src/libcharon/sa/ikev1/tasks/quick_mode.c

   1 /*
   2  * Copyright (C) 2012-2015 Tobias Brunner
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * Copyright (C) 2011 Martin Willi
   6  * Copyright (C) 2011 revosec AG
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 /*
  20  * Copyright (C) 2012 Volker Rümelin
  21  *
  22  * Permission is hereby granted, free of charge, to any person obtaining a copy
  23  * of this software and associated documentation files (the "Software"), to deal
  24  * in the Software without restriction, including without limitation the rights
  25  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  26  * copies of the Software, and to permit persons to whom the Software is
  27  * furnished to do so, subject to the following conditions:
  28  *
  29  * The above copyright notice and this permission notice shall be included in
  30  * all copies or substantial portions of the Software.
  31  *
  32  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  33  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  34  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  35  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  36  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  37  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  38  * THE SOFTWARE.
  39  */
  40
  41 #include "quick_mode.h"
  42
  43 #include <string.h>
  44
  45 #include <daemon.h>
  46 #include <sa/ikev1/keymat_v1.h>
  47 #include <encoding/payloads/sa_payload.h>
  48 #include <encoding/payloads/nonce_payload.h>
  49 #include <encoding/payloads/ke_payload.h>
  50 #include <encoding/payloads/id_payload.h>
  51 #include <encoding/payloads/payload.h>
  52 #include <sa/ikev1/tasks/informational.h>
  53 #include <sa/ikev1/tasks/quick_delete.h>
  54 #include <processing/jobs/inactivity_job.h>
  55
  56 typedef struct private_quick_mode_t private_quick_mode_t;
  57
  58 /**
  59  * Private members of a quick_mode_t task.
  60  */
  61 struct private_quick_mode_t {
  62
  63         /**
  64          * Public methods and task_t interface.
  65          */
  66         quick_mode_t public;
  67
  68         /**
  69          * Assigned IKE_SA.
  70          */
  71         ike_sa_t *ike_sa;
  72
  73         /**
  74          * TRUE if we are initiating quick mode
  75          */
  76         bool initiator;
  77
  78         /**
  79          * Traffic selector of initiator
  80          */
  81         traffic_selector_t *tsi;
  82
  83         /**
  84          * Traffic selector of responder
  85          */
  86         traffic_selector_t *tsr;
  87
  88         /**
  89          * Initiators nonce
  90          */
  91         chunk_t nonce_i;
  92
  93         /**
  94          * Responder nonce
  95          */
  96         chunk_t nonce_r;
  97
  98         /**
  99          * Initiators ESP SPI
 100          */
 101         uint32_t spi_i;
 102
 103         /**
 104          * Responder ESP SPI
 105          */
 106         uint32_t spi_r;
 107
 108         /**
 109          * Initiators IPComp CPI
 110          */
 111         uint16_t cpi_i;
 112
 113         /**
 114          * Responders IPComp CPI
 115          */
 116         uint16_t cpi_r;
 117
 118         /**
 119          * selected CHILD_SA proposal
 120          */
 121         proposal_t *proposal;
 122
 123         /**
 124          * Config of CHILD_SA to establish
 125          */
 126         child_cfg_t *config;
 127
 128         /**
 129          * CHILD_SA we are about to establish
 130          */
 131         child_sa_t *child_sa;
 132
 133         /**
 134          * IKEv1 keymat
 135          */
 136         keymat_v1_t *keymat;
 137
 138         /**
 139          * DH exchange, when PFS is in use
 140          */
 141         diffie_hellman_t *dh;
 142
 143         /**
 144          * Negotiated lifetime of new SA
 145          */
 146         uint32_t lifetime;
 147
 148         /**
 149          * Negotiated lifebytes of new SA
 150          */
 151         uint64_t lifebytes;
 152
 153         /**
 154          * Reqid to use, 0 for auto-allocate
 155          */
 156         uint32_t reqid;
 157
 158         /**
 159          * Explicit inbound mark value to use, if any
 160          */
 161         u_int mark_in;
 162
 163         /**
 164          * Explicit inbound mark value to use, if any
 165          */
 166         u_int mark_out;
 167
 168         /**
 169          * SPI of SA we rekey
 170          */
 171         uint32_t rekey;
 172
 173         /**
 174          * Delete old child after successful rekey
 175          */
 176         bool delete;
 177
 178         /**
 179          * Negotiated mode, tunnel or transport
 180          */
 181         ipsec_mode_t mode;
 182
 183         /*
 184          * SA protocol (ESP|AH) negotiated
 185          */
 186         protocol_id_t proto;
 187
 188         /**
 189          * Use UDP encapsulation
 190          */
 191         bool udp;
 192
 193         /**
 194          * Message ID of handled quick mode exchange
 195          */
 196         uint32_t mid;
 197
 198         /** states of quick mode */
 199         enum {
 200                 QM_INIT,
 201                 QM_NEGOTIATED,
 202         } state;
 203 };
 204
 205 /**
 206  * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
 207  */
 208 static void schedule_inactivity_timeout(private_quick_mode_t *this)
 209 {
 210         uint32_t timeout;
 211         bool close_ike;
 212
 213         timeout = this->config->get_inactivity(this->config);
 214         if (timeout)
 215         {
 216                 close_ike = lib->settings->get_bool(lib->settings,
 217                                                                         "%s.inactivity_close_ike", FALSE, lib->ns);
 218                 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
 219                         inactivity_job_create(this->child_sa->get_unique_id(this->child_sa),
 220                                                                   timeout, close_ike), timeout);
 221         }
 222 }
 223
 224 /**
 225  * Check if we have a an address pool configured
 226  */
 227 static bool have_pool(ike_sa_t *ike_sa)
 228 {
 229         enumerator_t *enumerator;
 230         peer_cfg_t *peer_cfg;
 231         char *pool;
 232         bool found = FALSE;
 233
 234         peer_cfg = ike_sa->get_peer_cfg(ike_sa);
 235         if (peer_cfg)
 236         {
 237                 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
 238                 if (enumerator->enumerate(enumerator, &pool))
 239                 {
 240                         found = TRUE;
 241                 }
 242                 enumerator->destroy(enumerator);
 243         }
 244         return found;
 245 }
 246
 247 /**
 248  * Get hosts to use for dynamic traffic selectors
 249  */
 250 static linked_list_t *get_dynamic_hosts(ike_sa_t *ike_sa, bool local)
 251 {
 252         enumerator_t *enumerator;
 253         linked_list_t *list;
 254         host_t *host;
 255
 256         list = linked_list_create();
 257         enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
 258         while (enumerator->enumerate(enumerator, &host))
 259         {
 260                 list->insert_last(list, host);
 261         }
