4 * @brief Implementation of ike_sa_t.
9 * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
10 * Copyright (C) 2005-2006 Martin Willi
11 * Copyright (C) 2005 Jan Hutter
12 * Hochschule fuer Technik Rapperswil
14 * This program is free software; you can redistribute it and/or modify it
15 * under the terms of the GNU General Public License as published by the
16 * Free Software Foundation; either version 2 of the License, or (at your
17 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
19 * This program is distributed in the hope that it will be useful, but
20 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
21 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
34 #include <utils/linked_list.h>
35 #include <utils/lexparser.h>
36 #include <crypto/diffie_hellman.h>
37 #include <crypto/prf_plus.h>
38 #include <crypto/crypters/crypter.h>
39 #include <crypto/hashers/hasher.h>
40 #include <encoding/payloads/sa_payload.h>
41 #include <encoding/payloads/nonce_payload.h>
42 #include <encoding/payloads/ke_payload.h>
43 #include <encoding/payloads/delete_payload.h>
44 #include <encoding/payloads/transform_substructure.h>
45 #include <encoding/payloads/transform_attribute.h>
46 #include <encoding/payloads/ts_payload.h>
47 #include <sa/task_manager.h>
48 #include <sa/tasks/ike_init.h>
49 #include <sa/tasks/ike_natd.h>
50 #include <sa/tasks/ike_auth.h>
51 #include <sa/tasks/ike_config.h>
52 #include <sa/tasks/ike_cert.h>
53 #include <sa/tasks/ike_rekey.h>
54 #include <sa/tasks/ike_delete.h>
55 #include <sa/tasks/ike_dpd.h>
56 #include <sa/tasks/child_create.h>
57 #include <sa/tasks/child_delete.h>
58 #include <sa/tasks/child_rekey.h>
59 #include <queues/jobs/retransmit_job.h>
60 #include <queues/jobs/delete_ike_sa_job.h>
61 #include <queues/jobs/send_dpd_job.h>
62 #include <queues/jobs/send_keepalive_job.h>
63 #include <queues/jobs/rekey_ike_sa_job.h>
64 #include <queues/jobs/route_job.h>
65 #include <queues/jobs/initiate_job.h>
69 #define RESOLV_CONF "/etc/resolv.conf"
72 ENUM(ike_sa_state_names
, IKE_CREATED
, IKE_DELETING
,
80 typedef struct private_ike_sa_t private_ike_sa_t
;
83 * Private data of an ike_sa_t object.
85 struct private_ike_sa_t
{
93 * Identifier for the current IKE_SA.
95 ike_sa_id_t
*ike_sa_id
;
98 * unique numerical ID for this IKE_SA.
103 * Current state of the IKE_SA
105 ike_sa_state_t state
;
108 * connection used to establish this IKE_SA.
110 connection_t
*connection
;
113 * Peer and authentication information to establish IKE_SA.
118 * Juggles tasks to process messages
120 task_manager_t
*task_manager
;
123 * Address of local host
128 * Address of remote host
133 * Identification used for us
135 identification_t
*my_id
;
138 * Identification used for other
140 identification_t
*other_id
;
143 * Linked List containing the child sa's of the current IKE_SA.
145 linked_list_t
*child_sas
;
148 * crypter for inbound traffic
150 crypter_t
*crypter_in
;
153 * crypter for outbound traffic
155 crypter_t
*crypter_out
;
158 * Signer for inbound traffic
163 * Signer for outbound traffic
165 signer_t
*signer_out
;
168 * Multi purpose prf, set key, use it, forget it
173 * Prf function for derivating keymat child SAs
178 * PRF to build outging authentication data
183 * PRF to verify incoming authentication data
188 * NAT status of local host.
193 * NAT status of remote host.
198 * Virtual IP on local host, if any
200 host_t
*my_virtual_ip
;
203 * Virtual IP on remote host, if any
205 host_t
*other_virtual_ip
;
208 * List of DNS servers installed by us
210 linked_list_t
*dns_servers
;
213 * Timestamps for this IKE_SA
216 /** last IKE message received */
218 /** last IKE message sent */
220 /** when IKE_SA became established */
221 u_int32_t established
;
222 /** when IKE_SA gets rekeyed */
224 /** when IKE_SA gets deleted */
229 * how many times we have retried so far (keyingtries)
235 * get the time of the latest traffic processed by the kernel
237 static time_t get_use_time(private_ike_sa_t
* this, bool inbound
)
239 iterator_t
*iterator
;
240 child_sa_t
*child_sa
;
241 time_t latest
= 0, use_time
;
243 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
244 while (iterator
->iterate(iterator
, (void**)&child_sa
))
246 if (child_sa
->get_use_time(child_sa
, inbound
, &use_time
) == SUCCESS
)
248 latest
= max(latest
, use_time
);
251 iterator
->destroy(iterator
);
255 return max(this->time
.inbound
, latest
);
259 return max(this->time
.outbound
, latest
);
264 * Implementation of ike_sa_t.get_unique_id
266 static u_int32_t
get_unique_id(private_ike_sa_t
*this)
268 return this->unique_id
;
272 * Implementation of ike_sa_t.get_name.
274 static char *get_name(private_ike_sa_t
*this)
276 if (this->connection
)
278 return this->connection
->get_name(this->connection
);
284 * Implementation of ike_sa_t.get_connection
286 static connection_t
* get_connection(private_ike_sa_t
*this)
288 return this->connection
;
292 * Implementation of ike_sa_t.set_connection
294 static void set_connection(private_ike_sa_t
*this, connection_t
*connection
)
296 this->connection
= connection
;
297 connection
->get_ref(connection
);
301 * Implementation of ike_sa_t.get_policy
303 static policy_t
*get_policy(private_ike_sa_t
*this)
309 * Implementation of ike_sa_t.set_policy
311 static void set_policy(private_ike_sa_t
*this, policy_t
*policy
)
313 policy
->get_ref(policy
);
314 this->policy
= policy
;
318 * Implementation of ike_sa_t.get_my_host.
320 static host_t
*get_my_host(private_ike_sa_t
*this)
322 return this->my_host
;
326 * Implementation of ike_sa_t.set_my_host.
328 static void set_my_host(private_ike_sa_t
*this, host_t
*me
)
330 DESTROY_IF(this->my_host
);
335 * Implementation of ike_sa_t.get_other_host.
337 static host_t
*get_other_host(private_ike_sa_t
*this)
339 return this->other_host
;
343 * Implementation of ike_sa_t.set_other_host.
345 static void set_other_host(private_ike_sa_t
*this, host_t
*other
)
347 DESTROY_IF(this->other_host
);
348 this->other_host
= other
;
352 * Implementation of ike_sa_t.send_dpd
354 static status_t
send_dpd(private_ike_sa_t
*this)
359 delay
= this->connection
->get_dpd_delay(this->connection
);
367 if (this->task_manager
->busy(this->task_manager
))
369 /* an exchange is in the air, no need to start a DPD check */
374 /* check if there was any inbound traffic */
376 last_in
= get_use_time(this, TRUE
);
378 diff
= now
- last_in
;
381 /* to long ago, initiate dead peer detection */
384 task
= (task_t
*)ike_dpd_create(TRUE
);
386 DBG1(DBG_IKE
, "sending DPD request");
388 this->task_manager
->queue_task(this->task_manager
, task
);
389 this->task_manager
->initiate(this->task_manager
);
392 /* recheck in "interval" seconds */
393 job
= send_dpd_job_create(this->ike_sa_id
);
394 charon
->event_queue
->add_relative(charon
->event_queue
, (job_t
*)job
,
395 (delay
- diff
) * 1000);
400 * Implementation of ike_sa_t.send_keepalive
402 static void send_keepalive(private_ike_sa_t
*this)
404 send_keepalive_job_t
*job
;
405 time_t last_out
, now
, diff
, interval
;
407 last_out
= get_use_time(this, FALSE
);
410 diff
= now
- last_out
;
411 interval
= charon
->configuration
->get_keepalive_interval(charon
->configuration
);
413 if (diff
>= interval
)
418 packet
= packet_create();
419 packet
->set_source(packet
, this->my_host
->clone(this->my_host
));
420 packet
->set_destination(packet
, this->other_host
->clone(this->other_host
));
421 data
.ptr
= malloc(1);
424 packet
->set_data(packet
, data
);
425 charon
->send_queue
->add(charon
->send_queue
, packet
);
426 DBG1(DBG_IKE
, "sending keep alive");
429 job
= send_keepalive_job_create(this->ike_sa_id
);
430 charon
->event_queue
->add_relative(charon
->event_queue
, (job_t
*)job
,
431 (interval
- diff
) * 1000);
435 * Implementation of ike_sa_t.get_state.
