2 * Copyright (C) 2006-2008 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2006 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
31 #include <utils/linked_list.h>
32 #include <utils/lexparser.h>
33 #include <crypto/diffie_hellman.h>
34 #include <crypto/prf_plus.h>
35 #include <crypto/crypters/crypter.h>
36 #include <crypto/hashers/hasher.h>
37 #include <encoding/payloads/sa_payload.h>
38 #include <encoding/payloads/nonce_payload.h>
39 #include <encoding/payloads/ke_payload.h>
40 #include <encoding/payloads/delete_payload.h>
41 #include <encoding/payloads/transform_substructure.h>
42 #include <encoding/payloads/transform_attribute.h>
43 #include <encoding/payloads/ts_payload.h>
44 #include <sa/task_manager.h>
45 #include <sa/tasks/ike_init.h>
46 #include <sa/tasks/ike_natd.h>
47 #include <sa/tasks/ike_mobike.h>
48 #include <sa/tasks/ike_auth.h>
49 #include <sa/tasks/ike_auth_lifetime.h>
50 #include <sa/tasks/ike_config.h>
51 #include <sa/tasks/ike_cert_pre.h>
52 #include <sa/tasks/ike_cert_post.h>
53 #include <sa/tasks/ike_rekey.h>
54 #include <sa/tasks/ike_reauth.h>
55 #include <sa/tasks/ike_delete.h>
56 #include <sa/tasks/ike_dpd.h>
57 #include <sa/tasks/child_create.h>
58 #include <sa/tasks/child_delete.h>
59 #include <sa/tasks/child_rekey.h>
60 #include <processing/jobs/retransmit_job.h>
61 #include <processing/jobs/delete_ike_sa_job.h>
62 #include <processing/jobs/send_dpd_job.h>
63 #include <processing/jobs/send_keepalive_job.h>
64 #include <processing/jobs/rekey_ike_sa_job.h>
67 #include <sa/tasks/ike_me.h>
68 #include <processing/jobs/initiate_mediation_job.h>
72 #define RESOLV_CONF "/etc/resolv.conf"
75 ENUM(ike_sa_state_names
, IKE_CREATED
, IKE_DESTROYING
,
84 typedef struct private_ike_sa_t private_ike_sa_t
;
87 * Private data of an ike_sa_t object.
89 struct private_ike_sa_t
{
97 * Identifier for the current IKE_SA.
99 ike_sa_id_t
*ike_sa_id
;
102 * unique numerical ID for this IKE_SA.
107 * Current state of the IKE_SA
109 ike_sa_state_t state
;
112 * IKE configuration used to set up this IKE_SA
117 * Peer and authentication information to establish IKE_SA.
119 peer_cfg_t
*peer_cfg
;
122 * associated authentication/authorization info for local peer
124 auth_info_t
*my_auth
;
127 * associated authentication/authorization info for remote peer
129 auth_info_t
*other_auth
;
132 * Juggles tasks to process messages
134 task_manager_t
*task_manager
;
137 * Address of local host
142 * Address of remote host
148 * Are we mediation server
150 bool is_mediation_server
;
153 * Server reflexive host
155 host_t
*server_reflexive_host
;
164 * Identification used for us
166 identification_t
*my_id
;
169 * Identification used for other
171 identification_t
*other_id
;
174 * EAP Identity exchange in EAP-Identity method
176 identification_t
*eap_identity
;;
179 * set of extensions the peer supports
181 ike_extension_t extensions
;
184 * set of condition flags currently enabled for this IKE_SA
186 ike_condition_t conditions
;
189 * Linked List containing the child sa's of the current IKE_SA.
191 linked_list_t
*child_sas
;
194 * String describing the selected IKE proposal
196 char *selected_proposal
;
199 * crypter for inbound traffic
201 crypter_t
*crypter_in
;
204 * crypter for outbound traffic
206 crypter_t
*crypter_out
;
209 * Signer for inbound traffic
214 * Signer for outbound traffic
216 signer_t
*signer_out
;
219 * Multi purpose prf, set key, use it, forget it
224 * Prf function for derivating keymat child SAs
229 * Key to build outging authentication data (SKp)
234 * Key to verify incoming authentication data (SKp)
239 * Virtual IP on local host, if any
241 host_t
*my_virtual_ip
;
244 * Virtual IP on remote host, if any
246 host_t
*other_virtual_ip
;
249 * List of DNS servers installed by us
251 linked_list_t
*dns_servers
;
254 * list of peers additional addresses, transmitted via MOBIKE
256 linked_list_t
*additional_addresses
;
259 * previously value of received DESTINATION_IP hash
261 chunk_t nat_detection_dest
;
264 * number pending UPDATE_SA_ADDRESS (MOBIKE)
266 u_int32_t pending_updates
;
269 * NAT keep alive interval
271 u_int32_t keepalive_interval
;
274 * Timestamps for this IKE_SA
276 u_int32_t stats
[STAT_MAX
];
279 * how many times we have retried so far (keyingtries)
284 * are we the initiator of this IKE_SA (rekeying does not affect this flag)
290 * get the time of the latest traffic processed by the kernel
292 static time_t get_use_time(private_ike_sa_t
* this, bool inbound
)
294 enumerator_t
*enumerator
;
295 child_sa_t
*child_sa
;
300 use_time
= this->stats
[STAT_INBOUND
];
304 use_time
= this->stats
[STAT_OUTBOUND
];
306 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
307 while (enumerator
->enumerate(enumerator
, &child_sa
))
309 use_time
= max(use_time
, child_sa
->get_usetime(child_sa
, inbound
));
311 enumerator
->destroy(enumerator
);
317 * Implementation of ike_sa_t.get_unique_id
319 static u_int32_t
get_unique_id(private_ike_sa_t
*this)
321 return this->unique_id
;
325 * Implementation of ike_sa_t.get_name.
327 static char *get_name(private_ike_sa_t
*this)
331 return this->peer_cfg
->get_name(this->peer_cfg
);
337 * Implementation of ike_sa_t.get_statistic.
339 static u_int32_t
get_statistic(private_ike_sa_t
*this, statistic_t kind
)
343 return this->stats
[kind
];
349 * Implementation of ike_sa_t.get_my_host.
351 static host_t
*get_my_host(private_ike_sa_t
*this)
353 return this->my_host
;
357 * Implementation of ike_sa_t.set_my_host.
359 static void set_my_host(private_ike_sa_t
*this, host_t
*me
)
361 DESTROY_IF(this->my_host
);
366 * Implementation of ike_sa_t.get_other_host.
368 static host_t
*get_other_host(private_ike_sa_t
*this)
370 return this->other_host
;
374 * Implementation of ike_sa_t.set_other_host.
376 static void set_other_host(private_ike_sa_t
*this, host_t
*other
)
378 DESTROY_IF(this->other_host
);
379 this->other_host
= other
;
383 * Implementation of ike_sa_t.get_peer_cfg
385 static peer_cfg_t
* get_peer_cfg(private_ike_sa_t
*this)
387 return this->peer_cfg
;
391 * Implementation of ike_sa_t.set_peer_cfg
393 static void set_peer_cfg(private_ike_sa_t
*this, peer_cfg_t
*peer_cfg
)
395 DESTROY_IF(this->peer_cfg
);
396 peer_cfg
->get_ref(peer_cfg
);
397 this->peer_cfg
= peer_cfg
;
399 if (this->ike_cfg
== NULL
)
401 this->ike_cfg
= peer_cfg
->get_ike_cfg(peer_cfg
);
402 this->ike_cfg
->get_ref(this->ike_cfg
);
404 /* apply IDs if they are not already set */
405 if (this->my_id
->contains_wildcards(this->my_id
))
407 DESTROY_IF(this->my_id
);
408 this->my_id
= this->peer_cfg
->get_my_id(this->peer_cfg
);
409 this->my_id
= this->my_id
->clone(this->my_id
);
411 if (this->other_id
->contains_wildcards(this->other_id
))
413 DESTROY_IF(this->other_id
);
414 this->other_id
= this->peer_cfg
->get_other_id(this->peer_cfg
);
415 this->other_id
= this->other_id
->clone(this->other_id
);
420 * Implementation of ike_sa_t.get_my_auth.
422 static auth_info_t
* get_my_auth(private_ike_sa_t
*this)
424 return this->my_auth
;
428 * Implementation of ike_sa_t.get_other_auth.
430 static auth_info_t
* get_other_auth(private_ike_sa_t
*this)
432 return this->other_auth
;
436 * Implementation of ike_sa_t.send_keepalive
438 static void send_keepalive(private_ike_sa_t
*this)
440 send_keepalive_job_t
*job
;
441 time_t last_out
, now
, diff
;
443 if (!(this->conditions
& COND_NAT_HERE
) || this->keepalive_interval
== 0)
444 { /* disable keep alives if we are not NATed anymore */
448 last_out
= get_use_time(this, FALSE
);
451 diff
= now
- last_out
;
453 if (diff
>= this->keepalive_interval
)
458 packet
= packet_create();
459 packet
->set_source(packet
, this->my_host
->clone(this->my_host
));
460 packet
->set_destination(packet
, this->other_host
->clone(this->other_host
));
461 data
.ptr
= malloc(1);
464 packet
->set_data(packet
, data
);
465 DBG1(DBG_IKE
, "sending keep alive");
466 charon
->sender
->send(charon
->sender
, packet
);
469 job
= send_keepalive_job_create(this->ike_sa_id
);
470 charon
->scheduler
->schedule_job(charon
->scheduler
, (job_t
*)job
,
471 (this->keepalive_interval
- diff
) * 1000);
475 * Implementation of ike_sa_t.get_ike_cfg
477 static ike_cfg_t
*get_ike_cfg(private_ike_sa_t
*this)
479 return this->ike_cfg
;
483 * Implementation of ike_sa_t.set_ike_cfg
485 static void set_ike_cfg(private_ike_sa_t
*this, ike_cfg_t
*ike_cfg
)
487 ike_cfg
->get_ref(ike_cfg
);
488 this->ike_cfg
= ike_cfg
;
492 * Implementation of ike_sa_t.is_ike_initiator
494 static bool is_ike_initiator(private_ike_sa_t
*this)
496 return this->ike_initiator
;
500 * Implementation of ike_sa_t.enable_extension.
