projects / strongswan.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
fixed dpd for responder
[strongswan.git] / src / charon / sa / ike_sa.c
1 /**
2 * @file ike_sa.c
3 *
4 * @brief Implementation of ike_sa_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
10 * Copyright (C) 2005-2006 Martin Willi
11 * Copyright (C) 2005 Jan Hutter
12 * Hochschule fuer Technik Rapperswil
13 *
14 * This program is free software; you can redistribute it and/or modify it
15 * under the terms of the GNU General Public License as published by the
16 * Free Software Foundation; either version 2 of the License, or (at your
17 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
18 *
19 * This program is distributed in the hope that it will be useful, but
20 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
21 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
22 * for more details.
23 */
24
25 #include <sys/time.h>
26 #include <string.h>
27
28 #include "ike_sa.h"
29
30 #include <types.h>
31 #include <daemon.h>
32 #include <definitions.h>
33 #include <utils/linked_list.h>
34 #include <utils/logger_manager.h>
35 #include <crypto/diffie_hellman.h>
36 #include <crypto/prf_plus.h>
37 #include <crypto/crypters/crypter.h>
38 #include <crypto/hashers/hasher.h>
39 #include <encoding/payloads/sa_payload.h>
40 #include <encoding/payloads/nonce_payload.h>
41 #include <encoding/payloads/ke_payload.h>
42 #include <encoding/payloads/delete_payload.h>
43 #include <encoding/payloads/transform_substructure.h>
44 #include <encoding/payloads/transform_attribute.h>
45 #include <encoding/payloads/ts_payload.h>
46 #include <sa/transactions/transaction.h>
47 #include <sa/transactions/ike_sa_init.h>
48 #include <sa/transactions/delete_ike_sa.h>
49 #include <sa/transactions/create_child_sa.h>
50 #include <sa/transactions/delete_child_sa.h>
51 #include <sa/transactions/dead_peer_detection.h>
52 #include <sa/transactions/rekey_ike_sa.h>
53 #include <queues/jobs/retransmit_request_job.h>
54 #include <queues/jobs/delete_ike_sa_job.h>
55 #include <queues/jobs/send_dpd_job.h>
56 #include <queues/jobs/send_keepalive_job.h>
57 #include <queues/jobs/rekey_ike_sa_job.h>
58 #include <queues/jobs/route_job.h>
59 #include <queues/jobs/initiate_job.h>
60
61 /**
62 * String mappings for ike_sa_state_t.
63 */
64 mapping_t ike_sa_state_m[] = {
65 {IKE_CREATED, "CREATED"},
66 {IKE_CONNECTING, "CONNECTING"},
67 {IKE_ESTABLISHED, "ESTABLISHED"},
68 {IKE_REKEYING, "REKEYING"},
69 {IKE_DELETING, "DELETING"},
70 {MAPPING_END, NULL}
71 };
72
73
74 typedef struct private_ike_sa_t private_ike_sa_t;
75
76 /**
77 * Private data of an ike_sa_t object.
78 */
79 struct private_ike_sa_t {
80
81 /**
82 * Public members
83 */
84 ike_sa_t public;
85
86 /**
87 * Identifier for the current IKE_SA.
88 */
89 ike_sa_id_t *ike_sa_id;
90
91 /**
92 * Current state of the IKE_SA
93 */
94 ike_sa_state_t state;
95
96 /**
97 * Name of the connection used by this IKE_SA
98 */
99 char *name;
100
101 /**
102 * Address of local host
103 */
104 host_t *my_host;
105
106 /**
107 * Address of remote host
108 */
109 host_t *other_host;
110
111 /**
112 * Identification used for us
113 */
114 identification_t *my_id;
115
116 /**
117 * Identification used for other
118 */
119 identification_t *other_id;
120
121 /**
122 * Linked List containing the child sa's of the current IKE_SA.
123 */
124 linked_list_t *child_sas;
125
126 /**
127 * crypter for inbound traffic
128 */
129 crypter_t *crypter_in;
130
131 /**
132 * crypter for outbound traffic
133 */
134 crypter_t *crypter_out;
135
136 /**
137 * Signer for inbound traffic
138 */
139 signer_t *signer_in;
140
141 /**
142 * Signer for outbound traffic
143 */
144 signer_t *signer_out;
145
146 /**
147 * Multi purpose prf, set key, use it, forget it
148 */
149 prf_t *prf;
150
151 /**
152 * Prf function for derivating keymat child SAs
153 */
154 prf_t *child_prf;
155
156 /**
157 * PRF, with key set to pi_key, used for authentication
158 */
159 prf_t *prf_auth_i;
160
161 /**
162 * PRF, with key set to pr_key, used for authentication
163 */
164 prf_t *prf_auth_r;
165
166 /**
167 * A logger for this IKE_SA.
168 */
169 logger_t *logger;
170
171 /**
172 * NAT hasher.
173 */
174 hasher_t *nat_hasher;
175
176 /**
177 * NAT status of local host.
178 */
179 bool nat_here;
180
181 /**
182 * NAT status of remote host.
183 */
184 bool nat_there;
185
186 /**
187 * message ID for next outgoung request
188 */
189 u_int32_t message_id_out;
190
191 /**
192 * Timestamps for this IKE_SA
193 */
194 struct {
195 /** last IKE message received */
196 u_int32_t inbound;
197 /** last IKE message sent */
198 u_int32_t outbound;
199 /** when IKE_SA became established */
200 u_int32_t established;
201 /** when IKE_SA gets rekeyed */
202 u_int32_t rekey;
203 /** when IKE_SA gets deleted */
204 u_int32_t delete;
205 } time;
206
207 /**
208 * interval to send DPD liveness check
209 */
210 time_t dpd_delay;
211
212 /**
213 * number of retransmit sequences to go through before giving up (keyingtries)
214 */
215 u_int32_t retrans_sequences;
216
217 /**
218 * List of queued transactions to process
219 */
220 linked_list_t *transaction_queue;
221
222 /**
223 * Transaction currently initiated
224 * (only one supported yet, window size = 1)
225 */
226 transaction_t *transaction_out;
227
228 /**
229 * last transaction initiated by peer processed.
230 * (only one supported yet, window size = 1)
231 * Stored for retransmission.
232 */
233 transaction_t *transaction_in;
234
235 /**
236 * Next incoming transaction expected. Used to
237 * do multi transaction operations.
238 */
239 transaction_t *transaction_in_next;
240
241 /**
242 * Transaction which rekeys this IKE_SA, used do detect simultaneus rekeying
243 */
244 rekey_ike_sa_t *rekeying_transaction;
245 };
246
247 /**
248 * get the time of the latest traffic processed by the kernel
249 */
250 static time_t get_kernel_time(private_ike_sa_t* this, bool inbound)
251 {
252 iterator_t *iterator;
253 child_sa_t *child_sa;
254 time_t latest = 0, use_time;
255
256 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
257 while (iterator->iterate(iterator, (void**)&child_sa))
258 {
259 if (child_sa->get_use_time(child_sa, inbound, &use_time) == SUCCESS)
260 {
261 latest = max(latest, use_time);
262 }
263 }
264 iterator->destroy(iterator);
265
266 return latest;
267 }
268
269 /**
270 * get the time of the latest received traffice
271 */
272 static time_t get_time_inbound(private_ike_sa_t *this)
273 {
274 return max(this->time.inbound, get_kernel_time(this, TRUE));
275 }
276
277 /**
278 * get the time of the latest sent traffic
279 */
280 static time_t get_time_outbound(private_ike_sa_t *this)
281 {
282 return max(this->time.outbound, get_kernel_time(this, FALSE));
283 }
284
285 /**
286 * Implementation of ike_sa_t.get_name.
287 */
288 static char *get_name(private_ike_sa_t *this)
289 {
290 return this->name;
291 }
292
293 /**
294 * Implementation of ike_sa_t.set_name.
295 */
296 static void set_name(private_ike_sa_t *this, char* name)
297 {
298 free(this->name);
299 this->name = strdup(name);
300 }
301
302 /**
303 * Implementation of ike_sa_t.set_dpd_delay.
304 */
305 static void set_dpd_delay(private_ike_sa_t *this, u_int32_t delay)
306 {
307 this->dpd_delay = delay;
308 }
309
310 /**
311 * Implementation of ike_sa_t.get_my_host.
312 */
313 static host_t *get_my_host(private_ike_sa_t *this)
314 {
315 return this->my_host;
316 }
317
318 /**
319 * Implementation of ike_sa_t.set_my_host.
320 */
321 static void set_my_host(private_ike_sa_t *this, host_t *me)
322 {
323 DESTROY_IF(this->my_host);
324 this->my_host = me;
325 }
326
327 /**
328 * Implementation of ike_sa_t.get_other_host.
329 */
330 static host_t *get_other_host(private_ike_sa_t *this)
331 {
332 return this->other_host;
333 }
334
335 /**
336 * Implementation of ike_sa_t.set_other_host.
