0c842c59c23a347da40be39dab4a0d383a2e61de
[strongswan.git] / src / libcharon / sa / ikev1 / tasks / quick_mode.c
1 /*
2 * Copyright (C) 2012-2015 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
4 *
5 * Copyright (C) 2011 Martin Willi
6 * Copyright (C) 2011 revosec AG
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 /*
20 * Copyright (C) 2012 Volker RĂ¼melin
21 *
22 * Permission is hereby granted, free of charge, to any person obtaining a copy
23 * of this software and associated documentation files (the "Software"), to deal
24 * in the Software without restriction, including without limitation the rights
25 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
26 * copies of the Software, and to permit persons to whom the Software is
27 * furnished to do so, subject to the following conditions:
28 *
29 * The above copyright notice and this permission notice shall be included in
30 * all copies or substantial portions of the Software.
31 *
32 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
33 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
34 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
35 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
36 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
37 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
38 * THE SOFTWARE.
39 */
40
41 #include "quick_mode.h"
42
43 #include <string.h>
44
45 #include <daemon.h>
46 #include <sa/ikev1/keymat_v1.h>
47 #include <encoding/payloads/sa_payload.h>
48 #include <encoding/payloads/nonce_payload.h>
49 #include <encoding/payloads/ke_payload.h>
50 #include <encoding/payloads/id_payload.h>
51 #include <encoding/payloads/payload.h>
52 #include <sa/ikev1/tasks/informational.h>
53 #include <sa/ikev1/tasks/quick_delete.h>
54 #include <processing/jobs/inactivity_job.h>
55
56 typedef struct private_quick_mode_t private_quick_mode_t;
57
58 /**
59 * Private members of a quick_mode_t task.
60 */
61 struct private_quick_mode_t {
62
63 /**
64 * Public methods and task_t interface.
65 */
66 quick_mode_t public;
67
68 /**
69 * Assigned IKE_SA.
70 */
71 ike_sa_t *ike_sa;
72
73 /**
74 * TRUE if we are initiating quick mode
75 */
76 bool initiator;
77
78 /**
79 * Traffic selector of initiator
80 */
81 traffic_selector_t *tsi;
82
83 /**
84 * Traffic selector of responder
85 */
86 traffic_selector_t *tsr;
87
88 /**
89 * Initiators nonce
90 */
91 chunk_t nonce_i;
92
93 /**
94 * Responder nonce
95 */
96 chunk_t nonce_r;
97
98 /**
99 * Initiators ESP SPI
100 */
101 uint32_t spi_i;
102
103 /**
104 * Responder ESP SPI
105 */
106 uint32_t spi_r;
107
108 /**
109 * Initiators IPComp CPI
110 */
111 uint16_t cpi_i;
112
113 /**
114 * Responders IPComp CPI
115 */
116 uint16_t cpi_r;
117
118 /**
119 * selected CHILD_SA proposal
120 */
121 proposal_t *proposal;
122
123 /**
124 * Config of CHILD_SA to establish
125 */
126 child_cfg_t *config;
127
128 /**
129 * CHILD_SA we are about to establish
130 */
131 child_sa_t *child_sa;
132
133 /**
134 * IKEv1 keymat
135 */
136 keymat_v1_t *keymat;
137
138 /**
139 * DH exchange, when PFS is in use
140 */
141 diffie_hellman_t *dh;
142
143 /**
144 * Negotiated lifetime of new SA
145 */
146 uint32_t lifetime;
147
148 /**
149 * Negotiated lifebytes of new SA
150 */
151 uint64_t lifebytes;
152
153 /**
154 * Reqid to use, 0 for auto-allocate
155 */
156 uint32_t reqid;
157
158 /**
159 * Explicit inbound mark value to use, if any
160 */
161 u_int mark_in;
162
163 /**
164 * Explicit inbound mark value to use, if any
165 */
166 u_int mark_out;
167
168 /**
169 * SPI of SA we rekey
170 */
171 uint32_t rekey;
172
173 /**
174 * Delete old child after successful rekey
175 */
176 bool delete;
177
178 /**
179 * Negotiated mode, tunnel or transport
180 */
181 ipsec_mode_t mode;
182
183 /*
184 * SA protocol (ESP|AH) negotiated
185 */
186 protocol_id_t proto;
187
188 /**
189 * Use UDP encapsulation
190 */
191 bool udp;
192
193 /**
194 * Message ID of handled quick mode exchange
195 */
196 uint32_t mid;
197
198 /** states of quick mode */
199 enum {
200 QM_INIT,
201 QM_NEGOTIATED,
202 } state;
203 };
204
205 /**
206 * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
207 */
208 static void schedule_inactivity_timeout(private_quick_mode_t *this)
209 {
210 uint32_t timeout;
211 bool close_ike;
212
213 timeout = this->config->get_inactivity(this->config);
214 if (timeout)
215 {
216 close_ike = lib->settings->get_bool(lib->settings,
217 "%s.inactivity_close_ike", FALSE, lib->ns);
218 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
219 inactivity_job_create(this->child_sa->get_unique_id(this->child_sa),
220 timeout, close_ike), timeout);
221 }
222 }
223
224 /**
225 * Check if we have a an address pool configured
226 */
227 static bool have_pool(ike_sa_t *ike_sa)
228 {
229 enumerator_t *enumerator;
230 peer_cfg_t *peer_cfg;
231 char *pool;
232 bool found = FALSE;
233
234 peer_cfg = ike_sa->get_peer_cfg(ike_sa);
235 if (peer_cfg)
236 {
237 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
238 if (enumerator->enumerate(enumerator, &pool))
239 {
240 found = TRUE;
241 }
242 enumerator->destroy(enumerator);
243 }
244 return found;