437 static ike_sa_state_t
get_state(private_ike_sa_t
*this)
443 * Implementation of ike_sa_t.set_state.
445 static void set_state(private_ike_sa_t
*this, ike_sa_state_t state
)
447 DBG1(DBG_IKE
, "IKE_SA state change: %N => %N",
448 ike_sa_state_names
, this->state
,
449 ike_sa_state_names
, state
);
453 case IKE_ESTABLISHED
:
455 if (this->state
== IKE_CONNECTING
)
458 u_int32_t now
= time(NULL
);
459 u_int32_t soft
, hard
;
462 this->time
.established
= now
;
463 /* start DPD checks */
466 /* schedule rekeying/reauthentication */
467 soft
= this->connection
->get_soft_lifetime(this->connection
);
468 hard
= this->connection
->get_hard_lifetime(this->connection
);
469 reauth
= this->connection
->get_reauth(this->connection
);
470 DBG1(DBG_IKE
, "scheduling %s in %ds, maximum lifetime %ds",
471 reauth ?
"reauthentication": "rekeying", soft
, hard
);
475 this->time
.rekey
= now
+ soft
;
476 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, reauth
);
477 charon
->event_queue
->add_relative(charon
->event_queue
, job
,
483 this->time
.delete = now
+ hard
;
484 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
485 charon
->event_queue
->add_relative(charon
->event_queue
, job
,
493 /* delete may fail if a packet gets lost, so set a timeout */
494 job_t
*job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
495 charon
->event_queue
->add_relative(charon
->event_queue
, job
,
496 charon
->configuration
->get_half_open_ike_sa_timeout(
497 charon
->configuration
));
508 * Implementation of ike_sa_t.reset
510 static void reset(private_ike_sa_t
*this)
512 /* the responder ID is reset, as peer may choose another one */
513 if (this->ike_sa_id
->is_initiator(this->ike_sa_id
))
515 this->ike_sa_id
->set_responder_spi(this->ike_sa_id
, 0);
518 set_state(this, IKE_CREATED
);
520 this->task_manager
->reset(this->task_manager
);
524 * Update connection host, as addresses may change (NAT)
526 static void update_hosts(private_ike_sa_t
*this, host_t
*me
, host_t
*other
)
528 iterator_t
*iterator
= NULL
;
529 child_sa_t
*child_sa
= NULL
;
530 host_diff_t my_diff
, other_diff
;
532 if (this->my_host
->is_anyaddr(this->my_host
) ||
533 this->other_host
->is_anyaddr(this->other_host
))
535 /* on first received message */
536 this->my_host
->destroy(this->my_host
);
537 this->my_host
= me
->clone(me
);
538 this->other_host
->destroy(this->other_host
);
539 this->other_host
= other
->clone(other
);
543 my_diff
= me
->get_differences(me
, this->my_host
);
544 other_diff
= other
->get_differences(other
, this->other_host
);
546 if (!my_diff
&& !other_diff
)
553 this->my_host
->destroy(this->my_host
);
554 this->my_host
= me
->clone(me
);
559 /* update without restrictions if we are not NATted */
562 this->other_host
->destroy(this->other_host
);
563 this->other_host
= other
->clone(other
);
568 /* if we are natted, only port may change */
569 if (other_diff
& HOST_DIFF_ADDR
)
573 else if (other_diff
& HOST_DIFF_PORT
)
575 this->other_host
->set_port(this->other_host
, other
->get_port(other
));
578 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
579 while (iterator
->iterate(iterator
, (void**)&child_sa
))
581 child_sa
->update_hosts(child_sa
, this->my_host
, this->other_host
,
582 my_diff
, other_diff
);
584 iterator
->destroy(iterator
);
588 * Implementation of ike_sa_t.generate
590 static status_t
generate_message(private_ike_sa_t
*this, message_t
*message
,
593 this->time
.outbound
= time(NULL
);
594 message
->set_ike_sa_id(message
, this->ike_sa_id
);
595 message
->set_destination(message
, this->other_host
->clone(this->other_host
));
596 message
->set_source(message
, this->my_host
->clone(this->my_host
));
597 return message
->generate(message
, this->crypter_out
, this->signer_out
, packet
);
601 * send a notify back to the sender
603 static void send_notify_response(private_ike_sa_t
*this, message_t
*request
,
609 response
= message_create();
610 response
->set_exchange_type(response
, request
->get_exchange_type(request
));
611 response
->set_request(response
, FALSE
);
612 response
->set_message_id(response
, request
->get_message_id(request
));
613 response
->add_notify(response
, FALSE
, type
, chunk_empty
);
614 if (this->my_host
->is_anyaddr(this->my_host
))
616 this->my_host
->destroy(this->my_host
);
617 this->my_host
= request
->get_destination(request
);
618 this->my_host
= this->my_host
->clone(this->my_host
);
620 if (this->other_host
->is_anyaddr(this->other_host
))
622 this->other_host
->destroy(this->other_host
);
623 this->other_host
= request
->get_source(request
);
624 this->other_host
= this->other_host
->clone(this->other_host
);
626 if (generate_message(this, response
, &packet
) == SUCCESS
)
628 charon
->send_queue
->add(charon
->send_queue
, packet
);
630 response
->destroy(response
);
634 * Implementation of ike_sa_t.process_message.
636 static status_t
process_message(private_ike_sa_t
*this, message_t
*message
)
641 is_request
= message
->get_request(message
);
643 status
= message
->parse_body(message
, this->crypter_in
, this->signer_in
);
644 if (status
!= SUCCESS
)
652 DBG1(DBG_IKE
, "ciritcal unknown payloads found");
655 send_notify_response(this, message
, UNSUPPORTED_CRITICAL_PAYLOAD
);
659 DBG1(DBG_IKE
, "message parsing failed");
662 send_notify_response(this, message
, INVALID_SYNTAX
);
666 DBG1(DBG_IKE
, "message verification failed");
669 send_notify_response(this, message
, INVALID_SYNTAX
);
673 DBG1(DBG_IKE
, "integrity check failed");
677 DBG1(DBG_IKE
, "found encrypted message, but no keys available");
680 send_notify_response(this, message
, INVALID_SYNTAX
);
686 DBG1(DBG_IKE
, "%N %s with message ID %d processing failed",
687 exchange_type_names
, message
->get_exchange_type(message
),
688 message
->get_request(message
) ?
