[strongSwan-dev] new notify message

Andreas Steffen andreas.steffen at strongswan.org
Fri Apr 9 17:47:22 CEST 2010


Hi Jan,

ME_ stands for the IKEv2 Mediation Extension as defined by
the Internet Draft

http://tools.ietf.org/html/draft-brunner-ikev2-mediation-00

written by strongSwan team member Tobias Brunner and
implemented by the strongSwan daemon.

Kind regards

Andreas

On 09.04.2010 17:34, Jan Willem Beusink wrote:
> Martin Willi wrote:
>> Hi,
>>
>>> add ME_AUTHORIZATION_FAILED = 8193 in the notify_payload.h file
>>
>>> understanding the notify_payload.c file. More specifically I
>>> can't make any sense of the enumerations...
>>
>> If you change the enum in a header file, you'll have to update the
>> enum-to-string mappings in the corresponding .c file, too.
>>
>> These macros create several structs with strings to map enums to
>> strings. The notify types enumeration is probably the most complex
>> incarnation of this struct, my apologies.
>>
>> Have a look at the src/libstrongswan/enum.h header, it explains in
>> detail how these macros work.
>>
>> Regards
>> Martin
>>
>>
>
> The enum header helped a lot :) thanks!
>
> I was wondering though if the ME in ME_CONNECT_FAILED has special
> meaning. I assumed it was for referring to adding a private
> implementation (ME as in me, self). Yet after seeing it more often,
> e.g.,"ME_MEDIATION","ME_ENDPOINT","ME_CALLBACK","ME_CONNECTID",ME_CONNECTKEY","ME_CONNECTAUTH","ME_RESPONSE",
>   I got the impression it might have an other meaning.
>
> Daniel Palomares wrote:
>> I took this from my internal WiKi. Hope it helps you!
>>
>>
>> Let's suppose the new payload is called |NEW_PAYLOAD|.
>>
>> Files to be changed:
>>
>>      *
>>        |notify_payload.h| at //scr/charon/encodings/payload//
>>
>> It has the list of notify messages types. So, it is needed to add
>> |NEW_PAYLOAD| to the |enum{}| list (|i.e.| |MOBIKE_SUPPORTED| = 16396
>> and it must be between 16397 and 16395). It means also that depending on
>> the value of the notify, its location is defined on the list |enum
>> notify_type_t{}|. It is VERY important to understand that this list is
>> the base to build all messages of IKEv2, including its extensions (see )
>>
>> /**
>>   * Notify message types.
>>   *
>>   * See IKEv2 RFC 3.10.1.
>>   */
>> enum notify_type_t {
>> 	/* notify error messages */
>> 	UNSUPPORTED_CRITICAL_PAYLOAD = 1,
>> 	INVALID_IKE_SPI = 4,
>> 	INVALID_MAJOR_VERSION = 5,
>> 	INVALID_SYNTAX = 7,
>> 	INVALID_MESSAGE_ID = 9,
>> 	INVALID_SPI = 11,
>> 	NO_PROPOSAL_CHOSEN = 14,
>> 	INVALID_KE_PAYLOAD = 17,
>> 	AUTHENTICATION_FAILED = 24,
>> 	SINGLE_PAIR_REQUIRED = 34,
>> 	NO_ADDITIONAL_SAS = 35,
>> 	INTERNAL_ADDRESS_FAILURE = 36,
>> 	FAILED_CP_REQUIRED = 37,
>> 	TS_UNACCEPTABLE = 38,
>> 	INVALID_SELECTORS = 39,
>> 	UNACCEPTABLE_ADDRESSES = 40,
>> 	UNEXPECTED_NAT_DETECTED = 41,
>> 	/* IKE-ME, private use */
>> 	ME_CONNECT_FAILED = 8192,
>>          /* MOBIKE-eXtended Messages */
>>          MOBIKE_UNSUPPORTED_VERSION = 8193,<---------- i.e. This Notify was added.
>>
>> 	/* notify status messages */
>> 	INITIAL_CONTACT = 16384,
