projects / strongswan.git / blob
? search:


1829c652c15a7660247be4af468faf07ddd7adc4
[strongswan.git] / Source / charon / ike_sa.c
1 /**
2 * @file ike_sa.c
3 *
4 * @brief Class ike_sa_t. An object of this type is managed by an
5 * ike_sa_manager_t object and represents an IKE_SA
6 *
7 */
8
9 /*
10 * Copyright (C) 2005 Jan Hutter, Martin Willi
11 * Hochschule fuer Technik Rapperswil
12 *
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms of the GNU General Public License as published by the
15 * Free Software Foundation; either version 2 of the License, or (at your
16 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
17 *
18 * This program is distributed in the hope that it will be useful, but
19 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
20 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
21 * for more details.
22 */
23
24 #include "ike_sa.h"
25
26 #include "types.h"
27 #include "globals.h"
28 #include "definitions.h"
29 #include "utils/allocator.h"
30 #include "utils/linked_list.h"
31 #include "utils/logger_manager.h"
32 #include "utils/randomizer.h"
33 #include "transforms/diffie_hellman.h"
34 #include "payloads/sa_payload.h"
35 #include "payloads/nonce_payload.h"
36 #include "payloads/ke_payload.h"
37 #include "payloads/transform_substructure.h"
38 #include "payloads/transform_attribute.h"
39
40
41 /**
42 * Nonce size in bytes of all sent nonces
43 */
44 #define NONCE_SIZE 16
45
46 /**
47 * States in which a IKE_SA can actually be
48 */
49 typedef enum ike_sa_state_e ike_sa_state_t;
50
51 enum ike_sa_state_e {
52
53 /**
54 * IKE_SA is is not in a state
55 */
56 NO_STATE = 1,
57
58 /**
59 * A IKE_SA_INIT-message was sent: role initiator
60 */
61 IKE_SA_INIT_REQUESTED = 2,
62
63 /**
64 * A IKE_SA_INIT-message was replied: role responder
65 */
66 IKE_SA_INIT_RESPONDED = 3,
67
68 /**
69 * An IKE_AUTH-message was sent after a successful
70 * IKE_SA_INIT-exchange: role initiator
71 */
72 IKE_AUTH_REQUESTED = 4,
73
74 /**
75 * An IKE_AUTH-message was replied: role responder.
76 * In this state, all the informations for an IKE_SA
77 * and one CHILD_SA are known.
78 */
79 IKE_SA_INITIALIZED = 5
80 };
81
82 /**
83 * string mappings for ike_sa_state
84 */
85 mapping_t ike_sa_state_m[] = {
86 {NO_STATE, "NO_STATE"},
87 {IKE_SA_INIT_REQUESTED, "IKE_SA_INIT_REQUESTED"},
88 {IKE_SA_INIT_RESPONDED, "IKE_SA_INIT_RESPONDED"},
89 {IKE_AUTH_REQUESTED, "IKE_AUTH_REQUESTED"},
90 {IKE_SA_INITIALIZED, "IKE_SA_INITIALIZED"},
91 {MAPPING_END, NULL}
92 };
93
94
95 /**
96 * Private data of an message_t object
97 */
98 typedef struct private_ike_sa_s private_ike_sa_t;
99
100 struct private_ike_sa_s {
101
102 /**
103 * Public part of a ike_sa_t object
104 */
105 ike_sa_t public;
106
107 /**
108 * Builds an empty IKEv2-Message
109 *
110 * Depending on the type of message (request or response), the message id is
111 * either message_id_out or message_id_in.
112 *
113 *
114 * @param this calling object
115 * @param type exchange type of new message
116 * @param request TRUE, if message has to be a request
117 * @param message new message is stored at this location
118 * @return
119 * - SUCCESS
120 * - OUT_OF_RES
121 */
122 status_t (*build_message) (private_ike_sa_t *this, exchange_type_t type, bool request, message_t **message);
123
124 status_t (*build_sa_payload) (private_ike_sa_t *this, sa_payload_t **payload);
125 status_t (*build_ke_payload) (private_ike_sa_t *this, ke_payload_t **payload);
126 status_t (*build_nonce_payload) (private_ike_sa_t *this, nonce_payload_t **payload);
127
128 status_t (*create_delete_job) (private_ike_sa_t *this);
129 status_t (*resend_last_reply) (private_ike_sa_t *this);
130
131
132 status_t (*transto_ike_sa_init_requested) (private_ike_sa_t *this, char *name);
133 status_t (*transto_ike_sa_init_responded) (private_ike_sa_t *this, message_t *message);
134 status_t (*transto_ike_auth_requested) (private_ike_sa_t *this, message_t *message);
135
136 /* Private values */
137 /**
138 * Identifier for the current IKE_SA
139 */
140 ike_sa_id_t *ike_sa_id;
141
142 /**
143 * Linked List containing the child sa's of the current IKE_SA
144 */
145 linked_list_t *child_sas;
146
147 /**
148 * Current state of the IKE_SA
149 */
150 ike_sa_state_t state;
151
152 /**
153 * this SA's source for random data
154 */
155 randomizer_t *randomizer;
156
157 /**
158 * contains the last responded message
159 *
160 */
161 message_t *last_responded_message;
162
163 /**
164 * contains the last requested message
165 *
166 */
167 message_t *last_requested_message;
168
169 /**
170 * Informations of this host
171 */
172 struct {
173 host_t *host;
174 } me;
175
176 /**
177 * Informations of the other host
178 */
179 struct {
180 host_t *host;
181 } other;
182
183
184 struct {
185 /**
186 * Diffie Hellman object used to compute shared secret
187 */
188 diffie_hellman_t *diffie_hellman;
189
190 /**
191 * Diffie Hellman group number
192 */
193 u_int16_t dh_group_number;
194
195 /**
196 * Priority used get matching dh_group number
197 */
198 u_int16_t dh_group_priority;
199
200 /**
201 * selected proposals
202 */
203 linked_list_t *proposals;
204
205 /**
206 * Sent nonce value
207 */
208 chunk_t sent_nonce;
209
210 /**
211 * received nonce value
212 */
213 chunk_t received_nonce;
214 } ike_sa_init_data;
215
216
217 /**
218 * next message id to receive
219 */
220 u_int32_t message_id_in;
221
222 /**
223 * next message id to send
224 */
225 u_int32_t message_id_out;
226
227 /**
228 * a logger for this IKE_SA
229 */
230 logger_t *logger;
231 };
232
233 /**
234 * @brief implements function process_message of private_ike_sa_t
235 */
236 static status_t process_message (private_ike_sa_t *this, message_t *message)
237 {
238 u_int32_t message_id;
239 bool is_request;
240 exchange_type_t exchange_type;
241 /* we must process each request or response from remote host
242 * the check if a given message is possible for a given state is done in here
243 */
244
245 /* find out type of message (request or response) */
246 is_request = message->get_request(message);
247 exchange_type = message->get_exchange_type(message);
248
249 this->logger->log(this->logger, CONTROL|MORE, "Process %s message of exchange type %s",(is_request) ? "REQUEST" : "RESPONSE",
250 mapping_find(exchange_type_m,exchange_type));
251
252 message_id = message->get_message_id(message);
253
254 /*
255 * It has to be checked, if the message has to be resent cause of lost packets!
