858cef373de4832dda648b010bf7e345b72a90b1
[strongswan.git] / src / charon / sa / ike_sa.c
1 /**
2 * @file ike_sa.c
3 *
4 * @brief Implementation of ike_sa_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
10 * Copyright (C) 2005-2006 Martin Willi
11 * Copyright (C) 2005 Jan Hutter
12 * Hochschule fuer Technik Rapperswil
13 *
14 * This program is free software; you can redistribute it and/or modify it
15 * under the terms of the GNU General Public License as published by the
16 * Free Software Foundation; either version 2 of the License, or (at your
17 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
18 *
19 * This program is distributed in the hope that it will be useful, but
20 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
21 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
22 * for more details.
23 */
24
25 #include <sys/time.h>
26 #include <string.h>
27 #include <printf.h>
28 #include <sys/stat.h>
29 #include <errno.h>
30
31 #include "ike_sa.h"
32
33 #include <library.h>
34 #include <daemon.h>
35 #include <utils/linked_list.h>
36 #include <utils/lexparser.h>
37 #include <crypto/diffie_hellman.h>
38 #include <crypto/prf_plus.h>
39 #include <crypto/crypters/crypter.h>
40 #include <crypto/hashers/hasher.h>
41 #include <encoding/payloads/sa_payload.h>
42 #include <encoding/payloads/nonce_payload.h>
43 #include <encoding/payloads/ke_payload.h>
44 #include <encoding/payloads/delete_payload.h>
45 #include <encoding/payloads/transform_substructure.h>
46 #include <encoding/payloads/transform_attribute.h>
47 #include <encoding/payloads/ts_payload.h>
48 #include <sa/task_manager.h>
49 #include <sa/tasks/ike_init.h>
50 #include <sa/tasks/ike_natd.h>
51 #include <sa/tasks/ike_auth.h>
52 #include <sa/tasks/ike_config.h>
53 #include <sa/tasks/ike_cert.h>
54 #include <sa/tasks/ike_rekey.h>
55 #include <sa/tasks/ike_delete.h>
56 #include <sa/tasks/ike_dpd.h>
57 #include <sa/tasks/child_create.h>
58 #include <sa/tasks/child_delete.h>
59 #include <sa/tasks/child_rekey.h>
60 #include <processing/jobs/retransmit_job.h>
61 #include <processing/jobs/delete_ike_sa_job.h>
62 #include <processing/jobs/send_dpd_job.h>
63 #include <processing/jobs/send_keepalive_job.h>
64 #include <processing/jobs/rekey_ike_sa_job.h>
65 #include <processing/jobs/route_job.h>
66 #include <processing/jobs/initiate_job.h>
67
68
69 #ifndef RESOLV_CONF
70 #define RESOLV_CONF "/etc/resolv.conf"
71 #endif
72
73 ENUM(ike_sa_state_names, IKE_CREATED, IKE_DELETING,
74 "CREATED",
75 "CONNECTING",
76 "ESTABLISHED",
77 "REKEYING",
78 "DELETING",
79 );
80
81 typedef struct private_ike_sa_t private_ike_sa_t;
82
83 /**
84 * Private data of an ike_sa_t object.
85 */
86 struct private_ike_sa_t {
87
88 /**
89 * Public members
90 */
91 ike_sa_t public;
92
93 /**
94 * Identifier for the current IKE_SA.
95 */
96 ike_sa_id_t *ike_sa_id;
97
98 /**
99 * unique numerical ID for this IKE_SA.
100 */
101 u_int32_t unique_id;
102
103 /**
104 * Current state of the IKE_SA
105 */
106 ike_sa_state_t state;
107
108 /**
109 * IKE configuration used to set up this IKE_SA
110 */
111 ike_cfg_t *ike_cfg;
112
113 /**
114 * Peer and authentication information to establish IKE_SA.
115 */
116 peer_cfg_t *peer_cfg;
117
118 /**
119 * Juggles tasks to process messages
120 */
121 task_manager_t *task_manager;
122
123 /**
124 * Address of local host
125 */
126 host_t *my_host;
127
128 /**
129 * Address of remote host
130 */
131 host_t *other_host;
132
133 /**
134 * Identification used for us
135 */
136 identification_t *my_id;
137
138 /**
139 * Identification used for other
140 */
141 identification_t *other_id;
142
143 /**
144 * Linked List containing the child sa's of the current IKE_SA.
145 */
146 linked_list_t *child_sas;
147
148 /**
149 * crypter for inbound traffic
150 */
151 crypter_t *crypter_in;
152
153 /**
154 * crypter for outbound traffic
155 */
156 crypter_t *crypter_out;
157
158 /**
159 * Signer for inbound traffic
160 */
161 signer_t *signer_in;
162
163 /**
164 * Signer for outbound traffic
165 */
166 signer_t *signer_out;
167
168 /**
169 * Multi purpose prf, set key, use it, forget it
170 */
171 prf_t *prf;
172
173 /**
174 * Prf function for derivating keymat child SAs
175 */
176 prf_t *child_prf;
177
178 /**
179 * Key to build outging authentication data (SKp)
180 */
181 chunk_t skp_build;
182
183 /**
184 * Key to verify incoming authentication data (SKp)
185 */
186 chunk_t skp_verify;
187
188 /**
189 * NAT status of local host.
190 */
191 bool nat_here;
192
193 /**
194 * NAT status of remote host.
195 */
196 bool nat_there;
197
198 /**
199 * Virtual IP on local host, if any
200 */
201 host_t *my_virtual_ip;
202
203 /**
204 * Virtual IP on remote host, if any
205 */
206 host_t *other_virtual_ip;
207
208 /**
209 * List of DNS servers installed by us
210 */
211 linked_list_t *dns_servers;
212
213 /**
214 * Timestamps for this IKE_SA
215 */
216 struct {
217 /** last IKE message received */
218 u_int32_t inbound;
219 /** last IKE message sent */
220 u_int32_t outbound;
221 /** when IKE_SA became established */
222 u_int32_t established;
223 /** when IKE_SA gets rekeyed */
224 u_int32_t rekey;
225 /** when IKE_SA gets deleted */
226 u_int32_t delete;
227 } time;
228
229 /**
230 * how many times we have retried so far (keyingtries)
231 */
232 u_int32_t keyingtry;
233 };
234
235 /**
236 * get the time of the latest traffic processed by the kernel
237 */
238 static time_t get_use_time(private_ike_sa_t* this, bool inbound)
239 {
240 iterator_t *iterator;
241 child_sa_t *child_sa;
242 time_t latest = 0, use_time;
243
244 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
245 while (iterator->iterate(iterator, (void**)&child_sa))
246 {
247 if (child_sa->get_use_time(child_sa, inbound, &use_time) == SUCCESS)
248 {
249 latest = max(latest, use_time);
250 }
251 }
252 iterator->destroy(iterator);
253
254 if (inbound)
255 {
256 return max(this->time.inbound, latest);
257 }
258 else
259 {
260 return max(this->time.outbound, latest);
261 }
262 }
263
264 /**
265 * Implementation of ike_sa_t.get_unique_id
266 */
267 static u_int32_t get_unique_id(private_ike_sa_t *this)
268 {
269 return this->unique_id;
270 }
271
272 /**
273 * Implementation of ike_sa_t.get_name.
274 */
275 static char *get_name(private_ike_sa_t *this)
276 {
277 if (this->peer_cfg)
278 {
279 return this->peer_cfg->get_name(this->peer_cfg);
280 }
281 return "(unnamed)";
282 }
283
284
285 /**
286 * Implementation of ike_sa_t.get_stats.
287 */
288 static void get_stats(private_ike_sa_t *this, u_int32_t *next_rekeying)
289 {
290 if (next_rekeying)
291 {
292 *next_rekeying = this->time.rekey;
293 }
294 }
295
296 /**
297 * Implementation of ike_sa_t.get_my_host.
298 */
299 static host_t *get_my_host(private_ike_sa_t *this)
300 {
301 return this->my_host;
302 }
303
304 /**
305 * Implementation of ike_sa_t.set_my_host.
306 */
307 static void set_my_host(private_ike_sa_t *this, host_t *me)
308 {
309 DESTROY_IF(this->my_host);
310 this->my_host = me;
311 }
312
313 /**
314 * Implementation of ike_sa_t.get_other_host.
315 */
316 static host_t *get_other_host(private_ike_sa_t *this)
317 {
318 return this->other_host;
319 }
320
321 /**
322 * Implementation of ike_sa_t.set_other_host.
