cfgs->create_enumerator(this->child_cfgs);
return enumerator_create_cleaner(enumerator,
(void*)pthread_mutex_unlock, &this->mutex);
}
/**
@@ -267,10 +265,10 @@ static child_cfg_t* select_child_cfg(private_peer_cfg_t *this,
host_t *my_host, host_t *other_host)
{
child_cfg_t *current, *found = NULL;
iterator_t *iterator;
enumerator_t *enumerator;
iterator = create_child_cfg_iterator(this);
while (iterator->iterate(iterator, (void**)&current))
enumerator = create_child_cfg_enumerator(this);
while (enumerator->enumerate(enumerator, &current))
{
if (contains_ts(current, TRUE, my_ts, my_host) &&
contains_ts(current, FALSE, other_ts, other_host))
@@ -280,7 +278,7 @@ static child_cfg_t* select_child_cfg(private_peer_cfg_t *this,
break;
}
}
iterator->destroy(iterator);
enumerator->destroy(enumerator);
return found;
}
@@ -300,30 +298,6 @@ static identification_t *get_other_id(private_peer_cfg_t *this)
return this->other_id;
}
/**
* Implementation of peer_cfg_t.get_my_ca
*/
static identification_t *get_my_ca(private_peer_cfg_t *this)
{
return this->my_ca;
}
/**
* Implementation of peer_cfg_t.get_other_ca
*/
static identification_t *get_other_ca(private_peer_cfg_t *this)
{
return this->other_ca;
}
/**
* Implementation of peer_cfg_t.get_groups
*/
static linked_list_t *get_groups(private_peer_cfg_t *this)
{
return this->groups;
}
/**
* Implementation of peer_cfg_t.get_cert_policy.
*/
@@ -452,6 +426,14 @@ static host_t* get_other_virtual_ip(private_peer_cfg_t *this, host_t *suggestion
}
return suggestion->clone(suggestion);
}
/**
* Implementation of peer_cfg_t.get_auth.
*/
static auth_info_t* get_auth(private_peer_cfg_t *this)
{
return this->auth;
}
#ifdef P2P
/**
@@ -502,15 +484,13 @@ static void destroy(private_peer_cfg_t *this)
this->child_cfgs->destroy_offset(this->child_cfgs, offsetof(child_cfg_t, destroy));
this->my_id->destroy(this->my_id);
this->other_id->destroy(this->other_id);
DESTROY_IF(this->my_ca);
DESTROY_IF(this->other_ca);
DESTROY_IF(this->my_virtual_ip);
DESTROY_IF(this->other_virtual_ip);
this->auth->destroy(this->auth);
#ifdef P2P
DESTROY_IF(this->p2p_mediated_by);
DESTROY_IF(this->peer_id);
#endif /* P2P */
ietfAttr_list_destroy(this->groups);
free(this->name);
free(this);
}
@@ -521,8 +501,7 @@ static void destroy(private_peer_cfg_t *this)
*/
peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
identification_t *my_id, identification_t *other_id,
identification_t *my_ca, identification_t *other_ca,
linked_list_t *groups, cert_policy_t cert_policy,
cert_policy_t cert_policy,
auth_method_t auth_method, eap_type_t eap_type,
u_int32_t eap_vendor,
u_int32_t keyingtries, u_int32_t rekey_time,
@@ -540,13 +519,11 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
this->public.get_ike_version = (u_int(*) (peer_cfg_t *))get_ike_version;
this->public.get_ike_cfg = (ike_cfg_t* (*) (peer_cfg_t *))get_ike_cfg;
this->public.add_child_cfg = (void (*) (peer_cfg_t *, child_cfg_t*))add_child_cfg;
this->public.create_child_cfg_iterator = (iterator_t* (*) (peer_cfg_t *))create_child_cfg_iterator;
this->public.remove_child_cfg = (void(*)(peer_cfg_t*, enumerator_t*))remove_child_cfg;
this->public.create_child_cfg_enumerator = (enumerator_t* (*) (peer_cfg_t *))create_child_cfg_enumerator;
this->public.select_child_cfg = (child_cfg_t* (*) (peer_cfg_t *,linked_list_t*,linked_list_t*,host_t*,host_t*))select_child_cfg;
this->public.get_my_id = (identification_t* (*)(peer_cfg_t*))get_my_id;
this->public.get_other_id = (identification_t* (*)(peer_cfg_t *))get_other_id;
this->public.get_my_ca = (identification_t* (*)(peer_cfg_t *))get_my_ca;
this->public.get_other_ca = (identification_t* (*)(peer_cfg_t *))get_other_ca;
this->public.get_groups = (linked_list_t* (*)(peer_cfg_t *))get_groups;
this->public.get_cert_policy = (cert_policy_t (*) (peer_cfg_t *))get_cert_policy;
this->public.get_auth_method = (auth_method_t (*) (peer_cfg_t *))get_auth_method;
this->public.get_eap_type = (eap_type_t (*) (peer_cfg_t *,u_int32_t*))get_eap_type;
@@ -559,6 +536,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
this->public.get_dpd_action = (dpd_action_t (*) (peer_cfg_t *))get_dpd_action;
this->public.get_my_virtual_ip = (host_t* (*) (peer_cfg_t *))get_my_virtual_ip;
this->public.get_other_virtual_ip = (host_t* (*) (peer_cfg_t *, host_t *))get_other_virtual_ip;
this->public.get_auth = (auth_info_t*(*)(peer_cfg_t*))get_auth;
this->public.get_ref = (void(*)(peer_cfg_t *))get_ref;
this->public.destroy = (void(*)(peer_cfg_t *))destroy;
#ifdef P2P
@@ -575,9 +553,6 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
pthread_mutex_init(&this->mutex, NULL);
this->my_id = my_id;
this->other_id = other_id;
this->my_ca = my_ca;
this->other_ca = other_ca;
this->groups = groups;
this->cert_policy = cert_policy;
this->auth_method = auth_method;
this->eap_type = eap_type;
@@ -600,11 +575,15 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
this->dpd_action = dpd_action;
this->my_virtual_ip = my_virtual_ip;
this->other_virtual_ip = other_virtual_ip;
this->auth = auth_info_create();
this->refcount = 1;
#ifdef P2P
this->p2p_mediation = p2p_mediation;
this->p2p_mediated_by = p2p_mediated_by;
this->peer_id = peer_id;
#else /* P2P */
DESTROY_IF(p2p_mediated_by);
DESTROY_IF(peer_id);
#endif /* P2P */
return &this->public;
src/charon/config/peer_cfg.h
+67 -110
View File
@@ -1,10 +1,3 @@
/**
* @file peer_cfg.h
*
* @brief Interface of peer_cfg_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2007 Martin Willi
@@ -20,6 +13,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup peer_cfg peer_cfg
* @{ @ingroup config
*/
#ifndef PEER_CFG_H_
@@ -31,21 +31,20 @@ typedef struct peer_cfg_t peer_cfg_t;
#include <library.h>
#include <utils/identification.h>
#include <utils/linked_list.h>
#include <utils/enumerator.h>
#include <config/traffic_selector.h>
#include <config/proposal.h>
#include <config/ike_cfg.h>
#include <config/child_cfg.h>
#include <sa/authenticators/authenticator.h>
#include <sa/authenticators/eap/eap_method.h>
#include <credentials/auth_info.h>
/**
* Certificate sending policy. This is also used for certificate
* requests when using this definition for the other peer. If
* it is CERT_NEVER_SEND, a certreq is omitted, otherwise its
* included.
*
* @ingroup config
*
* @warning These definitions must be the same as in pluto/starter,
* as they are sent over the stroke socket.
@@ -61,17 +60,13 @@ enum cert_policy_t {
/**
* enum strings for cert_policy_t
*
* @ingroup config
*/
extern enum_name_t *cert_policy_names;
/**
* @brief Actions to take when a peer does not respond (dead peer detected).
* Actions to take when a peer does not respond (dead peer detected).
*
* These values are the same as in pluto/starter, so do not modify them!
*
* @ingroup config
*/
enum dpd_action_t {
/** DPD disabled */
@@ -90,7 +85,7 @@ enum dpd_action_t {
extern enum_name_t *dpd_action_names;
/**
* @brief Configuration of a peer, specified by IDs.
* Configuration of a peer, specified by IDs.
*
* The peer config defines a connection between two given IDs. It contains
* exactly one ike_cfg_t, which is use for initiation. Additionally, it contains
@@ -106,61 +101,67 @@ extern enum_name_t *dpd_action_names;
| - ... | | - dpd config | | - ... |-+
+---------------+ | - ... | +---------------+
+-------------------+
^
|
+-------------------+
| auth_info |
+-------------------+
| auth_items |
+-------------------+
@endverbatim
*
* @b Constructors:
* - peer_cfg_create()
*
* @ingroup config
* The auth_info_t object associated to the peer_cfg holds additional
* authorization constraints. A peer who wants to use a config needs to fullfil
* the requirements defined in auth_info.
*/
struct peer_cfg_t {
/**
* @brief Get the name of the peer_cfg.
* Get the name of the peer_cfg.
*
* Returned object is not getting cloned.
*
* @param this calling object
* @return peer_cfg's name
*/
char* (*get_name) (peer_cfg_t *this);
/**
* @brief Get the IKE version to use for initiating.
* Get the IKE version to use for initiating.
*
* @param this calling object
* @return IKE major version
*/
u_int (*get_ike_version)(peer_cfg_t *this);
/**
* @brief Get the IKE config to use for initiaton.
* Get the IKE config to use for initiaton.
*
* @param this calling object
* @return the IKE config to use
*/
ike_cfg_t* (*get_ike_cfg) (peer_cfg_t *this);
/**
* @brief Attach a CHILD config.
* Attach a CHILD config.
*
* @param this calling object
* @param child_cfg CHILD config to add
*/
void (*add_child_cfg) (peer_cfg_t *this, child_cfg_t *child_cfg);
/**
* @brief Create an iterator for all attached CHILD configs.
*
* @param this calling object
* @return an iterator over all CHILD configs.
* Detach a CHILD config, pointed to by an enumerator.
*
* @param enumerator enumerator indicating element position
*/
iterator_t* (*create_child_cfg_iterator) (peer_cfg_t *this);
void (*remove_child_cfg)(peer_cfg_t *this, enumerator_t *enumerator);
/**
* @brief Select a CHILD config from traffic selectors.
* Create an enumerator for all attached CHILD configs.
*
* @return an enumerator over all CHILD configs.
*/
enumerator_t* (*create_child_cfg_enumerator) (peer_cfg_t *this);
/**
* Select a CHILD config from traffic selectors.
*
* @param this calling object
* @param my_ts TS for local side
* @param other_ts TS for remote side
* @param my_host host to narrow down dynamic TS for local side
@@ -172,213 +173,175 @@ struct peer_cfg_t {
host_t *other_host);
/**
* @brief Get own ID.
* Get the authentication constraint items.
*
* @return auth_info object to manipulate requirements
*/
auth_info_t* (*get_auth)(peer_cfg_t *this);
/**
* Get own ID.
*
* @param this calling object
* @return own id
*/
identification_t* (*get_my_id)(peer_cfg_t *this);
/**
* @brief Get peers ID.
* Get peers ID.
*
* @param this calling object
* @return other id
*/
identification_t* (*get_other_id)(peer_cfg_t *this);
/**
* @brief Get own CA.
*
* @param this calling object
* @return own ca
*/
identification_t* (*get_my_ca)(peer_cfg_t *this);
/**
* @brief Get peer CA.
*
* @param this calling object
* @return other ca
*/
identification_t* (*get_other_ca)(peer_cfg_t *this);
/**
* @brief Get list of group attributes.
*
* @param this calling object
* @return linked list of group attributes
*/
linked_list_t* (*get_groups)(peer_cfg_t *this);
/**
* @brief Should be sent a certificate for this connection?
* Should be sent a certificate for this connection?
*
* @param this calling object
* @return certificate sending policy
*/
cert_policy_t (*get_cert_policy) (peer_cfg_t *this);
/**
* @brief Get the authentication method to use to authenticate us.
* Get the authentication method to use to authenticate us.
*
* @param this calling object
* @return authentication method
*/
auth_method_t (*get_auth_method) (peer_cfg_t *this);
/**
* @brief Get the EAP type to use for peer authentication.
* Get the EAP type to use for peer authentication.
*
* If vendor specific types are used, a vendor ID != 0 is returned to
* to vendor argument. Then the returned type is specific for that
* vendor ID.
*
* @param this calling object
* @param vendor receives vendor specifier, 0 for predefined EAP types
* @return authentication method
*/
eap_type_t (*get_eap_type) (peer_cfg_t *this, u_int32_t *vendor);
/**
* @brief Get the max number of retries after timeout.
* Get the max number of retries after timeout.
*
* @param this calling object
* @return max number retries
*/
u_int32_t (*get_keyingtries) (peer_cfg_t *this);
/**
* @brief Get a time to start rekeying (is randomized with jitter).
* Get a time to start rekeying (is randomized with jitter).
*
* @param this calling object
* @return time in s when to start rekeying, 0 disables rekeying
*/
u_int32_t (*get_rekey_time)(peer_cfg_t *this);
/**
* @brief Get a time to start reauthentication (is randomized with jitter).
* Get a time to start reauthentication (is randomized with jitter).
*
* @param this calling object
* @return time in s when to start reauthentication, 0 disables it
*/
u_int32_t (*get_reauth_time)(peer_cfg_t *this);
/**
* @brief Get the timeout of a rekeying/reauthenticating SA.
* Get the timeout of a rekeying/reauthenticating SA.
*
* @param thsi calling object
* @return timeout in s
*/
u_int32_t (*get_over_time)(peer_cfg_t *this);
/**
* @brief Use MOBIKE (RFC4555) if peer supports it?
* Use MOBIKE (RFC4555) if peer supports it?
*
* @param this calling object
* @return TRUE to enable MOBIKE support
*/
bool (*use_mobike) (peer_cfg_t *this);
/**
* @brief Get the DPD check interval.
* Get the DPD check interval.
*
* @param this calling object
* @return dpd_delay in seconds
*/
u_int32_t (*get_dpd_delay) (peer_cfg_t *this);
/**
* @brief What should be done with a CHILD_SA, when other peer does not respond.
* What should be done with a CHILD_SA, when other peer does not respond.
*
* @param this calling object
* @return dpd action
*/
dpd_action_t (*get_dpd_action) (peer_cfg_t *this);
/**
* @brief Get a virtual IP for the local peer.
* Get a virtual IP for the local peer.
*
* If no virtual IP should be used, NULL is returned. %any means to request
* a virtual IP using configuration payloads. A specific address is also
* used for a request and may be changed by the server.
*
* @param this peer_cfg
* @param suggestion NULL, %any or specific
* @return clone of an IP, %any or NULL
*/
host_t* (*get_my_virtual_ip) (peer_cfg_t *this);
/**
* @brief Get a virtual IP for the remote peer.
* Get a virtual IP for the remote peer.
*
* An IP may be supplied, if one was requested by the initiator. However,
* the suggestion is not more as it says, any address may be returned, even
* NULL to not use virtual IPs.
*
* @param this peer_cfg
* @param suggestion NULL, %any or specific
* @return clone of an IP to use
*/
host_t* (*get_other_virtual_ip) (peer_cfg_t *this, host_t *suggestion);
#ifdef P2P
/**
* @brief Is this a mediation connection?
* Is this a mediation connection?
*
* @param this peer_cfg
* @return TRUE, if this is a mediation connection
*/
bool (*is_mediation) (peer_cfg_t *this);
/**
* @brief Get peer_cfg of the connection this one is mediated through.
* Get peer_cfg of the connection this one is mediated through.
*
* @param this peer_cfg
* @return reference to peer_cfg of the mediation connection
*/
peer_cfg_t* (*get_mediated_by) (peer_cfg_t *this);
/**
* @brief Get the id of the other peer at the mediation server.
* Get the id of the other peer at the mediation server.
*
* This is the leftid of the peer's connection with the mediation server.
*
* If it is not configured, it is assumed to be the same as the right id
* of this connection.
*
* @param this peer_cfg
* @return the id of the other peer
*/
identification_t* (*get_peer_id) (peer_cfg_t *this);
#endif /* P2P */
/**
* @brief Get a new reference.
* Get a new reference.
*
* Get a new reference to this peer_cfg by increasing
* it's internal reference counter.
* Do not call get_ref or any other function until you
* already have a reference. Otherwise the object may get
* destroyed while calling get_ref(),
*
* @param this calling object
*/
void (*get_ref) (peer_cfg_t *this);
/**
* @brief Destroys the peer_cfg object.
* Destroys the peer_cfg object.
*
* Decrements the internal reference counter and
* destroys the peer_cfg when it reaches zero.
*
* @param this calling object
*/
void (*destroy) (peer_cfg_t *this);
};
/**
* @brief Create a configuration object for IKE_AUTH and later.
* Create a configuration object for IKE_AUTH and later.
*
* name-string gets cloned, ID's not.
* Virtual IPs are used if they are != NULL. A %any host means the virtual
@@ -392,9 +355,6 @@ struct peer_cfg_t {
* @param ike_cfg IKE config to use when acting as initiator
* @param my_id identification_t for ourselves
* @param other_id identification_t for the remote guy
* @param my_ca CA to use for us
* @param other_ca CA to use for other
* @param groups list of group memberships
* @param cert_policy should we send a certificate payload?
* @param auth_method auth method to use to authenticate us
* @param eap_type EAP type to use for peer authentication
@@ -414,13 +374,10 @@ struct peer_cfg_t {
* @param p2p_mediated_by name of the mediation connection to mediate through
* @param peer_id ID that identifies our peer at the mediation server
* @return peer_cfg_t object
*
* @ingroup config
*/
peer_cfg_t *peer_cfg_create(char *name, u_int ikev_version, ike_cfg_t *ike_cfg,
identification_t *my_id, identification_t *other_id,
identification_t *my_ca, identification_t *other_ca,
linked_list_t *groups, cert_policy_t cert_policy,
cert_policy_t cert_policy,
auth_method_t auth_method, eap_type_t eap_type,
u_int32_t eap_vendor,
u_int32_t keyingtries, u_int32_t rekey_time,
@@ -431,4 +388,4 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ikev_version, ike_cfg_t *ike_cfg,
bool p2p_mediation, peer_cfg_t *p2p_mediated_by,
identification_t *peer_id);
#endif /* PEER_CFG_H_ */
#endif /* PEER_CFG_H_ @} */
src/charon/config/proposal.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file proposal.c
*
* @brief Implementation of proposal_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <string.h>
src/charon/config/proposal.h
+38 -76
View File
@@ -1,10 +1,3 @@
/**
* @file proposal.h
*
* @brief Interface of proposal_t.
*
*/
/*
* Copyright (C) 2006 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup proposal proposal
* @{ @ingroup config
*/
#ifndef PROPOSAL_H_
@@ -40,8 +40,6 @@ typedef struct proposal_t proposal_t;
/**
* Protocol ID of a proposal.
*
* @ingroup config
*/
enum protocol_id_t {
PROTO_NONE = 0,
@@ -52,16 +50,12 @@ enum protocol_id_t {
/**
* enum names for protocol_id_t
*
* @ingroup config
*/
extern enum_name_t *protocol_id_names;
/**
* Type of a transform, as in IKEv2 RFC 3.3.2.
*
* @ingroup config
*/
enum transform_type_t {
UNDEFINED_TRANSFORM_TYPE = 241,
@@ -74,16 +68,12 @@ enum transform_type_t {
/**
* enum names for transform_type_t.
*
* @ingroup config
*/
extern enum_name_t *transform_type_names;
/**
* Extended sequence numbers, as in IKEv2 RFC 3.3.2.
*
* @ingroup config
*/
enum extended_sequence_numbers_t {
NO_EXT_SEQ_NUMBERS = 0,
@@ -92,8 +82,6 @@ enum extended_sequence_numbers_t {
/**
* enum strings for extended_sequence_numbers_t.
*
* @ingroup config
*/
extern enum_name_t *extended_sequence_numbers_names;
@@ -102,8 +90,6 @@ extern enum_name_t *extended_sequence_numbers_names;
/**
* Struct used to store different kinds of algorithms. The internal
* lists of algorithms contain such structures.
*
* @ingroup config
*/
struct algorithm_t {
/**
@@ -118,22 +104,17 @@ struct algorithm_t {
};
/**
* @brief Stores a set of algorithms used for an SA.
* Stores a set of algorithms used for an SA.
*
* A proposal stores algorithms for a specific
* protocol. It can store algorithms for one protocol.
* Proposals with multiple protocols are not supported,
* as it's not specified in RFC4301 anymore.
*
* @b Constructors:
* - proposal_create()
*
* @ingroup config
*/
struct proposal_t {
/**
* @brief Add an algorithm to the proposal.
* Add an algorithm to the proposal.
*
* The algorithms are stored by priority, first added
* is the most preferred.
@@ -144,120 +125,103 @@ struct proposal_t {
* integrity_algorithm_t, dh_group_number_t and
* extended_sequence_numbers_t.
*
* @param this calling object
* @param type kind of algorithm
* @param alg identifier for algorithm
* @param key_size key size to use
* @param type kind of algorithm
* @param alg identifier for algorithm
* @param key_size key size to use
*/
void (*add_algorithm) (proposal_t *this, transform_type_t type, u_int16_t alg, size_t key_size);
/**
* @brief Get an iterator over algorithms for a specifc algo type.
* Get an iterator over algorithms for a specifc algo type.
*
* @param this calling object
* @param type kind of algorithm
* @return iterator over algorithm_t's
* @param type kind of algorithm
* @return iterator over algorithm_t's
*/
iterator_t *(*create_algorithm_iterator) (proposal_t *this, transform_type_t type);
/**
* @brief Get the algorithm for a type to use.
* Get the algorithm for a type to use.
*
* If there are multiple algorithms, only the first is returned.
*
* @param this calling object
* @param type kind of algorithm
* @param[out] algo pointer which receives algorithm and key size
* @return TRUE if algorithm of this kind available
* @param type kind of algorithm
* @param algo pointer which receives algorithm and key size
* @return TRUE if algorithm of this kind available
*/
bool (*get_algorithm) (proposal_t *this, transform_type_t type, algorithm_t** algo);
/**
* @brief Check if the proposal has a specific DH group.
* Check if the proposal has a specific DH group.
*
* @param this calling object
* @param group group to check for
* @return TRUE if algorithm included
* @param group group to check for
* @return TRUE if algorithm included
*/
bool (*has_dh_group) (proposal_t *this, diffie_hellman_group_t group);
/**
* @brief Compare two proposal, and select a matching subset.
* Compare two proposal, and select a matching subset.
*
* If the proposals are for the same protocols (AH/ESP), they are
* compared. If they have at least one algorithm of each type
* in common, a resulting proposal of this kind is created.
*
* @param this calling object
* @param other proposal to compair agains
* @return
* - selected proposal, if possible
* - NULL, if proposals don't match
* @param other proposal to compair agains
* @return selected proposal, NULL if proposals don't match
*/
proposal_t *(*select) (proposal_t *this, proposal_t *other);
/**
* @brief Get the protocol ID of the proposal.
* Get the protocol ID of the proposal.
*
* @param this calling object
* @return protocol of the proposal
* @return protocol of the proposal
*/
protocol_id_t (*get_protocol) (proposal_t *this);
/**
* @brief Get the SPI of the proposal.
* Get the SPI of the proposal.
*
* @param this calling object
* @return spi for proto
* @return spi for proto
*/
u_int64_t (*get_spi) (proposal_t *this);
/**
* @brief Set the SPI of the proposal.
* Set the SPI of the proposal.
*
* @param this calling object
* @param spi spi to set for proto
* @param spi spi to set for proto
*/
void (*set_spi) (proposal_t *this, u_int64_t spi);
/**
* @brief Clone a proposal.
* Clone a proposal.
*
* @param this proposal to clone
* @return clone of it
* @return clone of proposal
*/
proposal_t *(*clone) (proposal_t *this);
/**
* @brief Destroys the proposal object.
*
* @param this calling object
* Destroys the proposal object.
*/
void (*destroy) (proposal_t *this);
};
/**
* @brief Create a child proposal for AH, ESP or IKE.
* Create a child proposal for AH, ESP or IKE.
*
* @param protocol protocol, such as PROTO_ESP
* @return proposal_t object
*
* @ingroup config
*/
proposal_t *proposal_create(protocol_id_t protocol);
/**
* @brief Create a default proposal if nothing further specified.
* Create a default proposal if nothing further specified.
*
* @param protocol protocol, such as PROTO_ESP
* @return proposal_t object
*
* @ingroup config
*/
proposal_t *proposal_create_default(protocol_id_t protocol);
/**
* @brief Create a proposal from a string identifying the algorithms.
* Create a proposal from a string identifying the algorithms.
*
* The string is in the same form as a in the ipsec.conf file.
* E.g.: aes128-sha2_256-modp2048
@@ -268,9 +232,7 @@ proposal_t *proposal_create_default(protocol_id_t protocol);
* @param protocol protocol, such as PROTO_ESP
* @param algs algorithms as string
* @return proposal_t object
*
* @ingroup config
*/
proposal_t *proposal_create_from_string(protocol_id_t protocol, const char *algs);
#endif /* PROPOSAL_H_ */
#endif /* PROPOSAL_H_ @} */
src/charon/config/traffic_selector.c
+19 -10
View File
@@ -1,10 +1,3 @@
/**
* @file traffic_selector.c
*
* @brief Implementation of traffic_selector_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2007 Martin Willi
@@ -20,6 +13,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <arpa/inet.h>
@@ -276,11 +271,25 @@ static int print(FILE *stream, const struct printf_info *info,
}
/**
* register printf() handlers
* arginfo handler for printf() traffic selector
*/
static void __attribute__ ((constructor))print_register()
static int arginfo(const struct printf_info *info, size_t n, int *argtypes)
{
register_printf_function(PRINTF_TRAFFIC_SELECTOR, print, arginfo_ptr);
if (n > 0)
{
argtypes[0] = PA_POINTER;
}
return 1;
}
/**
* return printf hook functions for a chunk
*/
printf_hook_functions_t traffic_selector_get_printf_hooks()
{
printf_hook_functions_t hooks = {print, arginfo};
return hooks;
}
/**
src/charon/config/traffic_selector.h
+38 -63
View File
@@ -1,10 +1,3 @@
/**
* @file traffic_selector.h
*
* @brief Interface of traffic_selector_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2006 Martin Willi
@@ -20,6 +13,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup traffic_selector traffic_selector
* @{ @ingroup config
*/
#ifndef TRAFFIC_SELECTOR_H_
@@ -33,8 +33,6 @@ typedef struct traffic_selector_t traffic_selector_t;
/**
* Traffic selector types.
*
* @ingroup config
*/
enum ts_type_t {
@@ -63,29 +61,20 @@ enum ts_type_t {
extern enum_name_t *ts_type_name;
/**
* @brief Object representing a traffic selector entry.
* Object representing a traffic selector entry.
*
* A traffic selector defines an range of addresses
* and a range of ports. IPv6 is not fully supported yet.
*
* @b Constructors:
* - traffic_selector_create_from_bytes()
* - traffic_selector_create_from_string()
*
* @todo Add IPv6 support
*
* @ingroup config
*/
struct traffic_selector_t {
/**
* @brief Compare two traffic selectors, and create a new one
* Compare two traffic selectors, and create a new one
* which is the largest subset of both (subnet & port).
*
* Resulting traffic_selector is newly created and must be destroyed.
*
* @param this first to compare
* @param other second to compare
* @param other traffic selector to compare
* @return
* - created subset of them
* - or NULL if no match between this and other
@@ -94,73 +83,66 @@ struct traffic_selector_t {
traffic_selector_t *other);
/**
* @brief Clone a traffic selector.
* Clone a traffic selector.
*
* @param this traffic selector to clone
* @return clone of it
*/
traffic_selector_t *(*clone) (traffic_selector_t *this);
/**
* @brief Get starting address of this ts as a chunk.
* Get starting address of this ts as a chunk.
*
* Chunk is in network order gets allocated.
*
* @param this called object
* @return chunk containing the address
*/
chunk_t (*get_from_address) (traffic_selector_t *this);
/**
* @brief Get ending address of this ts as a chunk.
* Get ending address of this ts as a chunk.
*
* Chunk is in network order gets allocated.
*
* @param this called object
* @return chunk containing the address
*/
chunk_t (*get_to_address) (traffic_selector_t *this);
/**
* @brief Get starting port of this ts.
* Get starting port of this ts.
*
* Port is in host order, since the parser converts it.
* Size depends on protocol.
*
* @param this called object
* @return port
*/
u_int16_t (*get_from_port) (traffic_selector_t *this);
/**
* @brief Get ending port of this ts.
* Get ending port of this ts.
*
* Port is in host order, since the parser converts it.
* Size depends on protocol.
*
* @param this called object
* @return port
*/
u_int16_t (*get_to_port) (traffic_selector_t *this);
/**
* @brief Get the type of the traffic selector.
* Get the type of the traffic selector.
*
* @param this called object
* @return ts_type_t specifying the type
*/
ts_type_t (*get_type) (traffic_selector_t *this);
/**
* @brief Get the protocol id of this ts.
* Get the protocol id of this ts.
*
* @param this called object
* @return protocol id
*/
u_int8_t (*get_protocol) (traffic_selector_t *this);
/**
* @brief Check if the traffic selector is for a single host.
* Check if the traffic selector is for a single host.
*
* Traffic selector may describe the end of *-to-host tunnel. In this
* case, the address range is a single address equal to the hosts
@@ -168,61 +150,54 @@ struct traffic_selector_t {
* If host is NULL, the traffic selector is checked if it is a single host,
* but not a specific one.
*
* @param this called object
* @param host host_t specifying the address range
*/
bool (*is_host) (traffic_selector_t *this, host_t* host);
/**
* @brief Update the address of a traffic selector.
* Update the address of a traffic selector.
*
* Update the address range of a traffic selector, if it is
* constructed with the traffic_selector_create_dynamic().
*
* @param this called object
* @param host host_t specifying the address
*/
void (*set_address) (traffic_selector_t *this, host_t* host);
/**
* @brief Compare two traffic selectors for equality.
* Compare two traffic selectors for equality.
*
* @param this first to compare
* @param other second to compare with first
* @param other ts to compare with this
* @return pointer to a string.
*/
bool (*equals) (traffic_selector_t *this, traffic_selector_t *other);
/**
* @brief Check if a traffic selector is contained completly in another.
* Check if a traffic selector is contained completly in another.
*
* contains() allows to check if multiple traffic selectors are redundant.
*
* @param this ts that is contained in another
* @param other ts that contains this
* @return TRUE if other contains this completly, FALSE otherwise
*/
bool (*is_contained_in) (traffic_selector_t *this, traffic_selector_t *other);
/**
* @brief Check if a specific host is included in the address range of
* Check if a specific host is included in the address range of
* this traffic selector.
*
* @param this called object
* @param host the host to check
*/
bool (*includes) (traffic_selector_t *this, host_t *host);
/**
* @brief Destroys the ts object
*
* @param this called object
* Destroys the ts object
*/
void (*destroy) (traffic_selector_t *this);
};
/**
* @brief Create a new traffic selector using human readable params.
* Create a new traffic selector using human readable params.
*
* @param protocol protocol for this ts, such as TCP or UDP
* @param type type of following addresses, such as TS_IPV4_ADDR_RANGE
@@ -233,8 +208,6 @@ struct traffic_selector_t {
* @return
* - traffic_selector_t object
* - NULL if invalid address strings/protocol
*
* @ingroup config
*/
traffic_selector_t *traffic_selector_create_from_string(
u_int8_t protocol, ts_type_t type,
@@ -242,7 +215,7 @@ traffic_selector_t *traffic_selector_create_from_string(
char *to_addr, u_int16_t to_port);
/**
* @brief Create a new traffic selector using data read from the net.
* Create a new traffic selector using data read from the net.
*
* There exists a mix of network and host order in the params.
* But the parser gives us this data in this format, so we
@@ -255,8 +228,6 @@ traffic_selector_t *traffic_selector_create_from_string(
* @param to_address end of address range as string, network
* @param to_port port number, host order
* @return traffic_selector_t object
*
* @ingroup config
*/
traffic_selector_t *traffic_selector_create_from_bytes(
u_int8_t protocol, ts_type_t type,
@@ -264,7 +235,7 @@ traffic_selector_t *traffic_selector_create_from_bytes(
chunk_t to_address, u_int16_t to_port);
/**
* @brief Create a new traffic selector defining a whole subnet.
* Create a new traffic selector defining a whole subnet.
*
* In most cases, definition of a traffic selector for full subnets
* is sufficient. This constructor creates a traffic selector for
@@ -278,15 +249,13 @@ traffic_selector_t *traffic_selector_create_from_bytes(
* @return
* - traffic_selector_t object
* - NULL if address family of net not supported
*
* @ingroup config
*/
traffic_selector_t *traffic_selector_create_from_subnet(
host_t *net, u_int8_t netbits,
u_int8_t protocol, u_int16_t port);
/**
* @brief Create a traffic selector for host-to-host cases.
* Create a traffic selector for host-to-host cases.