256 */
257 if (is_request && ( message_id == (this->message_id_in - 1)))
258 {
259 /* message can be resent ! */
260 this->logger->log(this->logger, CONTROL|MORE, "Resent message detected. Send stored reply");
261 return (this->resend_last_reply(this));
262 }
263
264 /* Now, the message id is checked for request AND reply */
265 if (is_request)
266 {
267 /* In a request, the message has to be this->message_id_in (other case is already handled) */
268 if (message_id != this->message_id_in)
269 {
270 this->logger->log(this->logger, ERROR | MORE, "Message request with message id %d received, but %d expected",message_id,this->message_id_in);
271 return FAILED;
272 }
273 }
274 else
275 {
276 /* In a reply, the message has to be this->message_id_out -1 cause it is the reply to the last sent message*/
277 if (message_id != (this->message_id_out - 1))
278 {
279 this->logger->log(this->logger, ERROR | MORE, "Message reply with message id %d received, but %d expected",message_id,this->message_id_in);
280 return FAILED;
281 }
282 }
283
284 /* Now, the exchange type is checked and the appropriate transition handler is called*/
285 switch (message->get_exchange_type(message))
286 {
287 case IKE_SA_INIT:
288 {
289
290 if (message->get_request(message)) {
291 if (this->state == NO_STATE)
292 {
293 /* state transission NO_STATE => IKE_SA_INIT_RESPONDED */
294 return this->transto_ike_sa_init_responded(this, message);
295 }
296 }
297 else
298 {
299 if (this->state == IKE_SA_INIT_REQUESTED)
300 {
301 /* state transission IKE_SA_INIT_REQUESTED => IKE_AUTH_REQUESTED*/
302 return this->transto_ike_auth_requested(this, message);
303 }
304 }
305
306 this->logger->log(this->logger, ERROR | MORE, "Message in current state %s not supported",mapping_find(ike_sa_state_m,this->state));
307
308 break;
309 }
310 case IKE_AUTH:
311 {
312 if (this->state <= IKE_SA_INIT_REQUESTED)
313 {
314 this->logger->log(this->logger, ERROR | MORE, "Current state %s of IKE_SA does not allow IKE_AUTH message",mapping_find(ike_sa_state_m,this->state));
315 return FAILED;
316 }
317 break;
318 }
319 case CREATE_CHILD_SA:
320 {
321 if (this->state < IKE_SA_INITIALIZED)
322 {
323 this->logger->log(this->logger, ERROR | MORE, "Current state %s of IKE_SA does not allow CREATE_CHILD_SA message",mapping_find(ike_sa_state_m,this->state));
324 return FAILED;
325 }
326 break;
327 }
328 case INFORMATIONAL:
329 {
330 break;
331 }
332 default:
333 {
334 this->logger->log(this->logger, ERROR, "processing %s-message not supported.",
335 mapping_find(exchange_type_m,message->get_exchange_type(message)));
336 return NOT_SUPPORTED;
337 }
338 }
339 this->logger->log(this->logger, CONTROL, "received %s-message in state %s, not handled.",
340 mapping_find(exchange_type_m, message->get_exchange_type(message)),
341 mapping_find(ike_sa_state_m, this->state));
342 return INVALID_STATE;
343 }
344
345 /**
346 * @brief Implements function build_message of private_ike_sa_t.
347 */
348 static status_t build_message(private_ike_sa_t *this, exchange_type_t type, bool request, message_t **message)
349 {
350 status_t status;
351 message_t *new_message;
352 host_t *source, *destination;
353
354 this ->logger->log(this->logger, CONTROL|MORE, "build empty message");
355 new_message = message_create();
356 if (new_message == NULL)
357 {
358 this->logger->log(this->logger, ERROR, "Fatal error: could not create empty message object");
359 return OUT_OF_RES;
360 }
361
362 status = this->me.host->clone(this->me.host, &source);
363 if (status != SUCCESS)
364 {
365 this->logger->log(this->logger, ERROR, "Fatal error: could not clone my host information");
366 new_message->destroy(new_message);
367 return status;
368 }
369 status = this->other.host->clone(this->other.host, &destination);
370 if (status != SUCCESS)
371 {
372 this->logger->log(this->logger, ERROR, "Fatal error: could not clone other host information");
373 source->destroy(source);
374 new_message->destroy(new_message);
375 return status;
376 }
377
378 new_message->set_source(new_message, source);
379 new_message->set_destination(new_message, destination);
380
381 new_message->set_exchange_type(new_message, type);
382 new_message->set_request(new_message, request);
383
384 new_message->set_message_id(new_message, (request) ? this->message_id_out : this->message_id_in);
385
386 status = new_message->set_ike_sa_id(new_message, this->ike_sa_id);
387 if (status != SUCCESS)
388 {
389 this->logger->log(this->logger, ERROR, "Fatal error: could not set ike_sa_id of message");
390 new_message->destroy(new_message);
391 return status;
392 }
393
394 *message = new_message;
395
396 return SUCCESS;
397 }
398
399 /**
400 * @brief Implements function transto_ike_sa_init_requested of private_ike_sa_t.