"request" : "response",
689 message
->get_message_id(message
));
696 me
= message
->get_destination(message
);
697 other
= message
->get_source(message
);
699 /* if this IKE_SA is virgin, we check for a connection */
700 if (this->connection
== NULL
)
703 this->connection
= charon
->connections
->get_connection_by_hosts(
704 charon
->connections
, me
, other
);
705 if (this->connection
== NULL
)
707 /* no connection found for these hosts, destroy */
708 DBG1(DBG_IKE
, "no connection found for %H...%H, sending %N",
709 me
, other
, notify_type_names
, NO_PROPOSAL_CHOSEN
);
710 send_notify_response(this, message
, NO_PROPOSAL_CHOSEN
);
713 /* add a timeout if peer does not establish it completely */
714 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, FALSE
);
715 charon
->event_queue
->add_relative(charon
->event_queue
, job
,
716 charon
->configuration
->get_half_open_ike_sa_timeout(
717 charon
->configuration
));
720 /* check if message is trustworthy, and update connection information */
721 if (this->state
== IKE_CREATED
||
722 message
->get_exchange_type(message
) != IKE_SA_INIT
)
724 update_hosts(this, me
, other
);
725 this->time
.inbound
= time(NULL
);
727 return this->task_manager
->process_message(this->task_manager
, message
);
732 * apply the connection/policy information to this IKE_SA
734 static void apply_config(private_ike_sa_t
*this,
735 connection_t
*connection
, policy_t
*policy
)
738 identification_t
*my_id
, *other_id
;
740 if (this->connection
== NULL
&& this->policy
== NULL
)
742 this->connection
= connection
;
743 connection
->get_ref(connection
);
744 this->policy
= policy
;
745 policy
->get_ref(policy
);
747 me
= connection
->get_my_host(connection
);
748 other
= connection
->get_other_host(connection
);
749 my_id
= policy
->get_my_id(policy
);
750 other_id
= policy
->get_other_id(policy
);
751 set_my_host(this, me
->clone(me
));
752 set_other_host(this, other
->clone(other
));
753 DESTROY_IF(this->my_id
);
754 DESTROY_IF(this->other_id
);
755 this->my_id
= my_id
->clone(my_id
);
756 this->other_id
= other_id
->clone(other_id
);
761 * Implementation of ike_sa_t.initiate.
763 static status_t
initiate(private_ike_sa_t
*this,
764 connection_t
*connection
, policy_t
*policy
)
768 if (this->state
== IKE_CREATED
)
770 /* if we aren't established/establishing, do so */
771 apply_config(this, connection
, policy
);
773 if (this->other_host
->is_anyaddr(this->other_host
))
775 SIG(IKE_UP_START
, "initiating IKE_SA");
776 SIG(IKE_UP_FAILED
, "unable to initiate to %%any");
780 task
= (task_t
*)ike_init_create(&this->public, TRUE
, NULL
);
781 this->task_manager
->queue_task(this->task_manager
, task
);
782 task
= (task_t
*)ike_natd_create(&this->public, TRUE
);
783 this->task_manager
->queue_task(this->task_manager
, task
);
784 task
= (task_t
*)ike_cert_create(&this->public, TRUE
);
785 this->task_manager
->queue_task(this->task_manager
, task
);
786 task
= (task_t
*)ike_auth_create(&this->public, TRUE
);
787 this->task_manager
->queue_task(this->task_manager
, task
);
788 task
= (task_t
*)ike_config_create(&this->public, policy
);
789 this->task_manager
->queue_task(this->task_manager
, task
);
792 task
= (task_t
*)child_create_create(&this->public, policy
);
793 this->task_manager
->queue_task(this->task_manager
, task
);
795 return this->task_manager
->initiate(this->task_manager
);
799 * Implementation of ike_sa_t.acquire.
801 static status_t
acquire(private_ike_sa_t
*this, u_int32_t reqid
)
804 iterator_t
*iterator
;
805 child_sa_t
*current
, *child_sa
= NULL
;
807 child_create_t
*child_create
;
809 if (this->state
== IKE_DELETING
)
811 SIG(CHILD_UP_START
, "acquiring CHILD_SA on kernel request");
812 SIG(CHILD_UP_FAILED
, "acquiring CHILD_SA (reqid %d) failed: "
813 "IKE_SA is deleting", reqid
);
818 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
819 while (iterator
->iterate(iterator
, (void**)¤t
))
821 if (current
->get_reqid(current
) == reqid
)
827 iterator
->destroy(iterator
);
830 SIG(CHILD_UP_START
, "acquiring CHILD_SA on kernel request");
831 SIG(CHILD_UP_FAILED
, "acquiring CHILD_SA (reqid %d) failed: "
832 "CHILD_SA not found", reqid
);
836 policy
= child_sa
->get_policy(child_sa
);
838 if (this->state
== IKE_CREATED
)
840 task
= (task_t
*)ike_init_create(&this->public, TRUE
, NULL
);
841 this->task_manager
->queue_task(this->task_manager
, task
);
842 task
= (task_t
*)ike_natd_create(&this->public, TRUE
);
843 this->task_manager
->queue_task(this->task_manager
, task
);
844 task
= (task_t
*)ike_cert_create(&this->public, TRUE
);
845 this->task_manager
->queue_task(this->task_manager
, task
);
846 task
= (task_t
*)ike_auth_create(&this->public, TRUE
);
847 this->task_manager
->queue_task(this->task_manager
, task
);
848 task
= (task_t
*)ike_config_create(&this->public, policy
);
849 this->task_manager
->queue_task(this->task_manager
, task
);
852 child_create
= child_create_create(&this->public, policy
);
853 child_create
->use_reqid(child_create
, reqid
);
854 this->task_manager
->queue_task(this->task_manager
, (task_t
*)child_create
);
856 return this->task_manager
->initiate(this->task_manager
);
860 * compare two lists of traffic selectors for equality
862 static bool ts_list_equals(linked_list_t
*l1
, linked_list_t
*l2
)
866 traffic_selector_t
*t1
, *t2
;
868 if (l1
->get_count(l1
) != l2
->get_count(l2
))
873 i1
= l1
->create_iterator(l1
, TRUE
);
874 i2
= l2
->create_iterator(l2
, TRUE
);
875 while (i1
->iterate(i1
, (void**)&t1
) && i2
->iterate(i2
, (void**)&t2
))
877 if (!t1
->equals(t1
, t2
))
889 * Implementation of ike_sa_t.route.
891 static status_t
route(private_ike_sa_t
*this, connection_t
*connection
, policy_t
*policy
)
893 child_sa_t
*child_sa
= NULL
;
894 iterator_t
*iterator
;
895 linked_list_t
*my_ts
, *other_ts
;
898 SIG(CHILD_ROUTE_START
, "routing CHILD_SA");
900 /* check if not already routed*/
901 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
902 while (iterator
->iterate(iterator
, (void**)&child_sa
))
904 if (child_sa
->get_state(child_sa
) == CHILD_ROUTED
)
906 linked_list_t
*my_ts_conf
, *other_ts_conf
;
908 my_ts
= child_sa
->get_my_traffic_selectors(child_sa
);
909 other_ts
= child_sa
->get_other_traffic_selectors(child_sa
);
911 my_ts_conf
= policy
->get_my_traffic_selectors(policy
, this->my_host
);
912 other_ts_conf
= policy
->get_other_traffic_selectors(policy
, this->other_host
);
914 if (ts_list_equals(my_ts
, my_ts_conf
) &&
915 ts_list_equals(other_ts
, other_ts_conf
))
917 iterator
->destroy(iterator
);
918 my_ts_conf
->destroy_offset(my_ts_conf
, offsetof(traffic_selector_t
, destroy
));
919 other_ts_conf
->destroy_offset(other_ts_conf
, offsetof(traffic_selector_t
, destroy
));
920 SIG(CHILD_ROUTE_FAILED
, "CHILD_SA with such a policy already routed");
923 my_ts_conf
->destroy_offset(my_ts_conf
, offsetof(traffic_selector_t
, destroy
));
924 other_ts_conf
->destroy_offset(other_ts_conf
, offsetof(traffic_selector_t
, destroy
));
927 iterator
->destroy(iterator
);
933 SIG(CHILD_ROUTE_FAILED
,
934 "unable to route CHILD_SA, as its IKE_SA gets deleted");
937 /* apply connection information, we need it to acquire */
938 apply_config(this, connection
, policy
);
941 case IKE_ESTABLISHED
:
946 /* install kernel policies */
947 child_sa
= child_sa_create(this->my_host
, this->other_host
,
948 this->my_id
, this->other_id
, policy
, FALSE
, 0);
950 my_ts
= policy
->get_my_traffic_selectors(policy
, this->my_host
);
951 other_ts
= policy
->get_other_traffic_selectors(policy
, this->other_host
);
952 status
= child_sa
->add_policies(child_sa
, my_ts
, other_ts
,
953 policy
->get_mode(policy
));
954 my_ts
->destroy_offset(my_ts
, offsetof(traffic_selector_t
, destroy
));
955 other_ts
->destroy_offset(other_ts
, offsetof(traffic_selector_t
, destroy
));
956 this->child_sas
->insert_last(this->child_sas
, child_sa
);
957 SIG(CHILD_ROUTE_SUCCESS
, "CHILD_SA routed");
962 * Implementation of ike_sa_t.unroute.