*
* For host2host or virtual IP setups, the traffic selectors gets
* created at runtime using the external/virtual IP. Using this constructor,
@@ -300,13 +269,19 @@ traffic_selector_t *traffic_selector_create_from_subnet(
* @return
* - traffic_selector_t object
* - NULL if type not supported
*
* @ingroup config
*/
traffic_selector_t *traffic_selector_create_dynamic(
u_int8_t protocol, ts_type_t type,
u_int16_t from_port, u_int16_t to_port);
#endif /* TRAFFIC_SELECTOR_H_ */
/**
* Get printf hooks for a traffic selector.
*
* Arguments are:
* traffic_selector_t *ts
* With the #-specifier, arguments are:
* linked_list_t *list containing traffic_selector_t*
*/
printf_hook_functions_t traffic_selector_get_printf_hooks();
/* vim: set ts=4 sw=4 noet: */
#endif /* TRAFFIC_SELECTOR_H_ @} */
src/charon/control/interface_manager.c → src/charon/control/controller.c
+37 -128
View File
@@ -1,10 +1,3 @@
/**
* @file interface_manager.c
*
* @brief Implementation of interface_manager_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,9 +11,11 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "interface_manager.h"
#include "controller.h"
#include <sys/types.h>
#include <dirent.h>
@@ -29,31 +24,20 @@
#include <daemon.h>
#include <library.h>
#include <control/interfaces/interface.h>
typedef struct private_interface_manager_t private_interface_manager_t;
typedef struct private_controller_t private_controller_t;
typedef struct interface_bus_listener_t interface_bus_listener_t;
/**
* Private data of an stroke_t object.
*/
struct private_interface_manager_t {
struct private_controller_t {
/**
* Public part of stroke_t object.
*/
interface_manager_t public;
/**
* a list of all loaded interfaces
*/
linked_list_t *interfaces;
/**
* dlopen() handles of interfaces
*/
linked_list_t *handles;
controller_t public;
};
@@ -80,7 +64,7 @@ struct interface_bus_listener_t {
/**
* interface callback (listener gets redirected to here)
*/
interface_manager_cb_t callback;
controller_cb_t callback;
/**
* user parameter to pass to callback
@@ -130,9 +114,9 @@ static void nop(job_t *job)
}
/**
* Implementation of interface_manager_t.create_ike_sa_iterator.
* Implementation of controller_t.create_ike_sa_iterator.
*/
static iterator_t* create_ike_sa_iterator(interface_manager_t *this)
static iterator_t* create_ike_sa_iterator(controller_t *this)
{
return charon->ike_sa_manager->create_iterator(charon->ike_sa_manager);
}
@@ -173,11 +157,11 @@ static status_t initiate_execute(interface_job_t *job)
ike_sa_t *ike_sa;
interface_bus_listener_t *listener = &job->listener;
peer_cfg_t *peer_cfg = listener->peer_cfg;
ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
peer_cfg);
listener->ike_sa = ike_sa;
if (ike_sa->get_peer_cfg(ike_sa) == NULL)
{
ike_sa->set_peer_cfg(ike_sa, peer_cfg);
@@ -193,11 +177,11 @@ static status_t initiate_execute(interface_job_t *job)
}
/**
* Implementation of interface_manager_t.initiate.
* Implementation of controller_t.initiate.
*/
static status_t initiate(private_interface_manager_t *this,
static status_t initiate(private_controller_t *this,
peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
interface_manager_cb_t callback, void *param)
controller_cb_t callback, void *param)
{
interface_job_t job;
@@ -273,10 +257,10 @@ static status_t terminate_ike_execute(interface_job_t *job)
}
/**
* Implementation of interface_manager_t.terminate_ike.
* Implementation of controller_t.terminate_ike.
*/
static status_t terminate_ike(interface_manager_t *this, u_int32_t unique_id,
interface_manager_cb_t callback, void *param)
static status_t terminate_ike(controller_t *this, u_int32_t unique_id,
controller_cb_t callback, void *param)
{
interface_job_t job;
@@ -375,10 +359,10 @@ static status_t terminate_child_execute(interface_job_t *job)
}
/**
* Implementation of interface_manager_t.terminate_child.
* Implementation of controller_t.terminate_child.
*/
static status_t terminate_child(interface_manager_t *this, u_int32_t reqid,
interface_manager_cb_t callback, void *param)
static status_t terminate_child(controller_t *this, u_int32_t reqid,
controller_cb_t callback, void *param)
{
interface_job_t job;
@@ -434,7 +418,6 @@ static status_t route_execute(interface_job_t *job)
ike_sa_t *ike_sa;
interface_bus_listener_t *listener = &job->listener;
peer_cfg_t *peer_cfg = listener->peer_cfg;
ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
peer_cfg);
listener->ike_sa = ike_sa;
@@ -452,11 +435,11 @@ static status_t route_execute(interface_job_t *job)
}
/**
* Implementation of interface_manager_t.route.
* Implementation of controller_t.route.
*/
static status_t route(interface_manager_t *this,
static status_t route(controller_t *this,
peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
interface_manager_cb_t callback, void *param)
controller_cb_t callback, void *param)
{
interface_job_t job;
@@ -530,10 +513,10 @@ static status_t unroute_execute(interface_job_t *job)
}
/**
* Implementation of interface_manager_t.unroute.
* Implementation of controller_t.unroute.
*/
static status_t unroute(interface_manager_t *this, u_int32_t reqid,
interface_manager_cb_t callback, void *param)
static status_t unroute(controller_t *this, u_int32_t reqid,
controller_cb_t callback, void *param)
{
interface_job_t job;
@@ -554,77 +537,10 @@ static status_t unroute(interface_manager_t *this, u_int32_t reqid,
return job.listener.status;
}
/**
* load the control interface modules
*/
static void load_interfaces(private_interface_manager_t *this)
{
struct dirent* entry;
DIR* dir;
dir = opendir(IPSEC_INTERFACEDIR);
if (dir == NULL)
{
DBG1(DBG_CFG, "error opening interface modules directory "IPSEC_INTERFACEDIR);
return;
}
DBG1(DBG_CFG, "loading control interface modules from '"IPSEC_INTERFACEDIR"'");
while ((entry = readdir(dir)) != NULL)
{
char file[256];
interface_t *interface;
interface_constructor_t constructor;
void *handle;
char *ending;
snprintf(file, sizeof(file), IPSEC_INTERFACEDIR"/%s", entry->d_name);
ending = entry->d_name + strlen(entry->d_name) - 3;
if (ending <= entry->d_name || !streq(ending, ".so"))
{
/* skip anything which does not look like a library */
DBG2(DBG_CFG, " skipping %s, doesn't look like a library",
entry->d_name);
continue;
}
/* try to load the library */
handle = dlopen(file, RTLD_LAZY);
if (handle == NULL)
{
DBG1(DBG_CFG, " opening control interface module %s failed: %s",
entry->d_name, dlerror());
continue;
}
constructor = dlsym(handle, "interface_create");
if (constructor == NULL)
{
DBG1(DBG_CFG, " interface module %s has no interface_create() "
"function, skipped", entry->d_name);
dlclose(handle);
continue;
}
interface = constructor();
if (interface == NULL)
{
DBG1(DBG_CFG, " unable to create instance of interface "
"module %s, skipped", entry->d_name);
dlclose(handle);
continue;
}
DBG1(DBG_CFG, " loaded control interface module successfully from %s", entry->d_name);
this->interfaces->insert_last(this->interfaces, interface);
this->handles->insert_last(this->handles, handle);
}
closedir(dir);
}
/**
* See header
*/
bool interface_manager_cb_empty(void *param, signal_t signal, level_t level,
bool controller_cb_empty(void *param, signal_t signal, level_t level,
ike_sa_t *ike_sa, char *format, va_list args)
{
return TRUE;
@@ -633,32 +549,25 @@ bool interface_manager_cb_empty(void *param, signal_t signal, level_t level,
/**
* Implementation of stroke_t.destroy.
*/
static void destroy(private_interface_manager_t *this)
static void destroy(private_controller_t *this)
{
this->interfaces->destroy_offset(this->interfaces, offsetof(interface_t, destroy));
this->handles->destroy_function(this->handles, (void*)dlclose);
free(this);
}
/*
* Described in header-file
*/
interface_manager_t *interface_manager_create(void)
controller_t *controller_create(void)
{
private_interface_manager_t *this = malloc_thing(private_interface_manager_t);
private_controller_t *this = malloc_thing(private_controller_t);
this->public.create_ike_sa_iterator = (iterator_t*(*)(interface_manager_t*))create_ike_sa_iterator;
this->public.initiate = (status_t(*)(interface_manager_t*,peer_cfg_t*,child_cfg_t*,bool(*)(void*,signal_t,level_t,ike_sa_t*,char*,va_list),void*))initiate;
this->public.terminate_ike = (status_t(*)(interface_manager_t*,u_int32_t,interface_manager_cb_t, void*))terminate_ike;
this->public.terminate_child = (status_t(*)(interface_manager_t*,u_int32_t,interface_manager_cb_t, void *param))terminate_child;
this->public.route = (status_t(*)(interface_manager_t*,peer_cfg_t*, child_cfg_t*,interface_manager_cb_t,void*))route;
this->public.unroute = (status_t(*)(interface_manager_t*,u_int32_t,interface_manager_cb_t,void*))unroute;
this->public.destroy = (void (*)(interface_manager_t*))destroy;
this->interfaces = linked_list_create();
this->handles = linked_list_create();
load_interfaces(this);
this->public.create_ike_sa_iterator = (iterator_t*(*)(controller_t*))create_ike_sa_iterator;
this->public.initiate = (status_t(*)(controller_t*,peer_cfg_t*,child_cfg_t*,bool(*)(void*,signal_t,level_t,ike_sa_t*,char*,va_list),void*))initiate;
this->public.terminate_ike = (status_t(*)(controller_t*,u_int32_t,controller_cb_t, void*))terminate_ike;
this->public.terminate_child = (status_t(*)(controller_t*,u_int32_t,controller_cb_t, void *param))terminate_child;
this->public.route = (status_t(*)(controller_t*,peer_cfg_t*, child_cfg_t*,controller_cb_t,void*))route;
this->public.unroute = (status_t(*)(controller_t*,u_int32_t,controller_cb_t,void*))unroute;
this->public.destroy = (void (*)(controller_t*))destroy;
return &this->public;
}
src/charon/control/interface_manager.h → src/charon/control/controller.h
+42 -74
View File
@@ -1,10 +1,3 @@
/**
* @file interface_manager.h
*
* @brief Interface of interface_manager_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -18,15 +11,22 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#ifndef INTERFACE_MANAGER_H_
#define INTERFACE_MANAGER_H_
/**
* @defgroup controller_i controller
* @{ @ingroup control
*/
#ifndef CONTROLLER_H_
#define CONTROLLER_H_
#include <bus/bus.h>
/**
* callback to log things triggered by interface_manager.
* callback to log things triggered by controller.
*
* @param param echoed parameter supplied when function invoked
* @param signal type of signal
@@ -35,74 +35,51 @@
* @param format printf like format string
* @param args list of arguments to use for format
* @return FALSE to return from invoked function
* @ingroup control
*/
typedef bool(*interface_manager_cb_t)(void* param, signal_t signal, level_t level,
typedef bool(*controller_cb_t)(void* param, signal_t signal, level_t level,
ike_sa_t* ike_sa, char* format, va_list args);
/**
* @brief Empty callback function for interface_manager_t functions.
* Empty callback function for controller_t functions.
*
* If you wan't to do a syncrhonous call, but don't need a callback, pass
* this function to the interface_managers methods.
* this function to the controllers methods.
*/
bool interface_manager_cb_empty(void *param, signal_t signal, level_t level,
bool controller_cb_empty(void *param, signal_t signal, level_t level,
ike_sa_t *ike_sa, char *format, va_list args);
typedef struct interface_manager_t interface_manager_t;
typedef struct controller_t controller_t;
/**
* @brief The interface_manager loads control interfaces and has helper methods.
* The controller provides a simple interface to run actions.
*
* One job of the interface manager is to load pluggable control interface
* modules, implemented as interface_t.
* @verbatim
+---------+ +------------+ +--------------+ |
| | | |<----- +--------------+ | |
| daemon |<-----| interface- | +--------------+ |-+ <==|==> IPC
| core | | manager |<----| interfaces |-+ |
| |<-----| | +--------------+ |
| | | | |
+---------+ +------------+ |
@endverbatim
* The manager does not really use the interfaces, instead, the interface
* use the manager to fullfill their tasks (initiating, terminating, ...).
* The interface_manager starts actions by creating jobs. It then tries to
* The controller starts actions by creating jobs. It then tries to
* evaluate the result of the operation by listening on the bus.
*
* Passing NULL as callback to the managers function calls them asynchronously.
* If a callback is specified, they are called synchronoulsy. There is a default
* callback "interface_manager_cb_empty" if you wan't to call a function
* callback "controller_cb_empty" if you wan't to call a function
* synchronously, but don't need a callback.
*
* @b Constructors:
* - interface_manager_create()
*
* @ingroup control
*/
struct interface_manager_t {
struct controller_t {
/**
* @brief Create an iterator for all IKE_SAs.
* Create an iterator for all IKE_SAs.
*
* The iterator blocks the IKE_SA manager until it gets destroyed. Do
* not call another interface/manager method while the iterator is alive.
*
* @param this calling object
* @return iterator, locks IKE_SA manager until destroyed
*/
iterator_t* (*create_ike_sa_iterator)(interface_manager_t *this);
iterator_t* (*create_ike_sa_iterator)(controller_t *this);
/**
* @brief Initiate a CHILD_SA, and if required, an IKE_SA.
* Initiate a CHILD_SA, and if required, an IKE_SA.
*
* The inititate() function is synchronous and thus blocks until the
* IKE_SA is established or failed. Because of this, the initiate() function
* contains a thread cancellation point.
*
* @param this calling object
* @param peer_cfg peer_cfg to use for IKE_SA setup
* @param child_cfg child_cfg to set up CHILD_SA from
* @param cb logging callback
@@ -112,18 +89,17 @@ struct interface_manager_t {
* - FAILED, if setup failed
* - NEED_MORE, if callback returned FALSE
*/
status_t (*initiate)(interface_manager_t *this,
status_t (*initiate)(controller_t *this,
peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
interface_manager_cb_t callback, void *param);
controller_cb_t callback, void *param);
/**
* @brief Terminate an IKE_SA and all of its CHILD_SAs.
* Terminate an IKE_SA and all of its CHILD_SAs.
*
* The terminate() function is synchronous and thus blocks until the
* IKE_SA is properly deleted, or the delete timed out.
* The terminate() function contains a thread cancellation point.
*
* @param this calling object
* @param unique_id unique id of the IKE_SA to terminate.
* @param cb logging callback
* @param param parameter to include in each call of cb
@@ -132,13 +108,12 @@ struct interface_manager_t {
* - NOT_FOUND, if no such CHILD_SA found
* - NEED_MORE, if callback returned FALSE
*/
status_t (*terminate_ike)(interface_manager_t *this, u_int32_t unique_id,
interface_manager_cb_t callback, void *param);
status_t (*terminate_ike)(controller_t *this, u_int32_t unique_id,
controller_cb_t callback, void *param);
/**
* @brief Terminate a CHILD_SA.
* Terminate a CHILD_SA.
*
* @param this calling object
* @param reqid reqid of the CHILD_SA to terminate
* @param cb logging callback
* @param param parameter to include in each call of cb
@@ -147,13 +122,12 @@ struct interface_manager_t {
* - NOT_FOUND, if no such CHILD_SA found
* - NEED_MORE, if callback returned FALSE
*/
status_t (*terminate_child)(interface_manager_t *this, u_int32_t reqid,
interface_manager_cb_t callback, void *param);
status_t (*terminate_child)(controller_t *this, u_int32_t reqid,
controller_cb_t callback, void *param);
/**
* @brief Route a CHILD_SA (install triggering policies).
* Route a CHILD_SA (install triggering policies).
*
* @param this calling object
* @param peer_cfg peer_cfg to use for IKE_SA setup, if triggered
* @param child_cfg child_cfg to route
* @param cb logging callback
@@ -163,16 +137,15 @@ struct interface_manager_t {
* - FAILED, if routing failed
* - NEED_MORE, if callback returned FALSE
*/
status_t (*route)(interface_manager_t *this,
status_t (*route)(controller_t *this,
peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
interface_manager_cb_t callback, void *param);
controller_cb_t callback, void *param);
/**
* @brief Unroute a routed CHILD_SA (uninstall triggering policies).
* Unroute a routed CHILD_SA (uninstall triggering policies).
*
* Only the route is removed, not the CHILD_SAs the route triggered.
*
* @param this calling object
* @param reqid reqid of the CHILD_SA to unroute
* @param cb logging callback
* @param param parameter to include in each call of cb
@@ -181,26 +154,21 @@ struct interface_manager_t {
* - NOT_FOUND, if no such CHILD_SA routed
* - NEED_MORE, if callback returned FALSE
*/
status_t (*unroute)(interface_manager_t *this, u_int32_t reqid,
interface_manager_cb_t callback, void *param);
status_t (*unroute)(controller_t *this, u_int32_t reqid,
controller_cb_t callback, void *param);
/**
* @brief Destroy a interface_manager_t instance.
*
* @param this interface_manager_t objec to destroy
* Destroy a controller_t instance.
*/
void (*destroy) (interface_manager_t *this);
void (*destroy) (controller_t *this);
};
/**
* @brief Creates a interface_manager instance and loads all interface modules.
* Creates a controller instance.
*
* @return interface_manager_t object
*
* @ingroup control
* @return controller_t object
*/
interface_manager_t *interface_manager_create(void);
#endif /* INTERFACE_MANAGER_H_ */
controller_t *controller_create(void);
#endif /* CONTROLLER_H_ @} */
src/charon/control/interfaces/interface.h
-59
View File
@@ -1,59 +0,0 @@
/**
* @file interface.h
*
* @brief Interface of interface_t.
*
*/
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef INTERFACE_H_
#define INTERFACE_H_
typedef struct interface_t interface_t;
/**
* @brief Interface for a controller.
*
* An interface controls the daemon by calling functions on the
* interface_manager. All interfaces are manager by the interface_manager
* in a generic way, so they need their own class.
*
* @b Constructors:
* - interface_create() of one of the modules
*
* @ingroup interfaces
*/
struct interface_t {
/**
* @brief Destroy all interfaces
*
* @param this stroke_t objec to destroy
*/
void (*destroy) (interface_t *this);
};
/**
* Constructor in a control interface module to create the interface.
*
* @ingroup interfaces
*/
typedef interface_t*(*interface_constructor_t)(void);
#endif /* INTERFACE_H_ */
src/charon/control/interfaces/stroke_interface.c
-1818
View File
File diff suppressed because it is too large Load Diff
src/charon/credentials/auth_info.c
+356
View File
@@ -0,0 +1,356 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "auth_info.h"
#include <daemon.h>
#include <utils/linked_list.h>
#include <utils/identification.h>
#include <credentials/certificates/certificate.h>
ENUM(auth_item_names, AUTHN_CA_CERT, AUTHZ_AC_GROUP,
"AUTHN_CA_CERT",
"AUTHN_IM_CERT",
"AUTHN_SUBJECT_CERT",
"AUTHZ_PUBKEY",
"AUTHZ_PSK",
"AUTHZ_EAP",
"AUTHZ_CA_CERT",
"AUTHZ_IM_CERT",
"AUTHZ_SUBJECT_CERT",
"AUTHZ_CRL_VALIDATION",
"AUTHZ_OCSP_VALIDATION",
"AUTHZ_AC_GROUP",
);
typedef struct private_auth_info_t private_auth_info_t;
/**
* private data of item_set
*/
struct private_auth_info_t {
/**
* public functions
*/
auth_info_t public;
/**
* list of item_t's
*/
linked_list_t *items;
};
typedef struct item_t item_t;
struct item_t {
/** type of this item */
auth_item_t type;
/** associated privlege value, if any */
void *value;
};
/**
* implements item_enumerator_t.enumerate
*/
static bool item_filter(void *data, item_t **item, auth_item_t *type,
void *unused, void **value)
{
*type = (*item)->type;
*value = (*item)->value;
return TRUE;
}
/**
* Implementation of auth_info_t.create_item_enumerator.
*/
static enumerator_t* create_item_enumerator(private_auth_info_t *this)
{
return enumerator_create_filter(this->items->create_enumerator(this->items),
(void*)item_filter, NULL, NULL);
}
/**
* Implementation of auth_info_t.get_item.
*/
static bool get_item(private_auth_info_t *this, auth_item_t type, void** value)
{
enumerator_t *enumerator;
void *current_value;
auth_item_t current_type;
bool found = FALSE;
enumerator = create_item_enumerator(this);
while (enumerator->enumerate(enumerator, &current_type, &current_value))
{
if (type == current_type)
{
*value = current_value;
found = TRUE;
break;
}
}
enumerator->destroy(enumerator);
return found;
}
/**
* Implementation of auth_info_t.add_item.
*/
static void add_item(private_auth_info_t *this, auth_item_t type, void *value)
{
item_t *item = malloc_thing(item_t);
item->type = type;
switch (type)
{
case AUTHZ_PUBKEY:
{
public_key_t *key = (public_key_t*)value;
item->value = key->get_ref(key);
break;
}
case AUTHZ_PSK:
{
shared_key_t *key = (shared_key_t*)value;
item->value = key->get_ref(key);
break;
}
case AUTHN_CA_CERT:
case AUTHN_IM_CERT:
case AUTHN_SUBJECT_CERT:
case AUTHZ_CA_CERT:
case AUTHZ_IM_CERT:
case AUTHZ_SUBJECT_CERT:
{
certificate_t *cert = (certificate_t*)value;
item->value = cert->get_ref(cert);
break;
}
case AUTHZ_CRL_VALIDATION:
case AUTHZ_OCSP_VALIDATION:
{
cert_validation_t *validation = malloc_thing(cert_validation_t);
*validation = *(cert_validation_t*)value;
item->value = validation;
break;
}
case AUTHZ_EAP:
{
eap_method_t *method = malloc_thing(eap_method_t);
*method = *(eap_method_t*)value;
item->value = method;
break;
}
case AUTHZ_AC_GROUP:
{
identification_t *id = (identification_t*)value;
item->value = id->clone(id);
break;
}
}
this->items->insert_last(this->items, item);
}
/**
* Implementation of auth_info_t.complies.
*/
static bool complies(private_auth_info_t *this, auth_info_t *constraints)
{
enumerator_t *enumerator;
bool success = TRUE;
auth_item_t type;
void *value;
enumerator = constraints->create_item_enumerator(constraints);
while (enumerator->enumerate(enumerator, &type, &value))
{
switch (type)
{
case AUTHN_CA_CERT:
case AUTHN_IM_CERT:
case AUTHN_SUBJECT_CERT:
{ /* skip non-authorization tokens */
continue;
}
case AUTHZ_CRL_VALIDATION:
case AUTHZ_OCSP_VALIDATION:
{
cert_validation_t *valid;
/* OCSP validation is also sufficient for CRL constraint, but
* not vice-versa */
if (!get_item(this, type, (void**)&valid) &&
type == AUTHZ_CRL_VALIDATION &&
!get_item(this, AUTHZ_OCSP_VALIDATION, (void**)&valid))
{
DBG1(DBG_CFG, "constraint check failed: %N requires at "
"least %N, but no check done", auth_item_names, type,
cert_validation_names, *(cert_validation_t*)value);
success = FALSE;
break;
}
switch (*(cert_validation_t*)value)
{
case VALIDATION_SKIPPED:
if (*valid == VALIDATION_SKIPPED)
{
break;
} /* FALL */
case VALIDATION_GOOD:
if (*valid == VALIDATION_GOOD)
{
break;
} /* FALL */
default:
DBG1(DBG_CFG, "constraint check failed: %N is %N, but "
"requires at least %N", auth_item_names, type,
cert_validation_names, *valid,
cert_validation_names, *(cert_validation_t*)value);
success = FALSE;
break;
}
break;
}
case AUTHZ_PUBKEY:
case AUTHZ_PSK:
case AUTHZ_IM_CERT:
case AUTHZ_SUBJECT_CERT:
case AUTHZ_EAP:
case AUTHZ_AC_GROUP:
DBG1(DBG_CFG, "constraint check %N not implemented!",
auth_item_names, type);
success = FALSE;
break;
case AUTHZ_CA_CERT:
{
certificate_t *cert;
if (!get_item(this, AUTHZ_CA_CERT, (void**)&cert) ||
!cert->equals(cert, (certificate_t*)value))
{
cert = (certificate_t*)value;
DBG1(DBG_CFG, "constraint check failed: peer not "
"authenticated by CA '%D'.", cert->get_issuer(cert));
success = FALSE;
}
break;
}
}
if (!success)
{
break;
}
}
enumerator->destroy(enumerator);
return success;
}
/**
* Implementation of auth_info_t.merge.
*/
static void merge(private_auth_info_t *this, private_auth_info_t *other)
{
item_t *item;
while (other->items->remove_first(other->items, (void**)&item) == SUCCESS)
{
this->items->insert_last(this->items, item);
}
}
/**
* Implementation of auth_info_t.destroy
*/
static void destroy(private_auth_info_t *this)
{
item_t *item;
while (this->items->remove_last(this->items, (void**)&item) == SUCCESS)
{
switch (item->type)
{
case AUTHZ_PUBKEY:
{
public_key_t *key = (public_key_t*)item->value;
key->destroy(key);
break;
}
case AUTHZ_PSK:
{
shared_key_t *key = (shared_key_t*)item->value;
key->destroy(key);
break;
}
case AUTHN_CA_CERT:
case AUTHN_IM_CERT:
case AUTHN_SUBJECT_CERT:
case AUTHZ_CA_CERT:
case AUTHZ_IM_CERT:
case AUTHZ_SUBJECT_CERT:
{
certificate_t *cert = (certificate_t*)item->value;
cert->destroy(cert);
break;
}
case AUTHZ_CRL_VALIDATION:
case AUTHZ_OCSP_VALIDATION:
case AUTHZ_EAP:
{
free(item->value);
break;
}
case AUTHZ_AC_GROUP:
{
identification_t *id = (identification_t*)item->value;
id->destroy(id);
break;
}
}
free(item);
}
this->items->destroy(this->items);
free(this);
}
/*
* see header file
*/
auth_info_t *auth_info_create()
{
private_auth_info_t *this = malloc_thing(private_auth_info_t);
this->public.add_item = (void(*)(auth_info_t*, auth_item_t type, void *value))add_item;
this->public.get_item = (bool(*)(auth_info_t*, auth_item_t type, void **value))get_item;
this->public.create_item_enumerator = (enumerator_t*(*)(auth_info_t*))create_item_enumerator;
this->public.complies = (bool(*)(auth_info_t*, auth_info_t *))complies;
this->public.merge = (void(*)(auth_info_t*, auth_info_t *other))merge;
this->public.destroy = (void(*)(auth_info_t*))destroy;
this->items = linked_list_create();
return &this->public;
}
src/charon/credentials/auth_info.h
+158
View File
@@ -0,0 +1,158 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup auth_info auth_info
* @{ @ingroup ccredentials
*/
#ifndef AUTH_INFO_H_
#define AUTH_INFO_H_
#include <utils/enumerator.h>
typedef struct auth_info_t auth_info_t;
typedef enum auth_item_t auth_item_t;
/**
* Authentication/Authorization process helper item.
*
* For the authentication process, further information may be needed. These
* items are defined as auth_item_t and have a AUTHN prefix.
* The authentication process returns important data for the authorization
* process, these items are defined with a AUTHZ prefix.
* Authentication uses AUTHN items and creates AUTHZ items during authentication,
* authorization reads AUTHZ values to give out privileges.
*
* +---+ +---------------------+
* | A | | A |
* | u | | u +-----------+ |
* | t | | t | Required | |
* | h | | h | auth_info | |
* | e | | o +-----------+ |
* | n | | r | |
* +-----------+ | t | | i | |
* | Provided | | i | | z V |
* | auth_info |--| c |-------------| a ----> match? ----|------->
* +-----------+ | a | | t |
* | t | | i |
* | i | | o |
* | o | | n |
* | n | | |
* +---+ +---------------------+
*/
enum auth_item_t {
/*
* items provided to authentication process
*/
/** CA certificate to use for authentication, value is certificate_t* */
AUTHN_CA_CERT,
/** intermediate certificate, value is certificate_t* */
AUTHN_IM_CERT,
/** certificate for trustchain verification, value is certificate_t* */
AUTHN_SUBJECT_CERT,
/*
* item provided to authorization process
*/
/** subject has been authenticated by public key, value is public_key_t* */
AUTHZ_PUBKEY,
/** subject has ben authenticated using preshared secrets, value is shared_key_t* */
AUTHZ_PSK,
/** subject has been authenticated using EAP, value is eap_method_t */
AUTHZ_EAP,
/** certificate authority, value is certificate_t* */
AUTHZ_CA_CERT,
/** intermediate certificate in trustchain, value is certificate_t* */
AUTHZ_IM_CERT,
/** subject certificate, value is certificate_t* */
AUTHZ_SUBJECT_CERT,
/** result of a CRL validation, value is cert_validation_t */
AUTHZ_CRL_VALIDATION,
/** result of a OCSP validation, value is cert_validation_t */
AUTHZ_OCSP_VALIDATION,
/** subject is in attribute certificate group, value is identification_t* */
AUTHZ_AC_GROUP,
};
/**
* enum name for auth_item_t.
*/
extern enum_name_t *auth_item_names;
/**
* The auth_info class contains auth_item_t's used for AA.
*
* A auth_info allows the separation of authentication and authorization.
*/
struct auth_info_t {
/**
* Add an item to the set.
*
* @param type auth_info type
* @param value associated value to auth_info type, if any
*/
void (*add_item)(auth_info_t *this, auth_item_t type, void *value);
/**
* Get an item.
*
* @param type auth_info type to get
* @param value pointer to a pointer receiving item
* @return bool if item has been found
*/
bool (*get_item)(auth_info_t *this, auth_item_t type, void **value);
/**
* Create an enumerator over all items.
*
* @return enumerator over (auth_item_t type, void *value)
*/
enumerator_t* (*create_item_enumerator)(auth_info_t *this);
/**
* Check if this fulfills a set of required constraints.
*
* @param constraints required authorization infos
* @return TRUE if this complies with constraints
*/
bool (*complies)(auth_info_t *this, auth_info_t *constraints);
/**
* Merge items from other into this.
*
* Items do not get cloned, but moved from other to this.
*
* @param other items to read for merge
*/
void (*merge)(auth_info_t *this, auth_info_t *other);
/**
* Destroy a auth_info instance with all associated values.
*/
void (*destroy)(auth_info_t *this);
};
/**
* Create a auth_info instance.
*/
auth_info_t *auth_info_create();
#endif /* AUTH_INFO_H_ @}*/
src/charon/credentials/credential_manager.c
+1385
View File
File diff suppressed because it is too large Load Diff
src/charon/credentials/credential_manager.h
+187
View File
@@ -0,0 +1,187 @@
/*
* Copyright (C) 2007-2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup credential_manager credential_manager
* @{ @ingroup ccredentials
*/
#ifndef CREDENTIAL_MANAGER_H_
#define CREDENTIAL_MANAGER_H_
#include <utils/identification.h>
#include <utils/enumerator.h>
#include <credentials/auth_info.h>
#include <credentials/credential_set.h>
#include <credentials/keys/private_key.h>
#include <credentials/keys/shared_key.h>
#include <credentials/certificates/certificate.h>
typedef struct credential_manager_t credential_manager_t;
/**
* Manages credentials using credential_sets.
*
* The credential manager is the entry point of the credential framework. It
* uses so called "sets" to access credentials in a modular fashion, these
* are implemented through the credential_set_t interface.
* The manager additionally does trust chain verification and trust status
* chaching. A set may call the managers methods if it needs credentials itself,
* the manager uses recursive locking.
*
* @verbatim
+-------+ +----------------+
| A | | | +------------------+
| u | -----> | | ------> | +------------------+
| t | | credential- | | | +------------------+
| h | -----> | manager | ------> +--| | credential- | => IPC
| e | | | +--| sets |
| n | +--> | | ------> +------------------+
| t | | | | |
| i | | | | |
| c | | +----------------+ |
| a | | |
| t | +----------------------------------------------+
| o | may be recursive
| r |
+-------+
@endverbatim
*
* Synchronization is done completely in the manager, so the sets don't have
* to worry about it. The locking mechanism is reentrant save, so sets can
* call the manager.
*/
struct credential_manager_t {
/**
* Create an enumerator over all certificates.
*
* @param cert kind of certificate
* @param key kind of key in certificate
* @param id subject this certificate belongs to
* @param trusted TRUE to list trusted certificates only
* @return enumerator over the certificates
*/
enumerator_t *(*create_cert_enumerator)(credential_manager_t *this,
certificate_type_t cert, key_type_t key,
identification_t *id, bool trusted);
/**
* Create an enumerator over all shared keys.
*
* The enumerator enumerates over:
* shared_key_t*, id_match_t me, id_match_t other
* But must accepts values for the id_matches.