401 */
402 static status_t transto_ike_sa_init_requested(private_ike_sa_t *this, char *name)
403 {
404 message_t *message;
405 payload_t *payload;
406 packet_t *packet;
407 status_t status;
408 linked_list_iterator_t *proposal_iterator;
409
410 this->logger->log(this->logger, CONTROL, "Initializing connection %s",name);
411
412 status = global_configuration_manager->get_local_host(global_configuration_manager, name, &(this->me.host));
413 if (status != SUCCESS)
414 {
415 this->logger->log(this->logger, ERROR | MORE, "Could not retrieve local host configuration information for %s",name);
416 return INVALID_ARG;
417 }
418
419 status = global_configuration_manager->get_remote_host(global_configuration_manager, name, &(this->other.host));
420 if (status != SUCCESS)
421 {
422 this->logger->log(this->logger, ERROR | MORE, "Could not retrieve remote host configuration information for %s",name);
423 return INVALID_ARG;
424 }
425
426 status = global_configuration_manager->get_dh_group_number(global_configuration_manager, name, &(this->ike_sa_init_data.dh_group_number), this->ike_sa_init_data.dh_group_priority);
427 if (status != SUCCESS)
428 {
429 this->logger->log(this->logger, ERROR | MORE, "Could not retrieve DH group number for %s",name);
430 return INVALID_ARG;
431 }
432
433 if (this->ike_sa_init_data.proposals->get_count(this->ike_sa_init_data.proposals) > 0)
434 {
435 this->logger->log(this->logger, ERROR, "Proposals allready existing!");
436 return FAILED;
437 }
438
439 status = this->ike_sa_init_data.proposals->create_iterator(this->ike_sa_init_data.proposals, &proposal_iterator, FALSE);
440 if (status != SUCCESS)
441 {
442 this->logger->log(this->logger, ERROR, "Fatal error: Could not create iterator on list for proposals");
443 return status;
444 }
445
446 status = global_configuration_manager->get_proposals_for_host(global_configuration_manager, this->other.host, proposal_iterator);
447 if (status != SUCCESS)
448 {
449 this->logger->log(this->logger, ERROR | MORE, "Could not retrieve Proposals for %s",name);
450 return status;
451 }
452 /* not needed anymore */
453 proposal_iterator->destroy(proposal_iterator);
454
455 if (this->ike_sa_init_data.diffie_hellman != NULL)
456 {
457 this->logger->log(this->logger, ERROR, "Object of type diffie_hellman_t already existing!");
458 return FAILED;
459 }
460 this ->logger->log(this->logger, CONTROL|MOST, "create diffie hellman object");
461 this->ike_sa_init_data.diffie_hellman = diffie_hellman_create(this->ike_sa_init_data.dh_group_number);
462 if (this->ike_sa_init_data.diffie_hellman == NULL)
463 {
464 this->logger->log(this->logger, ERROR, "Object of type diffie_hellman_t could not be created!");
465 return FAILED;
466 }
467
468 if (this->ike_sa_init_data.sent_nonce.ptr != NULL)
469 {
470 this->logger->log(this->logger, ERROR, "Nonce for IKE_SA_INIT phase already existing!");
471 return FAILED;
472 }
473
474 if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, NONCE_SIZE, &(this->ike_sa_init_data.sent_nonce)) != SUCCESS)
475 {
476 this->logger->log(this->logger, ERROR, "Could not create nonce!");
477 return OUT_OF_RES;
478 }
479
480
481 /* going to build message */
482 status = this->build_message(this, IKE_SA_INIT, TRUE, &message);
483 if (status != SUCCESS)
484 {
485 this->logger->log(this->logger, ERROR, "Could not build message");
486 return status;
487 }
488
489 /* build SA payload */
490 status = this->build_sa_payload(this, (sa_payload_t**)&payload);
491 if (status != SUCCESS)
492 {
493 this->logger->log(this->logger, ERROR, "Could not build SA payload");
494 message->destroy(message);
495 return status;
496 }
497
498 this ->logger->log(this->logger, CONTROL|MOST, "add SA payload to message");
499 status = message->add_payload(message, payload);
500 if (status != SUCCESS)
501 {
502 this->logger->log(this->logger, ERROR, "Could not add SA payload to message");
503 message->destroy(message);
504 return status;
505 }
506
507
508 /* build KE payload */
509 status = this->build_ke_payload(this,(ke_payload_t **) &payload);
510 if (status != SUCCESS)
511 {
512 this->logger->log(this->logger, ERROR, "Could not build KE payload");
513 message->destroy(message);
514 return status;
515 }
516
517 this ->logger->log(this->logger, CONTROL|MOST, "add KE payload to message");
518 status = message->add_payload(message, payload);
519 if (status != SUCCESS)
520 {
521 this->logger->log(this->logger, ERROR, "Could not add KE payload to message");
522 message->destroy(message);
523 return status;
524 }
525
526 /* build Nonce payload */
527 status = this->build_nonce_payload(this, (nonce_payload_t**)&payload);
528 if (status != SUCCESS)
529 {
530 this->logger->log(this->logger, ERROR, "Could not build NONCE payload");
531 message->destroy(message);
532 return status;
533 }
534
535 this ->logger->log(this->logger, CONTROL|MOST, "add nonce payload to message");
536 status = message->add_payload(message, payload);
537 if (status != SUCCESS)
538 {
539 this->logger->log(this->logger, ERROR, "Could not add nonce payload to message");
540 message->destroy(message);
541 return status;
542 }
543
544 /* generate packet */
545 this ->logger->log(this->logger, CONTROL|MOST, "generate packet from message");
546 status = message->generate(message, &packet);
547 if (status != SUCCESS)
548 {
549 this->logger->log(this->logger, ERROR, "Fatal error: could not generate packet from message");
550 message->destroy(message);
551 return status;
552 }
553
554 this ->logger->log(this->logger, CONTROL|MOST, "Add packet to global send queue");
555 status = global_send_queue->add(global_send_queue, packet);
556 if (status != SUCCESS)
557 {
558 this->logger->log(this->logger, ERROR, "Could not add packet to send queue");
559 message->destroy(message);
560 return status;
561 }
562
563 if ( this->last_requested_message != NULL)