 262         enumerator->destroy(enumerator);
 263
 264         if (list->get_count(list) == 0)
 265         {       /* no virtual IPs assigned */
 266                 if (local)
 267                 {
 268                         host = ike_sa->get_my_host(ike_sa);
 269                         list->insert_last(list, host);
 270                 }
 271                 else if (!have_pool(ike_sa))
 272                 {       /* use host only if we don't have a pool configured */
 273                         host = ike_sa->get_other_host(ike_sa);
 274                         list->insert_last(list, host);
 275                 }
 276         }
 277         return list;
 278 }
 279
 280 /**
 281  * Install negotiated CHILD_SA
 282  */
 283 static bool install(private_quick_mode_t *this)
 284 {
 285         status_t status, status_i, status_o;
 286         chunk_t encr_i, encr_r, integ_i, integ_r;
 287         linked_list_t *tsi, *tsr, *my_ts, *other_ts;
 288         child_sa_t *old = NULL;
 289
 290         this->child_sa->set_proposal(this->child_sa, this->proposal);
 291         this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
 292         this->child_sa->set_mode(this->child_sa, this->mode);
 293
 294         if (this->cpi_i && this->cpi_r)
 295         {       /* DEFLATE is the only transform we currently support */
 296                 this->child_sa->set_ipcomp(this->child_sa, IPCOMP_DEFLATE);
 297         }
 298         else
 299         {
 300                 this->cpi_i = this->cpi_r = 0;
 301         }
 302
 303         this->child_sa->set_protocol(this->child_sa,
 304                                                                  this->proposal->get_protocol(this->proposal));
 305
 306         status_i = status_o = FAILED;
 307         encr_i = encr_r = integ_i = integ_r = chunk_empty;
 308         tsi = linked_list_create_with_items(this->tsi->clone(this->tsi), NULL);
 309         tsr = linked_list_create_with_items(this->tsr->clone(this->tsr), NULL);
 310         if (this->initiator)
 311         {
 312                 charon->bus->narrow(charon->bus, this->child_sa,
 313                                                         NARROW_INITIATOR_POST_AUTH, tsi, tsr);
 314         }
 315         else
 316         {
 317                 charon->bus->narrow(charon->bus, this->child_sa,
 318                                                         NARROW_RESPONDER_POST, tsr, tsi);
 319         }
 320         if (tsi->get_count(tsi) == 0 || tsr->get_count(tsr) == 0)
 321         {
 322                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 323                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 324                 DBG1(DBG_IKE, "no acceptable traffic selectors found");
 325                 return FALSE;
 326         }
 327
 328         if (this->initiator)
 329         {
 330                 this->child_sa->set_policies(this->child_sa, tsi, tsr);
 331         }
 332         else
 333         {
 334                 this->child_sa->set_policies(this->child_sa, tsr, tsi);
 335         }
 336         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 337         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 338
 339         if (this->keymat->derive_child_keys(this->keymat, this->proposal, this->dh,
 340                                                 this->spi_i, this->spi_r, this->nonce_i, this->nonce_r,
 341                                                 &encr_i, &integ_i, &encr_r, &integ_r))
 342         {
 343                 if (this->initiator)
 344                 {
 345                         status_i = this->child_sa->install(this->child_sa,
 346                                                                         encr_r, integ_r, this->spi_i, this->cpi_i,
 347                                                                         this->initiator, TRUE, FALSE);
 348                         status_o = this->child_sa->install(this->child_sa,
 349                                                                         encr_i, integ_i, this->spi_r, this->cpi_r,
 350                                                                         this->initiator, FALSE, FALSE);
 351                 }
 352                 else
 353                 {
 354                         status_i = this->child_sa->install(this->child_sa,
 355                                                                         encr_i, integ_i, this->spi_r, this->cpi_r,
 356                                                                         this->initiator, TRUE, FALSE);
 357                         status_o = this->child_sa->install(this->child_sa,
 358                                                                         encr_r, integ_r, this->spi_i, this->cpi_i,
 359                                                                         this->initiator, FALSE, FALSE);
 360                 }
 361         }
 362
 363         if (status_i != SUCCESS || status_o != SUCCESS)
 364         {
 365                 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
 366                         (status_i != SUCCESS) ? "inbound " : "",
 367                         (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
 368                         (status_o != SUCCESS) ? "outbound " : "");
 369                 status = FAILED;
 370         }
 371         else
 372         {
 373                 status = this->child_sa->install_policies(this->child_sa);
 374
 375                 if (status != SUCCESS)
 376                 {
 377                         DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
 378                 }
 379                 else
 380                 {
 381                         charon->bus->child_derived_keys(charon->bus, this->child_sa,
 382                                                                                         this->initiator, encr_i, encr_r,
 383                                                                                         integ_i, integ_r);
 384                 }
 385         }
 386         chunk_clear(&integ_i);
 387         chunk_clear(&integ_r);
 388         chunk_clear(&encr_i);
 389         chunk_clear(&encr_r);
 390
 391         if (status != SUCCESS)
 392         {
 393                 return FALSE;
 394         }
 395
 396         charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
 397                                                         this->dh, this->nonce_i, this->nonce_r);
 398
 399         my_ts = linked_list_create_from_enumerator(
 400                                 this->child_sa->create_ts_enumerator(this->child_sa, TRUE));
 401         other_ts = linked_list_create_from_enumerator(
 402                                 this->child_sa->create_ts_enumerator(this->child_sa, FALSE));
 403
 404         DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
 405                  "with SPIs %.8x_i %.8x_o and TS %#R === %#R",
 406                  this->child_sa->get_name(this->child_sa),
 407                  this->child_sa->get_unique_id(this->child_sa),
 408                  ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
 409                  ntohl(this->child_sa->get_spi(this->child_sa, FALSE)), my_ts, other_ts);
 410
 411         my_ts->destroy(my_ts);
 412         other_ts->destroy(other_ts);
 413