*
* @param type kind of requested shared key
* @param first first subject between key is shared
* @param second second subject between key is shared
* @return enumerator over shared keys
*/
enumerator_t *(*create_shared_enumerator)(credential_manager_t *this,
shared_key_type_t type,
identification_t *first, identification_t *second);
/**
* Create an enumerator over all Certificate Distribution Points.
*
* @param type kind of certificate the point distributes
* @param id identification of the distributed certificate
* @return enumerator of CDPs as char*
*/
enumerator_t *(*create_cdp_enumerator)(credential_manager_t *this,
credential_type_t type, identification_t *id);
/**
* Get a trusted or untrusted certificate.
*
* @param cert kind of certificate
* @param key kind of key in certificate
* @param id subject this certificate belongs to
* @param trusted TRUE to get a trusted certificate only
* @return certificate, if found, NULL otherwise
*/
certificate_t *(*get_cert)(credential_manager_t *this,
certificate_type_t cert, key_type_t key,
identification_t *id, bool trusted);
/**
* Get the best matching shared key for two IDs.
*
* @param type kind of requested shared key
* @param me own identity
* @param other peers identity
* @param auth auth_info helper
* @return shared_key_t, NULL if none found
*/
shared_key_t *(*get_shared)(credential_manager_t *this, shared_key_type_t type,
identification_t *me, identification_t *other);
/**
* Get a private key to create a signature.
*
* The get_private() method gets a secret private key identified by either
* the keyid itself or an id the key belongs to.
* The auth parameter contains additional information, such as receipients
* trusted CA certs. Auth gets filled with subject and CA certificates
* needed to validate a created signature.
*
* @param type type of the key to get
* @param id identification the key belongs to
* @param auth auth_info helper, including trusted CA certificates
* @return private_key_t, NULL if none found
*/
private_key_t* (*get_private)(credential_manager_t *this, key_type_t type,
identification_t *id, auth_info_t *auth);
/**
* Get a public key to verify a signature.
*
* The get_public() method gets a trusted public key to verify a signature
* of id. The auth parameter contains additional authentication infos,
* e.g. peer and intermediate certificates.
*
* @param type type of key to get
* @param id identification the key belongs to
* @param auth auth_info helper, including certificates to verify key
* @return public_key_t, NULL if none found
*/
public_key_t* (*get_public)(credential_manager_t *this, key_type_t type,
identification_t *id, auth_info_t *auth);
/**
* Register a credential set to the manager.
*
* @param set set to register
*/
void (*add_set)(credential_manager_t *this, credential_set_t *set);
/**
* Unregister a credential set from the manager.
*
* @param set set to unregister
*/
void (*remove_set)(credential_manager_t *this, credential_set_t *set);
/**
* Destroy a credential_manager instance.
*/
void (*destroy)(credential_manager_t *this);
};
/**
* Create a credential_manager instance.
*/
credential_manager_t *credential_manager_create();
#endif /* CREDENTIAL_MANAGER_H_ @} */
src/charon/credentials/credential_set.h
+93
View File
@@ -0,0 +1,93 @@
/*
* Copyright (C) 2007 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup credential_set credential_set
* @{ @ingroup ccredentials
*/
#ifndef CREDENTIAL_SET_H_
#define CREDENTIAL_SET_H_
#include <credentials/keys/public_key.h>
#include <credentials/keys/shared_key.h>
#include <credentials/certificates/certificate.h>
typedef struct credential_set_t credential_set_t;
/**
* A set of credentials.
*
* Contains private keys, shared keys and different kinds of certificates.
* Enumerators are used because queries might return multiple matches.
* Filter parameters restrict enumeration over specific items only.
* See credential_manager_t for an overview of the credential framework.
*/
struct credential_set_t {
/**
* Create an enumerator over private keys (private_key_t).
*
* The id is either a key identifier of the requested key, or an identity
* of the key owner.
*
* @param type type of requested private key
* @param id key identifier/owner
* @return enumerator over private_key_t's.
*/
enumerator_t *(*create_private_enumerator)(credential_set_t *this,
key_type_t type, identification_t *id);
/**
* Create an enumerator over certificates (certificate_t).
*
* @param cert kind of certificate
* @param key kind of key in certificate
* @param id identity (subject) this certificate belongs to
* @param trusted whether the certificate must be trustworthy
* @return enumerator as described above
*/
enumerator_t *(*create_cert_enumerator)(credential_set_t *this,
certificate_type_t cert, key_type_t key,
identification_t *id, bool trusted);
/**
* Create an enumerator over shared keys (shared_key_t).
*
* The enumerator enumerates over:
* shared_key_t*, id_match_t me, id_match_t other
* But must accept NULL values for the id_matches.
*
* @param type kind of requested shared key
* @param me own identity
* @param other other identity who owns that secret
* @return enumerator as described above
*/
enumerator_t *(*create_shared_enumerator)(credential_set_t *this,
shared_key_type_t type,
identification_t *me, identification_t *other);
/**
* Create an enumerator over certificate distribution points.
*
* @param type type of the certificate to get a CDP
* @param id identification of the distributed certificate
* @return an enumerator over CDPs as char*
*/
enumerator_t *(*create_cdp_enumerator)(credential_set_t *this,
certificate_type_t type, identification_t *id);
};
#endif /* CREDENTIAL_SET_H_ @} */
src/charon/daemon.c
+50 -47
View File
@@ -1,13 +1,7 @@
/**
* @file daemon.c
*
* @brief Implementation of daemon_t and main of IKEv2-Daemon.
*
*/
/* Copyright (C) 2006-2007 Tobias Brunner
/*
* Copyright (C) 2006-2007 Tobias Brunner
* Copyright (C) 2006 Daniel Roethlisberger
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -41,11 +35,9 @@
#include "daemon.h"
#include <library.h>
#include <crypto/ca.h>
#include <utils/fetcher.h>
#include <config/credentials/local_credential_store.h>
#include <config/backends/local_backend.h>
#include <sa/authenticators/eap/eap_method.h>
#include <credentials/credential_manager.h>
#include <config/backend_manager.h>
#include <config/traffic_selector.h>
/* on some distros, a capset definition is missing */
#ifdef NO_CAPSET_DEFINED
@@ -100,6 +92,12 @@ static void dbg_bus(int level, char *fmt, ...)
charon->bus->vsignal(charon->bus, DBG_LIB, level, fmt, args);
va_end(args);
}
/**
* Logging hook for library logs before logging facility initiated
*/
static void dbg_silent(int level, char *fmt, ...)
{
}
/**
* Logging hook for library logs, using stderr output
@@ -171,12 +169,17 @@ static void run(private_daemon_t *this)
static void destroy(private_daemon_t *this)
{
/* terminate all idle threads */
this->public.processor->set_threads(this->public.processor, 0);
if (this->public.processor)
{
this->public.processor->set_threads(this->public.processor, 0);
}
/* close all IKE_SAs */
DESTROY_IF(this->public.plugins);
DESTROY_IF(this->public.ike_sa_manager);
DESTROY_IF(this->public.kernel_interface);
DESTROY_IF(this->public.scheduler);
DESTROY_IF(this->public.interfaces);
DESTROY_IF(this->public.controller);
DESTROY_IF(this->public.eap);
#ifdef P2P
DESTROY_IF(this->public.connect_manager);
DESTROY_IF(this->public.mediation_manager);
@@ -323,29 +326,38 @@ static bool initialize(private_daemon_t *this, bool syslog, level_t levels[])
#endif /* INTEGRITY_TEST */
this->public.ike_sa_manager = ike_sa_manager_create();
if (this->public.ike_sa_manager == NULL)
{
return FALSE;
}
this->public.processor = processor_create();
this->public.scheduler = scheduler_create();
/* load secrets, ca certificates and crls */
this->public.credentials = (credential_store_t*)local_credential_store_create();
this->public.credentials->load_ca_certificates(this->public.credentials);
this->public.credentials->load_aa_certificates(this->public.credentials);
this->public.credentials->load_attr_certificates(this->public.credentials);
this->public.credentials->load_ocsp_certificates(this->public.credentials);
this->public.credentials->load_crls(this->public.credentials);
this->public.credentials->load_secrets(this->public.credentials, FALSE);
this->public.interfaces = interface_manager_create();
this->public.credentials = credential_manager_create();
this->public.controller = controller_create();
this->public.eap = eap_manager_create();
this->public.backends = backend_manager_create();
this->public.plugins = plugin_loader_create();
this->public.kernel_interface = kernel_interface_create();
this->public.socket = socket_create();
this->public.sender = sender_create();
this->public.receiver = receiver_create();
if (this->public.receiver == NULL)
{
return FALSE;
}
#ifdef P2P
this->public.connect_manager = connect_manager_create();
if (this->public.connect_manager == NULL)
{
return FALSE;
}
this->public.mediation_manager = mediation_manager_create();
#endif /* P2P */
this->public.plugins->load(this->public.plugins, IPSEC_PLUGINDIR, "libcharon-");
return TRUE;
}
@@ -401,7 +413,9 @@ private_daemon_t *daemon_create(void)
this->public.scheduler = NULL;
this->public.kernel_interface = NULL;
this->public.processor = NULL;
this->public.interfaces = NULL;
this->public.controller = NULL;
this->public.eap = NULL;
this->public.plugins = NULL;
this->public.bus = NULL;
this->public.outlog = NULL;
this->public.syslog = NULL;
@@ -443,7 +457,6 @@ static void usage(const char *msg)
" [--strictcrlpolicy]\n"
" [--cachecrls]\n"
" [--crlcheckinterval <interval>]\n"
" [--eapdir <dir>]\n"
" [--use-syslog]\n"
" [--debug-<type> <level>]\n"
" <type>: log context type (dmn|mgr|ike|chd|job|cfg|knl|net|enc|lib)\n"
@@ -460,10 +473,8 @@ static void usage(const char *msg)
int main(int argc, char *argv[])
{
u_int crl_check_interval = 0;
strict_t strict_crl_policy = STRICT_NO;
bool cache_crls = FALSE;
bool use_syslog = FALSE;
char *eapdir = IPSEC_EAPDIR;
private_daemon_t *private_charon;
FILE *pid_file;
@@ -471,6 +482,14 @@ int main(int argc, char *argv[])
level_t levels[DBG_MAX];
int signal;
/* silence the library during initialization, as we have no bus yet */
dbg = dbg_silent;
/* initialize library */
library_init(IPSEC_DIR "/strongswan.conf");
lib->plugins->load(lib->plugins, IPSEC_PLUGINDIR, "libstrongswan-");
lib->printf_hook->add_handler(lib->printf_hook, 'R',
traffic_selector_get_printf_hooks());
private_charon = daemon_create();
charon = (daemon_t*)private_charon;
@@ -491,10 +510,8 @@ int main(int argc, char *argv[])
{ "help", no_argument, NULL, 'h' },
{ "version", no_argument, NULL, 'v' },
{ "use-syslog", no_argument, NULL, 'l' },
{ "strictcrlpolicy", required_argument, NULL, 'r' },
{ "cachecrls", no_argument, NULL, 'C' },
{ "crlcheckinterval", required_argument, NULL, 'x' },
{ "eapdir", required_argument, NULL, 'e' },
/* TODO: handle "debug-all" */
{ "debug-dmn", required_argument, &signal, DBG_DMN },
{ "debug-mgr", required_argument, &signal, DBG_MGR },
@@ -523,18 +540,12 @@ int main(int argc, char *argv[])
case 'l':
use_syslog = TRUE;
continue;
case 'r':
strict_crl_policy = atoi(optarg);
continue;
case 'C':
cache_crls = TRUE;
continue;
case 'x':
crl_check_interval = atoi(optarg);
continue;
case 'e':
eapdir = optarg;
continue;
case 0:
/* option is in signal */
levels[signal] = atoi(optarg);
@@ -554,14 +565,6 @@ int main(int argc, char *argv[])
exit(-1);
}
/* initialize fetcher_t class */
fetcher_initialize();
/* load pluggable EAP modules */
eap_method_load(eapdir);
/* set strict_crl_policy, cache_crls and crl_check_interval options */
ca_info_set_options(strict_crl_policy, cache_crls, crl_check_interval);
/* check/setup PID file */
if (stat(PID_FILE, &stb) == 0)
{
@@ -586,12 +589,12 @@ int main(int argc, char *argv[])
/* run daemon */
run(private_charon);
eap_method_unload();
fetcher_finalize();
/* normal termination, cleanup and exit */
destroy(private_charon);
unlink(PID_FILE);
library_deinit();
return 0;
}
src/charon/daemon.h
+144 -304
View File
@@ -1,14 +1,7 @@
/**
* @file daemon.h
*
* @brief Interface of daemon_t.
*
*/
/*
* Copyright (C) 2006-2007 Tobias Brunner
* Copyright (C) 2006 Daniel Roethlisberger
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005-2008 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -21,6 +14,127 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup charon charon
*
* @defgroup bus bus
* @ingroup charon
*
* @defgroup listeners listeners
* @ingroup bus
*
* @defgroup config config
* @ingroup charon
*
* @defgroup control control
* @ingroup charon
*
* @defgroup ccredentials credentials
* @ingroup charon
*
* @defgroup encoding encoding
* @ingroup charon
*
* @defgroup payloads payloads
* @ingroup encoding
*
* @defgroup kernel kernel
* @ingroup charon
*
* @defgroup network network
* @ingroup charon
*
* @defgroup cplugins plugins
* @ingroup charon
*
* @defgroup processing processing
* @ingroup charon
*
* @defgroup jobs jobs
* @ingroup processing
*
* @defgroup sa sa
* @ingroup charon
*
* @defgroup authenticators authenticators
* @ingroup sa
*
* @defgroup eap eap
* @ingroup authenticators
*
* @defgroup tasks tasks
* @ingroup sa
*
* @addtogroup charon
* @{
*
* IKEv2 keying daemon.
*
* All IKEv2 stuff is handled in charon. It uses a newer and more flexible
* architecture than pluto. Charon uses a thread-pool (called processor),
* which allows parallel execution SA-management. All threads originate
* from the processor. Work is delegated to the processor by queueing jobs
* to it.
@verbatim
+---------------------------------+ +----------------------------+
| controller | | config |
+---------------------------------+ +----------------------------+
| | | ^ ^ ^
V V V | | |
+----------+ +-----------+ +------+ +----------+ +----+
| receiver | | | | | +------+ | CHILD_SA | | K |
+---+------+ | Scheduler | | IKE- | | IKE- |--+----------+ | e |
| | | | SA |--| SA | | CHILD_SA | | r |
+------+---+ +-----------+ | | +------+ +----------+ | n |
<->| socket | | | Man- | | e |
+------+---+ +-----------+ | ager | +------+ +----------+ | l |
| | | | | | IKE- |--| CHILD_SA | | - |
+---+------+ | Processor |---| |--| SA | +----------+ | I |
| sender | | | | | +------+ | f |
+----------+ +-----------+ +------+ +----+
| | | | | |
V V V V V V
+---------------------------------+ +----------------------------+
| Bus | | credentials |
+---------------------------------+ +----------------------------+
@endverbatim
* The scheduler is responsible to execute timed events. Jobs may be queued to
* the scheduler to get executed at a defined time (e.g. rekeying). The
* scheduler does not execute the jobs itself, it queues them to the processor.
*
* The IKE_SA manager managers all IKE_SA. It further handles the
* synchronization:
* Each IKE_SA must be checked out strictly and checked in again after use. The
* manager guarantees that only one thread may check out a single IKE_SA. This
* allows us to write the (complex) IKE_SAs routines non-threadsave.
* The IKE_SA contain the state and the logic of each IKE_SA and handle the
* messages.
*
* The CHILD_SA contains state about a IPsec security association and manages
* them. An IKE_SA may have multiple CHILD_SAs. Communication to the kernel
* takes place here through the kernel interface.
*
* The kernel interface installs IPsec security associations, policies, routes
* and virtual addresses. It further provides methods to enumerate interfaces
* and may notify the daemon about state changes at lower layers.
*
* The bus receives signals from the different threads and relais them to interested
* listeners. Debugging signals, but also important state changes or error
* messages are sent over the bus.
* It's listeners are not only for logging, but also to track the state of an
* IKE_SA.
*
* The controller, credential_manager, bus and backend_manager (config) are
* places where a plugin ca register itself to privide information or observe
* and control the daemon.
*/
#ifndef DAEMON_H_
@@ -28,338 +142,55 @@
typedef struct daemon_t daemon_t;
#include <credential_store.h>
#include <network/sender.h>
#include <network/receiver.h>
#include <network/socket.h>
#include <processing/scheduler.h>
#include <processing/processor.h>
#include <kernel/kernel_interface.h>
#include <control/interface_manager.h>
#include <control/controller.h>
#include <bus/bus.h>
#include <bus/listeners/file_logger.h>
#include <bus/listeners/sys_logger.h>
#include <sa/ike_sa_manager.h>
#include <config/backend_manager.h>
#include <credentials/credential_manager.h>
#include <sa/authenticators/eap/eap_manager.h>
#include <plugins/plugin_loader.h>
#ifdef P2P
#include <sa/connect_manager.h>
#include <sa/mediation_manager.h>
#endif /* P2P */
/**
* @defgroup charon charon
*
* @brief IKEv2 keying daemon.
*
* All IKEv2 stuff is handled in charon. It uses a newer and more flexible
* architecture than pluto. Charon uses a thread-pool (called processor),
* which allows parallel execution SA-management. All threads originate
* from the processor. Work is delegated to the processor by queueing jobs
* to it.
@verbatim
+--------+ +-------+ +--------+ +-----------+ +-----------+
| Stroke | | XML | | DBUS | | Local | | SQLite |
+--------+ +-------+ +--------+ +-----------+ +-----------+
| | | | |
+---------------------------------+ +----------------------------+
| Interfaces | | Backends |
+---------------------------------+ +----------------------------+
+------------+ +-----------+ +------+ +----------+
| receiver | | | | | +------+ | CHILD_SA |
+----+-------+ | Scheduler | | IKE- | | IKE- |--+----------+
| | | | SA |--| SA | | CHILD_SA |
+-------+--+ +-----------+ | | +------+ +----------+
<->| socket | | | Man- |
+-------+--+ +-----------+ | ager | +------+ +----------+
| | | | | | IKE- |--| CHILD_SA |
+----+-------+ | Processor |--------| |--| SA | +----------+
| sender | | | | | +------+
+------------+ +-----------+ +------+
+---------------------------------+ +----------------------------+
| Bus | | Kernel Interface |
+---------------------------------+ +----------------------------+
| | |
+-------------+ +-------------+ V
| File-Logger | | Sys-Logger | //////
+-------------+ +-------------+
@endverbatim
* The scheduler is responsible to execute timed events. Jobs may be queued to
* the scheduler to get executed at a defined time (e.g. rekeying). The scheduler
* does not execute the jobs itself, it queues them to the processor.
*
* The IKE_SA manager managers all IKE_SA. It further handles the synchronization:
* Each IKE_SA must be checked out strictly and checked in again after use. The
* manager guarantees that only one thread may check out a single IKE_SA. This allows
* us to write the (complex) IKE_SAs routines non-threadsave.
* The IKE_SA contain the state and the logic of each IKE_SA and handle the messages.
*
* The CHILD_SA contains state about a IPsec security association and manages them.
* An IKE_SA may have multiple CHILD_SAs. Communication to the kernel takes place
* here through the kernel interface.
*
* The kernel interface installs IPsec security associations, policies routes and
* virtual addresses. It further provides methods to enumerate interfaces and may notify
* the daemon about state changes at lower layers.
*
* The bus receives signals from the different threads and relais them to interested
* listeners. Debugging signals, but also important state changes or error messages are
* sent over the bus.
* It's listeners are not only for logging, but also to track the state of an IKE_SA.
*
* The interface manager loads pluggable controlling interfaces. These are written to control
* the daemon from external inputs (e.g. initiate IKE_SA, close IKE_SA, ...). The interface
* manager further provides a simple API to establish these tasks.
* Backends are pluggable modules which provide configuration. They have to implement an API
* which the daemon core uses to get configuration.
*/
/**
* @defgroup bus bus
*
* Signaling bus and its listeners.
*
* @ingroup charon
*/
/**
* @defgroup config config
*
* Classes implementing configuration related things.
*
* @ingroup charon
*/
/**
* @defgroup backends backends
*
* Classes implementing configuration backends.
*
* @ingroup config
*/
/**
* @defgroup credentials credentials
*
* Trust chain verification and certificate store.
*
* @ingroup config
*/
/**
* @defgroup control control
*
* Handling of loadable control interface modules.
*
* @ingroup charon
*/
/**
* @defgroup interfaces interfaces
*
* Classes which control the daemon using IPC mechanisms.
*
* @ingroup control
*/
/**
* @defgroup encoding encoding
*
* Classes used to encode and decode IKEv2 messages.
*
* @ingroup charon
*/
/**
* @defgroup payloads payloads
*
* Classes representing specific IKEv2 payloads.
*
* @ingroup encoding
*/
/**
* @defgroup kernel kernel
*
* Classes to configure and query the kernel.
*
* @ingroup charon
*/
/**
* @defgroup network network
*
* Classes for sending and receiving UDP packets over the network.
*
* @ingroup charon
*/
/**
* @defgroup processing processing
*
* Queueing, scheduling and processing of jobs
*
* @ingroup charon
*/
/**
* @defgroup jobs jobs
*
* Jobs to queue, schedule and process.
*
* @ingroup processing
*/
/**
* @defgroup sa sa
*
* Security associations for IKE and IPSec, and its helper classes.
*
* @ingroup charon
*/
/**
* @defgroup authenticators authenticators
*
* Authenticator classes to prove identity of a peer.
*
* @ingroup sa
*/
/**
* @defgroup eap eap
*
* EAP module loader, interface and it's implementations.
*
* @ingroup authenticators
*/
/**
* @defgroup tasks tasks
*
* Tasks process and build message payloads. They are used to create
* and process multiple exchanges.
*
* @ingroup sa
*/
/**
* Name of the daemon.
*
* @ingroup charon
*/
#define DAEMON_NAME "charon"
/**
* @brief Number of threads in the thread pool.
*
* @ingroup charon
* Number of threads in the thread pool.
*/
#define WORKER_THREADS 16
/**
* UDP Port on which the daemon will listen for incoming traffic.
*
* @ingroup charon
*/
#define IKEV2_UDP_PORT 500
/**
* UDP Port to which the daemon will float to if NAT is detected.
*
* @ingroup charon
*/
#define IKEV2_NATT_PORT 4500
/**
* PID file, in which charon stores its process id
*
* @ingroup charon
*/
#define PID_FILE IPSEC_PIDDIR "/charon.pid"
/**
* Configuration directory
*
* @ingroup charon
*/
#define CONFIG_DIR IPSEC_CONFDIR
/**
* Directory of IPsec relevant files
*
* @ingroup charon
*/
#define IPSEC_D_DIR CONFIG_DIR "/ipsec.d"
/**
* Default directory for private keys
*
* @ingroup charon
*/
#define PRIVATE_KEY_DIR IPSEC_D_DIR "/private"
/**
* Default directory for end entity certificates
*
* @ingroup charon
*/
#define CERTIFICATE_DIR IPSEC_D_DIR "/certs"
/**
* Default directory for trusted Certification Authority certificates
*
* @ingroup charon
*/
#define CA_CERTIFICATE_DIR IPSEC_D_DIR "/cacerts"
/**
* Default directory for Authorization Authority certificates
*
* @ingroup charon
*/
#define AA_CERTIFICATE_DIR IPSEC_D_DIR "/aacerts"
/**
* Default directory for Attribute certificates
*
* @ingroup charon
*/
#define ATTR_CERTIFICATE_DIR IPSEC_D_DIR "/acerts"
/**
* Default directory for OCSP signing certificates
*
* @ingroup charon
*/
#define OCSP_CERTIFICATE_DIR IPSEC_D_DIR "/ocspcerts"
/**
* Default directory for CRLs
*
* @ingroup charon
*/
#define CRL_DIR IPSEC_D_DIR "/crls"
/**
* Secrets files
*
* @ingroup charon
*/
#define SECRETS_FILE CONFIG_DIR "/ipsec.secrets"
/**
* @brief Main class of daemon, contains some globals.
*
* @ingroup charon
* Main class of daemon, contains some globals.
*/
struct daemon_t {
@@ -379,9 +210,9 @@ struct daemon_t {
backend_manager_t *backends;
/**
* A credential_store_t instance.
* Manager for the credential backends
*/
credential_store_t *credentials;
credential_manager_t *credentials;
/**
* The Sender-Thread.
@@ -408,6 +239,11 @@ struct daemon_t {
*/
bus_t *bus;
/**
* plugin loader
*/
plugin_loader_t *plugins;
/**
* A bus listener logging to stdout
*/
@@ -429,9 +265,14 @@ struct daemon_t {
kernel_interface_t *kernel_interface;
/**
* Interfaces for IPC
* Controller to control the daemon
*/
interface_manager_t *interfaces;
controller_t *controller;
/**
* EAP manager to maintain registered EAP methods
*/
eap_manager_t *eap;
#ifdef P2P
/**
@@ -446,9 +287,8 @@ struct daemon_t {
#endif /* P2P */
/**
* @brief Shut down the daemon.
* Shut down the daemon.
*
* @param this the daemon to kill
* @param reason describtion why it will be killed
*/
void (*kill) (daemon_t *this, char *reason);
@@ -459,4 +299,4 @@ struct daemon_t {
*/
extern daemon_t *charon;
#endif /*DAEMON_H_*/
#endif /*DAEMON_H_ @} */
src/charon/encoding/generator.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file generator.c
*
* @brief Implementation of generator_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stdlib.h>
src/charon/encoding/generator.h
+15 -30
View File
@@ -1,10 +1,3 @@
/**
* @file generator.h
*
* @brief Interface of generator_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup generator generator
* @{ @ingroup encoding
*/
#ifndef GENERATOR_H_
@@ -33,21 +33,17 @@ typedef struct generator_t generator_t;
/**
* Generating is done in a data buffer.
* This is thehe start size of this buffer in bytes.
*
* @ingroup enconding
*/
#define GENERATOR_DATA_BUFFER_SIZE 500
/**
* Number of bytes to increase the buffer, if it is to small.
*
* @ingroup enconding
*/
#define GENERATOR_DATA_BUFFER_INCREASE_VALUE 500
/**
* @brief A generator_t class used to generate IKEv2 payloads.
* A generator_t class used to generate IKEv2 payloads.
*
* After creation, multiple payloads can be generated with the generate_payload
* method. The generated bytes are appended. After all payloads are added,
@@ -56,47 +52,36 @@ typedef struct generator_t generator_t;
* The generater uses a set of encoding rules, which it can get from
* the supplied payload. With this rules, the generater can generate
* the payload and all substructures automatically.
*
* @b Constructor:
* - generator_create()
*
* @ingroup encoding
*/
struct generator_t {
/**
* @brief Generates a specific payload from given payload object.
* Generates a specific payload from given payload object.
*
* Remember: Header and substructures are also handled as payloads.
*
* @param this generator_t object
* @param[in] payload interface payload_t implementing object
* @param payload interface payload_t implementing object
*/
void (*generate_payload) (generator_t *this,payload_t *payload);
/**
* @brief Writes all generated data of the generator to a chunk.
* Writes all generated data of the generator to a chunk.
*
* @param this generator_t object
* @param[out] data chunk to write the data to
* @param data chunk to write the data to
*/
void (*write_to_chunk) (generator_t *this,chunk_t *data);
/**
* @brief Destroys a generator_t object.
*
* @param this generator_t object
* Destroys a generator_t object.
*/
void (*destroy) (generator_t *this);
};
/**
* @brief Constructor to create a generator.
* Constructor to create a generator.
*
* @return generator_t object.
*
* @ingroup encoding
*/
generator_t *generator_create(void);
#endif /*GENERATOR_H_*/
#endif /*GENERATOR_H_ @} */
src/charon/encoding/message.c
+394 -117
View File
@@ -1,10 +1,3 @@
/**
* @file message.c
*
* @brief Implementation of message_t.
*
*/
/*
* Copyright (C) 2006-2007 Tobias Brunner
* Copyright (C) 2006 Daniel Roethlisberger
@@ -21,6 +14,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stdlib.h>
@@ -82,13 +77,31 @@ struct payload_rule_t {
bool sufficient;
};
typedef struct payload_order_t payload_order_t;
/**
* payload ordering structure allows us to reorder payloads according to RFC.
*/
struct payload_order_t {
/**
* payload type
*/
payload_type_t type;
/**
* notify type, if payload == NOTIFY
*/
notify_type_t notify;
};
typedef struct message_rule_t message_rule_t;
/**
* A message rule defines the kind of a message,
* if it has encrypted contents and a list
* of payload rules.
*
* of payload ordering rules and payload parsing rules.
*/
struct message_rule_t {
/**
@@ -109,124 +122,276 @@ struct message_rule_t {
/**
* Number of payload rules which will follow
*/
size_t payload_rule_count;
int payload_rule_count;
/**
* Pointer to first payload rule
*/
payload_rule_t *payload_rules;
/**
* Number of payload order rules
*/
int payload_order_count;
/**
* payload ordering rules
*/
payload_order_t *payload_order;
};
/**
* Message rule for IKE_SA_INIT from initiator.
*/
static payload_rule_t ike_sa_init_i_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,FALSE,FALSE},
{SECURITY_ASSOCIATION,1,1,FALSE,FALSE},
{KEY_EXCHANGE,1,1,FALSE,FALSE},
{NONCE,1,1,FALSE,FALSE},
{VENDOR_ID,0,10,FALSE,FALSE},
/* payload type min max encr suff */
{NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, FALSE},
{SECURITY_ASSOCIATION, 1, 1, FALSE, FALSE},
{KEY_EXCHANGE, 1, 1, FALSE, FALSE},
{NONCE, 1, 1, FALSE, FALSE},
{VENDOR_ID, 0, 10, FALSE, FALSE},
};
/**
* payload order for IKE_SA_INIT initiator
*/
static payload_order_t ike_sa_init_i_payload_order[] = {
/* payload type notify type */
{NOTIFY, COOKIE},
{SECURITY_ASSOCIATION, 0},
{KEY_EXCHANGE, 0},
{NONCE, 0},
{NOTIFY, NAT_DETECTION_SOURCE_IP},
{NOTIFY, NAT_DETECTION_DESTINATION_IP},
{VENDOR_ID, 0},
};
/**
* Message rule for IKE_SA_INIT from responder.
*/
static payload_rule_t ike_sa_init_r_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,FALSE,TRUE},
{SECURITY_ASSOCIATION,1,1,FALSE,FALSE},
{KEY_EXCHANGE,1,1,FALSE,FALSE},
{NONCE,1,1,FALSE,FALSE},
{VENDOR_ID,0,10,FALSE,FALSE},
/* payload type min max encr suff */
{NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, TRUE},
{SECURITY_ASSOCIATION, 1, 1, FALSE, FALSE},
{KEY_EXCHANGE, 1, 1, FALSE, FALSE},
{NONCE, 1, 1, FALSE, FALSE},
{VENDOR_ID, 0, 10, FALSE, FALSE},
};
/**
* payload order for IKE_SA_INIT responder
*/
static payload_order_t ike_sa_init_r_payload_order[] = {
/* payload type notify type */
{SECURITY_ASSOCIATION, 0},
{KEY_EXCHANGE, 0},
{NONCE, 0},
{NOTIFY, NAT_DETECTION_SOURCE_IP},
{NOTIFY, NAT_DETECTION_DESTINATION_IP},
{NOTIFY, HTTP_CERT_LOOKUP_SUPPORTED},
{CERTIFICATE_REQUEST, 0},
{VENDOR_ID, 0},
};
/**
* Message rule for IKE_AUTH from initiator.