337 */
338 static void set_other_host(private_ike_sa_t *this, host_t *other)
339 {
340 DESTROY_IF(this->other_host);
341 this->other_host = other;
342 }
343
344 /**
345 * Update connection host, as addresses may change (NAT)
346 */
347 static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
348 {
349 /*
350 * Quoting RFC 4306:
351 *
352 * 2.11. Address and Port Agility
353 *
354 * IKE runs over UDP ports 500 and 4500, and implicitly sets up ESP and
355 * AH associations for the same IP addresses it runs over. The IP
356 * addresses and ports in the outer header are, however, not themselves
357 * cryptographically protected, and IKE is designed to work even through
358 * Network Address Translation (NAT) boxes. An implementation MUST
359 * accept incoming requests even if the source port is not 500 or 4500,
360 * and MUST respond to the address and port from which the request was
361 * received. It MUST specify the address and port at which the request
362 * was received as the source address and port in the response. IKE
363 * functions identically over IPv4 or IPv6.
364 *
365 * [...]
366 *
367 * There are cases where a NAT box decides to remove mappings that
368 * are still alive (for example, the keepalive interval is too long,
369 * or the NAT box is rebooted). To recover in these cases, hosts
370 * that are not behind a NAT SHOULD send all packets (including
371 * retransmission packets) to the IP address and port from the last
372 * valid authenticated packet from the other end (i.e., dynamically
373 * update the address). A host behind a NAT SHOULD NOT do this
374 * because it opens a DoS attack possibility. Any authenticated IKE
375 * packet or any authenticated UDP-encapsulated ESP packet can be
376 * used to detect that the IP address or the port has changed.
377 */
378 iterator_t *iterator = NULL;
379 child_sa_t *child_sa = NULL;
380 host_diff_t my_diff, other_diff;
381
382 if (this->my_host->is_anyaddr(this->my_host) ||
383 this->other_host->is_anyaddr(this->other_host))
384 {
385 /* on first received message */
386 this->my_host->destroy(this->my_host);
387 this->my_host = me->clone(me);
388 this->other_host->destroy(this->other_host);
389 this->other_host = other->clone(other);
390 return;
391 }
392
393 my_diff = me->get_differences(me, this->my_host);
394 other_diff = other->get_differences(other, this->other_host);
395
396 if (!my_diff && !other_diff)
397 {
398 return;
399 }
400
401 if (my_diff)
402 {
403 this->my_host->destroy(this->my_host);
404 this->my_host = me->clone(me);
405 }
406
407 if (!this->nat_here)
408 {
409 /* update without restrictions if we are not NATted */
410 if (other_diff)
411 {
412 this->other_host->destroy(this->other_host);
413 this->other_host = other->clone(other);
414 }
415 }
416 else
417 {
418 /* if we are natted, only port may change */
419 if (other_diff & HOST_DIFF_ADDR)
420 {
421 return;
422 }
423 else if (other_diff & HOST_DIFF_PORT)
424 {
425 this->other_host->set_port(this->other_host, other->get_port(other));
426 }
427 }
428 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
429 while (iterator->iterate(iterator, (void**)&child_sa))
430 {
431 child_sa->update_hosts(child_sa, this->my_host, this->other_host,
432 my_diff, other_diff);
433 /* TODO: what to do if update fails? Delete CHILD_SA? */
434 }
435 iterator->destroy(iterator);
436 }
437
438 /**
439 * called when the peer is not responding anymore
440 */
441 static void dpd_detected(private_ike_sa_t *this)
442 {
443 /* check for childrens with dpdaction=hold */
444 connection_t *connection = NULL;
445 policy_t *policy;
446 linked_list_t *my_ts, *other_ts;
447 child_sa_t* child_sa;
448 dpd_action_t action;
449 job_t *job;
450
451 this->logger->log(this->logger, CONTROL|LEVEL1,
452 "dead peer detected, handling CHILD_SAs dpd action");
453
454 while(this->child_sas->remove_first(this->child_sas,
455 (void**)&child_sa) == SUCCESS)
456 {
457 /* get the policy which belongs to this CHILD */
458 my_ts = child_sa->get_my_traffic_selectors(child_sa);
459 other_ts = child_sa->get_other_traffic_selectors(child_sa);
460 policy = charon->policies->get_policy(charon->policies,
461 this->my_id, this->other_id,
462 my_ts, other_ts,
463 this->my_host, this->other_host);
464 if (policy == NULL)
465 {
466 this->logger->log(this->logger, ERROR,
467 "no policy found for this CHILD_SA");
468 continue;
469 }
470
471 action = policy->get_dpd_action(policy);
472 /* get a connection for further actions */
473 if (connection == NULL &&
474 (action == DPD_ROUTE || action == DPD_RESTART))
475 {
476 connection = charon->connections->get_connection_by_hosts(
477 charon->connections,
478 this->my_host, this->other_host);
479 if (connection == NULL)
480 {
481 this->logger->log(this->logger, ERROR,
482 "no connection found for this IKE_SA");
483 break;
484 }
485 }
486
487 this->logger->log(this->logger, CONTROL, "dpd action for %s is %s",
488 policy->get_name(policy),
489 enum_name(&dpd_action_names, action));
490
491 switch (action)
492 {
493 case DPD_ROUTE:
494 connection->get_ref(connection);
495 job = (job_t*)route_job_create(connection, policy, TRUE);
496 charon->job_queue->add(charon->job_queue, job);
497 break;
498 case DPD_RESTART:
499 connection->get_ref(connection);
500 job = (job_t*)initiate_job_create(connection, policy);
501 charon->job_queue->add(charon->job_queue, job);
502 break;
503 default:
504 policy->destroy(policy);
505 break;
506 }
507 child_sa->destroy(child_sa);
508 }
509 DESTROY_IF(connection);
510 }
511
512 /**
513 * send a request and schedule retransmission
514 */
515 static status_t transmit_request(private_ike_sa_t *this)
516 {
517 message_t *request;
518 packet_t *packet;
519 status_t status;
520 retransmit_request_job_t *job;
521 u_int32_t transmitted;
522 u_int32_t timeout;
523 transaction_t *transaction = this->transaction_out;
524 u_int32_t message_id;
525
526 transmitted = transaction->requested(transaction);
527 timeout = charon->configuration->get_retransmit_timeout(charon->configuration,
528 transmitted,
529 this->retrans_sequences);
530 if (timeout == 0)
531 {
532 this->logger->log(this->logger, ERROR,
533 "giving up after %d retransmits, deleting IKE_SA",
534 transmitted - 1);
535 dpd_detected(this);
536 return DESTROY_ME;
537 }
538
539 status = transaction->get_request(transaction, &request);
540 if (status != SUCCESS)
541 {
542 this->logger->log(this->logger, ERROR,
543 "generating request failed");
544 return status;
545 }
546 message_id = transaction->get_message_id(transaction);
547 /* if we retransmit, the request is already generated */
548 if (transmitted == 0)
549 {
550 status = request->generate(request, this->crypter_out, this->signer_out, &packet);
551 if (status != SUCCESS)
552 {
553 this->logger->log(this->logger, ERROR,
554 "request generation failed. transaction discarded");
555 return FAILED;
556 }
557 }
558 else
559 {
560 this->logger->log(this->logger, CONTROL,
561 "sending retransmit %d for %s request with message ID %d",
562 transmitted,
563 mapping_find(exchange_type_m, request->get_exchange_type(request)),
564 message_id);
565 packet = request->get_packet(request);
566 }
567 /* finally send */
568 charon->send_queue->add(charon->send_queue, packet);
569 this->time.outbound = time(NULL);
570
571 /* schedule retransmission job */
572 job = retransmit_request_job_create(message_id, this->ike_sa_id);
573 charon->event_queue->add_relative(charon->event_queue, (job_t*)job, timeout);
574 return SUCCESS;
575 }
576
577 /**
578 * Implementation of ike_sa.retransmit_request.
579 */
580 static status_t retransmit_request(private_ike_sa_t *this, u_int32_t message_id)
581 {
582 if (this->transaction_out == NULL ||
583 this->transaction_out->get_message_id(this->transaction_out) != message_id)
584 {
585 /* no retransmit necessary, transaction did already complete */
586 return SUCCESS;
587 }
588 return transmit_request(this);
589 }
590
591 /**
592 * Check for transactions in the queue and initiate the first transaction found.
593 */
594 static status_t process_transaction_queue(private_ike_sa_t *this)
595 {
596 if (this->transaction_out)
597 {
598 /* already a transaction in progress */
599 return SUCCESS;
600 }
601
602 while (TRUE)
603 {
604 if (this->transaction_queue->remove_first(this->transaction_queue,
605 (void**)&this->transaction_out) != SUCCESS)
606 {
607 /* transaction queue empty */
608 return SUCCESS;
609 }
610 switch (transmit_request(this))
611 {
612 case SUCCESS:
613 return SUCCESS;
614 case DESTROY_ME:
615 /* critical, IKE_SA unusable, destroy immediately */
616 this->logger->log(this->logger, ERROR,
617 "transaction initiaton failed, deleting IKE_SA");
618 return DESTROY_ME;
619 default:
620 /* discard transaction, process next one */
621 this->logger->log(this->logger, ERROR,
622 "transaction initiation failed, discarded");
623 this->transaction_out->destroy(this->transaction_out);
624 this->transaction_out = NULL;
625 /* handle next transaction */
626 continue;
627 }
628 }
629 }
630
631 /**
632 * Queue a new transaction and execute the next outstanding transaction
633 */
634 static status_t queue_transaction(private_ike_sa_t *this, transaction_t *transaction, bool prefer)
635 {
636 /* inject next transaction */
637 if (transaction)
638 {
639 if (prefer)
640 {
641 this->transaction_queue->insert_first(this->transaction_queue, transaction);
642 }
643 else
644 {
645 this->transaction_queue->insert_last(this->transaction_queue, transaction);
646 }
647 }
648 /* process a transaction */
649 return process_transaction_queue(this);
650 }
651
652 /**
653 * process an incoming request.