 414         this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 415         this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
 416
 417         if (this->rekey)
 418         {
 419                 old = this->ike_sa->get_child_sa(this->ike_sa,
 420                                                                 this->proposal->get_protocol(this->proposal),
 421                                                                 this->rekey, TRUE);
 422         }
 423         if (old)
 424         {
 425                 charon->bus->child_rekey(charon->bus, old, this->child_sa);
 426                 /* rekeyed CHILD_SAs stay installed until they expire or are deleted
 427                  * by the other peer */
 428                 old->set_state(old, CHILD_REKEYED);
 429                 /* as initiator we delete the CHILD_SA if configured to do so */
 430                 if (this->initiator && this->delete)
 431                 {
 432                         this->ike_sa->queue_task(this->ike_sa,
 433                                 (task_t*)quick_delete_create(this->ike_sa,
 434                                                                 this->proposal->get_protocol(this->proposal),
 435                                                                 this->rekey, TRUE, FALSE));
 436                 }
 437         }
 438         else
 439         {
 440                 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
 441         }
 442         schedule_inactivity_timeout(this);
 443         this->child_sa = NULL;
 444         return TRUE;
 445 }
 446
 447 /**
 448  * Generate and add NONCE
 449  */
 450 static bool add_nonce(private_quick_mode_t *this, chunk_t *nonce,
 451                                           message_t *message)
 452 {
 453         nonce_payload_t *nonce_payload;
 454         nonce_gen_t *nonceg;
 455
 456         nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
 457         if (!nonceg)
 458         {
 459                 DBG1(DBG_IKE, "no nonce generator found to create nonce");
 460                 return FALSE;
 461         }
 462         if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, nonce))
 463         {
 464                 DBG1(DBG_IKE, "nonce allocation failed");
 465                 nonceg->destroy(nonceg);
 466                 return FALSE;
 467         }
 468         nonceg->destroy(nonceg);
 469
 470         nonce_payload = nonce_payload_create(PLV1_NONCE);
 471         nonce_payload->set_nonce(nonce_payload, *nonce);
 472         message->add_payload(message, &nonce_payload->payload_interface);
 473
 474         return TRUE;
 475 }
 476
 477 /**
 478  * Extract nonce from NONCE payload
 479  */
 480 static bool get_nonce(private_quick_mode_t *this, chunk_t *nonce,
 481                                           message_t *message)
 482 {
 483         nonce_payload_t *nonce_payload;
 484
 485         nonce_payload = (nonce_payload_t*)message->get_payload(message, PLV1_NONCE);
 486         if (!nonce_payload)
 487         {
 488                 DBG1(DBG_IKE, "NONCE payload missing in message");
 489                 return FALSE;
 490         }
 491         *nonce = nonce_payload->get_nonce(nonce_payload);
 492
 493         return TRUE;
 494 }
 495
 496 /**
 497  * Add KE payload to message
 498  */
 499 static bool add_ke(private_quick_mode_t *this, message_t *message)
 500 {
 501         ke_payload_t *ke_payload;
 502
 503         ke_payload = ke_payload_create_from_diffie_hellman(PLV1_KEY_EXCHANGE,
 504                                                                                                            this->dh);
 505         if (!ke_payload)
 506         {
 507                 DBG1(DBG_IKE, "creating KE payload failed");
 508                 return FALSE;
 509         }
 510         message->add_payload(message, &ke_payload->payload_interface);
 511         return TRUE;
 512 }
 513
 514 /**
 515  * Get DH value from a KE payload
 516  */
 517 static bool get_ke(private_quick_mode_t *this, message_t *message)
 518 {
 519         ke_payload_t *ke_payload;
 520
 521         ke_payload = (ke_payload_t*)message->get_payload(message, PLV1_KEY_EXCHANGE);
 522         if (!ke_payload)
 523         {
 524                 DBG1(DBG_IKE, "KE payload missing");
 525                 return FALSE;
 526         }
 527         if (!this->dh->set_other_public_value(this->dh,
 528                                                                 ke_payload->get_key_exchange_data(ke_payload)))
 529         {
 530                 DBG1(DBG_IKE, "unable to apply received KE value");
 531                 return FALSE;
 532         }
 533         return TRUE;
 534 }
 535
 536 /**
 537  * Select a traffic selector from configuration
 538  */
 539 static traffic_selector_t* select_ts(private_quick_mode_t *this, bool local,
 540                                                                          linked_list_t *supplied)
 541 {
 542         traffic_selector_t *ts;
 543         linked_list_t *list, *hosts;
 544
 545         hosts = get_dynamic_hosts(this->ike_sa, local);
 546         list = this->config->get_traffic_selectors(this->config,
 547                                                                                            local, supplied, hosts);
 548         hosts->destroy(hosts);
 549         if (list->get_first(list, (void**)&ts) == SUCCESS)
 550         {
 551                 ts = ts->clone(ts);
 552         }
 553         else
 554         {
 555                 DBG1(DBG_IKE, "%s traffic selector missing in configuration",
 556                          local ? "local" : "remote");
 557                 ts = NULL;
 558         }
 559         list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
 560         return ts;
 561 }
 562
 563 /**
 564  * Add selected traffic selectors to message
 565  */
 566 static void add_ts(private_quick_mode_t *this, message_t *message)
 567 {
 568         id_payload_t *id_payload;
 569
 570         id_payload = id_payload_create_from_ts(this->tsi);
 571         message->add_payload(message, &id_payload->payload_interface);
 572         id_payload = id_payload_create_from_ts(this->tsr);
 573         message->add_payload(message, &id_payload->payload_interface);
 574 }
 575
 576 /**
 577  * Get traffic selectors from received message
 578  */
 579 static bool get_ts(private_quick_mode_t *this, message_t *message)
 580 {
 581         traffic_selector_t *tsi = NULL, *tsr = NULL;
 582         enumerator_t *enumerator;
 583         id_payload_t *id_payload;
 584         payload_t *payload;
 585         host_t *hsi, *hsr;
 586         bool first = TRUE;
 587
 588         enumerator = message->create_payload_enumerator(message);
 589         while (enumerator->enumerate(enumerator, &payload))
 590         {
 591                 if (payload->get_type(payload) == PLV1_ID)
 592                 {
 593                         id_payload = (id_payload_t*)payload;
 594
 595                         if (first)
 596                         {
 597                                 tsi = id_payload->get_ts(id_payload);
 598                                 first = FALSE;
 599                         }
 600                         else
 601                         {
 602                                 tsr = id_payload->get_ts(id_payload);