964 static status_t
unroute(private_ike_sa_t
*this, policy_t
*policy
)
966 iterator_t
*iterator
;
967 child_sa_t
*child_sa
= NULL
;
969 linked_list_t
*my_ts
, *other_ts
, *my_ts_conf
, *other_ts_conf
;
971 SIG(CHILD_UNROUTE_START
, "unrouting CHILD_SA");
973 /* find CHILD_SA in ROUTED state */
974 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
975 while (iterator
->iterate(iterator
, (void**)&child_sa
))
977 if (child_sa
->get_state(child_sa
) == CHILD_ROUTED
)
979 my_ts
= child_sa
->get_my_traffic_selectors(child_sa
);
980 other_ts
= child_sa
->get_other_traffic_selectors(child_sa
);
982 my_ts_conf
= policy
->get_my_traffic_selectors(policy
, this->my_host
);
983 other_ts_conf
= policy
->get_other_traffic_selectors(policy
, this->other_host
);
985 if (ts_list_equals(my_ts
, my_ts_conf
) &&
986 ts_list_equals(other_ts
, other_ts_conf
))
988 iterator
->remove(iterator
);
989 SIG(CHILD_UNROUTE_SUCCESS
, "CHILD_SA unrouted");
990 child_sa
->destroy(child_sa
);
991 my_ts_conf
->destroy_offset(my_ts_conf
, offsetof(traffic_selector_t
, destroy
));
992 other_ts_conf
->destroy_offset(other_ts_conf
, offsetof(traffic_selector_t
, destroy
));
996 my_ts_conf
->destroy_offset(my_ts_conf
, offsetof(traffic_selector_t
, destroy
));
997 other_ts_conf
->destroy_offset(other_ts_conf
, offsetof(traffic_selector_t
, destroy
));
1000 iterator
->destroy(iterator
);
1004 SIG(CHILD_UNROUTE_FAILED
, "CHILD_SA to unroute not found");
1007 /* if we are not established, and we have no more routed childs, remove whole SA */
1008 if (this->state
== IKE_CREATED
&&
1009 this->child_sas
->get_count(this->child_sas
) == 0)
1017 * Implementation of ike_sa_t.retransmit.
1019 static status_t
retransmit(private_ike_sa_t
*this, u_int32_t message_id
)
1021 this->time
.outbound
= time(NULL
);
1022 if (this->task_manager
->retransmit(this->task_manager
, message_id
) != SUCCESS
)
1025 child_sa_t
* child_sa
;
1026 linked_list_t
*to_route
, *to_restart
;
1027 iterator_t
*iterator
;
1029 /* send a proper signal to brief interested bus listeners */
1030 switch (this->state
)
1032 case IKE_CONNECTING
:
1034 /* retry IKE_SA_INIT if we have multiple keyingtries */
1035 u_int32_t tries
= this->connection
->get_keyingtries(this->connection
);
1037 if (tries
== 0 || tries
> this->keyingtry
)
1039 SIG(IKE_UP_FAILED
, "peer not responding, trying again "
1040 "(%d/%d) in background ", this->keyingtry
+ 1, tries
);
1042 return this->task_manager
->initiate(this->task_manager
);
1044 SIG(IKE_UP_FAILED
, "establishing IKE_SA failed, peer not responding");
1048 SIG(IKE_REKEY_FAILED
, "rekeying IKE_SA failed, peer not responding");
1051 SIG(IKE_DOWN_FAILED
, "proper IKE_SA delete failed, peer not responding");
1057 /* summarize how we have to handle each child */
1058 to_route
= linked_list_create();
1059 to_restart
= linked_list_create();
1060 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1061 while (iterator
->iterate(iterator
, (void**)&child_sa
))
1063 policy
= child_sa
->get_policy(child_sa
);
1065 if (child_sa
->get_state(child_sa
) == CHILD_ROUTED
)
1067 /* reroute routed CHILD_SAs */
1068 to_route
->insert_last(to_route
, policy
);
1072 /* use DPD action for established CHILD_SAs */
1073 switch (policy
->get_dpd_action(policy
))
1076 to_route
->insert_last(to_route
, policy
);
1079 to_restart
->insert_last(to_restart
, policy
);
1086 iterator
->destroy(iterator
);
1088 /* create a new IKE_SA if we have to route or to restart */
1089 if (to_route
->get_count(to_route
) || to_restart
->get_count(to_restart
))
1091 ike_sa_id_t
*other_id
;
1092 private_ike_sa_t
*new;
1095 other_id
= ike_sa_id_create(0, 0, TRUE
);
1096 new = (private_ike_sa_t
*)charon
->ike_sa_manager
->checkout(
1097 charon
->ike_sa_manager
, other_id
);
1098 other_id
->destroy(other_id
);
1100 apply_config(new, this->connection
, this->policy
);
1101 /* use actual used host, not the wildcarded one in connection */
1102 new->other_host
->destroy(new->other_host
);
1103 new->other_host
= this->other_host
->clone(this->other_host
);
1105 /* install routes */
1106 while (to_route
->remove_last(to_route
, (void**)&policy
) == SUCCESS
)
1108 route(new, new->connection
, policy
);
1111 /* restart children */
1112 if (to_restart
->get_count(to_restart
))
1114 task
= (task_t
*)ike_init_create(&new->public, TRUE
, NULL
);
1115 new->task_manager
->queue_task(new->task_manager
, task
);
1116 task
= (task_t
*)ike_natd_create(&new->public, TRUE
);
1117 new->task_manager
->queue_task(new->task_manager
, task
);
1118 task
= (task_t
*)ike_cert_create(&new->public, TRUE
);
1119 new->task_manager
->queue_task(new->task_manager
, task
);
1120 task
= (task_t
*)ike_config_create(&new->public, new->policy
);
1121 new->task_manager
->queue_task(new->task_manager
, task
);
1122 task
= (task_t
*)ike_auth_create(&new->public, TRUE
);
1123 new->task_manager
->queue_task(new->task_manager
, task
);
1125 while (to_restart
->remove_last(to_restart
, (void**)&policy
) == SUCCESS
)
1127 task
= (task_t
*)child_create_create(&new->public, policy
);
1128 new->task_manager
->queue_task(new->task_manager
, task
);
1130 new->task_manager
->initiate(new->task_manager
);
1132 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, &new->public);
1134 to_route
->destroy(to_route
);
1135 to_restart
->destroy(to_restart
);
1142 * Implementation of ike_sa_t.get_prf.
1144 static prf_t
*get_prf(private_ike_sa_t
*this)
1150 * Implementation of ike_sa_t.get_prf.
1152 static prf_t
*get_child_prf(private_ike_sa_t
*this)
1154 return this->child_prf
;
1158 * Implementation of ike_sa_t.get_auth_bild
1160 static prf_t
*get_auth_build(private_ike_sa_t
*this)
1162 return this->auth_build
;
1166 * Implementation of ike_sa_t.get_auth_verify
1168 static prf_t
*get_auth_verify(private_ike_sa_t
*this)
1170 return this->auth_verify
;
1174 * Implementation of ike_sa_t.get_id.
