Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rename SignedOctets and fix MACedIDForI error #10

Merged
merged 3 commits into from
Jul 6, 2022
Merged

rename SignedOctets and fix MACedIDForI error #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
82ea74c
rename SignedOctets and fix MACedIDForI error
eggegg31415 May 21, 2022
858d553
fix landslide auth verification failure
eggegg31415 Jul 4, 2022
cf87c59
golang-lint run
eggegg31415 Jul 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions pkg/context/ue.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,8 +156,8 @@ type IKESecurityAssociation struct {
LastEAPIdentifier uint8

// Authentication data
LocalUnsignedAuthentication []byte
RemoteUnsignedAuthentication []byte
ResponderSignedOctets []byte
InitiatorSignedOctets []byte

// NAT detection
// If UEIsBehindNAT == true, N3IWF should enable NAT traversal and
Expand Down
2 changes: 1 addition & 1 deletion pkg/ike/dispatcher.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ func Dispatch(udpConn *net.UDPConn, localAddr, remoteAddr *net.UDPAddr, msg []by

switch ikeMessage.ExchangeType {
case ike_message.IKE_SA_INIT:
handler.HandleIKESAINIT(udpConn, localAddr, remoteAddr, ikeMessage)
handler.HandleIKESAINIT(udpConn, localAddr, remoteAddr, ikeMessage, msg)
case ike_message.IKE_AUTH:
handler.HandleIKEAUTH(udpConn, localAddr, remoteAddr, ikeMessage)
case ike_message.CREATE_CHILD_SA:
Expand Down
68 changes: 31 additions & 37 deletions pkg/ike/handler/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,8 @@ func init() {
ikeLog = logger.IKELog
}

func HandleIKESAINIT(udpConn *net.UDPConn, n3iwfAddr, ueAddr *net.UDPAddr, message *ike_message.IKEMessage) {
func HandleIKESAINIT(udpConn *net.UDPConn, n3iwfAddr, ueAddr *net.UDPAddr, message *ike_message.IKEMessage,
realMessage1 []byte) {
ikeLog.Infoln("Handle IKE_SA_INIT")

// Used to receive value from peer
Expand Down Expand Up @@ -329,13 +330,7 @@ func HandleIKESAINIT(udpConn *net.UDPConn, n3iwfAddr, ueAddr *net.UDPAddr, messa
// Prepare authentication data - InitatorSignedOctet
// InitatorSignedOctet = RealMessage1 | NonceRData | MACedIDForI
// MACedIDForI is acquired in IKE_AUTH exchange
receivedIKEMessageData, err := message.Encode()
if err != nil {
ikeLog.Errorln(err)
ikeLog.Error("Encode message failed.")
return
}
ikeSecurityAssociation.RemoteUnsignedAuthentication = append(receivedIKEMessageData, localNonce...)
ikeSecurityAssociation.InitiatorSignedOctets = append(realMessage1, localNonce...)

// Prepare authentication data - ResponderSignedOctet
// ResponderSignedOctet = RealMessage2 | NonceIData | MACedIDForR
Expand All @@ -345,7 +340,7 @@ func HandleIKESAINIT(udpConn *net.UDPConn, n3iwfAddr, ueAddr *net.UDPAddr, messa
ikeLog.Error("Encoding IKE message failed")
return
}
ikeSecurityAssociation.LocalUnsignedAuthentication = append(responseIKEMessageData, nonce.NonceData...)
ikeSecurityAssociation.ResponderSignedOctets = append(responseIKEMessageData, nonce.NonceData...)
// MACedIDForR
var idPayload ike_message.IKEPayloadContainer
idPayload.BuildIdentificationResponder(ike_message.ID_FQDN, []byte(n3iwfSelf.FQDN))
Expand All @@ -365,10 +360,10 @@ func HandleIKESAINIT(udpConn *net.UDPConn, n3iwfAddr, ueAddr *net.UDPAddr, messa
ikeLog.Errorf("Pseudorandom function write error: %+v", err)
return
}
ikeSecurityAssociation.LocalUnsignedAuthentication = append(ikeSecurityAssociation.LocalUnsignedAuthentication,
ikeSecurityAssociation.ResponderSignedOctets = append(ikeSecurityAssociation.ResponderSignedOctets,
pseudorandomFunction.Sum(nil)...)

ikeLog.Tracef("Local unsigned authentication data:\n%s", hex.Dump(ikeSecurityAssociation.LocalUnsignedAuthentication))
ikeLog.Tracef("Local unsigned authentication data:\n%s", hex.Dump(ikeSecurityAssociation.ResponderSignedOctets))