654 */
655 static status_t process_request(private_ike_sa_t *this, message_t *request)
656 {
657 transaction_t *last, *current = NULL;
658 message_t *response;
659 packet_t *packet;
660 u_int32_t request_mid;
661 status_t status;
662
663 request_mid = request->get_message_id(request);
664 last = this->transaction_in;
665
666 /* check if message ID is correct */
667 if (last)
668 {
669 u_int32_t last_mid = last->get_message_id(last);
670
671 if (last_mid == request_mid)
672 {
673 /* retransmit detected */
674 this->logger->log(this->logger, ERROR,
675 "received retransmitted request for message ID %d, retransmitting response",
676 request_mid);
677 last->get_response(last, request, &response, &this->transaction_in_next);
678 packet = response->get_packet(response);
679 charon->send_queue->add(charon->send_queue, packet);
680 this->time.outbound = time(NULL);
681 return SUCCESS;
682 }
683
684 if (last_mid > request_mid)
685 {
686 /* something seriously wrong here, message id may not decrease */
687 this->logger->log(this->logger, ERROR,
688 "received request with message ID %d, excepted %d, ingored",
689 request_mid, last_mid + 1);
690 return FAILED;
691 }
692 /* we allow jumps in message IDs, as long as they are incremental */
693 if (last_mid + 1 < request_mid)
694 {
695 this->logger->log(this->logger, ERROR,
696 "received request with message ID %d, excepted %d",
697 request_mid, last_mid + 1);
698 }
699 }
700 else
701 {
702 if (request_mid != 0)
703 {
704 /* warn, but allow it */
705 this->logger->log(this->logger, CONTROL,
706 "first received request has message ID %d, excepted 0",
707 request_mid);
708 }
709 }
710
711 /* check if we already have a pre-created transaction for this request */
712 if (this->transaction_in_next)
713 {
714 current = this->transaction_in_next;
715 this->transaction_in_next = NULL;
716 }
717 else
718 {
719 current = transaction_create(&this->public, request);
720 if (current == NULL)
721 {
722 this->logger->log(this->logger, ERROR,
723 "no idea how to handle received message (%d), ignored",
724 request->get_exchange_type(request));
725 return FAILED;
726 }
727 }
728
729 /* send message. get_request() always gives a valid response */
730 status = current->get_response(current, request, &response, &this->transaction_in_next);
731 if (response->generate(response, this->crypter_out, this->signer_out, &packet) != SUCCESS)
732 {
733 this->logger->log(this->logger, ERROR,
734 "response generation failed, discarding transaction");
735 current->destroy(current);
736 return FAILED;
737 }
738
739 charon->send_queue->add(charon->send_queue, packet);
740 this->time.outbound = time(NULL);
741 /* act depending on transaction result */
742 switch (status)
743 {
744 case DESTROY_ME:
745 /* transactions says we should destroy the IKE_SA, so do it */
746 current->destroy(current);
747 return DESTROY_ME;
748 default:
749 /* store for retransmission, destroy old transaction */
750 this->transaction_in = current;
751 if (last)
752 {
753 last->destroy(last);
754 }
755 return SUCCESS;
756 }
757 }
758
759 /**
760 * process an incoming response
761 */
762 static status_t process_response(private_ike_sa_t *this, message_t *response)
763 {
764 transaction_t *current, *new = NULL;
765
766 current = this->transaction_out;
767 /* check if message ID is that of our currently active transaction */
768 if (current == NULL ||
769 current->get_message_id(current) != response->get_message_id(response))
770 {
771 this->logger->log(this->logger, ERROR,
772 "received response with message ID %d not requested, ignored");
773 return FAILED;
774 }
775
776 switch (current->conclude(current, response, &new))
777 {
778 case DESTROY_ME:
779 /* state requested to destroy IKE_SA */
780 return DESTROY_ME;
781 default:
782 /* discard transaction, process next one */
783 break;
784 }
785 /* transaction comleted, remove */
786 current->destroy(current);
787 this->transaction_out = NULL;
788
789 /* queue new transaction */
790 return queue_transaction(this, new, TRUE);
791 }
792
793 /**
794 * send a notify back to the sender
795 */
796 static void send_notify_response(private_ike_sa_t *this,
797 message_t *request,
798 notify_type_t type)
799 {
800 notify_payload_t *notify;
801 message_t *response;
802 host_t *src, *dst;
803 packet_t *packet;
804
805 response = message_create();
806 dst = request->get_source(request);
807 src = request->get_destination(request);
808 response->set_source(response, src->clone(src));
809 response->set_destination(response, dst->clone(dst));
810 response->set_exchange_type(response, request->get_exchange_type(request));
811 response->set_request(response, FALSE);
812 response->set_message_id(response, request->get_message_id(request));
813 response->set_ike_sa_id(response, this->ike_sa_id);
814 notify = notify_payload_create_from_protocol_and_type(PROTO_NONE, type);
815 response->add_payload(response, (payload_t *)notify);
816 if (response->generate(response, this->crypter_out, this->signer_out, &packet) != SUCCESS)
817 {
818 response->destroy(response);
819 return;
820 }
821 charon->send_queue->add(charon->send_queue, packet);
822 this->time.outbound = time(NULL);
823 response->destroy(response);
824 return;
825 }
826
827
828 /**
829 * Implementation of ike_sa_t.process_message.
830 */
831 static status_t process_message(private_ike_sa_t *this, message_t *message)
832 {
833 status_t status;
834 bool is_request;
835
836 is_request = message->get_request(message);
837
838 status = message->parse_body(message, this->crypter_in, this->signer_in);
839 if (status != SUCCESS)
840 {
841 if (is_request)
842 {
843 switch (status)
844 {
845 case NOT_SUPPORTED:
846 this->logger->log(this->logger, ERROR,
847 "ciritcal unknown payloads found");
848 if (is_request)
849 {
850 send_notify_response(this, message, UNSUPPORTED_CRITICAL_PAYLOAD);
851 }
852 break;
853 case PARSE_ERROR:
854 this->logger->log(this->logger, ERROR,
855 "message parsing failed");
856 if (is_request)
857 {
858 send_notify_response(this, message, INVALID_SYNTAX);
859 }
860 break;
861 case VERIFY_ERROR:
862 this->logger->log(this->logger, ERROR,
863 "message verification failed");
864 if (is_request)
865 {
866 send_notify_response(this, message, INVALID_SYNTAX);
867 }
868 break;
869 case FAILED:
870 this->logger->log(this->logger, ERROR,
871 "integrity check failed");
872 /* ignored */
873 break;
874 case INVALID_STATE:
875 this->logger->log(this->logger, ERROR,
876 "found encrypted message, but no keys available");
877 if (is_request)
878 {
879 send_notify_response(this, message, INVALID_SYNTAX);
880 }
881 default:
882 break;
883 }
884 }
885 this->logger->log(this->logger, ERROR,
886 "%s %s with message ID %d processing failed",
887 mapping_find(exchange_type_m, message->get_exchange_type(message)),
888 message->get_request(message) ? "request" : "response",
889 message->get_message_id(message));
890 }
891 else
892 {
893 /* check if message is trustworthy, and update connection information */
894 if (this->state == IKE_CREATED ||
895 message->get_exchange_type(message) != IKE_SA_INIT)
896 {
897 update_hosts(this, message->get_destination(message),
898 message->get_source(message));
899 this->time.inbound = time(NULL);
900 }
901 if (is_request)
902 {
903 status = process_request(this, message);
904 }
905 else
906 {
907 status = process_response(this, message);
908 }
909 }
910 return status;
911 }
912
913 /**
914 * Implementation of ike_sa_t.initiate.
915 */
916 static status_t initiate(private_ike_sa_t *this,
917 connection_t *connection, policy_t *policy)
918 {
919 switch (this->state)
920 {
921 case IKE_CREATED:
922 {
923 /* in state CREATED, we must do the ike_sa_init
924 * and ike_auth transactions. Along with these,
925 * a CHILD_SA with the supplied policy is set up.
