proper initialization and disposal of keying material
[strongswan.git] / src / charon / sa / tasks / child_create.c
1 /*
2 * Copyright (C) 2008 Tobias Brunner
3 * Copyright (C) 2005-2008 Martin Willi
4 * Copyright (C) 2005 Jan Hutter
5 * Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 *
17 * $Id$
18 */
19
20 #include "child_create.h"
21
22 #include <daemon.h>
23 #include <crypto/diffie_hellman.h>
24 #include <encoding/payloads/sa_payload.h>
25 #include <encoding/payloads/ke_payload.h>
26 #include <encoding/payloads/ts_payload.h>
27 #include <encoding/payloads/nonce_payload.h>
28 #include <encoding/payloads/notify_payload.h>
29 #include <processing/jobs/delete_ike_sa_job.h>
30
31
32 typedef struct private_child_create_t private_child_create_t;
33
34 /**
35 * Private members of a child_create_t task.
36 */
37 struct private_child_create_t {
38
39 /**
40 * Public methods and task_t interface.
41 */
42 child_create_t public;
43
44 /**
45 * Assigned IKE_SA.
46 */
47 ike_sa_t *ike_sa;
48
49 /**
50 * Are we the initiator?
51 */
52 bool initiator;
53
54 /**
55 * nonce chosen by us
56 */
57 chunk_t my_nonce;
58
59 /**
60 * nonce chosen by peer
61 */
62 chunk_t other_nonce;
63
64 /**
65 * config to create the CHILD_SA from
66 */
67 child_cfg_t *config;
68
69 /**
70 * list of proposal candidates
71 */
72 linked_list_t *proposals;
73
74 /**
75 * selected proposal to use for CHILD_SA
76 */
77 proposal_t *proposal;
78
79 /**
80 * traffic selectors for initiators side
81 */
82 linked_list_t *tsi;
83
84 /**
85 * traffic selectors for responders side
86 */
87 linked_list_t *tsr;
88
89 /**
90 * optional diffie hellman exchange
91 */
92 diffie_hellman_t *dh;
93
94 /**
95 * group used for DH exchange
96 */
97 diffie_hellman_group_t dh_group;
98
99 /**
100 * IKE_SAs keymat
101 */
102 keymat_t *keymat;
103
104 /**
105 * mode the new CHILD_SA uses (transport/tunnel/beet)
106 */
107 ipsec_mode_t mode;
108
109 /**
110 * IPComp transform to use
111 */
112 ipcomp_transform_t ipcomp;
113
114 /**
115 * IPComp transform proposed or accepted by the other peer
116 */
117 ipcomp_transform_t ipcomp_received;
118
119 /**
120 * Own allocated SPI
121 */
122 u_int32_t my_spi;
123
124 /**
125 * SPI received in proposal
126 */
127 u_int32_t other_spi;
128
129 /**
130 * Own allocated Compression Parameter Index (CPI)
131 */
132 u_int16_t my_cpi;
133
134 /**
135 * Other Compression Parameter Index (CPI), received via IPCOMP_SUPPORTED
136 */
137 u_int16_t other_cpi;
138
139 /**
140 * reqid to use if we are rekeying
141 */
142 u_int32_t reqid;
143
144 /**
145 * CHILD_SA which gets established
146 */
147 child_sa_t *child_sa;
148
149 /**
150 * successfully established the CHILD?