245 }
246
247 /**
248 * Get hosts to use for dynamic traffic selectors
249 */
250 static linked_list_t *get_dynamic_hosts(ike_sa_t *ike_sa, bool local)
251 {
252 enumerator_t *enumerator;
253 linked_list_t *list;
254 host_t *host;
255
256 list = linked_list_create();
257 enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
258 while (enumerator->enumerate(enumerator, &host))
259 {
260 list->insert_last(list, host);
261 }
262 enumerator->destroy(enumerator);
263
264 if (list->get_count(list) == 0)
265 { /* no virtual IPs assigned */
266 if (local)
267 {
268 host = ike_sa->get_my_host(ike_sa);
269 list->insert_last(list, host);
270 }
271 else if (!have_pool(ike_sa))
272 { /* use host only if we don't have a pool configured */
273 host = ike_sa->get_other_host(ike_sa);
274 list->insert_last(list, host);
275 }
276 }
277 return list;
278 }
279
280 /**
281 * Install negotiated CHILD_SA
282 */
283 static bool install(private_quick_mode_t *this)
284 {
285 status_t status, status_i, status_o;
286 chunk_t encr_i, encr_r, integ_i, integ_r;
287 linked_list_t *tsi, *tsr, *my_ts, *other_ts;
288 child_sa_t *old = NULL;
289
290 this->child_sa->set_proposal(this->child_sa, this->proposal);
291 this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
292 this->child_sa->set_mode(this->child_sa, this->mode);
293
294 if (this->cpi_i && this->cpi_r)
295 { /* DEFLATE is the only transform we currently support */
296 this->child_sa->set_ipcomp(this->child_sa, IPCOMP_DEFLATE);
297 }
298 else
299 {
300 this->cpi_i = this->cpi_r = 0;
301 }
302
303 this->child_sa->set_protocol(this->child_sa,
304 this->proposal->get_protocol(this->proposal));
305
306 status_i = status_o = FAILED;
307 encr_i = encr_r = integ_i = integ_r = chunk_empty;
308 tsi = linked_list_create_with_items(this->tsi->clone(this->tsi), NULL);
309 tsr = linked_list_create_with_items(this->tsr->clone(this->tsr), NULL);
310 if (this->initiator)
311 {
312 charon->bus->narrow(charon->bus, this->child_sa,
313 NARROW_INITIATOR_POST_AUTH, tsi, tsr);
314 }
315 else
316 {
317 charon->bus->narrow(charon->bus, this->child_sa,
318 NARROW_RESPONDER_POST, tsr, tsi);
319 }
320 if (tsi->get_count(tsi) == 0 || tsr->get_count(tsr) == 0)
321 {
322 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
323 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
324 DBG1(DBG_IKE, "no acceptable traffic selectors found");
325 return FALSE;
326 }
327
328 if (this->initiator)
329 {
330 this->child_sa->set_policies(this->child_sa, tsi, tsr);
331 }
332 else
333 {
334 this->child_sa->set_policies(this->child_sa, tsr, tsi);
335 }
336 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
337 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
338
339 if (this->keymat->derive_child_keys(this->keymat, this->proposal, this->dh,
340 this->spi_i, this->spi_r, this->nonce_i, this->nonce_r,
341 &encr_i, &integ_i, &encr_r, &integ_r))
342 {
343 if (this->initiator)
344 {
345 status_i = this->child_sa->install(this->child_sa,
346 encr_r, integ_r, this->spi_i, this->cpi_i,
347 this->initiator, TRUE, FALSE);
348 status_o = this->child_sa->install(this->child_sa,
349 encr_i, integ_i, this->spi_r, this->cpi_r,
350 this->initiator, FALSE, FALSE);
351 }
352 else
353 {
354 status_i = this->child_sa->install(this->child_sa,
355 encr_i, integ_i, this->spi_r, this->cpi_r,
356 this->initiator, TRUE, FALSE);
357 status_o = this->child_sa->install(this->child_sa,
358 encr_r, integ_r, this->spi_i, this->cpi_i,
359 this->initiator, FALSE, FALSE);
360 }
361 }
362
363 if (status_i != SUCCESS || status_o != SUCCESS)
364 {
365 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
366 (status_i != SUCCESS) ? "inbound " : "",
367 (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
368 (status_o != SUCCESS) ? "outbound " : "");
369 status = FAILED;
370 }
371 else
372 {
373 status = this->child_sa->install_policies(this->child_sa);
374
375 if (status != SUCCESS)
376 {
377 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
378 }
379 else
380 {
381 charon->bus->child_derived_keys(charon->bus, this->child_sa,
382 this->initiator, encr_i, encr_r,
383 integ_i, integ_r);
384 }
385 }
386 chunk_clear(&integ_i);
387 chunk_clear(&integ_r);
388 chunk_clear(&encr_i);
389 chunk_clear(&encr_r);
390
391 if (status != SUCCESS)
392 {
393 return FALSE;
394 }
395
396 charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
397 this->dh, this->nonce_i, this->nonce_r);
398
399 my_ts = linked_list_create_from_enumerator(
400 this->child_sa->create_ts_enumerator(this->child_sa, TRUE));
401 other_ts = linked_list_create_from_enumerator(
402 this->child_sa->create_ts_enumerator(this->child_sa, FALSE));
403
404 DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
405 "with SPIs %.8x_i %.8x_o and TS %#R === %#R",
406 this->child_sa->get_name(this->child_sa),
407 this->child_sa->get_unique_id(this->child_sa),
408 ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
409 ntohl(this->child_sa->get_spi(this->child_sa, FALSE)), my_ts, other_ts);
410
411 my_ts->destroy(my_ts);
412 other_ts->destroy(other_ts);
413
414 this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
