src/libcharon/sa/ikev1/tasks/quick_mode.c

   1 /*
   2  * Copyright (C) 2012 Tobias Brunner
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * Copyright (C) 2011 Martin Willi
   6  * Copyright (C) 2011 revosec AG
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 /*
  20  * Copyright (C) 2012 Volker Rümelin
  21  *
  22  * Permission is hereby granted, free of charge, to any person obtaining a copy
  23  * of this software and associated documentation files (the "Software"), to deal
  24  * in the Software without restriction, including without limitation the rights
  25  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  26  * copies of the Software, and to permit persons to whom the Software is
  27  * furnished to do so, subject to the following conditions:
  28  *
  29  * The above copyright notice and this permission notice shall be included in
  30  * all copies or substantial portions of the Software.
  31  *
  32  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  33  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  34  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  35  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  36  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  37  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  38  * THE SOFTWARE.
  39  */
  40
  41 #include "quick_mode.h"
  42
  43 #include <string.h>
  44
  45 #include <daemon.h>
  46 #include <sa/ikev1/keymat_v1.h>
  47 #include <encoding/payloads/sa_payload.h>
  48 #include <encoding/payloads/nonce_payload.h>
  49 #include <encoding/payloads/ke_payload.h>
  50 #include <encoding/payloads/id_payload.h>
  51 #include <encoding/payloads/payload.h>
  52 #include <sa/ikev1/tasks/informational.h>
  53 #include <sa/ikev1/tasks/quick_delete.h>
  54 #include <processing/jobs/inactivity_job.h>
  55
  56 typedef struct private_quick_mode_t private_quick_mode_t;
  57
  58 /**
  59  * Private members of a quick_mode_t task.
  60  */
  61 struct private_quick_mode_t {
  62
  63         /**
  64          * Public methods and task_t interface.
  65          */
  66         quick_mode_t public;
  67
  68         /**
  69          * Assigned IKE_SA.
  70          */
  71         ike_sa_t *ike_sa;
  72
  73         /**
  74          * TRUE if we are initiating quick mode
  75          */
  76         bool initiator;
  77
  78         /**
  79          * Traffic selector of initiator
  80          */
  81         traffic_selector_t *tsi;
  82
  83         /**
  84          * Traffic selector of responder
  85          */
  86         traffic_selector_t *tsr;
  87
  88         /**
  89          * Initiators nonce
  90          */
  91         chunk_t nonce_i;
  92
  93         /**
  94          * Responder nonce
  95          */
  96         chunk_t nonce_r;
  97
  98         /**
  99          * Initiators ESP SPI
 100          */
 101         u_int32_t spi_i;
 102
 103         /**
 104          * Responder ESP SPI
 105          */
 106         u_int32_t spi_r;
 107
 108         /**
 109          * Initiators IPComp CPI
 110          */
 111         u_int16_t cpi_i;
 112
 113         /**
 114          * Responders IPComp CPI
 115          */
 116         u_int16_t cpi_r;
 117
 118         /**
 119          * selected CHILD_SA proposal
 120          */
 121         proposal_t *proposal;
 122
 123         /**
 124          * Config of CHILD_SA to establish
 125          */
 126         child_cfg_t *config;
 127
 128         /**
 129          * CHILD_SA we are about to establish
 130          */
 131         child_sa_t *child_sa;
 132
 133         /**
 134          * IKEv1 keymat
 135          */
 136         keymat_v1_t *keymat;
 137
 138         /**
 139          * DH exchange, when PFS is in use
 140          */
 141         diffie_hellman_t *dh;
 142
 143         /**
 144          * Negotiated lifetime of new SA
 145          */
 146         u_int32_t lifetime;
 147
 148         /**
 149          * Negotaited lifebytes of new SA
 150          */
 151         u_int64_t lifebytes;
 152
 153         /**
 154          * Reqid to use, 0 for auto-allocate
 155          */
 156         u_int32_t reqid;
 157
 158         /**
 159          * Explicit inbound mark value to use, if any
 160          */
 161         u_int mark_in;
 162
 163         /**
 164          * Explicit inbound mark value to use, if any
 165          */
 166         u_int mark_out;
 167
 168         /**
 169          * SPI of SA we rekey
 170          */
 171         u_int32_t rekey;
 172
 173         /**
 174          * Negotiated mode, tunnel or transport
 175          */
 176         ipsec_mode_t mode;
 177
 178         /*
 179          * SA protocol (ESP|AH) negotiated
