src/libcharon/sa/ikev1/tasks/main_mode.c

   1 /*
   2  * Copyright (C) 2011 Tobias Brunner
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * Copyright (C) 2011 Martin Willi
   6  * Copyright (C) 2011 revosec AG
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 #include "main_mode.h"
  20
  21 #include <string.h>
  22
  23 #include <daemon.h>
  24 #include <sa/ikev1/phase1.h>
  25 #include <encoding/payloads/sa_payload.h>
  26 #include <encoding/payloads/id_payload.h>
  27 #include <encoding/payloads/hash_payload.h>
  28 #include <sa/ikev1/tasks/xauth.h>
  29 #include <sa/ikev1/tasks/mode_config.h>
  30 #include <sa/ikev1/tasks/informational.h>
  31 #include <sa/ikev1/tasks/isakmp_delete.h>
  32 #include <processing/jobs/adopt_children_job.h>
  33
  34 typedef struct private_main_mode_t private_main_mode_t;
  35
  36 /**
  37  * Private members of a main_mode_t task.
  38  */
  39 struct private_main_mode_t {
  40
  41         /**
  42          * Public methods and task_t interface.
  43          */
  44         main_mode_t public;
  45
  46         /**
  47          * Assigned IKE_SA.
  48          */
  49         ike_sa_t *ike_sa;
  50
  51         /**
  52          * Are we the initiator?
  53          */
  54         bool initiator;
  55
  56         /**
  57          * Common phase 1 helper class
  58          */
  59         phase1_t *ph1;
  60
  61         /**
  62          * IKE config to establish
  63          */
  64         ike_cfg_t *ike_cfg;
  65
  66         /**
  67          * Peer config to use
  68          */
  69         peer_cfg_t *peer_cfg;
  70
  71         /**
  72          * selected IKE proposal
  73          */
  74         proposal_t *proposal;
  75
  76         /**
  77          * Negotiated SA lifetime
  78          */
  79         u_int32_t lifetime;
  80
  81         /**
  82          * Negotiated authentication method
  83          */
  84         auth_method_t method;
  85
  86         /** states of main mode */
  87         enum {
  88                 MM_INIT,
  89                 MM_SA,
  90                 MM_KE,
  91                 MM_AUTH,
  92         } state;
  93 };
  94
  95 /**
  96  * Set IKE_SA to established state
  97  */
  98 static bool establish(private_main_mode_t *this)
  99 {
 100         if (!charon->bus->authorize(charon->bus, TRUE))
 101         {
 102                 DBG1(DBG_IKE, "final authorization hook forbids IKE_SA, cancelling");
 103                 return FALSE;
 104         }
 105
 106         DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
 107                  this->ike_sa->get_name(this->ike_sa),
 108                  this->ike_sa->get_unique_id(this->ike_sa),
 109                  this->ike_sa->get_my_host(this->ike_sa),
 110                  this->ike_sa->get_my_id(this->ike_sa),
 111                  this->ike_sa->get_other_host(this->ike_sa),
 112                  this->ike_sa->get_other_id(this->ike_sa));
 113
 114         this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
 115         charon->bus->ike_updown(charon->bus, this->ike_sa, TRUE);
 116
 117         return TRUE;
 118 }
 119
 120 /**
 121  * Check for notify errors, return TRUE if error found
 122  */
 123 static bool has_notify_errors(private_main_mode_t *this, message_t *message)
 124 {
 125         enumerator_t *enumerator;
 126         payload_t *payload;
 127         bool err = FALSE;
 128
 129         enumerator = message->create_payload_enumerator(message);
 130         while (enumerator->enumerate(enumerator, &payload))
 131         {
 132                 if (payload->get_type(payload) == NOTIFY_V1)
 133                 {
 134                         notify_payload_t *notify;
 135                         notify_type_t type;
 136
 137                         notify = (notify_payload_t*)payload;
 138                         type = notify->get_notify_type(notify);
 139                         if (type < 16384)
 140                         {
 141                                 DBG1(DBG_IKE, "received %N error notify",
 142                                          notify_type_names, type);
 143                                 err = TRUE;
 144                         }
 145                         else if (type == INITIAL_CONTACT_IKEV1)
 146                         {
 147                                 if (!this->initiator && this->state == MM_AUTH)
 148                                 {
 149                                         /* If authenticated and received INITIAL_CONTACT,
 150                                          * delete any existing IKE_SAs with that peer.