502 static void enable_extension(private_ike_sa_t
*this, ike_extension_t extension
)
504 this->extensions
|= extension
;
508 * Implementation of ike_sa_t.has_extension.
510 static bool supports_extension(private_ike_sa_t
*this, ike_extension_t extension
)
512 return (this->extensions
& extension
) != FALSE
;
516 * Implementation of ike_sa_t.has_condition.
518 static bool has_condition(private_ike_sa_t
*this, ike_condition_t condition
)
520 return (this->conditions
& condition
) != FALSE
;
524 * Implementation of ike_sa_t.enable_condition.
526 static void set_condition(private_ike_sa_t
*this, ike_condition_t condition
,
529 if (has_condition(this, condition
) != enable
)
533 this->conditions
|= condition
;
537 DBG1(DBG_IKE
, "local host is behind NAT, sending keep alives");
538 this->conditions
|= COND_NAT_ANY
;
539 send_keepalive(this);
542 DBG1(DBG_IKE
, "remote host is behind NAT");
543 this->conditions
|= COND_NAT_ANY
;
546 DBG1(DBG_IKE
, "faking NAT situation to enforce UDP encapsulation");
547 this->conditions
|= COND_NAT_ANY
;
555 this->conditions
&= ~condition
;
561 set_condition(this, COND_NAT_ANY
,
562 has_condition(this, COND_NAT_HERE
) ||
563 has_condition(this, COND_NAT_THERE
) ||
564 has_condition(this, COND_NAT_FAKE
));
574 * Implementation of ike_sa_t.send_dpd
576 static status_t
send_dpd(private_ike_sa_t
*this)
581 delay
= this->peer_cfg
->get_dpd(this->peer_cfg
);
589 if (this->task_manager
->busy(this->task_manager
))
591 /* an exchange is in the air, no need to start a DPD check */
596 /* check if there was any inbound traffic */
598 last_in
= get_use_time(this, TRUE
);
600 diff
= now
- last_in
;
603 /* to long ago, initiate dead peer detection */
605 ike_mobike_t
*mobike
;
607 if (supports_extension(this, EXT_MOBIKE
) &&
608 has_condition(this, COND_NAT_HERE
))
610 /* use mobike enabled DPD to detect NAT mapping changes */
611 mobike
= ike_mobike_create(&this->public, TRUE
);
613 task
= &mobike
->task
;
617 task
= (task_t
*)ike_dpd_create(TRUE
);
620 DBG1(DBG_IKE
, "sending DPD request");
622 this->task_manager
->queue_task(this->task_manager
, task
);
623 this->task_manager
->initiate(this->task_manager
);
626 /* recheck in "interval" seconds */
627 job
= send_dpd_job_create(this->ike_sa_id
);
628 charon
->scheduler
->schedule_job(charon
->scheduler
, (job_t
*)job
,
629 (delay
- diff
) * 1000);
634 * Implementation of ike_sa_t.get_state.
636 static ike_sa_state_t
get_state(private_ike_sa_t
*this)
642 * Implementation of ike_sa_t.set_state.
644 static void set_state(private_ike_sa_t
*this, ike_sa_state_t state
)
646 DBG2(DBG_IKE
, "IKE_SA %s[%d] state change: %N => %N",
647 get_name(this), this->unique_id
,
648 ike_sa_state_names
, this->state
,
649 ike_sa_state_names
, state
);
653 case IKE_ESTABLISHED
:
655 if (this->state
== IKE_CONNECTING
)
660 /* calculate rekey, reauth and lifetime */
661 this->stats
[STAT_ESTABLISHED
] = time(NULL
);
663 /* schedule rekeying if we have a time which is smaller than
664 * an already scheduled rekeying */
665 t
= this->peer_cfg
->get_rekey_time(this->peer_cfg
);
666 if (t
&& (this->stats
[STAT_REKEY
] == 0 ||
667 (this->stats
[STAT_REKEY
] > t
+ this->stats
[STAT_ESTABLISHED
])))
669 this->stats
[STAT_REKEY
] = t
+ this->stats
[STAT_ESTABLISHED
];
670 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, FALSE
);
671 charon
->scheduler
->schedule_job(charon
->scheduler
,
673 DBG1(DBG_IKE
, "scheduling rekeying in %ds", t
);
675 t
= this->peer_cfg
->get_reauth_time(this->peer_cfg
);
676 if (t
&& (this->stats
[STAT_REAUTH
] == 0 ||
677 (this->stats
[STAT_REAUTH
] > t
+ this->stats
[STAT_ESTABLISHED
])))
679 this->stats
[STAT_REAUTH
] = t
+ this->stats
[STAT_ESTABLISHED
];
680 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
);
681 charon
->scheduler
->schedule_job(charon
->scheduler
,
683 DBG1(DBG_IKE
, "scheduling reauthentication in %ds", t
);
685 t
= this->peer_cfg
->get_over_time(this->peer_cfg
);
686 if (this->stats
[STAT_REKEY
] || this->stats
[STAT_REAUTH
])
688 if (this->stats
[STAT_REAUTH
] == 0)
690 this->stats
[STAT_DELETE
] = this->stats
[STAT_REKEY
];
692 else if (this->stats
[STAT_REKEY
] == 0)
694 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
];
698 this->stats
[STAT_DELETE
] = min(this->stats
[STAT_REKEY
],
699 this->stats
[STAT_REAUTH
]);
701 this->stats
[STAT_DELETE
] += t
;
702 t
= this->stats
[STAT_DELETE
] - this->stats
[STAT_ESTABLISHED
];
703 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
704 charon
->scheduler
->schedule_job(charon
->scheduler
, job
,
706 DBG1(DBG_IKE
, "maximum IKE_SA lifetime %ds", t
);
709 /* start DPD checks */
716 /* delete may fail if a packet gets lost, so set a timeout */
717 job_t
*job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
718 charon
->scheduler
->schedule_job(charon
->scheduler
, job
,
719 HALF_OPEN_IKE_SA_TIMEOUT
);
725 charon
->bus
->ike_state_change(charon
->bus
, &this->public, state
);
730 * Implementation of ike_sa_t.reset
732 static void reset(private_ike_sa_t
*this)
734 /* the responder ID is reset, as peer may choose another one */
735 if (this->ike_sa_id
->is_initiator(this->ike_sa_id
))
737 this->ike_sa_id
->set_responder_spi(this->ike_sa_id
, 0);
740 set_state(this, IKE_CREATED
);
742 this->task_manager
->reset(this->task_manager
);
746 * Implementation of ike_sa_t.set_virtual_ip
748 static void set_virtual_ip(private_ike_sa_t
*this, bool local
, host_t
*ip
)
752 DBG1(DBG_IKE
, "installing new virtual IP %H", ip
);
753 if (charon
->kernel_interface
->add_ip(charon
->kernel_interface
, ip
,
754 this->my_host
) == SUCCESS
)
756 if (this->my_virtual_ip
)
758 DBG1(DBG_IKE
, "removing old virtual IP %H", this->my_virtual_ip
);
759 charon
->kernel_interface
->del_ip(charon
->kernel_interface
,
760 this->my_virtual_ip
);
762 DESTROY_IF(this->my_virtual_ip
);
763 this->my_virtual_ip
= ip
->clone(ip
);
767 DBG1(DBG_IKE
, "installing virtual IP %H failed", ip
);
768 this->my_virtual_ip
= NULL
;
773 DESTROY_IF(this->other_virtual_ip
);
774 this->other_virtual_ip
= ip
->clone(ip
);
779 * Implementation of ike_sa_t.get_virtual_ip
781 static host_t
* get_virtual_ip(private_ike_sa_t
*this, bool local
)
785 return this->my_virtual_ip
;
789 return this->other_virtual_ip
;
794 * Implementation of ike_sa_t.add_additional_address.
796 static void add_additional_address(private_ike_sa_t
*this, host_t
*host
)
798 this->additional_addresses
->insert_last(this->additional_addresses
, host
);
802 * Implementation of ike_sa_t.create_additional_address_iterator.
804 static iterator_t
* create_additional_address_iterator(private_ike_sa_t
*this)
806 return this->additional_addresses
->create_iterator(
807 this->additional_addresses
, TRUE
);
811 * Implementation of ike_sa_t.has_mapping_changed
813 static bool has_mapping_changed(private_ike_sa_t
*this, chunk_t hash
)
815 if (this->nat_detection_dest
.ptr
== NULL
)
817 this->nat_detection_dest
= chunk_clone(hash
);
820 if (chunk_equals(hash
, this->nat_detection_dest
))
824 free(this->nat_detection_dest
.ptr
);
825 this->nat_detection_dest
= chunk_clone(hash
);
830 * Implementation of ike_sa_t.set_pending_updates.
832 static void set_pending_updates(private_ike_sa_t
*this, u_int32_t updates
)
834 this->pending_updates
= updates
;
838 * Implementation of ike_sa_t.get_pending_updates.