>> 	SET_WINDOW_SIZE = 16385,
>> 	ADDITIONAL_TS_POSSIBLE = 16386,
>> 	IPCOMP_SUPPORTED = 16387,
>> 	NAT_DETECTION_SOURCE_IP = 16388,
>> 	NAT_DETECTION_DESTINATION_IP = 16389,
>> 	COOKIE = 16390,
>> 	USE_TRANSPORT_MODE = 16391,
>> 	HTTP_CERT_LOOKUP_SUPPORTED = 16392,
>> 	REKEY_SA = 16393,
>> 	ESP_TFC_PADDING_NOT_SUPPORTED = 16394,
>> 	NON_FIRST_FRAGMENTS_ALSO = 16395,
>> 	/* mobike extension, RFC4555 */
>> 	MOBIKE_SUPPORTED = 16396,
>> 	ADDITIONAL_IP4_ADDRESS = 16397,
>> 	ADDITIONAL_IP6_ADDRESS = 16398,
>> 	NO_ADDITIONAL_ADDRESSES = 16399,
>> 	UPDATE_SA_ADDRESSES = 16400,
>> 	COOKIE2 = 16401,
>> 	NO_NATS_ALLOWED = 16402,
>> 	/* repeated authentication extension, RFC4478 */
>> 	AUTH_LIFETIME = 16403,
>>          /* multiple authentication exchanges, RFC 4739 */
>> 	MULTIPLE_AUTH_SUPPORTED = 16404,
>> 	ANOTHER_AUTH_FOLLOWS = 16405,
>> 	/* draft-eronen-ipsec-ikev2-eap-auth, not assigned by IANA yet */
>> 	EAP_ONLY_AUTHENTICATION = 40960,
>> 	/* BEET mode, not even a draft yet. private use */
>> 	USE_BEET_MODE = 40961,
>> 	/* IKE-ME, private use */
>> 	ME_MEDIATION = 40962,
>> 	ME_ENDPOINT = 40963,
>> 	ME_CALLBACK = 40964,
>> 	ME_CONNECTID = 40965,
>> 	ME_CONNECTKEY = 40966,
>> 	ME_CONNECTAUTH = 40967,
>> 	ME_RESPONSE = 40968,
>>
>> };
>>
>>      *
>>        |notify_payload.c| at //scr/charon/encodings/payload//
>>
>> Before knowing how to modify |notify_payload.c|, first it is mandatory
>> to know how enum's are represented in the code. The following structure
>> is located at //src/libstrongswan/enum.h/ :
>>
>> /**
>>   * Struct to store names for enums.
>>   *
>>   * To print the string representation of enumeration values, the strings
>>   * are stored in these structures. Every enum_name contains a range
>>   * of strings, multiple ranges are linked together.
>>   * Use the convenience macros to define these linked ranges.
>>   *
>>   * For a single range, use:
>>   * @code
>>     ENUM(name, first, last, string1, string2, ...)
>>     @endcode
>>   * For multiple linked ranges, use:
>>   * @code
>>     ENUM_BEGIN(name, first, last, string1, string2, ...)
>>       ENUM_NEXT(name, first, last, last_from_previous, string3, ...)
>>       ENUM_NEXT(name, first, last, last_from_previous, string4, ...)
>>     ENUM_END(name, last_from_previous)
>>     @endcode
>>   * The ENUM and the ENUM_END define a enum_name_t pointer with the name supplied
>>   * in "name".
>>   *
>>   * Resolving of enum names is done using a printf hook. A printf fromat
>>   * character %N is replaced by the enum string. Printf needs two arguments to
>>   * resolve a %N, the enum_name_t* (the defined name in ENUM_BEGIN) followed
>>   * by the numerical enum value.
>>   */
>> struct enum_name_t {
>> 	/** value of the first enum string */
>> 	int first;
>> 	/** value of the last enum string */
>> 	int last;
>> 	/** next enum_name_t in list */
>> 	enum_name_t *next;
>> 	/** array of strings containing names from first to last */
>> 	char *names[];
>> };
>>
>> As the |NEW_PAYLOAD| must be defined inside the enum list of IKEv2
>> notify messages, it should be added in |notify_payload.c| in order to be