323 */
324 static void set_other_host(private_ike_sa_t *this, host_t *other)
325 {
326 DESTROY_IF(this->other_host);
327 this->other_host = other;
328 }
329
330 /**
331 * Implementation of ike_sa_t.get_peer_cfg
332 */
333 static peer_cfg_t* get_peer_cfg(private_ike_sa_t *this)
334 {
335 return this->peer_cfg;
336 }
337
338 /**
339 * Implementation of ike_sa_t.set_peer_cfg
340 */
341 static void set_peer_cfg(private_ike_sa_t *this, peer_cfg_t *peer_cfg)
342 {
343 peer_cfg->get_ref(peer_cfg);
344 this->peer_cfg = peer_cfg;
345
346 if (this->ike_cfg == NULL)
347 {
348 this->ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
349 this->ike_cfg->get_ref(this->ike_cfg);
350 }
351
352 /* apply values, so we are ready to initate/acquire */
353 if (this->my_host->is_anyaddr(this->my_host))
354 {
355 host_t *me = this->ike_cfg->get_my_host(this->ike_cfg);
356
357 set_my_host(this, me->clone(me));
358 }
359 if (this->other_host->is_anyaddr(this->other_host))
360 {
361 host_t *other = this->ike_cfg->get_other_host(this->ike_cfg);
362
363 set_other_host(this, other->clone(other));
364 }
365 if (this->my_id == NULL || this->my_id->contains_wildcards(this->my_id))
366 {
367 identification_t *my_id = this->peer_cfg->get_my_id(this->peer_cfg);
368
369 DESTROY_IF(this->my_id);
370 this->my_id = my_id->clone(my_id);
371 }
372 if (this->other_id == NULL || this->other_id->contains_wildcards(this->other_id))
373 {
374 identification_t *other_id = this->peer_cfg->get_other_id(this->peer_cfg);
375
376 DESTROY_IF(this->other_id);
377 this->other_id = other_id->clone(other_id);
378 }
379 }
380
381 /**
382 * Implementation of ike_sa_t.get_ike_cfg
383 */
384 static ike_cfg_t *get_ike_cfg(private_ike_sa_t *this)
385 {
386 return this->ike_cfg;
387 }
388
389 /**
390 * Implementation of ike_sa_t.set_ike_cfg
391 */
392 static void set_ike_cfg(private_ike_sa_t *this, ike_cfg_t *ike_cfg)
393 {
394 ike_cfg->get_ref(ike_cfg);
395 this->ike_cfg = ike_cfg;
396 }
397
398 /**
399 * Implementation of ike_sa_t.send_dpd
400 */
401 static status_t send_dpd(private_ike_sa_t *this)
402 {
403 send_dpd_job_t *job;
404 time_t diff, delay;
405
406 delay = this->peer_cfg->get_dpd_delay(this->peer_cfg);
407
408 if (delay == 0)
409 {
410 /* DPD disabled */
411 return SUCCESS;
412 }
413
414 if (this->task_manager->busy(this->task_manager))
415 {
416 /* an exchange is in the air, no need to start a DPD check */
417 diff = 0;
418 }
419 else
420 {
421 /* check if there was any inbound traffic */
422 time_t last_in, now;
423 last_in = get_use_time(this, TRUE);
424 now = time(NULL);
425 diff = now - last_in;
426 if (diff >= delay)
427 {
428 /* to long ago, initiate dead peer detection */
429 task_t *task;
430
431 task = (task_t*)ike_dpd_create(TRUE);
432 diff = 0;
433 DBG1(DBG_IKE, "sending DPD request");
434
435 this->task_manager->queue_task(this->task_manager, task);
436 this->task_manager->initiate(this->task_manager);
437 }
438 }
439 /* recheck in "interval" seconds */
440 job = send_dpd_job_create(this->ike_sa_id);
441 charon->event_queue->add_relative(charon->event_queue, (job_t*)job,
442 (delay - diff) * 1000);
443 return SUCCESS;
444 }
445
446 /**
447 * Implementation of ike_sa_t.send_keepalive
448 */
449 static void send_keepalive(private_ike_sa_t *this)
450 {
451 send_keepalive_job_t *job;
452 time_t last_out, now, diff;
453
454 last_out = get_use_time(this, FALSE);
455 now = time(NULL);
456
457 diff = now - last_out;
458
459 if (diff >= KEEPALIVE_INTERVAL)
460 {
461 packet_t *packet;
462 chunk_t data;
463
464 packet = packet_create();
465 packet->set_source(packet, this->my_host->clone(this->my_host));
466 packet->set_destination(packet, this->other_host->clone(this->other_host));
467 data.ptr = malloc(1);
468 data.ptr[0] = 0xFF;
469 data.len = 1;
470 packet->set_data(packet, data);
471 charon->sender->send(charon->sender, packet);
472 DBG1(DBG_IKE, "sending keep alive");
473 diff = 0;
474 }
475 job = send_keepalive_job_create(this->ike_sa_id);
476 charon->event_queue->add_relative(charon->event_queue, (job_t*)job,
477 (KEEPALIVE_INTERVAL - diff) * 1000);
478 }
479
480 /**
481 * Implementation of ike_sa_t.get_state.
482 */
483 static ike_sa_state_t get_state(private_ike_sa_t *this)
484 {
485 return this->state;
486 }
487
488 /**
489 * Implementation of ike_sa_t.set_state.
490 */
491 static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
492 {
493 DBG1(DBG_IKE, "IKE_SA state change: %N => %N",
494 ike_sa_state_names, this->state,
495 ike_sa_state_names, state);
496
497 switch (state)
498 {
499 case IKE_ESTABLISHED:
500 {
501 if (this->state == IKE_CONNECTING)
502 {
503 job_t *job;
504 u_int32_t now = time(NULL);
505 u_int32_t soft, hard;
506 bool reauth;
507
508 this->time.established = now;
509 /* start DPD checks */
510 send_dpd(this);
511
512 /* schedule rekeying/reauthentication */
513 soft = this->peer_cfg->get_lifetime(this->peer_cfg, TRUE);
514 hard = this->peer_cfg->get_lifetime(this->peer_cfg, FALSE);
515 reauth = this->peer_cfg->use_reauth(this->peer_cfg);
516 DBG1(DBG_IKE, "scheduling %s in %ds, maximum lifetime %ds",
517 reauth ? "reauthentication": "rekeying", soft, hard);
518
519 if (soft)
520 {
521 this->time.rekey = now + soft;
522 job = (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, reauth);
523 charon->event_queue->add_relative(charon->event_queue, job,
524 soft * 1000);
525 }
526
527 if (hard)
528 {
529 this->time.delete = now + hard;
530 job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE);
531 charon->event_queue->add_relative(charon->event_queue, job,
532 hard * 1000);
533 }
534 }
535 break;
536 }
537 case IKE_DELETING:
538 {
539 /* delete may fail if a packet gets lost, so set a timeout */
540 job_t *job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE);
541 charon->event_queue->add_relative(charon->event_queue, job,
542 HALF_OPEN_IKE_SA_TIMEOUT);
543 break;
544 }
545 default:
546 break;
547 }
548
549 this->state = state;
550 }
551
552 /**
553 * Implementation of ike_sa_t.reset
554 */
555 static void reset(private_ike_sa_t *this)
556 {
557 /* the responder ID is reset, as peer may choose another one */
558 if (this->ike_sa_id->is_initiator(this->ike_sa_id))
559 {
560 this->ike_sa_id->set_responder_spi(this->ike_sa_id, 0);
561 }
562
563 set_state(this, IKE_CREATED);
564
565 this->task_manager->reset(this->task_manager);
566 }
567
568 /**
569 * Update hosts, as addresses may change (NAT)
570 */
571 static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
572 {
573 iterator_t *iterator = NULL;
574 child_sa_t *child_sa = NULL;
575 host_diff_t my_diff, other_diff;
576
577 if (this->my_host->is_anyaddr(this->my_host) ||
578 this->other_host->is_anyaddr(this->other_host))
579 {
580 /* on first received message */
581 this->my_host->destroy(this->my_host);
582 this->my_host = me->clone(me);
583 this->other_host->destroy(this->other_host);
584 this->other_host = other->clone(other);
585 return;
586 }
587
588 my_diff = me->get_differences(me, this->my_host);
589 other_diff = other->get_differences(other, this->other_host);
590
591 if (!my_diff && !other_diff)
592 {
593 return;
594 }
595
596 if (my_diff)
597 {
598 this->my_host->destroy(this->my_host);
599 this->my_host = me->clone(me);
600 }
601
602 if (!this->nat_here)
603 {
604 /* update without restrictions if we are not NATted */
605 if (other_diff)
606 {
607 this->other_host->destroy(this->other_host);
608 this->other_host = other->clone(other);
609 }
610 }
611 else
612 {
613 /* if we are natted, only port may change */
614 if (other_diff & HOST_DIFF_ADDR)
615 {
616 return;
617 }
618 else if (other_diff & HOST_DIFF_PORT)
619 {
620 this->other_host->set_port(this->other_host, other->get_port(other));
621 }
622 }
623 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
624 while (iterator->iterate(iterator, (void**)&child_sa))
625 {
626 child_sa->update_hosts(child_sa, this->my_host, this->other_host,
627 my_diff, other_diff);
628 }
629 iterator->destroy(iterator);
630 }
631
632 /**
633 * Implementation of ike_sa_t.generate
634 */
635 static status_t generate_message(private_ike_sa_t *this, message_t *message,
636 packet_t **packet)
637 {
638 this->time.outbound = time(NULL);
639 message->set_ike_sa_id(message, this->ike_sa_id);
640 message->set_destination(message, this->other_host->clone(this->other_host));
641 message->set_source(message, this->my_host->clone(this->my_host));
642 return message->generate(message, this->crypter_out, this->signer_out, packet);
643 }
644
645 /**
646 * send a notify back to the sender
647 */
648 static void send_notify_response(private_ike_sa_t *this, message_t *request,
649 notify_type_t type)
650 {
651 message_t *response;
652 packet_t *packet;
653
654 response = message_create();
655 response->set_exchange_type(response, request->get_exchange_type(request));
656 response->set_request(response, FALSE);
657 response->set_message_id(response, request->get_message_id(request));
658 response->add_notify(response, FALSE, type, chunk_empty);
659 if (this->my_host->is_anyaddr(this->my_host))
660 {
661 this->my_host->destroy(this->my_host);
662 this->my_host = request->get_destination(request);
663 this->my_host = this->my_host->clone(this->my_host);
664 }
665 if (this->other_host->is_anyaddr(this->other_host))
666 {
667 this->other_host->destroy(this->other_host);
668 this->other_host = request->get_source(request);
669 this->other_host = this->other_host->clone(this->other_host);
670 }
671 if (generate_message(this, response, &packet) == SUCCESS)
672 {
673 charon->sender->send(charon->sender, packet);
674 }
675 response->destroy(response);
676 }
677
678 /**
679 * Implementation of ike_sa_t.process_message.