 151                                          * The delete takes place when the SA is checked in due
 152                                          * to other id not known until the 3rd message.*/
 153                                         this->ike_sa->set_condition(this->ike_sa,
 154                                                                                                 COND_INIT_CONTACT_SEEN, TRUE);
 155                                 }
 156                         }
 157                         else
 158                         {
 159                                 DBG1(DBG_IKE, "received %N notify", notify_type_names, type);
 160                         }
 161                 }
 162         }
 163         enumerator->destroy(enumerator);
 164
 165         return err;
 166 }
 167
 168 /**
 169  * Queue a task sending a notify in an INFORMATIONAL exchange
 170  */
 171 static status_t send_notify(private_main_mode_t *this, notify_type_t type)
 172 {
 173         notify_payload_t *notify;
 174         ike_sa_id_t *ike_sa_id;
 175         u_int64_t spi_i, spi_r;
 176         chunk_t spi;
 177
 178         notify = notify_payload_create_from_protocol_and_type(NOTIFY_V1,
 179                                                                                                                   PROTO_IKE, type);
 180         ike_sa_id = this->ike_sa->get_id(this->ike_sa);
 181         spi_i = ike_sa_id->get_initiator_spi(ike_sa_id);
 182         spi_r = ike_sa_id->get_responder_spi(ike_sa_id);
 183         spi = chunk_cata("cc", chunk_from_thing(spi_i), chunk_from_thing(spi_r));
 184         notify->set_spi_data(notify, spi);
 185
 186         this->ike_sa->queue_task(this->ike_sa,
 187                                                 (task_t*)informational_create(this->ike_sa, notify));
 188         /* cancel all active/passive tasks in favour of informational */
 189         this->ike_sa->flush_queue(this->ike_sa,
 190                                         this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
 191         return ALREADY_DONE;
 192 }
 193
 194 /**
 195  * Queue a delete task if authentication failed as initiator
 196  */
 197 static status_t send_delete(private_main_mode_t *this)
 198 {
 199         this->ike_sa->queue_task(this->ike_sa,
 200                                                 (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
 201         /* cancel all active tasks in favour of informational */
 202         this->ike_sa->flush_queue(this->ike_sa,
 203                                         this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
 204         return ALREADY_DONE;
 205 }
 206
 207 METHOD(task_t, build_i, status_t,
 208         private_main_mode_t *this, message_t *message)
 209 {
 210         switch (this->state)
 211         {
 212                 case MM_INIT:
 213                 {
 214                         sa_payload_t *sa_payload;
 215                         linked_list_t *proposals;
 216                         packet_t *packet;
 217
 218                         DBG0(DBG_IKE, "initiating Main Mode IKE_SA %s[%d] to %H",
 219                                  this->ike_sa->get_name(this->ike_sa),
 220                                  this->ike_sa->get_unique_id(this->ike_sa),
 221                                  this->ike_sa->get_other_host(this->ike_sa));
 222                         this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 223
 224                         this->ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 225                         this->peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 226                         this->peer_cfg->get_ref(this->peer_cfg);
 227
 228                         this->method = this->ph1->get_auth_method(this->ph1, this->peer_cfg);
 229                         if (this->method == AUTH_NONE)
 230                         {
 231                                 DBG1(DBG_CFG, "configuration uses unsupported authentication");
 232                                 return FAILED;
 233                         }
 234                         this->lifetime = this->peer_cfg->get_reauth_time(this->peer_cfg,
 235                                                                                                                          FALSE);
 236                         if (!this->lifetime)
 237                         {       /* fall back to rekey time of no rekey time configured */
 238                                 this->lifetime = this->peer_cfg->get_rekey_time(this->peer_cfg,
 239                                                                                                                                  FALSE);
 240                         }
 241                         this->lifetime += this->peer_cfg->get_over_time(this->peer_cfg);
 242                         proposals = this->ike_cfg->get_proposals(this->ike_cfg);
 243                         sa_payload = sa_payload_create_from_proposals_v1(proposals,
 244                                                         this->lifetime, 0, this->method, MODE_NONE, FALSE);
 245                         proposals->destroy_offset(proposals, offsetof(proposal_t, destroy));
 246
 247                         message->add_payload(message, &sa_payload->payload_interface);
 248
 249                         /* pregenerate message to store SA payload */
 250                         if (this->ike_sa->generate_message(this->ike_sa, message,
 251                                                                                            &packet) != SUCCESS)
 252                         {
 253                                 DBG1(DBG_IKE, "pregenerating SA payload failed");
