ha: Add auth method for HA IKEv1 key derivation

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>

diff --git a/src/libcharon/bus/bus.c b/src/libcharon/bus/bus.c
index f4c01c22e680b475b07bdac1c88d4641da7ca235..b7348f0f93e399c41015ef5a6e5463f3746a9458 100644 (file)
--- a/src/libcharon/bus/bus.c
+++ b/src/libcharon/bus/bus.c
@@ -575,7 +575,7 @@ METHOD(bus_t, message, void,
 METHOD(bus_t, ike_keys, void,
        private_bus_t *this, ike_sa_t *ike_sa, diffie_hellman_t *dh,
        chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r,
-       ike_sa_t *rekey, shared_key_t *shared)
+       ike_sa_t *rekey, shared_key_t *shared, auth_method_t method)
 {
        enumerator_t *enumerator;
        entry_t *entry;
@@ -591,7 +591,8 @@ METHOD(bus_t, ike_keys, void,
                }
                entry->calling++;
                keep = entry->listener->ike_keys(entry->listener, ike_sa, dh, dh_other,
-                                                                                nonce_i, nonce_r, rekey, shared);
+                                                                                nonce_i, nonce_r, rekey, shared,
+                                                                                method);
                entry->calling--;
                if (!keep)
                {

diff --git a/src/libcharon/bus/bus.h b/src/libcharon/bus/bus.h
index df75683be079d9c46d14885284fa5bbbb628ebb2..8a97e8dfc7db487a67d85319542c5969b7f214a8 100644 (file)
--- a/src/libcharon/bus/bus.h
+++ b/src/libcharon/bus/bus.h
@@ -353,10 +353,12 @@ struct bus_t {
         * @param nonce_r       responder's nonce
         * @param rekey         IKE_SA we are rekeying, if any (IKEv2 only)
         * @param shared        shared key used for key derivation (IKEv1-PSK only)
+        * @param method        auth method for key derivation (IKEv1-non-PSK only)
         */
        void (*ike_keys)(bus_t *this, ike_sa_t *ike_sa, diffie_hellman_t *dh,
                                         chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r,
-                                        ike_sa_t *rekey, shared_key_t *shared);
+                                        ike_sa_t *rekey, shared_key_t *shared,
+                                        auth_method_t method);
 
        /**
         * IKE_SA derived keys hook.

diff --git a/src/libcharon/bus/listeners/listener.h b/src/libcharon/bus/listeners/listener.h
index 06057eb73fd2cbf08c8e44a260b4522991805300..0f3b8578a850ee37acf4a89a64b55224d0465b69 100644 (file)
--- a/src/libcharon/bus/listeners/listener.h
+++ b/src/libcharon/bus/listeners/listener.h
@@ -88,11 +88,13 @@ struct listener_t {
         * @param nonce_r       responder's nonce
         * @param rekey         IKE_SA we are rekeying, if any (IKEv2 only)
         * @param shared        shared key used for key derivation (IKEv1-PSK only)
+        * @param method        auth method for key derivation (IKEv1-non-PSK only)
         * @return                      TRUE to stay registered, FALSE to unregister
         */
        bool (*ike_keys)(listener_t *this, ike_sa_t *ike_sa, diffie_hellman_t *dh,
                                         chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r,
-                                        ike_sa_t *rekey, shared_key_t *shared);
+                                        ike_sa_t *rekey, shared_key_t *shared,
+                                        auth_method_t method);
 
        /**
         * Hook called with derived IKE_SA keys.

diff --git a/src/libcharon/plugins/ha/ha_dispatcher.c b/src/libcharon/plugins/ha/ha_dispatcher.c
index 4e380389291e12d930107b39288a7253a2ea364f..ab845317fdc46413e8ea7ad7981f89212e634622 100644 (file)
--- a/src/libcharon/plugins/ha/ha_dispatcher.c
+++ b/src/libcharon/plugins/ha/ha_dispatcher.c
@@ -138,6 +138,7 @@ static void process_ike_add(private_ha_dispatcher_t *this, ha_message_t *message
        chunk_t dh_local = chunk_empty, dh_remote = chunk_empty, psk = chunk_empty;
        host_t *other = NULL;
        bool ok = FALSE;
+       auth_method_t method = AUTH_RSA;
 
        enumerator = message->create_attribute_enumerator(message);
        while (enumerator->enumerate(enumerator, &attribute, &value))
@@ -197,6 +198,8 @@ static void process_ike_add(private_ha_dispatcher_t *this, ha_message_t *message
                        case HA_ALG_DH:
                                dh_grp = value.u16;
                                break;
+                       case HA_AUTH_METHOD:
+                               method = value.u16;
                        default:
                                break;
                }
@@ -238,7 +241,6 @@ static void process_ike_add(private_ha_dispatcher_t *this, ha_message_t *message
                {
                        keymat_v1_t *keymat_v1 = (keymat_v1_t*)ike_sa->get_keymat(ike_sa);
                        shared_key_t *shared = NULL;
-                       auth_method_t method = AUTH_RSA;
 