840 static u_int32_t
get_pending_updates(private_ike_sa_t
*this)
842 return this->pending_updates
;
846 * Update hosts, as addresses may change (NAT)
848 static void update_hosts(private_ike_sa_t
*this, host_t
*me
, host_t
*other
)
858 other
= this->other_host
;
861 /* apply hosts on first received message */
862 if (this->my_host
->is_anyaddr(this->my_host
) ||
863 this->other_host
->is_anyaddr(this->other_host
))
865 set_my_host(this, me
->clone(me
));
866 set_other_host(this, other
->clone(other
));
871 /* update our address in any case */
872 if (!me
->equals(me
, this->my_host
))
874 set_my_host(this, me
->clone(me
));
878 if (!other
->equals(other
, this->other_host
))
880 /* update others adress if we are NOT NATed,
881 * and allow port changes if we are NATed */
882 if (!has_condition(this, COND_NAT_HERE
) ||
883 other
->ip_equals(other
, this->other_host
))
885 set_other_host(this, other
->clone(other
));
891 /* update all associated CHILD_SAs, if required */
894 iterator_t
*iterator
;
895 child_sa_t
*child_sa
;
897 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
898 while (iterator
->iterate(iterator
, (void**)&child_sa
))
900 child_sa
->update_hosts(child_sa
, this->my_host
, this->other_host
,
901 this->my_virtual_ip
, has_condition(this, COND_NAT_ANY
));
903 iterator
->destroy(iterator
);
908 * Implementation of ike_sa_t.generate
910 static status_t
generate_message(private_ike_sa_t
*this, message_t
*message
,
913 this->stats
[STAT_OUTBOUND
] = time(NULL
);
914 message
->set_ike_sa_id(message
, this->ike_sa_id
);
915 return message
->generate(message
, this->crypter_out
, this->signer_out
, packet
);
919 * send a notify back to the sender
921 static void send_notify_response(private_ike_sa_t
*this, message_t
*request
,
927 response
= message_create();
928 response
->set_exchange_type(response
, request
->get_exchange_type(request
));
929 response
->set_request(response
, FALSE
);
930 response
->set_message_id(response
, request
->get_message_id(request
));
931 response
->add_notify(response
, FALSE
, type
, chunk_empty
);
932 if (this->my_host
->is_anyaddr(this->my_host
))
934 this->my_host
->destroy(this->my_host
);
935 this->my_host
= request
->get_destination(request
);
936 this->my_host
= this->my_host
->clone(this->my_host
);
938 if (this->other_host
->is_anyaddr(this->other_host
))
940 this->other_host
->destroy(this->other_host
);
941 this->other_host
= request
->get_source(request
);
942 this->other_host
= this->other_host
->clone(this->other_host
);
944 response
->set_source(response
, this->my_host
->clone(this->my_host
));
945 response
->set_destination(response
, this->other_host
->clone(this->other_host
));
946 if (generate_message(this, response
, &packet
) == SUCCESS
)
948 charon
->sender
->send(charon
->sender
, packet
);
950 response
->destroy(response
);
955 * Implementation of ike_sa_t.act_as_mediation_server.
957 static void act_as_mediation_server(private_ike_sa_t
*this)
959 charon
->mediation_manager
->update_sa_id(charon
->mediation_manager
,
960 this->other_id
, this->ike_sa_id
);
961 this->is_mediation_server
= TRUE
;
965 * Implementation of ike_sa_t.get_server_reflexive_host.
967 static host_t
*get_server_reflexive_host(private_ike_sa_t
*this)
969 return this->server_reflexive_host
;
973 * Implementation of ike_sa_t.set_server_reflexive_host.
975 static void set_server_reflexive_host(private_ike_sa_t
*this, host_t
*host
)
977 DESTROY_IF(this->server_reflexive_host
);
978 this->server_reflexive_host
= host
;
982 * Implementation of ike_sa_t.get_connect_id.
984 static chunk_t
get_connect_id(private_ike_sa_t
*this)
986 return this->connect_id
;
990 * Implementation of ike_sa_t.respond
992 static status_t
respond(private_ike_sa_t
*this, identification_t
*peer_id
,
995 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
996 task
->respond(task
, peer_id
, connect_id
);
997 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
998 return this->task_manager
->initiate(this->task_manager
);
1002 * Implementation of ike_sa_t.callback
1004 static status_t
callback(private_ike_sa_t
*this, identification_t
*peer_id
)
1006 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1007 task
->callback(task
, peer_id
);
1008 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1009 return this->task_manager
->initiate(this->task_manager
);
1013 * Implementation of ike_sa_t.relay
1015 static status_t
relay(private_ike_sa_t
*this, identification_t
*requester
,
1016 chunk_t connect_id
, chunk_t connect_key
, linked_list_t
*endpoints
, bool response
)
1018 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1019 task
->relay(task
, requester
, connect_id
, connect_key
, endpoints
, response
);
1020 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1021 return this->task_manager
->initiate(this->task_manager
);
1025 * Implementation of ike_sa_t.initiate_mediation
1027 static status_t
initiate_mediation(private_ike_sa_t
*this, peer_cfg_t
*mediated_cfg
)
1029 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1030 task
->connect(task
, mediated_cfg
->get_peer_id(mediated_cfg
));
1031 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1032 return this->task_manager
->initiate(this->task_manager
);
1036 * Implementation of ike_sa_t.initiate_mediated
1038 static status_t
initiate_mediated(private_ike_sa_t
*this, host_t
*me
, host_t
*other
,
1041 set_my_host(this, me
->clone(me
));
1042 set_other_host(this, other
->clone(other
));
1043 chunk_free(&this->connect_id
);
1044 this->connect_id
= chunk_clone(connect_id
);
1046 return this->task_manager
->initiate(this->task_manager
);
1051 * Resolve DNS host in configuration
1053 static void resolve_hosts(private_ike_sa_t
*this)
1057 host
= host_create_from_dns(this->ike_cfg
->get_other_addr(this->ike_cfg
),
1061 set_other_host(this, host
);
1064 host
= host_create_from_dns(this->ike_cfg
->get_my_addr(this->ike_cfg
),
1065 this->my_host
->get_family(this->my_host
),
1068 if (host
&& host
->is_anyaddr(host
) &&
1069 !this->other_host
->is_anyaddr(this->other_host
))
1071 host
->destroy(host
);
1072 host
= charon
->kernel_interface
->get_source_addr(
1073 charon
->kernel_interface
, this->other_host
, NULL
);
1076 host
->set_port(host
, IKEV2_UDP_PORT
);
1081 set_my_host(this, host
);
1086 * Initiates a CHILD_SA using the appropriate reqid
1088 static status_t
initiate_with_reqid(private_ike_sa_t
*this, child_cfg_t
*child_cfg
, u_int32_t reqid
)
1092 if (this->state
== IKE_CREATED
)
1094 resolve_hosts(this);
1096 if (this->other_host
->is_anyaddr(this->other_host
)
1098 && !this->peer_cfg
->get_mediated_by(this->peer_cfg
)
1102 child_cfg
->destroy(child_cfg
);
1103 DBG1(DBG_IKE
, "unable to initiate to %%any");
1107 this->ike_initiator
= TRUE
;
1109 task
= (task_t
*)ike_init_create(&this->public, TRUE
, NULL
);
1110 this->task_manager
->queue_task(this->task_manager
, task
);
1111 task
= (task_t
*)ike_natd_create(&this->public, TRUE
);
1112 this->task_manager
->queue_task(this->task_manager
, task
);
1113 task
= (task_t
*)ike_cert_pre_create(&this->public, TRUE
);
1114 this->task_manager
->queue_task(this->task_manager
, task
);
1115 task
= (task_t
*)ike_auth_create(&this->public, TRUE
);
1116 this->task_manager
->queue_task(this->task_manager
, task
);
1117 task
= (task_t
*)ike_cert_post_create(&this->public, TRUE
);
1118 this->task_manager
->queue_task(this->task_manager
, task
);
1119 task
= (task_t
*)ike_config_create(&this->public, TRUE
);
1120 this->task_manager
->queue_task(this->task_manager
, task
);
1121 task
= (task_t
*)ike_auth_lifetime_create(&this->public, TRUE
);
1122 this->task_manager
->queue_task(this->task_manager
, task
);
1123 if (this->peer_cfg
->use_mobike(this->peer_cfg
))
1125 task
= (task_t
*)ike_mobike_create(&this->public, TRUE
);
1126 this->task_manager
->queue_task(this->task_manager
, task
);
1129 task
= (task_t
*)ike_me_create(&this->public, TRUE
);
1130 this->task_manager
->queue_task(this->task_manager
, task
);
1135 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1136 { /* mediation connection is already established, retrigger state change
1137 * to notify bus listeners */
1138 DBG1(DBG_IKE
, "mediation connection is already up");
1139 set_state(this, IKE_ESTABLISHED
);
1140 DESTROY_IF(child_cfg
);
1145 /* normal IKE_SA with CHILD_SA */
1146 task
= (task_t
*)child_create_create(&this->public, child_cfg
);
1147 child_cfg
->destroy(child_cfg
);
1150 child_create_t
*child_create
= (child_create_t
*)task
;
1151 child_create
->use_reqid(child_create
, reqid
);
1153 this->task_manager
->queue_task(this->task_manager
, task
);
1156 if (this->peer_cfg
->get_mediated_by(this->peer_cfg
))
1158 /* mediated connection, initiate mediation process */
1159 job_t
*job
= (job_t
*)initiate_mediation_job_create(this->ike_sa_id
);
1160 charon
->processor
->queue_job(charon
->processor
, job
);
1166 return this->task_manager
->initiate(this->task_manager
);
1170 * Implementation of ike_sa_t.initiate.
1172 static status_t
initiate(private_ike_sa_t
*this, child_cfg_t
*child_cfg
)
1174 return initiate_with_reqid(this, child_cfg
, 0);
1178 * Implementation of ike_sa_t.acquire.
1180 static status_t
acquire(private_ike_sa_t
*this, u_int32_t reqid
)
1182 child_cfg_t
*child_cfg
;
1183 iterator_t
*iterator
;
1184 child_sa_t
*current
, *child_sa
= NULL
;
1186 if (this->state
== IKE_DELETING
)
1188 DBG1(DBG_IKE
, "acquiring CHILD_SA {reqid %d} failed: "
1189 "IKE_SA is deleting", reqid
);
1194 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1195 while (iterator
->iterate(iterator
, (void**)¤t
))
1197 if (current
->get_reqid(current
) == reqid
)
1203 iterator
->destroy(iterator
);
1206 DBG1(DBG_IKE
, "acquiring CHILD_SA {reqid %d} failed: "
1207 "CHILD_SA not found", reqid
);
1211 child_cfg
= child_sa
->get_config(child_sa
);
1212 child_cfg
->get_ref(child_cfg
);
1214 return initiate_with_reqid(this, child_cfg
, reqid
);
1218 * Implementation of ike_sa_t.route.
