[strongSwan-dev] new notify message
Jan Willem Beusink
jan.willem.beusink at ti-wmc.nl
Fri Apr 9 17:34:46 CEST 2010
Martin Willi wrote:
> Hi,
>
>> add ME_AUTHORIZATION_FAILED = 8193 in the notify_payload.h file
>
>> understanding the notify_payload.c file. More specifically I
>> can't make any sense of the enumerations...
>
> If you change the enum in a header file, you'll have to update the
> enum-to-string mappings in the corresponding .c file, too.
>
> These macros create several structs with strings to map enums to
> strings. The notify types enumeration is probably the most complex
> incarnation of this struct, my apologies.
>
> Have a look at the src/libstrongswan/enum.h header, it explains in
> detail how these macros work.
>
> Regards
> Martin
>
>
The enum header helped a lot :) thanks!
I was wondering though if the ME in ME_CONNECT_FAILED has special
meaning. I assumed it was for referring to adding a private
implementation (ME as in me, self). Yet after seeing it more often,
e.g.,"ME_MEDIATION","ME_ENDPOINT","ME_CALLBACK","ME_CONNECTID",ME_CONNECTKEY","ME_CONNECTAUTH","ME_RESPONSE",
I got the impression it might have an other meaning.
Daniel Palomares wrote:
> I took this from my internal WiKi. Hope it helps you!
>
>
> Let's suppose the new payload is called |NEW_PAYLOAD|.
>
> Files to be changed:
>
> *
> |notify_payload.h| at //scr/charon/encodings/payload//
>
> It has the list of notify messages types. So, it is needed to add
> |NEW_PAYLOAD| to the |enum{}| list (|i.e.| |MOBIKE_SUPPORTED| = 16396
> and it must be between 16397 and 16395). It means also that depending on
> the value of the notify, its location is defined on the list |enum
> notify_type_t{}|. It is VERY important to understand that this list is
> the base to build all messages of IKEv2, including its extensions (see )
>
> /**
> * Notify message types.
> *
> * See IKEv2 RFC 3.10.1.
> */
> enum notify_type_t {
> /* notify error messages */
> UNSUPPORTED_CRITICAL_PAYLOAD = 1,
> INVALID_IKE_SPI = 4,
> INVALID_MAJOR_VERSION = 5,
> INVALID_SYNTAX = 7,
> INVALID_MESSAGE_ID = 9,
> INVALID_SPI = 11,
> NO_PROPOSAL_CHOSEN = 14,
> INVALID_KE_PAYLOAD = 17,
> AUTHENTICATION_FAILED = 24,
> SINGLE_PAIR_REQUIRED = 34,
> NO_ADDITIONAL_SAS = 35,
> INTERNAL_ADDRESS_FAILURE = 36,
> FAILED_CP_REQUIRED = 37,
> TS_UNACCEPTABLE = 38,
> INVALID_SELECTORS = 39,
> UNACCEPTABLE_ADDRESSES = 40,
> UNEXPECTED_NAT_DETECTED = 41,
> /* IKE-ME, private use */
> ME_CONNECT_FAILED = 8192,
> /* MOBIKE-eXtended Messages */
> MOBIKE_UNSUPPORTED_VERSION = 8193, <---------- i.e. This Notify was added.