151 */
152 bool established;
153 };
154
155 /**
156 * get the nonce from a message
157 */
158 static status_t get_nonce(message_t *message, chunk_t *nonce)
159 {
160 nonce_payload_t *payload;
161
162 payload = (nonce_payload_t*)message->get_payload(message, NONCE);
163 if (payload == NULL)
164 {
165 return FAILED;
166 }
167 *nonce = payload->get_nonce(payload);
168 return NEED_MORE;
169 }
170
171 /**
172 * generate a new nonce to include in a CREATE_CHILD_SA message
173 */
174 static status_t generate_nonce(chunk_t *nonce)
175 {
176 rng_t *rng;
177
178 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
179 if (!rng)
180 {
181 DBG1(DBG_IKE, "error generating nonce value, no RNG found");
182 return FAILED;
183 }
184 rng->allocate_bytes(rng, NONCE_SIZE, nonce);
185 rng->destroy(rng);
186 return SUCCESS;
187 }
188
189 /**
190 * Check a list of traffic selectors if any selector belongs to host
191 */
192 static bool ts_list_is_host(linked_list_t *list, host_t *host)
193 {
194 traffic_selector_t *ts;
195 bool is_host = TRUE;
196 iterator_t *iterator = list->create_iterator(list, TRUE);
197
198 while (is_host && iterator->iterate(iterator, (void**)&ts))
199 {
200 is_host = is_host && ts->is_host(ts, host);
201 }
202 iterator->destroy(iterator);
203 return is_host;
204 }
205
206 /**
207 * Allocate SPIs and update proposals
208 */
209 static bool allocate_spi(private_child_create_t *this)
210 {
211 enumerator_t *enumerator;
212 proposal_t *proposal;
213
214 /* TODO: allocate additional SPI for AH if we have such proposals */
215 this->my_spi = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
216 if (this->my_spi)
217 {
218 if (this->initiator)
219 {
220 enumerator = this->proposals->create_enumerator(this->proposals);
221 while (enumerator->enumerate(enumerator, &proposal))
222 {
223 proposal->set_spi(proposal, this->my_spi);
224 }
225 enumerator->destroy(enumerator);
226 }
227 else
228 {
229 this->proposal->set_spi(this->proposal, this->my_spi);
230 }
231 return TRUE;
232 }
233 return FALSE;
234 }
235
236 /**
237 * Install a CHILD_SA for usage, return value:
238 * - FAILED: no acceptable proposal
239 * - INVALID_ARG: diffie hellman group inacceptable
240 * - NOT_FOUND: TS inacceptable
241 */
242 static status_t select_and_install(private_child_create_t *this, bool no_dh)
243 {
244 status_t status;
245 chunk_t nonce_i, nonce_r;
246 chunk_t encr_i = chunk_empty, encr_r = chunk_empty;
247 chunk_t integ_i = chunk_empty, integ_r = chunk_empty;
248 linked_list_t *my_ts, *other_ts;
249 host_t *me, *other, *other_vip, *my_vip;
250
251 if (this->proposals == NULL)
252 {
253 DBG1(DBG_IKE, "SA payload missing in message");
254 return FAILED;
255 }
256 if (this->tsi == NULL || this->tsr == NULL)
257 {
258 DBG1(DBG_IKE, "TS payloads missing in message");
259 return NOT_FOUND;
260 }
261
262 me = this->ike_sa->get_my_host(this->ike_sa);
263 other = this->ike_sa->get_other_host(this->ike_sa);
264 my_vip = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
265 other_vip = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
266
267 this->proposal = this->config->select_proposal(this->config, this->proposals,
268 no_dh);
269 if (this->proposal == NULL)
270 {
271 DBG1(DBG_IKE, "no acceptable proposal found");
272 return FAILED;
273 }
274 this->other_spi = this->proposal->get_spi(this->proposal);
275
276 if (!this->initiator && !allocate_spi(this))
277 { /* responder has no SPI allocated yet */
278 DBG1(DBG_IKE, "allocating SPI failed");
279 return FAILED;
280 }
281 this->child_sa->set_proposal(this->child_sa, this->proposal);
282
283 if (!this->proposal->has_dh_group(this->proposal, this->dh_group))
284 {
285 u_int16_t group;
286
287 if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
288 &group, NULL))
289 {
290 DBG1(DBG_IKE, "DH group %N inacceptable, requesting %N",
291 diffie_hellman_group_names, this->dh_group,
292 diffie_hellman_group_names, group);
293 this->dh_group = group;
294 return INVALID_ARG;
295 }
296 else
297 {
298 DBG1(DBG_IKE, "no acceptable proposal found");
299 return FAILED;
300 }
301 }
302
303 if (my_vip == NULL)
304 {
305 my_vip = me;
306 }
307 if (other_vip == NULL)
308 {
309 other_vip = other;
310 }
311
312 if (this->initiator)
313 {