*/
static payload_rule_t ike_auth_i_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,FALSE},
{EXTENSIBLE_AUTHENTICATION,0,1,TRUE,TRUE},
{AUTHENTICATION,0,1,TRUE,TRUE},
{ID_INITIATOR,1,1,TRUE,FALSE},
{CERTIFICATE,0,1,TRUE,FALSE},
{CERTIFICATE_REQUEST,0,1,TRUE,FALSE},
{ID_RESPONDER,0,1,TRUE,FALSE},
/* payload type min max encr suff */
{NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
{EXTENSIBLE_AUTHENTICATION, 0, 1, TRUE, TRUE},
{AUTHENTICATION, 0, 1, TRUE, TRUE},
{ID_INITIATOR, 1, 1, TRUE, FALSE},
{CERTIFICATE, 0, 4, TRUE, FALSE},
{CERTIFICATE_REQUEST, 0, 1, TRUE, FALSE},
{ID_RESPONDER, 0, 1, TRUE, FALSE},
#ifdef P2P
{SECURITY_ASSOCIATION,0,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_INITIATOR,0,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_RESPONDER,0,1,TRUE,FALSE},
{SECURITY_ASSOCIATION, 0, 1, TRUE, FALSE},
{TRAFFIC_SELECTOR_INITIATOR, 0, 1, TRUE, FALSE},
{TRAFFIC_SELECTOR_RESPONDER, 0, 1, TRUE, FALSE},
#else
{SECURITY_ASSOCIATION,1,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_INITIATOR,1,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_RESPONDER,1,1,TRUE,FALSE},
{SECURITY_ASSOCIATION, 1, 1, TRUE, FALSE},
{TRAFFIC_SELECTOR_INITIATOR, 1, 1, TRUE, FALSE},
{TRAFFIC_SELECTOR_RESPONDER, 1, 1, TRUE, FALSE},
#endif /* P2P */
{CONFIGURATION,0,1,TRUE,FALSE},
{VENDOR_ID,0,10,TRUE,FALSE},
{CONFIGURATION, 0, 1, TRUE, FALSE},
{VENDOR_ID, 0, 10, TRUE, FALSE},
};
/**
* payload order for IKE_AUTH initiator
*/
static payload_order_t ike_auth_i_payload_order[] = {
/* payload type notify type */
{ID_INITIATOR, 0},
{CERTIFICATE, 0},
{NOTIFY, INITIAL_CONTACT},
{NOTIFY, HTTP_CERT_LOOKUP_SUPPORTED},
{CERTIFICATE_REQUEST, 0},
{ID_RESPONDER, 0},
{AUTHENTICATION, 0},
{EXTENSIBLE_AUTHENTICATION, 0},
{CONFIGURATION, 0},
{NOTIFY, IPCOMP_SUPPORTED},
{NOTIFY, USE_TRANSPORT_MODE},
{NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
{NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
{SECURITY_ASSOCIATION, 0},
{TRAFFIC_SELECTOR_INITIATOR, 0},
{TRAFFIC_SELECTOR_RESPONDER, 0},
{NOTIFY, MOBIKE_SUPPORTED},
{NOTIFY, ADDITIONAL_IP4_ADDRESS},
{NOTIFY, ADDITIONAL_IP6_ADDRESS},
{NOTIFY, NO_ADDITIONAL_ADDRESSES},
{VENDOR_ID, 0},
};
/**
* Message rule for IKE_AUTH from responder.
*/
static payload_rule_t ike_auth_r_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,TRUE},
{EXTENSIBLE_AUTHENTICATION,0,1,TRUE,TRUE},
{CERTIFICATE,0,1,TRUE,FALSE},
{ID_RESPONDER,0,1,TRUE,FALSE},
{AUTHENTICATION,0,1,TRUE,FALSE},
{SECURITY_ASSOCIATION,0,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_INITIATOR,0,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_RESPONDER,0,1,TRUE,FALSE},
{CONFIGURATION,0,1,TRUE,FALSE},
{VENDOR_ID,0,10,TRUE,FALSE},
/* payload type min max encr suff */
{NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
{EXTENSIBLE_AUTHENTICATION, 0, 1, TRUE, TRUE},
{CERTIFICATE, 0, 4, TRUE, FALSE},
{ID_RESPONDER, 0, 1, TRUE, FALSE},
{AUTHENTICATION, 0, 1, TRUE, FALSE},
{SECURITY_ASSOCIATION, 0, 1, TRUE, FALSE},
{TRAFFIC_SELECTOR_INITIATOR, 0, 1, TRUE, FALSE},
{TRAFFIC_SELECTOR_RESPONDER, 0, 1, TRUE, FALSE},
{CONFIGURATION, 0, 1, TRUE, FALSE},
{VENDOR_ID, 0, 10, TRUE, FALSE},
};
/**
* payload order for IKE_AUTH responder
*/
static payload_order_t ike_auth_r_payload_order[] = {
/* payload type notify type */
{ID_RESPONDER, 0},
{CERTIFICATE, 0},
{AUTHENTICATION, 0},
{EXTENSIBLE_AUTHENTICATION, 0},
{CONFIGURATION, 0},
{NOTIFY, IPCOMP_SUPPORTED},
{NOTIFY, USE_TRANSPORT_MODE},
{NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
{NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
{SECURITY_ASSOCIATION, 0},
{TRAFFIC_SELECTOR_INITIATOR, 0},
{TRAFFIC_SELECTOR_RESPONDER, 0},
{NOTIFY, AUTH_LIFETIME},
{NOTIFY, MOBIKE_SUPPORTED},
{NOTIFY, ADDITIONAL_IP4_ADDRESS},
{NOTIFY, ADDITIONAL_IP6_ADDRESS},
{NOTIFY, NO_ADDITIONAL_ADDRESSES},
{VENDOR_ID, 0},
};
/**
* Message rule for INFORMATIONAL from initiator.
*/
static payload_rule_t informational_i_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,FALSE},
{CONFIGURATION,0,1,TRUE,FALSE},
{DELETE,0,1,TRUE,FALSE},
{VENDOR_ID,0,10,TRUE,FALSE},
/* payload type min max encr suff */
{NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
{CONFIGURATION, 0, 1, TRUE, FALSE},
{DELETE, 0, 1, TRUE, FALSE},
{VENDOR_ID, 0, 10, TRUE, FALSE},
};
/**
* payload order for INFORMATIONAL initiator
*/
static payload_order_t informational_i_payload_order[] = {
/* payload type notify type */
{NOTIFY, 0},
{DELETE, 0},
{CONFIGURATION, 0},
};
/**
* Message rule for INFORMATIONAL from responder.
*/
static payload_rule_t informational_r_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,FALSE},
{CONFIGURATION,0,1,TRUE,FALSE},
{DELETE,0,1,TRUE,FALSE},
{VENDOR_ID,0,10,TRUE,FALSE},
/* payload type min max encr suff */
{NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
{CONFIGURATION, 0, 1, TRUE, FALSE},
{DELETE, 0, 1, TRUE, FALSE},
{VENDOR_ID, 0, 10, TRUE, FALSE},
};
/**
* payload order for INFORMATIONAL responder
*/
static payload_order_t informational_r_payload_order[] = {
/* payload type notify type */
{NOTIFY, 0},
{DELETE, 0},
{CONFIGURATION, 0},
};
/**
* Message rule for CREATE_CHILD_SA from initiator.
*/
static payload_rule_t create_child_sa_i_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,FALSE},
{SECURITY_ASSOCIATION,1,1,TRUE,FALSE},
{NONCE,1,1,TRUE,FALSE},
{KEY_EXCHANGE,0,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_INITIATOR,0,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_RESPONDER,0,1,TRUE,FALSE},
{CONFIGURATION,0,1,TRUE,FALSE},
{VENDOR_ID,0,10,TRUE,FALSE},
/* payload type min max encr suff */
{NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
{SECURITY_ASSOCIATION, 1, 1, TRUE, FALSE},
{NONCE, 1, 1, TRUE, FALSE},
{KEY_EXCHANGE, 0, 1, TRUE, FALSE},
{TRAFFIC_SELECTOR_INITIATOR, 0, 1, TRUE, FALSE},
{TRAFFIC_SELECTOR_RESPONDER, 0, 1, TRUE, FALSE},
{CONFIGURATION, 0, 1, TRUE, FALSE},
{VENDOR_ID, 0, 10, TRUE, FALSE},
};
/**
* payload order for CREATE_CHILD_SA from initiator.
*/
static payload_order_t create_child_sa_i_payload_order[] = {
/* payload type notify type */
{NOTIFY, REKEY_SA},
{NOTIFY, IPCOMP_SUPPORTED},
{NOTIFY, USE_TRANSPORT_MODE},
{NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
{NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
{SECURITY_ASSOCIATION, 0},
{NONCE, 0},
{KEY_EXCHANGE, 0},
{TRAFFIC_SELECTOR_INITIATOR, 0},
{TRAFFIC_SELECTOR_RESPONDER, 0},
};
/**
* Message rule for CREATE_CHILD_SA from responder.
*/
static payload_rule_t create_child_sa_r_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,TRUE},
{SECURITY_ASSOCIATION,1,1,TRUE,FALSE},
{NONCE,1,1,TRUE,FALSE},
{KEY_EXCHANGE,0,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_INITIATOR,0,1,TRUE,FALSE},
{TRAFFIC_SELECTOR_RESPONDER,0,1,TRUE,FALSE},
{CONFIGURATION,0,1,TRUE,FALSE},
{VENDOR_ID,0,10,TRUE,FALSE},
/* payload type min max encr suff */
{NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
{SECURITY_ASSOCIATION, 1, 1, TRUE, FALSE},
{NONCE, 1, 1, TRUE, FALSE},
{KEY_EXCHANGE, 0, 1, TRUE, FALSE},
{TRAFFIC_SELECTOR_INITIATOR, 0, 1, TRUE, FALSE},
{TRAFFIC_SELECTOR_RESPONDER, 0, 1, TRUE, FALSE},
{CONFIGURATION, 0, 1, TRUE, FALSE},
{VENDOR_ID, 0, 10, TRUE, FALSE},
};
/**
* payload order for CREATE_CHILD_SA from responder.
*/
static payload_order_t create_child_sa_r_payload_order[] = {
/* payload type notify type */
{NOTIFY, IPCOMP_SUPPORTED},
{NOTIFY, USE_TRANSPORT_MODE},
{NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
{NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
{SECURITY_ASSOCIATION, 0},
{NONCE, 0},
{KEY_EXCHANGE, 0},
{TRAFFIC_SELECTOR_INITIATOR, 0},
{TRAFFIC_SELECTOR_RESPONDER, 0},
{NOTIFY, ADDITIONAL_TS_POSSIBLE},
};
#ifdef P2P
@@ -234,17 +399,38 @@ static payload_rule_t create_child_sa_r_payload_rules[] = {
* Message rule for P2P_CONNECT from initiator.
*/
static payload_rule_t p2p_connect_i_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,TRUE},
{ID_PEER,1,1,TRUE,FALSE},
{VENDOR_ID,0,10,TRUE,FALSE}
/* payload type min max encr suff */
{NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
{ID_PEER, 1, 1, TRUE, FALSE},
{VENDOR_ID, 0, 10, TRUE, FALSE}
};
/**
* payload order for P2P_CONNECT from initiator.
*/
static payload_order_t p2p_connect_i_payload_order[] = {
/* payload type notify type */
{NOTIFY, 0},
{ID_PEER, 0},
{VENDOR_ID, 0},
};
/**
* Message rule for P2P_CONNECT from responder.
*/
static payload_rule_t p2p_connect_r_payload_rules[] = {
{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,TRUE},
{VENDOR_ID,0,10,TRUE,FALSE}
/* payload type min max encr suff */
{NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
{VENDOR_ID, 0, 10, TRUE, FALSE}
};
/**
* payload order for P2P_CONNECT from responder.
*/
static payload_order_t p2p_connect_r_payload_order[] = {
/* payload type notify type */
{NOTIFY, 0},
{VENDOR_ID, 0},
};
#endif /* P2P */
@@ -252,17 +438,67 @@ static payload_rule_t p2p_connect_r_payload_rules[] = {
* Message rules, defines allowed payloads.
*/
static message_rule_t message_rules[] = {
{IKE_SA_INIT,TRUE,FALSE,(sizeof(ike_sa_init_i_payload_rules)/sizeof(payload_rule_t)),ike_sa_init_i_payload_rules},
{IKE_SA_INIT,FALSE,FALSE,(sizeof(ike_sa_init_r_payload_rules)/sizeof(payload_rule_t)),ike_sa_init_r_payload_rules},
{IKE_AUTH,TRUE,TRUE,(sizeof(ike_auth_i_payload_rules)/sizeof(payload_rule_t)),ike_auth_i_payload_rules},
{IKE_AUTH,FALSE,TRUE,(sizeof(ike_auth_r_payload_rules)/sizeof(payload_rule_t)),ike_auth_r_payload_rules},
{INFORMATIONAL,TRUE,TRUE,(sizeof(informational_i_payload_rules)/sizeof(payload_rule_t)),informational_i_payload_rules},
{INFORMATIONAL,FALSE,TRUE,(sizeof(informational_r_payload_rules)/sizeof(payload_rule_t)),informational_r_payload_rules},
{CREATE_CHILD_SA,TRUE,TRUE,(sizeof(create_child_sa_i_payload_rules)/sizeof(payload_rule_t)),create_child_sa_i_payload_rules},
{CREATE_CHILD_SA,FALSE,TRUE,(sizeof(create_child_sa_r_payload_rules)/sizeof(payload_rule_t)),create_child_sa_r_payload_rules},
{IKE_SA_INIT, TRUE, FALSE,
(sizeof(ike_sa_init_i_payload_rules)/sizeof(payload_rule_t)),
ike_sa_init_i_payload_rules,
(sizeof(ike_sa_init_i_payload_order)/sizeof(payload_order_t)),
ike_sa_init_i_payload_order,
},
{IKE_SA_INIT, FALSE, FALSE,
(sizeof(ike_sa_init_r_payload_rules)/sizeof(payload_rule_t)),
ike_sa_init_r_payload_rules,
(sizeof(ike_sa_init_r_payload_order)/sizeof(payload_order_t)),
ike_sa_init_r_payload_order,
},
{IKE_AUTH, TRUE, TRUE,
(sizeof(ike_auth_i_payload_rules)/sizeof(payload_rule_t)),
ike_auth_i_payload_rules,
(sizeof(ike_auth_i_payload_order)/sizeof(payload_order_t)),
ike_auth_i_payload_order,
},
{IKE_AUTH, FALSE, TRUE,
(sizeof(ike_auth_r_payload_rules)/sizeof(payload_rule_t)),
ike_auth_r_payload_rules,
(sizeof(ike_auth_r_payload_order)/sizeof(payload_order_t)),
ike_auth_r_payload_order,
},
{INFORMATIONAL, TRUE, TRUE,
(sizeof(informational_i_payload_rules)/sizeof(payload_rule_t)),
informational_i_payload_rules,
(sizeof(informational_i_payload_order)/sizeof(payload_order_t)),
informational_i_payload_order,
},
{INFORMATIONAL, FALSE, TRUE,
(sizeof(informational_r_payload_rules)/sizeof(payload_rule_t)),
informational_r_payload_rules,
(sizeof(informational_r_payload_order)/sizeof(payload_order_t)),
informational_r_payload_order,
},
{CREATE_CHILD_SA, TRUE, TRUE,
(sizeof(create_child_sa_i_payload_rules)/sizeof(payload_rule_t)),
create_child_sa_i_payload_rules,
(sizeof(create_child_sa_i_payload_order)/sizeof(payload_order_t)),
create_child_sa_i_payload_order,
},
{CREATE_CHILD_SA, FALSE, TRUE,
(sizeof(create_child_sa_r_payload_rules)/sizeof(payload_rule_t)),
create_child_sa_r_payload_rules,
(sizeof(create_child_sa_r_payload_order)/sizeof(payload_order_t)),
create_child_sa_r_payload_order,
},
#ifdef P2P
{P2P_CONNECT,TRUE,TRUE,(sizeof(p2p_connect_i_payload_rules)/sizeof(payload_rule_t)),p2p_connect_i_payload_rules},
{P2P_CONNECT,FALSE,TRUE,(sizeof(p2p_connect_r_payload_rules)/sizeof(payload_rule_t)),p2p_connect_r_payload_rules},
{P2P_CONNECT, TRUE, TRUE,
(sizeof(p2p_connect_i_payload_rules)/sizeof(payload_rule_t)),
p2p_connect_i_payload_rules,
(sizeof(p2p_connect_i_payload_order)/sizeof(payload_order_t)),
p2p_connect_i_payload_order,
},
{P2P_CONNECT, FALSE, TRUE,
(sizeof(p2p_connect_r_payload_rules)/sizeof(payload_rule_t)),
p2p_connect_r_payload_rules,
(sizeof(p2p_connect_r_payload_order)/sizeof(payload_order_t)),
p2p_connect_r_payload_order,
},
#endif /* P2P */
};
@@ -517,38 +753,19 @@ static bool is_encoded(private_message_t *this)
*/
static void add_payload(private_message_t *this, payload_t *payload)
{
payload_t *last_payload, *first_payload;
if ((this->is_request && payload->get_type(payload) == ID_INITIATOR) ||
(!this->is_request && payload->get_type(payload) == ID_RESPONDER))
payload_t *last_payload;
if (this->payloads->get_count(this->payloads) > 0)
{
/* HOTD: insert ID payload in the beginning to respect RFC */
if (this->payloads->get_first(this->payloads,
(void **)&first_payload) == SUCCESS)
{
payload->set_next_type(payload, first_payload->get_type(first_payload));
}
else
{
payload->set_next_type(payload, NO_PAYLOAD);
}
this->first_payload = payload->get_type(payload);
this->payloads->insert_first(this->payloads, payload);
this->payloads->get_last(this->payloads, (void **)&last_payload);
last_payload->set_next_type(last_payload, payload->get_type(payload));
}
else
{
if (this->payloads->get_count(this->payloads) > 0)
{
this->payloads->get_last(this->payloads,(void **) &last_payload);
last_payload->set_next_type(last_payload, payload->get_type(payload));
}
else
{
this->first_payload = payload->get_type(payload);
}
payload->set_next_type(payload, NO_PAYLOAD);
this->payloads->insert_last(this->payloads, payload);
this->first_payload = payload->get_type(payload);
}
payload->set_next_type(payload, NO_PAYLOAD);
this->payloads->insert_last(this->payloads, payload);
DBG2(DBG_ENC ,"added payload of type %N to message",
payload_type_names, payload->get_type(payload));
@@ -693,10 +910,66 @@ static char* get_string(private_message_t *this, char *buf, int len)
return buf;
}
/**
* reorder payloads depending on reordering rules
*/
static void order_payloads(private_message_t *this)
{
linked_list_t *list;
payload_t *payload;
int i;
/* move to temp list */
list = linked_list_create();
while (this->payloads->remove_last(this->payloads,
(void**)&payload) == SUCCESS)
{
list->insert_first(list, payload);
}
/* for each rule, ... */
for (i = 0; i < this->message_rule->payload_order_count; i++)
{
enumerator_t *enumerator;
notify_payload_t *notify;
payload_order_t order = this->message_rule->payload_order[i];
/* ... find all payload ... */
enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, &payload))
{
/* ... with that type ... */
if (payload->get_type(payload) == order.type)
{
notify = (notify_payload_t*)payload;
/**... and check notify for type. */
if (order.type != NOTIFY || order.notify == 0 ||
order.notify == notify->get_notify_type(notify))
{
list->remove_at(list, enumerator);
add_payload(this, payload);
}
}
}
enumerator->destroy(enumerator);
}
/* append all payloads without a rule to the end */
while (list->remove_last(list, (void**)&payload) == SUCCESS)
{
DBG1(DBG_ENC, "payload %N has no ordering rule in %N %s",
payload_type_names, payload->get_type(payload),
exchange_type_names, this->message_rule->exchange_type,
this->message_rule->is_request ? "request" : "response");
add_payload(this, payload);
}
list->destroy(list);
}
/**
* Implementation of private_message_t.encrypt_payloads.
*/
static status_t encrypt_payloads (private_message_t *this,crypter_t *crypter, signer_t* signer)
static status_t encrypt_payloads(private_message_t *this,
crypter_t *crypter, signer_t* signer)
{
encryption_payload_t *encryption_payload = NULL;
status_t status;
@@ -778,7 +1051,8 @@ static status_t encrypt_payloads (private_message_t *this,crypter_t *crypter, si
/**
* Implementation of message_t.generate.
*/
static status_t generate(private_message_t *this, crypter_t *crypter, signer_t* signer, packet_t **packet)
static status_t generate(private_message_t *this, crypter_t *crypter,
signer_t* signer, packet_t **packet)
{
generator_t *generator;
ike_header_t *ike_header;
@@ -795,8 +1069,6 @@ static status_t generate(private_message_t *this, crypter_t *crypter, signer_t*
return SUCCESS;
}
DBG1(DBG_ENC, "generating %s", get_string(this, str, sizeof(str)));
if (this->exchange_type == EXCHANGE_TYPE_UNDEFINED)
{
DBG1(DBG_ENC, "exchange type is not defined");
@@ -819,6 +1091,10 @@ static status_t generate(private_message_t *this, crypter_t *crypter, signer_t*
return NOT_SUPPORTED;
}
order_payloads(this);
DBG1(DBG_ENC, "generating %s", get_string(this, str, sizeof(str)));
/* going to encrypt all content which have to be encrypted */
status = encrypt_payloads(this, crypter, signer);
if (status != SUCCESS)
@@ -842,7 +1118,7 @@ static status_t generate(private_message_t *this, crypter_t *crypter, signer_t*
payload = (payload_t*)ike_header;
/* generate every payload expect last one, this is doen later*/
/* generate every payload expect last one, this is done later*/
iterator = this->payloads->create_iterator(this->payloads, TRUE);
while(iterator->iterate(iterator, (void**)&next_payload))
{
@@ -1346,3 +1622,4 @@ message_t *message_create()
{
return message_create_from_packet(NULL);
}
src/charon/encoding/message.h
+43 -86
View File
@@ -1,10 +1,3 @@
/**
* @file message.h
*
* @brief Interface of message_t.
*
*/
/*
* Copyright (C) 2006-2007 Tobias Brunner
* Copyright (C) 2006 Daniel Roethlisberger
@@ -21,6 +14,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup message message
* @{ @ingroup encoding
*/
#ifndef MESSAGE_H_
@@ -38,148 +38,126 @@ typedef struct message_t message_t;
#include <crypto/signers/signer.h>
/**
* @brief This class is used to represent an IKEv2-Message.
* This class is used to represent an IKEv2-Message.
*
* The message handles parsing and generation of payloads
* via parser_t/generator_t. Encryption is done transparently
* via the encryption_payload_t. A set of rules for messages
* and payloads does check parsed messages.
*
* @b Constructors:
* - message_create()
* - message_create_from_packet()
* - message_create_notify_reply()
*
* @ingroup encoding
*/
struct message_t {
/**
* @brief Sets the IKE major version of the message.
* Sets the IKE major version of the message.
*
* @param this message_t object
* @param major_version major version to set
*/
void (*set_major_version) (message_t *this,u_int8_t major_version);
/**
* @brief Gets the IKE major version of the message.
* Gets the IKE major version of the message.
*
* @param this message_t object
* @return major version of the message
*/
u_int8_t (*get_major_version) (message_t *this);
/**
* @brief Sets the IKE minor version of the message.
* Sets the IKE minor version of the message.
*
* @param this message_t object
* @param minor_version minor version to set
*/
void (*set_minor_version) (message_t *this,u_int8_t minor_version);
/**
* @brief Gets the IKE minor version of the message.
* Gets the IKE minor version of the message.
*
* @param this message_t object
* @return minor version of the message
*/
u_int8_t (*get_minor_version) (message_t *this);
/**
* @brief Sets the Message ID of the message.
* Sets the Message ID of the message.
*
* @param this message_t object
* @param message_id message_id to set
* @param message_id message_id to set
*/
void (*set_message_id) (message_t *this,u_int32_t message_id);
/**
* @brief Gets the Message ID of the message.
* Gets the Message ID of the message.
*
* @param this message_t object
* @return message_id type of the message
*/
u_int32_t (*get_message_id) (message_t *this);
/**
* @brief Gets the initiator SPI of the message.
* Gets the initiator SPI of the message.
*
* @param this message_t object
* @return initiator spi of the message
*/
u_int64_t (*get_initiator_spi) (message_t *this);
/**
* @brief Gets the responder SPI of the message.
* Gets the responder SPI of the message.
*
* @param this message_t object
* @return responder spi of the message
*/
u_int64_t (*get_responder_spi) (message_t *this);
/**
* @brief Sets the IKE_SA ID of the message.
* Sets the IKE_SA ID of the message.
*
* ike_sa_id gets cloned.
*
* @param this message_t object
* @param ike_sa_id ike_sa_id to set
*/
void (*set_ike_sa_id) (message_t *this, ike_sa_id_t * ike_sa_id);
/**
* @brief Gets the IKE_SA ID of the message.
* Gets the IKE_SA ID of the message.
*
* The ike_sa_id points to the message internal id, do not modify.
*
* @param this message_t object
* @return ike_sa_id of message
*/
ike_sa_id_t *(*get_ike_sa_id) (message_t *this);
/**
* @brief Sets the exchange type of the message.
* Sets the exchange type of the message.
*
* @param this message_t object
* @param exchange_type exchange_type to set
*/
void (*set_exchange_type) (message_t *this,exchange_type_t exchange_type);
/**
* @brief Gets the exchange type of the message.
* Gets the exchange type of the message.
*
* @param this message_t object
* @return exchange type of the message
*/
exchange_type_t (*get_exchange_type) (message_t *this);
/**
* @brief Gets the payload type of the first payload.
* Gets the payload type of the first payload.
*
* @param this message_t object
* @return payload type of the first payload
*/
payload_type_t (*get_first_payload_type) (message_t *this);
/**
* @brief Sets the request flag.
* Sets the request flag.
*
* @param this message_t object
* @param original_initiator TRUE if message is a request, FALSE if it is a reply
* @param request TRUE if message is a request, FALSE if it is a reply
*/
void (*set_request) (message_t *this,bool request);
void (*set_request) (message_t *this, bool request);
/**
* @brief Gets request flag.
* Gets request flag.
*
* @param this message_t object
* @return TRUE if message is a request, FALSE if it is a reply
*/
bool (*get_request) (message_t *this);
/**
* @brief Append a payload to the message.
* Append a payload to the message.
*
* If the payload must be encrypted is not specified here. Encryption
* of payloads is evaluated via internal rules for the messages and
@@ -187,19 +165,17 @@ struct message_t {
* all payloads to encrypt are added to the encryption payload, which is
* always the last one.
*
* @param this message_t object
* @param payload payload to append
*/
void (*add_payload) (message_t *this, payload_t *payload);
/**
* @brief Build a notify payload and add it to the message.
* Build a notify payload and add it to the message.
*
* This is a helper method to create notify messages or add
* notify payload to messages. The flush parameter specifies if existing
* payloads should get removed before appending the notify.
*
* @param this message_t object
* @param flush TRUE to remove existing payloads
* @param type type of the notify
* @param data a chunk of data to add to the notify, gets cloned
@@ -208,13 +184,12 @@ struct message_t {
chunk_t data);
/**
* @brief Parses header of message.
* Parses header of message.
*
* Begins parisng of a message created via message_create_from_packet().
* The parsing context is stored, so a subsequent call to parse_body()
* will continue the parsing process.
*
* @param this message_t object
* @return
* - SUCCESS if header could be parsed
* - PARSE_ERROR if corrupted/invalid data found
@@ -223,7 +198,7 @@ struct message_t {
status_t (*parse_header) (message_t *this);
/**
* @brief Parses body of message.
* Parses body of message.
*
* The body gets not only parsed, but rather it gets verified.
* All payloads are verified if they are allowed to exist in the message
@@ -234,7 +209,6 @@ struct message_t {
* Crypter/signer can be omitted (by passing NULL) when no encryption
* payload is expected.
*
* @param this message_t object
* @param crypter crypter to decrypt encryption payloads
* @param signer signer to verifiy a message with an encryption payload
* @return
@@ -249,7 +223,7 @@ struct message_t {
status_t (*parse_body) (message_t *this, crypter_t *crypter, signer_t *signer);
/**
* @brief Generates the UDP packet of specific message.
* Generates the UDP packet of specific message.
*
* Payloads which must be encrypted are generated first and added to
* an encryption payload. This encryption payload will get encrypted via
@@ -260,7 +234,6 @@ struct message_t {
* payload is expected.
* Generation is only done once, multiple calls will just return a packet copy.
*
* @param this message_t object
* @param crypter crypter to use when a payload must be encrypted
* @param signer signer to build a mac
* @param packet copy of generated packet
@@ -273,103 +246,91 @@ struct message_t {
status_t (*generate) (message_t *this, crypter_t *crypter, signer_t *signer, packet_t **packet);
/**
* @brief Gets the source host informations.
* Gets the source host informations.
*
* @warning Returned host_t object is not getting cloned,
* do not destroy nor modify.
*
* @param this message_t object
* @return host_t object representing source host
*/
host_t * (*get_source) (message_t *this);
/**
* @brief Sets the source host informations.
* Sets the source host informations.
*
* @warning host_t object is not getting cloned and gets destroyed by
* message_t.destroy or next call of message_t.set_source.
*
* @param this message_t object
* @param host host_t object representing source host
*/
void (*set_source) (message_t *this, host_t *host);
/**
* @brief Gets the destination host informations.
* Gets the destination host informations.
*
* @warning Returned host_t object is not getting cloned,
* do not destroy nor modify.
*
* @param this message_t object
* @return host_t object representing destination host
*/
host_t * (*get_destination) (message_t *this);
/**
* @brief Sets the destination host informations.
* Sets the destination host informations.
*
* @warning host_t object is not getting cloned and gets destroyed by
* message_t.destroy or next call of message_t.set_destination.
*
* @param this message_t object
* @param host host_t object representing destination host
*/
void (*set_destination) (message_t *this, host_t *host);
/**
* @brief Returns an iterator on all stored payloads.
* Returns an iterator on all stored payloads.
*
* @warning Don't insert payloads over this iterator.
* Use add_payload() instead.
*
* @param this message_t object
* @return iterator_t object which has to get destroyd by the caller
*/
iterator_t * (*get_payload_iterator) (message_t *this);
/**
* @brief Find a payload of a specific type.
* Find a payload of a specific type.
*
* Returns the first occurance.
*
* @param this message_t object
* @param type type of the payload to find
* @return payload, or NULL if no such payload found
*/
payload_t* (*get_payload) (message_t *this, payload_type_t type);
/**
* @brief Returns a clone of the internal stored packet_t object.
* Returns a clone of the internal stored packet_t object.
*
* @param this message_t object
* @return packet_t object as clone of internal one
*/
packet_t * (*get_packet) (message_t *this);
/**
* @brief Returns a clone of the internal stored packet_t data.
* Returns a clone of the internal stored packet_t data.
*
* @param this message_t object
* @return clone of the internal stored packet_t data.
*/
chunk_t (*get_packet_data) (message_t *this);
/**
* @brief Destroys a message and all including objects.
*
* @param this message_t object
* Destroys a message and all including objects.
*/
void (*destroy) (message_t *this);
};
/**
* @brief Creates an message_t object from a incoming UDP Packet.
* Creates an message_t object from a incoming UDP Packet.
*
* @warning the given packet_t object is not copied and gets
* destroyed in message_t's destroy call.
*
* @warning Packet is not parsed in here!
*
* - exchange_type is set to NOT_SET
* - original_initiator is set to TRUE
* - is_request is set to TRUE
@@ -377,23 +338,19 @@ struct message_t {
*
* @param packet packet_t object which is assigned to message
* @return message_t object
*
* @ingroup encoding
*/
message_t * message_create_from_packet(packet_t *packet);
/**
* @brief Creates an empty message_t object.
* Creates an empty message_t object.
*
* - exchange_type is set to NOT_SET
* - original_initiator is set to TRUE
* - is_request is set to TRUE
*
* @return message_t object
*
* @ingroup encoding
*/
message_t * message_create(void);
#endif /*MESSAGE_H_*/
#endif /*MESSAGE_H_ @} */
src/charon/encoding/parser.c
+12 -17
View File
@@ -1,10 +1,3 @@
/**
* @file parser.c
*
* @brief Implementation of parser_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stdlib.h>
@@ -67,7 +62,7 @@ struct private_parser_t {
parser_t public;
/**
* @brief Parse a 4-Bit unsigned integer from the current parsing position.
* Parse a 4-Bit unsigned integer from the current parsing position.
*
* @param this parser_t object
* @param rule_number number of current rule
@@ -79,7 +74,7 @@ struct private_parser_t {
status_t (*parse_uint4) (private_parser_t *this, int rule_number, u_int8_t *output_pos);
/**
* @brief Parse a 8-Bit unsigned integer from the current parsing position.
* Parse a 8-Bit unsigned integer from the current parsing position.
*
* @param this parser_t object
* @param rule_number number of current rule
@@ -91,7 +86,7 @@ struct private_parser_t {
status_t (*parse_uint8) (private_parser_t *this, int rule_number, u_int8_t *output_pos);
/**
* @brief Parse a 15-Bit unsigned integer from the current parsing position.
* Parse a 15-Bit unsigned integer from the current parsing position.
*
* This is a special case used for ATTRIBUTE_TYPE.
* Big-/Little-endian conversion is done here.
@@ -106,7 +101,7 @@ struct private_parser_t {
status_t (*parse_uint15) (private_parser_t *this, int rule_number, u_int16_t *output_pos);
/**
* @brief Parse a 16-Bit unsigned integer from the current parsing position.
* Parse a 16-Bit unsigned integer from the current parsing position.
*
* Big-/Little-endian conversion is done here.
*
@@ -120,7 +115,7 @@ struct private_parser_t {
status_t (*parse_uint16) (private_parser_t *this, int rule_number, u_int16_t *output_pos);
/**
* @brief Parse a 32-Bit unsigned integer from the current parsing position.
* Parse a 32-Bit unsigned integer from the current parsing position.
*
* Big-/Little-endian conversion is done here.
*
@@ -134,7 +129,7 @@ struct private_parser_t {
status_t (*parse_uint32) (private_parser_t *this, int rule_number, u_int32_t *output_pos);
/**
* @brief Parse a 64-Bit unsigned integer from the current parsing position.
* Parse a 64-Bit unsigned integer from the current parsing position.
*
* @todo add support for big-endian machines.