 254                                 return FAILED;
 255                         }
 256                         packet->destroy(packet);
 257                         if (!this->ph1->save_sa_payload(this->ph1, message))
 258                         {
 259                                 return FAILED;
 260                         }
 261
 262                         this->state = MM_SA;
 263                         return NEED_MORE;
 264                 }
 265                 case MM_SA:
 266                 {
 267                         u_int16_t group;
 268
 269                         if (!this->ph1->create_hasher(this->ph1))
 270                         {
 271                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
 272                         }
 273                         if (!this->proposal->get_algorithm(this->proposal,
 274                                                                                 DIFFIE_HELLMAN_GROUP, &group, NULL))
 275                         {
 276                                 DBG1(DBG_IKE, "DH group selection failed");
 277                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
 278                         }
 279                         if (!this->ph1->create_dh(this->ph1, group))
 280                         {
 281                                 DBG1(DBG_IKE, "negotiated DH group not supported");
 282                                 return send_notify(this, INVALID_KEY_INFORMATION);
 283                         }
 284                         if (!this->ph1->add_nonce_ke(this->ph1, message))
 285                         {
 286                                 return send_notify(this, INVALID_KEY_INFORMATION);
 287                         }
 288                         this->state = MM_KE;
 289                         return NEED_MORE;
 290                 }
 291                 case MM_KE:
 292                 {
 293                         id_payload_t *id_payload;
 294                         identification_t *id;
 295
 296                         id = this->ph1->get_id(this->ph1, this->peer_cfg, TRUE);
 297                         if (!id)
 298                         {
 299                                 DBG1(DBG_CFG, "own identity not known");
 300                                 return send_notify(this, INVALID_ID_INFORMATION);
 301                         }
 302                         this->ike_sa->set_my_id(this->ike_sa, id->clone(id));
 303                         id_payload = id_payload_create_from_identification(ID_V1, id);
 304                         message->add_payload(message, &id_payload->payload_interface);
 305
 306                         if (!this->ph1->build_auth(this->ph1, this->method, message,
 307                                                                            id_payload->get_encoded(id_payload)))
 308                         {
 309                                 return send_notify(this, AUTHENTICATION_FAILED);
 310                         }
 311
 312                         this->state = MM_AUTH;
 313                         return NEED_MORE;
 314                 }
 315                 default:
 316                         return FAILED;
 317         }
 318 }
 319
 320 METHOD(task_t, process_r, status_t,
 321         private_main_mode_t *this, message_t *message)
 322 {
 323         switch (this->state)
 324         {
 325                 case MM_INIT:
 326                 {
 327                         linked_list_t *list;
 328                         sa_payload_t *sa_payload;
 329                         bool private;
 330
 331                         this->ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 332                         DBG0(DBG_IKE, "%H is initiating a Main Mode IKE_SA",
 333                                  message->get_source(message));
 334                         this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 335
 336                         this->ike_sa->update_hosts(this->ike_sa,
 337                                                                            message->get_destination(message),
 338                                                                            message->get_source(message), TRUE);
 339
 340                         sa_payload = (sa_payload_t*)message->get_payload(message,
 341                                                                                                         SECURITY_ASSOCIATION_V1);
 342                         if (!sa_payload)
 343                         {
 344                                 DBG1(DBG_IKE, "SA payload missing");
 345                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 346                         }
 347                         if (!this->ph1->save_sa_payload(this->ph1, message))
 348                         {
 349                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 350                         }
 351
 352                         list = sa_payload->get_proposals(sa_payload);
 353                         private = this->ike_sa->supports_extension(this->ike_sa,
 354                                                                                                                    EXT_STRONGSWAN);
 355                         this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
 356                                                                                                                         list, private);
 357                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 358                         if (!this->proposal)
 359                         {
 360                                 DBG1(DBG_IKE, "no proposal found");
 361                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