680 */
681 static status_t process_message(private_ike_sa_t *this, message_t *message)
682 {
683 status_t status;
684 bool is_request;
685
686 is_request = message->get_request(message);
687
688 status = message->parse_body(message, this->crypter_in, this->signer_in);
689 if (status != SUCCESS)
690 {
691
692 if (is_request)
693 {
694 switch (status)
695 {
696 case NOT_SUPPORTED:
697 DBG1(DBG_IKE, "ciritcal unknown payloads found");
698 if (is_request)
699 {
700 send_notify_response(this, message, UNSUPPORTED_CRITICAL_PAYLOAD);
701 }
702 break;
703 case PARSE_ERROR:
704 DBG1(DBG_IKE, "message parsing failed");
705 if (is_request)
706 {
707 send_notify_response(this, message, INVALID_SYNTAX);
708 }
709 break;
710 case VERIFY_ERROR:
711 DBG1(DBG_IKE, "message verification failed");
712 if (is_request)
713 {
714 send_notify_response(this, message, INVALID_SYNTAX);
715 }
716 break;
717 case FAILED:
718 DBG1(DBG_IKE, "integrity check failed");
719 /* ignored */
720 break;
721 case INVALID_STATE:
722 DBG1(DBG_IKE, "found encrypted message, but no keys available");
723 if (is_request)
724 {
725 send_notify_response(this, message, INVALID_SYNTAX);
726 }
727 default:
728 break;
729 }
730 }
731 DBG1(DBG_IKE, "%N %s with message ID %d processing failed",
732 exchange_type_names, message->get_exchange_type(message),
733 message->get_request(message) ? "request" : "response",
734 message->get_message_id(message));
735 return status;
736 }
737 else
738 {
739 host_t *me, *other;
740
741 me = message->get_destination(message);
742 other = message->get_source(message);
743
744 /* if this IKE_SA is virgin, we check for a config */
745 if (this->ike_cfg == NULL)
746 {
747 job_t *job;
748 this->ike_cfg = charon->cfg_store->get_ike_cfg(charon->cfg_store,
749 me, other);
750 if (this->ike_cfg == NULL)
751 {
752 /* no config found for these hosts, destroy */
753 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
754 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
755 send_notify_response(this, message, NO_PROPOSAL_CHOSEN);
756 return DESTROY_ME;
757 }
758 /* add a timeout if peer does not establish it completely */
759 job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, FALSE);
760 charon->event_queue->add_relative(charon->event_queue, job,
761 HALF_OPEN_IKE_SA_TIMEOUT);
762 }
763
764 /* check if message is trustworthy, and update host information */
765 if (this->state == IKE_CREATED ||
766 message->get_exchange_type(message) != IKE_SA_INIT)
767 {
768 update_hosts(this, me, other);
769 this->time.inbound = time(NULL);
770 }
771 return this->task_manager->process_message(this->task_manager, message);
772 }
773 }
774
775 /**
776 * Implementation of ike_sa_t.initiate.
777 */
778 static status_t initiate(private_ike_sa_t *this, child_cfg_t *child_cfg)
779 {
780 task_t *task;
781
782 if (this->state == IKE_CREATED)
783 {
784
785 if (this->other_host->is_anyaddr(this->other_host))
786 {
787 SIG(IKE_UP_START, "initiating IKE_SA");
788 SIG(IKE_UP_FAILED, "unable to initiate to %%any");
789 return DESTROY_ME;
790 }
791
792 task = (task_t*)ike_init_create(&this->public, TRUE, NULL);
793 this->task_manager->queue_task(this->task_manager, task);
794 task = (task_t*)ike_natd_create(&this->public, TRUE);
795 this->task_manager->queue_task(this->task_manager, task);
796 task = (task_t*)ike_cert_create(&this->public, TRUE);
797 this->task_manager->queue_task(this->task_manager, task);
798 task = (task_t*)ike_auth_create(&this->public, TRUE);
799 this->task_manager->queue_task(this->task_manager, task);
800 task = (task_t*)ike_config_create(&this->public, TRUE);
801 this->task_manager->queue_task(this->task_manager, task);
802 }
803
804 task = (task_t*)child_create_create(&this->public, child_cfg);
805 this->task_manager->queue_task(this->task_manager, task);
806
807 return this->task_manager->initiate(this->task_manager);
808 }
809
810 /**
811 * Implementation of ike_sa_t.acquire.
812 */
813 static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
814 {
815 child_cfg_t *child_cfg;
816 iterator_t *iterator;
817 child_sa_t *current, *child_sa = NULL;
818 task_t *task;
819 child_create_t *child_create;
820
821 if (this->state == IKE_DELETING)
822 {
823 SIG(CHILD_UP_START, "acquiring CHILD_SA on kernel request");
824 SIG(CHILD_UP_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
825 "IKE_SA is deleting", reqid);
826 return FAILED;
827 }
828
829 /* find CHILD_SA */
830 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
831 while (iterator->iterate(iterator, (void**)&current))
832 {
833 if (current->get_reqid(current) == reqid)
834 {
835 child_sa = current;
836 break;
837 }
838 }
839 iterator->destroy(iterator);
840 if (!child_sa)
841 {
842 SIG(CHILD_UP_START, "acquiring CHILD_SA on kernel request");
843 SIG(CHILD_UP_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
844 "CHILD_SA not found", reqid);
845 return FAILED;
846 }
847
848
849 if (this->state == IKE_CREATED)
850 {
851 task = (task_t*)ike_init_create(&this->public, TRUE, NULL);
852 this->task_manager->queue_task(this->task_manager, task);
853 task = (task_t*)ike_natd_create(&this->public, TRUE);
854 this->task_manager->queue_task(this->task_manager, task);
855 task = (task_t*)ike_cert_create(&this->public, TRUE);
856 this->task_manager->queue_task(this->task_manager, task);
857 task = (task_t*)ike_auth_create(&this->public, TRUE);
858 this->task_manager->queue_task(this->task_manager, task);
859 task = (task_t*)ike_config_create(&this->public, TRUE);
860 this->task_manager->queue_task(this->task_manager, task);
861 }
862
863 child_cfg = child_sa->get_config(child_sa);
864 child_create = child_create_create(&this->public, child_cfg);
865 child_create->use_reqid(child_create, reqid);
866 this->task_manager->queue_task(this->task_manager, (task_t*)child_create);
867
868 return this->task_manager->initiate(this->task_manager);
869 }
870
871 /**
872 * Implementation of ike_sa_t.route.