 180          */
 181         protocol_id_t proto;
 182
 183         /**
 184          * Use UDP encapsulation
 185          */
 186         bool udp;
 187
 188         /** states of quick mode */
 189         enum {
 190                 QM_INIT,
 191                 QM_NEGOTIATED,
 192         } state;
 193 };
 194
 195 /**
 196  * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
 197  */
 198 static void schedule_inactivity_timeout(private_quick_mode_t *this)
 199 {
 200         u_int32_t timeout;
 201         bool close_ike;
 202
 203         timeout = this->config->get_inactivity(this->config);
 204         if (timeout)
 205         {
 206                 close_ike = lib->settings->get_bool(lib->settings,
 207                                                                         "%s.inactivity_close_ike", FALSE, lib->ns);
 208                 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
 209                         inactivity_job_create(this->child_sa->get_unique_id(this->child_sa),
 210                                                                   timeout, close_ike), timeout);
 211         }
 212 }
 213
 214 /**
 215  * Check if we have a an address pool configured
 216  */
 217 static bool have_pool(ike_sa_t *ike_sa)
 218 {
 219         enumerator_t *enumerator;
 220         peer_cfg_t *peer_cfg;
 221         char *pool;
 222         bool found = FALSE;
 223
 224         peer_cfg = ike_sa->get_peer_cfg(ike_sa);
 225         if (peer_cfg)
 226         {
 227                 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
 228                 if (enumerator->enumerate(enumerator, &pool))
 229                 {
 230                         found = TRUE;
 231                 }
 232                 enumerator->destroy(enumerator);
 233         }
 234         return found;
 235 }
 236
 237 /**
 238  * Get hosts to use for dynamic traffic selectors
 239  */
 240 static linked_list_t *get_dynamic_hosts(ike_sa_t *ike_sa, bool local)
 241 {
 242         enumerator_t *enumerator;
 243         linked_list_t *list;
 244         host_t *host;
 245
 246         list = linked_list_create();
 247         enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
 248         while (enumerator->enumerate(enumerator, &host))
 249         {
 250                 list->insert_last(list, host);
 251         }
 252         enumerator->destroy(enumerator);
 253
 254         if (list->get_count(list) == 0)
 255         {       /* no virtual IPs assigned */
 256                 if (local)
 257                 {
 258                         host = ike_sa->get_my_host(ike_sa);
 259                         list->insert_last(list, host);
 260                 }
 261                 else if (!have_pool(ike_sa))
 262                 {       /* use host only if we don't have a pool configured */
 263                         host = ike_sa->get_other_host(ike_sa);
 264                         list->insert_last(list, host);
 265                 }
 266         }
 267         return list;
 268 }
 269
 270 /**
 271  * Install negotiated CHILD_SA
 272  */
 273 static bool install(private_quick_mode_t *this)
 274 {
 275         status_t status, status_i, status_o;
 276         chunk_t encr_i, encr_r, integ_i, integ_r;
 277         linked_list_t *tsi, *tsr, *my_ts, *other_ts;
 278         child_sa_t *old = NULL;
 279
 280         this->child_sa->set_proposal(this->child_sa, this->proposal);
 281         this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
 282         this->child_sa->set_mode(this->child_sa, this->mode);
 283
 284         if (this->cpi_i && this->cpi_r)
 285         {       /* DEFLATE is the only transform we currently support */
 286                 this->child_sa->set_ipcomp(this->child_sa, IPCOMP_DEFLATE);
 287         }
 288         else
 289         {
 290                 this->cpi_i = this->cpi_r = 0;
 291         }
 292
 293         this->child_sa->set_protocol(this->child_sa,
 294                                                                  this->proposal->get_protocol(this->proposal));
 295
 296         status_i = status_o = FAILED;
 297         encr_i = encr_r = integ_i = integ_r = chunk_empty;
 298         tsi = linked_list_create_with_items(this->tsi->clone(this->tsi), NULL);
 299         tsr = linked_list_create_with_items(this->tsr->clone(this->tsr), NULL);
 300         if (this->initiator)
 301         {
 302                 charon->bus->narrow(charon->bus, this->child_sa,
 303                                                         NARROW_INITIATOR_POST_AUTH, tsi, tsr);
 304         }
 305         else
 306         {
 307                 charon->bus->narrow(charon->bus, this->child_sa,