 362                         }
 363                         this->ike_sa->set_proposal(this->ike_sa, this->proposal);
 364
 365                         this->method = sa_payload->get_auth_method(sa_payload);
 366                         this->lifetime = sa_payload->get_lifetime(sa_payload);
 367
 368                         this->state = MM_SA;
 369                         return NEED_MORE;
 370                 }
 371                 case MM_SA:
 372                 {
 373                         u_int16_t group;
 374
 375                         if (!this->ph1->create_hasher(this->ph1))
 376                         {
 377                                 return send_notify(this, INVALID_KEY_INFORMATION);
 378                         }
 379                         if (!this->proposal->get_algorithm(this->proposal,
 380                                                                                 DIFFIE_HELLMAN_GROUP, &group, NULL))
 381                         {
 382                                 DBG1(DBG_IKE, "DH group selection failed");
 383                                 return send_notify(this, INVALID_KEY_INFORMATION);
 384                         }
 385                         if (!this->ph1->create_dh(this->ph1, group))
 386                         {
 387                                 DBG1(DBG_IKE, "negotiated DH group not supported");
 388                                 return send_notify(this, INVALID_KEY_INFORMATION);
 389                         }
 390                         if (!this->ph1->get_nonce_ke(this->ph1, message))
 391                         {
 392                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 393                         }
 394                         this->state = MM_KE;
 395                         return NEED_MORE;
 396                 }
 397                 case MM_KE:
 398                 {
 399                         id_payload_t *id_payload;
 400                         identification_t *id;
 401
 402                         id_payload = (id_payload_t*)message->get_payload(message, ID_V1);
 403                         if (!id_payload)
 404                         {
 405                                 DBG1(DBG_IKE, "IDii payload missing");
 406                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 407                         }
 408
 409                         id = id_payload->get_identification(id_payload);
 410                         this->ike_sa->set_other_id(this->ike_sa, id);
 411                         this->peer_cfg = this->ph1->select_config(this->ph1,
 412                                                                                                           this->method, FALSE, id);
 413                         if (!this->peer_cfg)
 414                         {
 415                                 DBG1(DBG_IKE, "no peer config found");
 416                                 return send_notify(this, AUTHENTICATION_FAILED);
 417                         }
 418                         this->ike_sa->set_peer_cfg(this->ike_sa, this->peer_cfg);
 419
 420                         if (!this->ph1->verify_auth(this->ph1, this->method, message,
 421                                                                                 id_payload->get_encoded(id_payload)))
 422                         {
 423                                 return send_notify(this, AUTHENTICATION_FAILED);
 424                         }
 425                         if (!charon->bus->authorize(charon->bus, FALSE))
 426                         {
 427                                 DBG1(DBG_IKE, "Main Mode authorization hook forbids IKE_SA, "
 428                                          "cancelling");
 429                                 return send_notify(this, AUTHENTICATION_FAILED);
 430                         }
 431
 432                         this->state = MM_AUTH;
 433                         if (has_notify_errors(this, message))
 434                         {
 435                                 return FAILED;
 436                         }
 437                         return NEED_MORE;
 438                 }
 439                 default:
 440                         return FAILED;
 441         }
 442 }
 443
 444 METHOD(task_t, build_r, status_t,
 445         private_main_mode_t *this, message_t *message)
 446 {
 447         switch (this->state)
 448         {
 449                 case MM_SA:
 450                 {
 451                         sa_payload_t *sa_payload;
 452
 453                         sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
 454                                                         this->lifetime, 0, this->method, MODE_NONE, FALSE);
 455                         message->add_payload(message, &sa_payload->payload_interface);
 456
 457                         return NEED_MORE;
 458                 }
 459                 case MM_KE:
 460                 {
 461                         if (!this->ph1->add_nonce_ke(this->ph1, message))
 462                         {
 463                                 return send_notify(this, INVALID_KEY_INFORMATION);
 464                         }
 465                         if (!this->ph1->derive_keys(this->ph1, this->peer_cfg, this->method))
 466                         {
 467                                 return send_notify(this, INVALID_KEY_INFORMATION);
 468                         }
 469                         return NEED_MORE;
 470                 }
 471                 case MM_AUTH:
 472                 {
 473                         id_payload_t *id_payload;
 474                         identification_t *id;
 475
 476                         id = this->ph1->get_id(this->ph1, this->peer_cfg, TRUE);