1220 static status_t
route(private_ike_sa_t
*this, child_cfg_t
*child_cfg
)
1222 child_sa_t
*child_sa
;
1223 iterator_t
*iterator
;
1224 linked_list_t
*my_ts
, *other_ts
;
1228 /* check if not already routed*/
1229 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1230 while (iterator
->iterate(iterator
, (void**)&child_sa
))
1232 if (child_sa
->get_state(child_sa
) == CHILD_ROUTED
&&
1233 streq(child_sa
->get_name(child_sa
), child_cfg
->get_name(child_cfg
)))
1235 iterator
->destroy(iterator
);
1236 DBG1(DBG_IKE
, "routing CHILD_SA failed: already routed");
1240 iterator
->destroy(iterator
);
1242 switch (this->state
)
1246 DBG1(DBG_IKE
, "routing CHILD_SA failed: IKE_SA is %N",
1247 ike_sa_state_names
, this->state
);
1250 case IKE_CONNECTING
:
1251 case IKE_ESTABLISHED
:
1256 resolve_hosts(this);
1258 /* install kernel policies */
1259 child_sa
= child_sa_create(this->my_host
, this->other_host
,
1260 child_cfg
, 0, FALSE
);
1262 if (this->my_virtual_ip
)
1264 me
= this->my_virtual_ip
;
1266 other
= this->other_host
;
1267 if (this->other_virtual_ip
)
1269 other
= this->other_virtual_ip
;
1272 my_ts
= child_cfg
->get_traffic_selectors(child_cfg
, TRUE
, NULL
, me
);
1273 other_ts
= child_cfg
->get_traffic_selectors(child_cfg
, FALSE
, NULL
, other
);
1274 status
= child_sa
->add_policies(child_sa
, my_ts
, other_ts
,
1275 child_cfg
->get_mode(child_cfg
), PROTO_NONE
);
1276 my_ts
->destroy_offset(my_ts
, offsetof(traffic_selector_t
, destroy
));
1277 other_ts
->destroy_offset(other_ts
, offsetof(traffic_selector_t
, destroy
));
1278 if (status
== SUCCESS
)
1280 this->child_sas
->insert_last(this->child_sas
, child_sa
);
1281 DBG1(DBG_IKE
, "CHILD_SA routed");
1285 DBG1(DBG_IKE
, "routing CHILD_SA failed");
1291 * Implementation of ike_sa_t.unroute.
1293 static status_t
unroute(private_ike_sa_t
*this, u_int32_t reqid
)
1295 iterator_t
*iterator
;
1296 child_sa_t
*child_sa
;
1299 /* find CHILD_SA in ROUTED state */
1300 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1301 while (iterator
->iterate(iterator
, (void**)&child_sa
))
1303 if (child_sa
->get_state(child_sa
) == CHILD_ROUTED
&&
1304 child_sa
->get_reqid(child_sa
) == reqid
)
1306 iterator
->remove(iterator
);
1307 DBG1(DBG_IKE
, "CHILD_SA unrouted");
1308 child_sa
->destroy(child_sa
);
1313 iterator
->destroy(iterator
);
1317 DBG1(DBG_IKE
, "unrouting CHILD_SA failed: reqid %d not found", reqid
);
1320 /* if we are not established, and we have no more routed childs, remove whole SA */
1321 if (this->state
== IKE_CREATED
&&
1322 this->child_sas
->get_count(this->child_sas
) == 0)
1329 * Implementation of ike_sa_t.process_message.
1331 static status_t
process_message(private_ike_sa_t
*this, message_t
*message
)
1336 is_request
= message
->get_request(message
);
1338 status
= message
->parse_body(message
, this->crypter_in
, this->signer_in
);
1339 if (status
!= SUCCESS
)
1347 DBG1(DBG_IKE
, "ciritcal unknown payloads found");
1350 send_notify_response(this, message
, UNSUPPORTED_CRITICAL_PAYLOAD
);
1354 DBG1(DBG_IKE
, "message parsing failed");
1357 send_notify_response(this, message
, INVALID_SYNTAX
);
1361 DBG1(DBG_IKE
, "message verification failed");
1364 send_notify_response(this, message
, INVALID_SYNTAX
);
1368 DBG1(DBG_IKE
, "integrity check failed");
1372 DBG1(DBG_IKE
, "found encrypted message, but no keys available");
1375 send_notify_response(this, message
, INVALID_SYNTAX
);
1381 DBG1(DBG_IKE
, "%N %s with message ID %d processing failed",
1382 exchange_type_names
, message
->get_exchange_type(message
),
1383 message
->get_request(message
) ?
"request" : "response",
1384 message
->get_message_id(message
));
1390 private_ike_sa_t
*new;
1391 iterator_t
*iterator
;
1393 bool has_routed
= FALSE
;
1395 me
= message
->get_destination(message
);
1396 other
= message
->get_source(message
);
1398 /* if this IKE_SA is virgin, we check for a config */
1399 if (this->ike_cfg
== NULL
)
1402 this->ike_cfg
= charon
->backends
->get_ike_cfg(charon
->backends
,
1404 if (this->ike_cfg
== NULL
)
1406 /* no config found for these hosts, destroy */
1407 DBG1(DBG_IKE
, "no IKE config found for %H...%H, sending %N",
1408 me
, other
, notify_type_names
, NO_PROPOSAL_CHOSEN
);
1409 send_notify_response(this, message
, NO_PROPOSAL_CHOSEN
);
1412 /* add a timeout if peer does not establish it completely */
1413 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, FALSE
);
1414 charon
->scheduler
->schedule_job(charon
->scheduler
, job
,
1415 HALF_OPEN_IKE_SA_TIMEOUT
);
1417 this->stats
[STAT_INBOUND
] = time(NULL
);
1418 /* check if message is trustworthy, and update host information */
1419 if (this->state
== IKE_CREATED
|| this->state
== IKE_CONNECTING
||
1420 message
->get_exchange_type(message
) != IKE_SA_INIT
)
1422 if (!supports_extension(this, EXT_MOBIKE
))
1423 { /* with MOBIKE, we do no implicit updates */
1424 update_hosts(this, me
, other
);
1427 status
= this->task_manager
->process_message(this->task_manager
, message
);
1428 if (status
!= DESTROY_ME
)
1432 /* if IKE_SA gets closed for any reasons, reroute routed children */
1433 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1434 while (iterator
->iterate(iterator
, (void**)&child
))
1436 if (child
->get_state(child
) == CHILD_ROUTED
)
1442 iterator
->destroy(iterator
);
1447 /* move routed children to a new IKE_SA, apply connection info */
1448 new = (private_ike_sa_t
*)charon
->ike_sa_manager
->checkout_new(
1449 charon
->ike_sa_manager
, TRUE
);
1450 set_peer_cfg(new, this->peer_cfg
);
1451 new->other_host
->destroy(new->other_host
);
1452 new->other_host
= this->other_host
->clone(this->other_host
);
1453 if (!has_condition(this, COND_NAT_THERE
))
1455 new->other_host
->set_port(new->other_host
, IKEV2_UDP_PORT
);
1457 if (this->my_virtual_ip
)
1459 set_virtual_ip(new, TRUE
, this->my_virtual_ip
);
1461 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1462 while (iterator
->iterate(iterator
, (void**)&child
))
1464 if (child
->get_state(child
) == CHILD_ROUTED
)
1466 route(new, child
->get_config(child
));
1469 iterator
->destroy(iterator
);
1470 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, &new->public);
1476 * Implementation of ike_sa_t.get_prf.
1478 static prf_t
*get_prf(private_ike_sa_t
*this)
1484 * Implementation of ike_sa_t.get_prf.
1486 static prf_t
*get_child_prf(private_ike_sa_t
*this)
1488 return this->child_prf
;
1492 * Implementation of ike_sa_t.get_skp_bild
1494 static chunk_t
get_skp_build(private_ike_sa_t
*this)
1496 return this->skp_build
;
1500 * Implementation of ike_sa_t.get_skp_verify
1502 static chunk_t
get_skp_verify(private_ike_sa_t
*this)
1504 return this->skp_verify
;
1508 * Implementation of ike_sa_t.get_id.
1510 static ike_sa_id_t
* get_id(private_ike_sa_t
*this)
1512 return this->ike_sa_id
;
1516 * Implementation of ike_sa_t.get_my_id.
1518 static identification_t
* get_my_id(private_ike_sa_t
*this)
1524 * Implementation of ike_sa_t.set_my_id.
1526 static void set_my_id(private_ike_sa_t
*this, identification_t
*me
)
1528 DESTROY_IF(this->my_id
);
1533 * Implementation of ike_sa_t.get_other_id.
1535 static identification_t
* get_other_id(private_ike_sa_t
*this)
1537 return this->other_id
;
1541 * Implementation of ike_sa_t.set_other_id.
1543 static void set_other_id(private_ike_sa_t
*this, identification_t
*other
)
1545 DESTROY_IF(this->other_id
);
1546 this->other_id
= other
;
1550 * Implementation of ike_sa_t.get_eap_identity.
1552 static identification_t
* get_eap_identity(private_ike_sa_t
*this)
1554 return this->eap_identity
;
1558 * Implementation of ike_sa_t.set_eap_identity.
1560 static void set_eap_identity(private_ike_sa_t
*this, identification_t
*id
)
1562 DESTROY_IF(this->eap_identity
);
1563 this->eap_identity
= id
;
1567 * Implementation of ike_sa_t.derive_keys.