564 {
565 /* destroy message */
566 this ->logger->log(this->logger, CONTROL|MOST, "Destroy stored last requested message");
567 this->last_requested_message->destroy(this->last_requested_message);
568 }
569
570 this->last_requested_message = message;
571
572 /* message counter can now be increased */
573 this->message_id_out++;
574
575 /* state has NOW changed :-) */
576 this ->logger->log(this->logger, CONTROL|MORE, "Change state of IKE_SA from %s to %s",mapping_find(ike_sa_state_m,this->state),mapping_find(ike_sa_state_m,IKE_SA_INIT_REQUESTED) );
577 this->state = IKE_SA_INIT_REQUESTED;
578
579 return SUCCESS;
580 }
581
582 static status_t transto_ike_sa_init_responded(private_ike_sa_t *this, message_t *request)
583 {
584 status_t status;
585 linked_list_iterator_t *payloads;
586 message_t *response;
587 host_t *source, *destination;
588 payload_t *payload;
589 packet_t *packet;
590
591 /* this is the first message we process, so copy host infos */
592 request->get_source(request, &source);
593 request->get_destination(request, &destination);
594 /* we need to clone them, since we destroy the message later */
595 destination->clone(destination, &(this->me.host));
596 source->clone(source, &(this->other.host));
597
598 /* parse incoming message */
599 status = request->parse_body(request);
600 if (status != SUCCESS)
601 {
602 this->logger->log(this->logger, ERROR | MORE, "Could not parse body of request message");
603 this->create_delete_job(this);
604 return status;
605 }
606
607 /* iterate over incoming payloads. We can be sure, the message contains only accepted payloads! */
608 status = request->get_payload_iterator(request, &payloads);
609 if (status != SUCCESS)
610 {
611 this->logger->log(this->logger, ERROR, "Fatal error: Could not get payload interator");
612 this->create_delete_job(this);
613 return status;
614 }
615
616 while (payloads->has_next(payloads))
617 {
618 payload_t *payload;
619
620 /* get current payload */
621 payloads->current(payloads, (void**)&payload);
622
623 this->logger->log(this->logger, CONTROL|MORE, "Processing payload of type %s", mapping_find(payload_type_m, payload->get_type(payload)));
624 switch (payload->get_type(payload))
625 {
626 case SECURITY_ASSOCIATION:
627 {
628 sa_payload_t *sa_payload = (sa_payload_t*)payload;
629 linked_list_iterator_t *suggested_proposals, *accepted_proposals;
630
631 status = this->ike_sa_init_data.proposals->create_iterator(this->ike_sa_init_data.proposals, &accepted_proposals, FALSE);
632 if (status != SUCCESS)
633 {
634 this->logger->log(this->logger, ERROR, "Fatal error: Could not create iterator on list for proposals");
635 payloads->destroy(payloads);
636 this->create_delete_job(this);
637 return status;
638 }
639
640 /* get the list of suggested proposals */
641 status = sa_payload->create_proposal_substructure_iterator(sa_payload, &suggested_proposals, TRUE);
642 if (status != SUCCESS)
643 {
644 this->logger->log(this->logger, ERROR, "Fatal error: Could not create iterator on suggested proposals");
645 accepted_proposals->destroy(accepted_proposals);
646 payloads->destroy(payloads);
647 this->create_delete_job(this);
648 return status;
649 }
650
651 /* now let the configuration-manager select a subset of the proposals */
652 status = global_configuration_manager->select_proposals_for_host(global_configuration_manager,
653 this->other.host, suggested_proposals, accepted_proposals);
654 if (status != SUCCESS)
655 {
656 this->logger->log(this->logger, CONTROL | MORE, "No proposal of suggested proposals selected");
657 suggested_proposals->destroy(suggested_proposals);
658 accepted_proposals->destroy(accepted_proposals);
659 payloads->destroy(payloads);
660 this->create_delete_job(this);
661 return status;
662 }
663
664 /* iterators are not needed anymore */
665 suggested_proposals->destroy(suggested_proposals);
666 accepted_proposals->destroy(accepted_proposals);
667
668 this->logger->log(this->logger, CONTROL | MORE, "SA Payload processed");
669 /* ok, we have what we need for sa_payload (proposals are stored in this->proposals)*/
670 break;
671 }
672 case KEY_EXCHANGE:
673 {
674 ke_payload_t *ke_payload = (ke_payload_t*)payload;
675 diffie_hellman_group_t group;
676 diffie_hellman_t *dh;
677 bool allowed_group;
678
679 group = ke_payload->get_dh_group_number(ke_payload);
680
681 status = global_configuration_manager->is_dh_group_allowed_for_host(global_configuration_manager,
682 this->other.host, group, &allowed_group);
683
684 if (status != SUCCESS)
685 {
686 this->logger->log(this->logger, ERROR | MORE, "Could not get informations about DH group");
687 payloads->destroy(payloads);
688 this->create_delete_job(this);
689 return status;
690 }
691 if (!allowed_group)
692 {
693 /** @todo Send info reply */
694 }
695
696 /* create diffie hellman object to handle DH exchange */
697 dh = diffie_hellman_create(group);
698 if (dh == NULL)
699 {
700 this->logger->log(this->logger, ERROR, "Could not generate DH object");
701 payloads->destroy(payloads);
702 this->create_delete_job(this);
703 return OUT_OF_RES;
704 }
705
706 this->logger->log(this->logger, CONTROL | MORE, "Set other DH public value");
707
708 status = dh->set_other_public_value(dh, ke_payload->get_key_exchange_data(ke_payload));
709 if (status != SUCCESS)
710 {
711 this->logger->log(this->logger, ERROR, "Could not set other DH public value");
712 dh->destroy(dh);
713 payloads->destroy(payloads);
714 this->create_delete_job(this);
715 return OUT_OF_RES;
716 }
717
718 if (this->ike_sa_init_data.diffie_hellman != NULL)
719 {
720 this->logger->log(this->logger, CONTROL | MORE, "Going to destroy allready existing diffie_hellman object");
721 this->ike_sa_init_data.diffie_hellman->destroy(this->ike_sa_init_data.diffie_hellman);
722 }
723 this->ike_sa_init_data.diffie_hellman = dh;
724