>> displayed as a string somewhere and whenever is needed.
>>
>> ENUM_BEGIN(notify_type_names, UNSUPPORTED_CRITICAL_PAYLOAD, UNSUPPORTED_CRITICAL_PAYLOAD,
>> 	"UNSUPPORTED_CRITICAL_PAYLOAD");
>> ENUM_NEXT(notify_type_names, INVALID_IKE_SPI, INVALID_MAJOR_VERSION, UNSUPPORTED_CRITICAL_PAYLOAD,
>> 	"INVALID_IKE_SPI",
>> 	"INVALID_MAJOR_VERSION");
>> ENUM_NEXT(notify_type_names, INVALID_SYNTAX, INVALID_SYNTAX, INVALID_MAJOR_VERSION,
>> 	"INVALID_SYNTAX");
>> ENUM_NEXT(notify_type_names, INVALID_MESSAGE_ID, INVALID_MESSAGE_ID, INVALID_SYNTAX,
>> 	"INVALID_MESSAGE_ID");
>> ENUM_NEXT(notify_type_names, INVALID_SPI, INVALID_SPI, INVALID_MESSAGE_ID,
>> 	"INVALID_SPI");
>> ENUM_NEXT(notify_type_names, NO_PROPOSAL_CHOSEN, NO_PROPOSAL_CHOSEN, INVALID_SPI,
>> 	"NO_PROPOSAL_CHOSEN");
>> ENUM_NEXT(notify_type_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL_CHOSEN,
>> 	"INVALID_KE_PAYLOAD");
>> ENUM_NEXT(notify_type_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
>> 	"AUTHENTICATION_FAILED");
>> ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, UNEXPECTED_NAT_DETECTED, AUTHENTICATION_FAILED,
>> 	"SINGLE_PAIR_REQUIRED",
>> 	"NO_ADDITIONAL_SAS",
>> 	"INTERNAL_ADDRESS_FAILURE",
>> 	"FAILED_CP_REQUIRED",
>> 	"TS_UNACCEPTABLE",
>> 	"INVALID_SELECTORS",
>> 	"UNACCEPTABLE_ADDRESSES",
>> 	"UNEXPECTED_NAT_DETECTED");
>> ENUM_NEXT(notify_type_names, ME_CONNECT_FAILED, MOBIKE_UNSUPPORTED_VERSION, UNEXPECTED_NAT_DETECTED,
>> 	"ME_CONNECT_FAILED",
>>          "MOBIKE_UNSUPPORTED_VERSION");<------------------------------------------------------------------- Added in order to support MOBIKE-X
>>
>>
>> ENUM_NEXT(notify_type_names, INITIAL_CONTACT, ANOTHER_AUTH_FOLLOWS, MOBIKE_UNSUPPORTED_VERSION,
>> 	"INITIAL_CONTACT",
>> 	"SET_WINDOW_SIZE",
>> 	"ADDITIONAL_TS_POSSIBLE",
>> 	"IPCOMP_SUPPORTED",
>> 	"NAT_DETECTION_SOURCE_IP",
>> 	"NAT_DETECTION_DESTINATION_IP",
>> 	"COOKIE",
>> 	"USE_TRANSPORT_MODE",
>> 	"HTTP_CERT_LOOKUP_SUPPORTED",
>> 	"REKEY_SA",
>> 	"ESP_TFC_PADDING_NOT_SUPPORTED",
>> 	"NON_FIRST_FRAGMENTS_ALSO",
>> 	"MOBIKE_SUPPORTED",
>> 	"ADDITIONAL_IP4_ADDRESS",
>> 	"ADDITIONAL_IP6_ADDRESS",
>> 	"NO_ADDITIONAL_ADDRESSES",
>> 	"UPDATE_SA_ADDRESSES",
>> 	"COOKIE2",
>> 	"NO_NATS_ALLOWED",
>> 	"AUTH_LIFETIME",
>> 	"MULTIPLE_AUTH_SUPPORTED",
>> 	"ANOTHER_AUTH_FOLLOWS");
>> ENUM_NEXT(notify_type_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, ANOTHER_AUTH_FOLLOWS,
>> 	"EAP_ONLY_AUTHENTICATION");
>> ENUM_NEXT(notify_type_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
>> 	"USE_BEET_MODE");
>> ENUM_NEXT(notify_type_names, ME_MEDIATION, ME_RESPONSE, USE_BEET_MODE,
>> 	"ME_MEDIATION",
>> 	"ME_ENDPOINT",
>> 	"ME_CALLBACK",
>> 	"ME_CONNECTID",
>> 	"ME_CONNECTKEY",
>> 	"ME_CONNECTAUTH",
>> 	"ME_RESPONSE");
>> ENUM_END(notify_type_names, ME_RESPONSE);
>>
>>
>> ENUM_BEGIN(notify_type_short_names, UNSUPPORTED_CRITICAL_PAYLOAD, UNSUPPORTED_CRITICAL_PAYLOAD,
>> 	"CRIT");
>> ENUM_NEXT(notify_type_short_names, INVALID_IKE_SPI, INVALID_MAJOR_VERSION, UNSUPPORTED_CRITICAL_PAYLOAD,
>> 	"INVAL_IKE_SPI",
>> 	"INVAL_MAJOR");