>
> /* notify status messages */
> INITIAL_CONTACT = 16384,
> SET_WINDOW_SIZE = 16385,
> ADDITIONAL_TS_POSSIBLE = 16386,
> IPCOMP_SUPPORTED = 16387,
> NAT_DETECTION_SOURCE_IP = 16388,
> NAT_DETECTION_DESTINATION_IP = 16389,
> COOKIE = 16390,
> USE_TRANSPORT_MODE = 16391,
> HTTP_CERT_LOOKUP_SUPPORTED = 16392,
> REKEY_SA = 16393,
> ESP_TFC_PADDING_NOT_SUPPORTED = 16394,
> NON_FIRST_FRAGMENTS_ALSO = 16395,
> /* mobike extension, RFC4555 */
> MOBIKE_SUPPORTED = 16396,
> ADDITIONAL_IP4_ADDRESS = 16397,
> ADDITIONAL_IP6_ADDRESS = 16398,
> NO_ADDITIONAL_ADDRESSES = 16399,
> UPDATE_SA_ADDRESSES = 16400,
> COOKIE2 = 16401,
> NO_NATS_ALLOWED = 16402,
> /* repeated authentication extension, RFC4478 */
> AUTH_LIFETIME = 16403,
> /* multiple authentication exchanges, RFC 4739 */
> MULTIPLE_AUTH_SUPPORTED = 16404,
> ANOTHER_AUTH_FOLLOWS = 16405,
> /* draft-eronen-ipsec-ikev2-eap-auth, not assigned by IANA yet */
> EAP_ONLY_AUTHENTICATION = 40960,
> /* BEET mode, not even a draft yet. private use */
> USE_BEET_MODE = 40961,
> /* IKE-ME, private use */
> ME_MEDIATION = 40962,
> ME_ENDPOINT = 40963,
> ME_CALLBACK = 40964,
> ME_CONNECTID = 40965,
> ME_CONNECTKEY = 40966,
> ME_CONNECTAUTH = 40967,
> ME_RESPONSE = 40968,
>
> };
>
> *
> |notify_payload.c| at //scr/charon/encodings/payload//
>
> Before knowing how to modify |notify_payload.c|, first it is mandatory
> to know how enum's are represented in the code. The following structure
> is located at //src/libstrongswan/enum.h/ :
>
> /**
> * Struct to store names for enums.
> *
> * To print the string representation of enumeration values, the strings
> * are stored in these structures. Every enum_name contains a range
> * of strings, multiple ranges are linked together.
> * Use the convenience macros to define these linked ranges.
> *
> * For a single range, use:
> * @code
> ENUM(name, first, last, string1, string2, ...)
> @endcode
> * For multiple linked ranges, use:
> * @code
> ENUM_BEGIN(name, first, last, string1, string2, ...)
> ENUM_NEXT(name, first, last, last_from_previous, string3, ...)
> ENUM_NEXT(name, first, last, last_from_previous, string4, ...)
> ENUM_END(name, last_from_previous)
> @endcode
> * The ENUM and the ENUM_END define a enum_name_t pointer with the name supplied
> * in "name".
> *
> * Resolving of enum names is done using a printf hook. A printf fromat
> * character %N is replaced by the enum string. Printf needs two arguments to
> * resolve a %N, the enum_name_t* (the defined name in ENUM_BEGIN) followed
> * by the numerical enum value.
> */
> struct enum_name_t {
> /** value of the first enum string */
> int first;
> /** value of the last enum string */
> int last;
> /** next enum_name_t in list */
> enum_name_t *next;
> /** array of strings containing names from first to last */
> char *names[];
> };
>
> As the |NEW_PAYLOAD| must be defined inside the enum list of IKEv2
> notify messages, it should be added in |notify_payload.c| in order to be
> displayed as a string somewhere and whenever is needed.