415 this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
416
417 if (this->rekey)
418 {
419 old = this->ike_sa->get_child_sa(this->ike_sa,
420 this->proposal->get_protocol(this->proposal),
421 this->rekey, TRUE);
422 }
423 if (old)
424 {
425 charon->bus->child_rekey(charon->bus, old, this->child_sa);
426 /* rekeyed CHILD_SAs stay installed until they expire or are deleted
427 * by the other peer */
428 old->set_state(old, CHILD_REKEYED);
429 /* as initiator we delete the CHILD_SA if configured to do so */
430 if (this->initiator && this->delete)
431 {
432 this->ike_sa->queue_task(this->ike_sa,
433 (task_t*)quick_delete_create(this->ike_sa,
434 this->proposal->get_protocol(this->proposal),
435 this->rekey, TRUE, FALSE));
436 }
437 }
438 else
439 {
440 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
441 }
442 schedule_inactivity_timeout(this);
443 this->child_sa = NULL;
444 return TRUE;
445 }
446
447 /**
448 * Generate and add NONCE
449 */
450 static bool add_nonce(private_quick_mode_t *this, chunk_t *nonce,
451 message_t *message)
452 {
453 nonce_payload_t *nonce_payload;
454 nonce_gen_t *nonceg;
455
456 nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
457 if (!nonceg)
458 {
459 DBG1(DBG_IKE, "no nonce generator found to create nonce");
460 return FALSE;
461 }
462 if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, nonce))
463 {
464 DBG1(DBG_IKE, "nonce allocation failed");
465 nonceg->destroy(nonceg);
466 return FALSE;
467 }
468 nonceg->destroy(nonceg);
469
470 nonce_payload = nonce_payload_create(PLV1_NONCE);
471 nonce_payload->set_nonce(nonce_payload, *nonce);
472 message->add_payload(message, &nonce_payload->payload_interface);
473
474 return TRUE;
475 }
476
477 /**
478 * Extract nonce from NONCE payload
479 */
480 static bool get_nonce(private_quick_mode_t *this, chunk_t *nonce,
481 message_t *message)
482 {
483 nonce_payload_t *nonce_payload;
484
485 nonce_payload = (nonce_payload_t*)message->get_payload(message, PLV1_NONCE);
486 if (!nonce_payload)
487 {
488 DBG1(DBG_IKE, "NONCE payload missing in message");
489 return FALSE;
490 }
491 *nonce = nonce_payload->get_nonce(nonce_payload);
492
493 return TRUE;
494 }
495
496 /**
497 * Add KE payload to message
498 */
499 static bool add_ke(private_quick_mode_t *this, message_t *message)
500 {
501 ke_payload_t *ke_payload;
502
503 ke_payload = ke_payload_create_from_diffie_hellman(PLV1_KEY_EXCHANGE,
504 this->dh);
505 if (!ke_payload)
506 {
507 DBG1(DBG_IKE, "creating KE payload failed");
508 return FALSE;
509 }
510 message->add_payload(message, &ke_payload->payload_interface);
511 return TRUE;
512 }
513
514 /**
515 * Get DH value from a KE payload
516 */
517 static bool get_ke(private_quick_mode_t *this, message_t *message)
518 {
519 ke_payload_t *ke_payload;
520
521 ke_payload = (ke_payload_t*)message->get_payload(message, PLV1_KEY_EXCHANGE);
522 if (!ke_payload)
523 {
524 DBG1(DBG_IKE, "KE payload missing");
525 return FALSE;
526 }
527 if (!this->dh->set_other_public_value(this->dh,
528 ke_payload->get_key_exchange_data(ke_payload)))
529 {
530 DBG1(DBG_IKE, "unable to apply received KE value");
531 return FALSE;
532 }
533 return TRUE;
534 }
535
536 /**
537 * Select a traffic selector from configuration
538 */
539 static traffic_selector_t* select_ts(private_quick_mode_t *this, bool local,
540 linked_list_t *supplied)
541 {
542 traffic_selector_t *ts;
543 linked_list_t *list, *hosts;
544
545 hosts = get_dynamic_hosts(this->ike_sa, local);
546 list = this->config->get_traffic_selectors(this->config,
547 local, supplied, hosts);
548 hosts->destroy(hosts);
549 if (list->get_first(list, (void**)&ts) == SUCCESS)
550 {
551 ts = ts->clone(ts);
552 }
553 else
554 {
555 DBG1(DBG_IKE, "%s traffic selector missing in configuration",
556 local ? "local" : "remote");
557 ts = NULL;
558 }
559 list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
560 return ts;
561 }
562
563 /**
564 * Add selected traffic selectors to message
565 */
566 static void add_ts(private_quick_mode_t *this, message_t *message)
567 {
568 id_payload_t *id_payload;
569
570 id_payload = id_payload_create_from_ts(this->tsi);
571 message->add_payload(message, &id_payload->payload_interface);
572 id_payload = id_payload_create_from_ts(this->tsr);
573 message->add_payload(message, &id_payload->payload_interface);
574 }
575
576 /**
577 * Get traffic selectors from received message
578 */
579 static bool get_ts(private_quick_mode_t *this, message_t *message)
580 {
581 traffic_selector_t *tsi = NULL, *tsr = NULL;
582 enumerator_t *enumerator;
583 id_payload_t *id_payload;
584 payload_t *payload;
585 host_t *hsi, *hsr;
586 bool first = TRUE;
587
588 enumerator = message->create_payload_enumerator(message);
589 while (enumerator->enumerate(enumerator, &payload))
590 {
591 if (payload->get_type(payload) == PLV1_ID)
592 {
593 id_payload = (id_payload_t*)payload;
594
595 if (first)
596 {
597 tsi = id_payload->get_ts(id_payload);
598 first = FALSE;
599 }
600 else
601 {
602 tsr = id_payload->get_ts(id_payload);
603 break;
604 }
605 }
606 }
607 enumerator->destroy(enumerator);
608
609 /* create host2host selectors if ID payloads missing */