1176 static ike_sa_id_t
* get_id(private_ike_sa_t
*this)
1178 return this->ike_sa_id
;
1182 * Implementation of ike_sa_t.get_my_id.
1184 static identification_t
* get_my_id(private_ike_sa_t
*this)
1190 * Implementation of ike_sa_t.set_my_id.
1192 static void set_my_id(private_ike_sa_t
*this, identification_t
*me
)
1194 DESTROY_IF(this->my_id
);
1199 * Implementation of ike_sa_t.get_other_id.
1201 static identification_t
* get_other_id(private_ike_sa_t
*this)
1203 return this->other_id
;
1207 * Implementation of ike_sa_t.set_other_id.
1209 static void set_other_id(private_ike_sa_t
*this, identification_t
*other
)
1211 DESTROY_IF(this->other_id
);
1212 this->other_id
= other
;
1216 * Implementation of ike_sa_t.derive_keys.
1218 static status_t
derive_keys(private_ike_sa_t
*this,
1219 proposal_t
*proposal
, chunk_t secret
,
1220 chunk_t nonce_i
, chunk_t nonce_r
,
1221 bool initiator
, prf_t
*child_prf
, prf_t
*old_prf
)
1223 prf_plus_t
*prf_plus
;
1224 chunk_t skeyseed
, key
, nonces
, prf_plus_seed
;
1227 crypter_t
*crypter_i
, *crypter_r
;
1228 signer_t
*signer_i
, *signer_r
;
1229 prf_t
*prf_i
, *prf_r
;
1230 u_int8_t spi_i_buf
[sizeof(u_int64_t
)], spi_r_buf
[sizeof(u_int64_t
)];
1231 chunk_t spi_i
= chunk_from_buf(spi_i_buf
);
1232 chunk_t spi_r
= chunk_from_buf(spi_r_buf
);
1234 /* Create SAs general purpose PRF first, we may use it here */
1235 if (!proposal
->get_algorithm(proposal
, PSEUDO_RANDOM_FUNCTION
, &algo
))
1237 DBG1(DBG_IKE
, "key derivation failed: no PSEUDO_RANDOM_FUNCTION");;
1240 this->prf
= prf_create(algo
->algorithm
);
1241 if (this->prf
== NULL
)
1243 DBG1(DBG_IKE
, "key derivation failed: PSEUDO_RANDOM_FUNCTION "
1244 "%N not supported!", pseudo_random_function_names
, algo
->algorithm
);
1248 DBG4(DBG_IKE
, "shared Diffie Hellman secret %B", &secret
);
1249 nonces
= chunk_cat("cc", nonce_i
, nonce_r
);
1250 *((u_int64_t
*)spi_i
.ptr
) = this->ike_sa_id
->get_initiator_spi(this->ike_sa_id
);
1251 *((u_int64_t
*)spi_r
.ptr
) = this->ike_sa_id
->get_responder_spi(this->ike_sa_id
);
1252 prf_plus_seed
= chunk_cat("ccc", nonces
, spi_i
, spi_r
);
1254 /* KEYMAT = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr)
1256 * if we are rekeying, SKEYSEED is built on another way
1258 if (child_prf
== NULL
) /* not rekeying */
1260 /* SKEYSEED = prf(Ni | Nr, g^ir) */
1261 this->prf
->set_key(this->prf
, nonces
);
1262 this->prf
->allocate_bytes(this->prf
, secret
, &skeyseed
);
1263 DBG4(DBG_IKE
, "SKEYSEED %B", &skeyseed
);
1264 this->prf
->set_key(this->prf
, skeyseed
);
1265 chunk_free(&skeyseed
);
1266 chunk_free(&secret
);
1267 prf_plus
= prf_plus_create(this->prf
, prf_plus_seed
);
1271 /* SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
1272 * use OLD SAs PRF functions for both prf_plus and prf */
1273 secret
= chunk_cat("mc", secret
, nonces
);
1274 child_prf
->allocate_bytes(child_prf
, secret
, &skeyseed
);
1275 DBG4(DBG_IKE
, "SKEYSEED %B", &skeyseed
);
1276 old_prf
->set_key(old_prf
, skeyseed
);
1277 chunk_free(&skeyseed
);
1278 chunk_free(&secret
);
1279 prf_plus
= prf_plus_create(old_prf
, prf_plus_seed
);
1281 chunk_free(&nonces
);
1282 chunk_free(&prf_plus_seed
);
1284 /* KEYMAT = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr */
1286 /* SK_d is used for generating CHILD_SA key mat => child_prf */
1287 proposal
->get_algorithm(proposal
, PSEUDO_RANDOM_FUNCTION
, &algo
);
1288 this->child_prf
= prf_create(algo
->algorithm
);
1289 key_size
= this->child_prf
->get_key_size(this->child_prf
);
1290 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1291 DBG4(DBG_IKE
, "Sk_d secret %B", &key
);
1292 this->child_prf
->set_key(this->child_prf
, key
);
1295 /* SK_ai/SK_ar used for integrity protection => signer_in/signer_out */
1296 if (!proposal
->get_algorithm(proposal
, INTEGRITY_ALGORITHM
, &algo
))
1298 DBG1(DBG_IKE
, "key derivation failed: no INTEGRITY_ALGORITHM");
1301 signer_i
= signer_create(algo
->algorithm
);
1302 signer_r
= signer_create(algo
->algorithm
);
1303 if (signer_i
== NULL
|| signer_r
== NULL
)
1305 DBG1(DBG_IKE
, "key derivation failed: INTEGRITY_ALGORITHM "
1306 "%N not supported!", integrity_algorithm_names
,algo
->algorithm
);
1309 key_size
= signer_i
->get_key_size(signer_i
);
1311 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1312 DBG4(DBG_IKE
, "Sk_ai secret %B", &key
);
1313 signer_i
->set_key(signer_i
, key
);
1316 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1317 DBG4(DBG_IKE
, "Sk_ar secret %B", &key
);
1318 signer_r
->set_key(signer_r
, key
);
1323 this->signer_in
= signer_r
;
1324 this->signer_out
= signer_i
;
1328 this->signer_in
= signer_i
;
1329 this->signer_out
= signer_r
;
1332 /* SK_ei/SK_er used for encryption => crypter_in/crypter_out */
1333 if (!proposal
->get_algorithm(proposal
, ENCRYPTION_ALGORITHM
, &algo
))
1335 DBG1(DBG_IKE
, "key derivation failed: no ENCRYPTION_ALGORITHM");
1338 crypter_i
= crypter_create(algo
->algorithm
, algo
->key_size
/ 8);
1339 crypter_r
= crypter_create(algo
->algorithm
, algo
->key_size
/ 8);
1340 if (crypter_i
== NULL
|| crypter_r
== NULL
)
1342 DBG1(DBG_IKE
, "key derivation failed: ENCRYPTION_ALGORITHM "
1343 "%N (key size %d) not supported!",
1344 encryption_algorithm_names
, algo
->algorithm
, algo
->key_size
);
1347 key_size
= crypter_i
->get_key_size(crypter_i
);
1349 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1350 DBG4(DBG_IKE
, "Sk_ei secret %B", &key
);
1351 crypter_i
->set_key(crypter_i
, key
);
1354 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1355 DBG4(DBG_IKE
, "Sk_er secret %B", &key
);
1356 crypter_r
->set_key(crypter_r
, key
);
1361 this->crypter_in
= crypter_r
;
1362 this->crypter_out
= crypter_i
;
1366 this->crypter_in
= crypter_i
;
1367 this->crypter_out
= crypter_r
;
1370 /* SK_pi/SK_pr used for authentication => prf_auth_i, prf_auth_r */
1371 proposal
->get_algorithm(proposal
, PSEUDO_RANDOM_FUNCTION
, &algo
);
1372 prf_i
= prf_create(algo
->algorithm
);
1373 prf_r
= prf_create(algo
->algorithm
);
1375 key_size
= prf_i
->get_key_size(prf_i
);
1376 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1377 DBG4(DBG_IKE
, "Sk_pi secret %B", &key
);
1378 prf_i
->set_key(prf_i
, key
);
1381 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1382 DBG4(DBG_IKE
, "Sk_pr secret %B", &key
);
1383 prf_r
->set_key(prf_r
, key
);
1388 this->auth_verify
= prf_r
;
1389 this->auth_build
= prf_i
;
1393 this->auth_verify
= prf_i
;
1394 this->auth_build
= prf_r
;
1397 /* all done, prf_plus not needed anymore */
1398 prf_plus
->destroy(prf_plus
);
1404 * Implementation of ike_sa_t.add_child_sa.