873 */
874 static status_t route(private_ike_sa_t *this, child_cfg_t *child_cfg)
875 {
876 child_sa_t *child_sa;
877 iterator_t *iterator;
878 linked_list_t *my_ts, *other_ts;
879 status_t status;
880
881 SIG(CHILD_ROUTE_START, "routing CHILD_SA");
882
883 /* check if not already routed*/
884 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
885 while (iterator->iterate(iterator, (void**)&child_sa))
886 {
887 if (child_sa->get_state(child_sa) == CHILD_ROUTED &&
888 streq(child_sa->get_name(child_sa), child_cfg->get_name(child_cfg)))
889 {
890 iterator->destroy(iterator);
891 SIG(CHILD_ROUTE_FAILED, "CHILD_SA with such a config already routed");
892 return FAILED;
893 }
894 }
895 iterator->destroy(iterator);
896
897 switch (this->state)
898 {
899 case IKE_DELETING:
900 case IKE_REKEYING:
901 SIG(CHILD_ROUTE_FAILED,
902 "unable to route CHILD_SA, as its IKE_SA gets deleted");
903 return FAILED;
904 case IKE_CREATED:
905 case IKE_CONNECTING:
906 case IKE_ESTABLISHED:
907 default:
908 break;
909 }
910
911 /* install kernel policies */
912 child_sa = child_sa_create(this->my_host, this->other_host, this->my_id,
913 this->other_id, child_cfg, FALSE, 0);
914
915 my_ts = child_cfg->get_traffic_selectors(child_cfg, TRUE, NULL,
916 this->my_host);
917 other_ts = child_cfg->get_traffic_selectors(child_cfg, FALSE, NULL,
918 this->other_host);
919 status = child_sa->add_policies(child_sa, my_ts, other_ts,
920 child_cfg->get_mode(child_cfg));
921 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
922 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
923 if (status == SUCCESS)
924 {
925 this->child_sas->insert_last(this->child_sas, child_sa);
926 SIG(CHILD_ROUTE_SUCCESS, "CHILD_SA routed");
927 }
928 else
929 {
930 SIG(CHILD_ROUTE_FAILED, "routing CHILD_SA failed");
931 }
932 return status;
933 }
934
935 /**
936 * Implementation of ike_sa_t.unroute.
937 */
938 static status_t unroute(private_ike_sa_t *this, child_cfg_t *child_cfg)
939 {
940 iterator_t *iterator;
941 child_sa_t *child_sa;
942 bool found = FALSE;
943
944 SIG(CHILD_UNROUTE_START, "unrouting CHILD_SA");
945
946 /* find CHILD_SA in ROUTED state */
947 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
948 while (iterator->iterate(iterator, (void**)&child_sa))
949 {
950 if (child_sa->get_state(child_sa) == CHILD_ROUTED &&
951 streq(child_sa->get_name(child_sa), child_cfg->get_name(child_cfg)))
952 {
953 iterator->remove(iterator);
954 SIG(CHILD_UNROUTE_SUCCESS, "CHILD_SA unrouted");
955 child_sa->destroy(child_sa);
956 found = TRUE;
957 break;
958 }
959 }
960 iterator->destroy(iterator);
961
962 if (!found)
963 {
964 SIG(CHILD_UNROUTE_FAILED, "CHILD_SA to unroute not found");
965 return FAILED;
966 }
967 /* if we are not established, and we have no more routed childs, remove whole SA */
968 if (this->state == IKE_CREATED &&
969 this->child_sas->get_count(this->child_sas) == 0)
970 {
971 return DESTROY_ME;
972 }
973 return SUCCESS;
974 }
975
976 /**
977 * Implementation of ike_sa_t.retransmit.
978 */
979 static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
980 {
981 this->time.outbound = time(NULL);
982 if (this->task_manager->retransmit(this->task_manager, message_id) != SUCCESS)
983 {
984 child_cfg_t *child_cfg;
985 child_sa_t* child_sa;
986 linked_list_t *to_route, *to_restart;
987 iterator_t *iterator;
988
989 /* send a proper signal to brief interested bus listeners */
990 switch (this->state)
991 {
992 case IKE_CONNECTING:
993 {
994 /* retry IKE_SA_INIT if we have multiple keyingtries */
995 u_int32_t tries = this->peer_cfg->get_keyingtries(this->peer_cfg);
996 this->keyingtry++;
997 if (tries == 0 || tries > this->keyingtry)
998 {
999 SIG(IKE_UP_FAILED, "peer not responding, trying again "
1000 "(%d/%d) in background ", this->keyingtry + 1, tries);
1001 reset(this);
1002 return this->task_manager->initiate(this->task_manager);
1003 }
1004 SIG(IKE_UP_FAILED, "establishing IKE_SA failed, peer not responding");
1005 break;
1006 }
1007 case IKE_REKEYING:
1008 SIG(IKE_REKEY_FAILED, "rekeying IKE_SA failed, peer not responding");
1009 break;
1010 case IKE_DELETING:
1011 SIG(IKE_DOWN_FAILED, "proper IKE_SA delete failed, peer not responding");
1012 break;
1013 default:
1014 break;
1015 }
1016
1017 /* summarize how we have to handle each child */
1018 to_route = linked_list_create();
1019 to_restart = linked_list_create();
1020 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1021 while (iterator->iterate(iterator, (void**)&child_sa))
1022 {
1023 child_cfg = child_sa->get_config(child_sa);
1024
1025 if (child_sa->get_state(child_sa) == CHILD_ROUTED)
1026 {
1027 /* reroute routed CHILD_SAs */
1028 to_route->insert_last(to_route, child_cfg);
1029 }
1030 else
1031 {
1032 /* use DPD action for established CHILD_SAs */
1033 switch (this->peer_cfg->get_dpd_action(this->peer_cfg))
1034 {
1035 case DPD_ROUTE:
1036 to_route->insert_last(to_route, child_cfg);
1037 break;
1038 case DPD_RESTART:
1039 to_restart->insert_last(to_restart, child_cfg);
1040 break;
1041 default:
1042 break;
1043 }
1044 }
1045 }
1046 iterator->destroy(iterator);
1047
1048 /* create a new IKE_SA if we have to route or to restart */
1049 if (to_route->get_count(to_route) || to_restart->get_count(to_restart))
1050 {
1051 private_ike_sa_t *new;
1052 task_t *task;
1053
1054 new = (private_ike_sa_t*)charon->ike_sa_manager->checkout_new(
1055 charon->ike_sa_manager, TRUE);
1056
1057 set_peer_cfg(new, this->peer_cfg);
1058 /* use actual used host, not the wildcarded one in config */
1059 new->other_host->destroy(new->other_host);
1060 new->other_host = this->other_host->clone(this->other_host);
1061
1062 /* install routes */
1063 while (to_route->remove_last(to_route, (void**)&child_cfg) == SUCCESS)
1064 {
1065 route(new, child_cfg);
1066 }
1067
1068 /* restart children */
1069 if (to_restart->get_count(to_restart))
1070 {
1071 task = (task_t*)ike_init_create(&new->public, TRUE, NULL);
1072 new->task_manager->queue_task(new->task_manager, task);
1073 task = (task_t*)ike_natd_create(&new->public, TRUE);
1074 new->task_manager->queue_task(new->task_manager, task);
1075 task = (task_t*)ike_cert_create(&new->public, TRUE);
1076 new->task_manager->queue_task(new->task_manager, task);
1077 task = (task_t*)ike_config_create(&new->public, TRUE);
1078 new->task_manager->queue_task(new->task_manager, task);
1079 task = (task_t*)ike_auth_create(&new->public, TRUE);
1080 new->task_manager->queue_task(new->task_manager, task);
1081
1082 while (to_restart->remove_last(to_restart, (void**)&child_cfg) == SUCCESS)
1083 {
1084 task = (task_t*)child_create_create(&new->public, child_cfg);
1085 new->task_manager->queue_task(new->task_manager, task);
1086 }
1087 new->task_manager->initiate(new->task_manager);
1088 }
1089 charon->ike_sa_manager->checkin(charon->ike_sa_manager, &new->public);
1090 }
1091 to_route->destroy(to_route);
1092 to_restart->destroy(to_restart);
1093 return DESTROY_ME;
1094 }
1095 return SUCCESS;
1096 }
1097
1098 /**
1099 * Implementation of ike_sa_t.get_prf.