 477                         if (!id)
 478                         {
 479                                 DBG1(DBG_CFG, "own identity not known");
 480                                 return send_notify(this, INVALID_ID_INFORMATION);
 481                         }
 482                         this->ike_sa->set_my_id(this->ike_sa, id->clone(id));
 483
 484                         id_payload = id_payload_create_from_identification(ID_V1, id);
 485                         message->add_payload(message, &id_payload->payload_interface);
 486
 487                         if (!this->ph1->build_auth(this->ph1, this->method, message,
 488                                                                            id_payload->get_encoded(id_payload)))
 489                         {
 490                                 return send_notify(this, AUTHENTICATION_FAILED);
 491                         }
 492
 493                         switch (this->method)
 494                         {
 495                                 case AUTH_XAUTH_INIT_PSK:
 496                                 case AUTH_XAUTH_INIT_RSA:
 497                                 case AUTH_HYBRID_INIT_RSA:
 498                                         this->ike_sa->queue_task(this->ike_sa,
 499                                                                         (task_t*)xauth_create(this->ike_sa, TRUE));
 500                                         return SUCCESS;
 501                                 case AUTH_XAUTH_RESP_PSK:
 502                                 case AUTH_XAUTH_RESP_RSA:
 503                                 case AUTH_HYBRID_RESP_RSA:
 504                                         /* TODO-IKEv1: not yet supported */
 505                                         return FAILED;
 506                                 default:
 507                                         if (!establish(this))
 508                                         {
 509                                                 return send_notify(this, AUTHENTICATION_FAILED);
 510                                         }
 511                                         lib->processor->queue_job(lib->processor, (job_t*)
 512                                                                         adopt_children_job_create(
 513                                                                                 this->ike_sa->get_id(this->ike_sa)));
 514                                         return SUCCESS;
 515                         }
 516                 }
 517                 default:
 518                         return FAILED;
 519         }
 520 }
 521
 522 METHOD(task_t, process_i, status_t,
 523         private_main_mode_t *this, message_t *message)
 524 {
 525         switch (this->state)
 526         {
 527                 case MM_SA:
 528                 {
 529                         linked_list_t *list;
 530                         sa_payload_t *sa_payload;
 531                         auth_method_t method;
 532                         u_int32_t lifetime;
 533                         bool private;
 534
 535                         sa_payload = (sa_payload_t*)message->get_payload(message,
 536                                                                                                         SECURITY_ASSOCIATION_V1);
 537                         if (!sa_payload)
 538                         {
 539                                 DBG1(DBG_IKE, "SA payload missing");
 540                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 541                         }
 542                         list = sa_payload->get_proposals(sa_payload);
 543                         private = this->ike_sa->supports_extension(this->ike_sa,
 544                                                                                                                    EXT_STRONGSWAN);
 545                         this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
 546                                                                                                                         list, private);
 547                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 548                         if (!this->proposal)
 549                         {
 550                                 DBG1(DBG_IKE, "no proposal found");
 551                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
 552                         }
 553                         this->ike_sa->set_proposal(this->ike_sa, this->proposal);
 554
 555                         lifetime = sa_payload->get_lifetime(sa_payload);
 556                         if (lifetime != this->lifetime)
 557                         {
 558                                 DBG1(DBG_IKE, "received lifetime %us does not match configured "
 559                                          "lifetime %us", lifetime, this->lifetime);
 560                         }
 561                         this->lifetime = lifetime;
 562                         method = sa_payload->get_auth_method(sa_payload);
 563                         if (method != this->method)
 564                         {
 565                                 DBG1(DBG_IKE, "received %N authentication, but configured %N, "
 566                                          "continue with configured", auth_method_names, method,
 567                                          auth_method_names, this->method);
 568                         }
 569                         return NEED_MORE;
 570                 }
 571                 case MM_KE:
 572                 {
 573                         if (!this->ph1->get_nonce_ke(this->ph1, message))
 574                         {