 308                                                         NARROW_RESPONDER_POST, tsr, tsi);
 309         }
 310         if (tsi->get_count(tsi) == 0 || tsr->get_count(tsr) == 0)
 311         {
 312                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 313                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 314                 DBG1(DBG_IKE, "no acceptable traffic selectors found");
 315                 return FALSE;
 316         }
 317
 318         if (this->keymat->derive_child_keys(this->keymat, this->proposal, this->dh,
 319                                                 this->spi_i, this->spi_r, this->nonce_i, this->nonce_r,
 320                                                 &encr_i, &integ_i, &encr_r, &integ_r))
 321         {
 322                 if (this->initiator)
 323                 {
 324                         status_i = this->child_sa->install(this->child_sa,
 325                                                                         encr_r, integ_r, this->spi_i, this->cpi_i,
 326                                                                         this->initiator, TRUE, FALSE, tsi, tsr);
 327                         status_o = this->child_sa->install(this->child_sa,
 328                                                                         encr_i, integ_i, this->spi_r, this->cpi_r,
 329                                                                         this->initiator, FALSE, FALSE, tsi, tsr);
 330                 }
 331                 else
 332                 {
 333                         status_i = this->child_sa->install(this->child_sa,
 334                                                                         encr_i, integ_i, this->spi_r, this->cpi_r,
 335                                                                         this->initiator, TRUE, FALSE, tsr, tsi);
 336                         status_o = this->child_sa->install(this->child_sa,
 337                                                                         encr_r, integ_r, this->spi_i, this->cpi_i,
 338                                                                         this->initiator, FALSE, FALSE, tsr, tsi);
 339                 }
 340         }
 341         chunk_clear(&integ_i);
 342         chunk_clear(&integ_r);
 343         chunk_clear(&encr_i);
 344         chunk_clear(&encr_r);
 345
 346         if (status_i != SUCCESS || status_o != SUCCESS)
 347         {
 348                 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
 349                         (status_i != SUCCESS) ? "inbound " : "",
 350                         (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
 351                         (status_o != SUCCESS) ? "outbound " : "");
 352                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 353                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 354                 return FALSE;
 355         }
 356
 357         if (this->initiator)
 358         {
 359                 status = this->child_sa->add_policies(this->child_sa, tsi, tsr);
 360         }
 361         else
 362         {
 363                 status = this->child_sa->add_policies(this->child_sa, tsr, tsi);
 364         }
 365         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 366         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 367         if (status != SUCCESS)
 368         {
 369                 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
 370                 return FALSE;
 371         }
 372
 373         charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
 374                                                         this->dh, this->nonce_i, this->nonce_r);
 375
 376         /* add to IKE_SA, and remove from task */
 377         this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 378         this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
 379
 380         my_ts = linked_list_create_from_enumerator(
 381                                 this->child_sa->create_ts_enumerator(this->child_sa, TRUE));
 382         other_ts = linked_list_create_from_enumerator(
 383                                 this->child_sa->create_ts_enumerator(this->child_sa, FALSE));
 384
 385         DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
 386                  "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
 387                  this->child_sa->get_name(this->child_sa),
 388                  this->child_sa->get_unique_id(this->child_sa),
 389                  ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
 390                  ntohl(this->child_sa->get_spi(this->child_sa, FALSE)), my_ts, other_ts);
 391
 392         my_ts->destroy(my_ts);
 393         other_ts->destroy(other_ts);