>
> ENUM_BEGIN(notify_type_names, UNSUPPORTED_CRITICAL_PAYLOAD, UNSUPPORTED_CRITICAL_PAYLOAD,
> "UNSUPPORTED_CRITICAL_PAYLOAD");
> ENUM_NEXT(notify_type_names, INVALID_IKE_SPI, INVALID_MAJOR_VERSION, UNSUPPORTED_CRITICAL_PAYLOAD,
> "INVALID_IKE_SPI",
> "INVALID_MAJOR_VERSION");
> ENUM_NEXT(notify_type_names, INVALID_SYNTAX, INVALID_SYNTAX, INVALID_MAJOR_VERSION,
> "INVALID_SYNTAX");
> ENUM_NEXT(notify_type_names, INVALID_MESSAGE_ID, INVALID_MESSAGE_ID, INVALID_SYNTAX,
> "INVALID_MESSAGE_ID");
> ENUM_NEXT(notify_type_names, INVALID_SPI, INVALID_SPI, INVALID_MESSAGE_ID,
> "INVALID_SPI");
> ENUM_NEXT(notify_type_names, NO_PROPOSAL_CHOSEN, NO_PROPOSAL_CHOSEN, INVALID_SPI,
> "NO_PROPOSAL_CHOSEN");
> ENUM_NEXT(notify_type_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL_CHOSEN,
> "INVALID_KE_PAYLOAD");
> ENUM_NEXT(notify_type_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
> "AUTHENTICATION_FAILED");
> ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, UNEXPECTED_NAT_DETECTED, AUTHENTICATION_FAILED,
> "SINGLE_PAIR_REQUIRED",
> "NO_ADDITIONAL_SAS",
> "INTERNAL_ADDRESS_FAILURE",
> "FAILED_CP_REQUIRED",
> "TS_UNACCEPTABLE",
> "INVALID_SELECTORS",
> "UNACCEPTABLE_ADDRESSES",
> "UNEXPECTED_NAT_DETECTED");
> ENUM_NEXT(notify_type_names, ME_CONNECT_FAILED, MOBIKE_UNSUPPORTED_VERSION, UNEXPECTED_NAT_DETECTED,
> "ME_CONNECT_FAILED",
> "MOBIKE_UNSUPPORTED_VERSION"); <------------------------------------------------------------------- Added in order to support MOBIKE-X
>
>
> ENUM_NEXT(notify_type_names, INITIAL_CONTACT, ANOTHER_AUTH_FOLLOWS, MOBIKE_UNSUPPORTED_VERSION,
> "INITIAL_CONTACT",
> "SET_WINDOW_SIZE",
> "ADDITIONAL_TS_POSSIBLE",
> "IPCOMP_SUPPORTED",
> "NAT_DETECTION_SOURCE_IP",
> "NAT_DETECTION_DESTINATION_IP",
> "COOKIE",
> "USE_TRANSPORT_MODE",
> "HTTP_CERT_LOOKUP_SUPPORTED",
> "REKEY_SA",
> "ESP_TFC_PADDING_NOT_SUPPORTED",
> "NON_FIRST_FRAGMENTS_ALSO",
> "MOBIKE_SUPPORTED",
> "ADDITIONAL_IP4_ADDRESS",
> "ADDITIONAL_IP6_ADDRESS",
> "NO_ADDITIONAL_ADDRESSES",
> "UPDATE_SA_ADDRESSES",
> "COOKIE2",
> "NO_NATS_ALLOWED",
> "AUTH_LIFETIME",
> "MULTIPLE_AUTH_SUPPORTED",
> "ANOTHER_AUTH_FOLLOWS");
> ENUM_NEXT(notify_type_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, ANOTHER_AUTH_FOLLOWS,
> "EAP_ONLY_AUTHENTICATION");
> ENUM_NEXT(notify_type_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
> "USE_BEET_MODE");
> ENUM_NEXT(notify_type_names, ME_MEDIATION, ME_RESPONSE, USE_BEET_MODE,
> "ME_MEDIATION",
> "ME_ENDPOINT",
> "ME_CALLBACK",
> "ME_CONNECTID",
> "ME_CONNECTKEY",
> "ME_CONNECTAUTH",
> "ME_RESPONSE");
> ENUM_END(notify_type_names, ME_RESPONSE);
>
>
> ENUM_BEGIN(notify_type_short_names, UNSUPPORTED_CRITICAL_PAYLOAD, UNSUPPORTED_CRITICAL_PAYLOAD,
> "CRIT");