>> ENUM_NEXT(notify_type_short_names, INVALID_SYNTAX, INVALID_SYNTAX, INVALID_MAJOR_VERSION,
>> 	"INVAL_SYN");
>> ENUM_NEXT(notify_type_short_names, INVALID_MESSAGE_ID, INVALID_MESSAGE_ID, INVALID_SYNTAX,
>> 	"INVAL_MID");
>> ENUM_NEXT(notify_type_short_names, INVALID_SPI, INVALID_SPI, INVALID_MESSAGE_ID,
>> 	"INVAL_SPI");
>> ENUM_NEXT(notify_type_short_names, NO_PROPOSAL_CHOSEN, NO_PROPOSAL_CHOSEN, INVALID_SPI,
>> 	"NO_PROP");
>> ENUM_NEXT(notify_type_short_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL_CHOSEN,
>> 	"INVAL_KE");
>> ENUM_NEXT(notify_type_short_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
>> 	"AUTH_FAILED");
>> ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, UNEXPECTED_NAT_DETECTED, AUTHENTICATION_FAILED,
>> 	"SINGLE_PAIR",
>> 	"NO_ADD_SAS",
>> 	"INT_ADDR_FAIL",
>> 	"FAIL_CP_REQ",
>> 	"TS_UNACCEPT",
>> 	"INVAL_SEL",
>> 	"UNACCEPT_ADDR",
>> 	"UNEXPECT_NAT");
>> ENUM_NEXT(notify_type_short_names, ME_CONNECT_FAILED, MOBIKE_UNSUPPORTED_VERSION, UNEXPECTED_NAT_DETECTED,
>> 	"ME_CONN_FAIL",
>>          "MOBIKE_UNSUP");<-------------------------------------------------------------------------------- Added in order to support MOBIKE-X
>>
>>
>> ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, ANOTHER_AUTH_FOLLOWS, MOBIKE_UNSUPPORTED_VERSION,
>> 	"INIT_CONTACT",
>> 	"SET_WINSIZE",
>> 	"ADD_TS_POSS",
>> 	"IPCOMP_SUPP",
>> 	"NATD_S_IP",
>> 	"NATD_D_IP",
>> 	"COOKIE",
>> 	"USE_TRANSP",
>> 	"HTTP_CERT_LOOK",
>> 	"REKEY_SA",
>> 	"ESP_TFC_PAD_N",
>> 	"NON_FIRST_FRAG",
>> 	"MOBIKE_SUP",
>> 	"ADD_4_ADDR",
>> 	"ADD_6_ADDR",
>> 	"NO_ADD_ADDR",
>> 	"UPD_SA_ADDR",
>> 	"COOKIE2",
>> 	"NO_NATS",
>>          "AUTH_LFT",
>> 	"MULT_AUTH",
>> 	"AUTH_FOLLOWS");
>> ENUM_NEXT(notify_type_short_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, ANOTHER_AUTH_FOLLOWS,
>> 	"EAP_ONLY");
>> ENUM_NEXT(notify_type_short_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
>> 	"BEET_MODE");
>> ENUM_NEXT(notify_type_short_names, ME_MEDIATION, ME_RESPONSE, USE_BEET_MODE,
>> 	"ME_MED",
>> 	"ME_EP",
>> 	"ME_CB",
>> 	"ME_CID",
>> 	"ME_CKEY",
>> 	"ME_CAUTH",
>> 	"ME_R");
>> ENUM_END(notify_type_short_names, ME_RESPONSE);
>>
>> IMPORTANT: in the case of MOBIKE_UNSUPPORTED_VERSION, its value is 8193.
>> Just between |ME_CONNECT_FAILED| and |INITIAL_CONTACT|. As in this case
>> there are two different macros of the type |ENUM_NEXT|, these macros
>> must be changed carefully in order to not loose link between them.
>> Otherwise, somewhere in the code, at the moment when strings of notify
>> are needed (for example in the log file), the program is not going to
>> display the correct information. Note that there are two types of ENUMS,
>> the long and short types of names. So, one must modify both in the same
>> manner.
>>
>>      *
>>        |message.c| at /scr/charon/encodings//
>>
>> It controls the order of the payload which is going to be sent in the
>> message exchange. A |NEW_PAYLOAD| would be added depending on his
>> architecture and operation. For example, |MOBIKE_UNSUPPORTED_VERSION| is
>> a notify payload that could exists as a responder or as a initiator(only