725 this->logger->log(this->logger, CONTROL | MORE, "KE Payload processed");
726 break;
727 }
728 case NONCE:
729 {
730 nonce_payload_t *nonce_payload = (nonce_payload_t*)payload;
731 chunk_t nonce;
732
733 this->logger->log(this->logger, CONTROL | MORE, "Get nonce value and store it");
734 nonce_payload->get_nonce(nonce_payload, &nonce);
735 /** @todo free if there is already one */
736 this->ike_sa_init_data.received_nonce.ptr = allocator_clone_bytes(nonce.ptr, nonce.len);
737 this->ike_sa_init_data.received_nonce.len = nonce.len;
738 if (this->ike_sa_init_data.received_nonce.ptr == NULL)
739 {
740 payloads->destroy(payloads);
741 this->create_delete_job(this);
742 return OUT_OF_RES;
743 }
744
745 this->logger->log(this->logger, CONTROL | MORE, "Nonce Payload processed");
746 break;
747 }
748 default:
749 {
750 this->logger->log(this->logger, ERROR | MORE, "Payload type not supported!");
751 payloads->destroy(payloads);
752 this->create_delete_job(this);
753 return OUT_OF_RES;
754 }
755
756 }
757
758 }
759 /* iterator can be destroyed */
760 payloads->destroy(payloads);
761
762 this->logger->log(this->logger, CONTROL | MORE, "Request successfully handled. Going to create reply.");
763
764
765 if (this->ike_sa_init_data.sent_nonce.ptr != NULL)
766 {
767 this->logger->log(this->logger, ERROR, "Nonce for IKE_SA_INIT phase already existing!");
768 return FAILED;
769 }
770
771 this->logger->log(this->logger, CONTROL | MOST, "Going to create nonce.");
772 if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, NONCE_SIZE, &(this->ike_sa_init_data.sent_nonce)) != SUCCESS)
773 {
774 this->logger->log(this->logger, ERROR, "Could not create nonce!");
775 return OUT_OF_RES;
776 }
777
778
779 /* set up the reply */
780 status = this->build_message(this, IKE_SA_INIT, FALSE, &response);
781 if (status != SUCCESS)
782 {
783 this->logger->log(this->logger, ERROR, "Could not create empty message");
784 this->create_delete_job(this);
785 return status;
786 }
787
788 /* build SA payload */
789 status = this->build_sa_payload(this, (sa_payload_t**)&payload);
790 if (status != SUCCESS)
791 {
792 this->logger->log(this->logger, ERROR, "Could not build SA payload");
793 this->create_delete_job(this);
794 response->destroy(response);
795 return status;
796 }
797
798 this ->logger->log(this->logger, CONTROL|MOST, "add SA payload to message");
799 status = response->add_payload(response, payload);
800 if (status != SUCCESS)
801 {
802 this->logger->log(this->logger, ERROR, "Could not add SA payload to message");
803 this->create_delete_job(this);
804 response->destroy(response);
805 return status;
806 }
807
808 /* build KE payload */
809 status = this->build_ke_payload(this,(ke_payload_t **) &payload);
810 if (status != SUCCESS)
811 {
812 this->logger->log(this->logger, ERROR, "Could not build KE payload");
813 this->create_delete_job(this);
814 response->destroy(response);
815 return status;
816 }
817
818 this ->logger->log(this->logger, CONTROL|MOST, "add KE payload to message");
819 status = response->add_payload(response, payload);
820 if (status != SUCCESS)
821 {
822 this->logger->log(this->logger, ERROR, "Could not add KE payload to message");
823 this->create_delete_job(this);
824 response->destroy(response);
825 return status;
826 }
827
828 /* build Nonce payload */
829 status = this->build_nonce_payload(this, (nonce_payload_t**)&payload);
830 if (status != SUCCESS)
831 {
832 this->logger->log(this->logger, ERROR, "Could not build NONCE payload");
833 this->create_delete_job(this);
834 response->destroy(response);
835 return status;
836 }
837
838 this ->logger->log(this->logger, CONTROL|MOST, "add nonce payload to message");
839 status = response->add_payload(response, payload);
840 if (status != SUCCESS)
841 {
842 this->logger->log(this->logger, ERROR, "Could not add nonce payload to message");
843 this->create_delete_job(this);
844 response->destroy(response);
845 return status;
846 }
847
848 /* generate packet */
849 this ->logger->log(this->logger, CONTROL|MOST, "generate packet from message");
850 status = response->generate(response, &packet);
851 if (status != SUCCESS)
852 {
853 this->logger->log(this->logger, ERROR, "Fatal error: could not generate packet from message");
854 this->create_delete_job(this);
855 response->destroy(response);
856 return status;
857 }
858
859 this ->logger->log(this->logger, CONTROL|MOST, "Add packet to global send queue");
860 status = global_send_queue->add(global_send_queue, packet);
861 if (status != SUCCESS)
862 {
863 this->logger->log(this->logger, ERROR, "Could not add packet to send queue");
864 this->create_delete_job(this);
865 response->destroy(response);
866 return status;
867 }
868
869 if ( this->last_responded_message != NULL)
870 {
871 /* destroy message */
872 this ->logger->log(this->logger, CONTROL|MOST, "Destroy stored last responded message");
873 this->last_responded_message->destroy(this->last_responded_message);
874 }
875
876 this->last_responded_message = response;
877
878 /* state has NOW changed :-) */
879 this ->logger->log(this->logger, CONTROL|MORE, "Change state of IKE_SA from %s to %s",mapping_find(ike_sa_state_m,this->state),mapping_find(ike_sa_state_m,IKE_SA_INIT_REQUESTED) );
880 this->state = IKE_SA_INIT_RESPONDED;
881
882
883 return SUCCESS;
884 }
885
886 static status_t transto_ike_auth_requested(private_ike_sa_t *this, message_t *response)
887 {
888 status_t status;
889 linked_list_iterator_t *payloads;
890
891
892 /* parse incoming message */
893 status = response->parse_body(response);
894 if (status != SUCCESS)
895 {
896 this->logger->log(this->logger, ERROR, "Could not parse body");
897 return status;
898 }
899 /* iterate over incoming payloads */
900 status = response->get_payload_iterator(response, &payloads);
901 if (status != SUCCESS)
902 {
903 response->destroy(response);
904 return status;