> ENUM_NEXT(notify_type_short_names, INVALID_IKE_SPI, INVALID_MAJOR_VERSION, UNSUPPORTED_CRITICAL_PAYLOAD,
> "INVAL_IKE_SPI",
> "INVAL_MAJOR");
> ENUM_NEXT(notify_type_short_names, INVALID_SYNTAX, INVALID_SYNTAX, INVALID_MAJOR_VERSION,
> "INVAL_SYN");
> ENUM_NEXT(notify_type_short_names, INVALID_MESSAGE_ID, INVALID_MESSAGE_ID, INVALID_SYNTAX,
> "INVAL_MID");
> ENUM_NEXT(notify_type_short_names, INVALID_SPI, INVALID_SPI, INVALID_MESSAGE_ID,
> "INVAL_SPI");
> ENUM_NEXT(notify_type_short_names, NO_PROPOSAL_CHOSEN, NO_PROPOSAL_CHOSEN, INVALID_SPI,
> "NO_PROP");
> ENUM_NEXT(notify_type_short_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL_CHOSEN,
> "INVAL_KE");
> ENUM_NEXT(notify_type_short_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
> "AUTH_FAILED");
> ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, UNEXPECTED_NAT_DETECTED, AUTHENTICATION_FAILED,
> "SINGLE_PAIR",
> "NO_ADD_SAS",
> "INT_ADDR_FAIL",
> "FAIL_CP_REQ",
> "TS_UNACCEPT",
> "INVAL_SEL",
> "UNACCEPT_ADDR",
> "UNEXPECT_NAT");
> ENUM_NEXT(notify_type_short_names, ME_CONNECT_FAILED, MOBIKE_UNSUPPORTED_VERSION, UNEXPECTED_NAT_DETECTED,
> "ME_CONN_FAIL",
> "MOBIKE_UNSUP"); <-------------------------------------------------------------------------------- Added in order to support MOBIKE-X
>
>
> ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, ANOTHER_AUTH_FOLLOWS, MOBIKE_UNSUPPORTED_VERSION,
> "INIT_CONTACT",
> "SET_WINSIZE",
> "ADD_TS_POSS",
> "IPCOMP_SUPP",
> "NATD_S_IP",
> "NATD_D_IP",
> "COOKIE",
> "USE_TRANSP",
> "HTTP_CERT_LOOK",
> "REKEY_SA",
> "ESP_TFC_PAD_N",
> "NON_FIRST_FRAG",
> "MOBIKE_SUP",
> "ADD_4_ADDR",
> "ADD_6_ADDR",
> "NO_ADD_ADDR",
> "UPD_SA_ADDR",
> "COOKIE2",
> "NO_NATS",
> "AUTH_LFT",
> "MULT_AUTH",
> "AUTH_FOLLOWS");
> ENUM_NEXT(notify_type_short_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, ANOTHER_AUTH_FOLLOWS,
> "EAP_ONLY");
> ENUM_NEXT(notify_type_short_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
> "BEET_MODE");
> ENUM_NEXT(notify_type_short_names, ME_MEDIATION, ME_RESPONSE, USE_BEET_MODE,
> "ME_MED",
> "ME_EP",
> "ME_CB",
> "ME_CID",
> "ME_CKEY",
> "ME_CAUTH",
> "ME_R");
> ENUM_END(notify_type_short_names, ME_RESPONSE);
>
> IMPORTANT: in the case of MOBIKE_UNSUPPORTED_VERSION, its value is 8193.
> Just between |ME_CONNECT_FAILED| and |INITIAL_CONTACT|. As in this case
> there are two different macros of the type |ENUM_NEXT|, these macros
> must be changed carefully in order to not loose link between them.
> Otherwise, somewhere in the code, at the moment when strings of notify
> are needed (for example in the log file), the program is not going to
> display the correct information. Note that there are two types of ENUMS,
> the long and short types of names. So, one must modify both in the same
> manner.