1100 */
1101 static prf_t *get_prf(private_ike_sa_t *this)
1102 {
1103 return this->prf;
1104 }
1105
1106 /**
1107 * Implementation of ike_sa_t.get_prf.
1108 */
1109 static prf_t *get_child_prf(private_ike_sa_t *this)
1110 {
1111 return this->child_prf;
1112 }
1113
1114 /**
1115 * Implementation of ike_sa_t.get_skp_bild
1116 */
1117 static chunk_t get_skp_build(private_ike_sa_t *this)
1118 {
1119 return this->skp_build;
1120 }
1121
1122 /**
1123 * Implementation of ike_sa_t.get_skp_verify
1124 */
1125 static chunk_t get_skp_verify(private_ike_sa_t *this)
1126 {
1127 return this->skp_verify;
1128 }
1129
1130 /**
1131 * Implementation of ike_sa_t.get_id.
1132 */
1133 static ike_sa_id_t* get_id(private_ike_sa_t *this)
1134 {
1135 return this->ike_sa_id;
1136 }
1137
1138 /**
1139 * Implementation of ike_sa_t.get_my_id.
1140 */
1141 static identification_t* get_my_id(private_ike_sa_t *this)
1142 {
1143 return this->my_id;
1144 }
1145
1146 /**
1147 * Implementation of ike_sa_t.set_my_id.
1148 */
1149 static void set_my_id(private_ike_sa_t *this, identification_t *me)
1150 {
1151 DESTROY_IF(this->my_id);
1152 this->my_id = me;
1153 }
1154
1155 /**
1156 * Implementation of ike_sa_t.get_other_id.
1157 */
1158 static identification_t* get_other_id(private_ike_sa_t *this)
1159 {
1160 return this->other_id;
1161 }
1162
1163 /**
1164 * Implementation of ike_sa_t.set_other_id.
1165 */
1166 static void set_other_id(private_ike_sa_t *this, identification_t *other)
1167 {
1168 DESTROY_IF(this->other_id);
1169 this->other_id = other;
1170 }
1171
1172 /**
1173 * Implementation of ike_sa_t.set_virtual_ip
1174 */
1175 static void set_virtual_ip(private_ike_sa_t *this, bool local, host_t *ip)
1176 {
1177 if (local)
1178 {
1179 DBG1(DBG_IKE, "installing new virtual IP %H", ip);
1180 if (this->my_virtual_ip)
1181 {
1182 DBG1(DBG_IKE, "removing old virtual IP %H", this->my_virtual_ip);
1183 charon->kernel_interface->del_ip(charon->kernel_interface,
1184 this->my_virtual_ip,
1185 this->my_host);
1186 this->my_virtual_ip->destroy(this->my_virtual_ip);
1187 }
1188 if (charon->kernel_interface->add_ip(charon->kernel_interface, ip,
1189 this->my_host) == SUCCESS)
1190 {
1191 this->my_virtual_ip = ip->clone(ip);
1192 }
1193 else
1194 {
1195 DBG1(DBG_IKE, "installing virtual IP %H failed", ip);
1196 this->my_virtual_ip = NULL;
1197 }
1198 }
1199 else
1200 {
1201 DESTROY_IF(this->other_virtual_ip);
1202 this->other_virtual_ip = ip->clone(ip);
1203 }
1204 }
1205
1206 /**
1207 * Implementation of ike_sa_t.get_virtual_ip
1208 */
1209 static host_t* get_virtual_ip(private_ike_sa_t *this, bool local)
1210 {
1211 if (local)
1212 {
1213 return this->my_virtual_ip;
1214 }
1215 else
1216 {
1217 return this->other_virtual_ip;
1218 }
1219 }
1220
1221 /**
1222 * Implementation of ike_sa_t.derive_keys.
1223 */
1224 static status_t derive_keys(private_ike_sa_t *this,
1225 proposal_t *proposal, chunk_t secret,
1226 chunk_t nonce_i, chunk_t nonce_r,
1227 bool initiator, prf_t *child_prf, prf_t *old_prf)
1228 {
1229 prf_plus_t *prf_plus;
1230 chunk_t skeyseed, key, nonces, prf_plus_seed;
1231 algorithm_t *algo;
1232 size_t key_size;
1233 crypter_t *crypter_i, *crypter_r;
1234 signer_t *signer_i, *signer_r;
1235 u_int8_t spi_i_buf[sizeof(u_int64_t)], spi_r_buf[sizeof(u_int64_t)];
1236 chunk_t spi_i = chunk_from_buf(spi_i_buf);
1237 chunk_t spi_r = chunk_from_buf(spi_r_buf);
1238
1239 /* Create SAs general purpose PRF first, we may use it here */
1240 if (!proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo))
1241 {
1242 DBG1(DBG_IKE, "key derivation failed: no PSEUDO_RANDOM_FUNCTION");;
1243 return FAILED;
1244 }
1245 this->prf = prf_create(algo->algorithm);
1246 if (this->prf == NULL)
1247 {
1248 DBG1(DBG_IKE, "key derivation failed: PSEUDO_RANDOM_FUNCTION "
1249 "%N not supported!", pseudo_random_function_names, algo->algorithm);
1250 return FAILED;
1251 }
1252
1253 DBG4(DBG_IKE, "shared Diffie Hellman secret %B", &secret);
1254 nonces = chunk_cat("cc", nonce_i, nonce_r);
1255 *((u_int64_t*)spi_i.ptr) = this->ike_sa_id->get_initiator_spi(this->ike_sa_id);
1256 *((u_int64_t*)spi_r.ptr) = this->ike_sa_id->get_responder_spi(this->ike_sa_id);
1257 prf_plus_seed = chunk_cat("ccc", nonces, spi_i, spi_r);
1258
1259 /* KEYMAT = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr)
1260 *
1261 * if we are rekeying, SKEYSEED is built on another way
1262 */
1263 if (child_prf == NULL) /* not rekeying */
1264 {
1265 /* SKEYSEED = prf(Ni | Nr, g^ir) */
1266 this->prf->set_key(this->prf, nonces);
1267 this->prf->allocate_bytes(this->prf, secret, &skeyseed);
1268 DBG4(DBG_IKE, "SKEYSEED %B", &skeyseed);
1269 this->prf->set_key(this->prf, skeyseed);
1270 chunk_free(&skeyseed);
1271 chunk_free(&secret);
1272 prf_plus = prf_plus_create(this->prf, prf_plus_seed);
1273 }
1274 else
1275 {
1276 /* SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
1277 * use OLD SAs PRF functions for both prf_plus and prf */
1278 secret = chunk_cat("mc", secret, nonces);
1279 child_prf->allocate_bytes(child_prf, secret, &skeyseed);
1280 DBG4(DBG_IKE, "SKEYSEED %B", &skeyseed);
1281 old_prf->set_key(old_prf, skeyseed);
1282 chunk_free(&skeyseed);
1283 chunk_free(&secret);
1284 prf_plus = prf_plus_create(old_prf, prf_plus_seed);
1285 }
1286 chunk_free(&nonces);
1287 chunk_free(&prf_plus_seed);
1288
1289 /* KEYMAT = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr */
1290
1291 /* SK_d is used for generating CHILD_SA key mat => child_prf */
1292 proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo);
1293 this->child_prf = prf_create(algo->algorithm);
1294 key_size = this->child_prf->get_key_size(this->child_prf);
1295 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1296 DBG4(DBG_IKE, "Sk_d secret %B", &key);
1297 this->child_prf->set_key(this->child_prf, key);
1298 chunk_free(&key);
1299
1300 /* SK_ai/SK_ar used for integrity protection => signer_in/signer_out */
1301 if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &algo))
1302 {
1303 DBG1(DBG_IKE, "key derivation failed: no INTEGRITY_ALGORITHM");
1304 return FAILED;
1305 }
1306 signer_i = signer_create(algo->algorithm);
1307 signer_r = signer_create(algo->algorithm);
1308 if (signer_i == NULL || signer_r == NULL)
1309 {
1310 DBG1(DBG_IKE, "key derivation failed: INTEGRITY_ALGORITHM "