610 if (this->initiator)
611 {
612 hsi = this->ike_sa->get_my_host(this->ike_sa);
613 hsr = this->ike_sa->get_other_host(this->ike_sa);
614 }
615 else
616 {
617 hsr = this->ike_sa->get_my_host(this->ike_sa);
618 hsi = this->ike_sa->get_other_host(this->ike_sa);
619 }
620 if (!tsi)
621 {
622 tsi = traffic_selector_create_from_subnet(hsi->clone(hsi),
623 hsi->get_family(hsi) == AF_INET ? 32 : 128, 0, 0, 65535);
624 }
625 if (!tsr)
626 {
627 tsr = traffic_selector_create_from_subnet(hsr->clone(hsr),
628 hsr->get_family(hsr) == AF_INET ? 32 : 128, 0, 0, 65535);
629 }
630 if (this->mode == MODE_TRANSPORT && this->udp &&
631 (!tsi->is_host(tsi, hsi) || !tsr->is_host(tsr, hsr)))
632 { /* change TS in case of a NAT in transport mode */
633 DBG2(DBG_IKE, "changing received traffic selectors %R=== %R due to NAT",
634 tsi, tsr);
635 tsi->set_address(tsi, hsi);
636 tsr->set_address(tsr, hsr);
637 }
638
639 if (this->initiator)
640 {
641 traffic_selector_t *tsisub, *tsrsub;
642
643 /* check if peer selection is valid */
644 tsisub = this->tsi->get_subset(this->tsi, tsi);
645 tsrsub = this->tsr->get_subset(this->tsr, tsr);
646 if (!tsisub || !tsrsub)
647 {
648 DBG1(DBG_IKE, "peer selected invalid traffic selectors: "
649 "%R for %R, %R for %R", tsi, this->tsi, tsr, this->tsr);
650 DESTROY_IF(tsisub);
651 DESTROY_IF(tsrsub);
652 tsi->destroy(tsi);
653 tsr->destroy(tsr);
654 return FALSE;
655 }
656 tsi->destroy(tsi);
657 tsr->destroy(tsr);
658 this->tsi->destroy(this->tsi);
659 this->tsr->destroy(this->tsr);
660 this->tsi = tsisub;
661 this->tsr = tsrsub;
662 }
663 else
664 {
665 this->tsi = tsi;
666 this->tsr = tsr;
667 }
668 return TRUE;
669 }
670
671 /**
672 * Get encap
673 */
674 static encap_t get_encap(ike_sa_t* ike_sa, bool udp)
675 {
676 if (!udp)
677 {
678 return ENCAP_NONE;
679 }
680 if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
681 {
682 return ENCAP_UDP_DRAFT_00_03;
683 }
684 return ENCAP_UDP;
685 }
686
687 /**
688 * Get NAT-OA payload type (RFC 3947 or RFC 3947 drafts).
689 */
690 static payload_type_t get_nat_oa_payload_type(ike_sa_t *ike_sa)
691 {
692 if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
693 {
694 return PLV1_NAT_OA_DRAFT_00_03;
695 }
696 return PLV1_NAT_OA;
697 }
698
699 /**
700 * Add NAT-OA payloads
701 */
702 static void add_nat_oa_payloads(private_quick_mode_t *this, message_t *message)
703 {
704 identification_t *id;
705 id_payload_t *nat_oa;
706 host_t *init, *resp;
707 payload_type_t nat_oa_payload_type;
708
709 if (this->initiator)
710 {
711 init = message->get_source(message);
712 resp = message->get_destination(message);
713 }
714 else
715 {
716 init = message->get_destination(message);
717 resp = message->get_source(message);
718 }
719
720 nat_oa_payload_type = get_nat_oa_payload_type(this->ike_sa);
721
722 /* first NAT-OA is the initiator's address */
723 id = identification_create_from_sockaddr(init->get_sockaddr(init));
724 nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
725 message->add_payload(message, (payload_t*)nat_oa);
726 id->destroy(id);
727
728 /* second NAT-OA is that of the responder */
729 id = identification_create_from_sockaddr(resp->get_sockaddr(resp));
730 nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
731 message->add_payload(message, (payload_t*)nat_oa);
732 id->destroy(id);
733 }
734
735 /**
736 * Look up lifetimes
737 */
738 static void get_lifetimes(private_quick_mode_t *this)
739 {
740 lifetime_cfg_t *lft;
741
742 lft = this->config->get_lifetime(this->config, TRUE);
743 if (lft->time.life)
744 {
745 this->lifetime = lft->time.life;
746 }
747 if (lft->bytes.life)
748 {
749 this->lifebytes = lft->bytes.life;
750 }
751 free(lft);
752 }
753
754 /**
755 * Check and apply lifetimes
756 */
757 static void apply_lifetimes(private_quick_mode_t *this, sa_payload_t *sa_payload)
758 {
759 uint32_t lifetime;
760 uint64_t lifebytes;
761
762 lifetime = sa_payload->get_lifetime(sa_payload);
763 lifebytes = sa_payload->get_lifebytes(sa_payload);
764 if (this->lifetime != lifetime)
765 {
766 DBG1(DBG_IKE, "received %us lifetime, configured %us",
767 lifetime, this->lifetime);
768 this->lifetime = lifetime;
769 }
770 if (this->lifebytes != lifebytes)
771 {
772 DBG1(DBG_IKE, "received %llu lifebytes, configured %llu",
773 lifebytes, this->lifebytes);
774 this->lifebytes = lifebytes;
775 }
776 }
777
778 /**
779 * Set the task ready to build notify error message
780 */
781 static status_t send_notify(private_quick_mode_t *this, notify_type_t type)
782 {
783 notify_payload_t *notify;
784
785 notify = notify_payload_create_from_protocol_and_type(PLV1_NOTIFY,
786 this->proto, type);
787 notify->set_spi(notify, this->spi_i);
788
789 this->ike_sa->queue_task(this->ike_sa,
790 (task_t*)informational_create(this->ike_sa, notify));
791 /* cancel all active/passive tasks in favour of informational */
792 this->ike_sa->flush_queue(this->ike_sa,
793 this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
794 return ALREADY_DONE;
795 }
796
797 /**
798 * Prepare a list of proposals from child_config containing only the specified
799 * DH group, unless it is set to MODP_NONE.