// Send response to UE
SendIKEMessageToUE(udpConn, n3iwfAddr, ueAddr, responseIKEMessage)
Expand Down Expand Up @@ -504,7 +499,7 @@ func HandleIKEAUTH(udpConn *net.UDPConn, n3iwfAddr, ueAddr *net.UDPAddr, message
ikeLog.Error("Encoding ID payload message failed.")
return
}
pseudorandomFunction, ok := NewPseudorandomFunction(ikeSecurityAssociation.SK_pr,
pseudorandomFunction, ok := NewPseudorandomFunction(ikeSecurityAssociation.SK_pi,
transformPseudorandomFunction.TransformID)
if !ok {
ikeLog.Error("Get an unsupported pseudorandom funcion. This may imply an unsupported transform is chosen.")
Expand All @@ -514,8 +509,8 @@ func HandleIKEAUTH(udpConn *net.UDPConn, n3iwfAddr, ueAddr *net.UDPAddr, message
ikeLog.Errorf("Pseudorandom function write error: %+v", err)
return
}
ikeSecurityAssociation.RemoteUnsignedAuthentication =
append(ikeSecurityAssociation.RemoteUnsignedAuthentication, pseudorandomFunction.Sum(nil)...)
ikeSecurityAssociation.InitiatorSignedOctets =
append(ikeSecurityAssociation.InitiatorSignedOctets, pseudorandomFunction.Sum(nil)...)
} else {
ikeLog.Error("The initiator identification field is nil")
// TODO: send error message to UE
Expand Down Expand Up @@ -690,9 +685,9 @@ func HandleIKEAUTH(udpConn *net.UDPConn, n3iwfAddr, ueAddr *net.UDPAddr, message
responseIKEPayload.BuildCertificate(ike_message.X509CertificateSignature, n3iwfSelf.N3IWFCertificate)

// Authentication Data
ikeLog.Tracef("Local authentication data:\n%s", hex.Dump(ikeSecurityAssociation.LocalUnsignedAuthentication))
ikeLog.Tracef("Local authentication data:\n%s", hex.Dump(ikeSecurityAssociation.ResponderSignedOctets))
sha1HashFunction := sha1.New()
if _, err := sha1HashFunction.Write(ikeSecurityAssociation.LocalUnsignedAuthentication); err != nil {
if _, err := sha1HashFunction.Write(ikeSecurityAssociation.ResponderSignedOctets); err != nil {
ikeLog.Errorf("Hash function write error: %+v", err)
return
}
Expand Down Expand Up @@ -929,36 +924,35 @@ func HandleIKEAUTH(udpConn *net.UDPConn, n3iwfAddr, ueAddr *net.UDPAddr, message
if authentication != nil {
// Verifying remote AUTH
pseudorandomFunction.Reset()
if _, err := pseudorandomFunction.Write(ikeSecurityAssociation.RemoteUnsignedAuthentication); err != nil {
if _, err := pseudorandomFunction.Write(ikeSecurityAssociation.InitiatorSignedOctets); err != nil {
ikeLog.Errorf("Pseudorandom function write error: %+v", err)
return
}
expectedAuthenticationData := pseudorandomFunction.Sum(nil)

ikeLog.Tracef("Expected Authentication Data:\n%s", hex.Dump(expectedAuthenticationData))
// TODO: Finish authentication test for UE and N3IWF
/*
if !bytes.Equal(authentication.AuthenticationData, expectedAuthenticationData) {
ikeLog.Warn("Peer authentication failed.")
// Inform UE the authentication has failed
// Build IKE message
responseIKEMessage.BuildIKEHeader(message.InitiatorSPI, message.ResponderSPI,
ike_message.IKE_AUTH, ike_message.ResponseBitCheck, message.MessageID)
responseIKEMessage.Payloads.Reset()

// Notification
responseIKEPayload.BuildNotification(ike_message.TypeNone, ike_message.AUTHENTICATION_FAILED, nil, nil)
if !bytes.Equal(authentication.AuthenticationData, expectedAuthenticationData) {
ikeLog.Warn("Peer authentication failed.")
// Inform UE the authentication has failed
// Build IKE message
responseIKEMessage.BuildIKEHeader(message.InitiatorSPI, message.ResponderSPI,
ike_message.IKE_AUTH, ike_message.ResponseBitCheck, message.MessageID)
responseIKEMessage.Payloads.Reset()

if err := EncryptProcedure(ikeSecurityAssociation, responseIKEPayload, responseIKEMessage); err != nil {
ikeLog.Errorf("Encrypting IKE message failed: %+v", err)
return
}
// Notification
responseIKEPayload.BuildNotification(ike_message.TypeNone, ike_message.AUTHENTICATION_FAILED, nil, nil)

// Send IKE message to UE
SendIKEMessageToUE(udpConn, n3iwfAddr, ueAddr, responseIKEMessage)
if err := EncryptProcedure(ikeSecurityAssociation, responseIKEPayload, responseIKEMessage); err != nil {
ikeLog.Errorf("Encrypting IKE message failed: %+v", err)
return
}
*/

// Send IKE message to UE
SendIKEMessageToUE(udpConn, n3iwfAddr, ueAddr, responseIKEMessage)
return
} else {
ikeLog.Tracef("Peer authentication success")
}
} else {
ikeLog.Warn("Peer authentication failed.")
// Inform UE the authentication has failed
Expand Down Expand Up @@ -1011,7 +1005,7 @@ func HandleIKEAUTH(udpConn *net.UDPConn, n3iwfAddr, ueAddr *net.UDPAddr, message

// Calculate local AUTH
pseudorandomFunction.Reset()
if _, err := pseudorandomFunction.Write(ikeSecurityAssociation.LocalUnsignedAuthentication); err != nil {
if _, err := pseudorandomFunction.Write(ikeSecurityAssociation.ResponderSignedOctets); err != nil {
ikeLog.Errorf("Pseudorandom function write error: %+v", err)
return
}
Expand Down