1311 "%N not supported!", integrity_algorithm_names ,algo->algorithm);
1312 return FAILED;
1313 }
1314 key_size = signer_i->get_key_size(signer_i);
1315
1316 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1317 DBG4(DBG_IKE, "Sk_ai secret %B", &key);
1318 signer_i->set_key(signer_i, key);
1319 chunk_free(&key);
1320
1321 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1322 DBG4(DBG_IKE, "Sk_ar secret %B", &key);
1323 signer_r->set_key(signer_r, key);
1324 chunk_free(&key);
1325
1326 if (initiator)
1327 {
1328 this->signer_in = signer_r;
1329 this->signer_out = signer_i;
1330 }
1331 else
1332 {
1333 this->signer_in = signer_i;
1334 this->signer_out = signer_r;
1335 }
1336
1337 /* SK_ei/SK_er used for encryption => crypter_in/crypter_out */
1338 if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &algo))
1339 {
1340 DBG1(DBG_IKE, "key derivation failed: no ENCRYPTION_ALGORITHM");
1341 return FAILED;
1342 }
1343 crypter_i = crypter_create(algo->algorithm, algo->key_size / 8);
1344 crypter_r = crypter_create(algo->algorithm, algo->key_size / 8);
1345 if (crypter_i == NULL || crypter_r == NULL)
1346 {
1347 DBG1(DBG_IKE, "key derivation failed: ENCRYPTION_ALGORITHM "
1348 "%N (key size %d) not supported!",
1349 encryption_algorithm_names, algo->algorithm, algo->key_size);
1350 return FAILED;
1351 }
1352 key_size = crypter_i->get_key_size(crypter_i);
1353
1354 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1355 DBG4(DBG_IKE, "Sk_ei secret %B", &key);
1356 crypter_i->set_key(crypter_i, key);
1357 chunk_free(&key);
1358
1359 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1360 DBG4(DBG_IKE, "Sk_er secret %B", &key);
1361 crypter_r->set_key(crypter_r, key);
1362 chunk_free(&key);
1363
1364 if (initiator)
1365 {
1366 this->crypter_in = crypter_r;
1367 this->crypter_out = crypter_i;
1368 }
1369 else
1370 {
1371 this->crypter_in = crypter_i;
1372 this->crypter_out = crypter_r;
1373 }
1374
1375 /* SK_pi/SK_pr used for authentication => stored for later */
1376 key_size = this->prf->get_key_size(this->prf);
1377 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1378 DBG4(DBG_IKE, "Sk_pi secret %B", &key);
1379 if (initiator)
1380 {
1381 this->skp_build = key;
1382 }
1383 else
1384 {
1385 this->skp_verify = key;
1386 }
1387 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1388 DBG4(DBG_IKE, "Sk_pr secret %B", &key);
1389 if (initiator)
1390 {
1391 this->skp_verify = key;
1392 }
1393 else
1394 {
1395 this->skp_build = key;
1396 }
1397
1398 /* all done, prf_plus not needed anymore */
1399 prf_plus->destroy(prf_plus);
1400
1401 return SUCCESS;
1402 }
1403
1404 /**
1405 * Implementation of ike_sa_t.add_child_sa.
1406 */
1407 static void add_child_sa(private_ike_sa_t *this, child_sa_t *child_sa)
1408 {
1409 this->child_sas->insert_last(this->child_sas, child_sa);
1410 }
1411
1412 /**
1413 * Implementation of ike_sa_t.get_child_sa.
1414 */
1415 static child_sa_t* get_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
1416 u_int32_t spi, bool inbound)
1417 {
1418 iterator_t *iterator;
1419 child_sa_t *current, *found = NULL;
1420
1421 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1422 while (iterator->iterate(iterator, (void**)&current))
1423 {
1424 if (current->get_spi(current, inbound) == spi &&
1425 current->get_protocol(current) == protocol)
1426 {
1427 found = current;
1428 }
1429 }
1430 iterator->destroy(iterator);
1431 return found;
1432 }
1433
1434 /**
1435 * Implementation of ike_sa_t.create_child_sa_iterator.
1436 */
1437 static iterator_t* create_child_sa_iterator(private_ike_sa_t *this)
1438 {
1439 return this->child_sas->create_iterator(this->child_sas, TRUE);
1440 }
1441
1442 /**
1443 * Implementation of ike_sa_t.rekey_child_sa.
1444 */
1445 static status_t rekey_child_sa(private_ike_sa_t *this, protocol_id_t protocol, u_int32_t spi)
1446 {
1447 child_sa_t *child_sa;
1448 child_rekey_t *child_rekey;
1449
1450 child_sa = get_child_sa(this, protocol, spi, TRUE);
1451 if (child_sa)
1452 {
1453 child_rekey = child_rekey_create(&this->public, child_sa);
1454 this->task_manager->queue_task(this->task_manager, &child_rekey->task);
1455 return this->task_manager->initiate(this->task_manager);
1456 }
1457 return FAILED;
1458 }
1459
1460 /**
1461 * Implementation of ike_sa_t.delete_child_sa.
1462 */
1463 static status_t delete_child_sa(private_ike_sa_t *this, protocol_id_t protocol, u_int32_t spi)
1464 {
1465 child_sa_t *child_sa;
1466 child_delete_t *child_delete;
1467
1468 child_sa = get_child_sa(this, protocol, spi, TRUE);
1469 if (child_sa)
1470 {
1471 child_delete = child_delete_create(&this->public, child_sa);
1472 this->task_manager->queue_task(this->task_manager, &child_delete->task);
1473 return this->task_manager->initiate(this->task_manager);
1474 }
1475 return FAILED;
1476 }
1477
1478 /**
1479 * Implementation of ike_sa_t.destroy_child_sa.
1480 */
1481 static status_t destroy_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
1482 u_int32_t spi)
1483 {
1484 iterator_t *iterator;
1485 child_sa_t *child_sa;
1486 status_t status = NOT_FOUND;
1487
1488 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1489 while (iterator->iterate(iterator, (void**)&child_sa))
1490 {
1491 if (child_sa->get_protocol(child_sa) == protocol &&
1492 child_sa->get_spi(child_sa, TRUE) == spi)
1493 {
1494 child_sa->destroy(child_sa);
1495 iterator->remove(iterator);
1496 status = SUCCESS;
1497 break;
1498 }
1499 }
1500 iterator->destroy(iterator);
1501 return status;
1502 }
1503
1504 /**
1505 * Implementation of public_ike_sa_t.delete.
1506 */
1507 static status_t delete_(private_ike_sa_t *this)
1508 {
1509 ike_delete_t *ike_delete;
1510
1511 switch (this->state)
1512 {
1513 case IKE_ESTABLISHED:
1514 DBG1(DBG_IKE, "deleting IKE_SA");
1515 /* do not log when rekeyed */
1516 case IKE_REKEYING:
1517 ike_delete = ike_delete_create(&this->public, TRUE);
1518 this->task_manager->queue_task(this->task_manager, &ike_delete->task);
1519 return this->task_manager->initiate(this->task_manager);
1520 default:
1521 DBG1(DBG_IKE, "destroying IKE_SA in state %N without notification",
1522 ike_sa_state_names, this->state);
1523 break;
1524 }
1525 return DESTROY_ME;
1526 }
1527
1528 /**
1529 * Implementation of ike_sa_t.rekey.