926 */
927 ike_sa_init_t *ike_sa_init;
928
929 this->logger->log(this->logger, CONTROL,
930 "initiating IKE_SA");
931 DESTROY_IF(this->my_host);
932 this->my_host = connection->get_my_host(connection);
933 this->my_host = this->my_host->clone(this->my_host);
934 DESTROY_IF(this->other_host);
935 this->other_host = connection->get_other_host(connection);
936 this->other_host = this->other_host->clone(this->other_host);
937 this->retrans_sequences = connection->get_retrans_seq(connection);
938 this->dpd_delay = connection->get_dpd_delay(connection);
939
940 this->message_id_out = 1;
941 ike_sa_init = ike_sa_init_create(&this->public);
942 ike_sa_init->set_config(ike_sa_init, connection, policy);
943 return queue_transaction(this, (transaction_t*)ike_sa_init, TRUE);
944 }
945 case IKE_DELETING:
946 case IKE_REKEYING:
947 {
948 /* if we are in DELETING/REKEYING, we deny set up of a policy. */
949 this->logger->log(this->logger, CONTROL,
950 "creating CHILD_SA discarded, as IKE_SA is in state %s",
951 mapping_find(ike_sa_state_m, this->state));
952 policy->destroy(policy);
953 connection->destroy(connection);
954 return FAILED;
955 }
956 case IKE_CONNECTING:
957 case IKE_ESTABLISHED:
958 {
959 /* if we are ESTABLISHED or CONNECTING,we queue the
960 * transaction to create the CHILD_SA. It gets processed
961 * when the IKE_SA is ready to do so. We don't need the
962 * connection, as the IKE_SA is already established/establishing.
963 */
964 create_child_sa_t *create_child;
965
966 this->logger->log(this->logger, CONTROL,
967 "initiating CHILD_SA");
968
969 connection->destroy(connection);
970 create_child = create_child_sa_create(&this->public);
971 create_child->set_policy(create_child, policy);
972 return queue_transaction(this, (transaction_t*)create_child, FALSE);
973 }
974 }
975 return FAILED;
976 }
977
978 /**
979 * Implementation of ike_sa_t.acquire.
980 */
981 static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
982 {
983 connection_t *connection;
984 policy_t *policy;
985 iterator_t *iterator;
986 child_sa_t *current, *child_sa = NULL;
987 linked_list_t *my_ts, *other_ts;
988
989 if (this->state == IKE_DELETING)
990 {
991 this->logger->log(this->logger, CONTROL,
992 "acquiring CHILD_SA with reqid %d discarded, as IKE_SA is deleting",
993 reqid);
994 return FAILED;
995 }
996
997
998 /* find CHILD_SA */
999 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1000 while (iterator->iterate(iterator, (void**)&current))
1001 {
1002 if (current->get_reqid(current) == reqid)
1003 {
1004 child_sa = current;
1005 break;
1006 }
1007 }
1008 iterator->destroy(iterator);
1009 if (!child_sa)
1010 {
1011 this->logger->log(this->logger, ERROR,
1012 "CHILD_SA with reqid %d not found, unable to acquire",
1013 reqid);
1014 return FAILED;
1015 }
1016 my_ts = child_sa->get_my_traffic_selectors(child_sa);
1017 other_ts = child_sa->get_other_traffic_selectors(child_sa);
1018
1019 policy = charon->policies->get_policy(charon->policies,
1020 this->my_id, this->other_id,
1021 my_ts, other_ts,
1022 this->my_host, this->other_host);
1023 if (policy == NULL)
1024 {
1025 this->logger->log(this->logger, ERROR,
1026 "no policy found to acquire CHILD_SA with reqid %d",
1027 reqid);
1028 return FAILED;
1029 }
1030
1031 switch (this->state)
1032 {
1033 case IKE_CREATED:
1034 {
1035 ike_sa_init_t *ike_sa_init;
1036
1037 this->logger->log(this->logger, CONTROL,
1038 "acquiring CHILD_SA with reqid %d, IKE_SA setup needed",
1039 reqid);
1040
1041 connection = charon->connections->get_connection_by_hosts(
1042 charon->connections, this->my_host, this->other_host);
1043
1044 if (connection == NULL)
1045 {
1046 this->logger->log(this->logger, ERROR,
1047 "no connection found to acquire IKE_SA for CHILD_SA with reqid %d",
1048 reqid);
1049 policy->destroy(policy);
1050 return FAILED;
1051 }
1052
1053 this->message_id_out = 1;
1054 ike_sa_init = ike_sa_init_create(&this->public);
1055 ike_sa_init->set_config(ike_sa_init, connection, policy);
1056 /* reuse existing reqid */
1057 ike_sa_init->set_reqid(ike_sa_init, reqid);
1058 return queue_transaction(this, (transaction_t*)ike_sa_init, TRUE);
1059 }
1060 case IKE_CONNECTING:
1061 case IKE_ESTABLISHED:
1062 {
1063 create_child_sa_t *create_child;
1064
1065 this->logger->log(this->logger, CONTROL,
1066 "acquiring CHILD_SA with reqid %d",
1067 reqid);
1068
1069 create_child = create_child_sa_create(&this->public);
1070 create_child->set_policy(create_child, policy);
1071 /* reuse existing reqid */
1072 create_child->set_reqid(create_child, reqid);
1073 return queue_transaction(this, (transaction_t*)create_child, FALSE);
1074 }
1075 default:
1076 break;
1077 }
1078 return FAILED;
1079 }
1080
1081 /**
1082 * destroy a list of traffic selectors
1083 */
1084 static void ts_list_destroy(linked_list_t *list)
1085 {
1086 traffic_selector_t *ts;
1087 while (list->remove_last(list, (void**)&ts) == SUCCESS)
1088 {
1089 ts->destroy(ts);
1090 }
1091 list->destroy(list);
1092 }
1093
1094 /**
1095 * compare two lists of traffic selectors for equality
1096 */
1097 static bool ts_list_equals(linked_list_t *l1, linked_list_t *l2)
1098 {
1099 bool equals = TRUE;
1100 iterator_t *i1, *i2;
1101 traffic_selector_t *t1, *t2;
1102
1103 i1 = l1->create_iterator(l1, TRUE);
1104 i2 = l2->create_iterator(l2, TRUE);
1105 while (i1->iterate(i1, (void**)&t1) && i2->iterate(i2, (void**)&t2))
1106 {
1107 if (!t1->equals(t1, t2))
1108 {
1109 equals = FALSE;
1110 break;
1111 }
1112 }
1113 /* check if one iterator is not at the end */
1114 if (i1->has_next(i1) || i2->has_next(i2))
1115 {
1116 equals = FALSE;
1117 }
1118 i1->destroy(i1);
1119 i2->destroy(i2);
1120 return equals;
1121 }
1122
1123 /**
1124 * Implementation of ike_sa_t.route.
1125 */
1126 static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t *policy)
1127 {
1128 child_sa_t *child_sa = NULL;
1129 iterator_t *iterator;
1130 linked_list_t *my_ts, *other_ts;
1131 status_t status;
1132
1133 /* check if not already routed*/
1134 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1135 while (iterator->iterate(iterator, (void**)&child_sa))
1136 {
1137 if (child_sa->get_state(child_sa) == CHILD_ROUTED)
1138 {
1139 linked_list_t *my_ts_conf, *other_ts_conf;
1140
1141 my_ts = child_sa->get_my_traffic_selectors(child_sa);
1142 other_ts = child_sa->get_other_traffic_selectors(child_sa);
1143
1144 my_ts_conf = policy->get_my_traffic_selectors(policy, this->my_host);
1145 other_ts_conf = policy->get_other_traffic_selectors(policy, this->other_host);
1146
1147 if (ts_list_equals(my_ts, my_ts_conf) &&
1148 ts_list_equals(other_ts, other_ts_conf))
1149 {
1150 ts_list_destroy(my_ts_conf);
1151 ts_list_destroy(other_ts_conf);
1152 iterator->destroy(iterator);
1153 this->logger->log(this->logger, CONTROL,
1154 "a CHILD_SA with such a policy already routed");
1155
1156 return FAILED;
1157 }
1158 ts_list_destroy(my_ts_conf);
1159 ts_list_destroy(other_ts_conf);
1160 }
1161 }
1162 iterator->destroy(iterator);
1163
1164 switch (this->state)
1165 {
1166 case IKE_CREATED:
1167 case IKE_CONNECTING:
1168 /* we update IKE_SA information as good as possible,
1169 * this allows us to set up the SA later when an acquire comes in. */
1170 if (this->my_id->get_type(this->my_id) == ID_ANY)
1171 {
1172 this->my_id->destroy(this->my_id);
1173 this->my_id = policy->get_my_id(policy);
1174 this->my_id = this->my_id->clone(this->my_id);
1175 }
1176 if (this->other_id->get_type(this->other_id) == ID_ANY)
1177 {
1178 this->other_id->destroy(this->other_id);
1179 this->other_id = policy->get_other_id(policy);
1180 this->other_id = this->other_id->clone(this->other_id);
1181 }
1182 if (this->my_host->is_anyaddr(this->my_host))
1183 {
1184 this->my_host->destroy(this->my_host);
1185 this->my_host = connection->get_my_host(connection);
1186 this->my_host = this->my_host->clone(this->my_host);
1187 }
1188 if (this->other_host->is_anyaddr(this->other_host))
1189 {
1190 this->other_host->destroy(this->other_host);
1191 this->other_host = connection->get_other_host(connection);
1192 this->other_host = this->other_host->clone(this->other_host);
1193 }
1194 set_name(this, connection->get_name(connection));
1195 this->retrans_sequences = connection->get_retrans_seq(connection);
1196 this->dpd_delay = connection->get_dpd_delay(connection);
1197 break;
1198 case IKE_ESTABLISHED:
1199 case IKE_REKEYING:
1200 /* nothing to do. We allow it for rekeying, as it will be
1201 * adopted by the new IKE_SA */
1202 break;
1203 case IKE_DELETING:
1204 /* deny */
1205 return FAILED;
1206 }
1207
1208 child_sa = child_sa_create(0, this->my_host, this->other_host,
1209 this->my_id, this->other_id,
1210 0, 0,
1211 NULL, policy->get_hostaccess(policy),
1212 FALSE);
1213 child_sa->set_name(child_sa, policy->get_name(policy));
1214 my_ts = policy->get_my_traffic_selectors(policy, this->my_host);
1215 other_ts = policy->get_other_traffic_selectors(policy, this->other_host);
1216 status = child_sa->add_policies(child_sa, my_ts, other_ts);
1217 ts_list_destroy(my_ts);
1218 ts_list_destroy(other_ts);
1219 this->child_sas->insert_last(this->child_sas, child_sa);
1220
1221 return status;
1222 }
1223
1224 /**
1225 * Implementation of ike_sa_t.unroute.