314 nonce_i = this->my_nonce;
315 nonce_r = this->other_nonce;
316 my_ts = this->tsi;
317 other_ts = this->tsr;
318 }
319 else
320 {
321 nonce_r = this->my_nonce;
322 nonce_i = this->other_nonce;
323 my_ts = this->tsr;
324 other_ts = this->tsi;
325 }
326 my_ts = this->config->get_traffic_selectors(this->config, TRUE, my_ts,
327 my_vip);
328 other_ts = this->config->get_traffic_selectors(this->config, FALSE, other_ts,
329 other_vip);
330
331 if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
332 {
333 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
334 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
335 DBG1(DBG_IKE, "no acceptable traffic selectors found");
336 return NOT_FOUND;
337 }
338
339 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
340 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
341 if (this->initiator)
342 {
343 this->tsi = my_ts;
344 this->tsr = other_ts;
345 }
346 else
347 {
348 this->tsr = my_ts;
349 this->tsi = other_ts;
350 }
351
352 if (!this->initiator)
353 {
354 /* check if requested mode is acceptable, downgrade if required */
355 switch (this->mode)
356 {
357 case MODE_TRANSPORT:
358 if (!this->config->use_proxy_mode(this->config) &&
359 (!ts_list_is_host(this->tsi, other) ||
360 !ts_list_is_host(this->tsr, me))
361 )
362 {
363 this->mode = MODE_TUNNEL;
364 DBG1(DBG_IKE, "not using transport mode, not host-to-host");
365 }
366 else if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
367 {
368 this->mode = MODE_TUNNEL;
369 DBG1(DBG_IKE, "not using transport mode, connection NATed");
370 }
371 break;
372 case MODE_BEET:
373 if (!ts_list_is_host(this->tsi, NULL) ||
374 !ts_list_is_host(this->tsr, NULL))
375 {
376 this->mode = MODE_TUNNEL;
377 DBG1(DBG_IKE, "not using BEET mode, not host-to-host");
378 }
379 break;
380 default:
381 break;
382 }
383 }
384
385 this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
386 this->child_sa->set_ipcomp(this->child_sa, this->ipcomp);
387 this->child_sa->set_mode(this->child_sa, this->mode);
388 this->child_sa->set_protocol(this->child_sa,
389 this->proposal->get_protocol(this->proposal));
390
391 if (this->my_cpi == 0 || this->other_cpi == 0 || this->ipcomp == IPCOMP_NONE)
392 {
393 this->my_cpi = this->other_cpi = 0;
394 this->ipcomp = IPCOMP_NONE;
395 }
396 status = FAILED;
397 if (this->keymat->derive_child_keys(this->keymat, this->proposal,
398 this->dh, nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
399 {
400 if (this->initiator)
401 {
402 status = this->child_sa->install(this->child_sa, encr_r, integ_r,
403 this->my_spi, this->my_cpi, TRUE);
404 status = this->child_sa->install(this->child_sa, encr_i, integ_i,
405 this->other_spi, this->other_cpi, FALSE);
406 }
407 else
408 {
409 status = this->child_sa->install(this->child_sa, encr_i, integ_i,
410 this->my_spi, this->my_cpi, TRUE);
411 status = this->child_sa->install(this->child_sa, encr_r, integ_r,
412 this->other_spi, this->other_cpi, FALSE);
413 }
414 }
415 chunk_clear(&integ_i);
416 chunk_clear(&integ_r);
417 chunk_clear(&encr_i);
418 chunk_clear(&encr_r);
419
420 if (status != SUCCESS)
421 {
422 DBG1(DBG_IKE, "unable to install IPsec SA (SAD) in kernel");
423 return FAILED;
424 }
425
426 status = this->child_sa->add_policies(this->child_sa, my_ts, other_ts);
427 if (status != SUCCESS)
428 {
429 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
430 return NOT_FOUND;
431 }
432
433 charon->bus->child_keys(charon->bus, this->child_sa, this->dh,
434 nonce_i, nonce_r);
435
436 /* add to IKE_SA, and remove from task */
437 this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
438 this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
439 this->established = TRUE;
440 return SUCCESS;
441 }
442
443 /**
444 * build the payloads for the message
445 */
446 static void build_payloads(private_child_create_t *this, message_t *message)
447 {
448 sa_payload_t *sa_payload;
449 nonce_payload_t *nonce_payload;
450 ke_payload_t *ke_payload;
451 ts_payload_t *ts_payload;
452
453 /* add SA payload */
454 if (this->initiator)
455 {
456 sa_payload = sa_payload_create_from_proposal_list(this->proposals);
457 }
458 else
459 {
460 sa_payload = sa_payload_create_from_proposal(this->proposal);
461 }