905 }
906 while (payloads->has_next(payloads))
907 {
908 payload_t *payload;
909 payloads->current(payloads, (void**)&payload);
910
911 this->logger->log(this->logger, CONTROL|MORE, "Processing payload %s", mapping_find(payload_type_m, payload->get_type(payload)));
912 switch (payload->get_type(payload))
913 {
914 // case SECURITY_ASSOCIATION:
915 // {
916 // sa_payload_t *sa_payload = (sa_payload_t*)payload;
917 // linked_list_iterator_t *suggested_proposals, *accepted_proposals;
918 // /* create a list for accepted proposals */
919 // if (this->ike_sa_init_data.proposals == NULL) {
920 // this->ike_sa_init_data.proposals = linked_list_create();
921 // }
922 // else
923 // {
924 // /** @todo destroy list contents */
925 // }
926 // if (this->ike_sa_init_data.proposals == NULL)
927 // {
928 // payloads->destroy(payloads);
929 // return OUT_OF_RES;
930 // }
931 // status = this->ike_sa_init_data.proposals->create_iterator(this->ike_sa_init_data.proposals, &accepted_proposals, FALSE);
932 // if (status != SUCCESS)
933 // {
934 // payloads->destroy(payloads);
935 // return status;
936 // }
937 //
938 // /* get the list of suggested proposals */
939 // status = sa_payload->create_proposal_substructure_iterator(sa_payload, &suggested_proposals, TRUE);
940 // if (status != SUCCESS)
941 // {
942 // accepted_proposals->destroy(accepted_proposals);
943 // payloads->destroy(payloads);
944 // return status;
945 // }
946 //
947 // /* now let the configuration-manager select a subset of the proposals */
948 // status = global_configuration_manager->select_proposals_for_host(global_configuration_manager,
949 // this->other.host, suggested_proposals, accepted_proposals);
950 // if (status != SUCCESS)
951 // {
952 // suggested_proposals->destroy(suggested_proposals);
953 // accepted_proposals->destroy(accepted_proposals);
954 // payloads->destroy(payloads);
955 // return status;
956 // }
957 //
958 // suggested_proposals->destroy(suggested_proposals);
959 // accepted_proposals->destroy(accepted_proposals);
960 //
961 // /* ok, we have what we need for sa_payload */
962 // break;
963 // }
964 case KEY_EXCHANGE:
965 {
966 ke_payload_t *ke_payload = (ke_payload_t*)payload;
967 diffie_hellman_t *dh;
968 chunk_t shared_secret;
969
970 dh = this->ike_sa_init_data.diffie_hellman;
971
972
973 status = dh->set_other_public_value(dh, ke_payload->get_key_exchange_data(ke_payload));
974 if (status != SUCCESS)
975 {
976 dh->destroy(dh);
977 payloads->destroy(payloads);
978 return OUT_OF_RES;
979 }
980
981 status = dh->get_shared_secret(dh, &shared_secret);
982
983 this->logger->log_chunk(this->logger, RAW, "Shared secret", &shared_secret);
984
985 break;
986 }
987 case NONCE:
988 {
989 nonce_payload_t *nonce_payload = (nonce_payload_t*)payload;
990 chunk_t nonce;
991
992 nonce_payload->get_nonce(nonce_payload, &nonce);
993 /** @todo free if there is already one */
994 this->ike_sa_init_data.received_nonce.ptr = allocator_clone_bytes(nonce.ptr, nonce.len);
995 this->ike_sa_init_data.received_nonce.len = nonce.len;
996 if (this->ike_sa_init_data.received_nonce.ptr == NULL)
997 {
998 payloads->destroy(payloads);
999 return OUT_OF_RES;
1000 }
1001 break;
1002 }
1003 default:
1004 {
1005 /** @todo handle */
1006 }
1007
1008 }
1009
1010 }
1011 payloads->destroy(payloads);
1012
1013 printf("done.\n");
1014
1015 /* set up the reply */
1016 status = this->build_message(this, IKE_SA_INIT, FALSE, &response);
1017 if (status != SUCCESS)
1018 {
1019 this->create_delete_job(this);
1020 return status;
1021 }
1022
1023 response->destroy(response);
1024
1025 return SUCCESS;
1026
1027
1028 }
1029
1030 /**
1031 * @brief implements function process_configuration of private_ike_sa_t
1032 */
1033 static status_t initialize_connection(private_ike_sa_t *this, char *name)
1034 {
1035 /* work is done in transto_ike_sa_init_requested */
1036 return (this->transto_ike_sa_init_requested(this,name));
1037 }
1038
1039 /**
1040 * @brief implements function private_ike_sa_t.get_id
1041 */
1042 static ike_sa_id_t* get_id(private_ike_sa_t *this)
1043 {
1044 return this->ike_sa_id;
1045 }
1046
1047 /**
1048 * implements private_ike_sa_t.build_sa_payload
1049 */
1050 static status_t build_sa_payload(private_ike_sa_t *this, sa_payload_t **payload)
1051 {
1052 sa_payload_t* sa_payload;
1053 linked_list_iterator_t *proposal_iterator;
1054 status_t status;
1055
1056
1057 /* SA payload takes proposals from this->ike_sa_init_data.proposals and writes them to the created sa_payload */
1058
1059 this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
1060
1061 status = this->ike_sa_init_data.proposals->create_iterator(this->ike_sa_init_data.proposals, &proposal_iterator, FALSE);
1062 if (status != SUCCESS)
1063 {
1064 this->logger->log(this->logger, ERROR, "Fatal error: Could not create iterator on list for proposals");
1065 return status;
1066 }
1067
1068 sa_payload = sa_payload_create();
1069 if (sa_payload == NULL)
1070 {
1071 this->logger->log(this->logger, ERROR, "Fatal error: Could not create SA payload object");
1072 return OUT_OF_RES;
1073 }
1074
1075 while (proposal_iterator->has_next(proposal_iterator))
1076 {
1077 proposal_substructure_t *current_proposal;
1078 proposal_substructure_t *current_proposal_clone;
1079 status = proposal_iterator->current(proposal_iterator,(void **) &current_proposal);
1080 if (status != SUCCESS)
1081 {
1082 this->logger->log(this->logger, ERROR, "Could not get current proposal needed to copy");
1083 sa_payload->destroy(sa_payload);
1084 return status;
1085 }
1086 status = current_proposal->clone(current_proposal,&current_proposal_clone);
1087 if (status != SUCCESS)
1088 {
1089 this->logger->log(this->logger, ERROR, "Could not clone current proposal");
1090 sa_payload->destroy(sa_payload);
1091 return status;
1092 }
1093