1226 */
1227 static status_t unroute(private_ike_sa_t *this, policy_t *policy)
1228 {
1229 iterator_t *iterator;
1230 child_sa_t *child_sa = NULL;
1231 linked_list_t *my_ts, *other_ts, *my_ts_conf, *other_ts_conf;
1232
1233 /* find CHILD_SA in ROUTED state */
1234 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1235 while (iterator->iterate(iterator, (void**)&child_sa))
1236 {
1237 if (child_sa->get_state(child_sa) == CHILD_ROUTED)
1238 {
1239 my_ts = child_sa->get_my_traffic_selectors(child_sa);
1240 other_ts = child_sa->get_other_traffic_selectors(child_sa);
1241
1242 my_ts_conf = policy->get_my_traffic_selectors(policy, this->my_host);
1243 other_ts_conf = policy->get_other_traffic_selectors(policy, this->other_host);
1244
1245 if (ts_list_equals(my_ts, my_ts_conf) &&
1246 ts_list_equals(other_ts, other_ts_conf))
1247 {
1248 iterator->remove(iterator);
1249 child_sa->destroy(child_sa);
1250 ts_list_destroy(my_ts_conf);
1251 ts_list_destroy(other_ts_conf);
1252 break;
1253 }
1254 ts_list_destroy(my_ts_conf);
1255 ts_list_destroy(other_ts_conf);
1256 }
1257 }
1258 iterator->destroy(iterator);
1259 /* if we are not established, and we have no more routed childs, remove whole SA */
1260 if (this->state == IKE_CREATED &&
1261 this->child_sas->get_count(this->child_sas) == 0)
1262 {
1263 return DESTROY_ME;
1264 }
1265 return SUCCESS;
1266 }
1267
1268 /**
1269 * Implementation of ike_sa_t.send_dpd
1270 */
1271 static status_t send_dpd(private_ike_sa_t *this)
1272 {
1273 send_dpd_job_t *job;
1274 time_t diff;
1275
1276 if (this->dpd_delay == 0)
1277 {
1278 /* DPD disabled */
1279 return SUCCESS;
1280 }
1281
1282 if (this->transaction_out)
1283 {
1284 /* there is a transaction in progress. Come back later */
1285 diff = 0;
1286 }
1287 else
1288 {
1289 /* check if there was any inbound traffic */
1290 time_t last_in, now;
1291 last_in = get_time_inbound(this);
1292 now = time(NULL);
1293 diff = now - last_in;
1294 if (diff >= this->dpd_delay)
1295 {
1296 /* to long ago, initiate dead peer detection */
1297 dead_peer_detection_t *dpd;
1298 this->logger->log(this->logger, CONTROL, "sending DPD request");
1299 dpd = dead_peer_detection_create(&this->public);
1300 queue_transaction(this, (transaction_t*)dpd, FALSE);
1301 diff = 0;
1302 }
1303 }
1304 /* recheck in "interval" seconds */
1305 job = send_dpd_job_create(this->ike_sa_id);
1306 charon->event_queue->add_relative(charon->event_queue, (job_t*)job,
1307 (this->dpd_delay - diff) * 1000);
1308 return SUCCESS;
1309 }
1310
1311 /**
1312 * Implementation of ike_sa_t.send_keepalive
1313 */
1314 static void send_keepalive(private_ike_sa_t *this)
1315 {
1316 send_keepalive_job_t *job;
1317 time_t last_out, now, diff, interval;
1318
1319 last_out = get_time_outbound(this);
1320 now = time(NULL);
1321
1322 diff = now - last_out;
1323 interval = charon->configuration->get_keepalive_interval(charon->configuration);
1324
1325 if (diff >= interval)
1326 {
1327 packet_t *packet;
1328 chunk_t data;
1329
1330 packet = packet_create();
1331 packet->set_source(packet, this->my_host->clone(this->my_host));
1332 packet->set_destination(packet, this->other_host->clone(this->other_host));
1333 data.ptr = malloc(1);
1334 data.ptr[0] = 0xFF;
1335 data.len = 1;
1336 packet->set_data(packet, data);
1337 charon->send_queue->add(charon->send_queue, packet);
1338 this->logger->log(this->logger, CONTROL, "sending keep alive");
1339 diff = 0;
1340 }
1341 job = send_keepalive_job_create(this->ike_sa_id);
1342 charon->event_queue->add_relative(charon->event_queue, (job_t*)job,
1343 (interval - diff) * 1000);
1344 }
1345
1346 /**
1347 * Implementation of ike_sa_t.get_state.
1348 */
1349 static ike_sa_state_t get_state(private_ike_sa_t *this)
1350 {
1351 return this->state;
1352 }
1353
1354 /**
1355 * Implementation of ike_sa_t.set_state.
1356 */
1357 static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
1358 {
1359 this->logger->log(this->logger, CONTROL, "state change: %s => %s",
1360 mapping_find(ike_sa_state_m, this->state),
1361 mapping_find(ike_sa_state_m, state));
1362 if (state == IKE_ESTABLISHED)
1363 {
1364 this->time.established = time(NULL);
1365 this->logger->log(this->logger, AUDIT, "IKE_SA established: %s[%s]...%s[%s]",
1366 this->my_host->get_string(this->my_host),
1367 this->my_id->get_string(this->my_id),
1368 this->other_host->get_string(this->other_host),
1369 this->other_id->get_string(this->other_id));
1370 /* start DPD checks */
1371 send_dpd(this);
1372 }
1373 this->state = state;
1374 }
1375
1376 /**
1377 * Implementation of ike_sa_t.get_prf.
1378 */
1379 static prf_t *get_prf(private_ike_sa_t *this)
1380 {
1381 return this->prf;
1382 }
1383
1384 /**
1385 * Implementation of ike_sa_t.get_prf.
1386 */
1387 static prf_t *get_child_prf(private_ike_sa_t *this)
1388 {
1389 return this->child_prf;
1390 }
1391
1392 /**
1393 * Implementation of ike_sa_t.get_prf_auth_i.
1394 */
1395 static prf_t *get_prf_auth_i(private_ike_sa_t *this)
1396 {
1397 return this->prf_auth_i;
1398 }
1399
1400 /**
1401 * Implementation of ike_sa_t.get_prf_auth_r.
1402 */
1403 static prf_t *get_prf_auth_r(private_ike_sa_t *this)
1404 {
1405 return this->prf_auth_r;
1406 }
1407
1408 /**
1409 * Implementation of ike_sa_t.get_id.
1410 */
1411 static ike_sa_id_t* get_id(private_ike_sa_t *this)
1412 {
1413 return this->ike_sa_id;
1414 }
1415
1416 /**
1417 * Implementation of ike_sa_t.get_my_id.
1418 */
1419 static identification_t* get_my_id(private_ike_sa_t *this)
1420 {
1421 return this->my_id;
1422 }
1423
1424 /**
1425 * Implementation of ike_sa_t.set_my_id.
1426 */
1427 static void set_my_id(private_ike_sa_t *this, identification_t *me)
1428 {
1429 DESTROY_IF(this->my_id);
1430 this->my_id = me;
1431 }
1432
1433 /**
1434 * Implementation of ike_sa_t.get_other_id.
1435 */
1436 static identification_t* get_other_id(private_ike_sa_t *this)
1437 {
1438 return this->other_id;
1439 }
1440
1441 /**
1442 * Implementation of ike_sa_t.set_other_id.
1443 */
1444 static void set_other_id(private_ike_sa_t *this, identification_t *other)
1445 {
1446 DESTROY_IF(this->other_id);
1447 this->other_id = other;
1448 }
1449
1450 /**
1451 * Implementation of ike_sa_t.derive_keys.