*
@@ -148,7 +143,7 @@ struct private_parser_t {
status_t (*parse_uint64) (private_parser_t *this, int rule_number, u_int64_t *output_pos);
/**
* @brief Parse a given amount of bytes and writes them to a specific location
* Parse a given amount of bytes and writes them to a specific location
*
* @param this parser_t object
* @param rule_number number of current rule
@@ -161,7 +156,7 @@ struct private_parser_t {
status_t (*parse_bytes) (private_parser_t *this, int rule_number, u_int8_t *output_pos,size_t bytes);
/**
* @brief Parse a single Bit from the current parsing position
* Parse a single Bit from the current parsing position
*
* @param this parser_t object
* @param rule_number number of current rule
@@ -173,7 +168,7 @@ struct private_parser_t {
status_t (*parse_bit) (private_parser_t *this, int rule_number, bool *output_pos);
/**
* @brief Parse substructures in a list
* Parse substructures in a list
*
* This function calls the parser recursively to parse contained substructures
* in a linked_list_t. The list must already be created. Payload defines
@@ -192,7 +187,7 @@ struct private_parser_t {
status_t (*parse_list) (private_parser_t *this, int rule_number, linked_list_t **output_pos, payload_type_t payload_ype, size_t length);
/**
* @brief Parse data from current parsing position in a chunk.
* Parse data from current parsing position in a chunk.
*
* This function clones length number of bytes to output_pos, without
* modifiyng them. Space will be allocated and must be freed by caller.
src/charon/encoding/parser.h
+19 -33
View File
@@ -1,10 +1,3 @@
/**
* @file parser.h
*
* @brief Interface of parser_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup parser parser
* @{ @ingroup encoding
*/
#ifndef PARSER_H_
@@ -31,65 +31,51 @@ typedef struct parser_t parser_t;
#include <encoding/payloads/payload.h>
/**
* @brief A parser_t class to parse IKEv2 payloads.
* A parser_t class to parse IKEv2 payloads.
*
* A parser is used for parsing one chunk of data. Multiple
* payloads can be parsed out of the chunk using parse_payload.
* The parser remains the state until destroyed.
*
* @b Constructors:
* - parser_create()
*
* @ingroup encoding
*/
struct parser_t {
/**
* @brief Parses the next payload.
* Parses the next payload.
*
* @warning Caller is responsible for freeing allocated payload.
*
* Rules for parsing are described in the payload definition.
*
* @param this parser_t bject
* @param payload_type payload type to parse
* @param[out] payload pointer where parsed payload was allocated
* @param payload_type payload type to parse
* @param payload pointer where parsed payload was allocated
* @return
* - SUCCESSFUL if succeeded,
* - PARSE_ERROR if corrupted/invalid data found
* - SUCCESSFUL if succeeded,
* - PARSE_ERROR if corrupted/invalid data found
*/
status_t (*parse_payload) (parser_t *this, payload_type_t payload_type, payload_t **payload);
/**
* Gets the remaining byte count which is not currently parsed.
*
* @param parser parser_t object
*/
int (*get_remaining_byte_count) (parser_t *this);
/**
* @brief Resets the current parser context.
*
* @param parser parser_t object
* Resets the current parser context.
*/
void (*reset_context) (parser_t *this);
/**
* @brief Destroys a parser_t object.
*
* @param parser parser_t object
* Destroys a parser_t object.
*/
void (*destroy) (parser_t *this);
};
/**
* @brief Constructor to create a parser_t object.
* Constructor to create a parser_t object.
*
* @param data chunk of data to parse with this parser_t object
* @return parser_t object
*
* @ingroup encoding
* @param data chunk of data to parse with this parser_t object
* @return parser_t object
*/
parser_t *parser_create(chunk_t data);
#endif /*PARSER_H_*/
#endif /*PARSER_H_ @} */
src/charon/encoding/payloads/auth_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file auth_payload.h
*
* @brief Implementation of auth_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "auth_payload.h"
src/charon/encoding/payloads/auth_payload.h
+17 -34
View File
@@ -1,10 +1,3 @@
/**
* @file auth_payload.h
*
* @brief Interface of auth_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup auth_payload auth_payload
* @{ @ingroup payloads
*/
#ifndef AUTH_PAYLOAD_H_
@@ -32,20 +32,13 @@ typedef struct auth_payload_t auth_payload_t;
/**
* Length of a auth payload without the auth data in bytes.
*
* @ingroup payloads
*/
#define AUTH_PAYLOAD_HEADER_LENGTH 8
/**
* @brief Class representing an IKEv2 AUTH payload.
* Class representing an IKEv2 AUTH payload.
*
* The AUTH payload format is described in RFC section 3.8.
*
* @b Constructors:
* - auth_payload_create()
*
* @ingroup payloads
*/
struct auth_payload_t {
@@ -55,67 +48,57 @@ struct auth_payload_t {
payload_t payload_interface;
/**
* @brief Set the AUTH method.
* Set the AUTH method.
*
* @param this calling auth_payload_t object
* @param method auth_method_t to use
*/
void (*set_auth_method) (auth_payload_t *this, auth_method_t method);
/**
* @brief Get the AUTH method.
* Get the AUTH method.
*
* @param this calling auth_payload_t object
* @return auth_method_t used
*/
auth_method_t (*get_auth_method) (auth_payload_t *this);
/**
* @brief Set the AUTH data.
* Set the AUTH data.
*
* Data are getting cloned.
* Data gets cloned.
*
* @param this calling auth_payload_t object
* @param data AUTH data as chunk_t
*/
void (*set_data) (auth_payload_t *this, chunk_t data);
/**
* @brief Get the AUTH data.
* Get the AUTH data.
*
* Returned data are a copy of the internal one.
*
* @param this calling auth_payload_t object
* @return AUTH data as chunk_t
*/
chunk_t (*get_data_clone) (auth_payload_t *this);
/**
* @brief Get the AUTH data.
* Get the AUTH data.
*
* Returned data are NOT copied
*
* @param this calling auth_payload_t object
* @return AUTH data as chunk_t
*/
chunk_t (*get_data) (auth_payload_t *this);
/**
* @brief Destroys an auth_payload_t object.
*
* @param this auth_payload_t object to destroy
* Destroys an auth_payload_t object.
*/
void (*destroy) (auth_payload_t *this);
};
/**
* @brief Creates an empty auth_payload_t object.
* Creates an empty auth_payload_t object.
*
* @return auth_payload_t object
*
* @ingroup payloads
*/
auth_payload_t *auth_payload_create(void);
#endif /* AUTH_PAYLOAD_H_ */
#endif /* AUTH_PAYLOAD_H_ @} */
src/charon/encoding/payloads/cert_payload.c
+76 -103
View File
@@ -1,12 +1,5 @@
/**
* @file cert_payload.c
*
* @brief Implementation of cert_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -19,29 +12,31 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
#include <daemon.h>
#include "cert_payload.h"
ENUM(cert_encoding_names, CERT_NONE, CERT_OCSP_CONTENT,
"CERT_NONE",
"CERT_PKCS7_WRAPPED_X509",
"CERT_PGP",
"CERT_DNS_SIGNED_KEY",
"CERT_X509_SIGNATURE",
"CERT_X509_KEY_EXCHANGE",
"CERT_KERBEROS_TOKENS",
"CERT_CRL",
"CERT_ARL",
"CERT_SPKI",
"CERT_X509_ATTRIBUTE",
"CERT_RAW_RSA_KEY",
"CERT_X509_HASH_AND_URL",
"CERT_X509_HASH_AND_URL_BUNDLE",
"CERT_OCSP_CONTENT",
ENUM(cert_encoding_names, ENC_PKCS7_WRAPPED_X509, ENC_OCSP_CONTENT,
"ENC_PKCS7_WRAPPED_X509",
"ENC_PGP",
"ENC_DNS_SIGNED_KEY",
"ENC_X509_SIGNATURE",
"ENC_X509_KEY_EXCHANGE",
"ENC_KERBEROS_TOKENS",
"ENC_CRL",
"ENC_ARL",
"ENC_SPKI",
"ENC_X509_ATTRIBUTE",
"ENC_RAW_RSA_KEY",
"ENC_X509_HASH_AND_URL",
"ENC_X509_HASH_AND_URL_BUNDLE",
"ENC_OCSP_CONTENT",
);
typedef struct private_cert_payload_t private_cert_payload_t;
@@ -74,12 +69,12 @@ struct private_cert_payload_t {
/**
* Encoding of the CERT Data.
*/
u_int8_t cert_encoding;
u_int8_t encoding;
/**
* The contained cert data value.
*/
chunk_t cert_data;
chunk_t data;
};
/**
@@ -105,9 +100,9 @@ encoding_rule_t cert_payload_encodings[] = {
/* Length of the whole payload*/
{ PAYLOAD_LENGTH, offsetof(private_cert_payload_t, payload_length)},
/* 1 Byte CERT type*/
{ U_INT_8, offsetof(private_cert_payload_t, cert_encoding) },
{ U_INT_8, offsetof(private_cert_payload_t, encoding) },
/* some cert data bytes, length is defined in PAYLOAD_LENGTH */
{ CERT_DATA, offsetof(private_cert_payload_t, cert_data) }
{ CERT_DATA, offsetof(private_cert_payload_t, data) }
};
/*
@@ -128,19 +123,14 @@ encoding_rule_t cert_payload_encodings[] = {
*/
static status_t verify(private_cert_payload_t *this)
{
if ((this->cert_encoding == 0) ||
((this->cert_encoding >= CERT_ROOF) && (this->cert_encoding <= 200)))
{
/* reserved IDs */
return FAILED;
}
return SUCCESS;
}
/**
* Implementation of cert_payload_t.get_encoding_rules.
*/
static void get_encoding_rules(private_cert_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
static void get_encoding_rules(private_cert_payload_t *this,
encoding_rule_t **rules, size_t *rule_count)
{
*rules = cert_payload_encodings;
*rule_count = sizeof(cert_payload_encodings) / sizeof(encoding_rule_t);
@@ -159,7 +149,7 @@ static payload_type_t get_payload_type(private_cert_payload_t *this)
*/
static payload_type_t get_next_type(private_cert_payload_t *this)
{
return (this->next_payload);
return this->next_payload;
}
/**
@@ -179,56 +169,37 @@ static size_t get_length(private_cert_payload_t *this)
}
/**
* Implementation of cert_payload_t.set_cert_encoding.
* Implementation of cert_payload_t.get_cert.
*/
static void set_cert_encoding (private_cert_payload_t *this, cert_encoding_t encoding)
static certificate_t* get_cert(private_cert_payload_t *this)
{
this->cert_encoding = encoding;
}
/**
* Implementation of cert_payload_t.get_cert_encoding.
*/
static cert_encoding_t get_cert_encoding (private_cert_payload_t *this)
{
return (this->cert_encoding);
}
/**
* Implementation of cert_payload_t.set_data.
*/
static void set_data (private_cert_payload_t *this, chunk_t data)
{
if (this->cert_data.ptr != NULL)
certificate_type_t type;
switch (this->encoding)
{
chunk_free(&(this->cert_data));
case ENC_X509_SIGNATURE:
type = CERT_X509;
break;
case ENC_PKCS7_WRAPPED_X509:
case ENC_PGP:
case ENC_DNS_SIGNED_KEY:
case ENC_KERBEROS_TOKEN:
case ENC_CRL:
case ENC_ARL:
case ENC_SPKI:
case ENC_X509_ATTRIBUTE:
case ENC_RAW_RSA_KEY:
case ENC_X509_HASH_AND_URL:
case ENC_X509_HASH_AND_URL_BUNDLE:
case ENC_OCSP_CONTENT:
default:
DBG1(DBG_ENC, "certificate encoding %N not supported",
cert_encoding_names, this->encoding);
return NULL;
}
this->cert_data.ptr = clalloc(data.ptr,data.len);
this->cert_data.len = data.len;
this->payload_length = CERT_PAYLOAD_HEADER_LENGTH + this->cert_data.len;
}
/**
* Implementation of cert_payload_t.get_data.
*/
static chunk_t get_data (private_cert_payload_t *this)
{
return (this->cert_data);
}
/**
* Implementation of cert_payload_t.get_data_clone.
*/
static chunk_t get_data_clone (private_cert_payload_t *this)
{
chunk_t cloned_data;
if (this->cert_data.ptr == NULL)
{
return (this->cert_data);
}
cloned_data.ptr = clalloc(this->cert_data.ptr,this->cert_data.len);
cloned_data.len = this->cert_data.len;
return cloned_data;
return lib->creds->create(lib->creds, CRED_CERTIFICATE, type,
BUILD_BLOB_ASN1_DER, chunk_clone(this->data),
BUILD_END);
}
/**
@@ -236,11 +207,7 @@ static chunk_t get_data_clone (private_cert_payload_t *this)
*/
static void destroy(private_cert_payload_t *this)
{
if (this->cert_data.ptr != NULL)
{
chunk_free(&(this->cert_data));
}
chunk_free(&this->data);
free(this);
}
@@ -251,7 +218,6 @@ cert_payload_t *cert_payload_create()
{
private_cert_payload_t *this = malloc_thing(private_cert_payload_t);
/* interface functions */
this->public.payload_interface.verify = (status_t (*) (payload_t*))verify;
this->public.payload_interface.get_encoding_rules = (void (*) (payload_t*,encoding_rule_t**, size_t*))get_encoding_rules;
this->public.payload_interface.get_length = (size_t (*) (payload_t*))get_length;
@@ -260,31 +226,38 @@ cert_payload_t *cert_payload_create()
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t*))get_payload_type;
this->public.payload_interface.destroy = (void (*) (payload_t*))destroy;
/* public functions */
this->public.destroy = (void (*) (cert_payload_t*))destroy;
this->public.set_cert_encoding = (void (*) (cert_payload_t*,cert_encoding_t))set_cert_encoding;
this->public.get_cert_encoding = (cert_encoding_t (*) (cert_payload_t*))get_cert_encoding;
this->public.set_data = (void (*) (cert_payload_t*,chunk_t))set_data;
this->public.get_data_clone = (chunk_t (*) (cert_payload_t*))get_data_clone;
this->public.get_data = (chunk_t (*) (cert_payload_t*))get_data;
this->public.get_cert = (certificate_t* (*) (cert_payload_t*))get_cert;
/* private variables */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
this->payload_length = CERT_PAYLOAD_HEADER_LENGTH;
this->cert_data = chunk_empty;
this->data = chunk_empty;
this->encoding = 0;
return (&(this->public));
return &this->public;
}
/*
* Described in header
*/
cert_payload_t *cert_payload_create_from_x509(x509_t *cert)
cert_payload_t *cert_payload_create_from_cert(certificate_t *cert)
{
cert_payload_t *this = cert_payload_create();
private_cert_payload_t *this = (private_cert_payload_t*)cert_payload_create();
this->set_cert_encoding(this, CERT_X509_SIGNATURE);
this->set_data(this, cert->get_certificate(cert));
return this;
switch (cert->get_type(cert))
{
case CERT_X509:
this->encoding = ENC_X509_SIGNATURE;
break;
default:
DBG1(DBG_ENC, "embedding %N certificate in payload failed",
certificate_type_names, cert->get_type(cert));
free(this);
return NULL;
}
this->data = cert->get_encoding(cert);
this->payload_length = CERT_PAYLOAD_HEADER_LENGTH + this->data.len;
return &this->public;
}
src/charon/encoding/payloads/cert_payload.h
+36 -98
View File
@@ -1,12 +1,5 @@
/**
* @file cert_payload.h
*
* @brief Interface of cert_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2005 Jan Hutter
* Hochschule fuer Technik Rapperswil
*
@@ -19,69 +12,58 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup cert_payload cert_payload
* @{ @ingroup payloads
*/
#ifndef CERT_PAYLOAD_H_
#define CERT_PAYLOAD_H_
typedef enum cert_encoding_t cert_encoding_t;
typedef struct cert_payload_t cert_payload_t;
typedef enum cert_encoding_t cert_encoding_t;
#include <library.h>
#include <crypto/x509.h>
#include <credentials/certificates/certificate.h>
#include <encoding/payloads/payload.h>
/**
* Length of a cert payload without the cert data in bytes.
*
* @ingroup payloads
*/
#define CERT_PAYLOAD_HEADER_LENGTH 5
/**
* @brief Certificate encoding, as described in IKEv2 RFC section 3.6
*
* @ingroup payloads
* Certifcate encodings, as in RFC4306
*/
enum cert_encoding_t {
CERT_NONE = 0,
CERT_PKCS7_WRAPPED_X509 = 1,
CERT_PGP = 2,
CERT_DNS_SIGNED_KEY = 3,
CERT_X509_SIGNATURE = 4,
CERT_KERBEROS_TOKEN = 6,
CERT_CRL = 7,
CERT_ARL = 8,
CERT_SPKI = 9,
CERT_X509_ATTRIBUTE = 10,
CERT_RAW_RSA_KEY = 11,
CERT_X509_HASH_AND_URL = 12,
CERT_X509_HASH_AND_URL_BUNDLE = 13,
CERT_OCSP_CONTENT = 14, /* from RFC 4806 */
CERT_ROOF = 15
ENC_PKCS7_WRAPPED_X509 = 1,
ENC_PGP = 2,
ENC_DNS_SIGNED_KEY = 3,
ENC_X509_SIGNATURE = 4,
ENC_KERBEROS_TOKEN = 6,
ENC_CRL = 7,
ENC_ARL = 8,
ENC_SPKI = 9,
ENC_X509_ATTRIBUTE = 10,
ENC_RAW_RSA_KEY = 11,
ENC_X509_HASH_AND_URL = 12,
ENC_X509_HASH_AND_URL_BUNDLE = 13,
ENC_OCSP_CONTENT = 14, /* from RFC 4806 */
};
/**
* string mappings for cert_encoding_t.
*
* @ingroup payloads
* Enum names for cert_encoding_t
*/
extern enum_name_t *cert_encoding_names;
/**
* @brief Class representing an IKEv2 CERT payload.
* Class representing an IKEv2 CERT payload.
*
* The CERT payload format is described in RFC section 3.6.
* This is just a dummy implementation to fullfill the standards
* requirements. A full implementation would offer setters/getters
* for the different encoding types.
*
* @b Constructors:
* - cert_payload_create()
*
* @todo Implement setters/getters for the different certificate encodings.
*
* @ingroup payloads
*/
struct cert_payload_t {
@@ -89,78 +71,34 @@ struct cert_payload_t {
* The payload_t interface.
*/
payload_t payload_interface;
/**
* @brief Set the CERT encoding.
*
* @param this calling cert_payload_t object
* @param encoding CERT encoding
*/
void (*set_cert_encoding) (cert_payload_t *this, cert_encoding_t encoding);
/**
* @brief Get the CERT encoding.
* Get the playoads encoded certifcate.
*
* @param this calling cert_payload_t object
* @return Encoding of the CERT
* @return certifcate copy
*/
cert_encoding_t (*get_cert_encoding) (cert_payload_t *this);
certificate_t *(*get_cert)(cert_payload_t *this);
/**
* @brief Set the CERT data.
*
* Data are getting cloned.
*
* @param this calling cert_payload_t object
* @param data CERT data as chunk_t
*/
void (*set_data) (cert_payload_t *this, chunk_t data);
/**
* @brief Get the CERT data.
*
* Returned data are a copy of the internal one.
*
* @param this calling cert_payload_t object
* @return CERT data as chunk_t
*/
chunk_t (*get_data_clone) (cert_payload_t *this);
/**
* @brief Get the CERT data.
*
* Returned data are NOT copied.
*
* @param this calling cert_payload_t object
* @return CERT data as chunk_t
*/
chunk_t (*get_data) (cert_payload_t *this);
/**
* @brief Destroys an cert_payload_t object.
*
* @param this cert_payload_t object to destroy
* Destroys the cert_payload object.
*/
void (*destroy) (cert_payload_t *this);
};
/**
* @brief Creates an empty cert_payload_t object.
* Creates an empty certificate payload.
*
* @param cert certificate to embed
* @return cert_payload_t object
*
* @ingroup payloads
*/
cert_payload_t *cert_payload_create(void);
/**
* @brief Creates a cert_payload_t object with an X.509 certificate.
* Creates a certificate payload with an embedded certificate.
*
* @param cert X.509 certificate
* @param cert certificate to embed
* @return cert_payload_t object
*
* @ingroup payloads
*/
cert_payload_t *cert_payload_create_from_x509(x509_t *cert);
cert_payload_t *cert_payload_create_from_cert(certificate_t *cert);
#endif /* CERT_PAYLOAD_H_ */
#endif /* CERT_PAYLOAD_H_ @} */
src/charon/encoding/payloads/certreq_payload.c
+95 -130
View File
@@ -1,10 +1,3 @@
/**
* @file certreq_payload.c
*
* @brief Implementation of certreq_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,14 +12,15 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
#include <string.h>
#include <daemon.h>
#include <crypto/hashers/hasher.h>
#include <crypto/ca.h>
#include <encoding/payloads/cert_payload.h>
#include "certreq_payload.h"
@@ -61,12 +55,12 @@ struct private_certreq_payload_t {
/**
* Encoding of the CERT Data.
*/
u_int8_t cert_encoding;
u_int8_t encoding;
/**
* The contained certreq data value.
*/
chunk_t certreq_data;
chunk_t data;
};
/**
@@ -90,11 +84,11 @@ encoding_rule_t certreq_payload_encodings[] = {
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
/* Length of the whole payload*/
{ PAYLOAD_LENGTH, offsetof(private_certreq_payload_t, payload_length)},
{ PAYLOAD_LENGTH, offsetof(private_certreq_payload_t, payload_length) },
/* 1 Byte CERTREQ type*/
{ U_INT_8, offsetof(private_certreq_payload_t, cert_encoding)},
{ U_INT_8, offsetof(private_certreq_payload_t, encoding) },
/* some certreq data bytes, length is defined in PAYLOAD_LENGTH */
{ CERTREQ_DATA, offsetof(private_certreq_payload_t, certreq_data)}
{ CERTREQ_DATA, offsetof(private_certreq_payload_t, data) }
};
/*
@@ -115,11 +109,15 @@ encoding_rule_t certreq_payload_encodings[] = {
*/
static status_t verify(private_certreq_payload_t *this)
{
if ((this->cert_encoding == 0) ||
((this->cert_encoding >= CERT_ROOF) && (this->cert_encoding <= 200)))
if (this->encoding == ENC_X509_SIGNATURE)
{
/* reserved IDs */
return FAILED;
if (this->data.len < HASH_SIZE_SHA1 ||
this->data.len % HASH_SIZE_SHA1)
{
DBG1(DBG_ENC, "invalid X509 hash length (%d) in certreq",
this->data.len);
return FAILED;
}
}
return SUCCESS;
}
@@ -164,58 +162,78 @@ static size_t get_length(private_certreq_payload_t *this)
{
return this->payload_length;
}
/**
* Implementation of certreq_payload_t.set_cert_encoding.
* Implementation of certreq_payload_t.add_keyid.
*/
static void set_cert_encoding (private_certreq_payload_t *this, cert_encoding_t encoding)
static void add_keyid(private_certreq_payload_t *this, chunk_t keyid)
{
this->cert_encoding = encoding;
this->data = chunk_cat("mc", this->data, keyid);
this->payload_length += keyid.len;
}
/**
* Implementation of certreq_payload_t.get_cert_encoding.
*/
static cert_encoding_t get_cert_encoding (private_certreq_payload_t *this)
{
return (this->cert_encoding);
}
typedef struct keyid_enumerator_t keyid_enumerator_t;
/**
* Implementation of certreq_payload_t.set_data.
* enumerator to enumerate keyids
*/
static void set_data (private_certreq_payload_t *this, chunk_t data)
struct keyid_enumerator_t {
enumerator_t public;
chunk_t full;
u_char *pos;
};
/**
* enumerate function for keyid_enumerator
*/
static bool keyid_enumerate(keyid_enumerator_t *this, chunk_t *chunk)
{
if (this->certreq_data.ptr != NULL)
if (this->pos == NULL)
{
chunk_free(&(this->certreq_data));
this->pos = this->full.ptr;
}
this->certreq_data.ptr = clalloc(data.ptr,data.len);
this->certreq_data.len = data.len;
this->payload_length = CERTREQ_PAYLOAD_HEADER_LENGTH + this->certreq_data.len;
}
/**
* Implementation of certreq_payload_t.get_data.
*/
static chunk_t get_data (private_certreq_payload_t *this)
{
return (this->certreq_data);
}
/**
* Implementation of certreq_payload_t.get_data_clone.
*/
static chunk_t get_data_clone (private_certreq_payload_t *this)
{
chunk_t cloned_data;
if (this->certreq_data.ptr == NULL)
else
{
return (this->certreq_data);
this->pos += HASH_SIZE_SHA1;
if (this->pos > (this->full.ptr + this->full.len - HASH_SIZE_SHA1))
{
this->pos = NULL;
}
}
if (this->pos)
{
chunk->ptr = this->pos;
chunk->len = HASH_SIZE_SHA1;
return TRUE;
}
return FALSE;
}
/**
* Implementation of certreq_payload_t.create_keyid_enumerator.
*/
static enumerator_t* create_keyid_enumerator(private_certreq_payload_t *this)
{
keyid_enumerator_t *enumerator = malloc_thing(keyid_enumerator_t);
enumerator->public.enumerate = (void*)keyid_enumerate;
enumerator->public.destroy = (void*)free;
enumerator->full = this->data;
enumerator->pos = NULL;
return &enumerator->public;
}
/**
* Implementation of certreq_payload_t.get_cert_type.
*/
static certificate_type_t get_cert_type(private_certreq_payload_t *this)
{
switch (this->encoding)
{
case ENC_X509_SIGNATURE:
return CERT_X509;
default:
return CERT_ANY;
}
cloned_data.ptr = clalloc(this->certreq_data.ptr,this->certreq_data.len);
cloned_data.len = this->certreq_data.len;
return cloned_data;
}
/**
@@ -223,11 +241,7 @@ static chunk_t get_data_clone (private_certreq_payload_t *this)
*/
static void destroy(private_certreq_payload_t *this)
{
if (this->certreq_data.ptr != NULL)
{
chunk_free(&(this->certreq_data));
}
chunk_free(&this->data);
free(this);
}
@@ -249,87 +263,38 @@ certreq_payload_t *certreq_payload_create()
/* public functions */
this->public.destroy = (void (*) (certreq_payload_t*)) destroy;
this->public.set_cert_encoding = (void (*) (certreq_payload_t*,cert_encoding_t))set_cert_encoding;
this->public.get_cert_encoding = (cert_encoding_t (*) (certreq_payload_t*))get_cert_encoding;
this->public.set_data = (void (*) (certreq_payload_t*,chunk_t))set_data;
this->public.get_data_clone = (chunk_t (*) (certreq_payload_t*))get_data_clone;
this->public.get_data = (chunk_t (*) (certreq_payload_t*))get_data;
this->public.create_keyid_enumerator = (enumerator_t*(*)(certreq_payload_t*))create_keyid_enumerator;
this->public.get_cert_type = (certificate_type_t(*)(certreq_payload_t*))get_cert_type;
this->public.add_keyid = (void(*)(certreq_payload_t*, chunk_t keyid))add_keyid;
/* private variables */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
this->payload_length =CERTREQ_PAYLOAD_HEADER_LENGTH;
this->certreq_data = chunk_empty;
this->payload_length = CERTREQ_PAYLOAD_HEADER_LENGTH;
this->data = chunk_empty;
this->encoding = 0;
return (&(this->public));
return &this->public;
}
/*
* Described in header
*/
certreq_payload_t *certreq_payload_create_from_cacert(identification_t *id)
certreq_payload_t *certreq_payload_create_type(certificate_type_t type)
{
x509_t *cacert;
rsa_public_key_t *pubkey;
chunk_t keyid;
certreq_payload_t *this;
private_certreq_payload_t *this = (private_certreq_payload_t*)certreq_payload_create();
cacert = charon->credentials->get_auth_certificate(charon->credentials, AUTH_CA, id);
if (cacert == NULL)
switch (type)
{
/* no such CA cert */
return NULL;
case CERT_X509:
this->encoding = ENC_X509_SIGNATURE;
break;
default:
DBG1(DBG_ENC, "certificate type %N not supported in requests",
certificate_type_names, type);
free(this);
return NULL;
}
this = certreq_payload_create();
pubkey = cacert->get_public_key(cacert);
keyid = pubkey->get_keyid(pubkey);
DBG2(DBG_IKE, "requesting certificate issued by '%D'", id);
DBG2(DBG_IKE, " with keyid %#B", &keyid);
this->set_cert_encoding(this, CERT_X509_SIGNATURE);
this->set_data(this, keyid);
return this;
return &this->public;
}
/*
* Described in header
*/
certreq_payload_t *certreq_payload_create_from_cacerts(void)
{
certreq_payload_t *this;
chunk_t keyids;
u_char *pos;
ca_info_t *cainfo;
iterator_t *iterator = charon->credentials->create_cainfo_iterator(charon->credentials);
int count = iterator->get_count(iterator);
if (count == 0)
{
iterator->destroy(iterator);
return NULL;
}
this = certreq_payload_create();
keyids = chunk_alloc(count * HASH_SIZE_SHA1);
pos = keyids.ptr;
while (iterator->iterate(iterator, (void**)&cainfo))
{
x509_t *cacert = cainfo->get_certificate(cainfo);
chunk_t keyid = cacert->get_keyid(cacert);
DBG2(DBG_IKE, "requesting certificate issued by '%D'", cacert->get_subject(cacert));
DBG2(DBG_IKE, " with keyid %#B", &keyid);
memcpy(pos, keyid.ptr, keyid.len);
pos += HASH_SIZE_SHA1;
}
iterator->destroy(iterator);
this->set_cert_encoding(this, CERT_X509_SIGNATURE);
this->set_data(this, keyids);
free(keyids.ptr);
return this;
}
src/charon/encoding/payloads/certreq_payload.h
+26 -78
View File
@@ -1,10 +1,3 @@
/**
* @file certreq_payload.h
*
* @brief Interface of certreq_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup certreq_payload certreq_payload
* @{ @ingroup payloads
*/
#ifndef CERTREQ_PAYLOAD_H_
@@ -32,26 +32,13 @@ typedef struct certreq_payload_t certreq_payload_t;
/**
* Length of a CERTREQ payload without the CERTREQ data in bytes.
*
* @ingroup payloads
*/
#define CERTREQ_PAYLOAD_HEADER_LENGTH 5
/**
* @brief Class representing an IKEv2 CERTREQ payload.
* Class representing an IKEv2 CERTREQ payload.
*
* The CERTREQ payload format is described in RFC section 3.7.
* This is just a dummy implementation to fullfill the standards
* requirements. A full implementation would offer setters/getters
* for the different encoding types.
*
* @b Constructors:
* - certreq_payload_create()
*
* @todo Implement payload functionality.
*
* @ingroup payloads
*/
struct certreq_payload_t {
/**
@@ -60,85 +47,46 @@ struct certreq_payload_t {
payload_t payload_interface;
/**
* @brief Set the CERT encoding.
* Create an enumerator over contained keyids.
*
* @param this calling certreq_payload_t object
* @param encoding CERT encoding
* @return enumerator over chunk_t's.
*/
void (*set_cert_encoding) (certreq_payload_t *this, cert_encoding_t encoding);
enumerator_t* (*create_keyid_enumerator)(certreq_payload_t *this);
/**
* @brief Get the CERT encoding.
* Get the type of contained certificate keyids.
*
* @param this calling certreq_payload_t object
* @return Encoding of the CERT
* @return certificate keyid type
*/
cert_encoding_t (*get_cert_encoding) (certreq_payload_t *this);
certificate_type_t (*get_cert_type)(certreq_payload_t *this);
/**
* @brief Set the CERTREQ data.
*
* Data are getting cloned.
* Add a certificates keyid to the payload.
*
* @param this calling certreq_payload_t object
* @param data CERTREQ data as chunk_t
* @param keyid keyid of the trusted certifcate
* @return
*/
void (*set_data) (certreq_payload_t *this, chunk_t data);
void (*add_keyid)(certreq_payload_t *this, chunk_t keyid);
/**
* @brief Get the CERTREQ data.
*
* Returned data are a copy of the internal one.
*
* @param this calling certreq_payload_t object
* @return CERTREQ data as chunk_t
*/
chunk_t (*get_data_clone) (certreq_payload_t *this);
/**
* @brief Get the CERTREQ data.
*
* Returned data are NOT copied.
*
* @param this calling certreq_payload_t object
* @return CERTREQ data as chunk_t
*/
chunk_t (*get_data) (certreq_payload_t *this);
/**
* @brief Destroys an certreq_payload_t object.
*
* @param this certreq_payload_t object to destroy
* Destroys an certreq_payload_t object.
*/
void (*destroy) (certreq_payload_t *this);
};
/**
* @brief Creates an empty certreq_payload_t object.
* Creates an empty certreq_payload_t object.
*
* @return certreq_payload_t object
*
* @ingroup payloads
* @return certreq payload
*/
certreq_payload_t *certreq_payload_create(void);
/**
* @brief Creates a certreq_payload_t object from a ca certificate
* Creates an empty certreq_payload_t for a kind of certificates.