1094 status = sa_payload->add_proposal_substructure(sa_payload,current_proposal_clone);
1095 if (status != SUCCESS)
1096 {
1097 this->logger->log(this->logger, ERROR, "Could not add cloned proposal to SA payload");
1098 sa_payload->destroy(sa_payload);
1099 return status;
1100 }
1101
1102 }
1103
1104 this->logger->log(this->logger, CONTROL|MORE, "sa payload buildet");
1105
1106 *payload = sa_payload;
1107
1108 return SUCCESS;
1109 }
1110
1111 static status_t build_ke_payload(private_ike_sa_t *this, ke_payload_t **payload)
1112 {
1113 ke_payload_t *ke_payload;
1114 chunk_t key_data;
1115 status_t status;
1116
1117 this->logger->log(this->logger, CONTROL|MORE, "building ke payload");
1118
1119 if (this->state != NO_STATE)
1120 {
1121 this->logger->log(this->logger, ERROR, "KE payload in state %s not supported",mapping_find(ike_sa_state_m,this->state));
1122 return FALSE;
1123 }
1124
1125 switch(this->ike_sa_id->is_initiator(this->ike_sa_id))
1126 {
1127 case TRUE:
1128 case FALSE:
1129 {
1130 this ->logger->log(this->logger, CONTROL|MORE, "get public dh value to send in ke payload");
1131 status = this->ike_sa_init_data.diffie_hellman->get_my_public_value(this->ike_sa_init_data.diffie_hellman,&key_data);
1132 if (status != SUCCESS)
1133 {
1134 this->logger->log(this->logger, ERROR, "Could not get my DH public value");
1135 return status;
1136 }
1137
1138 ke_payload = ke_payload_create();
1139 if (ke_payload == NULL)
1140 {
1141 this->logger->log(this->logger, ERROR, "Could not create KE payload");
1142 allocator_free_chunk(key_data);
1143 return OUT_OF_RES;
1144 }
1145 ke_payload->set_dh_group_number(ke_payload, MODP_1024_BIT);
1146 if (ke_payload->set_key_exchange_data(ke_payload, key_data) != SUCCESS)
1147 {
1148 this->logger->log(this->logger, ERROR, "Could not set key exchange data of KE payload");
1149 ke_payload->destroy(ke_payload);
1150 allocator_free_chunk(key_data);
1151 return OUT_OF_RES;
1152 }
1153 allocator_free_chunk(key_data);
1154
1155 *payload = ke_payload;
1156 return SUCCESS;
1157 }
1158 }
1159
1160 return FAILED;
1161 }
1162
1163 /**
1164 * implements private_ike_sa_t.build_nonce_payload
1165 */
1166 static status_t build_nonce_payload(private_ike_sa_t *this, nonce_payload_t **payload)
1167 {
1168 nonce_payload_t *nonce_payload;
1169 status_t status;
1170
1171 this->logger->log(this->logger, CONTROL|MORE, "building nonce payload");
1172
1173 if (this->state != NO_STATE)
1174 {
1175 this->logger->log(this->logger, ERROR, "Nonce payload in state %s not supported",mapping_find(ike_sa_state_m,this->state));
1176 return FALSE;
1177 }
1178
1179 nonce_payload = nonce_payload_create();
1180 if (nonce_payload == NULL)
1181 {
1182 this->logger->log(this->logger, ERROR, "Fatal error: could not create nonce payload object");
1183 return OUT_OF_RES;
1184 }
1185
1186 status = nonce_payload->set_nonce(nonce_payload, this->ike_sa_init_data.sent_nonce);
1187
1188 if (status != SUCCESS)
1189 {
1190 this->logger->log(this->logger, ERROR, "Fatal error: could not set nonce data of payload");
1191 nonce_payload->destroy(nonce_payload);
1192 return status;
1193 }
1194
1195 *payload = nonce_payload;
1196
1197 return SUCCESS;
1198 }
1199
1200 /**
1201 * @brief implements function resend_last_reply of private_ike_sa_t
1202 */
1203 status_t resend_last_reply (private_ike_sa_t *this)
1204 {
1205 packet_t *packet;
1206 status_t status;
1207
1208 status = this->last_responded_message->generate(this->last_responded_message, &packet);
1209 if (status != SUCCESS)
1210 {
1211 this->logger->log(this->logger, ERROR, "Could not generate message to resent");
1212 return status;
1213 }
1214
1215 status = global_send_queue->add(global_send_queue, packet);
1216 if (status != SUCCESS)
1217 {
1218 this->logger->log(this->logger, ERROR, "Could not add packet to send queue");
1219 packet->destroy(packet);
1220 return status;
1221 }
1222 return SUCCESS;
1223 }
1224
1225 status_t create_delete_job (private_ike_sa_t *this)
1226 {
1227 job_t *delete_job;
1228 status_t status;
1229
1230 this->logger->log(this->logger, CONTROL | MORE, "Going to create job to delete this IKE_SA");
1231
1232 delete_job = (job_t *) delete_ike_sa_job_create(this->ike_sa_id);
1233 if (delete_job == NULL)
1234 {
1235 this->logger->log(this->logger, ERROR, "Job to delete IKE SA could not be created");
1236 return FAILED;
1237 }
1238
1239 status = global_job_queue->add(global_job_queue,delete_job);
1240 if (status != SUCCESS)
1241 {
1242 this->logger->log(this->logger, ERROR, "%s Job to delete IKE SA could not be added to job queue",mapping_find(status_m,status));
1243 delete_job->destroy_all(delete_job);
1244 return status;
1245 }
1246 return SUCCESS;
1247 }
1248
1249 /**
1250 * @brief implements function destroy of private_ike_sa_t
1251 */
1252 static status_t destroy (private_ike_sa_t *this)
1253 {
1254
1255 this->logger->log(this->logger, CONTROL | MORE, "Going to destroy IKE_SA");
1256
1257 /* destroy child sa's */
1258 this->logger->log(this->logger, CONTROL | MOST, "Destroy all child_sa's");
1259 while (this->child_sas->get_count(this->child_sas) > 0)
1260 {
1261 void *child_sa;
1262 if (this->child_sas->remove_first(this->child_sas,&child_sa) != SUCCESS)
1263 {
1264 break;
1265 }
1266 /* destroy child sa */
1267 }
1268 this->child_sas->destroy(this->child_sas);
1269
1270 /* destroy ike_sa_id */
1271 this->logger->log(this->logger, CONTROL | MOST, "Destroy assigned ike_sa_id");
1272 this->ike_sa_id->destroy(this->ike_sa_id);
1273
1274 /* destroy stored requested message */
1275 if (this->last_requested_message != NULL)
1276 {
1277 this->logger->log(this->logger, CONTROL | MOST, "Destroy last requested message");
1278 this->last_requested_message->destroy(this->last_requested_message);
1279 }
1280
1281 /* destroy stored responded messages */
1282 if (this->last_responded_message != NULL)
1283 {