1530 */
1531 static status_t rekey(private_ike_sa_t *this)
1532 {
1533 ike_rekey_t *ike_rekey;
1534
1535 ike_rekey = ike_rekey_create(&this->public, TRUE);
1536
1537 this->task_manager->queue_task(this->task_manager, &ike_rekey->task);
1538 return this->task_manager->initiate(this->task_manager);
1539 }
1540
1541 /**
1542 * Implementation of ike_sa_t.reestablish
1543 */
1544 static void reestablish(private_ike_sa_t *this)
1545 {
1546 private_ike_sa_t *other;
1547 iterator_t *iterator;
1548 child_sa_t *child_sa;
1549 child_cfg_t *child_cfg;
1550 task_t *task;
1551 job_t *job;
1552
1553 other = (private_ike_sa_t*)charon->ike_sa_manager->checkout_new(
1554 charon->ike_sa_manager, TRUE);
1555
1556 set_peer_cfg(other, this->peer_cfg);
1557 other->other_host->destroy(other->other_host);
1558 other->other_host = this->other_host->clone(this->other_host);
1559 if (this->my_virtual_ip)
1560 {
1561 /* if we already have a virtual IP, we reuse it */
1562 set_virtual_ip(other, TRUE, this->my_virtual_ip);
1563 }
1564
1565 if (this->state == IKE_ESTABLISHED)
1566 {
1567 task = (task_t*)ike_init_create(&other->public, TRUE, NULL);
1568 other->task_manager->queue_task(other->task_manager, task);
1569 task = (task_t*)ike_natd_create(&other->public, TRUE);
1570 other->task_manager->queue_task(other->task_manager, task);
1571 task = (task_t*)ike_cert_create(&other->public, TRUE);
1572 other->task_manager->queue_task(other->task_manager, task);
1573 task = (task_t*)ike_config_create(&other->public, TRUE);
1574 other->task_manager->queue_task(other->task_manager, task);
1575 task = (task_t*)ike_auth_create(&other->public, TRUE);
1576 other->task_manager->queue_task(other->task_manager, task);
1577 }
1578
1579 other->task_manager->adopt_tasks(other->task_manager, this->task_manager);
1580
1581 /* Create task for established children, adopt routed children directly */
1582 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1583 while(iterator->iterate(iterator, (void**)&child_sa))
1584 {
1585 switch (child_sa->get_state(child_sa))
1586 {
1587 case CHILD_ROUTED:
1588 {
1589 iterator->remove(iterator);
1590 other->child_sas->insert_first(other->child_sas, child_sa);
1591 break;
1592 }
1593 default:
1594 {
1595 child_cfg = child_sa->get_config(child_sa);
1596 task = (task_t*)child_create_create(&other->public, child_cfg);
1597 other->task_manager->queue_task(other->task_manager, task);
1598 break;
1599 }
1600 }
1601 }
1602 iterator->destroy(iterator);
1603
1604 other->task_manager->initiate(other->task_manager);
1605
1606 charon->ike_sa_manager->checkin(charon->ike_sa_manager, &other->public);
1607
1608 job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE);
1609 charon->job_queue->add(charon->job_queue, job);
1610 }
1611
1612 /**
1613 * Implementation of ike_sa_t.inherit.
1614 */
1615 static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
1616 {
1617 child_sa_t *child_sa;
1618 host_t *ip;
1619
1620 /* apply hosts and ids */
1621 this->my_host->destroy(this->my_host);
1622 this->other_host->destroy(this->other_host);
1623 this->my_id->destroy(this->my_id);
1624 this->other_id->destroy(this->other_id);
1625 this->my_host = other->my_host->clone(other->my_host);
1626 this->other_host = other->other_host->clone(other->other_host);
1627 this->my_id = other->my_id->clone(other->my_id);
1628 this->other_id = other->other_id->clone(other->other_id);
1629
1630 /* apply virtual assigned IPs... */
1631 if (other->my_virtual_ip)
1632 {
1633 this->my_virtual_ip = other->my_virtual_ip;
1634 other->my_virtual_ip = NULL;
1635 }
1636 if (other->other_virtual_ip)
1637 {
1638 this->other_virtual_ip = other->other_virtual_ip;
1639 other->other_virtual_ip = NULL;
1640 }
1641
1642 /* ... and DNS servers */
1643 while (other->dns_servers->remove_last(other->dns_servers,
1644 (void**)&ip) == SUCCESS)
1645 {
1646 this->dns_servers->insert_first(this->dns_servers, ip);
1647 }
1648
1649 /* adopt all children */
1650 while (other->child_sas->remove_last(other->child_sas,
1651 (void**)&child_sa) == SUCCESS)
1652 {
1653 this->child_sas->insert_first(this->child_sas, (void*)child_sa);
1654 }
1655
1656 /* move pending tasks to the new IKE_SA */
1657 this->task_manager->adopt_tasks(this->task_manager, other->task_manager);
1658
1659 /* we have to initate here, there may be new tasks to handle */
1660 return this->task_manager->initiate(this->task_manager);
1661 }
1662
1663 /**
1664 * Implementation of ike_sa_t.is_natt_enabled.
1665 */
1666 static bool is_natt_enabled(private_ike_sa_t *this)
1667 {
1668 return this->nat_here || this->nat_there;
1669 }
1670
1671 /**
1672 * Implementation of ike_sa_t.enable_natt.
1673 */
1674 static void enable_natt(private_ike_sa_t *this, bool local)
1675 {
1676 if (local)
1677 {
1678 DBG1(DBG_IKE, "local host is behind NAT, scheduling keep alives");
1679 this->nat_here = TRUE;
1680 send_keepalive(this);
1681 }
1682 else
1683 {
1684 DBG1(DBG_IKE, "remote host is behind NAT");
1685 this->nat_there = TRUE;
1686 }
1687 }
1688
1689 /**
1690 * Implementation of ike_sa_t.remove_dns_server
1691 */
1692 static void remove_dns_servers(private_ike_sa_t *this)
1693 {
1694 FILE *file;
1695 struct stat stats;
1696 chunk_t contents, line, orig_line, token;
1697 char string[INET6_ADDRSTRLEN];
1698 host_t *ip;
1699 iterator_t *iterator;
1700
1701 if (this->dns_servers->get_count(this->dns_servers) == 0)
1702 {
1703 /* don't touch anything if we have no nameservers installed */
1704 return;
1705 }
1706
1707 file = fopen(RESOLV_CONF, "r");
1708 if (file == NULL || stat(RESOLV_CONF, &stats) != 0)
1709 {
1710 DBG1(DBG_IKE, "unable to open DNS configuration file %s: %s",
1711 RESOLV_CONF, strerror(errno));
1712 return;
1713 }
1714
1715 contents = chunk_alloca((size_t)stats.st_size);
1716
1717 if (fread(contents.ptr, 1, contents.len, file) != contents.len)
1718 {
1719 DBG1(DBG_IKE, "unable to read DNS configuration file: %s", strerror(errno));
1720 fclose(file);
1721 return;
1722 }
1723
1724 fclose(file);
1725 file = fopen(RESOLV_CONF, "w");
1726 if (file == NULL)
1727 {
1728 DBG1(DBG_IKE, "unable to open DNS configuration file %s: %s",
1729 RESOLV_CONF, strerror(errno));
1730 return;
1731 }
1732
1733 iterator = this->dns_servers->create_iterator(this->dns_servers, TRUE);
1734 while (fetchline(&contents, &line))
1735 {
1736 bool found = FALSE;
1737 orig_line = line;
1738 if (extract_token(&token, ' ', &line) &&
1739 strncasecmp(token.ptr, "nameserver", token.len) == 0)
1740 {
1741 if (!extract_token(&token, ' ', &line))
1742 {
1743 token = line;
1744 }
1745 iterator->reset(iterator);
1746 while (iterator->iterate(iterator, (void**)&ip))
1747 {
1748 snprintf(string, sizeof(string), "%H", ip);
1749 if (strlen(string) == token.len &&
1750 strncmp(token.ptr, string, token.len) == 0)
1751 {
1752 iterator->remove(iterator);
1753 ip->destroy(ip);
1754 found = TRUE;
1755 break;
1756 }
1757 }
1758 }
1759
1760 if (!found)
1761 {
1762 /* write line untouched back to file */
1763 fwrite(orig_line.ptr, orig_line.len, 1, file);
1764 fprintf(file, "\n");
1765 }
1766 }
1767 iterator->destroy(iterator);
1768 fclose(file);
1769 }
1770
1771 /**
1772 * Implementation of ike_sa_t.add_dns_server
1773 */
1774 static void add_dns_server(private_ike_sa_t *this, host_t *dns)
1775 {
1776 FILE *file;
1777 struct stat stats;
1778 chunk_t contents;
1779
1780 DBG1(DBG_IKE, "installing DNS server %H", dns);
1781
1782 file = fopen(RESOLV_CONF, "a+");
1783 if (file == NULL || stat(RESOLV_CONF, &stats) != 0)
1784 {
1785 DBG1(DBG_IKE, "unable to open DNS configuration file %s: %s",
1786 RESOLV_CONF, strerror(errno));
1787 return;
1788 }
1789
1790 contents = chunk_alloca(stats.st_size);
1791
1792 if (fread(contents.ptr, 1, contents.len, file) != contents.len)
1793 {
1794 DBG1(DBG_IKE, "unable to read DNS configuration file: %s", strerror(errno));
1795 fclose(file);
1796 return;
1797 }
1798
1799 fclose(file);
1800 file = fopen(RESOLV_CONF, "w");
1801 if (file == NULL)
1802 {
1803 DBG1(DBG_IKE, "unable to open DNS configuration file %s: %s",
1804 RESOLV_CONF, strerror(errno));
1805 return;
1806 }
1807
1808 if (fprintf(file, "nameserver %H # added by strongSwan, assigned by %D\n",
1809 dns, this->other_id) < 0)
1810 {
1811 DBG1(DBG_IKE, "unable to write DNS configuration: %s", strerror(errno));
1812 }
1813 else
1814 {
1815 this->dns_servers->insert_last(this->dns_servers, dns->clone(dns));
1816 }
1817 fwrite(contents.ptr, contents.len, 1, file);
1818
1819 fclose(file);
1820 }
1821
1822 /**
1823 * Implementation of ike_sa_t.destroy.