462 message->add_payload(message, (payload_t*)sa_payload);
463
464 /* add nonce payload if not in IKE_AUTH */
465 if (message->get_exchange_type(message) == CREATE_CHILD_SA)
466 {
467 nonce_payload = nonce_payload_create();
468 nonce_payload->set_nonce(nonce_payload, this->my_nonce);
469 message->add_payload(message, (payload_t*)nonce_payload);
470 }
471
472 /* diffie hellman exchange, if PFS enabled */
473 if (this->dh)
474 {
475 ke_payload = ke_payload_create_from_diffie_hellman(this->dh);
476 message->add_payload(message, (payload_t*)ke_payload);
477 }
478
479 /* add TSi/TSr payloads */
480 ts_payload = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
481 message->add_payload(message, (payload_t*)ts_payload);
482 ts_payload = ts_payload_create_from_traffic_selectors(FALSE, this->tsr);
483 message->add_payload(message, (payload_t*)ts_payload);
484
485 /* add a notify if we are not in tunnel mode */
486 switch (this->mode)
487 {
488 case MODE_TRANSPORT:
489 message->add_notify(message, FALSE, USE_TRANSPORT_MODE, chunk_empty);
490 break;
491 case MODE_BEET:
492 message->add_notify(message, FALSE, USE_BEET_MODE, chunk_empty);
493 break;
494 default:
495 break;
496 }
497 }
498
499 /**
500 * Adds an IPCOMP_SUPPORTED notify to the message, allocating a CPI
501 */
502 static void add_ipcomp_notify(private_child_create_t *this,
503 message_t *message, u_int8_t ipcomp)
504 {
505 if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
506 {
507 DBG1(DBG_IKE, "IPComp is not supported if either peer is natted, "
508 "IPComp disabled");
509 return;
510 }
511
512 this->my_cpi = this->child_sa->alloc_cpi(this->child_sa);
513 if (this->my_cpi)
514 {
515 this->ipcomp = ipcomp;
516 message->add_notify(message, FALSE, IPCOMP_SUPPORTED,
517 chunk_cata("cc", chunk_from_thing(this->my_cpi),
518 chunk_from_thing(ipcomp)));
519 }
520 else
521 {
522 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, IPComp disabled");
523 }
524 }
525
526 /**
527 * handle a received notify payload
528 */
529 static void handle_notify(private_child_create_t *this, notify_payload_t *notify)
530 {
531 switch (notify->get_notify_type(notify))
532 {
533 case USE_TRANSPORT_MODE:
534 this->mode = MODE_TRANSPORT;
535 break;
536 case USE_BEET_MODE:
537 this->mode = MODE_BEET;
538 break;
539 case IPCOMP_SUPPORTED:
540 {
541 ipcomp_transform_t ipcomp;
542 u_int16_t cpi;
543 chunk_t data;
544
545 data = notify->get_notification_data(notify);
546 cpi = *(u_int16_t*)data.ptr;
547 ipcomp = (ipcomp_transform_t)(*(data.ptr + 2));
548 switch (ipcomp)
549 {
550 case IPCOMP_DEFLATE:
551 this->other_cpi = cpi;
552 this->ipcomp_received = ipcomp;
553 break;
554 case IPCOMP_LZS:
555 case IPCOMP_LZJH:
556 default:
557 DBG1(DBG_IKE, "received IPCOMP_SUPPORTED notify with a "
558 "transform ID we don't support %N",
559 ipcomp_transform_names, ipcomp);
560 break;
561 }
562 }
563 default:
564 break;
565 }
566 }
567
568 /**
569 * Read payloads from message
570 */
571 static void process_payloads(private_child_create_t *this, message_t *message)
572 {
573 iterator_t *iterator;
574 payload_t *payload;
575 sa_payload_t *sa_payload;
576 ke_payload_t *ke_payload;
577 ts_payload_t *ts_payload;
578
579 /* defaults to TUNNEL mode */
580 this->mode = MODE_TUNNEL;
581
582 iterator = message->get_payload_iterator(message);
583 while (iterator->iterate(iterator, (void**)&payload))
584 {
585 switch (payload->get_type(payload))
586 {
587 case SECURITY_ASSOCIATION:
588 sa_payload = (sa_payload_t*)payload;
589 this->proposals = sa_payload->get_proposals(sa_payload);
590 break;
591 case KEY_EXCHANGE:
592 ke_payload = (ke_payload_t*)payload;
593 if (!this->initiator)
594 {
595 this->dh_group = ke_payload->get_dh_group_number(ke_payload);
596 this->dh = this->keymat->create_dh(this->keymat, this->dh_group);
597 }
598 if (this->dh)
599 {
600 this->dh->set_other_public_value(this->dh,
601 ke_payload->get_key_exchange_data(ke_payload));
602 }
603 break;
604 case TRAFFIC_SELECTOR_INITIATOR:
605 ts_payload = (ts_payload_t*)payload;
606 this->tsi = ts_payload->get_traffic_selectors(ts_payload);
607 break;
608 case TRAFFIC_SELECTOR_RESPONDER:
609 ts_payload = (ts_payload_t*)payload;
610 this->tsr = ts_payload->get_traffic_selectors(ts_payload);