 603                                 break;
 604                         }
 605                 }
 606         }
 607         enumerator->destroy(enumerator);
 608
 609         /* create host2host selectors if ID payloads missing */
 610         if (this->initiator)
 611         {
 612                 hsi = this->ike_sa->get_my_host(this->ike_sa);
 613                 hsr = this->ike_sa->get_other_host(this->ike_sa);
 614         }
 615         else
 616         {
 617                 hsr = this->ike_sa->get_my_host(this->ike_sa);
 618                 hsi = this->ike_sa->get_other_host(this->ike_sa);
 619         }
 620         if (!tsi)
 621         {
 622                 tsi = traffic_selector_create_from_subnet(hsi->clone(hsi),
 623                                         hsi->get_family(hsi) == AF_INET ? 32 : 128, 0, 0, 65535);
 624         }
 625         if (!tsr)
 626         {
 627                 tsr = traffic_selector_create_from_subnet(hsr->clone(hsr),
 628                                         hsr->get_family(hsr) == AF_INET ? 32 : 128, 0, 0, 65535);
 629         }
 630         if (this->mode == MODE_TRANSPORT && this->udp &&
 631            (!tsi->is_host(tsi, hsi) || !tsr->is_host(tsr, hsr)))
 632         {       /* change TS in case of a NAT in transport mode */
 633                 DBG2(DBG_IKE, "changing received traffic selectors %R=== %R due to NAT",
 634                          tsi, tsr);
 635                 tsi->set_address(tsi, hsi);
 636                 tsr->set_address(tsr, hsr);
 637         }
 638
 639         if (this->initiator)
 640         {
 641                 traffic_selector_t *tsisub, *tsrsub;
 642
 643                 /* check if peer selection is valid */
 644                 tsisub = this->tsi->get_subset(this->tsi, tsi);
 645                 tsrsub = this->tsr->get_subset(this->tsr, tsr);
 646                 if (!tsisub || !tsrsub)
 647                 {
 648                         DBG1(DBG_IKE, "peer selected invalid traffic selectors: "
 649                                  "%R for %R, %R for %R", tsi, this->tsi, tsr, this->tsr);
 650                         DESTROY_IF(tsisub);
 651                         DESTROY_IF(tsrsub);
 652                         tsi->destroy(tsi);
 653                         tsr->destroy(tsr);
 654                         return FALSE;
 655                 }
 656                 tsi->destroy(tsi);
 657                 tsr->destroy(tsr);
 658                 this->tsi->destroy(this->tsi);
 659                 this->tsr->destroy(this->tsr);
 660                 this->tsi = tsisub;
 661                 this->tsr = tsrsub;
 662         }
 663         else
 664         {
 665                 this->tsi = tsi;
 666                 this->tsr = tsr;
 667         }
 668         return TRUE;
 669 }
 670
 671 /**
 672  * Get encap
 673  */
 674 static encap_t get_encap(ike_sa_t* ike_sa, bool udp)
 675 {
 676         if (!udp)
 677         {
 678                 return ENCAP_NONE;
 679         }
 680         if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
 681         {
 682                 return ENCAP_UDP_DRAFT_00_03;
 683         }
 684         return ENCAP_UDP;
 685 }
 686
 687 /**
 688  * Get NAT-OA payload type (RFC 3947 or RFC 3947 drafts).
 689  */
 690 static payload_type_t get_nat_oa_payload_type(ike_sa_t *ike_sa)
 691 {
 692         if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
 693         {
 694                 return PLV1_NAT_OA_DRAFT_00_03;
 695         }
 696         return PLV1_NAT_OA;
 697 }
 698
 699 /**
 700  * Add NAT-OA payloads
 701  */
 702 static void add_nat_oa_payloads(private_quick_mode_t *this, message_t *message)
 703 {
 704         identification_t *id;
 705         id_payload_t *nat_oa;
 706         host_t *init, *resp;
 707         payload_type_t nat_oa_payload_type;
 708
 709         if (this->initiator)
 710         {
 711                 init = message->get_source(message);
 712                 resp = message->get_destination(message);
 713         }
 714         else
 715         {
 716                 init = message->get_destination(message);
 717                 resp = message->get_source(message);
 718         }
 719
 720         nat_oa_payload_type = get_nat_oa_payload_type(this->ike_sa);
 721
 722         /* first NAT-OA is the initiator's address */
 723         id = identification_create_from_sockaddr(init->get_sockaddr(init));
 724         nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
 725         message->add_payload(message, (payload_t*)nat_oa);
 726         id->destroy(id);
 727
 728         /* second NAT-OA is that of the responder */
 729         id = identification_create_from_sockaddr(resp->get_sockaddr(resp));
 730         nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
 731         message->add_payload(message, (payload_t*)nat_oa);
 732         id->destroy(id);
 733 }
 734
 735 /**
 736  * Look up lifetimes
 737  */
 738 static void get_lifetimes(private_quick_mode_t *this)
 739 {
 740         lifetime_cfg_t *lft;
 741
 742         lft = this->config->get_lifetime(this->config, TRUE);
 743         if (lft->time.life)
 744         {
 745                 this->lifetime = lft->time.life;
 746         }
 747         if (lft->bytes.life)
 748         {
 749                 this->lifebytes = lft->bytes.life;
 750         }
 751         free(lft);
 752 }
 753
 754 /**
 755  * Check and apply lifetimes
 756  */
 757 static void apply_lifetimes(private_quick_mode_t *this, sa_payload_t *sa_payload)
 758 {
 759         uint32_t lifetime;
 760         uint64_t lifebytes;
 761
 762         lifetime = sa_payload->get_lifetime(sa_payload);
 763         lifebytes = sa_payload->get_lifebytes(sa_payload);
 764         if (this->lifetime != lifetime)
 765         {
 766                 DBG1(DBG_IKE, "received %us lifetime, configured %us",
 767                          lifetime, this->lifetime);
 768                 this->lifetime = lifetime;
 769         }
 770         if (this->lifebytes != lifebytes)
 771         {
 772                 DBG1(DBG_IKE, "received %llu lifebytes, configured %llu",
 773                          lifebytes, this->lifebytes);
 774                 this->lifebytes = lifebytes;
 775         }
 776 }
 777
 778 /**
 779  * Set the task ready to build notify error message
 780  */
 781 static status_t send_notify(private_quick_mode_t *this, notify_type_t type)
 782 {
 783         notify_payload_t *notify;
 784
 785         notify = notify_payload_create_from_protocol_and_type(PLV1_NOTIFY,
 786                                                                                                                   this->proto, type);
 787         notify->set_spi(notify, this->spi_i);
 788
 789         this->ike_sa->queue_task(this->ike_sa,
 790                                                 (task_t*)informational_create(this->ike_sa, notify));
 791         /* cancel all active/passive tasks in favour of informational */
 792         this->ike_sa->flush_queue(this->ike_sa,
 793                                         this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
 794         return ALREADY_DONE;
 795 }
 796
 797 /**
 798  * Prepare a list of proposals from child_config containing only the specified
 799  * DH group, unless it is set to MODP_NONE.