800 */
801 static linked_list_t *get_proposals(private_quick_mode_t *this,
802 diffie_hellman_group_t group)
803 {
804 linked_list_t *list;
805 proposal_t *proposal;
806 enumerator_t *enumerator;
807
808 list = this->config->get_proposals(this->config, FALSE);
809 enumerator = list->create_enumerator(list);
810 while (enumerator->enumerate(enumerator, &proposal))
811 {
812 if (group != MODP_NONE)
813 {
814 if (!proposal->has_dh_group(proposal, group))
815 {
816 list->remove_at(list, enumerator);
817 proposal->destroy(proposal);
818 continue;
819 }
820 proposal->strip_dh(proposal, group);
821 }
822 proposal->set_spi(proposal, this->spi_i);
823 }
824 enumerator->destroy(enumerator);
825
826 return list;
827 }
828
829 METHOD(task_t, build_i, status_t,
830 private_quick_mode_t *this, message_t *message)
831 {
832 switch (this->state)
833 {
834 case QM_INIT:
835 {
836 sa_payload_t *sa_payload;
837 linked_list_t *list, *tsi, *tsr;
838 proposal_t *proposal;
839 diffie_hellman_group_t group;
840 encap_t encap;
841
842 this->udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
843 this->mode = this->config->get_mode(this->config);
844 this->child_sa = child_sa_create(
845 this->ike_sa->get_my_host(this->ike_sa),
846 this->ike_sa->get_other_host(this->ike_sa),
847 this->config, this->reqid, this->udp,
848 this->mark_in, this->mark_out);
849
850 if (this->udp && this->mode == MODE_TRANSPORT)
851 {
852 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
853 add_nat_oa_payloads(this, message);
854 }
855
856 if (this->config->has_option(this->config, OPT_IPCOMP))
857 {
858 this->cpi_i = this->child_sa->alloc_cpi(this->child_sa);
859 if (!this->cpi_i)
860 {
861 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, "
862 "IPComp disabled");
863 }
864 }
865
866 list = this->config->get_proposals(this->config, MODP_NONE);
867 if (list->get_first(list, (void**)&proposal) == SUCCESS)
868 {
869 this->proto = proposal->get_protocol(proposal);
870 }
871 list->destroy_offset(list, offsetof(proposal_t, destroy));
872 this->spi_i = this->child_sa->alloc_spi(this->child_sa, this->proto);
873 if (!this->spi_i)
874 {
875 DBG1(DBG_IKE, "allocating SPI from kernel failed");
876 return FAILED;
877 }
878
879 group = this->config->get_dh_group(this->config);
880 if (group != MODP_NONE)
881 {
882 proposal_t *proposal;
883 uint16_t preferred_group;
884
885 proposal = this->ike_sa->get_proposal(this->ike_sa);
886 proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP,
887 &preferred_group, NULL);
888 /* try the negotiated DH group from IKE_SA */
889 list = get_proposals(this, preferred_group);
890 if (list->get_count(list))
891 {
892 group = preferred_group;
893 }
894 else
895 {
896 /* fall back to the first configured DH group */
897 list->destroy(list);
898 list = get_proposals(this, group);
899 }
900
901 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
902 group);
903 if (!this->dh)
904 {
905 DBG1(DBG_IKE, "configured DH group %N not supported",
906 diffie_hellman_group_names, group);
907 list->destroy_offset(list, offsetof(proposal_t, destroy));
908 return FAILED;
909 }
910 }
911 else
912 {
913 list = get_proposals(this, MODP_NONE);
914 }
915
916 get_lifetimes(this);
917 encap = get_encap(this->ike_sa, this->udp);
918 sa_payload = sa_payload_create_from_proposals_v1(list,
919 this->lifetime, this->lifebytes, AUTH_NONE,
920 this->mode, encap, this->cpi_i);
921 list->destroy_offset(list, offsetof(proposal_t, destroy));
922 message->add_payload(message, &sa_payload->payload_interface);
923
924 if (!add_nonce(this, &this->nonce_i, message))
925 {
926 return FAILED;
927 }
928 if (group != MODP_NONE)
929 {
930 if (!add_ke(this, message))
931 {
932 return FAILED;
933 }
934 }
935 if (!this->tsi)
936 {
937 this->tsi = select_ts(this, TRUE, NULL);
938 }
939 if (!this->tsr)
940 {
941 this->tsr = select_ts(this, FALSE, NULL);
942 }
943 tsi = linked_list_create_with_items(this->tsi, NULL);
944 tsr = linked_list_create_with_items(this->tsr, NULL);
945 this->tsi = this->tsr = NULL;
946 charon->bus->narrow(charon->bus, this->child_sa,
947 NARROW_INITIATOR_PRE_AUTH, tsi, tsr);
948 tsi->remove_first(tsi, (void**)&this->tsi);
949 tsr->remove_first(tsr, (void**)&this->tsr);
950 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
951 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
952 if (!this->tsi || !this->tsr)
953 {
954 return FAILED;
955 }
956 add_ts(this, message);
957 return NEED_MORE;
958 }
959 case QM_NEGOTIATED:
960 {
961 return SUCCESS;
962 }
963 default:
964 return FAILED;
965 }
966 }
967
968 /**
969 * Check for notify errors, return TRUE if error found
970 */
971 static bool has_notify_errors(private_quick_mode_t *this, message_t *message)
972 {
973 enumerator_t *enumerator;
974 payload_t *payload;
975 bool err = FALSE;
976
977 enumerator = message->create_payload_enumerator(message);
978 while (enumerator->enumerate(enumerator, &payload))
979 {
980 if (payload->get_type(payload) == PLV1_NOTIFY)