611 break;
612 case NOTIFY:
613 handle_notify(this, (notify_payload_t*)payload);
614 break;
615 default:
616 break;
617 }
618 }
619 iterator->destroy(iterator);
620 }
621
622 /**
623 * Implementation of task_t.build for initiator
624 */
625 static status_t build_i(private_child_create_t *this, message_t *message)
626 {
627 host_t *me, *other, *vip;
628 bool propose_all = FALSE;
629 peer_cfg_t *peer_cfg;
630
631 switch (message->get_exchange_type(message))
632 {
633 case IKE_SA_INIT:
634 return get_nonce(message, &this->my_nonce);
635 case CREATE_CHILD_SA:
636 if (generate_nonce(&this->my_nonce) != SUCCESS)
637 {
638 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
639 return SUCCESS;
640 }
641 if (this->dh_group == MODP_NONE)
642 {
643 this->dh_group = this->config->get_dh_group(this->config);
644 }
645 break;
646 case IKE_AUTH:
647 if (!message->get_payload(message, ID_INITIATOR))
648 {
649 /* send only in the first request, not in subsequent EAP */
650 return NEED_MORE;
651 }
652 break;
653 default:
654 break;
655 }
656
657 if (this->reqid)
658 {
659 DBG0(DBG_IKE, "establishing CHILD_SA %s{%d}",
660 this->config->get_name(this->config), this->reqid);
661 }
662 else
663 {
664 DBG0(DBG_IKE, "establishing CHILD_SA %s",
665 this->config->get_name(this->config));
666 }
667
668 /* reuse virtual IP if we already have one */
669 me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
670 if (me == NULL)
671 {
672 me = this->ike_sa->get_my_host(this->ike_sa);
673 }
674 other = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
675 if (other == NULL)
676 {
677 other = this->ike_sa->get_other_host(this->ike_sa);
678 }
679
680 /* check if we want a virtual IP, but don't have one */
681 if (!this->reqid)
682 {
683 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
684 vip = peer_cfg->get_virtual_ip(peer_cfg);
685 if (vip)
686 {
687 propose_all = TRUE;
688 }
689 }
690
691 if (propose_all)
692 { /* propose a 0.0.0.0/0 subnet when we use virtual ip */
693 this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
694 NULL, NULL);
695 }
696 else
697 { /* but shorten a 0.0.0.0/0 subnet for host2host/we already have a vip */
698 this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
699 NULL, me);
700 }
701 this->tsr = this->config->get_traffic_selectors(this->config, FALSE,
702 NULL, other);
703
704 this->proposals = this->config->get_proposals(this->config,
705 this->dh_group == MODP_NONE);
706 this->mode = this->config->get_mode(this->config);
707
708 this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
709 this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
710 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
711
712 if (!allocate_spi(this))
713 {
714 DBG1(DBG_IKE, "unable to allocate SPIs from kernel");
715 return FAILED;
716 }
717
718 if (this->dh_group != MODP_NONE)
719 {
720 this->dh = this->keymat->create_dh(this->keymat, this->dh_group);
721 }
722
723 if (this->config->use_ipcomp(this->config))
724 {
725 /* IPCOMP_DEFLATE is the only transform we support at the moment */
726 add_ipcomp_notify(this, message, IPCOMP_DEFLATE);
727 }
728
729 build_payloads(this, message);
730
731 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
732 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
733 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
734 this->tsi = NULL;
735 this->tsr = NULL;
736 this->proposals = NULL;
737
738 return NEED_MORE;
739 }
740
741 /**
742 * Implementation of task_t.process for responder
743 */
744 static status_t process_r(private_child_create_t *this, message_t *message)
745 {
746 peer_cfg_t *peer_cfg;
747
748 switch (message->get_exchange_type(message))
749 {
750 case IKE_SA_INIT:
751 return get_nonce(message, &this->other_nonce);
752 case CREATE_CHILD_SA:
753 get_nonce(message, &this->other_nonce);
754 break;
755 case IKE_AUTH:
756 if (message->get_payload(message, ID_INITIATOR) == NULL)
757 {
758 /* wait until extensible authentication completed, if used */
759 return NEED_MORE;
760 }
761 default:
762 break;
763 }
764
765 process_payloads(this, message);
766
767 if (this->tsi == NULL || this->tsr == NULL)
768 {
769 DBG1(DBG_IKE, "TS payload missing in message");
770 return NEED_MORE;
771 }
772