*
* @param id subject distinguished name of CA certificate
* @return certreq_payload_t object
*
* @ingroup payloads
* @param type type of the added keyids
* @return certreq payload
*/
certreq_payload_t *certreq_payload_create_from_cacert(identification_t *id);
certreq_payload_t *certreq_payload_create_type(certificate_type_t type);
/**
* @brief Creates a certreq_payload_t object from all ca certificates
*
* @return certreq_payload_t object
*
* @ingroup payloads
*/
certreq_payload_t *certreq_payload_create_from_cacerts(void);
#endif /* CERTREQ_PAYLOAD_H_ */
#endif /* CERTREQ_PAYLOAD_H_ @} */
src/charon/encoding/payloads/configuration_attribute.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file configuration_attribute.c
*
* @brief Implementation of configuration_attribute_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/configuration_attribute.h
+17 -37
View File
@@ -1,10 +1,3 @@
/**
* @file configuration_attribute.h
*
* @brief Interface of configuration_attribute_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup configuration_attribute configuration_attribute
* @{ @ingroup payloads
*/
#ifndef CONFIGURATION_ATTRIBUTE_H_
@@ -33,15 +33,11 @@ typedef struct configuration_attribute_t configuration_attribute_t;
/**
* Configuration attribute header length in bytes.
*
* @ingroup payloads
*/
#define CONFIGURATION_ATTRIBUTE_HEADER_LENGTH 4
/**
* Type of the attribute, as in IKEv2 RFC 3.15.1.
*
* @ingroup payloads
*/
enum configuration_attribute_type_t {
INTERNAL_IP4_ADDRESS = 1,
@@ -62,20 +58,13 @@ enum configuration_attribute_type_t {
/**
* enum names for configuration_attribute_type_t.
*
* @ingroup payloads
*/
extern enum_name_t *configuration_attribute_type_names;
/**
* @brief Class representing an IKEv2-CONFIGURATION Attribute.
* Class representing an IKEv2-CONFIGURATION Attribute.
*
* The CONFIGURATION ATTRIBUTE format is described in RFC section 3.15.1.
*
* @b Constructors:
* - configuration_attribute_create()
*
* @ingroup payloads
*/
struct configuration_attribute_t {
/**
@@ -84,64 +73,55 @@ struct configuration_attribute_t {
payload_t payload_interface;
/**
* @brief Returns the currently set value of the attribute.
* Returns the currently set value of the attribute.
*
* @warning Returned data are not copied.
*
* @param this calling configuration_attribute_t object
* @return chunk_t pointing to the value
*/
chunk_t (*get_value) (configuration_attribute_t *this);
/**
* @brief Sets the value of the attribute.
* Sets the value of the attribute.
*
* @warning Value is getting copied.
* Value is getting copied.
*
* @param this calling configuration_attribute_t object
* @param value chunk_t pointing to the value to set
*/
void (*set_value) (configuration_attribute_t *this, chunk_t value);
/**
* @brief Sets the type of the attribute.
* Sets the type of the attribute.
*
* @param this calling configuration_attribute_t object
* @param type type to set (most significant bit is set to zero)
*/
void (*set_type) (configuration_attribute_t *this, u_int16_t type);
/**
* @brief get the type of the attribute.
* get the type of the attribute.
*
* @param this calling configuration_attribute_t object
* @return type of the value
*/
u_int16_t (*get_type) (configuration_attribute_t *this);
/**
* @brief get the length of an attribute.
* get the length of an attribute.
*
* @param this calling configuration_attribute_t object
* @return type of the value
*/
u_int16_t (*get_length) (configuration_attribute_t *this);
/**
* @brief Destroys an configuration_attribute_t object.
*
* @param this configuration_attribute_t object to destroy
* Destroys an configuration_attribute_t object.
*/
void (*destroy) (configuration_attribute_t *this);
};
/**
* @brief Creates an empty configuration_attribute_t object.
* Creates an empty configuration_attribute_t object.
*
* @return created configuration_attribute_t object
*
* @ingroup payloads
*/
configuration_attribute_t *configuration_attribute_create(void);
#endif /* CONFIGURATION_ATTRIBUTE_H_*/
#endif /* CONFIGURATION_ATTRIBUTE_H_ @} */
src/charon/encoding/payloads/cp_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file cp_payload.c
*
* @brief Implementation of cp_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/cp_payload.h
+15 -34
View File
@@ -1,10 +1,3 @@
/**
* @file cp_payload.h
*
* @brief Interface of cp_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup cp_payload cp_payload
* @{ @ingroup payloads
*/
#ifndef CP_PAYLOAD_H_
@@ -34,15 +34,11 @@ typedef struct cp_payload_t cp_payload_t;
/**
* CP_PAYLOAD length in bytes without any proposal substructure.
*
* @ingroup payloads
*/
#define CP_PAYLOAD_HEADER_LENGTH 8
/**
* Config Type of an Configuration Payload.
*
* @ingroup payloads
*/
enum config_type_t {
CFG_REQUEST = 1,
@@ -53,20 +49,13 @@ enum config_type_t {
/**
* enum name for config_type_t.
*
* @ingroup payloads
*/
extern enum_name_t *config_type_names;
/**
* @brief Class representing an IKEv2-CP Payload.
* Class representing an IKEv2-CP Payload.
*
* The CP Payload format is described in RFC section 3.15.
*
* @b Constructors:
* - cp_payload_create()
*
* @ingroup payloads
*/
struct cp_payload_t {
/**
@@ -75,58 +64,50 @@ struct cp_payload_t {
payload_t payload_interface;
/**
* @brief Creates an iterator of stored configuration_attribute_t objects.
* Creates an iterator of stored configuration_attribute_t objects.
*
* When deleting an attribute using this iterator, the length of this
* configuration_attribute_t has to be refreshed by calling get_length()!
*
* @param this calling cp_payload_t object
* @return created iterator_t object
*/
iterator_t *(*create_attribute_iterator) (cp_payload_t *this);
/**
* @brief Adds a configuration_attribute_t object to this object.
* Adds a configuration_attribute_t object to this object.
*
* The added configuration_attribute_t object is getting destroyed in
* destroy function of cp_payload_t.
*
* @param this calling cp_payload_t object
* @param attribute configuration_attribute_t object to add
*/
void (*add_configuration_attribute) (cp_payload_t *this, configuration_attribute_t *attribute);
/**
* @brief Set the config type.
* Set the config type.
*
* @param this calling cp_payload_t object
* @param config_type config_type_t to set
*/
void (*set_config_type) (cp_payload_t *this,config_type_t config_type);
/**
* @brief Get the config type.
* Get the config type.
*
* @param this calling cp_payload_t object
* @return config_type_t
*/
config_type_t (*get_config_type) (cp_payload_t *this);
/**
* @brief Destroys an cp_payload_t object.
*
* @param this cp_payload_t object to destroy
* Destroys an cp_payload_t object.
*/
void (*destroy) (cp_payload_t *this);
};
/**
* @brief Creates an empty cp_payload_t object
* Creates an empty cp_payload_t object
*
* @return cp_payload_t object
*
* @ingroup payloads
*/
cp_payload_t *cp_payload_create(void);
#endif /*CP_PAYLOAD_H_*/
#endif /*CP_PAYLOAD_H_ @} */
src/charon/encoding/payloads/delete_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file delete_payload.c
*
* @brief Implementation of delete_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/delete_payload.h
+14 -30
View File
@@ -1,10 +1,3 @@
/**
* @file delete_payload.h
*
* @brief Interface of delete_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup delete_payload delete_payload
* @{ @ingroup payloads
*/
#ifndef DELETE_PAYLOAD_H_
@@ -32,22 +32,13 @@ typedef struct delete_payload_t delete_payload_t;
/**
* Length of a delete payload without the SPI in bytes.
*
* @ingroup payloads
*/
#define DELETE_PAYLOAD_HEADER_LENGTH 8
/**
* @brief Class representing an IKEv2 DELETE payload.
* Class representing an IKEv2 DELETE payload.
*
* The DELETE payload format is described in RFC section 3.11.
*
* @b Constructors:
* - delete_payload_create()
*
* @todo Implement better setter/getters
*
* @ingroup payloads
*/
struct delete_payload_t {
/**
@@ -56,47 +47,40 @@ struct delete_payload_t {
payload_t payload_interface;
/**
* @brief Get the protocol ID.
* Get the protocol ID.
*
* @param this calling delete_payload_t object
* @return protocol ID
*/
protocol_id_t (*get_protocol_id) (delete_payload_t *this);
/**
* @brief Add an SPI to the list of deleted SAs.
* Add an SPI to the list of deleted SAs.
*
* @param this calling delete_payload_t object
* @param spi spi to add
*/
void (*add_spi) (delete_payload_t *this, u_int32_t spi);
/**
* @brief Get an iterator over the SPIs.
* Get an iterator over the SPIs.
*
* The iterate() function returns a pointer to a u_int32_t SPI.
*
* @param this calling delete_payload_t object
* @return iterator over SPIs
*/
iterator_t *(*create_spi_iterator) (delete_payload_t *this);
/**
* @brief Destroys an delete_payload_t object.
*
* @param this delete_payload_t object to destroy
* Destroys an delete_payload_t object.
*/
void (*destroy) (delete_payload_t *this);
};
/**
* @brief Creates an empty delete_payload_t object.
* Creates an empty delete_payload_t object.
*
* @param protocol_id protocol, such as AH|ESP
* @return delete_payload_t object
*
* @ingroup payloads
*/
delete_payload_t *delete_payload_create(protocol_id_t protocol_id);
#endif /* DELETE_PAYLOAD_H_ */
#endif /* DELETE_PAYLOAD_H_ @} */
src/charon/encoding/payloads/eap_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file eap_payload.c
*
* @brief Implementation of eap_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/eap_payload.h
+19 -41
View File
@@ -1,10 +1,3 @@
/**
* @file eap_payload.h
*
* @brief Interface of eap_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup eap_payload eap_payload
* @{ @ingroup payloads
*/
#ifndef EAP_PAYLOAD_H_
@@ -32,20 +32,13 @@ typedef struct eap_payload_t eap_payload_t;
/**
* Length of a EAP payload without the EAP Message in bytes.
*
* @ingroup payloads
*/
#define EAP_PAYLOAD_HEADER_LENGTH 4
/**
* @brief Class representing an IKEv2 EAP payload.
* Class representing an IKEv2 EAP payload.
*
* The EAP payload format is described in RFC section 3.16.
*
* @b Constructors:
* - eap_payload_create()
*
* @ingroup payloads
*/
struct eap_payload_t {
@@ -55,79 +48,68 @@ struct eap_payload_t {
payload_t payload_interface;
/**
* @brief Set the contained EAP data.
* Set the contained EAP data.
*
* This contains the FULL EAP message starting with "code".
* Chunk gets cloned.
*
* @param this calling eap_payload_t object
* @param message EAP data
*/
void (*set_data) (eap_payload_t *this, chunk_t data);
/**
* @brief Get the contained EAP data.
* Get the contained EAP data.
*
* This contains the FULL EAP message starting with "code".
*
* @param this calling eap_payload_t object
* @return EAP data (pointer to internal data)
*/
chunk_t (*get_data) (eap_payload_t *this);
/**
* @brief Get the EAP code.
* Get the EAP code.
*
* @param this calling eap_payload_t object
* @return EAP message as chunk_t
*/
eap_code_t (*get_code) (eap_payload_t *this);
/**
* @brief Get the EAP identifier.
* Get the EAP identifier.
*
* @param this calling eap_payload_t object
* @return unique identifier
*/
u_int8_t (*get_identifier) (eap_payload_t *this);
/**
* @brief Get the EAP method type.
* Get the EAP method type.
*
* @param this calling eap_payload_t object
* @param vendor pointer receiving vendor identifier
* @return EAP method type, vendor specific if vendor != 0
*/
eap_type_t (*get_type) (eap_payload_t *this, u_int32_t *vendor);
/**
* @brief Destroys an eap_payload_t object.
*
* @param this eap_payload_t object to destroy
* Destroys an eap_payload_t object.
*/
void (*destroy) (eap_payload_t *this);
};
/**
* @brief Creates an empty eap_payload_t object.
* Creates an empty eap_payload_t object.
*
* @return eap_payload_t object
*
* @ingroup payloads
*/
eap_payload_t *eap_payload_create(void);
/**
* @brief Creates an eap_payload_t object with data.
* Creates an eap_payload_t object with data.
*
* @return eap_payload_t object
*
* @ingroup payloads
*/
eap_payload_t *eap_payload_create_data(chunk_t data);
/**
* @brief Creates an eap_payload_t object with a code.
* Creates an eap_payload_t object with a code.
*
* Could should be either EAP_SUCCESS/EAP_FAILURE, use
* constructor above otherwise.
@@ -135,19 +117,15 @@ eap_payload_t *eap_payload_create_data(chunk_t data);
* @param code EAP status code
* @param identifier EAP identifier to use in payload
* @return eap_payload_t object
*
* @ingroup payloads
*/
eap_payload_t *eap_payload_create_code(eap_code_t code, u_int8_t identifier);
/**
* @brief Creates an eap_payload_t EAP_RESPONSE containing an EAP_NAK.
* Creates an eap_payload_t EAP_RESPONSE containing an EAP_NAK.
*
* @param identifier EAP identifier to use in payload
* @return eap_payload_t object
*
* @ingroup payloads
*/
eap_payload_t *eap_payload_create_nak(u_int8_t identifier);
#endif /* EAP_PAYLOAD_H_ */
#endif /* EAP_PAYLOAD_H_ @} */
src/charon/encoding/payloads/encodings.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file encodings.c
*
* @brief String mappings of encoding_type_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
src/charon/encoding/payloads/encodings.h
+13 -20
View File
@@ -1,10 +1,3 @@
/**
* @file encodings.h
*
* @brief Definition of encoding_type_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup encodings encodings
* @{ @ingroup payloads
*/
#ifndef ENCODINGS_H_
@@ -30,7 +30,7 @@ typedef struct encoding_rule_t encoding_rule_t;
#include <library.h>
/**
* @brief All different kinds of encoding types.
* All different kinds of encoding types.
*
* Each field of an IKEv2-Message (in header or payload)
* which has to be parsed or generated differently has its own
@@ -40,8 +40,6 @@ typedef struct encoding_rule_t encoding_rule_t;
* from PRIVATE USE space. Also the substructures
* of specific payload types get their own payload_id
* from PRIVATE_USE space. See IKEv2-Draft for more informations.
*
* @ingroup payloads
*/
enum encoding_type_t {
@@ -114,7 +112,7 @@ enum encoding_type_t {
U_INT_64,
/**
* @brief represents a RESERVED_BIT used in FLAG-Bytes.
* represents a RESERVED_BIT used in FLAG-Bytes.
*
* When generating, the next bit is set to zero and the current write
* position is moved one bit forward.
@@ -128,7 +126,7 @@ enum encoding_type_t {
RESERVED_BIT,
/**
* @brief represents a RESERVED_BYTE.
* represents a RESERVED_BYTE.
*
* When generating, the next byte is set to zero and the current write
* position is moved one byte forward.
@@ -499,21 +497,16 @@ enum encoding_type_t {
/**
* enum name for encoding_type_t
*
* @ingroup payloads
*/
extern enum_name_t *encoding_type_names;
/**
* Rule how to en-/decode a payload field.
*
* An encoding rule is a mapping of a specific encoding type to
* a location in the data struct where the current field is stored to
* or read from.
*
* For examples see files in this directory.
*
* This rules are used by parser and generator.
*
* @ingroup payloads
*/
struct encoding_rule_t {
@@ -534,4 +527,4 @@ struct encoding_rule_t {
u_int32_t offset;
};
#endif /*ENCODINGS_H_*/
#endif /*ENCODINGS_H_ @} */
src/charon/encoding/payloads/encryption_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file encryption_payload.c
*
* @brief Implementation of encryption_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/encryption_payload.h
+24 -46
View File
@@ -1,9 +1,3 @@
/**
* @file encryption_payload.h
*
* @brief Interface of encryption_payload_t.
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -18,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup encryption_payload encryption_payload
* @{ @ingroup payloads
*/
#ifndef ENCRYPTION_PAYLOAD_H_
@@ -33,14 +34,12 @@ typedef struct encryption_payload_t encryption_payload_t;
/**
* Encrpytion payload length in bytes without IV and following data.
*
* @ingroup payloads
*/
#define ENCRYPTION_PAYLOAD_HEADER_LENGTH 4
/**
* @brief The encryption payload as described in RFC section 3.14.
* The encryption payload as described in RFC section 3.14.
*
* Before any crypt/decrypt/sign/verify operation can occur,
* the transforms must be set. After that, a parsed encryption payload
@@ -51,11 +50,6 @@ typedef struct encryption_payload_t encryption_payload_t;
* must be builded after generation of all payloads and the encryption
* of the encryption payload.
* Signature verificatin is done before decryption.
*
* @b Constructors:
* - encryption_payload_create()
*
* @ingroup payloads
*/
struct encryption_payload_t {
/**
@@ -64,29 +58,26 @@ struct encryption_payload_t {
payload_t payload_interface;
/**
* @brief Creates an iterator for all contained payloads.
* Creates an iterator for all contained payloads.
*
* @warning iterator_t object has to get destroyed by the caller.
* iterator_t object has to get destroyed by the caller.
*
* @param this calling encryption_payload_t object
* @param[in] forward iterator direction (TRUE: front to end)
* @param forward iterator direction (TRUE: front to end)
* return created iterator_t object
*/
iterator_t *(*create_payload_iterator) (encryption_payload_t *this, bool forward);
/**
* @brief Adds a payload to this encryption payload.
* Adds a payload to this encryption payload.
*
* @param this calling encryption_payload_t object
* @param payload payload_t object to add
*/
void (*add_payload) (encryption_payload_t *this, payload_t *payload);
/**
* @brief Reove the last payload in the contained payload list.
* Reove the last payload in the contained payload list.
*
* @param this calling encryption_payload_t object
* @param[out] payload removed payload
* @param payload removed payload
* @return
* - SUCCESS, or
* - NOT_FOUND if list empty
@@ -94,15 +85,14 @@ struct encryption_payload_t {
status_t (*remove_first_payload) (encryption_payload_t *this, payload_t **payload);
/**
* @brief Get the number of payloads.
* Get the number of payloads.
*
* @param this calling encryption_payload_t object
* @return number of contained payloads
*/
size_t (*get_payload_count) (encryption_payload_t *this);
/**
* @brief Set transforms to use.
* Set transforms to use.
*
* To decryption, encryption, signature building and verifying,
* the payload needs a crypter and a signer object.
@@ -110,34 +100,29 @@ struct encryption_payload_t {
* @warning Do NOT call this function again after encryption, since
* the signer must be the same while encrypting and signature building!
*
* @param this calling encryption_payload_t
* @param crypter crypter_t to use for data de-/encryption
* @param signer signer_t to use for data signing/verifying
*/
void (*set_transforms) (encryption_payload_t *this, crypter_t *crypter, signer_t *signer);
/**
* @brief Generate and encrypt contained payloads.
* Generate and encrypt contained payloads.
*
* This function generates the content for added payloads
* and encrypts them. Signature is not built, since we need
* additional data (the full message).
*
* @param this calling encryption_payload_t
* @return
* - SUCCESS, or
* - INVALID_STATE if transforms not set
* @return SUCCESS, or INVALID_STATE if transforms not set
*/
status_t (*encrypt) (encryption_payload_t *this);
/**
* @brief Decrypt and parse contained payloads.
* Decrypt and parse contained payloads.
*
* This function decrypts the contained data. After,
* the payloads are parsed internally and are accessible
* via the iterator.
*
* @param this calling encryption_payload_t
* @return
* - SUCCESS, or
* - INVALID_STATE if transforms not set, or
@@ -146,13 +131,12 @@ struct encryption_payload_t {
status_t (*decrypt) (encryption_payload_t *this);
/**
* @brief Build the signature.
* Build the signature.
*
* The signature is built over the FULL message, so the header
* and every payload (inclusive this one) must already be generated.
* The generated message is supplied via the data paramater.
*
* @param this calling encryption_payload_t
* @param data chunk contains the already generated message
* @return
* - SUCCESS, or
@@ -161,13 +145,12 @@ struct encryption_payload_t {
status_t (*build_signature) (encryption_payload_t *this, chunk_t data);
/**
* @brief Verify the signature.
* Verify the signature.
*
* Since the signature is built over the full message, we need
* this data to do the verification. The message data
* is supplied via the data argument.
*
* @param this calling encryption_payload_t
* @param data chunk contains the message
* @return
* - SUCCESS, or
@@ -177,21 +160,16 @@ struct encryption_payload_t {
status_t (*verify_signature) (encryption_payload_t *this, chunk_t data);
/**
* @brief Destroys an encryption_payload_t object.
*
* @param this encryption_payload_t object to destroy
* Destroys an encryption_payload_t object.
*/
void (*destroy) (encryption_payload_t *this);
};
/**
* @brief Creates an empty encryption_payload_t object.
* Creates an empty encryption_payload_t object.
*
* @return encryption_payload_t object
*
* @ingroup payloads
*/
encryption_payload_t *encryption_payload_create(void);
#endif /*ENCRYPTION_PAYLOAD_H_*/
#endif /*ENCRYPTION_PAYLOAD_H_ @} */
src/charon/encoding/payloads/endpoint_notify.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file endpoint_notify.c
*
* @brief Implementation of endpoint_notify_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Hochschule fuer Technik Rapperswil
@@ -18,6 +11,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "endpoint_notify.h"
src/charon/encoding/payloads/endpoint_notify.h
+25 -52
View File
@@ -1,10 +1,3 @@
/**
* @file endpoint_notify.h
*
* @brief Interface of endpoint_notify_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Hochschule fuer Technik Rapperswil
@@ -18,8 +11,14 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup endpoint_notify endpoint_notify
* @{ @ingroup payloads
*/
#ifndef ENDPOINT_NOTIFY_H_
#define ENDPOINT_NOTIFY_H_
@@ -36,9 +35,7 @@ typedef struct endpoint_notify_t endpoint_notify_t;
#include <encoding/payloads/notify_payload.h>
/**
* @brief P2P endpoint families.
*
* @ingroup payloads
* P2P endpoint families.
*/
enum p2p_endpoint_family_t {
@@ -53,9 +50,7 @@ enum p2p_endpoint_family_t {
};
/**
* @brief P2P endpoint types.
*
* @ingroup payloads
* P2P endpoint types.
*/
enum p2p_endpoint_type_t {
@@ -75,128 +70,106 @@ enum p2p_endpoint_type_t {
/**
* enum name for p2p_endpoint_type_t.
*
* @ingroup payloads
*/
extern enum_name_t *p2p_endpoint_type_names;
/**
* @brief Class representing a P2P_ENDPOINT notify. In fact it's not
* Class representing a P2P_ENDPOINT notify. In fact it's not
* the notify per se, but the notification data of that notify that is
* handled with this class.
*
* @b Constructors:
* - endpoint_notify_create()
* - endpoint_notify_create_from_host()
*
* @ingroup payloads
*/
struct endpoint_notify_t {
/**
* @brief Returns the priority of this endpoint.
* Returns the priority of this endpoint.
*
* @param this object
* @return priority
*/
u_int32_t (*get_priority) (endpoint_notify_t *this);
/**
* @brief Sets the priority of this endpoint.
* Sets the priority of this endpoint.
*
* @param this object
* @param priority priority
*/
void (*set_priority) (endpoint_notify_t *this, u_int32_t priority);
/**
* @brief Returns the endpoint type of this endpoint.
* Returns the endpoint type of this endpoint.
*
* @param this object
* @return endpoint type
*/
p2p_endpoint_type_t (*get_type) (endpoint_notify_t *this);
/**
* @brief Returns the endpoint family of this endpoint.
* Returns the endpoint family of this endpoint.
*
* @param this object
* @return endpoint family
*/
p2p_endpoint_family_t (*get_family) (endpoint_notify_t *this);
/**
* @brief Returns the host of this endpoint.
* Returns the host of this endpoint.
*
* @param this object
* @return host
*/
host_t *(*get_host) (endpoint_notify_t *this);
/**
* @brief Returns the base of this endpoint.
* Returns the base of this endpoint.
*
* If this is not a SERVER_REFLEXIVE endpoint, the returned host is the same
* as the one returned by get_host.
*
* @param this object
* @return host
*/
host_t *(*get_base) (endpoint_notify_t *this);
/**
* @brief Generates a notification payload from this endpoint.
* Generates a notification payload from this endpoint.
*
* @param this object
* @return built notify_payload_t
*/
notify_payload_t *(*build_notify) (endpoint_notify_t *this);
/**
* @brief Clones an endpoint_notify_t object.
* Clones an endpoint_notify_t object.
*
* @param this endpoint_notify_t object to clone
* @return cloned object
* @return cloned object
*/
endpoint_notify_t *(*clone) (endpoint_notify_t *this);
/**
* @brief Destroys an endpoint_notify_t object.
*
* @param this endpoint_notify_t object to destroy
* Destroys an endpoint_notify_t object.
*/
void (*destroy) (endpoint_notify_t *this);
};
/**
* @brief Creates an empty endpoint_notify_t object.
* Creates an empty endpoint_notify_t object.
*
* @return created endpoint_notify_t object
*
* @ingroup payloads
*/
endpoint_notify_t *endpoint_notify_create(void);
/**
* @brief Creates an endpoint_notify_t object from a host.
* Creates an endpoint_notify_t object from a host.
*
* @param type the endpoint type
* @param host host to base the notify on (gets cloned)
* @param base base of the endpoint, applies only to reflexive endpoints (gets cloned)
* @return created endpoint_notify_t object
*
* @ingroup payloads
*/
endpoint_notify_t *endpoint_notify_create_from_host(p2p_endpoint_type_t type, host_t *host, host_t *base);
endpoint_notify_t *endpoint_notify_create_from_host(p2p_endpoint_type_t type,
host_t *host, host_t *base);
/**
* @brief Creates an endpoint_notify_t object from a notify payload.
* Creates an endpoint_notify_t object from a notify payload.
*
* @param notify the notify payload
* @return - created endpoint_notify_t object
* - NULL if invalid payload
* @ingroup payloads
*/
endpoint_notify_t *endpoint_notify_create_from_payload(notify_payload_t *notify);
#endif /*ENDPOINT_NOTIFY_H_*/
#endif /*ENDPOINT_NOTIFY_H_ @} */
src/charon/encoding/payloads/id_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file id_payload.h
*
* @brief Interface of id_payload_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2006 Martin Willi
@@ -21,6 +14,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/id_payload.h
+18 -40
View File
@@ -1,10 +1,3 @@
/**
* @file id_payload.h
*
* @brief Interface of id_payload_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2006 Martin Willi
@@ -20,8 +13,14 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup id_payload id_payload
* @{ @ingroup payloads
*/
#ifndef ID_PAYLOAD_H_
#define ID_PAYLOAD_H_
@@ -34,8 +33,6 @@ typedef struct id_payload_t id_payload_t;
/**
* Length of a id payload without the data in bytes.
*
* @ingroup payloads
*/
#define ID_PAYLOAD_HEADER_LENGTH 8
@@ -43,12 +40,6 @@ typedef struct id_payload_t id_payload_t;
* Object representing an IKEv2 ID payload.
*
* The ID payload format is described in RFC section 3.5.
*
* @b Constructors:
* - id_payload_create_from_identification()
* - id_payload_create()
*
* @ingroup payloads
*/
struct id_payload_t {
/**
@@ -57,90 +48,77 @@ struct id_payload_t {
payload_t payload_interface;
/**
* @brief Set the ID type.
* Set the ID type.
*
* @param this calling id_payload_t object
* @param type Type of ID
*/
void (*set_id_type) (id_payload_t *this, id_type_t type);
/**
* @brief Get the ID type.
* Get the ID type.
*
* @param this calling id_payload_t object
* @return type of the ID
*/
id_type_t (*get_id_type) (id_payload_t *this);
/**
* @brief Set the ID data.
* Set the ID data.
*
* Data are getting cloned.
*
* @param this calling id_payload_t object
* @param data ID data as chunk_t
*/
void (*set_data) (id_payload_t *this, chunk_t data);
/**
* @brief Get the ID data.
* Get the ID data.
*
* Returned data are a copy of the internal one
*
* @param this calling id_payload_t object
* @return ID data as chunk_t
*/
chunk_t (*get_data_clone) (id_payload_t *this);
/**
* @brief Get the ID data.
* Get the ID data.
*
* Returned data are NOT copied.
*
* @param this calling id_payload_t object
* @return ID data as chunk_t
*/
chunk_t (*get_data) (id_payload_t *this);
/**
* @brief Creates an identification object of this id payload.
* Creates an identification object of this id payload.
*
* Returned object has to get destroyed by the caller.
*
* @param this calling id_payload_t object
* @return identification_t object
*/
identification_t *(*get_identification) (id_payload_t *this);
/**
* @brief Destroys an id_payload_t object.
*
* @param this id_payload_t object to destroy
* Destroys an id_payload_t object.
*/
void (*destroy) (id_payload_t *this);
};
/**
* @brief Creates an empty id_payload_t object.
* Creates an empty id_payload_t object.
*
* @param payload_type one of ID_INITIATOR, ID_RESPONDER
* @return id_payload_t object
*
* @ingroup payloads
*/
id_payload_t *id_payload_create(payload_type_t payload_type);
/**
* @brief Creates an id_payload_t from an existing identification_t object.
* Creates an id_payload_t from an existing identification_t object.
*
* @param payload_type one of ID_INITIATOR, ID_RESPONDER
* @param identification identification_t object
* @return id_payload_t object
*
* @ingroup payloads
*/
id_payload_t *id_payload_create_from_identification(payload_type_t payload_type, identification_t *identification);
id_payload_t *id_payload_create_from_identification(payload_type_t payload_type,
identification_t *identification);
#endif /* ID_PAYLOAD_H_ */
#endif /* ID_PAYLOAD_H_ @} */
src/charon/encoding/payloads/ike_header.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file ike_header.c
*
* @brief Implementation of ike_header_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2006 Martin Willi
@@ -20,6 +13,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/* offsetof macro */
src/charon/encoding/payloads/ike_header.h
+29 -66
View File
@@ -1,10 +1,3 @@
/**
* @file ike_header.h
*
* @brief Interface of ike_header_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2006 Martin Willi
@@ -20,6 +13,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup ike_header ike_header
* @{ @ingroup payloads
*/
#ifndef IKE_HEADER_H_
@@ -33,38 +33,28 @@ typedef struct ike_header_t ike_header_t;
/**
* Major Version of IKEv2.
*
* @ingroup payloads
*/
#define IKE_MAJOR_VERSION 2
/**
* Minor Version of IKEv2.
*
* @ingroup payloads
*/
#define IKE_MINOR_VERSION 0
/**
* Flag in IKEv2-Header. Always 0.
*
* @ingroup payloads
*/
#define HIGHER_VERSION_SUPPORTED_FLAG 0
/**
* Length of IKE Header in Bytes.
*
* @ingroup payloads
*/
#define IKE_HEADER_LENGTH 28
/**
* @brief Different types of IKE-Exchanges.
* Different types of IKE-Exchanges.
*
* See Draft for different types.
*
* @ingroup payloads
* See RFC for different types.
*/
enum exchange_type_t{
@@ -102,23 +92,16 @@ enum exchange_type_t{
/**
* enum name for exchange_type_t
*
* @ingroup payloads
*/
extern enum_name_t *exchange_type_names;
/**
* @brief An object of this type represents an IKEv2 header and is used to
* An object of this type represents an IKEv2 header and is used to
* generate and parse IKEv2 headers.
*
* The header format of an IKEv2-Message is compatible to the
* ISAKMP-Header format to allow implementations supporting
* both versions of the IKE-protocol.
*
* @b Constructors:
* - ike_header_create()
*
* @ingroup payloads
*/
struct ike_header_t {
/**
@@ -127,141 +110,121 @@ struct ike_header_t {
payload_t payload_interface;
/**
* @brief Get the initiator spi.
* Get the initiator spi.
*
* @param this ike_header_t object
* @return initiator_spi
*/
u_int64_t (*get_initiator_spi) (ike_header_t *this);
/**
* @brief Set the initiator spi.
* Set the initiator spi.
*
* @param this ike_header_t object
* @param initiator_spi initiator_spi
*/
void (*set_initiator_spi) (ike_header_t *this, u_int64_t initiator_spi);
/**
* @brief Get the responder spi.
* Get the responder spi.
*
* @param this ike_header_t object
* @return responder_spi
*/
u_int64_t (*get_responder_spi) (ike_header_t *this);
/**
* @brief Set the responder spi.
* Set the responder spi.
*
* @param this ike_header_t object
* @param responder_spi responder_spi
*/
void (*set_responder_spi) (ike_header_t *this, u_int64_t responder_spi);
/**
* @brief Get the major version.
* Get the major version.
*
* @param this ike_header_t object
* @return major version
*/
u_int8_t (*get_maj_version) (ike_header_t *this);
/**
* @brief Get the minor version.
* Get the minor version.
*
* @param this ike_header_t object
* @return minor version
*/
u_int8_t (*get_min_version) (ike_header_t *this);
/**
* @brief Get the response flag.
* Get the response flag.