 575                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 576                         }
 577                         if (!this->ph1->derive_keys(this->ph1, this->peer_cfg, this->method))
 578                         {
 579                                 return send_notify(this, INVALID_KEY_INFORMATION);
 580                         }
 581                         return NEED_MORE;
 582                 }
 583                 case MM_AUTH:
 584                 {
 585                         id_payload_t *id_payload;
 586                         identification_t *id, *cid;
 587
 588                         id_payload = (id_payload_t*)message->get_payload(message, ID_V1);
 589                         if (!id_payload)
 590                         {
 591                                 DBG1(DBG_IKE, "IDir payload missing");
 592                                 return send_delete(this);
 593                         }
 594                         id = id_payload->get_identification(id_payload);
 595                         cid = this->ph1->get_id(this->ph1, this->peer_cfg, FALSE);
 596                         if (cid && !id->matches(id, cid))
 597                         {
 598                                 DBG1(DBG_IKE, "IDir '%Y' does not match to '%Y'", id, cid);
 599                                 id->destroy(id);
 600                                 return send_delete(this);
 601                         }
 602                         this->ike_sa->set_other_id(this->ike_sa, id);
 603
 604                         if (!this->ph1->verify_auth(this->ph1, this->method, message,
 605                                                                                 id_payload->get_encoded(id_payload)))
 606                         {
 607                                 return send_delete(this);
 608                         }
 609                         if (!charon->bus->authorize(charon->bus, FALSE))
 610                         {
 611                                 DBG1(DBG_IKE, "Main Mode authorization hook forbids IKE_SA, "
 612                                          "cancelling");
 613                                 return send_delete(this);
 614                         }
 615                         switch (this->method)
 616                         {
 617                                 case AUTH_XAUTH_INIT_PSK:
 618                                 case AUTH_XAUTH_INIT_RSA:
 619                                 case AUTH_HYBRID_INIT_RSA:
 620                                         /* wait for XAUTH request */
 621                                         break;
 622                                 case AUTH_XAUTH_RESP_PSK:
 623                                 case AUTH_XAUTH_RESP_RSA:
 624                                 case AUTH_HYBRID_RESP_RSA:
 625                                         /* TODO-IKEv1: not yet */
 626                                         return FAILED;
 627                                 default:
 628                                         if (!establish(this))
 629                                         {
 630                                                 return send_delete(this);
 631                                         }
 632                                         break;
 633                         }
 634                         if (this->peer_cfg->get_virtual_ip(this->peer_cfg))
 635                         {
 636                                 this->ike_sa->queue_task(this->ike_sa,
 637                                                         (task_t*)mode_config_create(this->ike_sa, TRUE));
 638                         }
 639                         return SUCCESS;
 640                 }
 641                 default:
 642                         return FAILED;
 643         }
 644 }
 645
 646 METHOD(task_t, get_type, task_type_t,
 647         private_main_mode_t *this)
 648 {
 649         return TASK_MAIN_MODE;
 650 }
 651
 652 METHOD(task_t, migrate, void,
 653         private_main_mode_t *this, ike_sa_t *ike_sa)
 654 {
 655         DESTROY_IF(this->peer_cfg);
 656         DESTROY_IF(this->proposal);
 657         this->ph1->destroy(this->ph1);
 658
 659         this->ike_sa = ike_sa;
 660         this->state = MM_INIT;
 661         this->peer_cfg = NULL;
 662         this->proposal = NULL;
 663         this->ph1 = phase1_create(ike_sa, this->initiator);
 664 }
 665
 666 METHOD(task_t, destroy, void,
 667         private_main_mode_t *this)
 668 {
 669         DESTROY_IF(this->peer_cfg);
 670         DESTROY_IF(this->proposal);
 671         this->ph1->destroy(this->ph1);
 672         free(this);
 673 }
 674
 675 /*
 676  * Described in header.
 677  */
 678 main_mode_t *main_mode_create(ike_sa_t *ike_sa, bool initiator)
 679 {
 680         private_main_mode_t *this;
 681
 682         INIT(this,
 683                 .public = {
 684                         .task = {
 685                                 .get_type = _get_type,
 686                                 .migrate = _migrate,
 687                                 .destroy = _destroy,
 688                         },
 689                 },
 690                 .ike_sa = ike_sa,
 691                 .ph1 = phase1_create(ike_sa, initiator),
 692                 .initiator = initiator,
 693                 .state = MM_INIT,
 694         );
 695
 696         if (initiator)
 697         {
 698                 this->public.task.build = _build_i;
 699                 this->public.task.process = _process_i;
 700         }
 701         else
 702         {
 703                 this->public.task.build = _build_r;
 704                 this->public.task.process = _process_r;
 705         }
 706
 707         return &this->public;
 708 }