773 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
774 if (peer_cfg)
775 {
776 host_t *me, *other;
777
778 me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
779 if (me == NULL)
780 {
781 me = this->ike_sa->get_my_host(this->ike_sa);
782 }
783 other = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
784 if (other == NULL)
785 {
786 other = this->ike_sa->get_other_host(this->ike_sa);
787 }
788
789 this->config = peer_cfg->select_child_cfg(peer_cfg, this->tsr,
790 this->tsi, me, other);
791 }
792 return NEED_MORE;
793 }
794
795 /**
796 * handle CHILD_SA setup failure
797 */
798 static void handle_child_sa_failure(private_child_create_t *this,
799 message_t *message)
800 {
801 if (message->get_exchange_type(message) == IKE_AUTH &&
802 lib->settings->get_bool(lib->settings,
803 "charon.close_ike_on_child_failure", FALSE))
804 {
805 /* we delay the delete for 100ms, as the IKE_AUTH response must arrive
806 * first */
807 DBG1(DBG_IKE, "closing IKE_SA due CHILD_SA setup failure");
808 charon->scheduler->schedule_job(charon->scheduler, (job_t*)
809 delete_ike_sa_job_create(this->ike_sa->get_id(this->ike_sa), TRUE),
810 100);
811 }
812 }
813
814 /**
815 * Implementation of task_t.build for responder
816 */
817 static status_t build_r(private_child_create_t *this, message_t *message)
818 {
819 payload_t *payload;
820 iterator_t *iterator;
821 bool no_dh = TRUE;
822
823 switch (message->get_exchange_type(message))
824 {
825 case IKE_SA_INIT:
826 return get_nonce(message, &this->my_nonce);
827 case CREATE_CHILD_SA:
828 if (generate_nonce(&this->my_nonce) != SUCCESS)
829 {
830 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN,
831 chunk_empty);
832 return SUCCESS;
833 }
834 no_dh = FALSE;
835 break;
836 case IKE_AUTH:
837 if (message->get_payload(message, EXTENSIBLE_AUTHENTICATION))
838 {
839 /* wait until extensible authentication completed, if used */
840 return NEED_MORE;
841 }
842 default:
843 break;
844 }
845
846 if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
847 {
848 DBG1(DBG_IKE, "unable to create CHILD_SA while rekeying IKE_SA");
849 message->add_notify(message, TRUE, NO_ADDITIONAL_SAS, chunk_empty);
850 return SUCCESS;
851 }
852
853 if (this->config == NULL)
854 {
855 DBG1(DBG_IKE, "traffic selectors %#R=== %#R inacceptable",
856 this->tsr, this->tsi);
857 message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
858 handle_child_sa_failure(this, message);
859 return SUCCESS;
860 }
861
862 /* check if ike_config_t included non-critical error notifies */
863 iterator = message->get_payload_iterator(message);
864 while (iterator->iterate(iterator, (void**)&payload))
865 {
866 if (payload->get_type(payload) == NOTIFY)
867 {
868 notify_payload_t *notify = (notify_payload_t*)payload;
869
870 switch (notify->get_notify_type(notify))
871 {
872 case INTERNAL_ADDRESS_FAILURE:
873 case FAILED_CP_REQUIRED:
874 {
875 DBG1(DBG_IKE,"configuration payload negotation "
876 "failed, no CHILD_SA built");
877 iterator->destroy(iterator);
878 handle_child_sa_failure(this, message);
879 return SUCCESS;
880 }
881 default:
882 break;
883 }
884 }
885 }
886 iterator->destroy(iterator);
887
888 this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
889 this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
890 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
891
892 if (this->ipcomp_received != IPCOMP_NONE)
893 {
894 if (this->config->use_ipcomp(this->config))
895 {
896 add_ipcomp_notify(this, message, this->ipcomp_received);
897 }
898 else
899 {
900 DBG1(DBG_IKE, "received %N notify but IPComp is disabled, ignoring",
901 notify_type_names, IPCOMP_SUPPORTED);
902 }
903 }
904
905 switch (select_and_install(this, no_dh))
906 {
907 case SUCCESS:
908 break;
909 case NOT_FOUND:
910 message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
911 handle_child_sa_failure(this, message);
912 return SUCCESS;
913 case INVALID_ARG:
914 {
915 u_int16_t group = htons(this->dh_group);
916 message->add_notify(message, FALSE, INVALID_KE_PAYLOAD,
917 chunk_from_thing(group));
918 handle_child_sa_failure(this, message);
919 return SUCCESS;
920 }
921 case FAILED:
922 default:
923 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
924 handle_child_sa_failure(this, message);