*
* @param this ike_header_t object
* @return response flag
*/
bool (*get_response_flag) (ike_header_t *this);
/**
* @brief Set the response flag-
* Set the response flag-
*
* @param this ike_header_t object
* @param response response flag
*
*/
void (*set_response_flag) (ike_header_t *this, bool response);
/**
* @brief Get "higher version supported"-flag.
* Get "higher version supported"-flag.
*
* @param this ike_header_t object
* @return version flag
*/
bool (*get_version_flag) (ike_header_t *this);
/**
* @brief Get the initiator flag.
* Get the initiator flag.
*
* @param this ike_header_t object
* @return initiator flag
*/
bool (*get_initiator_flag) (ike_header_t *this);
/**
* @brief Set the initiator flag.
* Set the initiator flag.
*
* @param this ike_header_t object
* @param initiator initiator flag
*
*/
void (*set_initiator_flag) (ike_header_t *this, bool initiator);
/**
* @brief Get the exchange type.
* Get the exchange type.
*
* @param this ike_header_t object
* @return exchange type
* @return exchange type
*/
u_int8_t (*get_exchange_type) (ike_header_t *this);
/**
* @brief Set the exchange type.
* Set the exchange type.
*
* @param this ike_header_t object
* @param exchange_type exchange type
*/
void (*set_exchange_type) (ike_header_t *this, u_int8_t exchange_type);
/**
* @brief Get the message id.
* Get the message id.
*
* @param this ike_header_t object
* @return message id
*/
u_int32_t (*get_message_id) (ike_header_t *this);
/**
* @brief Set the message id.
* Set the message id.
*
* @param this ike_header_t object
* @param initiator_spi message id
*/
void (*set_message_id) (ike_header_t *this, u_int32_t message_id);
/**
* @brief Destroys a ike_header_t object.
*
* @param this ike_header_t object to destroy
* Destroys a ike_header_t object.
*/
void (*destroy) (ike_header_t *this);
};
/**
* @brief Create an ike_header_t object
* Create an ike_header_t object
*
* @return ike_header_t object
*
* @ingroup payloads
*/
ike_header_t *ike_header_create(void);
#endif /*IKE_HEADER_H_*/
#endif /*IKE_HEADER_H_ @} */
src/charon/encoding/payloads/ke_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file ke_payload.c
*
* @brief Implementation of ke_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/ke_payload.h
+23 -38
View File
@@ -1,10 +1,3 @@
/**
* @file ke_payload.h
*
* @brief Interface of ke_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup ke_payload ke_payload
* @{ @ingroup payloads
*/
#ifndef KE_PAYLOAD_H_
@@ -34,20 +34,13 @@ typedef struct ke_payload_t ke_payload_t;
/**
* KE payload length in bytes without any key exchange data.
*
* @ingroup payloads
*/
#define KE_PAYLOAD_HEADER_LENGTH 8
/**
* @brief Class representing an IKEv2-KE Payload.
* Class representing an IKEv2-KE Payload.
*
* The KE Payload format is described in RFC section 3.4.
*
* @b Constructors:
* - ke_payload_create()
*
* @ingroup payloads
*/
struct ke_payload_t {
/**
@@ -56,66 +49,58 @@ struct ke_payload_t {
payload_t payload_interface;
/**
* @brief Returns the currently set key exchange data of this KE payload.
* Returns the currently set key exchange data of this KE payload.
*
* @warning Returned data are not copied.
*
* @param this calling ke_payload_t object
* @return chunk_t pointing to the value
*/
chunk_t (*get_key_exchange_data) (ke_payload_t *this);
/**
* @brief Sets the key exchange data of this KE payload.
* Sets the key exchange data of this KE payload.
*
* @warning Value is getting copied.
* Value is getting copied.
*
* @param this calling ke_payload_t object
* @param key_exchange_data chunk_t pointing to the value to set
* @param key_exchange_data chunk_t pointing to the value to set
*/
void (*set_key_exchange_data) (ke_payload_t *this, chunk_t key_exchange_data);
/**
* @brief Gets the Diffie-Hellman Group Number of this KE payload.
* Gets the Diffie-Hellman Group Number of this KE payload.
*
* @param this calling ke_payload_t object
* @return DH Group Number of this payload
* @return DH Group Number of this payload
*/
diffie_hellman_group_t (*get_dh_group_number) (ke_payload_t *this);
/**
* @brief Sets the Diffie-Hellman Group Number of this KE payload.
* Sets the Diffie-Hellman Group Number of this KE payload.
*
* @param this calling ke_payload_t object
* @param dh_group_number DH Group to set
*/
void (*set_dh_group_number) (ke_payload_t *this, diffie_hellman_group_t dh_group_number);
void (*set_dh_group_number) (ke_payload_t *this,
diffie_hellman_group_t dh_group_number);
/**
* @brief Destroys an ke_payload_t object.
*
* @param this ke_payload_t object to destroy
* Destroys an ke_payload_t object.
*/
void (*destroy) (ke_payload_t *this);
};
/**
* @brief Creates an empty ke_payload_t object
* Creates an empty ke_payload_t object
*
* @return ke_payload_t object
*
* @ingroup payloads
*/
ke_payload_t *ke_payload_create(void);
/**
* @brief Creates a ke_payload_t from a diffie_hellman_t
* Creates a ke_payload_t from a diffie_hellman_t
*
* @param diffie_hellman diffie hellman object containing group and key
* @return ke_payload_t object
*
* @ingroup payloads
*/
ke_payload_t *ke_payload_create_from_diffie_hellman(diffie_hellman_t *diffie_hellman);
ke_payload_t *ke_payload_create_from_diffie_hellman(
diffie_hellman_t *diffie_hellman);
#endif /* KE_PAYLOAD_H_ */
#endif /* KE_PAYLOAD_H_ @} */
src/charon/encoding/payloads/nonce_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file nonce_payload.h
*
* @brief Implementation of nonce_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/* offsetof macro */
src/charon/encoding/payloads/nonce_payload.h
+12 -31
View File
@@ -1,10 +1,3 @@
/**
* @file nonce_payload.h
*
* @brief Interface of nonce_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup nonce_payload nonce_payload
* @{ @ingroup payloads
*/
#ifndef NONCE_PAYLOAD_H_
@@ -31,17 +31,11 @@ typedef struct nonce_payload_t nonce_payload_t;
/**
* Nonce size in bytes for nonces sending to other peer.
*
* @warning Nonce size MUST be between 16 and 256 bytes.
*
* @ingroup payloads
*/
#define NONCE_SIZE 16
/**
* Length of a nonce payload without a nonce in bytes.
*
* @ingroup payloads
*/
#define NONCE_PAYLOAD_HEADER_LENGTH 4
@@ -49,11 +43,6 @@ typedef struct nonce_payload_t nonce_payload_t;
* Object representing an IKEv2 Nonce payload.
*
* The Nonce payload format is described in RFC section 3.3.
*
* @b Constructors:
* - nonce_payload_create()
*
* @ingroup payloads
*/
struct nonce_payload_t {
/**
@@ -62,38 +51,30 @@ struct nonce_payload_t {
payload_t payload_interface;
/**
* @brief Set the nonce value.
* Set the nonce value.
*
* @param this calling nonce_payload_t object
* @param nonce chunk containing the nonce, will be cloned
*/
void (*set_nonce) (nonce_payload_t *this, chunk_t nonce);
/**
* @brief Get the nonce value.
* Get the nonce value.
*
* @param this calling nonce_payload_t object
* @return a chunk containing the cloned nonce
*/
chunk_t (*get_nonce) (nonce_payload_t *this);
/**
* @brief Destroys an nonce_payload_t object.
*
* @param this nonce_payload_t object to destroy
* Destroys an nonce_payload_t object.
*/
void (*destroy) (nonce_payload_t *this);
};
/**
* @brief Creates an empty nonce_payload_t object
* Creates an empty nonce_payload_t object
*
* @return nonce_payload_t object
*
* @ingroup payloads
*/
nonce_payload_t *nonce_payload_create(void);
#endif /*NONCE_PAYLOAD_H_*/
#endif /*NONCE_PAYLOAD_H_ @} */
src/charon/encoding/payloads/notify_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file notify_payload.c
*
* @brief Implementation of notify_payload_t.
*
*/
/*
* Copyright (C) 2006-2007 Tobias Brunner
* Copyright (C) 2006 Daniel Roethlisberger
@@ -21,6 +14,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/notify_payload.h
+25 -55
View File
@@ -1,10 +1,3 @@
/**
* @file notify_payload.h
*
* @brief Interface of notify_payload_t.
*
*/
/*
* Copyright (C) 2006-2007 Tobias Brunner
* Copyright (C) 2006 Daniel Roethlisberger
@@ -21,8 +14,14 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup notify_payload notify_payload
* @{ @ingroup payloads
*/
#ifndef NOTIFY_PAYLOAD_H_
#define NOTIFY_PAYLOAD_H_
@@ -37,17 +36,13 @@ typedef struct notify_payload_t notify_payload_t;
/**
* Notify payload length in bytes without any spi and notification data.
*
* @ingroup payloads
*/
#define NOTIFY_PAYLOAD_HEADER_LENGTH 8
/**
* @brief Notify message types.
* Notify message types.
*
* See IKEv2 RFC 3.10.1.
*
* @ingroup payloads
*/
enum notify_type_t {
/* notify error messages */
@@ -109,30 +104,18 @@ enum notify_type_t {
/**
* enum name for notify_type_t.
*
* @ingroup payloads
*/
extern enum_name_t *notify_type_names;
/**
* enum name for notify_type_t (shorter strings).
*
* @ingroup payloads
*/
extern enum_name_t *notify_type_short_names;
/**
* @brief Class representing an IKEv2-Notify Payload.
* Class representing an IKEv2-Notify Payload.
*
* The Notify Payload format is described in Draft section 3.10.
*
* @b Constructors:
* - notify_payload_create()
* - notify_payload_create_from_protocol_and_type()
*
* @todo Build specified constructor/getter for notify's
*
* @ingroup payloads
*/
struct notify_payload_t {
/**
@@ -141,104 +124,91 @@ struct notify_payload_t {
payload_t payload_interface;
/**
* @brief Gets the protocol id of this payload.
* Gets the protocol id of this payload.
*
* @param this calling notify_payload_t object
* @return protocol id of this payload
*/
u_int8_t (*get_protocol_id) (notify_payload_t *this);
/**
* @brief Sets the protocol id of this payload.
* Sets the protocol id of this payload.
*
* @param this calling notify_payload_t object
* @param protocol_id protocol id to set
*/
void (*set_protocol_id) (notify_payload_t *this, u_int8_t protocol_id);
/**
* @brief Gets the notify message type of this payload.
* Gets the notify message type of this payload.
*
* @param this calling notify_payload_t object
* @return notify message type of this payload
*/
notify_type_t (*get_notify_type) (notify_payload_t *this);
/**
* @brief Sets notify message type of this payload.
* Sets notify message type of this payload.
*
* @param this calling notify_payload_t object
* @param type notify message type to set
*/
void (*set_notify_type) (notify_payload_t *this, notify_type_t type);
/**
* @brief Returns the currently set spi of this payload.
* Returns the currently set spi of this payload.
*
* This is only valid for notifys with protocol AH|ESP
*
* @param this calling notify_payload_t object
* @return SPI value
*/
u_int32_t (*get_spi) (notify_payload_t *this);
/**
* @brief Sets the spi of this payload.
* Sets the spi of this payload.
*
* This is only valid for notifys with protocol AH|ESP
*
* @param this calling notify_payload_t object
* @param spi SPI value
*/
void (*set_spi) (notify_payload_t *this, u_int32_t spi);
/**
* @brief Returns the currently set notification data of payload.
* Returns the currently set notification data of payload.
*
* @warning Returned data are not copied.
* Returned data are not copied.
*
* @param this calling notify_payload_t object
* @return chunk_t pointing to the value
*/
chunk_t (*get_notification_data) (notify_payload_t *this);
/**
* @brief Sets the notification data of this payload.
* Sets the notification data of this payload.
*
* @warning Value is getting copied.
*
* @param this calling notify_payload_t object
* @param notification_data chunk_t pointing to the value to set
*/
void (*set_notification_data) (notify_payload_t *this, chunk_t notification_data);
void (*set_notification_data) (notify_payload_t *this,
chunk_t notification_data);
/**
* @brief Destroys an notify_payload_t object.
*
* @param this notify_payload_t object to destroy
* Destroys an notify_payload_t object.
*/
void (*destroy) (notify_payload_t *this);
};
/**
* @brief Creates an empty notify_payload_t object
* Creates an empty notify_payload_t object
*
* @return created notify_payload_t object
*
* @ingroup payloads
*/
notify_payload_t *notify_payload_create(void);
/**
* @brief Creates an notify_payload_t object of specific type for specific protocol id.
* Creates an notify_payload_t object of specific type for specific protocol id.
*
* @param protocol_id protocol id (IKE, AH or ESP)
* @param type notify type (see notify_type_t)
* @return notify_payload_t object
*
* @ingroup payloads
*/
notify_payload_t *notify_payload_create_from_protocol_and_type(protocol_id_t protocol_id, notify_type_t type);
notify_payload_t *notify_payload_create_from_protocol_and_type(
protocol_id_t protocol_id, notify_type_t type);
#endif /*NOTIFY_PAYLOAD_H_*/
#endif /*NOTIFY_PAYLOAD_H_ @} */
src/charon/encoding/payloads/payload.c
+2 -8
View File
@@ -1,11 +1,3 @@
/**
* @file payload.c
*
* @brief Generic constructor to the payload_t interface.
*
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2006 Martin Willi
@@ -21,6 +13,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
src/charon/encoding/payloads/payload.h
+25 -42
View File
@@ -1,10 +1,3 @@
/**
* @file payload.h
*
* @brief Interface payload_t.
*
*/
/*
* Copyright (C) 2007 Tobias Brunner
* Copyright (C) 2005-2006 Martin Willi
@@ -20,6 +13,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup payload payload
* @{ @ingroup payloads
*/
#ifndef PAYLOAD_H_
@@ -33,12 +33,10 @@ typedef struct payload_t payload_t;
/**
* @brief Payload-Types of a IKEv2-Message.
* Payload-Types of a IKEv2-Message.
*
* Header and substructures are also defined as
* payload types with values from PRIVATE USE space.
*
* @ingroup payloads
*/
enum payload_type_t{
@@ -204,80 +202,65 @@ extern enum_name_t *payload_type_names;
extern enum_name_t *payload_type_short_names;
/**
* @brief Generic interface for all payload types (incl.header and substructures).
* Generic interface for all payload types (incl.header and substructures).
*
* To handle all kinds of payloads on a generic way, this interface must
* be implemented by every payload. This allows parser_t/generator_t a simple
* handling of all payloads.
*
* @b Constructors:
* - payload_create() with the payload to instantiate.
*
* @ingroup payloads
*/
struct payload_t {
/**
* @brief Get encoding rules for this payload.
* Get encoding rules for this payload.
*
* @param this calling object
* @param[out] rules location to store pointer of first rule
* @param[out] rule_count location to store number of rules
* @param rules location to store pointer of first rule
* @param rule_count location to store number of rules
*/
void (*get_encoding_rules) (payload_t *this, encoding_rule_t **rules, size_t *rule_count);
/**
* @brief Get type of payload.
* Get type of payload.
*
* @param this calling object
* @return type of this payload
* @return type of this payload
*/
payload_type_t (*get_type) (payload_t *this);
/**
* @brief Get type of next payload or NO_PAYLOAD (0) if this is the last one.
* Get type of next payload or NO_PAYLOAD (0) if this is the last one.
*
* @param this calling object
* @return type of next payload
* @return type of next payload
*/
payload_type_t (*get_next_type) (payload_t *this);
/**
* @brief Set type of next payload.
* Set type of next payload.
*
* @param this calling object
* @param type type of next payload
* @param type type of next payload
*/
void (*set_next_type) (payload_t *this,payload_type_t type);
/**
* @brief Get length of payload.
* Get length of payload.
*
* @param this calling object
* @return length of this payload
* @return length of this payload
*/
size_t (*get_length) (payload_t *this);
/**
* @brief Verifies payload structure and makes consistence check.
* Verifies payload structure and makes consistence check.
*
* @param this calling object
* @return
* - SUCCESS
* - FAILED if consistence not given
* @return SUCCESS, FAILED if consistence not given
*/
status_t (*verify) (payload_t *this);
/**
* @brief Destroys a payload and all included substructures.
*
* @param this payload to destroy
* Destroys a payload and all included substructures.
*/
void (*destroy) (payload_t *this);
};
/**
* @brief Create an empty payload.
* Create an empty payload.
*
* Useful for the parser, who wants a generic constructor for all payloads.
* It supports all payload_t methods. If a payload type is not known,
@@ -288,4 +271,4 @@ struct payload_t {
*/
payload_t *payload_create(payload_type_t type);
#endif /*PAYLOAD_H_*/
#endif /*PAYLOAD_H_ @} */
src/charon/encoding/payloads/proposal_substructure.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file proposal_substructure.h
*
* @brief Implementation of proposal_substructure_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/proposal_substructure.h
+41 -72
View File
@@ -1,10 +1,3 @@
/**
* @file proposal_substructure.h
*
* @brief Interface of proposal_substructure_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup proposal_substructure proposal_substructure
* @{ @ingroup payloads
*/
#ifndef PROPOSAL_SUBSTRUCTURE_H_
@@ -35,20 +35,13 @@ typedef struct proposal_substructure_t proposal_substructure_t;
/**
* Length of the proposal substructure header (without spi).
*
* @ingroup payloads
*/
#define PROPOSAL_SUBSTRUCTURE_HEADER_LENGTH 8
/**
* @brief Class representing an IKEv2-PROPOSAL SUBSTRUCTURE.
* Class representing an IKEv2-PROPOSAL SUBSTRUCTURE.
*
* The PROPOSAL SUBSTRUCTURE format is described in RFC section 3.3.1.
*
* @b Constructors:
* - proposal_substructure_create()
*
* @ingroup payloads
*/
struct proposal_substructure_t {
/**
@@ -57,150 +50,126 @@ struct proposal_substructure_t {
payload_t payload_interface;
/**
* @brief Creates an iterator of stored transform_substructure_t objects.
*
* @warning The created iterator has to get destroyed by the caller!
* When deleting any transform over this iterator, call
* get_size to make sure the length and number values are ok.
* Creates an iterator of stored transform_substructure_t objects.
*
* @param this calling proposal_substructure_t object
* @param forward iterator direction (TRUE: front to end)
* @return created iterator_t object
*/
iterator_t *(*create_transform_substructure_iterator) (proposal_substructure_t *this, bool forward);
iterator_t *(*create_transform_substructure_iterator) (
proposal_substructure_t *this, bool forward);
/**
* @brief Adds a transform_substructure_t object to this object.
*
* @warning The added transform_substructure_t object is
* getting destroyed in destroy function of proposal_substructure_t.
* Adds a transform_substructure_t object to this object.
*
* @param this calling proposal_substructure_t object
* @param transform transform_substructure_t object to add
* @param transform transform_substructure_t object to add
*/
void (*add_transform_substructure) (proposal_substructure_t *this,transform_substructure_t *transform);
void (*add_transform_substructure) (proposal_substructure_t *this,
transform_substructure_t *transform);
/**
* @brief Sets the proposal number of current proposal.
* Sets the proposal number of current proposal.
*
* @param this calling proposal_substructure_t object
* @param id proposal number to set
* @param id proposal number to set
*/
void (*set_proposal_number) (proposal_substructure_t *this,u_int8_t proposal_number);
void (*set_proposal_number) (proposal_substructure_t *this,
u_int8_t proposal_number);
/**
* @brief get proposal number of current proposal.
* get proposal number of current proposal.
*
* @param this calling proposal_substructure_t object
* @return proposal number of current proposal substructure.
*/
u_int8_t (*get_proposal_number) (proposal_substructure_t *this);
/**
* @brief get the number of transforms in current proposal.
* get the number of transforms in current proposal.
*
* @param this calling proposal_substructure_t object
* @return transform count in current proposal
*/
size_t (*get_transform_count) (proposal_substructure_t *this);
/**
* @brief get size of the set spi in bytes.
* get size of the set spi in bytes.
*
* @param this calling proposal_substructure_t object
* @return size of the spi in bytes
*/
size_t (*get_spi_size) (proposal_substructure_t *this);
/**
* @brief Sets the protocol id of current proposal.
* Sets the protocol id of current proposal.
*
* @param this calling proposal_substructure_t object
* @param id protocol id to set
* @param id protocol id to set
*/
void (*set_protocol_id) (proposal_substructure_t *this,u_int8_t protocol_id);
void (*set_protocol_id) (proposal_substructure_t *this,
u_int8_t protocol_id);
/**
* @brief get protocol id of current proposal.
* get protocol id of current proposal.
*
* @param this calling proposal_substructure_t object
* @return protocol id of current proposal substructure.
*/
u_int8_t (*get_protocol_id) (proposal_substructure_t *this);
/**
* @brief Sets the next_payload field of this substructure
* Sets the next_payload field of this substructure
*
* If this is the last proposal, next payload field is set to 0,
* otherwise to 2
*
* @param this calling proposal_substructure_t object
* @param is_last When TRUE, next payload field is set to 0, otherwise to 2
*/
void (*set_is_last_proposal) (proposal_substructure_t *this, bool is_last);
/**
* @brief Returns the currently set SPI of this proposal.
*
* @warning Returned data are not copied
*
* @param this calling proposal_substructure_t object
* @return chunk_t pointing to the value
* Returns the currently set SPI of this proposal.
*
* @return chunk_t pointing to the value
*/
chunk_t (*get_spi) (proposal_substructure_t *this);
/**
* @brief Sets the SPI of the current proposal.
* Sets the SPI of the current proposal.
*
* @warning SPI is getting copied
*
* @param this calling proposal_substructure_t object
* @param spi chunk_t pointing to the value to set
* @param spi chunk_t pointing to the value to set
*/
void (*set_spi) (proposal_substructure_t *this, chunk_t spi);
/**
* @brief Get a proposal_t from the propsal_substructure_t.
* Get a proposal_t from the propsal_substructure_t.
*
* @param this calling proposal_substructure_t object
* @return proposal_t
*/
proposal_t * (*get_proposal) (proposal_substructure_t *this);
/**
* @brief Clones an proposal_substructure_t object.
* Clones an proposal_substructure_t object.
*
* @param this proposal_substructure_t object to clone
* @return cloned object
*/
proposal_substructure_t* (*clone) (proposal_substructure_t *this);
/**
* @brief Destroys an proposal_substructure_t object.
*
* @param this proposal_substructure_t object to destroy
* Destroys an proposal_substructure_t object.
*/
void (*destroy) (proposal_substructure_t *this);
};
/**
* @brief Creates an empty proposal_substructure_t object
* Creates an empty proposal_substructure_t object
*
* @return proposal_substructure_t object
*
* @ingroup payloads
*/
proposal_substructure_t *proposal_substructure_create(void);
/**
* @brief Creates a proposal_substructure_t from a proposal_t.
* Creates a proposal_substructure_t from a proposal_t.
*
* @param proposal proposal to build a substruct out of it
* @return proposal_substructure_t object
*
* @ingroup payloads
*/
proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *proposal);
proposal_substructure_t *proposal_substructure_create_from_proposal(
proposal_t *proposal);
#endif /*PROPOSAL_SUBSTRUCTURE_H_*/
#endif /*PROPOSAL_SUBSTRUCTURE_H_ @} */
src/charon/encoding/payloads/sa_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file sa_payload.c
*
* @brief Implementation of sa_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/sa_payload.h
+26 -50
View File
@@ -1,10 +1,3 @@
/**
* @file sa_payload.h
*
* @brief Interface of sa_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup sa_payload sa_payload
* @{ @ingroup payloads
*/
#ifndef SA_PAYLOAD_H_
@@ -33,24 +33,13 @@ typedef struct sa_payload_t sa_payload_t;
/**
* SA_PAYLOAD length in bytes without any proposal substructure.
*
* @ingroup payloads
*/
#define SA_PAYLOAD_HEADER_LENGTH 4
/**
* @brief Class representing an IKEv2-SA Payload.
* Class representing an IKEv2-SA Payload.
*
* The SA Payload format is described in RFC section 3.3.
*
* @b Constructors:
* - sa_payload_create()
* - sa_payload_create_from_ike_proposals()
* - sa_payload_create_from_proposal()
*
* @todo Add support of algorithms without specified keylength in get_proposals and get_ike_proposals.
*
* @ingroup payloads
*/
struct sa_payload_t {
/**
@@ -59,83 +48,70 @@ struct sa_payload_t {
payload_t payload_interface;
/**
* @brief Creates an iterator of stored proposal_substructure_t objects.
* Creates an iterator of stored proposal_substructure_t objects.
*
* @warning The created iterator has to get destroyed by the caller!
*
* @warning When deleting an proposal using this iterator,
* the length of this transform substructure has to be refreshed
* by calling get_length()!
* When deleting an proposal using this iterator,
* the length of this transform substructure has to be refreshed
* by calling get_length()!
*
* @param this calling sa_payload_t object
* @param[in] forward iterator direction (TRUE: front to end)
* @return created iterator_t object
* @param forward iterator direction (TRUE: front to end)
* @return created iterator_t object
*/
iterator_t *(*create_proposal_substructure_iterator) (sa_payload_t *this, bool forward);
iterator_t *(*create_proposal_substructure_iterator) (sa_payload_t *this,
bool forward);
/**
* @brief Adds a proposal_substructure_t object to this object.
*
* @warning The added proposal_substructure_t object is
* getting destroyed in destroy function of sa_payload_t.
* Adds a proposal_substructure_t object to this object.
*
* @param this calling sa_payload_t object
* @param proposal proposal_substructure_t object to add
*/
void (*add_proposal_substructure) (sa_payload_t *this,proposal_substructure_t *proposal);
void (*add_proposal_substructure) (sa_payload_t *this,
proposal_substructure_t *proposal);
/**
* @brief Gets the proposals in this payload as a list.
* Gets the proposals in this payload as a list.
*
* @return a list containing proposal_t s
*/
linked_list_t *(*get_proposals) (sa_payload_t *this);
/**
* @brief Add a child proposal (AH/ESP) to the payload.
* Add a child proposal (AH/ESP) to the payload.
*
* @param proposal child proposal to add to the payload
*/
void (*add_proposal) (sa_payload_t *this, proposal_t *proposal);
/**
* @brief Destroys an sa_payload_t object.
*
* @param this sa_payload_t object to destroy
* Destroys an sa_payload_t object.
*/
void (*destroy) (sa_payload_t *this);
};
/**
* @brief Creates an empty sa_payload_t object
* Creates an empty sa_payload_t object
*
* @return created sa_payload_t object
*
* @ingroup payloads
*/
sa_payload_t *sa_payload_create(void);
/**
* @brief Creates a sa_payload_t object from a list of proposals.
* Creates a sa_payload_t object from a list of proposals.
*
* @param proposals list of proposals to build the payload from
* @return sa_payload_t object
*
* @ingroup payloads
*/
sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals);
/**
* @brief Creates a sa_payload_t object from a single proposal.
* Creates a sa_payload_t object from a single proposal.
*
* This is only for convenience. Use sa_payload_create_from_proposal_list
* if you want to add more than one proposal.
*
* @param proposal proposal from which the payload should be built.
* @return sa_payload_t object
*
* @ingroup payloads
*/
sa_payload_t *sa_payload_create_from_proposal(proposal_t *proposal);
#endif /*SA_PAYLOAD_H_*/
#endif /*SA_PAYLOAD_H_ @} */
src/charon/encoding/payloads/traffic_selector_substructure.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file traffic_selector_substructure.c
*
* @brief Interface of traffic_selector_substructure_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "traffic_selector_substructure.h"
src/charon/encoding/payloads/traffic_selector_substructure.h
+32 -51
View File
@@ -1,10 +1,3 @@
/**
* @file traffic_selector_substructure.h
*
* @brief Interface of traffic_selector_substructure_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,8 +12,14 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup traffic_selector_substructure traffic_selector_substructure
* @{ @ingroup payloads
*/
#ifndef TRAFFIC_SELECTOR_SUBSTRUCTURE_H_
#define TRAFFIC_SELECTOR_SUBSTRUCTURE_H_
@@ -34,21 +33,13 @@ typedef struct traffic_selector_substructure_t traffic_selector_substructure_t;
/**
* Length of a TRAFFIC SELECTOR SUBSTRUCTURE without start and end address.
*
* @ingroup payloads
*/
#define TRAFFIC_SELECTOR_HEADER_LENGTH 8
/**
* @brief Class representing an IKEv2 TRAFFIC SELECTOR.
* Class representing an IKEv2 TRAFFIC SELECTOR.
*
* The TRAFFIC SELECTOR format is described in RFC section 3.13.1.
*
* @b Constructors:
* - traffic_selector_substructure_create()
* - traffic_selector_substructure_create_from_traffic_selector()
*
* @ingroup payloads
*/
struct traffic_selector_substructure_t {
/**
@@ -57,116 +48,106 @@ struct traffic_selector_substructure_t {
payload_t payload_interface;
/**
* @brief Get the type of Traffic selector.
* Get the type of Traffic selector.
*
* @param this calling traffic_selector_substructure_t object
* @return type of traffic selector
*
*/
ts_type_t (*get_ts_type) (traffic_selector_substructure_t *this);
/**
* @brief Set the type of Traffic selector.
* Set the type of Traffic selector.
*
* @param this calling traffic_selector_substructure_t object
* @param ts_type type of traffic selector
*/
void (*set_ts_type) (traffic_selector_substructure_t *this,ts_type_t ts_type);
void (*set_ts_type) (traffic_selector_substructure_t *this,
ts_type_t ts_type);
/**
* @brief Get the IP protocol ID of Traffic selector.
* Get the IP protocol ID of Traffic selector.
*
* @param this calling traffic_selector_substructure_t object
* @return type of traffic selector
*
*/
u_int8_t (*get_protocol_id) (traffic_selector_substructure_t *this);
/**
* @brief Set the IP protocol ID of Traffic selector
* Set the IP protocol ID of Traffic selector
*
* @param this calling traffic_selector_substructure_t object
* @param protocol_id protocol ID of traffic selector
*/
void (*set_protocol_id) (traffic_selector_substructure_t *this,u_int8_t protocol_id);
void (*set_protocol_id) (traffic_selector_substructure_t *this,
u_int8_t protocol_id);
/**
* @brief Get the start port and address as host_t object.
* Get the start port and address as host_t object.
*
* Returned host_t object has to get destroyed by the caller.
*
* @param this calling traffic_selector_substructure_t object
* @return start host as host_t object
*
*/
host_t *(*get_start_host) (traffic_selector_substructure_t *this);
/**
* @brief Set the start port and address as host_t object.
* Set the start port and address as host_t object.
*
* @param this calling traffic_selector_substructure_t object
* @param start_host start host as host_t object
*/
void (*set_start_host) (traffic_selector_substructure_t *this,host_t *start_host);
void (*set_start_host) (traffic_selector_substructure_t *this,
host_t *start_host);
/**
* @brief Get the end port and address as host_t object.
* Get the end port and address as host_t object.
*
* Returned host_t object has to get destroyed by the caller.
*
* @param this calling traffic_selector_substructure_t object
* @return end host as host_t object
*
*/
host_t *(*get_end_host) (traffic_selector_substructure_t *this);
/**
* @brief Set the end port and address as host_t object.
* Set the end port and address as host_t object.
*
* @param this calling traffic_selector_substructure_t object
* @param end_host end host as host_t object
*/
void (*set_end_host) (traffic_selector_substructure_t *this,host_t *end_host);
void (*set_end_host) (traffic_selector_substructure_t *this,
host_t *end_host);
/**
* @brief Get a traffic_selector_t from this substructure.
* Get a traffic_selector_t from this substructure.
*
* @warning traffic_selector_t must be destroyed after usage.
*
* @param this calling traffic_selector_substructure_t object
* @return contained traffic_selector_t
*/
traffic_selector_t *(*get_traffic_selector) (traffic_selector_substructure_t *this);
traffic_selector_t *(*get_traffic_selector) (
traffic_selector_substructure_t *this);
/**
* @brief Destroys an traffic_selector_substructure_t object.
*
* @param this traffic_selector_substructure_t object to destroy
* Destroys an traffic_selector_substructure_t object.
*/
void (*destroy) (traffic_selector_substructure_t *this);
};
/**
* @brief Creates an empty traffic_selector_substructure_t object.
* Creates an empty traffic_selector_substructure_t object.
*
* TS type is set to default TS_IPV4_ADDR_RANGE!
*
* @return traffic_selector_substructure_t object
*
* @ingroup payloads
*/
traffic_selector_substructure_t *traffic_selector_substructure_create(void);
/**
* @brief Creates an initialized traffif selector substructure using
* Creates an initialized traffif selector substructure using
* the values from a traffic_selector_t.