1452 */
1453 static status_t derive_keys(private_ike_sa_t *this,
1454 proposal_t *proposal, diffie_hellman_t *dh,
1455 chunk_t nonce_i, chunk_t nonce_r,
1456 bool initiator, prf_t *child_prf, prf_t *old_prf)
1457 {
1458 prf_plus_t *prf_plus;
1459 chunk_t skeyseed, secret, key, nonces, prf_plus_seed;
1460 algorithm_t *algo;
1461 size_t key_size;
1462 crypter_t *crypter_i, *crypter_r;
1463 signer_t *signer_i, *signer_r;
1464 u_int8_t spi_i_buf[sizeof(u_int64_t)], spi_r_buf[sizeof(u_int64_t)];
1465 chunk_t spi_i = chunk_from_buf(spi_i_buf);
1466 chunk_t spi_r = chunk_from_buf(spi_r_buf);
1467
1468 /* Create SAs general purpose PRF first, we may use it here */
1469 if (!proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo))
1470 {
1471 this->logger->log(this->logger, ERROR, "no PSEUDO_RANDOM_FUNCTION selected!");
1472 return FAILED;
1473 }
1474 this->prf = prf_create(algo->algorithm);
1475 if (this->prf == NULL)
1476 {
1477 this->logger->log(this->logger, ERROR, "PSEUDO_RANDOM_FUNCTION %s not supported!",
1478 mapping_find(pseudo_random_function_m, algo->algorithm));
1479 return FAILED;
1480 }
1481
1482 dh->get_shared_secret(dh, &secret);
1483 this->logger->log_chunk(this->logger, PRIVATE, "shared Diffie Hellman secret", secret);
1484 nonces = chunk_cat("cc", nonce_i, nonce_r);
1485 *((u_int64_t*)spi_i.ptr) = this->ike_sa_id->get_initiator_spi(this->ike_sa_id);
1486 *((u_int64_t*)spi_r.ptr) = this->ike_sa_id->get_responder_spi(this->ike_sa_id);
1487 prf_plus_seed = chunk_cat("ccc", nonces, spi_i, spi_r);
1488
1489 /* KEYMAT = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr)
1490 *
1491 * if we are rekeying, SKEYSEED built on another way
1492 */
1493 if (child_prf == NULL) /* not rekeying */
1494 {
1495 /* SKEYSEED = prf(Ni | Nr, g^ir) */
1496 this->prf->set_key(this->prf, nonces);
1497 this->prf->allocate_bytes(this->prf, secret, &skeyseed);
1498 this->logger->log_chunk(this->logger, PRIVATE|LEVEL1, "SKEYSEED", skeyseed);
1499 this->prf->set_key(this->prf, skeyseed);
1500 chunk_free(&skeyseed);
1501 chunk_free(&secret);
1502 prf_plus = prf_plus_create(this->prf, prf_plus_seed);
1503 }
1504 else
1505 {
1506 /* SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
1507 * use OLD SAs PRF functions for both prf_plus and prf */
1508 secret = chunk_cat("mc", secret, nonces);
1509 child_prf->allocate_bytes(child_prf, secret, &skeyseed);
1510 this->logger->log_chunk(this->logger, PRIVATE|LEVEL1, "SKEYSEED", skeyseed);
1511 old_prf->set_key(old_prf, skeyseed);
1512 chunk_free(&skeyseed);
1513 chunk_free(&secret);
1514 prf_plus = prf_plus_create(old_prf, prf_plus_seed);
1515 }
1516 chunk_free(&nonces);
1517 chunk_free(&prf_plus_seed);
1518
1519 /* KEYMAT = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr */
1520
1521 /* SK_d is used for generating CHILD_SA key mat => child_prf */
1522 proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo);
1523 this->child_prf = prf_create(algo->algorithm);
1524 key_size = this->child_prf->get_key_size(this->child_prf);
1525 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1526 this->logger->log_chunk(this->logger, PRIVATE, "Sk_d secret", key);
1527 this->child_prf->set_key(this->child_prf, key);
1528 chunk_free(&key);
1529
1530 /* SK_ai/SK_ar used for integrity protection => signer_in/signer_out */
1531 if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &algo))
1532 {
1533 this->logger->log(this->logger, ERROR, "no INTEGRITY_ALGORITHM selected?!");
1534 return FAILED;
1535 }
1536 signer_i = signer_create(algo->algorithm);
1537 signer_r = signer_create(algo->algorithm);
1538 if (signer_i == NULL || signer_r == NULL)
1539 {
1540 this->logger->log(this->logger, ERROR, "INTEGRITY_ALGORITHM %s not supported!",
1541 mapping_find(integrity_algorithm_m,algo->algorithm));
1542 return FAILED;
1543 }
1544 key_size = signer_i->get_key_size(signer_i);
1545
1546 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1547 this->logger->log_chunk(this->logger, PRIVATE, "Sk_ai secret", key);
1548 signer_i->set_key(signer_i, key);
1549 chunk_free(&key);
1550
1551 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1552 this->logger->log_chunk(this->logger, PRIVATE, "Sk_ar secret", key);
1553 signer_r->set_key(signer_r, key);
1554 chunk_free(&key);
1555
1556 if (initiator)
1557 {
1558 this->signer_in = signer_r;
1559 this->signer_out = signer_i;
1560 }
1561 else
1562 {
1563 this->signer_in = signer_i;
1564 this->signer_out = signer_r;
1565 }
1566
1567 /* SK_ei/SK_er used for encryption => crypter_in/crypter_out */
1568 if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &algo))
1569 {
1570 this->logger->log(this->logger, ERROR, "no ENCRYPTION_ALGORITHM selected!");
1571 return FAILED;
1572 }
1573 crypter_i = crypter_create(algo->algorithm, algo->key_size / 8);
1574 crypter_r = crypter_create(algo->algorithm, algo->key_size / 8);
1575 if (crypter_i == NULL || crypter_r == NULL)
1576 {
1577 this->logger->log(this->logger, ERROR,
1578 "ENCRYPTION_ALGORITHM %s (key size %d) not supported!",
1579 mapping_find(encryption_algorithm_m, algo->algorithm),
1580 algo->key_size);
1581 return FAILED;
1582 }
1583 key_size = crypter_i->get_key_size(crypter_i);
1584
1585 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1586 this->logger->log_chunk(this->logger, PRIVATE, "Sk_ei secret", key);
1587 crypter_i->set_key(crypter_i, key);
1588 chunk_free(&key);
1589
1590 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1591 this->logger->log_chunk(this->logger, PRIVATE, "Sk_er secret", key);
1592 crypter_r->set_key(crypter_r, key);
1593 chunk_free(&key);
1594
1595 if (initiator)
1596 {
1597 this->crypter_in = crypter_r;
1598 this->crypter_out = crypter_i;
1599 }
1600 else
1601 {
1602 this->crypter_in = crypter_i;
1603 this->crypter_out = crypter_r;
1604 }
1605
1606 /* SK_pi/SK_pr used for authentication => prf_auth_i, prf_auth_r */
1607 proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo);
1608 this->prf_auth_i = prf_create(algo->algorithm);
1609 this->prf_auth_r = prf_create(algo->algorithm);
1610
1611 key_size = this->prf_auth_i->get_key_size(this->prf_auth_i);
1612 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1613 this->logger->log_chunk(this->logger, PRIVATE, "Sk_pi secret", key);
1614 this->prf_auth_i->set_key(this->prf_auth_i, key);
1615 chunk_free(&key);
1616
1617 prf_plus->allocate_bytes(prf_plus, key_size, &key);
1618 this->logger->log_chunk(this->logger, PRIVATE, "Sk_pr secret", key);
1619 this->prf_auth_r->set_key(this->prf_auth_r, key);
1620 chunk_free(&key);
1621
1622 /* all done, prf_plus not needed anymore */
1623 prf_plus->destroy(prf_plus);
1624
1625 return SUCCESS;
1626
1627 }
1628
1629 /**
1630 * Implementation of ike_sa_t.add_child_sa.
1631 */
1632 static void add_child_sa(private_ike_sa_t *this, child_sa_t *child_sa)
1633 {
1634 this->child_sas->insert_last(this->child_sas, child_sa);
1635 }
1636
1637 /**
1638 * Implementation of ike_sa_t.has_child_sa.
1639 */
1640 static bool has_child_sa(private_ike_sa_t *this, u_int32_t reqid)
1641 {
1642 iterator_t *iterator;
1643 child_sa_t *current;
1644 bool found = FALSE;
1645
1646 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1647 while (iterator->iterate(iterator, (void**)&current))
1648 {
1649 if (current->get_reqid(current) == reqid)
1650 {
1651 found = TRUE;
1652 break;
1653 }
1654 }
1655 iterator->destroy(iterator);
1656 return found;
1657 }
1658
1659 /**
1660 * Implementation of ike_sa_t.get_child_sa.
1661 */
1662 static child_sa_t* get_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
1663 u_int32_t spi, bool inbound)
1664 {
1665 iterator_t *iterator;
1666 child_sa_t *current, *found = NULL;
1667
1668 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1669 while (iterator->has_next(iterator))
1670 {
1671 iterator->current(iterator, (void**)&current);
1672 if (current->get_spi(current, inbound) == spi &&
1673 current->get_protocol(current) == protocol)
1674 {
1675 found = current;
1676 }
1677 }
1678 iterator->destroy(iterator);
1679 return found;
1680 }
1681
1682 /**
1683 * Implementation of ike_sa_t.create_child_sa_iterator.
1684 */
1685 static iterator_t* create_child_sa_iterator(private_ike_sa_t *this)
1686 {
1687 return this->child_sas->create_iterator(this->child_sas, TRUE);
1688 }
1689
1690 /**
1691 * Implementation of ike_sa_t.rekey_child_sa.