 800  */
 801 static linked_list_t *get_proposals(private_quick_mode_t *this,
 802                                                                         diffie_hellman_group_t group)
 803 {
 804         linked_list_t *list;
 805         proposal_t *proposal;
 806         enumerator_t *enumerator;
 807
 808         list = this->config->get_proposals(this->config, FALSE);
 809         enumerator = list->create_enumerator(list);
 810         while (enumerator->enumerate(enumerator, &proposal))
 811         {
 812                 if (group != MODP_NONE)
 813                 {
 814                         if (!proposal->has_dh_group(proposal, group))
 815                         {
 816                                 list->remove_at(list, enumerator);
 817                                 proposal->destroy(proposal);
 818                                 continue;
 819                         }
 820                         proposal->strip_dh(proposal, group);
 821                 }
 822                 proposal->set_spi(proposal, this->spi_i);
 823         }
 824         enumerator->destroy(enumerator);
 825
 826         return list;
 827 }
 828
 829 METHOD(task_t, build_i, status_t,
 830         private_quick_mode_t *this, message_t *message)
 831 {
 832         switch (this->state)
 833         {
 834                 case QM_INIT:
 835                 {
 836                         sa_payload_t *sa_payload;
 837                         linked_list_t *list, *tsi, *tsr;
 838                         proposal_t *proposal;
 839                         diffie_hellman_group_t group;
 840                         encap_t encap;
 841
 842                         this->udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
 843                         this->mode = this->config->get_mode(this->config);
 844                         this->child_sa = child_sa_create(
 845                                                                         this->ike_sa->get_my_host(this->ike_sa),
 846                                                                         this->ike_sa->get_other_host(this->ike_sa),
 847                                                                         this->config, this->reqid, this->udp,
 848                                                                         this->mark_in, this->mark_out);
 849
 850                         if (this->udp && this->mode == MODE_TRANSPORT)
 851                         {
 852                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
 853                                 add_nat_oa_payloads(this, message);
 854                         }
 855
 856                         if (this->config->has_option(this->config, OPT_IPCOMP))
 857                         {
 858                                 this->cpi_i = this->child_sa->alloc_cpi(this->child_sa);
 859                                 if (!this->cpi_i)
 860                                 {
 861                                         DBG1(DBG_IKE, "unable to allocate a CPI from kernel, "
 862                                                  "IPComp disabled");
 863                                 }
 864                         }
 865
 866                         list = this->config->get_proposals(this->config, MODP_NONE);
 867                         if (list->get_first(list, (void**)&proposal) == SUCCESS)
 868                         {
 869                                 this->proto = proposal->get_protocol(proposal);
 870                         }
 871                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 872                         this->spi_i = this->child_sa->alloc_spi(this->child_sa, this->proto);
 873                         if (!this->spi_i)
 874                         {
 875                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
 876                                 return FAILED;
 877                         }
 878
 879                         group = this->config->get_dh_group(this->config);
 880                         if (group != MODP_NONE)
 881                         {
 882                                 proposal_t *proposal;
 883                                 uint16_t preferred_group;
 884
 885                                 proposal = this->ike_sa->get_proposal(this->ike_sa);
 886                                 proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP,
 887                                                                                 &preferred_group, NULL);
 888                                 /* try the negotiated DH group from IKE_SA */
 889                                 list = get_proposals(this, preferred_group);
 890                                 if (list->get_count(list))
 891                                 {
 892                                         group = preferred_group;
 893                                 }
 894                                 else
 895                                 {
 896                                         /* fall back to the first configured DH group */
 897                                         list->destroy(list);
 898                                         list = get_proposals(this, group);
 899                                 }
 900
 901                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
 902                                                                                                                   group);
 903                                 if (!this->dh)
 904                                 {
 905                                         DBG1(DBG_IKE, "configured DH group %N not supported",
 906                                                  diffie_hellman_group_names, group);
 907                                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 908                                         return FAILED;
 909                                 }
 910                         }
 911                         else
 912                         {
 913                                 list = get_proposals(this, MODP_NONE);
 914                         }
 915
 916                         get_lifetimes(this);
 917                         encap = get_encap(this->ike_sa, this->udp);
 918                         sa_payload = sa_payload_create_from_proposals_v1(list,
 919                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
 920                                                                 this->mode, encap, this->cpi_i);
 921                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 922                         message->add_payload(message, &sa_payload->payload_interface);
 923
 924                         if (!add_nonce(this, &this->nonce_i, message))
 925                         {
 926                                 return FAILED;
 927                         }
 928                         if (group != MODP_NONE)
 929                         {
 930                                 if (!add_ke(this, message))
 931                                 {
 932                                         return FAILED;
 933                                 }
 934                         }
 935                         if (!this->tsi)
 936                         {
 937                                 this->tsi = select_ts(this, TRUE, NULL);
 938                         }
 939                         if (!this->tsr)
 940                         {
 941                                 this->tsr = select_ts(this, FALSE, NULL);
 942                         }
 943                         tsi = linked_list_create_with_items(this->tsi, NULL);
 944                         tsr = linked_list_create_with_items(this->tsr, NULL);
 945                         this->tsi = this->tsr = NULL;
 946                         charon->bus->narrow(charon->bus, this->child_sa,
 947                                                                 NARROW_INITIATOR_PRE_AUTH, tsi, tsr);
 948                         tsi->remove_first(tsi, (void**)&this->tsi);
 949                         tsr->remove_first(tsr, (void**)&this->tsr);
 950                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 951                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 952                         if (!this->tsi || !this->tsr)
 953                         {
 954                                 return FAILED;
 955                         }
 956                         add_ts(this, message);
 957                         return NEED_MORE;
 958                 }
 959                 case QM_NEGOTIATED:
 960                 {
 961                         return SUCCESS;
 962                 }
 963                 default:
 964                         return FAILED;
 965         }
 966 }
 967
 968 /**
 969  * Check for notify errors, return TRUE if error found
 970  */
 971 static bool has_notify_errors(private_quick_mode_t *this, message_t *message)