1569 static status_t
derive_keys(private_ike_sa_t
*this,
1570 proposal_t
*proposal
, chunk_t secret
,
1571 chunk_t nonce_i
, chunk_t nonce_r
,
1572 bool initiator
, prf_t
*child_prf
, prf_t
*old_prf
)
1574 prf_plus_t
*prf_plus
;
1575 chunk_t skeyseed
, key
, full_nonce
, fixed_nonce
, prf_plus_seed
;
1576 u_int16_t alg
, key_size
;
1577 crypter_t
*crypter_i
, *crypter_r
;
1578 signer_t
*signer_i
, *signer_r
;
1579 u_int8_t spi_i_buf
[sizeof(u_int64_t
)], spi_r_buf
[sizeof(u_int64_t
)];
1580 chunk_t spi_i
= chunk_from_buf(spi_i_buf
);
1581 chunk_t spi_r
= chunk_from_buf(spi_r_buf
);
1583 /* Create SAs general purpose PRF first, we may use it here */
1584 if (!proposal
->get_algorithm(proposal
, PSEUDO_RANDOM_FUNCTION
, &alg
, NULL
))
1586 DBG1(DBG_IKE
, "no %N selected",
1587 transform_type_names
, PSEUDO_RANDOM_FUNCTION
);
1590 this->prf
= lib
->crypto
->create_prf(lib
->crypto
, alg
);
1591 if (this->prf
== NULL
)
1593 DBG1(DBG_IKE
, "%N %N not supported!",
1594 transform_type_names
, PSEUDO_RANDOM_FUNCTION
,
1595 pseudo_random_function_names
, alg
);
1598 DBG4(DBG_IKE
, "shared Diffie Hellman secret %B", &secret
);
1599 /* full nonce is used as seed for PRF+ ... */
1600 full_nonce
= chunk_cat("cc", nonce_i
, nonce_r
);
1601 /* but the PRF may need a fixed key which only uses the first bytes of
1605 case PRF_AES128_XCBC
:
1606 /* while rfc4434 defines variable keys for AES-XCBC, rfc3664 does
1607 * not and therefore fixed key semantics apply to XCBC for key
1609 nonce_i
.len
= min(nonce_i
.len
, this->prf
->get_key_size(this->prf
)/2);
1610 nonce_r
.len
= min(nonce_r
.len
, this->prf
->get_key_size(this->prf
)/2);
1613 /* all other algorithms use variable key length, full nonce */
1616 fixed_nonce
= chunk_cat("cc", nonce_i
, nonce_r
);
1617 *((u_int64_t
*)spi_i
.ptr
) = this->ike_sa_id
->get_initiator_spi(this->ike_sa_id
);
1618 *((u_int64_t
*)spi_r
.ptr
) = this->ike_sa_id
->get_responder_spi(this->ike_sa_id
);
1619 prf_plus_seed
= chunk_cat("ccc", full_nonce
, spi_i
, spi_r
);
1621 /* KEYMAT = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr)
1623 * if we are rekeying, SKEYSEED is built on another way
1625 if (child_prf
== NULL
) /* not rekeying */
1627 /* SKEYSEED = prf(Ni | Nr, g^ir) */
1628 this->prf
->set_key(this->prf
, fixed_nonce
);
1629 this->prf
->allocate_bytes(this->prf
, secret
, &skeyseed
);
1630 DBG4(DBG_IKE
, "SKEYSEED %B", &skeyseed
);
1631 this->prf
->set_key(this->prf
, skeyseed
);
1632 chunk_clear(&skeyseed
);
1633 chunk_clear(&secret
);
1634 prf_plus
= prf_plus_create(this->prf
, prf_plus_seed
);
1638 /* SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
1639 * use OLD SAs PRF functions for both prf_plus and prf */
1640 secret
= chunk_cat("mc", secret
, full_nonce
);
1641 child_prf
->allocate_bytes(child_prf
, secret
, &skeyseed
);
1642 DBG4(DBG_IKE
, "SKEYSEED %B", &skeyseed
);
1643 old_prf
->set_key(old_prf
, skeyseed
);
1644 chunk_clear(&skeyseed
);
1645 chunk_clear(&secret
);
1646 prf_plus
= prf_plus_create(old_prf
, prf_plus_seed
);
1648 chunk_free(&full_nonce
);
1649 chunk_free(&fixed_nonce
);
1650 chunk_clear(&prf_plus_seed
);
1652 /* KEYMAT = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr */
1654 /* SK_d is used for generating CHILD_SA key mat => child_prf */
1655 proposal
->get_algorithm(proposal
, PSEUDO_RANDOM_FUNCTION
, &alg
, NULL
);
1656 this->child_prf
= lib
->crypto
->create_prf(lib
->crypto
, alg
);
1657 key_size
= this->child_prf
->get_key_size(this->child_prf
);
1658 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1659 DBG4(DBG_IKE
, "Sk_d secret %B", &key
);
1660 this->child_prf
->set_key(this->child_prf
, key
);
1663 /* SK_ai/SK_ar used for integrity protection => signer_in/signer_out */
1664 if (!proposal
->get_algorithm(proposal
, INTEGRITY_ALGORITHM
, &alg
, NULL
))
1666 DBG1(DBG_IKE
, "no %N selected",
1667 transform_type_names
, INTEGRITY_ALGORITHM
);
1670 signer_i
= lib
->crypto
->create_signer(lib
->crypto
, alg
);
1671 signer_r
= lib
->crypto
->create_signer(lib
->crypto
, alg
);
1672 if (signer_i
== NULL
|| signer_r
== NULL
)
1674 DBG1(DBG_IKE
, "%N %N not supported!",
1675 transform_type_names
, INTEGRITY_ALGORITHM
,
1676 integrity_algorithm_names
,alg
);
1677 prf_plus
->destroy(prf_plus
);
1680 key_size
= signer_i
->get_key_size(signer_i
);
1682 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1683 DBG4(DBG_IKE
, "Sk_ai secret %B", &key
);
1684 signer_i
->set_key(signer_i
, key
);
1687 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1688 DBG4(DBG_IKE
, "Sk_ar secret %B", &key
);
1689 signer_r
->set_key(signer_r
, key
);
1694 this->signer_in
= signer_r
;
1695 this->signer_out
= signer_i
;
1699 this->signer_in
= signer_i
;
1700 this->signer_out
= signer_r
;
1703 /* SK_ei/SK_er used for encryption => crypter_in/crypter_out */
1704 if (!proposal
->get_algorithm(proposal
, ENCRYPTION_ALGORITHM
, &alg
, &key_size
))
1706 DBG1(DBG_IKE
, "no %N selected",
1707 transform_type_names
, ENCRYPTION_ALGORITHM
);
1708 prf_plus
->destroy(prf_plus
);
1711 crypter_i
= lib
->crypto
->create_crypter(lib
->crypto
, alg
, key_size
/ 8);
1712 crypter_r
= lib
->crypto
->create_crypter(lib
->crypto
, alg
, key_size
/ 8);
1713 if (crypter_i
== NULL
|| crypter_r
== NULL
)
1715 DBG1(DBG_IKE
, "%N %N (key size %d) not supported!",
1716 transform_type_names
, ENCRYPTION_ALGORITHM
,
1717 encryption_algorithm_names
, alg
, key_size
);
1718 prf_plus
->destroy(prf_plus
);
1721 key_size
= crypter_i
->get_key_size(crypter_i
);
1723 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1724 DBG4(DBG_IKE
, "Sk_ei secret %B", &key
);
1725 crypter_i
->set_key(crypter_i
, key
);
1728 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1729 DBG4(DBG_IKE
, "Sk_er secret %B", &key
);
1730 crypter_r
->set_key(crypter_r
, key
);
1735 this->crypter_in
= crypter_r
;
1736 this->crypter_out
= crypter_i
;
1740 this->crypter_in
= crypter_i
;
1741 this->crypter_out
= crypter_r
;
1744 /* SK_pi/SK_pr used for authentication => stored for later */
1745 key_size
= this->prf
->get_key_size(this->prf
);
1746 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1747 DBG4(DBG_IKE
, "Sk_pi secret %B", &key
);
1750 this->skp_build
= key
;
1754 this->skp_verify
= key
;
1756 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1757 DBG4(DBG_IKE
, "Sk_pr secret %B", &key
);
1760 this->skp_verify
= key
;
1764 this->skp_build
= key
;
1767 /* all done, prf_plus not needed anymore */
1768 prf_plus
->destroy(prf_plus
);
1774 * Implementation of ike_sa_t.get_proposal.
1776 static char* get_proposal(private_ike_sa_t
*this)
1778 return this->selected_proposal
;
1782 * Implementation of ike_sa_t.set_proposal.
1784 static void set_proposal(private_ike_sa_t
*this, char *proposal
)
1786 free(this->selected_proposal
);
1787 this->selected_proposal
= strdup(proposal
);
1791 * Implementation of ike_sa_t.add_child_sa.
1793 static void add_child_sa(private_ike_sa_t
*this, child_sa_t
*child_sa
)
1795 this->child_sas
->insert_last(this->child_sas
, child_sa
);
1799 * Implementation of ike_sa_t.get_child_sa.
1801 static child_sa_t
* get_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
,
1802 u_int32_t spi
, bool inbound
)
1804 iterator_t
*iterator
;
1805 child_sa_t
*current
, *found
= NULL
;
1807 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1808 while (iterator
->iterate(iterator
, (void**)¤t
))
1810 if (current
->get_spi(current
, inbound
) == spi
&&
1811 current
->get_protocol(current
) == protocol
)
1816 iterator
->destroy(iterator
);
1821 * Implementation of ike_sa_t.create_child_sa_iterator.
1823 static iterator_t
* create_child_sa_iterator(private_ike_sa_t
*this)
1825 return this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1829 * Implementation of ike_sa_t.rekey_child_sa.
1831 static status_t
rekey_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1833 child_sa_t
*child_sa
;
1834 child_rekey_t
*child_rekey
;
1836 child_sa
= get_child_sa(this, protocol
, spi
, TRUE
);
1839 child_rekey
= child_rekey_create(&this->public, child_sa
);
1840 this->task_manager
->queue_task(this->task_manager
, &child_rekey
->task
);
1841 return this->task_manager
->initiate(this->task_manager
);
1847 * Implementation of ike_sa_t.delete_child_sa.
1849 static status_t
delete_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1851 child_sa_t
*child_sa
;
1852 child_delete_t
*child_delete
;
1854 child_sa
= get_child_sa(this, protocol
, spi
, TRUE
);
1857 child_delete
= child_delete_create(&this->public, child_sa
);
1858 this->task_manager
->queue_task(this->task_manager
, &child_delete
->task
);
1859 return this->task_manager
->initiate(this->task_manager
);
1865 * Implementation of ike_sa_t.destroy_child_sa.