>> to terminate a MOBIKE-X connection), then it is needed to add a new
>> payload in the payload order defined in this file. Also, it is mandatory
>> to know when the |NEW_PAYLOAD| is taking place. For
>> |MOBIKE_UNSUPPORTED_VERSION|, it just could happen during |IKE_AUTH| or
>> as |INFORMATIONAL|. So let's take a look how it should be added:
>>
>> .
>> .
>> .
>> /**
>>   * payload order for IKE_AUTH responder
>>   */
>> static payload_order_t ike_auth_r_payload_order[] = {
>>
>>
>> /*	payload type					notify type */
>> 	{ID_RESPONDER,					0},
>> 	{CERTIFICATE,					0},
>> 	{AUTHENTICATION,				0},
>> 	{EXTENSIBLE_AUTHENTICATION,		0},
>> 	{CONFIGURATION,					0},
>> 	{NOTIFY,						IPCOMP_SUPPORTED},
>> 	{NOTIFY,						USE_TRANSPORT_MODE},
>> 	{NOTIFY,						ESP_TFC_PADDING_NOT_SUPPORTED},
>> 	{NOTIFY,						NON_FIRST_FRAGMENTS_ALSO},
>> 	{SECURITY_ASSOCIATION, 			0},
>> 	{TRAFFIC_SELECTOR_INITIATOR,	0},
>> 	{TRAFFIC_SELECTOR_RESPONDER,	0},
>> 	{NOTIFY,						AUTH_LIFETIME},
>> 	{NOTIFY,						MOBIKE_SUPPORTED},
>>          {NOTIFY,						MOBIKE_UNSUPPORTED_VERSION},<------------- Added Here as responder for IKE_AUTH
>>
>>
>> 	{NOTIFY,						ADDITIONAL_IP4_ADDRESS},
>> 	{NOTIFY,						ADDITIONAL_IP6_ADDRESS},
>> 	{NOTIFY,						NO_ADDITIONAL_ADDRESSES},
>> 	{NOTIFY,						0},
>> 	{VENDOR_ID,						0},
>> };
>> .
>> .
>> .
>>
>> /**
>>
>>
>>   * payload order for IKE_AUTH initiator
>>   */
>> static payload_order_t ike_auth_i_payload_order[] = {
>>
>>
>> /*	payload type					notify type */
>> 	{ID_INITIATOR,					0},
>> 	{CERTIFICATE,					0},
>> 	{NOTIFY,						INITIAL_CONTACT},
>> 	{NOTIFY,						HTTP_CERT_LOOKUP_SUPPORTED},
>> 	{CERTIFICATE_REQUEST,			0},
>> 	{ID_RESPONDER,					0},
>> 	{AUTHENTICATION,				0},
>> 	{EXTENSIBLE_AUTHENTICATION,		0},
>> 	{CONFIGURATION,					0},
>> 	{NOTIFY,						IPCOMP_SUPPORTED},
>> 	{NOTIFY,						USE_TRANSPORT_MODE},
>> 	{NOTIFY,						ESP_TFC_PADDING_NOT_SUPPORTED},
>> 	{NOTIFY,						NON_FIRST_FRAGMENTS_ALSO},
>> 	{SECURITY_ASSOCIATION, 			0},
>> 	{TRAFFIC_SELECTOR_INITIATOR,	0},
>> 	{TRAFFIC_SELECTOR_RESPONDER,	0},
>> 	{NOTIFY,						MOBIKE_SUPPORTED},
>>          {NOTIFY,						MOBIKE_UNSUPPORTED_VERSION},<------------- Added Here as initiator for IKE_AUTH
>>
>>
>> 	{NOTIFY,						ADDITIONAL_IP4_ADDRESS},
>> 	{NOTIFY,						ADDITIONAL_IP6_ADDRESS},
>> 	{NOTIFY,						NO_ADDITIONAL_ADDRESSES},
>>          {NOTIFY,						0},
>> 	{VENDOR_ID,						0},
>> };
>> .
>> .
>> .
>>
>>
>>
>> Daniel Palomares Velásquez
>> Orange Labs de France Télécom
>> Doctorate Student
>>
>>
>
> This also helped a lot, I always liked learning by example :)
> Especially thanks for pointing out that I needed to change message.c I
> was not aware I needed to change that one to and I bet you saved me days
> of debugging.
>
> Yours sincerely,
>
> Jan Willem Beusink

======================================================================
Andreas Steffen                         andreas.steffen at strongswan.org
strongSwan - the Linux VPN Solution!                www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==




More information about the Dev mailing list