 972 {
 973         enumerator_t *enumerator;
 974         payload_t *payload;
 975         bool err = FALSE;
 976
 977         enumerator = message->create_payload_enumerator(message);
 978         while (enumerator->enumerate(enumerator, &payload))
 979         {
 980                 if (payload->get_type(payload) == PLV1_NOTIFY)
 981                 {
 982                         notify_payload_t *notify;
 983                         notify_type_t type;
 984
 985                         notify = (notify_payload_t*)payload;
 986                         type = notify->get_notify_type(notify);
 987                         if (type < 16384)
 988                         {
 989
 990                                 DBG1(DBG_IKE, "received %N error notify",
 991                                          notify_type_names, type);
 992                                 err = TRUE;
 993                         }
 994                         else
 995                         {
 996                                 DBG1(DBG_IKE, "received %N notify", notify_type_names, type);
 997                         }
 998                 }
 999         }
1000         enumerator->destroy(enumerator);
1001
1002         return err;
1003 }
1004
1005 /**
1006  * Check if this is a rekey for an existing CHILD_SA, reuse reqid if so
1007  */
1008 static void check_for_rekeyed_child(private_quick_mode_t *this, bool responder)
1009 {
1010         enumerator_t *enumerator, *policies;
1011         traffic_selector_t *local, *remote, *my_ts, *other_ts;
1012         child_sa_t *child_sa;
1013         proposal_t *proposal;
1014         char *name;
1015
1016         if (responder)
1017         {
1018                 my_ts = this->tsr;
1019                 other_ts = this->tsi;
1020         }
1021         else
1022         {
1023                 my_ts = this->tsi;
1024                 other_ts = this->tsr;
1025         }
1026
1027         name = this->config->get_name(this->config);
1028         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1029         while (this->reqid == 0 && enumerator->enumerate(enumerator, &child_sa))
1030         {
1031                 if (streq(child_sa->get_name(child_sa), name))
1032                 {
1033                         proposal = child_sa->get_proposal(child_sa);
1034                         switch (child_sa->get_state(child_sa))
1035                         {
1036                                 case CHILD_INSTALLED:
1037                                 case CHILD_REKEYING:
1038                                         policies = child_sa->create_policy_enumerator(child_sa);
1039                                         if (policies->enumerate(policies, &local, &remote) &&
1040                                                 local->equals(local, my_ts) &&
1041                                                 remote->equals(remote, other_ts) &&
1042                                                 this->proposal->equals(this->proposal, proposal))
1043                                         {
1044                                                 this->reqid = child_sa->get_reqid(child_sa);
1045                                                 this->rekey = child_sa->get_spi(child_sa, TRUE);
1046                                                 this->mark_in = child_sa->get_mark(child_sa,
1047                                                                                                                         TRUE).value;
1048                                                 this->mark_out = child_sa->get_mark(child_sa,
1049                                                                                                                         FALSE).value;
1050                                                 child_sa->set_state(child_sa, CHILD_REKEYING);
1051                                                 DBG1(DBG_IKE, "detected rekeying of CHILD_SA %s{%u}",
1052                                                          child_sa->get_name(child_sa),
1053                                                          child_sa->get_unique_id(child_sa));
1054                                         }
1055                                         policies->destroy(policies);
1056                                         break;
1057                                 case CHILD_REKEYED:
1058                                 default:
1059                                         break;
1060                         }
1061                 }
1062         }
1063         enumerator->destroy(enumerator);
1064 }
1065
1066 METHOD(task_t, process_r, status_t,
1067         private_quick_mode_t *this, message_t *message)
1068 {
1069         if (this->mid && this->mid != message->get_message_id(message))
1070         {       /* not responsible for this quick mode exchange */
1071                 return INVALID_ARG;
1072         }
1073
1074         switch (this->state)
1075         {
1076                 case QM_INIT:
1077                 {
1078                         sa_payload_t *sa_payload;
1079                         linked_list_t *tsi, *tsr, *hostsi, *hostsr, *list = NULL;
1080                         peer_cfg_t *peer_cfg;
1081                         uint16_t group;
1082                         bool private, prefer_configured;
1083
1084                         sa_payload = (sa_payload_t*)message->get_payload(message,
1085                                                                                                         PLV1_SECURITY_ASSOCIATION);
1086                         if (!sa_payload)
1087                         {
1088                                 DBG1(DBG_IKE, "sa payload missing");
1089                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1090                         }
1091
1092                         this->mode = sa_payload->get_encap_mode(sa_payload, &this->udp);
1093
1094                         if (!get_ts(this, message))
1095                         {
1096                                 return FAILED;
1097                         }
1098                         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1099                         tsi = linked_list_create_with_items(this->tsi, NULL);
1100                         tsr = linked_list_create_with_items(this->tsr, NULL);
1101                         this->tsi = this->tsr = NULL;
1102                         hostsi = get_dynamic_hosts(this->ike_sa, FALSE);
1103                         hostsr = get_dynamic_hosts(this->ike_sa, TRUE);
1104                         this->config = peer_cfg->select_child_cfg(peer_cfg, tsr, tsi,
1105                                                                                                           hostsr, hostsi);
1106                         hostsi->destroy(hostsi);
1107                         hostsr->destroy(hostsr);
1108                         if (this->config)
1109                         {
1110                                 this->tsi = select_ts(this, FALSE, tsi);
1111                                 this->tsr = select_ts(this, TRUE, tsr);
1112                         }
1113                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1114                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1115                         if (!this->config || !this->tsi || !this->tsr ||
1116                                 this->mode != this->config->get_mode(this->config))
1117                         {
1118                                 DBG1(DBG_IKE, "no matching CHILD_SA config found");
1119                                 return send_notify(this, INVALID_ID_INFORMATION);
1120                         }
1121
1122                         if (this->config->has_option(this->config, OPT_IPCOMP))
1123                         {
1124                                 list = sa_payload->get_ipcomp_proposals(sa_payload,
1125                                                                                                                 &this->cpi_i);
1126                                 if (!list->get_count(list))
1127                                 {
1128                                         DBG1(DBG_IKE, "expected IPComp proposal but peer did "
1129                                                  "not send one, IPComp disabled");
1130                                         this->cpi_i = 0;
1131                                 }
1132                         }
1133                         if (!list || !list->get_count(list))
1134                         {
1135                                 DESTROY_IF(list);
1136                                 list = sa_payload->get_proposals(sa_payload);
1137                         }
1138                         private = this->ike_sa->supports_extension(this->ike_sa,
1139                                                                                                            EXT_STRONGSWAN);