                        if (psk.len)
                        {

diff --git a/src/libcharon/plugins/ha/ha_ike.c b/src/libcharon/plugins/ha/ha_ike.c
index 2854ab76d7d6a8d12cf5e542bdc7cfde805e970d..aae402d5054bb2ea1d7f7acf386c8e3a1b148339 100644 (file)
--- a/src/libcharon/plugins/ha/ha_ike.c
+++ b/src/libcharon/plugins/ha/ha_ike.c
@@ -73,7 +73,7 @@ static ike_extension_t copy_extension(ike_sa_t *ike_sa, ike_extension_t ext)
 METHOD(listener_t, ike_keys, bool,
        private_ha_ike_t *this, ike_sa_t *ike_sa, diffie_hellman_t *dh,
        chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r, ike_sa_t *rekey,
-       shared_key_t *shared)
+       shared_key_t *shared, auth_method_t method)
 {
        ha_message_t *m;
        chunk_t secret;
@@ -141,6 +141,10 @@ METHOD(listener_t, ike_keys, bool,
                {
                        m->add_attribute(m, HA_PSK, shared->get_key(shared));
                }
+               else
+               {
+                       m->add_attribute(m, HA_AUTH_METHOD, method);
+               }
        }
        m->add_attribute(m, HA_REMOTE_ADDR, ike_sa->get_other_host(ike_sa));
 

diff --git a/src/libcharon/plugins/ha/ha_message.c b/src/libcharon/plugins/ha/ha_message.c
index 7891b165428e9bde2e3ad823c5546e13e48fe2d7..28b7b0d5bab0478eb29f05c8f54f1a8c0436c772 100644 (file)
--- a/src/libcharon/plugins/ha/ha_message.c
+++ b/src/libcharon/plugins/ha/ha_message.c
@@ -240,6 +240,7 @@ METHOD(ha_message_t, add_attribute, void,
                case HA_OUTBOUND_CPI:
                case HA_SEGMENT:
                case HA_ESN:
+               case HA_AUTH_METHOD:
                {
                        uint16_t val;
 
@@ -463,6 +464,7 @@ METHOD(enumerator_t, attribute_enumerate, bool,
                case HA_OUTBOUND_CPI:
                case HA_SEGMENT:
                case HA_ESN:
+               case HA_AUTH_METHOD:
                {
                        if (this->buf.len < sizeof(uint16_t))
                        {

diff --git a/src/libcharon/plugins/ha/ha_message.h b/src/libcharon/plugins/ha/ha_message.h
index 3e43dc8dc2053c231db9859b1cb26382b760ecf5..3c0058d99158f605d58ec26ac61e261eefd8c8c1 100644 (file)
--- a/src/libcharon/plugins/ha/ha_message.h
+++ b/src/libcharon/plugins/ha/ha_message.h
@@ -156,6 +156,8 @@ enum ha_message_attribute_t {
        HA_PSK,
        /** chunk_t, IV for next IKEv1 message */
        HA_IV,
+       /** uint16_t, auth_method_t for IKEv1 key derivation */
+       HA_AUTH_METHOD,
 };
 
 /**

diff --git a/src/libcharon/sa/ikev1/phase1.c b/src/libcharon/sa/ikev1/phase1.c
index b99d75142fe285e8da00d33ad38ff854fe4fff7f..ac2899f113c21879c3b8f966ea6bec0893603e8e 100644 (file)
--- a/src/libcharon/sa/ikev1/phase1.c
+++ b/src/libcharon/sa/ikev1/phase1.c
@@ -251,7 +251,8 @@ METHOD(phase1_t, derive_keys, bool,
                return FALSE;
        }
        charon->bus->ike_keys(charon->bus, this->ike_sa, this->dh, this->dh_value,
-                                                 this->nonce_i, this->nonce_r, NULL, shared_key);
+                                                 this->nonce_i, this->nonce_r, NULL, shared_key,
+                                                 method);
        DESTROY_IF(shared_key);
        return TRUE;
 }

diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c
index 307d99264267afefdffbb9db3be7370e1ad25118..b5086182b459db81b7a53df35218ec46543cd611 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/ike_init.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_init.c
@@ -773,7 +773,7 @@ static bool derive_keys(private_ike_init_t *this,
                return FALSE;
        }
        charon->bus->ike_keys(charon->bus, this->ike_sa, this->dh, chunk_empty,
-                                                 nonce_i, nonce_r, this->old_sa, NULL);
+                                                 nonce_i, nonce_r, this->old_sa, NULL, AUTH_NONE);
        return TRUE;
 }