>
> *
> |message.c| at /scr/charon/encodings//
>
> It controls the order of the payload which is going to be sent in the
> message exchange. A |NEW_PAYLOAD| would be added depending on his
> architecture and operation. For example, |MOBIKE_UNSUPPORTED_VERSION| is
> a notify payload that could exists as a responder or as a initiator(only
> to terminate a MOBIKE-X connection), then it is needed to add a new
> payload in the payload order defined in this file. Also, it is mandatory
> to know when the |NEW_PAYLOAD| is taking place. For
> |MOBIKE_UNSUPPORTED_VERSION|, it just could happen during |IKE_AUTH| or
> as |INFORMATIONAL|. So let's take a look how it should be added:
>
> .
> .
> .
> /**
> * payload order for IKE_AUTH responder
> */
> static payload_order_t ike_auth_r_payload_order[] = {
>
>
> /* payload type notify type */
> {ID_RESPONDER, 0},
> {CERTIFICATE, 0},
> {AUTHENTICATION, 0},
> {EXTENSIBLE_AUTHENTICATION, 0},
> {CONFIGURATION, 0},
> {NOTIFY, IPCOMP_SUPPORTED},
> {NOTIFY, USE_TRANSPORT_MODE},
> {NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
> {NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
> {SECURITY_ASSOCIATION, 0},
> {TRAFFIC_SELECTOR_INITIATOR, 0},
> {TRAFFIC_SELECTOR_RESPONDER, 0},
> {NOTIFY, AUTH_LIFETIME},
> {NOTIFY, MOBIKE_SUPPORTED},
> {NOTIFY, MOBIKE_UNSUPPORTED_VERSION}, <------------- Added Here as responder for IKE_AUTH
>
>
> {NOTIFY, ADDITIONAL_IP4_ADDRESS},
> {NOTIFY, ADDITIONAL_IP6_ADDRESS},
> {NOTIFY, NO_ADDITIONAL_ADDRESSES},
> {NOTIFY, 0},
> {VENDOR_ID, 0},
> };
> .
> .
> .
>
> /**
>
>
> * payload order for IKE_AUTH initiator
> */
> static payload_order_t ike_auth_i_payload_order[] = {
>
>
> /* payload type notify type */
> {ID_INITIATOR, 0},
> {CERTIFICATE, 0},
> {NOTIFY, INITIAL_CONTACT},
> {NOTIFY, HTTP_CERT_LOOKUP_SUPPORTED},
> {CERTIFICATE_REQUEST, 0},
> {ID_RESPONDER, 0},
> {AUTHENTICATION, 0},
> {EXTENSIBLE_AUTHENTICATION, 0},
> {CONFIGURATION, 0},
> {NOTIFY, IPCOMP_SUPPORTED},
> {NOTIFY, USE_TRANSPORT_MODE},
> {NOTIFY, ESP_TFC_PADDING_NOT_SUPPORTED},
> {NOTIFY, NON_FIRST_FRAGMENTS_ALSO},
> {SECURITY_ASSOCIATION, 0},
> {TRAFFIC_SELECTOR_INITIATOR, 0},
> {TRAFFIC_SELECTOR_RESPONDER, 0},
> {NOTIFY, MOBIKE_SUPPORTED},
> {NOTIFY, MOBIKE_UNSUPPORTED_VERSION}, <------------- Added Here as initiator for IKE_AUTH
>
>
> {NOTIFY, ADDITIONAL_IP4_ADDRESS},
> {NOTIFY, ADDITIONAL_IP6_ADDRESS},
> {NOTIFY, NO_ADDITIONAL_ADDRESSES},
> {NOTIFY, 0},
> {VENDOR_ID, 0},
> };
> .
> .
> .
>
>
>
> Daniel Palomares Velásquez
> Orange Labs de France Télécom
> Doctorate Student
>
>
This also helped a lot, I always liked learning by example :)
Especially thanks for pointing out that I needed to change message.c I
was not aware I needed to change that one to and I bet you saved me days
of debugging.
Yours sincerely,
Jan Willem Beusink
More information about the Dev
mailing list