1140                         prefer_configured = lib->settings->get_bool(lib->settings,
1141                                                         "%s.prefer_configured_proposals", TRUE, lib->ns);
1142                         this->proposal = this->config->select_proposal(this->config, list,
1143                                                                                         FALSE, private, prefer_configured);
1144                         list->destroy_offset(list, offsetof(proposal_t, destroy));
1145
1146                         get_lifetimes(this);
1147                         apply_lifetimes(this, sa_payload);
1148
1149                         if (!this->proposal)
1150                         {
1151                                 DBG1(DBG_IKE, "no matching proposal found, sending %N",
1152                                          notify_type_names, NO_PROPOSAL_CHOSEN);
1153                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1154                         }
1155                         this->spi_i = this->proposal->get_spi(this->proposal);
1156
1157                         if (!get_nonce(this, &this->nonce_i, message))
1158                         {
1159                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1160                         }
1161
1162                         if (this->proposal->get_algorithm(this->proposal,
1163                                                                                 DIFFIE_HELLMAN_GROUP, &group, NULL))
1164                         {
1165                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
1166                                                                                                                   group);
1167                                 if (!this->dh)
1168                                 {
1169                                         DBG1(DBG_IKE, "negotiated DH group %N not supported",
1170                                                  diffie_hellman_group_names, group);
1171                                         return send_notify(this, INVALID_KEY_INFORMATION);
1172                                 }
1173                                 if (!get_ke(this, message))
1174                                 {
1175                                         return send_notify(this, INVALID_PAYLOAD_TYPE);
1176                                 }
1177                         }
1178
1179                         check_for_rekeyed_child(this, TRUE);
1180
1181                         this->child_sa = child_sa_create(
1182                                                                         this->ike_sa->get_my_host(this->ike_sa),
1183                                                                         this->ike_sa->get_other_host(this->ike_sa),
1184                                                                         this->config, this->reqid, this->udp,
1185                                                                         this->mark_in, this->mark_out);
1186
1187                         tsi = linked_list_create_with_items(this->tsi, NULL);
1188                         tsr = linked_list_create_with_items(this->tsr, NULL);
1189                         this->tsi = this->tsr = NULL;
1190                         charon->bus->narrow(charon->bus, this->child_sa,
1191                                                                 NARROW_RESPONDER, tsr, tsi);
1192                         if (tsi->remove_first(tsi, (void**)&this->tsi) != SUCCESS ||
1193                                 tsr->remove_first(tsr, (void**)&this->tsr) != SUCCESS)
1194                         {
1195                                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1196                                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1197                                 return send_notify(this, INVALID_ID_INFORMATION);
1198                         }
1199                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1200                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1201
1202                         return NEED_MORE;
1203                 }
1204                 case QM_NEGOTIATED:
1205                 {
1206                         if (has_notify_errors(this, message))
1207                         {
1208                                 return SUCCESS;
1209                         }
1210                         if (message->get_exchange_type(message) == INFORMATIONAL_V1)
1211                         {
1212                                 if (message->get_payload(message, PLV1_DELETE))
1213                                 {
1214                                         /* If the DELETE for a Quick Mode follows immediately
1215                                          * after rekeying, we might receive it before the
1216                                          * third completing Quick Mode message. Ignore it, as
1217                                          * it gets handled by a separately queued delete task. */
1218                                         return NEED_MORE;
1219                                 }
1220                                 return SUCCESS;
1221                         }
1222                         if (!install(this))
1223                         {
1224                                 ike_sa_t *ike_sa = this->ike_sa;
1225                                 task_t *task;
1226
1227                                 task = (task_t*)quick_delete_create(this->ike_sa,
1228                                                                 this->proposal->get_protocol(this->proposal),
1229                                                                 this->spi_i, TRUE, TRUE);
1230                                 /* flush_queue() destroys the current task */
1231                                 ike_sa->flush_queue(ike_sa, TASK_QUEUE_PASSIVE);
1232                                 ike_sa->queue_task(ike_sa, task);
1233                                 return ALREADY_DONE;
1234                         }
1235                         return SUCCESS;
1236                 }
1237                 default:
1238                         return FAILED;
1239         }
1240 }
1241
1242 METHOD(task_t, build_r, status_t,
1243         private_quick_mode_t *this, message_t *message)
1244 {
1245         if (this->mid && this->mid != message->get_message_id(message))
1246         {       /* not responsible for this quick mode exchange */
1247                 return INVALID_ARG;
1248         }
1249
1250         switch (this->state)
1251         {
1252                 case QM_INIT:
1253                 {
1254                         sa_payload_t *sa_payload;
1255                         encap_t encap;
1256
1257                         this->proto = this->proposal->get_protocol(this->proposal);
1258                         this->spi_r = this->child_sa->alloc_spi(this->child_sa, this->proto);
1259                         if (!this->spi_r)
1260                         {
1261                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
1262                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1263                         }
1264                         this->proposal->set_spi(this->proposal, this->spi_r);
1265
1266                         if (this->cpi_i)
1267                         {
1268                                 this->cpi_r = this->child_sa->alloc_cpi(this->child_sa);
1269                                 if (!this->cpi_r)
1270                                 {
1271                                         DBG1(DBG_IKE, "unable to allocate a CPI from "
1272                                                  "kernel, IPComp disabled");
1273                                         return send_notify(this, NO_PROPOSAL_CHOSEN);
1274                                 }
1275                         }
1276
1277                         if (this->udp && this->mode == MODE_TRANSPORT)
1278                         {
1279                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
1280                                 add_nat_oa_payloads(this, message);
1281                         }
1282
1283                         encap = get_encap(this->ike_sa, this->udp);
1284                         sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
1285                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
1286                                                                 this->mode, encap, this->cpi_r);
1287                         message->add_payload(message, &sa_payload->payload_interface);
1288
1289                         if (!add_nonce(this, &this->nonce_r, message))
1290                         {
1291                                 return FAILED;
1292                         }
1293                         if (this->dh)
1294                         {
1295                                 if (!add_ke(this, message))