1406 static void add_child_sa(private_ike_sa_t
*this, child_sa_t
*child_sa
)
1408 this->child_sas
->insert_last(this->child_sas
, child_sa
);
1412 * Implementation of ike_sa_t.get_child_sa.
1414 static child_sa_t
* get_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
,
1415 u_int32_t spi
, bool inbound
)
1417 iterator_t
*iterator
;
1418 child_sa_t
*current
, *found
= NULL
;
1420 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1421 while (iterator
->iterate(iterator
, (void**)¤t
))
1423 if (current
->get_spi(current
, inbound
) == spi
&&
1424 current
->get_protocol(current
) == protocol
)
1429 iterator
->destroy(iterator
);
1434 * Implementation of ike_sa_t.create_child_sa_iterator.
1436 static iterator_t
* create_child_sa_iterator(private_ike_sa_t
*this)
1438 return this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1442 * Implementation of ike_sa_t.rekey_child_sa.
1444 static status_t
rekey_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1446 child_sa_t
*child_sa
;
1447 child_rekey_t
*child_rekey
;
1449 child_sa
= get_child_sa(this, protocol
, spi
, TRUE
);
1452 child_rekey
= child_rekey_create(&this->public, child_sa
);
1453 this->task_manager
->queue_task(this->task_manager
, &child_rekey
->task
);
1454 return this->task_manager
->initiate(this->task_manager
);
1460 * Implementation of ike_sa_t.delete_child_sa.
1462 static status_t
delete_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1464 child_sa_t
*child_sa
;
1465 child_delete_t
*child_delete
;
1467 child_sa
= get_child_sa(this, protocol
, spi
, TRUE
);
1470 child_delete
= child_delete_create(&this->public, child_sa
);
1471 this->task_manager
->queue_task(this->task_manager
, &child_delete
->task
);
1472 return this->task_manager
->initiate(this->task_manager
);
1478 * Implementation of ike_sa_t.destroy_child_sa.
1480 static status_t
destroy_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
,
1483 iterator_t
*iterator
;
1484 child_sa_t
*child_sa
;
1485 status_t status
= NOT_FOUND
;
1487 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1488 while (iterator
->iterate(iterator
, (void**)&child_sa
))
1490 if (child_sa
->get_protocol(child_sa
) == protocol
&&
1491 child_sa
->get_spi(child_sa
, TRUE
) == spi
)
1493 child_sa
->destroy(child_sa
);
1494 iterator
->remove(iterator
);
1499 iterator
->destroy(iterator
);
1504 * Implementation of public_ike_sa_t.delete.
1506 static status_t
delete_(private_ike_sa_t
*this)
1508 ike_delete_t
*ike_delete
;
1510 switch (this->state
)
1512 case IKE_ESTABLISHED
:
1513 DBG1(DBG_IKE
, "deleting IKE_SA");
1514 /* do not log when rekeyed */
1516 ike_delete
= ike_delete_create(&this->public, TRUE
);
1517 this->task_manager
->queue_task(this->task_manager
, &ike_delete
->task
);
1518 return this->task_manager
->initiate(this->task_manager
);
1520 DBG1(DBG_IKE
, "destroying IKE_SA in state %N without notification",
1521 ike_sa_state_names
, this->state
);
1528 * Implementation of ike_sa_t.rekey.
1530 static status_t
rekey(private_ike_sa_t
*this)
1532 ike_rekey_t
*ike_rekey
;
1534 ike_rekey
= ike_rekey_create(&this->public, TRUE
);
1536 this->task_manager
->queue_task(this->task_manager
, &ike_rekey
->task
);
1537 return this->task_manager
->initiate(this->task_manager
);
1541 * Implementation of ike_sa_t.reestablish
1543 static void reestablish(private_ike_sa_t
*this)
1545 ike_sa_id_t
*other_id
;
1546 private_ike_sa_t
*other
;
1547 iterator_t
*iterator
;
1548 child_sa_t
*child_sa
;
1553 other_id
= ike_sa_id_create(0, 0, TRUE
);
1554 other
= (private_ike_sa_t
*)charon
->ike_sa_manager
->checkout(
1555 charon
->ike_sa_manager
, other_id
);
1556 other_id
->destroy(other_id
);
1558 apply_config(other
, this->connection
, this->policy
);
1559 other
->other_host
->destroy(other
->other_host
);
1560 other
->other_host
= this->other_host
->clone(this->other_host
);
1562 if (this->state
== IKE_ESTABLISHED
)
1564 task
= (task_t
*)ike_init_create(&other
->public, TRUE
, NULL
);
1565 other
->task_manager
->queue_task(other
->task_manager
, task
);
1566 task
= (task_t
*)ike_natd_create(&other
->public, TRUE
);
1567 other
->task_manager
->queue_task(other
->task_manager
, task
);
1568 task
= (task_t
*)ike_cert_create(&other
->public, TRUE
);
1569 other
->task_manager
->queue_task(other
->task_manager
, task
);
1570 task
= (task_t
*)ike_config_create(&other
->public, other
->policy
);
1571 other
->task_manager
->queue_task(other
->task_manager
, task
);
1572 task
= (task_t
*)ike_auth_create(&other
->public, TRUE
);
1573 other
->task_manager
->queue_task(other
->task_manager
, task
);
1576 other
->task_manager
->adopt_tasks(other
->task_manager
, this->task_manager
);
1578 /* Create task for established children, adopt routed children directly */
1579 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1580 while(iterator
->iterate(iterator
, (void**)&child_sa
))
1582 switch (child_sa
->get_state(child_sa
))
1586 iterator
->remove(iterator
);
1587 other
->child_sas
->insert_first(other
->child_sas
, child_sa
);
1592 policy
= child_sa
->get_policy(child_sa
);
1593 task
= (task_t
*)child_create_create(&other
->public, policy
);
1594 other
->task_manager
->queue_task(other
->task_manager
, task
);
1599 iterator
->destroy(iterator
);
1601 other
->task_manager
->initiate(other
->task_manager
);
1603 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, &other
->public);
1605 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
1606 charon
->job_queue
->add(charon
->job_queue
, job
);
1610 * Implementation of ike_sa_t.inherit.