1692 */
1693 static status_t rekey_child_sa(private_ike_sa_t *this, protocol_id_t protocol, u_int32_t spi)
1694 {
1695 create_child_sa_t *rekey;
1696 child_sa_t *child_sa;
1697
1698 child_sa = get_child_sa(this, protocol, spi, TRUE);
1699 if (child_sa == NULL)
1700 {
1701 return NOT_FOUND;
1702 }
1703
1704 rekey = create_child_sa_create(&this->public);
1705 rekey->rekeys_child(rekey, child_sa);
1706 return queue_transaction(this, (transaction_t*)rekey, FALSE);
1707 }
1708
1709 /**
1710 * Implementation of ike_sa_t.delete_child_sa.
1711 */
1712 static status_t delete_child_sa(private_ike_sa_t *this, protocol_id_t protocol, u_int32_t spi)
1713 {
1714 delete_child_sa_t *del;
1715 child_sa_t *child_sa;
1716
1717 child_sa = get_child_sa(this, protocol, spi, TRUE);
1718 if (child_sa == NULL)
1719 {
1720 return NOT_FOUND;
1721 }
1722
1723 del = delete_child_sa_create(&this->public);
1724 del->set_child_sa(del, child_sa);
1725 return queue_transaction(this, (transaction_t*)del, FALSE);
1726 }
1727
1728 /**
1729 * Implementation of ike_sa_t.destroy_child_sa.
1730 */
1731 static status_t destroy_child_sa(private_ike_sa_t *this, protocol_id_t protocol, u_int32_t spi)
1732 {
1733 iterator_t *iterator;
1734 child_sa_t *child_sa;
1735 status_t status = NOT_FOUND;
1736
1737 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1738 while (iterator->iterate(iterator, (void**)&child_sa))
1739 {
1740 if (child_sa->get_protocol(child_sa) == protocol &&
1741 child_sa->get_spi(child_sa, TRUE) == spi)
1742 {
1743 child_sa->destroy(child_sa);
1744 iterator->remove(iterator);
1745 status = SUCCESS;
1746 break;
1747 }
1748 }
1749 iterator->destroy(iterator);
1750 return status;
1751 }
1752
1753 /**
1754 * Implementation of ike_sa_t.set_lifetimes.
1755 */
1756 static void set_lifetimes(private_ike_sa_t *this,
1757 u_int32_t soft_lifetime, u_int32_t hard_lifetime)
1758 {
1759 job_t *job;
1760
1761 if (soft_lifetime)
1762 {
1763 this->time.rekey = this->time.established + soft_lifetime;
1764 job = (job_t*)rekey_ike_sa_job_create(this->ike_sa_id);
1765 charon->event_queue->add_relative(charon->event_queue, job,
1766 soft_lifetime * 1000);
1767 }
1768
1769 if (hard_lifetime)
1770 {
1771 this->time.delete = this->time.established + hard_lifetime;
1772 job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE);
1773 charon->event_queue->add_relative(charon->event_queue, job,
1774 hard_lifetime * 1000);
1775 }
1776 }
1777
1778 /**
1779 * Implementation of ike_sa_t.rekey.
1780 */
1781 static status_t rekey(private_ike_sa_t *this)
1782 {
1783 rekey_ike_sa_t *rekey_ike_sa;
1784
1785 this->logger->log(this->logger, CONTROL,
1786 "rekeying IKE_SA between %s[%s]..%s[%s]",
1787 this->my_host->get_string(this->my_host),
1788 this->my_id->get_string(this->my_id),
1789 this->other_host->get_string(this->other_host),
1790 this->other_id->get_string(this->other_id));
1791
1792 if (this->state != IKE_ESTABLISHED)
1793 {
1794 this->logger->log(this->logger, ERROR,
1795 "unable to rekey IKE_SA in state %s",
1796 mapping_find(ike_sa_state_m, this->state));
1797 return FAILED;
1798 }
1799
1800 rekey_ike_sa = rekey_ike_sa_create(&this->public);
1801 return queue_transaction(this, (transaction_t*)rekey_ike_sa, FALSE);
1802 }
1803
1804 /**
1805 * Implementation of ike_sa_t.get_rekeying_transaction.
1806 */
1807 static rekey_ike_sa_t* get_rekeying_transaction(private_ike_sa_t *this)
1808 {
1809 return this->rekeying_transaction;
1810 }
1811
1812 /**
1813 * Implementation of ike_sa_t.set_rekeying_transaction.
1814 */
1815 static void set_rekeying_transaction(private_ike_sa_t *this, rekey_ike_sa_t *rekey)
1816 {
1817 this->rekeying_transaction = rekey;
1818 }
1819
1820 /**
1821 * Implementation of ike_sa_t.adopt_children.
1822 */
1823 static void adopt_children(private_ike_sa_t *this, private_ike_sa_t *other)
1824 {
1825 child_sa_t *child_sa;
1826
1827 while (other->child_sas->remove_last(other->child_sas,
1828 (void**)&child_sa) == SUCCESS)
1829 {
1830 this->child_sas->insert_first(this->child_sas, (void*)child_sa);
1831 }
1832 }
1833
1834 /**
1835 * Implementation of ike_sa_t.log_status.
1836 */
1837 static void log_status(private_ike_sa_t *this, logger_t *logger, char *name)
1838 {
1839 iterator_t *iterator;
1840 child_sa_t *child_sa;
1841 bool contains_child = FALSE;
1842
1843 /* check for a CHILD_SA with specified name. We then print the IKE_SA,
1844 * even it has another name */
1845 if (name != NULL)
1846 {
1847 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1848 while (iterator->iterate(iterator, (void**)&child_sa))
1849 {
1850 if (streq(name, child_sa->get_name(child_sa)))
1851 {
1852 contains_child = TRUE;
1853 break;
1854 }
1855 }
1856 iterator->destroy(iterator);
1857 }
1858
1859 if (name == NULL || contains_child || streq(name, this->name))
1860 {
1861 if (logger == NULL)
1862 {
1863 logger = this->logger;
1864 }
1865 logger->log(logger, CONTROL|LEVEL1,
1866 " \"%s\": IKE_SA in state %s, SPIs: 0x%.16llx 0x%.16llx",
1867 this->name,
1868 mapping_find(ike_sa_state_m, this->state),
1869 this->ike_sa_id->get_initiator_spi(this->ike_sa_id),
1870 this->ike_sa_id->get_responder_spi(this->ike_sa_id));
1871 logger->log(logger, CONTROL, " \"%s\": %s[%s]...%s[%s]",
1872 this->name,
1873 this->my_host->get_string(this->my_host),
1874 this->my_id->get_string(this->my_id),
1875 this->other_host->get_string(this->other_host),
1876 this->other_id->get_string(this->other_id));
1877
1878 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1879 while (iterator->has_next(iterator))
1880 {
1881 iterator->current(iterator, (void**)&child_sa);
1882 child_sa->log_status(child_sa, logger);
1883 }
1884 iterator->destroy(iterator);
1885 }
1886 }
1887
1888 /**
1889 * Implementation of public_ike_sa_t.delete.
1890 */
1891 static status_t delete_(private_ike_sa_t *this)
1892 {
1893 switch (this->state)
1894 {
1895 case IKE_CONNECTING:
1896 case IKE_ESTABLISHED:
1897 {
1898 delete_ike_sa_t *delete_ike_sa;
1899 if (this->transaction_out)
1900 {
1901 /* already a transaction in progress. As this may hang
1902 * around a while, we don't inform the other peer. */
1903 return DESTROY_ME;
1904 }
1905 delete_ike_sa = delete_ike_sa_create(&this->public);
1906 return queue_transaction(this, (transaction_t*)delete_ike_sa, FALSE);
1907 }
1908 case IKE_CREATED:
1909 case IKE_DELETING:
1910 default:
1911 {
1912 return DESTROY_ME;
1913 }
1914 }
1915 }
1916
1917 /**
1918 * Implementation of ike_sa_t.get_next_message_id.
1919 */
1920 static u_int32_t get_next_message_id (private_ike_sa_t *this)
1921 {
1922 return this->message_id_out++;
1923 }
1924
1925 /**
1926 * Implementation of ike_sa_t.is_natt_enabled.
1927 */
1928 static bool is_natt_enabled (private_ike_sa_t *this)
1929 {
1930 return this->nat_here || this->nat_there;
1931 }
1932
1933 /**
1934 * Implementation of ike_sa_t.enable_natt.
1935 */
1936 static void enable_natt (private_ike_sa_t *this, bool local)
1937 {
1938 if (local)
1939 {
1940 this->logger->log(this->logger, CONTROL,
1941 "local host is behind NAT, using NAT-T, scheduled keep alives");
1942 this->nat_here = TRUE;
1943 send_keepalive(this);
1944 }
1945 else
1946 {
1947 this->logger->log(this->logger, CONTROL,
1948 "remote host is behind NAT, using NAT-T");
1949 this->nat_there = TRUE;
1950 }
1951 }
1952
1953 /**
1954 * Implementation of ike_sa_t.destroy.