981 {
982 notify_payload_t *notify;
983 notify_type_t type;
984
985 notify = (notify_payload_t*)payload;
986 type = notify->get_notify_type(notify);
987 if (type < 16384)
988 {
989
990 DBG1(DBG_IKE, "received %N error notify",
991 notify_type_names, type);
992 err = TRUE;
993 }
994 else
995 {
996 DBG1(DBG_IKE, "received %N notify", notify_type_names, type);
997 }
998 }
999 }
1000 enumerator->destroy(enumerator);
1001
1002 return err;
1003 }
1004
1005 /**
1006 * Check if this is a rekey for an existing CHILD_SA, reuse reqid if so
1007 */
1008 static void check_for_rekeyed_child(private_quick_mode_t *this, bool responder)
1009 {
1010 enumerator_t *enumerator, *policies;
1011 traffic_selector_t *local, *remote, *my_ts, *other_ts;
1012 child_sa_t *child_sa;
1013 proposal_t *proposal;
1014 char *name;
1015
1016 if (responder)
1017 {
1018 my_ts = this->tsr;
1019 other_ts = this->tsi;
1020 }
1021 else
1022 {
1023 my_ts = this->tsi;
1024 other_ts = this->tsr;
1025 }
1026
1027 name = this->config->get_name(this->config);
1028 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1029 while (this->reqid == 0 && enumerator->enumerate(enumerator, &child_sa))
1030 {
1031 if (streq(child_sa->get_name(child_sa), name))
1032 {
1033 proposal = child_sa->get_proposal(child_sa);
1034 switch (child_sa->get_state(child_sa))
1035 {
1036 case CHILD_INSTALLED:
1037 case CHILD_REKEYING:
1038 policies = child_sa->create_policy_enumerator(child_sa);
1039 if (policies->enumerate(policies, &local, &remote) &&
1040 local->equals(local, my_ts) &&
1041 remote->equals(remote, other_ts) &&
1042 this->proposal->equals(this->proposal, proposal))
1043 {
1044 this->reqid = child_sa->get_reqid(child_sa);
1045 this->rekey = child_sa->get_spi(child_sa, TRUE);
1046 this->mark_in = child_sa->get_mark(child_sa,
1047 TRUE).value;
1048 this->mark_out = child_sa->get_mark(child_sa,
1049 FALSE).value;
1050 child_sa->set_state(child_sa, CHILD_REKEYING);
1051 DBG1(DBG_IKE, "detected rekeying of CHILD_SA %s{%u}",
1052 child_sa->get_name(child_sa),
1053 child_sa->get_unique_id(child_sa));
1054 }
1055 policies->destroy(policies);
1056 break;
1057 case CHILD_REKEYED:
1058 default:
1059 break;
1060 }
1061 }
1062 }
1063 enumerator->destroy(enumerator);
1064 }
1065
1066 METHOD(task_t, process_r, status_t,
1067 private_quick_mode_t *this, message_t *message)
1068 {
1069 if (this->mid && this->mid != message->get_message_id(message))
1070 { /* not responsible for this quick mode exchange */
1071 return INVALID_ARG;
1072 }
1073
1074 switch (this->state)
1075 {
1076 case QM_INIT:
1077 {
1078 sa_payload_t *sa_payload;
1079 linked_list_t *tsi, *tsr, *hostsi, *hostsr, *list = NULL;
1080 peer_cfg_t *peer_cfg;
1081 uint16_t group;
1082 bool private, prefer_configured;
1083
1084 sa_payload = (sa_payload_t*)message->get_payload(message,
1085 PLV1_SECURITY_ASSOCIATION);
1086 if (!sa_payload)
1087 {
1088 DBG1(DBG_IKE, "sa payload missing");
1089 return send_notify(this, INVALID_PAYLOAD_TYPE);
1090 }
1091
1092 this->mode = sa_payload->get_encap_mode(sa_payload, &this->udp);
1093
1094 if (!get_ts(this, message))
1095 {
1096 return FAILED;
1097 }
1098 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1099 tsi = linked_list_create_with_items(this->tsi, NULL);
1100 tsr = linked_list_create_with_items(this->tsr, NULL);
1101 this->tsi = this->tsr = NULL;
1102 hostsi = get_dynamic_hosts(this->ike_sa, FALSE);
1103 hostsr = get_dynamic_hosts(this->ike_sa, TRUE);
1104 this->config = peer_cfg->select_child_cfg(peer_cfg, tsr, tsi,
1105 hostsr, hostsi);
1106 hostsi->destroy(hostsi);
1107 hostsr->destroy(hostsr);
1108 if (this->config)
1109 {
1110 this->tsi = select_ts(this, FALSE, tsi);
1111 this->tsr = select_ts(this, TRUE, tsr);
1112 }
1113 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1114 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1115 if (!this->config || !this->tsi || !this->tsr ||
1116 this->mode != this->config->get_mode(this->config))
1117 {
1118 DBG1(DBG_IKE, "no matching CHILD_SA config found");
1119 return send_notify(this, INVALID_ID_INFORMATION);
1120 }
1121
1122 if (this->config->has_option(this->config, OPT_IPCOMP))
1123 {
1124 list = sa_payload->get_ipcomp_proposals(sa_payload,
1125 &this->cpi_i);
1126 if (!list->get_count(list))
1127 {
1128 DBG1(DBG_IKE, "expected IPComp proposal but peer did "
1129 "not send one, IPComp disabled");
1130 this->cpi_i = 0;
1131 }
1132 }
1133 if (!list || !list->get_count(list))
1134 {
1135 DESTROY_IF(list);
1136 list = sa_payload->get_proposals(sa_payload);
1137 }
1138 private = this->ike_sa->supports_extension(this->ike_sa,
1139 EXT_STRONGSWAN);
1140 prefer_configured = lib->settings->get_bool(lib->settings,
1141 "%s.prefer_configured_proposals", TRUE, lib->ns);
1142 this->proposal = this->config->select_proposal(this->config, list,
1143 FALSE, private, prefer_configured);
1144 list->destroy_offset(list, offsetof(proposal_t, destroy));
1145