1296                                 {
1297                                         return FAILED;
1298                                 }
1299                         }
1300
1301                         add_ts(this, message);
1302
1303                         this->state = QM_NEGOTIATED;
1304                         this->mid = message->get_message_id(message);
1305                         return NEED_MORE;
1306                 }
1307                 case QM_NEGOTIATED:
1308                         if (message->get_exchange_type(message) == INFORMATIONAL_V1)
1309                         {
1310                                 /* skip INFORMATIONAL response if we received a INFORMATIONAL
1311                                  * delete, see process_r() */
1312                                 return ALREADY_DONE;
1313                         }
1314                         /* fall */
1315                 default:
1316                         return FAILED;
1317         }
1318 }
1319
1320 METHOD(task_t, process_i, status_t,
1321         private_quick_mode_t *this, message_t *message)
1322 {
1323         switch (this->state)
1324         {
1325                 case QM_INIT:
1326                 {
1327                         sa_payload_t *sa_payload;
1328                         linked_list_t *list = NULL;
1329                         bool private;
1330
1331                         sa_payload = (sa_payload_t*)message->get_payload(message,
1332                                                                                                         PLV1_SECURITY_ASSOCIATION);
1333                         if (!sa_payload)
1334                         {
1335                                 DBG1(DBG_IKE, "sa payload missing");
1336                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1337                         }
1338                         if (this->cpi_i)
1339                         {
1340                                 list = sa_payload->get_ipcomp_proposals(sa_payload,
1341                                                                                                                 &this->cpi_r);
1342                                 if (!list->get_count(list))
1343                                 {
1344                                         DBG1(DBG_IKE, "peer did not accept our IPComp proposal, "
1345                                                  "IPComp disabled");
1346                                         this->cpi_i = 0;
1347                                 }
1348                         }
1349                         if (!list || !list->get_count(list))
1350                         {
1351                                 DESTROY_IF(list);
1352                                 list = sa_payload->get_proposals(sa_payload);
1353                         }
1354                         private = this->ike_sa->supports_extension(this->ike_sa,
1355                                                                                                            EXT_STRONGSWAN);
1356                         this->proposal = this->config->select_proposal(this->config, list,
1357                                                                                                                 FALSE, private, TRUE);
1358                         list->destroy_offset(list, offsetof(proposal_t, destroy));
1359                         if (!this->proposal)
1360                         {
1361                                 DBG1(DBG_IKE, "no matching proposal found");
1362                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1363                         }
1364                         this->spi_r = this->proposal->get_spi(this->proposal);
1365
1366                         apply_lifetimes(this, sa_payload);
1367
1368                         if (!get_nonce(this, &this->nonce_r, message))
1369                         {
1370                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1371                         }
1372                         if (this->dh && !get_ke(this, message))
1373                         {
1374                                 return send_notify(this, INVALID_KEY_INFORMATION);
1375                         }
1376                         if (!get_ts(this, message))
1377                         {
1378                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1379                         }
1380                         check_for_rekeyed_child(this, FALSE);
1381                         if (!install(this))
1382                         {
1383                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1384                         }
1385                         this->state = QM_NEGOTIATED;
1386                         return NEED_MORE;
1387                 }
1388                 default:
1389                         return FAILED;
1390         }
1391 }
1392
1393 METHOD(task_t, get_type, task_type_t,
1394         private_quick_mode_t *this)
1395 {
1396         return TASK_QUICK_MODE;
1397 }
1398
1399 METHOD(quick_mode_t, get_mid, uint32_t,
1400         private_quick_mode_t *this)
1401 {
1402         return this->mid;
1403 }
1404
1405 METHOD(quick_mode_t, use_reqid, void,
1406         private_quick_mode_t *this, uint32_t reqid)
1407 {
1408         this->reqid = reqid;
1409 }
1410
1411 METHOD(quick_mode_t, use_marks, void,
1412         private_quick_mode_t *this, u_int in, u_int out)
1413 {
1414         this->mark_in = in;
1415         this->mark_out = out;
1416 }
1417
1418 METHOD(quick_mode_t, rekey, void,
1419         private_quick_mode_t *this, uint32_t spi)
1420 {
1421         this->rekey = spi;
1422 }
1423
1424 METHOD(task_t, migrate, void,
1425         private_quick_mode_t *this, ike_sa_t *ike_sa)
1426 {
1427         chunk_free(&this->nonce_i);
1428         chunk_free(&this->nonce_r);
1429         DESTROY_IF(this->tsi);
1430         DESTROY_IF(this->tsr);
1431         DESTROY_IF(this->proposal);
1432         DESTROY_IF(this->child_sa);
1433         DESTROY_IF(this->dh);
1434
1435         this->ike_sa = ike_sa;
1436         this->keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa);
1437         this->state = QM_INIT;
1438         this->mid = 0;
1439         this->tsi = NULL;
1440         this->tsr = NULL;
1441         this->proposal = NULL;
1442         this->child_sa = NULL;
1443         this->dh = NULL;
1444         this->spi_i = 0;
1445         this->spi_r = 0;
1446         this->mark_in = 0;
1447         this->mark_out = 0;
1448
1449         if (!this->initiator)
1450         {
1451                 DESTROY_IF(this->config);
1452                 this->config = NULL;
1453         }
1454 }
1455
1456 METHOD(task_t, destroy, void,
1457         private_quick_mode_t *this)
1458 {
1459         chunk_free(&this->nonce_i);
1460         chunk_free(&this->nonce_r);
1461         DESTROY_IF(this->tsi);
1462         DESTROY_IF(this->tsr);
1463         DESTROY_IF(this->proposal);
1464         DESTROY_IF(this->child_sa);
1465         DESTROY_IF(this->config);
1466         DESTROY_IF(this->dh);
1467         free(this);
1468 }
1469
1470 /*
1471  * Described in header.
1472  */
1473 quick_mode_t *quick_mode_create(ike_sa_t *ike_sa, child_cfg_t *config,
1474                                                         traffic_selector_t *tsi, traffic_selector_t *tsr)
1475 {
1476         private_quick_mode_t *this;
1477
1478         INIT(this,
1479                 .public = {
1480                         .task = {
1481                                 .get_type = _get_type,
1482                                 .migrate = _migrate,
1483                                 .destroy = _destroy,
1484                         },
1485                         .get_mid = _get_mid,
1486                         .use_reqid = _use_reqid,
1487                         .use_marks = _use_marks,
1488                         .rekey = _rekey,
1489                 },
1490                 .ike_sa = ike_sa,
1491                 .initiator = config != NULL,
1492                 .config = config,
1493                 .keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa),
1494                 .state = QM_INIT,
1495                 .tsi = tsi ? tsi->clone(tsi) : NULL,
1496                 .tsr = tsr ? tsr->clone(tsr) : NULL,
1497                 .proto = PROTO_ESP,
1498                 .delete = lib->settings->get_bool(lib->settings,
1499                                                                                   "%s.delete_rekeyed", FALSE, lib->ns),
1500         );
1501
1502         if (config)
1503         {
1504                 this->public.task.build = _build_i;
1505                 this->public.task.process = _process_i;
1506         }
1507         else
1508         {
1509                 this->public.task.build = _build_r;
1510                 this->public.task.process = _process_r;
1511         }
1512
1513         return &this->public;
1514 }