1867 static status_t
destroy_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
,
1870 iterator_t
*iterator
;
1871 child_sa_t
*child_sa
;
1872 status_t status
= NOT_FOUND
;
1874 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1875 while (iterator
->iterate(iterator
, (void**)&child_sa
))
1877 if (child_sa
->get_protocol(child_sa
) == protocol
&&
1878 child_sa
->get_spi(child_sa
, TRUE
) == spi
)
1880 child_sa
->destroy(child_sa
);
1881 iterator
->remove(iterator
);
1886 iterator
->destroy(iterator
);
1891 * Implementation of public_ike_sa_t.delete.
1893 static status_t
delete_(private_ike_sa_t
*this)
1895 ike_delete_t
*ike_delete
;
1897 switch (this->state
)
1899 case IKE_ESTABLISHED
:
1901 ike_delete
= ike_delete_create(&this->public, TRUE
);
1902 this->task_manager
->queue_task(this->task_manager
, &ike_delete
->task
);
1903 return this->task_manager
->initiate(this->task_manager
);
1905 DBG1(DBG_IKE
, "deleting unestablished IKE_SA");
1908 DBG1(DBG_IKE
, "destroying IKE_SA in state %N "
1909 "without notification", ike_sa_state_names
, this->state
);
1916 * Implementation of ike_sa_t.rekey.
1918 static status_t
rekey(private_ike_sa_t
*this)
1920 ike_rekey_t
*ike_rekey
;
1922 ike_rekey
= ike_rekey_create(&this->public, TRUE
);
1924 this->task_manager
->queue_task(this->task_manager
, &ike_rekey
->task
);
1925 return this->task_manager
->initiate(this->task_manager
);
1929 * Implementation of ike_sa_t.reauth
1931 static status_t
reauth(private_ike_sa_t
*this)
1935 /* we can't reauthenticate as responder when we use EAP or virtual IPs.
1936 * If the peer does not support RFC4478, there is no way to keep the
1938 if (!this->ike_initiator
)
1940 DBG1(DBG_IKE
, "initiator did not reauthenticate as requested");
1941 if (this->other_virtual_ip
!= NULL
||
1942 has_condition(this, COND_EAP_AUTHENTICATED
)
1944 /* if we are mediation server we too cannot reauth the IKE_SA */
1945 || this->is_mediation_server
1949 time_t now
= time(NULL
);
1951 DBG1(DBG_IKE
, "IKE_SA will timeout in %#V",
1952 &now
, &this->stats
[STAT_DELETE
]);
1957 DBG1(DBG_IKE
, "reauthenticating actively");
1960 task
= (task_t
*)ike_reauth_create(&this->public);
1961 this->task_manager
->queue_task(this->task_manager
, task
);
1963 return this->task_manager
->initiate(this->task_manager
);
1967 * Implementation of ike_sa_t.reestablish
1969 static status_t
reestablish(private_ike_sa_t
*this)
1974 iterator_t
*iterator
;
1975 child_sa_t
*child_sa
;
1976 child_cfg_t
*child_cfg
;
1977 bool required
= FALSE
;
1978 status_t status
= FAILED
;
1980 /* check if we have children to keep up at all*/
1981 iterator
= create_child_sa_iterator(this);
1982 while (iterator
->iterate(iterator
, (void**)&child_sa
))
1984 child_cfg
= child_sa
->get_config(child_sa
);
1985 if (this->state
== IKE_DELETING
)
1987 action
= child_cfg
->get_close_action(child_cfg
);
1991 action
= child_cfg
->get_dpd_action(child_cfg
);
1995 case ACTION_RESTART
:
2002 iterator
->destroy(iterator
);
2004 /* we initiate the new IKE_SA of the mediation connection without CHILD_SA */
2005 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
2015 /* check if we are able to reestablish this IKE_SA */
2016 if (!this->ike_initiator
&&
2017 (this->other_virtual_ip
!= NULL
||
2018 has_condition(this, COND_EAP_AUTHENTICATED
)
2020 || this->is_mediation_server
2024 DBG1(DBG_IKE
, "unable to reestablish IKE_SA due asymetric setup");
2028 new = charon
->ike_sa_manager
->checkout_new(charon
->ike_sa_manager
, TRUE
);
2029 new->set_peer_cfg(new, this->peer_cfg
);
2030 host
= this->other_host
;
2031 new->set_other_host(new, host
->clone(host
));
2032 host
= this->my_host
;
2033 new->set_my_host(new, host
->clone(host
));
2034 /* if we already have a virtual IP, we reuse it */
2035 host
= this->my_virtual_ip
;
2038 new->set_virtual_ip(new, TRUE
, host
);
2042 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
2044 status
= new->initiate(new, NULL
);
2049 iterator
= create_child_sa_iterator(this);
2050 while (iterator
->iterate(iterator
, (void**)&child_sa
))
2052 child_cfg
= child_sa
->get_config(child_sa
);
2053 if (this->state
== IKE_DELETING
)
2055 action
= child_cfg
->get_close_action(child_cfg
);
2059 action
= child_cfg
->get_dpd_action(child_cfg
);
2063 case ACTION_RESTART
:
2064 DBG1(DBG_IKE
, "restarting CHILD_SA %s",
2065 child_cfg
->get_name(child_cfg
));
2066 child_cfg
->get_ref(child_cfg
);
2067 status
= new->initiate(new, child_cfg
);
2070 status
= new->route(new, child_cfg
);
2075 if (status
== DESTROY_ME
)
2080 iterator
->destroy(iterator
);
2083 if (status
== DESTROY_ME
)
2085 charon
->ike_sa_manager
->checkin_and_destroy(charon
->ike_sa_manager
, new);
2090 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, new);
2096 * Implementation of ike_sa_t.retransmit.
2098 static status_t
retransmit(private_ike_sa_t
*this, u_int32_t message_id
)
2100 this->stats
[STAT_OUTBOUND
] = time(NULL
);
2101 if (this->task_manager
->retransmit(this->task_manager
, message_id
) != SUCCESS
)
2103 /* send a proper signal to brief interested bus listeners */
2104 switch (this->state
)
2106 case IKE_CONNECTING
:
2108 /* retry IKE_SA_INIT if we have multiple keyingtries */
2109 u_int32_t tries
= this->peer_cfg
->get_keyingtries(this->peer_cfg
);
2111 if (tries
== 0 || tries
> this->keyingtry
)
2113 DBG1(DBG_IKE
, "peer not responding, trying again (%d/%d)",
2114 this->keyingtry
+ 1, tries
);
2116 return this->task_manager
->initiate(this->task_manager
);
2118 DBG1(DBG_IKE
, "establishing IKE_SA failed, peer not responding");
2122 DBG1(DBG_IKE
, "proper IKE_SA delete failed, peer not responding");
2125 DBG1(DBG_IKE
, "rekeying IKE_SA failed, peer not responding");
2137 * Implementation of ike_sa_t.set_auth_lifetime.
2139 static void set_auth_lifetime(private_ike_sa_t
*this, u_int32_t lifetime
)
2141 u_int32_t reduction
= this->peer_cfg
->get_over_time(this->peer_cfg
);
2142 u_int32_t reauth_time
= time(NULL
) + lifetime
- reduction
;
2144 if (lifetime
< reduction
)
2146 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, starting reauthentication",
2148 charon
->processor
->queue_job(charon
->processor
,
2149 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
));
2151 else if (this->stats
[STAT_REAUTH
] == 0 ||
2152 this->stats
[STAT_REAUTH
] > reauth_time
)
2154 this->stats
[STAT_REAUTH
] = reauth_time
;
2155 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, scheduling reauthentication"
2156 " in %ds", lifetime
, lifetime
- reduction
);
2157 charon
->scheduler
->schedule_job(charon
->scheduler
,
2158 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
),
2159 (lifetime
- reduction
) * 1000);
2163 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, reauthentication already "
2164 "scheduled in %ds", lifetime
, this->stats
[STAT_REAUTH
] - time(NULL
));
2169 * Implementation of ike_sa_t.roam.
2171 static status_t
roam(private_ike_sa_t
*this, bool address
)
2174 ike_mobike_t
*mobike
;
2176 switch (this->state
)
2184 /* responder just updates the peer about changed address config */
2185 if (!this->ike_sa_id
->is_initiator(this->ike_sa_id
))
2187 if (supports_extension(this, EXT_MOBIKE
) && address
)
2189 DBG1(DBG_IKE
, "sending address list update using MOBIKE");
2190 mobike
= ike_mobike_create(&this->public, TRUE
);
2191 this->task_manager
->queue_task(this->task_manager
, (task_t
*)mobike
);
2192 return this->task_manager
->initiate(this->task_manager
);
2197 /* keep existing path if possible */
2198 src
= charon
->kernel_interface
->get_source_addr(charon
->kernel_interface
,
2199 this->other_host
, this->my_host
);
2202 if (src
->ip_equals(src
, this->my_host
))
2204 DBG2(DBG_IKE
, "keeping connection path %H - %H",
2205 src
, this->other_host
);
2212 /* update addresses with mobike, if supported ... */
2213 if (supports_extension(this, EXT_MOBIKE
))
2215 DBG1(DBG_IKE
, "requesting address change using MOBIKE");
2216 mobike
= ike_mobike_create(&this->public, TRUE
);
2217 mobike
->roam(mobike
, address
);
2218 this->task_manager
->queue_task(this->task_manager
, (task_t
*)mobike
);
2219 return this->task_manager
->initiate(this->task_manager
);
2221 DBG1(DBG_IKE
, "reauthenticating IKE_SA due to address change");
2222 /* ... reauth if not */
2223 return reauth(this);
2227 * Implementation of ike_sa_t.inherit.