1955 */
1956 static void destroy(private_ike_sa_t *this)
1957 {
1958 child_sa_t *child_sa;
1959 transaction_t *transaction;
1960
1961 this->logger->log(this->logger, CONTROL|LEVEL2, "going to destroy IKE SA %llu:%llu, role %s",
1962 this->ike_sa_id->get_initiator_spi(this->ike_sa_id),
1963 this->ike_sa_id->get_responder_spi(this->ike_sa_id),
1964 this->ike_sa_id->is_initiator(this->ike_sa_id) ? "initiator" : "responder");
1965
1966 if (this->state == IKE_ESTABLISHED)
1967 {
1968 this->logger->log(this->logger, ERROR,
1969 "destroying an established IKE SA without knowledge from remote peer!");
1970 }
1971
1972 while (this->child_sas->remove_last(this->child_sas, (void**)&child_sa) == SUCCESS)
1973 {
1974 child_sa->destroy(child_sa);
1975 }
1976 this->child_sas->destroy(this->child_sas);
1977
1978 while (this->transaction_queue->remove_last(this->transaction_queue, (void**)&transaction) == SUCCESS)
1979 {
1980 transaction->destroy(transaction);
1981 }
1982 this->transaction_queue->destroy(this->transaction_queue);
1983
1984 DESTROY_IF(this->transaction_in);
1985 DESTROY_IF(this->transaction_in_next);
1986 DESTROY_IF(this->transaction_out);
1987 DESTROY_IF(this->crypter_in);
1988 DESTROY_IF(this->crypter_out);
1989 DESTROY_IF(this->signer_in);
1990 DESTROY_IF(this->signer_out);
1991 DESTROY_IF(this->prf);
1992 DESTROY_IF(this->child_prf);
1993 DESTROY_IF(this->prf_auth_i);
1994 DESTROY_IF(this->prf_auth_r);
1995
1996 this->logger->log(this->logger, AUDIT,
1997 "IKE_SA deleted between %s[%s]...%s[%s]",
1998 this->my_host->get_string(this->my_host),
1999 this->my_id->get_string(this->my_id),
2000 this->other_host->get_string(this->other_host),
2001 this->other_id->get_string(this->other_id));
2002
2003 DESTROY_IF(this->my_host);
2004 DESTROY_IF(this->other_host);
2005 DESTROY_IF(this->my_id);
2006 DESTROY_IF(this->other_id);
2007
2008 free(this->name);
2009 this->ike_sa_id->destroy(this->ike_sa_id);
2010 free(this);
2011 }
2012
2013 /*
2014 * Described in header.
2015 */
2016 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
2017 {
2018 private_ike_sa_t *this = malloc_thing(private_ike_sa_t);
2019
2020 /* Public functions */
2021 this->public.get_state = (ike_sa_state_t(*)(ike_sa_t*)) get_state;
2022 this->public.set_state = (void(*)(ike_sa_t*,ike_sa_state_t)) set_state;
2023 this->public.get_name = (char*(*)(ike_sa_t*))get_name;
2024 this->public.set_name = (void(*)(ike_sa_t*,char*))set_name;
2025 this->public.process_message = (status_t(*)(ike_sa_t*, message_t*)) process_message;
2026 this->public.initiate = (status_t(*)(ike_sa_t*,connection_t*,policy_t*)) initiate;
2027 this->public.route = (status_t(*)(ike_sa_t*,connection_t*,policy_t*)) route;
2028 this->public.unroute = (status_t(*)(ike_sa_t*,policy_t*)) unroute;
2029 this->public.acquire = (status_t(*)(ike_sa_t*,u_int32_t)) acquire;
2030 this->public.get_id = (ike_sa_id_t*(*)(ike_sa_t*)) get_id;
2031 this->public.get_my_host = (host_t*(*)(ike_sa_t*)) get_my_host;
2032 this->public.set_my_host = (void(*)(ike_sa_t*,host_t*)) set_my_host;
2033 this->public.get_other_host = (host_t*(*)(ike_sa_t*)) get_other_host;
2034 this->public.set_other_host = (void(*)(ike_sa_t*,host_t*)) set_other_host;
2035 this->public.get_my_id = (identification_t*(*)(ike_sa_t*)) get_my_id;
2036 this->public.set_my_id = (void(*)(ike_sa_t*,identification_t*)) set_my_id;
2037 this->public.get_other_id = (identification_t*(*)(ike_sa_t*)) get_other_id;
2038 this->public.set_other_id = (void(*)(ike_sa_t*,identification_t*)) set_other_id;
2039 this->public.get_next_message_id = (u_int32_t(*)(ike_sa_t*)) get_next_message_id;
2040 this->public.retransmit_request = (status_t (*) (ike_sa_t *, u_int32_t)) retransmit_request;
2041 this->public.log_status = (void (*) (ike_sa_t*,logger_t*,char*))log_status;
2042 this->public.delete = (status_t(*)(ike_sa_t*))delete_;
2043 this->public.destroy = (void(*)(ike_sa_t*))destroy;
2044 this->public.send_dpd = (status_t (*)(ike_sa_t*)) send_dpd;
2045 this->public.send_keepalive = (void (*)(ike_sa_t*)) send_keepalive;
2046 this->public.get_prf = (prf_t *(*) (ike_sa_t *)) get_prf;
2047 this->public.get_child_prf = (prf_t *(*) (ike_sa_t *)) get_child_prf;
2048 this->public.get_prf_auth_i = (prf_t *(*) (ike_sa_t *)) get_prf_auth_i;
2049 this->public.get_prf_auth_r = (prf_t *(*) (ike_sa_t *)) get_prf_auth_r;
2050 this->public.derive_keys = (status_t (*) (ike_sa_t *,proposal_t*,diffie_hellman_t*,chunk_t,chunk_t,bool,prf_t*,prf_t*)) derive_keys;
2051 this->public.add_child_sa = (void (*) (ike_sa_t*,child_sa_t*)) add_child_sa;
2052 this->public.has_child_sa = (bool(*)(ike_sa_t*,u_int32_t)) has_child_sa;
2053 this->public.get_child_sa = (child_sa_t* (*)(ike_sa_t*,protocol_id_t,u_int32_t,bool)) get_child_sa;
2054 this->public.create_child_sa_iterator = (iterator_t* (*)(ike_sa_t*)) create_child_sa_iterator;
2055 this->public.rekey_child_sa = (status_t(*)(ike_sa_t*,protocol_id_t,u_int32_t)) rekey_child_sa;
2056 this->public.delete_child_sa = (status_t(*)(ike_sa_t*,protocol_id_t,u_int32_t)) delete_child_sa;
2057 this->public.destroy_child_sa = (status_t (*)(ike_sa_t*,protocol_id_t,u_int32_t))destroy_child_sa;
2058 this->public.enable_natt = (void(*)(ike_sa_t*, bool)) enable_natt;
2059 this->public.is_natt_enabled = (bool(*)(ike_sa_t*)) is_natt_enabled;
2060 this->public.set_lifetimes = (void(*)(ike_sa_t*,u_int32_t,u_int32_t))set_lifetimes;
2061 this->public.set_dpd_delay = (void(*)(ike_sa_t*,u_int32_t))set_dpd_delay;
2062 this->public.rekey = (status_t(*)(ike_sa_t*))rekey;
2063 this->public.get_rekeying_transaction = (void*(*)(ike_sa_t*))get_rekeying_transaction;
2064 this->public.set_rekeying_transaction = (void(*)(ike_sa_t*,void*))set_rekeying_transaction;
2065 this->public.adopt_children = (void(*)(ike_sa_t*,ike_sa_t*))adopt_children;
2066
2067 /* initialize private fields */
2068 this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
2069 this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
2070 this->name = strdup("(uninitialized)");
2071 this->child_sas = linked_list_create();
2072 this->my_host = host_create_from_string("0.0.0.0", 0);
2073 this->other_host = host_create_from_string("0.0.0.0", 0);
2074 this->my_id = identification_create_from_encoding(ID_ANY, CHUNK_INITIALIZER);
2075 this->other_id = identification_create_from_encoding(ID_ANY, CHUNK_INITIALIZER);
2076 this->crypter_in = NULL;
2077 this->crypter_out = NULL;
2078 this->signer_in = NULL;
2079 this->signer_out = NULL;
2080 this->prf = NULL;
2081 this->prf_auth_i = NULL;
2082 this->prf_auth_r = NULL;
2083 this->child_prf = NULL;
2084 this->nat_here = FALSE;
2085 this->nat_there = FALSE;
2086 this->transaction_queue = linked_list_create();
2087 this->transaction_in = NULL;
2088 this->transaction_in_next = NULL;
2089 this->transaction_out = NULL;
2090 this->rekeying_transaction = NULL;
2091 this->state = IKE_CREATED;
2092 this->message_id_out = 0;
2093 /* set to NOW, as when we rekey an existing IKE_SA no message is exchanged */
2094 this->time.inbound = this->time.outbound = time(NULL);
2095 this->time.established = 0;
2096 this->time.rekey = 0;
2097 this->time.delete = 0;
2098 this->dpd_delay = 0;
2099 this->retrans_sequences = 0;
2100
2101 return &this->public;
2102 }
strongSwan - IPsec VPN