925 return SUCCESS;
926 }
927
928 build_payloads(this, message);
929
930 DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
931 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
932 this->child_sa->get_name(this->child_sa),
933 this->child_sa->get_reqid(this->child_sa),
934 ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
935 ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
936 this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
937 this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
938
939 return SUCCESS;
940 }
941
942 /**
943 * Implementation of task_t.process for initiator
944 */
945 static status_t process_i(private_child_create_t *this, message_t *message)
946 {
947 iterator_t *iterator;
948 payload_t *payload;
949 bool no_dh = TRUE;
950
951 switch (message->get_exchange_type(message))
952 {
953 case IKE_SA_INIT:
954 return get_nonce(message, &this->other_nonce);
955 case CREATE_CHILD_SA:
956 get_nonce(message, &this->other_nonce);
957 no_dh = FALSE;
958 break;
959 case IKE_AUTH:
960 if (message->get_payload(message, EXTENSIBLE_AUTHENTICATION))
961 {
962 /* wait until extensible authentication completed, if used */
963 return NEED_MORE;
964 }
965 default:
966 break;
967 }
968
969 /* check for erronous notifies */
970 iterator = message->get_payload_iterator(message);
971 while (iterator->iterate(iterator, (void**)&payload))
972 {
973 if (payload->get_type(payload) == NOTIFY)
974 {
975 notify_payload_t *notify = (notify_payload_t*)payload;
976 notify_type_t type = notify->get_notify_type(notify);
977
978 switch (type)
979 {
980 /* handle notify errors related to CHILD_SA only */
981 case NO_PROPOSAL_CHOSEN:
982 case SINGLE_PAIR_REQUIRED:
983 case NO_ADDITIONAL_SAS:
984 case INTERNAL_ADDRESS_FAILURE:
985 case FAILED_CP_REQUIRED:
986 case TS_UNACCEPTABLE:
987 case INVALID_SELECTORS:
988 {
989 DBG1(DBG_IKE, "received %N notify, no CHILD_SA built",
990 notify_type_names, type);
991 iterator->destroy(iterator);
992 handle_child_sa_failure(this, message);
993 /* an error in CHILD_SA creation is not critical */
994 return SUCCESS;
995 }
996 case INVALID_KE_PAYLOAD:
997 {
998 chunk_t data;
999 diffie_hellman_group_t bad_group;
1000
1001 bad_group = this->dh_group;
1002 data = notify->get_notification_data(notify);
1003 this->dh_group = ntohs(*((u_int16_t*)data.ptr));
1004 DBG1(DBG_IKE, "peer didn't accept DH group %N, "
1005 "it requested %N", diffie_hellman_group_names,
1006 bad_group, diffie_hellman_group_names, this->dh_group);
1007
1008 this->public.task.migrate(&this->public.task, this->ike_sa);
1009 iterator->destroy(iterator);
1010 return NEED_MORE;
1011 }
1012 default:
1013 break;
1014 }
1015 }
1016 }
1017 iterator->destroy(iterator);
1018
1019 process_payloads(this, message);
1020
1021 if (this->ipcomp == IPCOMP_NONE && this->ipcomp_received != IPCOMP_NONE)
1022 {
1023 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify without requesting"
1024 " one, no CHILD_SA built");
1025 handle_child_sa_failure(this, message);
1026 return SUCCESS;
1027 }
1028 else if (this->ipcomp != IPCOMP_NONE && this->ipcomp_received == IPCOMP_NONE)
1029 {
1030 DBG1(DBG_IKE, "peer didn't accept our proposed IPComp transforms, "
1031 "IPComp is disabled");
1032 this->ipcomp = IPCOMP_NONE;
1033 }
1034 else if (this->ipcomp != IPCOMP_NONE && this->ipcomp != this->ipcomp_received)
1035 {
1036 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify we didn't propose, "
1037 "no CHILD_SA built");
1038 handle_child_sa_failure(this, message);
1039 return SUCCESS;
1040 }
1041
1042 if (select_and_install(this, no_dh) == SUCCESS)
1043 {
1044 DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
1045 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
1046 this->child_sa->get_name(this->child_sa),
1047 this->child_sa->get_reqid(this->child_sa),
1048 ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
1049 ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
1050 this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
1051 this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
1052 }
1053 else
1054 {
1055 handle_child_sa_failure(this, message);
1056 }
1057 return SUCCESS;
1058 }
1059
1060 /**
1061 * Implementation of task_t.get_type