2229 static status_t
inherit(private_ike_sa_t
*this, private_ike_sa_t
*other
)
2231 child_sa_t
*child_sa
;
2234 /* apply hosts and ids */
2235 this->my_host
->destroy(this->my_host
);
2236 this->other_host
->destroy(this->other_host
);
2237 this->my_id
->destroy(this->my_id
);
2238 this->other_id
->destroy(this->other_id
);
2239 this->my_host
= other
->my_host
->clone(other
->my_host
);
2240 this->other_host
= other
->other_host
->clone(other
->other_host
);
2241 this->my_id
= other
->my_id
->clone(other
->my_id
);
2242 this->other_id
= other
->other_id
->clone(other
->other_id
);
2243 this->ike_initiator
= other
->ike_initiator
;
2245 /* apply virtual assigned IPs... */
2246 if (other
->my_virtual_ip
)
2248 this->my_virtual_ip
= other
->my_virtual_ip
;
2249 other
->my_virtual_ip
= NULL
;
2251 if (other
->other_virtual_ip
)
2253 this->other_virtual_ip
= other
->other_virtual_ip
;
2254 other
->other_virtual_ip
= NULL
;
2257 /* ... and DNS servers */
2258 while (other
->dns_servers
->remove_last(other
->dns_servers
,
2259 (void**)&ip
) == SUCCESS
)
2261 this->dns_servers
->insert_first(this->dns_servers
, ip
);
2264 /* inherit NAT-T conditions */
2265 this->conditions
= other
->conditions
;
2266 if (this->conditions
& COND_NAT_HERE
)
2268 send_keepalive(this);
2272 if (other
->is_mediation_server
)
2274 act_as_mediation_server(this);
2276 else if (other
->server_reflexive_host
)
2278 this->server_reflexive_host
= other
->server_reflexive_host
->clone(
2279 other
->server_reflexive_host
);
2283 /* adopt all children */
2284 while (other
->child_sas
->remove_last(other
->child_sas
,
2285 (void**)&child_sa
) == SUCCESS
)
2287 this->child_sas
->insert_first(this->child_sas
, (void*)child_sa
);
2290 /* move pending tasks to the new IKE_SA */
2291 this->task_manager
->adopt_tasks(this->task_manager
, other
->task_manager
);
2293 /* reauthentication timeout survives a rekeying */
2294 if (other
->stats
[STAT_REAUTH
])
2296 time_t reauth
, delete, now
= time(NULL
);
2298 this->stats
[STAT_REAUTH
] = other
->stats
[STAT_REAUTH
];
2299 reauth
= this->stats
[STAT_REAUTH
] - now
;
2300 delete = reauth
+ this->peer_cfg
->get_over_time(this->peer_cfg
);
2301 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
] + delete;
2302 DBG1(DBG_IKE
, "rescheduling reauthentication in %ds after rekeying, "
2303 "lifetime reduced to %ds", reauth
, delete);
2304 charon
->scheduler
->schedule_job(charon
->scheduler
,
2305 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
),
2307 charon
->scheduler
->schedule_job(charon
->scheduler
,
2308 (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
),
2311 /* we have to initate here, there may be new tasks to handle */
2312 return this->task_manager
->initiate(this->task_manager
);
2316 * Implementation of ike_sa_t.remove_dns_server
2318 static void remove_dns_servers(private_ike_sa_t
*this)
2322 chunk_t contents
, line
, orig_line
, token
;
2323 char string
[INET6_ADDRSTRLEN
];
2325 iterator_t
*iterator
;
2327 if (this->dns_servers
->get_count(this->dns_servers
) == 0)
2329 /* don't touch anything if we have no nameservers installed */
2333 file
= fopen(RESOLV_CONF
, "r");
2334 if (file
== NULL
|| stat(RESOLV_CONF
, &stats
) != 0)
2336 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %s",
2337 RESOLV_CONF
, strerror(errno
));
2341 contents
= chunk_alloca((size_t)stats
.st_size
);
2343 if (fread(contents
.ptr
, 1, contents
.len
, file
) != contents
.len
)
2345 DBG1(DBG_IKE
, "unable to read DNS configuration file: %s", strerror(errno
));
2351 file
= fopen(RESOLV_CONF
, "w");
2354 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %s",
2355 RESOLV_CONF
, strerror(errno
));
2359 iterator
= this->dns_servers
->create_iterator(this->dns_servers
, TRUE
);
2360 while (fetchline(&contents
, &line
))
2364 if (extract_token(&token
, ' ', &line
) &&
2365 strncasecmp(token
.ptr
, "nameserver", token
.len
) == 0)
2367 if (!extract_token(&token
, ' ', &line
))
2371 iterator
->reset(iterator
);
2372 while (iterator
->iterate(iterator
, (void**)&ip
))
2374 snprintf(string
, sizeof(string
), "%H", ip
);
2375 if (strlen(string
) == token
.len
&&
2376 strncmp(token
.ptr
, string
, token
.len
) == 0)
2378 iterator
->remove(iterator
);
2388 /* write line untouched back to file */
2389 fwrite(orig_line
.ptr
, orig_line
.len
, 1, file
);
2390 fprintf(file
, "\n");
2393 iterator
->destroy(iterator
);
2398 * Implementation of ike_sa_t.add_dns_server
2400 static void add_dns_server(private_ike_sa_t
*this, host_t
*dns
)
2406 DBG1(DBG_IKE
, "installing DNS server %H", dns
);
2408 file
= fopen(RESOLV_CONF
, "a+");
2409 if (file
== NULL
|| stat(RESOLV_CONF
, &stats
) != 0)
2411 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %s",
2412 RESOLV_CONF
, strerror(errno
));
2416 contents
= chunk_alloca(stats
.st_size
);
2418 if (fread(contents
.ptr
, 1, contents
.len
, file
) != contents
.len
)
2420 DBG1(DBG_IKE
, "unable to read DNS configuration file: %s", strerror(errno
));
2426 file
= fopen(RESOLV_CONF
, "w");
2429 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %s",
2430 RESOLV_CONF
, strerror(errno
));
2434 if (fprintf(file
, "nameserver %H # added by strongSwan, assigned by %D\n",
2435 dns
, this->other_id
) < 0)
2437 DBG1(DBG_IKE
, "unable to write DNS configuration: %s", strerror(errno
));
2441 this->dns_servers
->insert_last(this->dns_servers
, dns
->clone(dns
));
2443 fwrite(contents
.ptr
, contents
.len
, 1, file
);
2449 * Implementation of ike_sa_t.destroy.
2451 static void destroy(private_ike_sa_t
*this)
2453 set_state(this, IKE_DESTROYING
);
2455 this->child_sas
->destroy_offset(this->child_sas
, offsetof(child_sa_t
, destroy
));
2457 /* unset SA after here to avoid usage by the listeners */
2458 charon
->bus
->set_sa(charon
->bus
, NULL
);
2460 this->task_manager
->destroy(this->task_manager
);
2462 DESTROY_IF(this->crypter_in
);
2463 DESTROY_IF(this->crypter_out
);
2464 DESTROY_IF(this->signer_in
);
2465 DESTROY_IF(this->signer_out
);
2466 DESTROY_IF(this->prf
);
2467 DESTROY_IF(this->child_prf
);
2468 chunk_free(&this->skp_verify
);
2469 chunk_free(&this->skp_build
);
2470 free(this->selected_proposal
);
2472 if (this->my_virtual_ip
)
2474 charon
->kernel_interface
->del_ip(charon
->kernel_interface
,
2475 this->my_virtual_ip
);
2476 this->my_virtual_ip
->destroy(this->my_virtual_ip
);
2478 if (this->other_virtual_ip
)
2480 if (this->peer_cfg
&& this->peer_cfg
->get_pool(this->peer_cfg
))
2482 charon
->attributes
->release_address(charon
->attributes
,
2483 this->peer_cfg
->get_pool(this->peer_cfg
),
2484 this->other_virtual_ip
);
2486 this->other_virtual_ip
->destroy(this->other_virtual_ip
);
2489 remove_dns_servers(this);
2490 this->dns_servers
->destroy_offset(this->dns_servers
,
2491 offsetof(host_t
, destroy
));
2492 this->additional_addresses
->destroy_offset(this->additional_addresses
,
2493 offsetof(host_t
, destroy
));
2495 if (this->is_mediation_server
)
2497 charon
->mediation_manager
->remove(charon
->mediation_manager
, this->ike_sa_id
);
2499 DESTROY_IF(this->server_reflexive_host
);
2500 chunk_free(&this->connect_id
);
2502 free(this->nat_detection_dest
.ptr
);
2504 DESTROY_IF(this->my_host
);
2505 DESTROY_IF(this->other_host
);
2506 DESTROY_IF(this->my_id
);
2507 DESTROY_IF(this->other_id
);
2508 DESTROY_IF(this->eap_identity
);
2510 DESTROY_IF(this->ike_cfg
);
2511 DESTROY_IF(this->peer_cfg
);
2512 DESTROY_IF(this->my_auth
);
2513 DESTROY_IF(this->other_auth
);
2515 this->ike_sa_id
->destroy(this->ike_sa_id
);
2520 * Described in header.