1824 */
1825 static void destroy(private_ike_sa_t *this)
1826 {
1827 this->child_sas->destroy_offset(this->child_sas, offsetof(child_sa_t, destroy));
1828
1829 DESTROY_IF(this->crypter_in);
1830 DESTROY_IF(this->crypter_out);
1831 DESTROY_IF(this->signer_in);
1832 DESTROY_IF(this->signer_out);
1833 DESTROY_IF(this->prf);
1834 DESTROY_IF(this->child_prf);
1835 chunk_free(&this->skp_verify);
1836 chunk_free(&this->skp_build);
1837
1838 if (this->my_virtual_ip)
1839 {
1840 charon->kernel_interface->del_ip(charon->kernel_interface,
1841 this->my_virtual_ip, this->my_host);
1842 this->my_virtual_ip->destroy(this->my_virtual_ip);
1843 }
1844 DESTROY_IF(this->other_virtual_ip);
1845
1846 remove_dns_servers(this);
1847 this->dns_servers->destroy_offset(this->dns_servers, offsetof(host_t, destroy));
1848
1849 DESTROY_IF(this->my_host);
1850 DESTROY_IF(this->other_host);
1851 DESTROY_IF(this->my_id);
1852 DESTROY_IF(this->other_id);
1853
1854 DESTROY_IF(this->ike_cfg);
1855 DESTROY_IF(this->peer_cfg);
1856
1857 this->ike_sa_id->destroy(this->ike_sa_id);
1858 this->task_manager->destroy(this->task_manager);
1859 free(this);
1860 }
1861
1862 /*
1863 * Described in header.
1864 */
1865 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
1866 {
1867 private_ike_sa_t *this = malloc_thing(private_ike_sa_t);
1868 static u_int32_t unique_id = 0;
1869
1870 /* Public functions */
1871 this->public.get_state = (ike_sa_state_t(*)(ike_sa_t*)) get_state;
1872 this->public.set_state = (void(*)(ike_sa_t*,ike_sa_state_t)) set_state;
1873 this->public.get_stats = (void(*)(ike_sa_t*,u_int32_t*))get_stats;
1874 this->public.get_name = (char*(*)(ike_sa_t*))get_name;
1875 this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
1876 this->public.initiate = (status_t(*)(ike_sa_t*,child_cfg_t*)) initiate;
1877 this->public.route = (status_t(*)(ike_sa_t*,child_cfg_t*)) route;
1878 this->public.unroute = (status_t(*)(ike_sa_t*,child_cfg_t*)) unroute;
1879 this->public.acquire = (status_t(*)(ike_sa_t*,u_int32_t)) acquire;
1880 this->public.get_ike_cfg = (ike_cfg_t*(*)(ike_sa_t*))get_ike_cfg;
1881 this->public.set_ike_cfg = (void(*)(ike_sa_t*,ike_cfg_t*))set_ike_cfg;
1882 this->public.get_peer_cfg = (peer_cfg_t*(*)(ike_sa_t*))get_peer_cfg;
1883 this->public.set_peer_cfg = (void(*)(ike_sa_t*,peer_cfg_t*))set_peer_cfg;
1884 this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
1885 this->public.get_my_host = (host_t*(*)(ike_sa_t*)) get_my_host;
1886 this->public.set_my_host = (void(*)(ike_sa_t*,host_t*)) set_my_host;
1887 this->public.get_other_host = (host_t*(*)(ike_sa_t*)) get_other_host;
1888 this->public.set_other_host = (void(*)(ike_sa_t*,host_t*)) set_other_host;
1889 this->public.get_my_id = (identification_t*(*)(ike_sa_t*)) get_my_id;
1890 this->public.set_my_id = (void(*)(ike_sa_t*,identification_t*)) set_my_id;
1891 this->public.get_other_id = (identification_t*(*)(ike_sa_t*)) get_other_id;
1892 this->public.set_other_id = (void(*)(ike_sa_t*,identification_t*)) set_other_id;
1893 this->public.retransmit = (status_t (*) (ike_sa_t *, u_int32_t)) retransmit;
1894 this->public.delete = (status_t(*)(ike_sa_t*))delete_;
1895 this->public.destroy = (void(*)(ike_sa_t*))destroy;
1896 this->public.send_dpd = (status_t (*)(ike_sa_t*)) send_dpd;
1897 this->public.send_keepalive = (void (*)(ike_sa_t*)) send_keepalive;
1898 this->public.get_prf = (prf_t *(*) (ike_sa_t *)) get_prf;
1899 this->public.get_child_prf = (prf_t *(*) (ike_sa_t *)) get_child_prf;
1900 this->public.get_skp_verify = (chunk_t(*) (ike_sa_t *)) get_skp_verify;
1901 this->public.get_skp_build = (chunk_t(*) (ike_sa_t *)) get_skp_build;
1902 this->public.derive_keys = (status_t (*) (ike_sa_t *,proposal_t*,chunk_t,chunk_t,chunk_t,bool,prf_t*,prf_t*)) derive_keys;
1903 this->public.add_child_sa = (void (*) (ike_sa_t*,child_sa_t*)) add_child_sa;
1904 this->public.get_child_sa = (child_sa_t* (*)(ike_sa_t*,protocol_id_t,u_int32_t,bool)) get_child_sa;
1905 this->public.create_child_sa_iterator = (iterator_t* (*)(ike_sa_t*)) create_child_sa_iterator;
1906 this->public.rekey_child_sa = (status_t(*)(ike_sa_t*,protocol_id_t,u_int32_t)) rekey_child_sa;
1907 this->public.delete_child_sa = (status_t(*)(ike_sa_t*,protocol_id_t,u_int32_t)) delete_child_sa;
1908 this->public.destroy_child_sa = (status_t (*)(ike_sa_t*,protocol_id_t,u_int32_t))destroy_child_sa;
1909 this->public.enable_natt = (void(*)(ike_sa_t*, bool)) enable_natt;
1910 this->public.is_natt_enabled = (bool(*)(ike_sa_t*)) is_natt_enabled;
1911 this->public.rekey = (status_t(*)(ike_sa_t*))rekey;
1912 this->public.reestablish = (void(*)(ike_sa_t*))reestablish;
1913 this->public.inherit = (status_t(*)(ike_sa_t*,ike_sa_t*))inherit;
1914 this->public.generate_message = (status_t(*)(ike_sa_t*,message_t*,packet_t**))generate_message;
1915 this->public.reset = (void(*)(ike_sa_t*))reset;
1916 this->public.get_unique_id = (u_int32_t(*)(ike_sa_t*))get_unique_id;
1917 this->public.set_virtual_ip = (void(*)(ike_sa_t*,bool,host_t*))set_virtual_ip;
1918 this->public.get_virtual_ip = (host_t*(*)(ike_sa_t*,bool))get_virtual_ip;
1919 this->public.add_dns_server = (void(*)(ike_sa_t*,host_t*))add_dns_server;
1920
1921 /* initialize private fields */
1922 this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
1923 this->child_sas = linked_list_create();
1924 this->my_host = host_create_any(AF_INET);
1925 this->other_host = host_create_any(AF_INET);
1926 this->my_id = identification_create_from_encoding(ID_ANY, chunk_empty);
1927 this->other_id = identification_create_from_encoding(ID_ANY, chunk_empty);
1928 this->crypter_in = NULL;
1929 this->crypter_out = NULL;
1930 this->signer_in = NULL;
1931 this->signer_out = NULL;
1932 this->prf = NULL;
1933 this->skp_verify = chunk_empty;
1934 this->skp_build = chunk_empty;
1935 this->child_prf = NULL;
1936 this->nat_here = FALSE;
1937 this->nat_there = FALSE;
1938 this->state = IKE_CREATED;
1939 this->time.inbound = this->time.outbound = time(NULL);
1940 this->time.established = 0;
1941 this->time.rekey = 0;
1942 this->time.delete = 0;
1943 this->ike_cfg = NULL;
1944 this->peer_cfg = NULL;
1945 this->task_manager = task_manager_create(&this->public);
1946 this->unique_id = ++unique_id;
1947 this->my_virtual_ip = NULL;
1948 this->other_virtual_ip = NULL;
1949 this->dns_servers = linked_list_create();
1950 this->keyingtry = 0;
1951
1952 return &this->public;
1953 }