 394
 395         if (this->rekey)
 396         {
 397                 old = this->ike_sa->get_child_sa(this->ike_sa,
 398                                                                 this->proposal->get_protocol(this->proposal),
 399                                                                 this->rekey, TRUE);
 400         }
 401         if (old)
 402         {
 403                 charon->bus->child_rekey(charon->bus, old, this->child_sa);
 404                 /* rekeyed CHILD_SAs stay installed until they expire */
 405                 old->set_state(old, CHILD_INSTALLED);
 406         }
 407         else
 408         {
 409                 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
 410         }
 411         schedule_inactivity_timeout(this);
 412         this->child_sa = NULL;
 413         return TRUE;
 414 }
 415
 416 /**
 417  * Generate and add NONCE
 418  */
 419 static bool add_nonce(private_quick_mode_t *this, chunk_t *nonce,
 420                                           message_t *message)
 421 {
 422         nonce_payload_t *nonce_payload;
 423         nonce_gen_t *nonceg;
 424
 425         nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
 426         if (!nonceg)
 427         {
 428                 DBG1(DBG_IKE, "no nonce generator found to create nonce");
 429                 return FALSE;
 430         }
 431         if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, nonce))
 432         {
 433                 DBG1(DBG_IKE, "nonce allocation failed");
 434                 nonceg->destroy(nonceg);
 435                 return FALSE;
 436         }
 437         nonceg->destroy(nonceg);
 438
 439         nonce_payload = nonce_payload_create(PLV1_NONCE);
 440         nonce_payload->set_nonce(nonce_payload, *nonce);
 441         message->add_payload(message, &nonce_payload->payload_interface);
 442
 443         return TRUE;
 444 }
 445
 446 /**
 447  * Extract nonce from NONCE payload
 448  */
 449 static bool get_nonce(private_quick_mode_t *this, chunk_t *nonce,
 450                                           message_t *message)
 451 {
 452         nonce_payload_t *nonce_payload;
 453
 454         nonce_payload = (nonce_payload_t*)message->get_payload(message, PLV1_NONCE);
 455         if (!nonce_payload)
 456         {
 457                 DBG1(DBG_IKE, "NONCE payload missing in message");
 458                 return FALSE;
 459         }
 460         *nonce = nonce_payload->get_nonce(nonce_payload);
 461
 462         return TRUE;
 463 }
 464
 465 /**
 466  * Add KE payload to message
 467  */
 468 static void add_ke(private_quick_mode_t *this, message_t *message)
 469 {
 470         ke_payload_t *ke_payload;
 471
 472         ke_payload = ke_payload_create_from_diffie_hellman(PLV1_KEY_EXCHANGE, this->dh);
 473         message->add_payload(message, &ke_payload->payload_interface);
 474 }
 475
 476 /**
 477  * Get DH value from a KE payload
 478  */
 479 static bool get_ke(private_quick_mode_t *this, message_t *message)
 480 {
 481         ke_payload_t *ke_payload;
 482
 483         ke_payload = (ke_payload_t*)message->get_payload(message, PLV1_KEY_EXCHANGE);
 484         if (!ke_payload)
 485         {
 486                 DBG1(DBG_IKE, "KE payload missing");
 487                 return FALSE;
 488         }
 489         this->dh->set_other_public_value(this->dh,
 490                                                                 ke_payload->get_key_exchange_data(ke_payload));
 491         return TRUE;
 492 }
 493
 494 /**
 495  * Select a traffic selector from configuration
 496  */
 497 static traffic_selector_t* select_ts(private_quick_mode_t *this, bool local,
 498                                                                          linked_list_t *supplied)
 499 {
 500         traffic_selector_t *ts;
 501         linked_list_t *list, *hosts;
 502
 503         hosts = get_dynamic_hosts(this->ike_sa, local);
 504         list = this->config->get_traffic_selectors(this->config,
 505                                                                                            local, supplied, hosts);
 506         hosts->destroy(hosts);
 507         if (list->get_first(list, (void**)&ts) == SUCCESS)
 508         {
 509                 ts = ts->clone(ts);
 510         }
 511         else
 512         {
 513                 DBG1(DBG_IKE, "%s traffic selector missing in configuration",
 514                          local ? "local" : "remote");
 515                 ts = NULL;
 516         }
 517         list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
 518         return ts;
 519 }
 520
 521 /**
 522  * Add selected traffic selectors to message
 523  */