2522 ike_sa_t
* ike_sa_create(ike_sa_id_t
*ike_sa_id
)
2524 private_ike_sa_t
*this = malloc_thing(private_ike_sa_t
);
2525 static u_int32_t unique_id
= 0;
2527 /* Public functions */
2528 this->public.get_state
= (ike_sa_state_t (*)(ike_sa_t
*)) get_state
;
2529 this->public.set_state
= (void (*)(ike_sa_t
*,ike_sa_state_t
)) set_state
;
2530 this->public.get_name
= (char* (*)(ike_sa_t
*))get_name
;
2531 this->public.get_statistic
= (u_int32_t(*)(ike_sa_t
*, statistic_t kind
))get_statistic
;
2532 this->public.process_message
= (status_t (*)(ike_sa_t
*, message_t
*)) process_message
;
2533 this->public.initiate
= (status_t (*)(ike_sa_t
*,child_cfg_t
*)) initiate
;
2534 this->public.route
= (status_t (*)(ike_sa_t
*,child_cfg_t
*)) route
;
2535 this->public.unroute
= (status_t (*)(ike_sa_t
*,u_int32_t
)) unroute
;
2536 this->public.acquire
= (status_t (*)(ike_sa_t
*,u_int32_t
)) acquire
;
2537 this->public.get_ike_cfg
= (ike_cfg_t
* (*)(ike_sa_t
*))get_ike_cfg
;
2538 this->public.set_ike_cfg
= (void (*)(ike_sa_t
*,ike_cfg_t
*))set_ike_cfg
;
2539 this->public.get_peer_cfg
= (peer_cfg_t
* (*)(ike_sa_t
*))get_peer_cfg
;
2540 this->public.set_peer_cfg
= (void (*)(ike_sa_t
*,peer_cfg_t
*))set_peer_cfg
;
2541 this->public.get_my_auth
= (auth_info_t
*(*)(ike_sa_t
*))get_my_auth
;
2542 this->public.get_other_auth
= (auth_info_t
*(*)(ike_sa_t
*))get_other_auth
;
2543 this->public.get_id
= (ike_sa_id_t
* (*)(ike_sa_t
*)) get_id
;
2544 this->public.get_my_host
= (host_t
* (*)(ike_sa_t
*)) get_my_host
;
2545 this->public.set_my_host
= (void (*)(ike_sa_t
*,host_t
*)) set_my_host
;
2546 this->public.get_other_host
= (host_t
* (*)(ike_sa_t
*)) get_other_host
;
2547 this->public.set_other_host
= (void (*)(ike_sa_t
*,host_t
*)) set_other_host
;
2548 this->public.update_hosts
= (void(*)(ike_sa_t
*, host_t
*me
, host_t
*other
))update_hosts
;
2549 this->public.get_my_id
= (identification_t
* (*)(ike_sa_t
*)) get_my_id
;
2550 this->public.set_my_id
= (void (*)(ike_sa_t
*,identification_t
*)) set_my_id
;
2551 this->public.get_other_id
= (identification_t
* (*)(ike_sa_t
*)) get_other_id
;
2552 this->public.set_other_id
= (void (*)(ike_sa_t
*,identification_t
*)) set_other_id
;
2553 this->public.get_eap_identity
= (identification_t
* (*)(ike_sa_t
*)) get_eap_identity
;
2554 this->public.set_eap_identity
= (void (*)(ike_sa_t
*,identification_t
*)) set_eap_identity
;
2555 this->public.enable_extension
= (void(*)(ike_sa_t
*, ike_extension_t extension
))enable_extension
;
2556 this->public.supports_extension
= (bool(*)(ike_sa_t
*, ike_extension_t extension
))supports_extension
;
2557 this->public.set_condition
= (void (*)(ike_sa_t
*, ike_condition_t
,bool)) set_condition
;
2558 this->public.has_condition
= (bool (*)(ike_sa_t
*,ike_condition_t
)) has_condition
;
2559 this->public.set_pending_updates
= (void(*)(ike_sa_t
*, u_int32_t updates
))set_pending_updates
;
2560 this->public.get_pending_updates
= (u_int32_t(*)(ike_sa_t
*))get_pending_updates
;
2561 this->public.is_ike_initiator
= (bool (*)(ike_sa_t
*))is_ike_initiator
;
2562 this->public.create_additional_address_iterator
= (iterator_t
*(*)(ike_sa_t
*))create_additional_address_iterator
;
2563 this->public.add_additional_address
= (void(*)(ike_sa_t
*, host_t
*host
))add_additional_address
;
2564 this->public.has_mapping_changed
= (bool(*)(ike_sa_t
*, chunk_t hash
))has_mapping_changed
;
2565 this->public.retransmit
= (status_t (*)(ike_sa_t
*, u_int32_t
)) retransmit
;
2566 this->public.delete = (status_t (*)(ike_sa_t
*))delete_
;
2567 this->public.destroy
= (void (*)(ike_sa_t
*))destroy
;
2568 this->public.send_dpd
= (status_t (*)(ike_sa_t
*)) send_dpd
;
2569 this->public.send_keepalive
= (void (*)(ike_sa_t
*)) send_keepalive
;
2570 this->public.get_prf
= (prf_t
* (*)(ike_sa_t
*)) get_prf
;
2571 this->public.get_child_prf
= (prf_t
* (*)(ike_sa_t
*)) get_child_prf
;
2572 this->public.get_skp_verify
= (chunk_t (*)(ike_sa_t
*)) get_skp_verify
;
2573 this->public.get_skp_build
= (chunk_t (*)(ike_sa_t
*)) get_skp_build
;
2574 this->public.derive_keys
= (status_t (*)(ike_sa_t
*,proposal_t
*,chunk_t
,chunk_t
,chunk_t
,bool,prf_t
*,prf_t
*)) derive_keys
;
2575 this->public.get_proposal
= (char* (*)(ike_sa_t
*)) get_proposal
;
2576 this->public.set_proposal
= (void (*)(ike_sa_t
*,char*)) set_proposal
;
2577 this->public.add_child_sa
= (void (*)(ike_sa_t
*,child_sa_t
*)) add_child_sa
;
2578 this->public.get_child_sa
= (child_sa_t
* (*)(ike_sa_t
*,protocol_id_t
,u_int32_t
,bool)) get_child_sa
;
2579 this->public.create_child_sa_iterator
= (iterator_t
* (*)(ike_sa_t
*)) create_child_sa_iterator
;
2580 this->public.rekey_child_sa
= (status_t (*)(ike_sa_t
*,protocol_id_t
,u_int32_t
)) rekey_child_sa
;
2581 this->public.delete_child_sa
= (status_t (*)(ike_sa_t
*,protocol_id_t
,u_int32_t
)) delete_child_sa
;
2582 this->public.destroy_child_sa
= (status_t (*)(ike_sa_t
*,protocol_id_t
,u_int32_t
))destroy_child_sa
;
2583 this->public.rekey
= (status_t (*)(ike_sa_t
*))rekey
;
2584 this->public.reauth
= (status_t (*)(ike_sa_t
*))reauth
;
2585 this->public.reestablish
= (status_t (*)(ike_sa_t
*))reestablish
;
2586 this->public.set_auth_lifetime
= (void(*)(ike_sa_t
*, u_int32_t lifetime
))set_auth_lifetime
;
2587 this->public.roam
= (status_t(*)(ike_sa_t
*,bool))roam
;
2588 this->public.inherit
= (status_t (*)(ike_sa_t
*,ike_sa_t
*))inherit
;
2589 this->public.generate_message
= (status_t (*)(ike_sa_t
*,message_t
*,packet_t
**))generate_message
;
2590 this->public.reset
= (void (*)(ike_sa_t
*))reset
;
2591 this->public.get_unique_id
= (u_int32_t (*)(ike_sa_t
*))get_unique_id
;
2592 this->public.set_virtual_ip
= (void (*)(ike_sa_t
*,bool,host_t
*))set_virtual_ip
;
2593 this->public.get_virtual_ip
= (host_t
* (*)(ike_sa_t
*,bool))get_virtual_ip
;
2594 this->public.add_dns_server
= (void (*)(ike_sa_t
*,host_t
*))add_dns_server
;
2596 this->public.act_as_mediation_server
= (void (*)(ike_sa_t
*)) act_as_mediation_server
;
2597 this->public.get_server_reflexive_host
= (host_t
* (*)(ike_sa_t
*)) get_server_reflexive_host
;
2598 this->public.set_server_reflexive_host
= (void (*)(ike_sa_t
*,host_t
*)) set_server_reflexive_host
;
2599 this->public.get_connect_id
= (chunk_t (*)(ike_sa_t
*)) get_connect_id
;
2600 this->public.initiate_mediation
= (status_t (*)(ike_sa_t
*,peer_cfg_t
*)) initiate_mediation
;
2601 this->public.initiate_mediated
= (status_t (*)(ike_sa_t
*,host_t
*,host_t
*,chunk_t
)) initiate_mediated
;
2602 this->public.relay
= (status_t (*)(ike_sa_t
*,identification_t
*,chunk_t
,chunk_t
,linked_list_t
*,bool)) relay
;
2603 this->public.callback
= (status_t (*)(ike_sa_t
*,identification_t
*)) callback
;
2604 this->public.respond
= (status_t (*)(ike_sa_t
*,identification_t
*,chunk_t
)) respond
;
2607 /* initialize private fields */
2608 this->ike_sa_id
= ike_sa_id
->clone(ike_sa_id
);
2609 this->child_sas
= linked_list_create();
2610 this->my_host
= host_create_from_string("0.0.0.0", IKEV2_UDP_PORT
);
2611 this->other_host
= host_create_from_string("0.0.0.0", IKEV2_UDP_PORT
);
2612 this->my_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
);
2613 this->other_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
);
2614 this->eap_identity
= NULL
;
2615 this->extensions
= 0;
2616 this->conditions
= 0;
2617 this->selected_proposal
= NULL
;
2618 this->crypter_in
= NULL
;
2619 this->crypter_out
= NULL
;
2620 this->signer_in
= NULL
;
2621 this->signer_out
= NULL
;
2623 this->skp_verify
= chunk_empty
;
2624 this->skp_build
= chunk_empty
;
2625 this->child_prf
= NULL
;
2626 this->state
= IKE_CREATED
;
2627 this->keepalive_interval
= lib
->settings
->get_time(lib
->settings
,
2628 "charon.keep_alive", KEEPALIVE_INTERVAL
);
2629 memset(this->stats
, 0, sizeof(this->stats
));
2630 this->stats
[STAT_INBOUND
] = this->stats
[STAT_OUTBOUND
] = time(NULL
);
2631 this->ike_cfg
= NULL
;
2632 this->peer_cfg
= NULL
;
2633 this->my_auth
= auth_info_create();
2634 this->other_auth
= auth_info_create();
2635 this->task_manager
= task_manager_create(&this->public);
2636 this->unique_id
= ++unique_id
;
2637 this->my_virtual_ip
= NULL
;
2638 this->other_virtual_ip
= NULL
;
2639 this->dns_servers
= linked_list_create();
2640 this->additional_addresses
= linked_list_create();
2641 this->nat_detection_dest
= chunk_empty
;
2642 this->pending_updates
= 0;
2643 this->keyingtry
= 0;
2644 this->ike_initiator
= FALSE
;
2646 this->is_mediation_server
= FALSE
;
2647 this->server_reflexive_host
= NULL
;
2648 this->connect_id
= chunk_empty
;
2651 return &this->public;