1612 static void inherit(private_ike_sa_t
*this, private_ike_sa_t
*other
)
1614 child_sa_t
*child_sa
;
1617 /* apply hosts and ids */
1618 this->my_host
->destroy(this->my_host
);
1619 this->other_host
->destroy(this->other_host
);
1620 this->my_id
->destroy(this->my_id
);
1621 this->other_id
->destroy(this->other_id
);
1622 this->my_host
= other
->my_host
->clone(other
->my_host
);
1623 this->other_host
= other
->other_host
->clone(other
->other_host
);
1624 this->my_id
= other
->my_id
->clone(other
->my_id
);
1625 this->other_id
= other
->other_id
->clone(other
->other_id
);
1627 /* apply virtual assigned IPs... */
1628 if (other
->my_virtual_ip
)
1630 this->my_virtual_ip
= other
->my_virtual_ip
;
1631 other
->my_virtual_ip
= NULL
;
1633 if (other
->other_virtual_ip
)
1635 this->other_virtual_ip
= other
->other_virtual_ip
;
1636 other
->other_virtual_ip
= NULL
;
1639 /* ... and DNS servers */
1640 while (other
->dns_servers
->remove_last(other
->dns_servers
,
1641 (void**)&ip
) == SUCCESS
)
1643 this->dns_servers
->insert_first(this->dns_servers
, ip
);
1646 /* adopt all children */
1647 while (other
->child_sas
->remove_last(other
->child_sas
,
1648 (void**)&child_sa
) == SUCCESS
)
1650 this->child_sas
->insert_first(this->child_sas
, (void*)child_sa
);
1655 * Implementation of ike_sa_t.is_natt_enabled.
1657 static bool is_natt_enabled(private_ike_sa_t
*this)
1659 return this->nat_here
|| this->nat_there
;
1663 * Implementation of ike_sa_t.enable_natt.
1665 static void enable_natt(private_ike_sa_t
*this, bool local
)
1669 DBG1(DBG_IKE
, "local host is behind NAT, scheduling keep alives");
1670 this->nat_here
= TRUE
;
1671 send_keepalive(this);
1675 DBG1(DBG_IKE
, "remote host is behind NAT");
1676 this->nat_there
= TRUE
;
1681 * Implementation of ike_sa_t.set_virtual_ip
1683 static void set_virtual_ip(private_ike_sa_t
*this, bool local
, host_t
*ip
)
1687 DBG1(DBG_IKE
, "installing new virtual IP %H", ip
);
1688 if (this->my_virtual_ip
)
1690 DBG1(DBG_IKE
, "removing old virtual IP %H", this->my_virtual_ip
);
1691 charon
->kernel_interface
->del_ip(charon
->kernel_interface
,
1692 this->my_virtual_ip
,
1694 this->my_virtual_ip
->destroy(this->my_virtual_ip
);
1696 if (charon
->kernel_interface
->add_ip(charon
->kernel_interface
, ip
,
1697 this->my_host
) == SUCCESS
)
1699 this->my_virtual_ip
= ip
->clone(ip
);
1703 DBG1(DBG_IKE
, "installing virtual IP %H failed", ip
);
1704 this->my_virtual_ip
= NULL
;
1709 DESTROY_IF(this->other_virtual_ip
);
1710 this->other_virtual_ip
= ip
->clone(ip
);
1715 * Implementation of ike_sa_t.get_virtual_ip
1717 static host_t
* get_virtual_ip(private_ike_sa_t
*this, bool local
)
1721 return this->my_virtual_ip
;
1725 return this->other_virtual_ip
;
1730 * Implementation of ike_sa_t.remove_dns_server
1732 static void remove_dns_servers(private_ike_sa_t
*this)
1736 chunk_t contents
, line
, orig_line
, token
;
1737 char string
[INET6_ADDRSTRLEN
];
1739 iterator_t
*iterator
;
1741 if (this->dns_servers
->get_count(this->dns_servers
) == 0)
1743 /* don't touch anything if we have no nameservers installed */
1747 file
= fopen(RESOLV_CONF
, "r");
1748 if (file
== NULL
|| stat(RESOLV_CONF
, &stats
) != 0)
1750 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %m", RESOLV_CONF
);
1754 contents
= chunk_alloca((size_t)stats
.st_size
);
1756 if (fread(contents
.ptr
, 1, contents
.len
, file
) != contents
.len
)
1758 DBG1(DBG_IKE
, "unable to read DNS configuration file: %m");
1764 file
= fopen(RESOLV_CONF
, "w");
1767 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %m", RESOLV_CONF
);
1771 iterator
= this->dns_servers
->create_iterator(this->dns_servers
, TRUE
);
1772 while (fetchline(&contents
, &line
))
1776 if (extract_token(&token
, ' ', &line
) &&
1777 strncasecmp(token
.ptr
, "nameserver", token
.len
) == 0)
1779 if (!extract_token(&token
, ' ', &line
))
1783 iterator
->reset(iterator
);
1784 while (iterator
->iterate(iterator
, (void**)&ip
))
1786 snprintf(string
, sizeof(string
), "%H", ip
);
1787 if (strlen(string
) == token
.len
&&
1788 strncmp(token
.ptr
, string
, token
.len
) == 0)
1790 iterator
->remove(iterator
);
1800 /* write line untouched back to file */
1801 fwrite(orig_line
.ptr
, orig_line
.len
, 1, file
);
1802 fprintf(file
, "\n");
1805 iterator
->destroy(iterator
);
1810 * Implementation of ike_sa_t.add_dns_server
1812 static void add_dns_server(private_ike_sa_t
*this, host_t
*dns
)
1818 DBG1(DBG_IKE
, "installing DNS server %H", dns
);
1820 file
= fopen(RESOLV_CONF
, "a+");
1821 if (file
== NULL
|| stat(RESOLV_CONF
, &stats
) != 0)
1823 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %m", RESOLV_CONF
);
1827 contents
= chunk_alloca(stats
.st_size
);
1829 if (fread(contents
.ptr
, 1, contents
.len
, file
) != contents
.len
)
1831 DBG1(DBG_IKE
, "unable to read DNS configuration file: %m");
1837 file
= fopen(RESOLV_CONF
, "w");
1840 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %m", RESOLV_CONF
);
1844 if (fprintf(file
, "nameserver %H # added by strongSwan, assigned by %D\n",
1845 dns
, this->other_id
) < 0)
1847 DBG1(DBG_IKE
, "unable to write DNS configuration: %m");
1851 this->dns_servers
->insert_last(this->dns_servers
, dns
->clone(dns
));
1853 fwrite(contents
.ptr
, contents
.len
, 1, file
);
1859 * output handler in printf()
1861 static int print(FILE *stream
, const struct printf_info
*info
,
1862 const void *const *args
)
1865 bool reauth
= FALSE
;
1866 private_ike_sa_t
*this = *((private_ike_sa_t
**)(args
[0]));
1868 if (this->connection
)
1870 reauth
= this->connection
->get_reauth(this->connection
);
1875 return fprintf(stream
, "(null)");
1878 written
= fprintf(stream
, "%12s[%d]: %N, %H[%D]...%H[%D]", get_name(this),
1879 this->unique_id
, ike_sa_state_names
, this->state
,
1880 this->my_host
, this->my_id
, this->other_host
,
1882 written
+= fprintf(stream
, "\n%12s[%d]: IKE SPIs: %J, %s in %ds",
1883 get_name(this), this->unique_id
, this->ike_sa_id
,
1884 this->connection
&& reauth?
"reauthentication":"rekeying",
1885 this->time
.rekey
- time(NULL
));
1895 * register printf() handlers
1897 static void __attribute__ ((constructor
))print_register()
1899 register_printf_function(PRINTF_IKE_SA
, print
, arginfo_ptr
);
1903 * Implementation of ike_sa_t.destroy.
1905 static void destroy(private_ike_sa_t
*this)
1907 this->child_sas
->destroy_offset(this->child_sas
, offsetof(child_sa_t
, destroy
));
1909 DESTROY_IF(this->crypter_in
);
1910 DESTROY_IF(this->crypter_out
);
1911 DESTROY_IF(this->signer_in
);
1912 DESTROY_IF(this->signer_out
);
1913 DESTROY_IF(this->prf
);
1914 DESTROY_IF(this->child_prf
);
1915 DESTROY_IF(this->auth_verify
);
1916 DESTROY_IF(this->auth_build
);
1918 if (this->my_virtual_ip
)
1920 charon
->kernel_interface
->del_ip(charon
->kernel_interface
,
1921 this->my_virtual_ip
, this->my_host
);
1922 this->my_virtual_ip
->destroy(this->my_virtual_ip
);
1924 DESTROY_IF(this->other_virtual_ip
);
1926 remove_dns_servers(this);
1927 this->dns_servers
->destroy_offset(this->dns_servers
, offsetof(host_t
, destroy
));
1929 DESTROY_IF(this->my_host
);
1930 DESTROY_IF(this->other_host
);
1931 DESTROY_IF(this->my_id
);
1932 DESTROY_IF(this->other_id
);
1934 DESTROY_IF(this->connection
);
1935 DESTROY_IF(this->policy
);
1937 this->ike_sa_id
->destroy(this->ike_sa_id
);
1938 this->task_manager
->destroy(this->task_manager
);
1943 * Described in header.