1146 get_lifetimes(this);
1147 apply_lifetimes(this, sa_payload);
1148
1149 if (!this->proposal)
1150 {
1151 DBG1(DBG_IKE, "no matching proposal found, sending %N",
1152 notify_type_names, NO_PROPOSAL_CHOSEN);
1153 return send_notify(this, NO_PROPOSAL_CHOSEN);
1154 }
1155 this->spi_i = this->proposal->get_spi(this->proposal);
1156
1157 if (!get_nonce(this, &this->nonce_i, message))
1158 {
1159 return send_notify(this, INVALID_PAYLOAD_TYPE);
1160 }
1161
1162 if (this->proposal->get_algorithm(this->proposal,
1163 DIFFIE_HELLMAN_GROUP, &group, NULL))
1164 {
1165 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
1166 group);
1167 if (!this->dh)
1168 {
1169 DBG1(DBG_IKE, "negotiated DH group %N not supported",
1170 diffie_hellman_group_names, group);
1171 return send_notify(this, INVALID_KEY_INFORMATION);
1172 }
1173 if (!get_ke(this, message))
1174 {
1175 return send_notify(this, INVALID_PAYLOAD_TYPE);
1176 }
1177 }
1178
1179 check_for_rekeyed_child(this, TRUE);
1180
1181 this->child_sa = child_sa_create(
1182 this->ike_sa->get_my_host(this->ike_sa),
1183 this->ike_sa->get_other_host(this->ike_sa),
1184 this->config, this->reqid, this->udp,
1185 this->mark_in, this->mark_out);
1186
1187 tsi = linked_list_create_with_items(this->tsi, NULL);
1188 tsr = linked_list_create_with_items(this->tsr, NULL);
1189 this->tsi = this->tsr = NULL;
1190 charon->bus->narrow(charon->bus, this->child_sa,
1191 NARROW_RESPONDER, tsr, tsi);
1192 if (tsi->remove_first(tsi, (void**)&this->tsi) != SUCCESS ||
1193 tsr->remove_first(tsr, (void**)&this->tsr) != SUCCESS)
1194 {
1195 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1196 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1197 return send_notify(this, INVALID_ID_INFORMATION);
1198 }
1199 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1200 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1201
1202 return NEED_MORE;
1203 }
1204 case QM_NEGOTIATED:
1205 {
1206 if (has_notify_errors(this, message))
1207 {
1208 return SUCCESS;
1209 }
1210 if (message->get_exchange_type(message) == INFORMATIONAL_V1)
1211 {
1212 if (message->get_payload(message, PLV1_DELETE))
1213 {
1214 /* If the DELETE for a Quick Mode follows immediately
1215 * after rekeying, we might receive it before the
1216 * third completing Quick Mode message. Ignore it, as
1217 * it gets handled by a separately queued delete task. */
1218 return NEED_MORE;
1219 }
1220 return SUCCESS;
1221 }
1222 if (!install(this))
1223 {
1224 ike_sa_t *ike_sa = this->ike_sa;
1225 task_t *task;
1226
1227 task = (task_t*)quick_delete_create(this->ike_sa,
1228 this->proposal->get_protocol(this->proposal),
1229 this->spi_i, TRUE, TRUE);
1230 /* flush_queue() destroys the current task */
1231 ike_sa->flush_queue(ike_sa, TASK_QUEUE_PASSIVE);
1232 ike_sa->queue_task(ike_sa, task);
1233 return ALREADY_DONE;
1234 }
1235 return SUCCESS;
1236 }
1237 default:
1238 return FAILED;
1239 }
1240 }
1241
1242 METHOD(task_t, build_r, status_t,
1243 private_quick_mode_t *this, message_t *message)
1244 {
1245 if (this->mid && this->mid != message->get_message_id(message))
1246 { /* not responsible for this quick mode exchange */
1247 return INVALID_ARG;
1248 }
1249
1250 switch (this->state)
1251 {
1252 case QM_INIT:
1253 {
1254 sa_payload_t *sa_payload;
1255 encap_t encap;
1256
1257 this->proto = this->proposal->get_protocol(this->proposal);
1258 this->spi_r = this->child_sa->alloc_spi(this->child_sa, this->proto);
1259 if (!this->spi_r)
1260 {
1261 DBG1(DBG_IKE, "allocating SPI from kernel failed");
1262 return send_notify(this, NO_PROPOSAL_CHOSEN);
1263 }
1264 this->proposal->set_spi(this->proposal, this->spi_r);
1265
1266 if (this->cpi_i)
1267 {
1268 this->cpi_r = this->child_sa->alloc_cpi(this->child_sa);
1269 if (!this->cpi_r)
1270 {
1271 DBG1(DBG_IKE, "unable to allocate a CPI from "
1272 "kernel, IPComp disabled");
1273 return send_notify(this, NO_PROPOSAL_CHOSEN);
1274 }
1275 }
1276
1277 if (this->udp && this->mode == MODE_TRANSPORT)
1278 {
1279 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
1280 add_nat_oa_payloads(this, message);
1281 }
1282
1283 encap = get_encap(this->ike_sa, this->udp);
1284 sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
1285 this->lifetime, this->lifebytes, AUTH_NONE,
1286 this->mode, encap, this->cpi_r);
1287 message->add_payload(message, &sa_payload->payload_interface);
1288
1289 if (!add_nonce(this, &this->nonce_r, message))
1290 {
1291 return FAILED;
1292 }
1293 if (this->dh)
1294 {
1295 if (!add_ke(this, message))
1296 {
1297 return FAILED;
1298 }
1299 }
1300
1301 add_ts(this, message);
1302
1303 this->state = QM_NEGOTIATED;
1304 this->mid = message->get_message_id(message);
1305 return NEED_MORE;
1306 }
1307 case QM_NEGOTIATED:
1308 if (message->get_exchange_type(message) == INFORMATIONAL_V1)
1309 {
1310 /* skip INFORMATIONAL response if we received a INFORMATIONAL
1311 * delete, see process_r() */
1312 return ALREADY_DONE;
1313 }
1314 /* fall */