 524 static void add_ts(private_quick_mode_t *this, message_t *message)
 525 {
 526         id_payload_t *id_payload;
 527
 528         id_payload = id_payload_create_from_ts(this->tsi);
 529         message->add_payload(message, &id_payload->payload_interface);
 530         id_payload = id_payload_create_from_ts(this->tsr);
 531         message->add_payload(message, &id_payload->payload_interface);
 532 }
 533
 534 /**
 535  * Get traffic selectors from received message
 536  */
 537 static bool get_ts(private_quick_mode_t *this, message_t *message)
 538 {
 539         traffic_selector_t *tsi = NULL, *tsr = NULL;
 540         enumerator_t *enumerator;
 541         id_payload_t *id_payload;
 542         payload_t *payload;
 543         host_t *hsi, *hsr;
 544         bool first = TRUE;
 545
 546         enumerator = message->create_payload_enumerator(message);
 547         while (enumerator->enumerate(enumerator, &payload))
 548         {
 549                 if (payload->get_type(payload) == PLV1_ID)
 550                 {
 551                         id_payload = (id_payload_t*)payload;
 552
 553                         if (first)
 554                         {
 555                                 tsi = id_payload->get_ts(id_payload);
 556                                 first = FALSE;
 557                         }
 558                         else
 559                         {
 560                                 tsr = id_payload->get_ts(id_payload);
 561                                 break;
 562                         }
 563                 }
 564         }
 565         enumerator->destroy(enumerator);
 566
 567         /* create host2host selectors if ID payloads missing */
 568         if (this->initiator)
 569         {
 570                 hsi = this->ike_sa->get_my_host(this->ike_sa);
 571                 hsr = this->ike_sa->get_other_host(this->ike_sa);
 572         }
 573         else
 574         {
 575                 hsr = this->ike_sa->get_my_host(this->ike_sa);
 576                 hsi = this->ike_sa->get_other_host(this->ike_sa);
 577         }
 578         if (!tsi)
 579         {
 580                 tsi = traffic_selector_create_from_subnet(hsi->clone(hsi),
 581                                         hsi->get_family(hsi) == AF_INET ? 32 : 128, 0, 0, 65535);
 582         }
 583         if (!tsr)
 584         {
 585                 tsr = traffic_selector_create_from_subnet(hsr->clone(hsr),
 586                                         hsr->get_family(hsr) == AF_INET ? 32 : 128, 0, 0, 65535);
 587         }
 588         if (this->mode == MODE_TRANSPORT && this->udp &&
 589            (!tsi->is_host(tsi, hsi) || !tsr->is_host(tsr, hsr)))
 590         {       /* change TS in case of a NAT in transport mode */
 591                 DBG2(DBG_IKE, "changing received traffic selectors %R=== %R due to NAT",
 592                          tsi, tsr);
 593                 tsi->set_address(tsi, hsi);
 594                 tsr->set_address(tsr, hsr);
 595         }
 596
 597         if (this->initiator)
 598         {
 599                 traffic_selector_t *tsisub, *tsrsub;
 600
 601                 /* check if peer selection is valid */
 602                 tsisub = this->tsi->get_subset(this->tsi, tsi);
 603                 tsrsub = this->tsr->get_subset(this->tsr, tsr);
 604                 if (!tsisub || !tsrsub)
 605                 {
 606                         DBG1(DBG_IKE, "peer selected invalid traffic selectors: "
 607                                  "%R for %R, %R for %R", tsi, this->tsi, tsr, this->tsr);
 608                         DESTROY_IF(tsisub);
 609                         DESTROY_IF(tsrsub);
 610                         tsi->destroy(tsi);
 611                         tsr->destroy(tsr);
 612                         return FALSE;
 613                 }
 614                 tsi->destroy(tsi);
 615                 tsr->destroy(tsr);
 616                 this->tsi->destroy(this->tsi);
 617                 this->tsr->destroy(this->tsr);
 618                 this->tsi = tsisub;
 619                 this->tsr = tsrsub;
 620         }
 621         else
 622         {
 623                 this->tsi = tsi;
 624                 this->tsr = tsr;
 625         }
 626         return TRUE;
 627 }
 628
 629 /**
 630  * Get encap
 631  */
 632 static encap_t get_encap(ike_sa_t* ike_sa, bool udp)
 633 {
 634         if (!udp)
 635         {
 636                 return ENCAP_NONE;
 637         }
 638         if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
 639         {
 640                 return ENCAP_UDP_DRAFT_00_03;
 641         }
 642         return ENCAP_UDP;
 643 }
 644
 645 /**
 646  * Get NAT-OA payload type (RFC 3947 or RFC 3947 drafts).