1945 ike_sa_t
* ike_sa_create(ike_sa_id_t
*ike_sa_id
)
1947 private_ike_sa_t
*this = malloc_thing(private_ike_sa_t
);
1948 static u_int32_t unique_id
= 0;
1950 /* Public functions */
1951 this->public.get_state
= (ike_sa_state_t(*)(ike_sa_t
*)) get_state
;
1952 this->public.set_state
= (void(*)(ike_sa_t
*,ike_sa_state_t
)) set_state
;
1953 this->public.get_name
= (char*(*)(ike_sa_t
*))get_name
;
1954 this->public.process_message
= (status_t(*)(ike_sa_t
*, message_t
*)) process_message
;
1955 this->public.initiate
= (status_t(*)(ike_sa_t
*,connection_t
*,policy_t
*)) initiate
;
1956 this->public.route
= (status_t(*)(ike_sa_t
*,connection_t
*,policy_t
*)) route
;
1957 this->public.unroute
= (status_t(*)(ike_sa_t
*,policy_t
*)) unroute
;
1958 this->public.acquire
= (status_t(*)(ike_sa_t
*,u_int32_t
)) acquire
;
1959 this->public.get_connection
= (connection_t
*(*)(ike_sa_t
*))get_connection
;
1960 this->public.set_connection
= (void(*)(ike_sa_t
*,connection_t
*))set_connection
;
1961 this->public.get_policy
= (policy_t
*(*)(ike_sa_t
*))get_policy
;
1962 this->public.set_policy
= (void(*)(ike_sa_t
*,policy_t
*))set_policy
;
1963 this->public.get_id
= (ike_sa_id_t
*(*)(ike_sa_t
*)) get_id
;
1964 this->public.get_my_host
= (host_t
*(*)(ike_sa_t
*)) get_my_host
;
1965 this->public.set_my_host
= (void(*)(ike_sa_t
*,host_t
*)) set_my_host
;
1966 this->public.get_other_host
= (host_t
*(*)(ike_sa_t
*)) get_other_host
;
1967 this->public.set_other_host
= (void(*)(ike_sa_t
*,host_t
*)) set_other_host
;
1968 this->public.get_my_id
= (identification_t
*(*)(ike_sa_t
*)) get_my_id
;
1969 this->public.set_my_id
= (void(*)(ike_sa_t
*,identification_t
*)) set_my_id
;
1970 this->public.get_other_id
= (identification_t
*(*)(ike_sa_t
*)) get_other_id
;
1971 this->public.set_other_id
= (void(*)(ike_sa_t
*,identification_t
*)) set_other_id
;
1972 this->public.retransmit
= (status_t (*) (ike_sa_t
*, u_int32_t
)) retransmit
;
1973 this->public.delete = (status_t(*)(ike_sa_t
*))delete_
;
1974 this->public.destroy
= (void(*)(ike_sa_t
*))destroy
;
1975 this->public.send_dpd
= (status_t (*)(ike_sa_t
*)) send_dpd
;
1976 this->public.send_keepalive
= (void (*)(ike_sa_t
*)) send_keepalive
;
1977 this->public.get_prf
= (prf_t
*(*) (ike_sa_t
*)) get_prf
;
1978 this->public.get_child_prf
= (prf_t
*(*) (ike_sa_t
*)) get_child_prf
;
1979 this->public.get_auth_verify
= (prf_t
*(*) (ike_sa_t
*)) get_auth_verify
;
1980 this->public.get_auth_build
= (prf_t
*(*) (ike_sa_t
*)) get_auth_build
;
1981 this->public.derive_keys
= (status_t (*) (ike_sa_t
*,proposal_t
*,chunk_t
,chunk_t
,chunk_t
,bool,prf_t
*,prf_t
*)) derive_keys
;
1982 this->public.add_child_sa
= (void (*) (ike_sa_t
*,child_sa_t
*)) add_child_sa
;
1983 this->public.get_child_sa
= (child_sa_t
* (*)(ike_sa_t
*,protocol_id_t
,u_int32_t
,bool)) get_child_sa
;
1984 this->public.create_child_sa_iterator
= (iterator_t
* (*)(ike_sa_t
*)) create_child_sa_iterator
;
1985 this->public.rekey_child_sa
= (status_t(*)(ike_sa_t
*,protocol_id_t
,u_int32_t
)) rekey_child_sa
;
1986 this->public.delete_child_sa
= (status_t(*)(ike_sa_t
*,protocol_id_t
,u_int32_t
)) delete_child_sa
;
1987 this->public.destroy_child_sa
= (status_t (*)(ike_sa_t
*,protocol_id_t
,u_int32_t
))destroy_child_sa
;
1988 this->public.enable_natt
= (void(*)(ike_sa_t
*, bool)) enable_natt
;
1989 this->public.is_natt_enabled
= (bool(*)(ike_sa_t
*)) is_natt_enabled
;
1990 this->public.rekey
= (status_t(*)(ike_sa_t
*))rekey
;
1991 this->public.reestablish
= (void(*)(ike_sa_t
*))reestablish
;
1992 this->public.inherit
= (void(*)(ike_sa_t
*,ike_sa_t
*))inherit
;
1993 this->public.generate_message
= (status_t(*)(ike_sa_t
*,message_t
*,packet_t
**))generate_message
;
1994 this->public.reset
= (void(*)(ike_sa_t
*))reset
;
1995 this->public.get_unique_id
= (u_int32_t(*)(ike_sa_t
*))get_unique_id
;
1996 this->public.set_virtual_ip
= (void(*)(ike_sa_t
*,bool,host_t
*))set_virtual_ip
;
1997 this->public.get_virtual_ip
= (host_t
*(*)(ike_sa_t
*,bool))get_virtual_ip
;
1998 this->public.add_dns_server
= (void(*)(ike_sa_t
*,host_t
*))add_dns_server
;
2000 /* initialize private fields */
2001 this->ike_sa_id
= ike_sa_id
->clone(ike_sa_id
);
2002 this->child_sas
= linked_list_create();
2003 this->my_host
= host_create_any(AF_INET
);
2004 this->other_host
= host_create_any(AF_INET
);
2005 this->my_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
);
2006 this->other_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
);
2007 this->crypter_in
= NULL
;
2008 this->crypter_out
= NULL
;
2009 this->signer_in
= NULL
;
2010 this->signer_out
= NULL
;
2012 this->auth_verify
= NULL
;
2013 this->auth_build
= NULL
;
2014 this->child_prf
= NULL
;
2015 this->nat_here
= FALSE
;
2016 this->nat_there
= FALSE
;
2017 this->state
= IKE_CREATED
;
2018 this->time
.inbound
= this->time
.outbound
= time(NULL
);
2019 this->time
.established
= 0;
2020 this->time
.rekey
= 0;
2021 this->time
.delete = 0;
2022 this->connection
= NULL
;
2023 this->policy
= NULL
;
2024 this->task_manager
= task_manager_create(&this->public);
2025 this->unique_id
= ++unique_id
;
2026 this->my_virtual_ip
= NULL
;
2027 this->other_virtual_ip
= NULL
;
2028 this->dns_servers
= linked_list_create();
2029 this->keyingtry
= 0;
2031 return &this->public;