1284 this->logger->log(this->logger, CONTROL | MOST, "Destroy last responded message");
1285 this->last_responded_message->destroy(this->last_responded_message);
1286 }
1287
1288 /* destroy stored proposal */
1289 this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
1290 while (this->ike_sa_init_data.proposals->get_count(this->ike_sa_init_data.proposals) > 0)
1291 {
1292 proposal_substructure_t *current_proposal;
1293 this->ike_sa_init_data.proposals->remove_first(this->ike_sa_init_data.proposals,(void **)&current_proposal);
1294 current_proposal->destroy(current_proposal);
1295 }
1296 this->ike_sa_init_data.proposals->destroy(this->ike_sa_init_data.proposals);
1297
1298
1299 this->logger->log(this->logger, CONTROL | MOST, "Destroy randomizer");
1300 this->randomizer->destroy(this->randomizer);
1301
1302
1303 /* destroy ike_sa_init data */
1304 this->logger->log(this->logger, CONTROL | MOST, "Going to destroy ike_sa_init data");
1305 if (this->ike_sa_init_data.diffie_hellman != NULL)
1306 {
1307 this->logger->log(this->logger, CONTROL | MOST, "Destroy diffie hellman object");
1308 this->ike_sa_init_data.diffie_hellman->destroy(this->ike_sa_init_data.diffie_hellman);
1309 }
1310 if (this->ike_sa_init_data.sent_nonce.ptr != NULL)
1311 {
1312 this->logger->log(this->logger, CONTROL | MOST, "Destroy sent nonce data");
1313 allocator_free_chunk(this->ike_sa_init_data.sent_nonce);
1314 }
1315 if (this->ike_sa_init_data.received_nonce.ptr != NULL)
1316 {
1317 this->logger->log(this->logger, CONTROL | MOST, "Destroy received nonce data");
1318 allocator_free_chunk(this->ike_sa_init_data.received_nonce);
1319 }
1320
1321 if (this->me.host != NULL)
1322 {
1323 this->logger->log(this->logger, CONTROL | MOST, "Destroy host informations of me");
1324 this->me.host->destroy(this->me.host);
1325 }
1326
1327 if (this->other.host != NULL)
1328 {
1329 this->logger->log(this->logger, CONTROL | MOST, "Destroy host informations of other");
1330 this->other.host->destroy(this->other.host);
1331 }
1332
1333
1334 this->logger->log(this->logger, CONTROL | MOST, "Destroy logger of IKE_SA");
1335 global_logger_manager->destroy_logger(global_logger_manager, this->logger);
1336
1337 allocator_free(this);
1338 return SUCCESS;
1339 }
1340
1341 /*
1342 * Described in Header
1343 */
1344 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
1345 {
1346 private_ike_sa_t *this = allocator_alloc_thing(private_ike_sa_t);
1347 if (this == NULL)
1348 {
1349 return NULL;
1350 }
1351
1352 /* Public functions */
1353 this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
1354 this->public.initialize_connection = (status_t(*)(ike_sa_t*, char*)) initialize_connection;
1355 this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
1356 this->public.destroy = (status_t(*)(ike_sa_t*))destroy;
1357
1358 /* private functions */
1359 this->build_sa_payload = build_sa_payload;
1360 this->build_nonce_payload = build_nonce_payload;
1361 this->build_ke_payload = build_ke_payload;
1362 this->build_message = build_message;
1363 this->transto_ike_sa_init_requested = transto_ike_sa_init_requested;
1364 this->transto_ike_sa_init_responded = transto_ike_sa_init_responded;
1365 this->transto_ike_auth_requested = transto_ike_auth_requested;
1366 this->resend_last_reply = resend_last_reply;
1367 this->create_delete_job = create_delete_job;
1368
1369
1370 /* initialize private fields */
1371 this->logger = global_logger_manager->create_logger(global_logger_manager, IKE_SA, NULL);
1372 if (this->logger == NULL)
1373 {
1374 allocator_free(this);
1375 }
1376
1377 if (ike_sa_id->clone(ike_sa_id,&(this->ike_sa_id)) != SUCCESS)
1378 {
1379 this->logger->log(this->logger, ERROR, "Fatal error: Could not clone ike_sa_id");
1380 global_logger_manager->destroy_logger(global_logger_manager,this->logger);
1381 allocator_free(this);
1382 return NULL;
1383 }
1384 this->child_sas = linked_list_create();
1385 if (this->child_sas == NULL)
1386 {
1387 this->logger->log(this->logger, ERROR, "Fatal error: Could not create list for child_sa's");
1388 this->ike_sa_id->destroy(this->ike_sa_id);
1389 global_logger_manager->destroy_logger(global_logger_manager,this->logger);
1390 allocator_free(this);
1391 return NULL;
1392 }
1393 this->randomizer = randomizer_create();
1394 if (this->randomizer == NULL)
1395 {
1396 this->logger->log(this->logger, ERROR, "Fatal error: Could not create list for child_sa's");
1397 this->child_sas->destroy(this->child_sas);
1398 this->ike_sa_id->destroy(this->ike_sa_id);
1399 global_logger_manager->destroy_logger(global_logger_manager,this->logger);
1400 allocator_free(this);
1401 }
1402
1403 this->me.host = NULL;
1404 this->other.host = NULL;
1405 this->ike_sa_init_data.diffie_hellman = NULL;
1406 this->ike_sa_init_data.dh_group_number = 0;
1407 /* 1 means highest priority */
1408 this->ike_sa_init_data.dh_group_priority = 1;
1409 this->ike_sa_init_data.sent_nonce.len = 0;
1410 this->ike_sa_init_data.sent_nonce.ptr = NULL;
1411 this->ike_sa_init_data.received_nonce.len = 0;
1412 this->ike_sa_init_data.received_nonce.ptr = NULL;
1413 this->ike_sa_init_data.proposals = linked_list_create();
1414 if (this->ike_sa_init_data.proposals == NULL)
1415 {
1416 this->logger->log(this->logger, ERROR, "Fatal error: Could not create list for child_sa's");
1417 this->child_sas->destroy(this->child_sas);
1418 this->ike_sa_id->destroy(this->ike_sa_id);
1419 this->randomizer->destroy(this->randomizer);
1420 global_logger_manager->destroy_logger(global_logger_manager,this->logger);
1421 allocator_free(this);
1422 }
1423 this->last_requested_message = NULL;
1424 this->last_responded_message = NULL;
1425 this->message_id_out = 0;
1426 this->message_id_in = 0;
1427
1428
1429 /* at creation time, IKE_SA isn't in a specific state */
1430 this->state = NO_STATE;
1431
1432 return (&this->public);
1433 }
strongSwan - IPsec VPN