 647  */
 648 static payload_type_t get_nat_oa_payload_type(ike_sa_t *ike_sa)
 649 {
 650         if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
 651         {
 652                 return PLV1_NAT_OA_DRAFT_00_03;
 653         }
 654         return PLV1_NAT_OA;
 655 }
 656
 657 /**
 658  * Add NAT-OA payloads
 659  */
 660 static void add_nat_oa_payloads(private_quick_mode_t *this, message_t *message)
 661 {
 662         identification_t *id;
 663         id_payload_t *nat_oa;
 664         host_t *src, *dst;
 665         payload_type_t nat_oa_payload_type;
 666
 667         src = message->get_source(message);
 668         dst = message->get_destination(message);
 669
 670         src = this->initiator ? src : dst;
 671         dst = this->initiator ? dst : src;
 672
 673         nat_oa_payload_type = get_nat_oa_payload_type(this->ike_sa);
 674
 675         /* first NAT-OA is the initiator's address */
 676         id = identification_create_from_sockaddr(src->get_sockaddr(src));
 677         nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
 678         message->add_payload(message, (payload_t*)nat_oa);
 679         id->destroy(id);
 680
 681         /* second NAT-OA is that of the responder */
 682         id = identification_create_from_sockaddr(dst->get_sockaddr(dst));
 683         nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
 684         message->add_payload(message, (payload_t*)nat_oa);
 685         id->destroy(id);
 686 }
 687
 688 /**
 689  * Look up lifetimes
 690  */
 691 static void get_lifetimes(private_quick_mode_t *this)
 692 {
 693         lifetime_cfg_t *lft;
 694
 695         lft = this->config->get_lifetime(this->config);
 696         if (lft->time.life)
 697         {
 698                 this->lifetime = lft->time.life;
 699         }
 700         else if (lft->bytes.life)
 701         {
 702                 this->lifebytes = lft->bytes.life;
 703         }
 704         free(lft);
 705 }
 706
 707 /**
 708  * Check and apply lifetimes
 709  */
 710 static void apply_lifetimes(private_quick_mode_t *this, sa_payload_t *sa_payload)
 711 {
 712         u_int32_t lifetime;
 713         u_int64_t lifebytes;
 714
 715         lifetime = sa_payload->get_lifetime(sa_payload);
 716         lifebytes = sa_payload->get_lifebytes(sa_payload);
 717         if (this->lifetime != lifetime)
 718         {
 719                 DBG1(DBG_IKE, "received %us lifetime, configured %us",
 720                          lifetime, this->lifetime);
 721                 this->lifetime = lifetime;
 722         }
 723         if (this->lifebytes != lifebytes)
 724         {
 725                 DBG1(DBG_IKE, "received %llu lifebytes, configured %llu",
 726                          lifebytes, this->lifebytes);
 727                 this->lifebytes = lifebytes;
 728         }
 729 }
 730
 731 /**
 732  * Set the task ready to build notify error message
 733  */
 734 static status_t send_notify(private_quick_mode_t *this, notify_type_t type)
 735 {
 736         notify_payload_t *notify;
 737
 738         notify = notify_payload_create_from_protocol_and_type(PLV1_NOTIFY,
 739                                                                                                                   this->proto, type);
 740         notify->set_spi(notify, this->spi_i);
 741
 742         this->ike_sa->queue_task(this->ike_sa,
 743                                                 (task_t*)informational_create(this->ike_sa, notify));
 744         /* cancel all active/passive tasks in favour of informational */
 745         this->ike_sa->flush_queue(this->ike_sa,
 746                                         this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
 747         return ALREADY_DONE;
 748 }
 749
 750 /**
 751  * Prepare a list of proposals from child_config containing only the specified
 752  * DH group, unless it is set to MODP_NONE.