1315 default:
1316 return FAILED;
1317 }
1318 }
1319
1320 METHOD(task_t, process_i, status_t,
1321 private_quick_mode_t *this, message_t *message)
1322 {
1323 switch (this->state)
1324 {
1325 case QM_INIT:
1326 {
1327 sa_payload_t *sa_payload;
1328 linked_list_t *list = NULL;
1329 bool private;
1330
1331 sa_payload = (sa_payload_t*)message->get_payload(message,
1332 PLV1_SECURITY_ASSOCIATION);
1333 if (!sa_payload)
1334 {
1335 DBG1(DBG_IKE, "sa payload missing");
1336 return send_notify(this, NO_PROPOSAL_CHOSEN);
1337 }
1338 if (this->cpi_i)
1339 {
1340 list = sa_payload->get_ipcomp_proposals(sa_payload,
1341 &this->cpi_r);
1342 if (!list->get_count(list))
1343 {
1344 DBG1(DBG_IKE, "peer did not accept our IPComp proposal, "
1345 "IPComp disabled");
1346 this->cpi_i = 0;
1347 }
1348 }
1349 if (!list || !list->get_count(list))
1350 {
1351 DESTROY_IF(list);
1352 list = sa_payload->get_proposals(sa_payload);
1353 }
1354 private = this->ike_sa->supports_extension(this->ike_sa,
1355 EXT_STRONGSWAN);
1356 this->proposal = this->config->select_proposal(this->config, list,
1357 FALSE, private, TRUE);
1358 list->destroy_offset(list, offsetof(proposal_t, destroy));
1359 if (!this->proposal)
1360 {
1361 DBG1(DBG_IKE, "no matching proposal found");
1362 return send_notify(this, NO_PROPOSAL_CHOSEN);
1363 }
1364 this->spi_r = this->proposal->get_spi(this->proposal);
1365
1366 apply_lifetimes(this, sa_payload);
1367
1368 if (!get_nonce(this, &this->nonce_r, message))
1369 {
1370 return send_notify(this, INVALID_PAYLOAD_TYPE);
1371 }
1372 if (this->dh && !get_ke(this, message))
1373 {
1374 return send_notify(this, INVALID_KEY_INFORMATION);
1375 }
1376 if (!get_ts(this, message))
1377 {
1378 return send_notify(this, INVALID_PAYLOAD_TYPE);
1379 }
1380 check_for_rekeyed_child(this, FALSE);
1381 if (!install(this))
1382 {
1383 return send_notify(this, NO_PROPOSAL_CHOSEN);
1384 }
1385 this->state = QM_NEGOTIATED;
1386 return NEED_MORE;
1387 }
1388 default:
1389 return FAILED;
1390 }
1391 }
1392
1393 METHOD(task_t, get_type, task_type_t,
1394 private_quick_mode_t *this)
1395 {
1396 return TASK_QUICK_MODE;
1397 }
1398
1399 METHOD(quick_mode_t, get_mid, uint32_t,
1400 private_quick_mode_t *this)
1401 {
1402 return this->mid;
1403 }
1404
1405 METHOD(quick_mode_t, use_reqid, void,
1406 private_quick_mode_t *this, uint32_t reqid)
1407 {
1408 this->reqid = reqid;
1409 }
1410
1411 METHOD(quick_mode_t, use_marks, void,
1412 private_quick_mode_t *this, u_int in, u_int out)
1413 {
1414 this->mark_in = in;
1415 this->mark_out = out;
1416 }
1417
1418 METHOD(quick_mode_t, rekey, void,
1419 private_quick_mode_t *this, uint32_t spi)
1420 {
1421 this->rekey = spi;
1422 }
1423
1424 METHOD(task_t, migrate, void,
1425 private_quick_mode_t *this, ike_sa_t *ike_sa)
1426 {
1427 chunk_free(&this->nonce_i);
1428 chunk_free(&this->nonce_r);
1429 DESTROY_IF(this->tsi);
1430 DESTROY_IF(this->tsr);
1431 DESTROY_IF(this->proposal);
1432 DESTROY_IF(this->child_sa);
1433 DESTROY_IF(this->dh);
1434
1435 this->ike_sa = ike_sa;
1436 this->keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa);
1437 this->state = QM_INIT;
1438 this->mid = 0;
1439 this->tsi = NULL;
1440 this->tsr = NULL;
1441 this->proposal = NULL;
1442 this->child_sa = NULL;
1443 this->dh = NULL;
1444 this->spi_i = 0;
1445 this->spi_r = 0;
1446 this->mark_in = 0;
1447 this->mark_out = 0;
1448
1449 if (!this->initiator)
1450 {
1451 DESTROY_IF(this->config);
1452 this->config = NULL;
1453 }
1454 }
1455
1456 METHOD(task_t, destroy, void,
1457 private_quick_mode_t *this)
1458 {
1459 chunk_free(&this->nonce_i);
1460 chunk_free(&this->nonce_r);
1461 DESTROY_IF(this->tsi);
1462 DESTROY_IF(this->tsr);
1463 DESTROY_IF(this->proposal);
1464 DESTROY_IF(this->child_sa);
1465 DESTROY_IF(this->config);
1466 DESTROY_IF(this->dh);
1467 free(this);
1468 }
1469
1470 /*
1471 * Described in header.
1472 */
1473 quick_mode_t *quick_mode_create(ike_sa_t *ike_sa, child_cfg_t *config,
1474 traffic_selector_t *tsi, traffic_selector_t *tsr)
1475 {
1476 private_quick_mode_t *this;
1477
1478 INIT(this,
1479 .public = {
1480 .task = {
1481 .get_type = _get_type,
1482 .migrate = _migrate,
1483 .destroy = _destroy,
1484 },
1485 .get_mid = _get_mid,
1486 .use_reqid = _use_reqid,
1487 .use_marks = _use_marks,
1488 .rekey = _rekey,
1489 },
1490 .ike_sa = ike_sa,
1491 .initiator = config != NULL,
1492 .config = config,
1493 .keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa),
1494 .state = QM_INIT,
1495 .tsi = tsi ? tsi->clone(tsi) : NULL,
1496 .tsr = tsr ? tsr->clone(tsr) : NULL,
1497 .proto = PROTO_ESP,
1498 .delete = lib->settings->get_bool(lib->settings,
1499 "%s.delete_rekeyed", FALSE, lib->ns),
1500 );
1501
1502 if (config)
1503 {
1504 this->public.task.build = _build_i;
1505 this->public.task.process = _process_i;
1506 }
1507 else
1508 {
1509 this->public.task.build = _build_r;
1510 this->public.task.process = _process_r;
1511 }
1512
1513 return &this->public;
1514 }