*
* @param traffic_selector traffic_selector_t to use for initialization
* @return traffic_selector_substructure_t object
*
* @ingroup payloads
*/
traffic_selector_substructure_t *traffic_selector_substructure_create_from_traffic_selector(traffic_selector_t *traffic_selector);
traffic_selector_substructure_t *traffic_selector_substructure_create_from_traffic_selector(
traffic_selector_t *traffic_selector);
#endif /* /TRAFFIC_SELECTOR_SUBSTRUCTURE_H_ */
#endif /* /TRAFFIC_SELECTOR_SUBSTRUCTURE_H_ @} */
src/charon/encoding/payloads/transform_attribute.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file transform_attribute.c
*
* @brief Implementation of transform_attribute_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <string.h>
src/charon/encoding/payloads/transform_attribute.h
+22 -42
View File
@@ -1,10 +1,3 @@
/**
* @file transform_attribute.h
*
* @brief Interface of transform_attribute_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup transform_attribute transform_attribute
* @{ @ingroup payloads
*/
#ifndef TRANSFORM_ATTRIBUTE_H_
@@ -33,8 +33,6 @@ typedef struct transform_attribute_t transform_attribute_t;
/**
* Type of the attribute, as in IKEv2 RFC 3.3.5.
*
* @ingroup payloads
*/
enum transform_attribute_type_t {
ATTRIBUTE_UNDEFINED = 16384,
@@ -43,17 +41,13 @@ enum transform_attribute_type_t {
/**
* enum name for transform_attribute_type_t.
*
* @ingroup payloads
*/
extern enum_name_t *transform_attribute_type_names;
/**
* @brief Class representing an IKEv2- TRANSFORM Attribute.
* Class representing an IKEv2- TRANSFORM Attribute.
*
* The TRANSFORM ATTRIBUTE format is described in RFC section 3.3.5.
*
* @ingroup payloads
*/
struct transform_attribute_t {
/**
@@ -62,93 +56,79 @@ struct transform_attribute_t {
payload_t payload_interface;
/**
* @brief Returns the currently set value of the attribute.
* Returns the currently set value of the attribute.
*
* @warning Returned data are not copied.
* Returned data are not copied.
*
* @param this calling transform_attribute_t object
* @return chunk_t pointing to the value
*/
chunk_t (*get_value_chunk) (transform_attribute_t *this);
/**
* @brief Returns the currently set value of the attribute.
* Returns the currently set value of the attribute.
*
* @warning Returned data are not copied.
* Returned data are not copied.
*
* @param this calling transform_attribute_t object
* @return value
*/
u_int16_t (*get_value) (transform_attribute_t *this);
/**
* @brief Sets the value of the attribute.
* Sets the value of the attribute.
*
* @warning Value is getting copied.
* Value is getting copied.
*
* @param this calling transform_attribute_t object
* @param value chunk_t pointing to the value to set
*/
void (*set_value_chunk) (transform_attribute_t *this, chunk_t value);
/**
* @brief Sets the value of the attribute.
* Sets the value of the attribute.
*
* @param this calling transform_attribute_t object
* @param value value to set
*/
void (*set_value) (transform_attribute_t *this, u_int16_t value);
/**
* @brief Sets the type of the attribute.
* Sets the type of the attribute.
*
* @param this calling transform_attribute_t object
* @param type type to set (most significant bit is set to zero)
*/
void (*set_attribute_type) (transform_attribute_t *this, u_int16_t type);
/**
* @brief get the type of the attribute.
* get the type of the attribute.
*
* @param this calling transform_attribute_t object
* @return type of the value
*/
u_int16_t (*get_attribute_type) (transform_attribute_t *this);
/**
* @brief Clones an transform_attribute_t object.
* Clones an transform_attribute_t object.
*
* @param this transform_attribute_t object to clone
* @return cloned transform_attribute_t object
*/
transform_attribute_t * (*clone) (transform_attribute_t *this);
/**
* @brief Destroys an transform_attribute_t object.
*
* @param this transform_attribute_t object to destroy
* Destroys an transform_attribute_t object.
*/
void (*destroy) (transform_attribute_t *this);
};
/**
* @brief Creates an empty transform_attribute_t object.
* Creates an empty transform_attribute_t object.
*
* @return transform_attribute_t object
*
* @ingroup payloads
*/
transform_attribute_t *transform_attribute_create(void);
/**
* @brief Creates an transform_attribute_t of type KEY_LENGTH.
* Creates an transform_attribute_t of type KEY_LENGTH.
*
* @param key_length key length in bytes
* @return transform_attribute_t object
*
* @ingroup payloads
*/
transform_attribute_t *transform_attribute_create_key_length(u_int16_t key_length);
#endif /*TRANSFORM_ATTRIBUTE_H_*/
#endif /*TRANSFORM_ATTRIBUTE_H_ @} */
src/charon/encoding/payloads/transform_substructure.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file transform_substructure.h
*
* @brief Implementation of transform_substructure_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/transform_substructure.h
+39 -61
View File
@@ -1,10 +1,3 @@
/**
* @file transform_substructure.h
*
* @brief Interface of transform_substructure_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup transform_substructure transform_substructure
* @{ @ingroup payloads
*/
#ifndef TRANSFORM_SUBSTRUCTURE_H_
@@ -39,25 +39,19 @@ typedef struct transform_substructure_t transform_substructure_t;
/**
* IKEv1 Value for a transform payload.
*
* @ingroup payloads
*/
#define TRANSFORM_TYPE_VALUE 3
/**
* Length of the transform substructure header in bytes.
*
* @ingroup payloads
*/
#define TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH 8
/**
* @brief Class representing an IKEv2- TRANSFORM SUBSTRUCTURE.
* Class representing an IKEv2- TRANSFORM SUBSTRUCTURE.
*
* The TRANSFORM SUBSTRUCTURE format is described in RFC section 3.3.2.
*
* @ingroup payloads
*/
struct transform_substructure_t {
/**
@@ -66,121 +60,105 @@ struct transform_substructure_t {
payload_t payload_interface;
/**
* @brief Creates an iterator of stored transform_attribute_t objects.
* Creates an iterator of stored transform_attribute_t objects.
*
* @warning The created iterator has to get destroyed by the caller!
*
* @warning When deleting an transform attribute using this iterator,
* the length of this transform substructure has to be refreshed
* by calling get_length()!
* When deleting an transform attribute using this iterator,
* the length of this transform substructure has to be refreshed
* by calling get_length().
*
* @param this calling transform_substructure_t object
* @param[in] forward iterator direction (TRUE: front to end)
* @param forward iterator direction (TRUE: front to end)
* @return created iterator_t object.
*/
iterator_t * (*create_transform_attribute_iterator) (transform_substructure_t *this, bool forward);
iterator_t * (*create_transform_attribute_iterator) (
transform_substructure_t *this, bool forward);
/**
* @brief Adds a transform_attribute_t object to this object.
*
* @warning The added proposal_substructure_t object is
* getting destroyed in destroy function of transform_substructure_t.
* Adds a transform_attribute_t object to this object.
*
* @param this calling transform_substructure_t object
* @param proposal transform_attribute_t object to add
*/
void (*add_transform_attribute) (transform_substructure_t *this,transform_attribute_t *attribute);
void (*add_transform_attribute) (transform_substructure_t *this,
transform_attribute_t *attribute);
/**
* @brief Sets the next_payload field of this substructure
* Sets the next_payload field of this substructure
*
* If this is the last transform, next payload field is set to 0,
* otherwise to 3
*
* @param this calling transform_substructure_t object
* @param is_last When TRUE, next payload field is set to 0, otherwise to 3
*/
void (*set_is_last_transform) (transform_substructure_t *this, bool is_last);
/**
* @brief Checks if this is the last transform.
* Checks if this is the last transform.
*
* @param this calling transform_substructure_t object
* @return TRUE if this is the last Transform, FALSE otherwise
*/
bool (*get_is_last_transform) (transform_substructure_t *this);
/**
* @brief Sets transform type of the current transform substructure.
* Sets transform type of the current transform substructure.
*
* @param this calling transform_substructure_t object
* @param type type value to set
*/
void (*set_transform_type) (transform_substructure_t *this,u_int8_t type);
void (*set_transform_type) (transform_substructure_t *this, u_int8_t type);
/**
* @brief get transform type of the current transform.
* get transform type of the current transform.
*
* @param this calling transform_substructure_t object
* @return Transform type of current transform substructure.
*/
u_int8_t (*get_transform_type) (transform_substructure_t *this);
/**
* @brief Sets transform id of the current transform substructure.
* Sets transform id of the current transform substructure.
*
* @param this calling transform_substructure_t object
* @param id transform id to set
* @param id transform id to set
*/
void (*set_transform_id) (transform_substructure_t *this,u_int16_t id);
void (*set_transform_id) (transform_substructure_t *this, u_int16_t id);
/**
* @brief get transform id of the current transform.
* get transform id of the current transform.
*
* @param this calling transform_substructure_t object
* @return Transform id of current transform substructure.
*/
u_int16_t (*get_transform_id) (transform_substructure_t *this);
/**
* @brief get transform id of the current transform.
* get transform id of the current transform.
*
* @param this calling transform_substructure_t object
* @param key_length The key length is written to this location
* @param key_length The key length is written to this location
* @return
* - SUCCESS if a key length attribute is contained
* - FAILED if no key length attribute is part of this
* transform or key length uses more then 16 bit!
*/
status_t (*get_key_length) (transform_substructure_t *this,u_int16_t *key_length);
status_t (*get_key_length) (transform_substructure_t *this,
u_int16_t *key_length);
/**
* @brief Clones an transform_substructure_t object.
* Clones an transform_substructure_t object.
*
* @param this transform_substructure_t object to clone
* @return cloned transform_substructure_t object
*/
transform_substructure_t* (*clone) (transform_substructure_t *this);
/**
* @brief Destroys an transform_substructure_t object.
*
* @param this transform_substructure_t object to destroy
* Destroys an transform_substructure_t object.
*/
void (*destroy) (transform_substructure_t *this);
};
/**
* @brief Creates an empty transform_substructure_t object.
* Creates an empty transform_substructure_t object.
*
* @return created transform_substructure_t object
*
* @ingroup payloads
*/
transform_substructure_t *transform_substructure_create(void);
/**
* @brief Creates an empty transform_substructure_t object.
* Creates an empty transform_substructure_t object.
*
* The key length is used for the transport types ENCRYPTION_ALGORITHM,
* PSEUDO_RANDOM_FUNCTION, INTEGRITY_ALGORITHM. For all
@@ -190,9 +168,9 @@ transform_substructure_t *transform_substructure_create(void);
* @param transform_id transform id specifying the specific algorithm of a transform type
* @param key_length Key length for key lenght attribute
* @return transform_substructure_t object
*
* @ingroup payloads
*/
transform_substructure_t *transform_substructure_create_type(transform_type_t transform_type, u_int16_t transform_id, u_int16_t key_length);
transform_substructure_t *transform_substructure_create_type(
transform_type_t transform_type, u_int16_t transform_id,
u_int16_t key_length);
#endif /*TRANSFORM_SUBSTRUCTURE_H_*/
#endif /*TRANSFORM_SUBSTRUCTURE_H_ @} */
src/charon/encoding/payloads/ts_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file ts_payload.c
*
* @brief Implementation of ts_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/ts_payload.h
+27 -51
View File
@@ -1,10 +1,3 @@
/**
* @file ts_payload.h
*
* @brief Interface of ts_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup ts_payload ts_payload
* @{ @ingroup payloads
*/
@@ -35,22 +35,14 @@ typedef struct ts_payload_t ts_payload_t;
/**
* Length of a TS payload without the Traffic selectors.
*
* @ingroup payloads
*/
#define TS_PAYLOAD_HEADER_LENGTH 8
/**
* @brief Class representing an IKEv2 TS payload.
* Class representing an IKEv2 TS payload.
*
* The TS payload format is described in RFC section 3.13.
*
* @b Constructors:
* - ts_payload_create()
* - ts_payload_create_from_traffic_selectors()
*
* @ingroup payloads
*/
struct ts_payload_t {
/**
@@ -59,9 +51,8 @@ struct ts_payload_t {
payload_t payload_interface;
/**
* @brief Get the type of TSpayload (TSi or TSr).
* Get the type of TSpayload (TSi or TSr).
*
* @param this calling id_payload_t object
* @return
* - TRUE if this payload is of type TSi
* - FALSE if this payload is of type TSr
@@ -69,9 +60,8 @@ struct ts_payload_t {
bool (*get_initiator) (ts_payload_t *this);
/**
* @brief Set the type of TS payload (TSi or TSr).
* Set the type of TS payload (TSi or TSr).
*
* @param this calling id_payload_t object
* @param is_initiator
* - TRUE if this payload is of type TSi
* - FALSE if this payload is of type TSr
@@ -79,75 +69,61 @@ struct ts_payload_t {
void (*set_initiator) (ts_payload_t *this,bool is_initiator);
/**
* @brief Adds a traffic_selector_substructure_t object to this object.
*
* @warning The added traffic_selector_substructure_t object is
* getting destroyed in destroy function of ts_payload_t.
* Adds a traffic_selector_substructure_t object to this object.
*
* @param this calling ts_payload_t object
* @param traffic_selector traffic_selector_substructure_t object to add
*/
void (*add_traffic_selector_substructure) (ts_payload_t *this,traffic_selector_substructure_t *traffic_selector);
void (*add_traffic_selector_substructure) (ts_payload_t *this,
traffic_selector_substructure_t *traffic_selector);
/**
* @brief Creates an iterator of stored traffic_selector_substructure_t objects.
* Creates an iterator of stored traffic_selector_substructure_t objects.
*
* @warning The created iterator has to get destroyed by the caller!
*
* @warning When removing an traffic_selector_substructure_t object
* using this iterator, the length of this payload
* has to get refreshed by calling payload_t.get_length!
* When removing an traffic_selector_substructure_t object
* using this iterator, the length of this payload
* has to get refreshed by calling payload_t.get_length!
*
* @param this calling ts_payload_t object
* @param[in] forward iterator direction (TRUE: front to end)
* @param forward iterator direction (TRUE: front to end)
* @return created iterator_t object
*/
iterator_t *(*create_traffic_selector_substructure_iterator) (ts_payload_t *this, bool forward);
iterator_t *(*create_traffic_selector_substructure_iterator) (
ts_payload_t *this, bool forward);
/**
* @brief Get a list of nested traffic selectors as traffic_selector_t.
* Get a list of nested traffic selectors as traffic_selector_t.
*
* Resulting list and its traffic selectors must be destroyed after usage
*
* @param this calling ts_payload_t object
* @return list of traffic selectors
*/
linked_list_t *(*get_traffic_selectors) (ts_payload_t *this);
/**
* @brief Destroys an ts_payload_t object.
*
* @param this ts_payload_t object to destroy
* Destroys an ts_payload_t object.
*/
void (*destroy) (ts_payload_t *this);
};
/**
* @brief Creates an empty ts_payload_t object.
*
* Creates an empty ts_payload_t object.
*
* @param is_initiator
* - TRUE if this payload is of type TSi
* - FALSE if this payload is of type TSr
* @return ts_payload_t object
*
* @ingroup payloads
*/
ts_payload_t *ts_payload_create(bool is_initiator);
/**
* @brief Creates ts_payload with a list of traffic_selector_t
*
* Creates ts_payload with a list of traffic_selector_t
*
* @param is_initiator
* - TRUE if this payload is of type TSi
* - FALSE if this payload is of type TSr
* @param traffic_selectors list of traffic selectors to include
* @return ts_payload_t object
*
* @ingroup payloads
*/
ts_payload_t *ts_payload_create_from_traffic_selectors(bool is_initiator, linked_list_t *traffic_selectors);
ts_payload_t *ts_payload_create_from_traffic_selectors(bool is_initiator,
linked_list_t *traffic_selectors);
#endif /* TS_PAYLOAD_H_ */
#endif /* TS_PAYLOAD_H_ @} */
src/charon/encoding/payloads/unknown_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file unknown_payload.c
*
* @brief Implementation of unknown_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/unknown_payload.h
+13 -27
View File
@@ -1,10 +1,3 @@
/**
* @file unknown_payload.h
*
* @brief Interface of unknown_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup unknown_payload unknown_payload
* @{ @ingroup payloads
*/
#ifndef UNKNOWN_PAYLOAD_H_
@@ -31,22 +31,15 @@ typedef struct unknown_payload_t unknown_payload_t;
/**
* Header length of the unknown payload.
*
* @ingroup payloads
*/
#define UNKNOWN_PAYLOAD_HEADER_LENGTH 4
/**
* @brief Payload which can't be processed further.
* Payload which can't be processed further.
*
* When the parser finds an unknown payload, he builds an instance of
* this class. This allows further processing of this payload, such as
* a check for the critical bit in the header.
*
* @b Constructors:
* - unknown_payload_create()
*
* @ingroup payloads
*/
struct unknown_payload_t {
@@ -56,40 +49,33 @@ struct unknown_payload_t {
payload_t payload_interface;
/**
* @brief Get the raw data of this payload, without
* Get the raw data of this payload, without
* the generic payload header.
*
* Returned data are NOT copied and must not be freed.
*
* @param this calling unknown_payload_t object
* @return data as chunk_t
*/
chunk_t (*get_data) (unknown_payload_t *this);
/**
* @brief Get the critical flag.
* Get the critical flag.
*
* @param this calling unknown_payload_t object
* @return TRUE if payload is critical, FALSE if not
*/
bool (*is_critical) (unknown_payload_t *this);
/**
* @brief Destroys an unknown_payload_t object.
*
* @param this unknown_payload_t object to destroy
* Destroys an unknown_payload_t object.
*/
void (*destroy) (unknown_payload_t *this);
};
/**
* @brief Creates an empty unknown_payload_t object.
* Creates an empty unknown_payload_t object.
*
* @return unknown_payload_t object
*
* @ingroup payloads
*/
unknown_payload_t *unknown_payload_create(void);
#endif /* UNKNOWN_PAYLOAD_H_ */
#endif /* UNKNOWN_PAYLOAD_H_ @} */
src/charon/encoding/payloads/vendor_id_payload.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file vendor_id_payload.c
*
* @brief Implementation of vendor_id_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <stddef.h>
src/charon/encoding/payloads/vendor_id_payload.h
+14 -29
View File
@@ -1,10 +1,3 @@
/**
* @file vendor_id_payload.h
*
* @brief Interface of vendor_id_payload_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup vendor_id_payload vendor_id_payload
* @{ @ingroup payloads
*/
#ifndef VENDOR_ID_PAYLOAD_H_
@@ -31,21 +31,14 @@ typedef struct vendor_id_payload_t vendor_id_payload_t;
/**
* Length of a VENDOR ID payload without the VID data in bytes.
*
* @ingroup payloads
*/
#define VENDOR_ID_PAYLOAD_HEADER_LENGTH 4
/**
* @brief Class representing an IKEv2 VENDOR ID payload.
* Class representing an IKEv2 VENDOR ID payload.
*
* The VENDOR ID payload format is described in RFC section 3.12.
*
* @b Constructors:
* - vendor_id_payload_create()
*
* @ingroup payloads
*/
struct vendor_id_payload_t {
/**
@@ -54,51 +47,43 @@ struct vendor_id_payload_t {
payload_t payload_interface;
/**
* @brief Set the VID data.
* Set the VID data.
*
* Data are getting cloned.
*
* @param this calling vendor_id_payload_t object
* @param data VID data as chunk_t
*/
void (*set_data) (vendor_id_payload_t *this, chunk_t data);
/**
* @brief Get the VID data.
* Get the VID data.
*
* Returned data are a copy of the internal one.
*
* @param this calling vendor_id_payload_t object
* @return VID data as chunk_t
*/
chunk_t (*get_data_clone) (vendor_id_payload_t *this);
/**
* @brief Get the VID data.
* Get the VID data.
*
* Returned data are NOT copied.
*
* @param this calling vendor_id_payload_t object
* @return VID data as chunk_t
*/
chunk_t (*get_data) (vendor_id_payload_t *this);
/**
* @brief Destroys an vendor_id_payload_t object.
*
* @param this vendor_id_payload_t object to destroy
* Destroys an vendor_id_payload_t object.
*/
void (*destroy) (vendor_id_payload_t *this);
};
/**
* @brief Creates an empty vendor_id_payload_t object.
* Creates an empty vendor_id_payload_t object.
*
* @return vendor_id_payload_t object
*
* @ingroup payloads
*/
vendor_id_payload_t *vendor_id_payload_create(void);
#endif /* VENDOR_ID_PAYLOAD_H_ */
#endif /* VENDOR_ID_PAYLOAD_H_ @} */
src/charon/kernel/kernel_interface.c
+2 -7
View File
@@ -1,10 +1,3 @@
/**
* @file kernel_interface.c
*
* @brief Implementation of kernel_interface_t.
*
*/
/*
* Copyright (C) 2005-2007 Martin Willi
* Copyright (C) 2006-2007 Tobias Brunner
@@ -25,6 +18,8 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include <sys/types.h>
src/charon/kernel/kernel_interface.h
+36 -80
View File
@@ -1,10 +1,3 @@
/**
* @file kernel_interface.h
*
* @brief Interface of kernel_interface_t.
*
*/
/*
* Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
* Copyright (C) 2005-2006 Martin Willi
@@ -20,6 +13,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup kernel_interface kernel_interface
* @{ @ingroup kernel
*/
#ifndef KERNEL_INTERFACE_H_
@@ -37,8 +37,6 @@ typedef struct kernel_interface_t kernel_interface_t;
* Direction of a policy. These are equal to those
* defined in xfrm.h, but we want to stay implementation
* neutral here.
*
* @ingroup kernel
*/
enum policy_dir_t {
/** Policy for inbound traffic */
@@ -50,7 +48,7 @@ enum policy_dir_t {
};
/**
* @brief Interface to the kernel.
* Interface to the kernel.
*
* The kernel interface handles the communication with the kernel
* for SA and policy management. It allows setup of these, and provides
@@ -59,36 +57,28 @@ enum policy_dir_t {
* reference counting. The Linux kernel does not allow the same policy
* installed twice, but we need this as CHILD_SA exist multiple times
* when rekeying. Thats why we do reference counting of policies.
*
* @b Constructors:
* - kernel_interface_create()
*
* @ingroup kernel
*/
struct kernel_interface_t {
/**
* @brief Get a SPI from the kernel.
* Get a SPI from the kernel.
*
* @warning get_spi() implicitely creates an SA with
* the allocated SPI, therefore the replace flag
* in add_sa() must be set when installing this SA.
*
* @param this calling object
* @param src source address of SA
* @param dst destination address of SA
* @param protocol protocol for SA (ESP/AH)
* @param reqid unique ID for this SA
* @param[out] spi allocated spi
* @return
* - SUCCESS
* - FAILED if kernel comm failed
* @param spi allocated spi
* @return SUCCESS if operation completed
*/
status_t (*get_spi)(kernel_interface_t *this, host_t *src, host_t *dst,
protocol_id_t protocol, u_int32_t reqid, u_int32_t *spi);
/**
* @brief Add an SA to the SAD.
* Add an SA to the SAD.
*
* add_sa() may update an already allocated
* SPI (via get_spi). In this case, the replace
@@ -98,7 +88,6 @@ struct kernel_interface_t {
* gets the keys itself from the PRF, as we don't know
* his algorithms and key sizes.
*
* @param this calling object
* @param src source address for this SA
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
@@ -112,9 +101,7 @@ struct kernel_interface_t {
* @param mode mode of the SA (tunnel, transport)
* @param encap enable UDP encapsulation for NAT traversal
* @param replace Should an already installed SA be updated?
* @return
* - SUCCESS
* - FAILED if kernel comm failed
* @return SUCCESS if operation completed
*/
status_t (*add_sa) (kernel_interface_t *this,
host_t *src, host_t *dst, u_int32_t spi,
@@ -125,14 +112,13 @@ struct kernel_interface_t {
bool update);
/**
* @brief Update the hosts on an installed SA.
* Update the hosts on an installed SA.
*
* We cannot directly update the destination address as the kernel
* requires the spi, the protocol AND the destination address (and family)
* to identify SAs. Therefore if the destination address changed we
* create a new SA and delete the old one.
*
* @param this calling object
* @param spi SPI of the SA
* @param protocol protocol for this SA (ESP/AH)
* @param src current source address
@@ -140,9 +126,7 @@ struct kernel_interface_t {
* @param new_src new source address
* @param new_dst new destination address
* @param encap use UDP encapsulation
* @return
* - SUCCESS
* - FAILED if kernel comm failed
* @return SUCCESS if operation completed
*/
status_t (*update_sa)(kernel_interface_t *this,
u_int32_t spi, protocol_id_t protocol,
@@ -150,44 +134,37 @@ struct kernel_interface_t {
host_t *new_src, host_t *new_dst, bool encap);
/**
* @brief Query the use time of an SA.
* Query the use time of an SA.
*
* The use time of an SA is not the time of the last usage, but
* the time of the first usage of the SA.
*
* @param this calling object
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
* @param protocol protocol for this SA (ESP/AH)
* @param[out] use_time the time of this SA's last use
* @return
* - SUCCESS
* - FAILED if kernel comm failed
* @param use_time pointer receives the time of this SA's last use
* @return SUCCESS if operation completed
*/
status_t (*query_sa) (kernel_interface_t *this, host_t *dst, u_int32_t spi,
protocol_id_t protocol, u_int32_t *use_time);
/**
* @brief Delete a previusly installed SA from the SAD.
* Delete a previusly installed SA from the SAD.
*
* @param this calling object
* @param dst destination address for this SA
* @param spi SPI allocated by us or remote peer
* @param protocol protocol for this SA (ESP/AH)
* @return
* - SUCCESS
* - FAILED if kernel comm failed
* @return SUCCESS if operation completed
*/
status_t (*del_sa) (kernel_interface_t *this, host_t *dst, u_int32_t spi,
protocol_id_t protocol);
/**
* @brief Add a policy to the SPD.
* Add a policy to the SPD.
*
* A policy is always associated to an SA. Traffic which matches a
* policy is handled by the SA with the same reqid.
*
* @param this calling object
* @param src source address of SA
* @param dst dest address of SA
* @param src_ts traffic selector to match traffic source
@@ -197,9 +174,7 @@ struct kernel_interface_t {
* @param reqid uniqe ID of an SA to use to enforce policy
* @param high_prio if TRUE, uses a higher priority than any with FALSE
* @param mode mode of SA (tunnel, transport)
* @return
* - SUCCESS
* - FAILED if kernel comm failed
* @return SUCCESS if operation completed
*/
status_t (*add_policy) (kernel_interface_t *this,
host_t *src, host_t *dst,
@@ -209,19 +184,16 @@ struct kernel_interface_t {
u_int32_t reqid, bool high_prio, mode_t mode);
/**
* @brief Query the use time of a policy.
* Query the use time of a policy.
*
* The use time of a policy is the time the policy was used
* for the last time.
*
* @param this calling object
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @param[out] use_time the time of this SA's last use
* @return
* - SUCCESS
* - FAILED if kernel comm failed
* @return SUCCESS if operation completed
*/
status_t (*query_policy) (kernel_interface_t *this,
traffic_selector_t *src_ts,
@@ -229,20 +201,17 @@ struct kernel_interface_t {
policy_dir_t direction, u_int32_t *use_time);
/**
* @brief Remove a policy from the SPD.
* Remove a policy from the SPD.
*
* The kernel interface implements reference counting for policies.
* If the same policy is installed multiple times (in the case of rekeying),
* the reference counter is increased. del_policy() decreases the ref counter
* and removes the policy only when no more references are available.
*
* @param this calling object
* @param src_ts traffic selector to match traffic source
* @param dst_ts traffic selector to match traffic dest
* @param direction direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
* @return
* - SUCCESS
* - FAILED if kernel comm failed
* @return SUCCESS if operation completed
*/
status_t (*del_policy) (kernel_interface_t *this,
traffic_selector_t *src_ts,
@@ -250,82 +219,69 @@ struct kernel_interface_t {
policy_dir_t direction);
/**
* @brief Get our outgoing source address for a destination.
* Get our outgoing source address for a destination.
*
* Does a route lookup to get the source address used to reach dest.
* The returned host is allocated and must be destroyed.
*
* @param this calling object
* @param dest target destination address
* @return outgoing source address, NULL if unreachable
*/
host_t* (*get_source_addr)(kernel_interface_t *this, host_t *dest);
/**
* @brief Get the interface name of a local address.
* Get the interface name of a local address.
*
* @param this calling object
* @param host address to get interface name from
* @return allocated interface name, or NULL if not found
*/
char* (*get_interface) (kernel_interface_t *this, host_t *host);
/**
* @brief Creates an iterator over all local addresses.
* Creates an iterator over all local addresses.
*
* This function blocks an internal cached address list until the
* iterator gets destroyed.
* These hosts are read-only, do not modify or free.
*
* @param this calling object
* @return iterator over host_t's
*/
iterator_t *(*create_address_iterator) (kernel_interface_t *this);
/**
* @brief Add a virtual IP to an interface.
* Add a virtual IP to an interface.
*
* Virtual IPs are attached to an interface. If an IP is added multiple
* times, the IP is refcounted and not removed until del_ip() was called
* as many times as add_ip().
* The virtual IP is attached to the interface where the iface_ip is found.
*
* @param this calling object
* @param virtual_ip virtual ip address to assign
* @param iface_ip IP of an interface to attach virtual IP
* @return
* - SUCCESS
* - FAILED if kernel comm failed
* @return SUCCESS if operation completed
*/
status_t (*add_ip) (kernel_interface_t *this, host_t *virtual_ip,
host_t *iface_ip);
/**
* @brief Remove a virtual IP from an interface.
* Remove a virtual IP from an interface.
*
* The kernel interface uses refcounting, see add_ip().
*
* @param this calling object
* @param virtual_ip virtual ip address to assign
* @return
* - SUCCESS
* - FAILED if kernel comm failed
* @return SUCCESS if operation completed
*/
status_t (*del_ip) (kernel_interface_t *this, host_t *virtual_ip);
/**
* @brief Destroys a kernel_interface object.
*
* @param kernel_interface_t calling object
* Destroys a kernel_interface object.
*/
void (*destroy) (kernel_interface_t *kernel_interface);
};
/**
* @brief Creates an object of type kernel_interface_t.
*
* @ingroup kernel
* Creates an object of type kernel_interface_t.
*/
kernel_interface_t *kernel_interface_create(void);
#endif /*KERNEL_INTERFACE_H_*/
#endif /*KERNEL_INTERFACE_H_ @} */
src/charon/network/packet.c
+2 -9
View File
@@ -1,10 +1,3 @@
/**
* @file packet.c
*
* @brief Implementation of packet_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,12 +12,12 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "packet.h"
typedef struct private_packet_t private_packet_t;
/**
src/charon/network/packet.h
+19 -36
View File
@@ -1,10 +1,3 @@
/**
* @file packet.h
*
* @brief Interface of packet_t.
*
*/
/*
* Copyright (C) 2005-2006 Martin Willi
* Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
/**
* @defgroup packet packet
* @{ @ingroup network
*/
#ifndef PACKET_H_
@@ -30,105 +30,88 @@ typedef struct packet_t packet_t;
#include <utils/host.h>
/**
* @brief Abstraction of an UDP-Packet, contains data, sender and receiver.
*
* @b Constructors:
* - packet_create()
*
* @ingroup network
* Abstraction of an UDP-Packet, contains data, sender and receiver.
*/
struct packet_t {
/**
* @brief Set the source address.
* Set the source address.
*
* Set host_t is now owned by packet_t, it will destroy
* it if necessary.
*
* @param this calling object
* @param source address to set as source
*/
void (*set_source) (packet_t *packet, host_t *source);
/**
* @brief Set the destination address.
* Set the destination address.
*
* Set host_t is now owned by packet_t, it will destroy
* it if necessary.
*
* @param this calling object
* @param source address to set as destination
*/
void (*set_destination) (packet_t *packet, host_t *destination);
/**
* @brief Get the source address.
* Get the source address.
*
* Set host_t is still owned by packet_t, clone it
* if needed.
*
* @param this calling object
* @return source address
*/
host_t *(*get_source) (packet_t *packet);
/**
* @brief Get the destination address.
* Get the destination address.
*
* Set host_t is still owned by packet_t, clone it
* if needed.
*
* @param this calling object
* @return destination address
*/
host_t *(*get_destination) (packet_t *packet);
/**
* @brief Get the data from the packet.
* Get the data from the packet.
*
* The data pointed by the chunk is still owned
* by the packet. Clone it if needed.
*
* @param this calling object
* @return chunk containing the data
*/
chunk_t (*get_data) (packet_t *packet);
/**
* @brief Set the data in the packet.
* Set the data in the packet.
*
* Supplied chunk data is now owned by the
* packet. It will free it.
*
* @param this calling object
* @param data chunk with data to set
*/
void (*set_data) (packet_t *packet, chunk_t data);
/**
* @brief Clones a packet_t object.
* Clones a packet_t object.
*
* @param packet calling object
* @param clone pointer to a packet_t object pointer where the new object is stored
* @param clone clone of the packet
*/
packet_t* (*clone) (packet_t *packet);
/**
* @brief Destroy the packet, freeing contained data.
*
* @param packet packet to destroy
* Destroy the packet, freeing contained data.
*/
void (*destroy) (packet_t *packet);
};
/**
* @brief create an empty packet
* create an empty packet
*
* @return packet_t object
*
* @ingroup network
*/
packet_t *packet_create(void);
#endif /*PACKET_H_*/
#endif /*PACKET_H_ @} */

Some files were not shown because too many files have changed in this diff Show More