1062 */
1063 static task_type_t get_type(private_child_create_t *this)
1064 {
1065 return CHILD_CREATE;
1066 }
1067
1068 /**
1069 * Implementation of child_create_t.use_reqid
1070 */
1071 static void use_reqid(private_child_create_t *this, u_int32_t reqid)
1072 {
1073 this->reqid = reqid;
1074 }
1075
1076 /**
1077 * Implementation of child_create_t.get_child
1078 */
1079 static child_sa_t* get_child(private_child_create_t *this)
1080 {
1081 return this->child_sa;
1082 }
1083
1084 /**
1085 * Implementation of child_create_t.get_lower_nonce
1086 */
1087 static chunk_t get_lower_nonce(private_child_create_t *this)
1088 {
1089 if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
1090 min(this->my_nonce.len, this->other_nonce.len)) < 0)
1091 {
1092 return this->my_nonce;
1093 }
1094 else
1095 {
1096 return this->other_nonce;
1097 }
1098 }
1099
1100 /**
1101 * Implementation of task_t.migrate
1102 */
1103 static void migrate(private_child_create_t *this, ike_sa_t *ike_sa)
1104 {
1105 chunk_free(&this->my_nonce);
1106 chunk_free(&this->other_nonce);
1107 if (this->tsi)
1108 {
1109 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1110 }
1111 if (this->tsr)
1112 {
1113 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1114 }
1115 DESTROY_IF(this->child_sa);
1116 DESTROY_IF(this->proposal);
1117 DESTROY_IF(this->dh);
1118 if (this->proposals)
1119 {
1120 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1121 }
1122
1123 this->ike_sa = ike_sa;
1124 this->keymat = ike_sa->get_keymat(ike_sa);
1125 this->proposal = NULL;
1126 this->proposals = NULL;
1127 this->tsi = NULL;
1128 this->tsr = NULL;
1129 this->dh = NULL;
1130 this->child_sa = NULL;
1131 this->mode = MODE_TUNNEL;
1132 this->ipcomp = IPCOMP_NONE;
1133 this->ipcomp_received = IPCOMP_NONE;
1134 this->other_cpi = 0;
1135 this->reqid = 0;
1136 this->established = FALSE;
1137 }
1138
1139 /**
1140 * Implementation of task_t.destroy
1141 */
1142 static void destroy(private_child_create_t *this)
1143 {
1144 chunk_free(&this->my_nonce);
1145 chunk_free(&this->other_nonce);
1146 if (this->tsi)
1147 {
1148 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1149 }
1150 if (this->tsr)
1151 {
1152 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1153 }
1154 if (!this->established)
1155 {
1156 DESTROY_IF(this->child_sa);
1157 }
1158 DESTROY_IF(this->proposal);
1159 DESTROY_IF(this->dh);
1160 if (this->proposals)
1161 {
1162 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1163 }
1164
1165 DESTROY_IF(this->config);
1166 free(this);
1167 }
1168
1169 /*
1170 * Described in header.
1171 */
1172 child_create_t *child_create_create(ike_sa_t *ike_sa, child_cfg_t *config)
1173 {
1174 private_child_create_t *this = malloc_thing(private_child_create_t);
1175
1176 this->public.get_child = (child_sa_t*(*)(child_create_t*))get_child;
1177 this->public.get_lower_nonce = (chunk_t(*)(child_create_t*))get_lower_nonce;
1178 this->public.use_reqid = (void(*)(child_create_t*,u_int32_t))use_reqid;
1179 this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
1180 this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
1181 this->public.task.destroy = (void(*)(task_t*))destroy;
1182 if (config)
1183 {
1184 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
1185 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
1186 this->initiator = TRUE;
1187 config->get_ref(config);
1188 }
1189 else
1190 {
1191 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
1192 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
1193 this->initiator = FALSE;
1194 }
1195
1196 this->ike_sa = ike_sa;
1197 this->config = config;
1198 this->my_nonce = chunk_empty;
1199 this->other_nonce = chunk_empty;
1200 this->proposals = NULL;
1201 this->proposal = NULL;
1202 this->tsi = NULL;
1203 this->tsr = NULL;
1204 this->dh = NULL;
1205 this->dh_group = MODP_NONE;
1206 this->keymat = ike_sa->get_keymat(ike_sa);
1207 this->child_sa = NULL;
1208 this->mode = MODE_TUNNEL;
1209 this->ipcomp = IPCOMP_NONE;
1210 this->ipcomp_received = IPCOMP_NONE;
1211 this->my_spi = 0;
1212 this->other_spi = 0;
1213 this->my_cpi = 0;
1214 this->other_cpi = 0;
1215 this->reqid = 0;
1216 this->established = FALSE;
1217
1218 return &this->public;
1219 }