 753  */
 754 static linked_list_t *get_proposals(private_quick_mode_t *this,
 755                                                                         diffie_hellman_group_t group)
 756 {
 757         linked_list_t *list;
 758         proposal_t *proposal;
 759         enumerator_t *enumerator;
 760
 761         list = this->config->get_proposals(this->config, FALSE);
 762         enumerator = list->create_enumerator(list);
 763         while (enumerator->enumerate(enumerator, &proposal))
 764         {
 765                 if (group != MODP_NONE)
 766                 {
 767                         if (!proposal->has_dh_group(proposal, group))
 768                         {
 769                                 list->remove_at(list, enumerator);
 770                                 proposal->destroy(proposal);
 771                                 continue;
 772                         }
 773                         proposal->strip_dh(proposal, group);
 774                 }
 775                 proposal->set_spi(proposal, this->spi_i);
 776         }
 777         enumerator->destroy(enumerator);
 778
 779         return list;
 780 }
 781
 782 METHOD(task_t, build_i, status_t,
 783         private_quick_mode_t *this, message_t *message)
 784 {
 785         switch (this->state)
 786         {
 787                 case QM_INIT:
 788                 {
 789                         sa_payload_t *sa_payload;
 790                         linked_list_t *list, *tsi, *tsr;
 791                         proposal_t *proposal;
 792                         diffie_hellman_group_t group;
 793                         encap_t encap;
 794
 795                         this->udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
 796                         this->mode = this->config->get_mode(this->config);
 797                         this->child_sa = child_sa_create(
 798                                                                         this->ike_sa->get_my_host(this->ike_sa),
 799                                                                         this->ike_sa->get_other_host(this->ike_sa),
 800                                                                         this->config, this->reqid, this->udp,
 801                                                                         this->mark_in, this->mark_out);
 802
 803                         if (this->udp && this->mode == MODE_TRANSPORT)
 804                         {
 805                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
 806                                 add_nat_oa_payloads(this, message);
 807                         }
 808
 809                         if (this->config->use_ipcomp(this->config))
 810                         {
 811                                 this->cpi_i = this->child_sa->alloc_cpi(this->child_sa);
 812                                 if (!this->cpi_i)
 813                                 {
 814                                         DBG1(DBG_IKE, "unable to allocate a CPI from kernel, "
 815                                                  "IPComp disabled");
 816                                 }
 817                         }
 818
 819                         list = this->config->get_proposals(this->config, MODP_NONE);
 820                         if (list->get_first(list, (void**)&proposal) == SUCCESS)
 821                         {
 822                                 this->proto = proposal->get_protocol(proposal);
 823                         }
 824                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 825                         this->spi_i = this->child_sa->alloc_spi(this->child_sa, this->proto);
 826                         if (!this->spi_i)
 827                         {
 828                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
 829                                 return FAILED;
 830                         }
 831
 832                         group = this->config->get_dh_group(this->config);
 833                         if (group != MODP_NONE)
 834                         {
 835                                 proposal_t *proposal;
 836                                 u_int16_t preferred_group;
 837
 838                                 proposal = this->ike_sa->get_proposal(this->ike_sa);
 839                                 proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP,
 840                                                                                 &preferred_group, NULL);
 841                                 /* try the negotiated DH group from IKE_SA */
 842                                 list = get_proposals(this, preferred_group);
 843                                 if (list->get_count(list))
 844                                 {
 845                                         group = preferred_group;
 846                                 }
 847                                 else
 848                                 {
 849                                         /* fall back to the first configured DH group */
 850                                         list->destroy(list);
 851                                         list = get_proposals(this, group);
 852                                 }
 853
 854                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
 855                                                                                                                   group);
 856                                 if (!this->dh)
 857                                 {
 858                                         DBG1(DBG_IKE, "configured DH group %N not supported",
 859                                                  diffie_hellman_group_names, group);
 860                                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 861                                         return FAILED;
 862                                 }
 863                         }
 864                         else
 865                         {
 866                                 list = get_proposals(this, MODP_NONE);
 867                         }
 868
 869                         get_lifetimes(this);
 870                         encap = get_encap(this->ike_sa, this->udp);
 871                         sa_payload = sa_payload_create_from_proposals_v1(list,
 872                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
 873                                                                 this->mode, encap, this->cpi_i);
 874                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 875                         message->add_payload(message, &sa_payload->payload_interface);
 876
 877                         if (!add_nonce(this, &this->nonce_i, message))
 878                         {
 879                                 return FAILED;
 880                         }
 881                         if (group != MODP_NONE)
 882                         {
 883                                 add_ke(this, message);
 884                         }
 885                         if (!this->tsi)
 886                         {
 887                                 this->tsi = select_ts(this, TRUE, NULL);
 888                         }
 889                         if (!this->tsr)
 890                         {
 891                                 this->tsr = select_ts(this, FALSE, NULL);
 892                         }
 893                         tsi = linked_list_create_with_items(this->tsi, NULL);
 894                         tsr = linked_list_create_with_items(this->tsr, NULL);
 895                         this->tsi = this->tsr = NULL;
 896                         charon->bus->narrow(charon->bus, this->child_sa,
 897                                                                 NARROW_INITIATOR_PRE_AUTH, tsi, tsr);
 898                         tsi->remove_first(tsi, (void**)&this->tsi);
 899                         tsr->remove_first(tsr, (void**)&this->tsr);
 900                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 901                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 902                         if (!this->tsi || !this->tsr)
 903                         {
 904                                 return FAILED;
 905                         }
 906                         add_ts(this, message);
 907                         return NEED_MORE;
 908                 }
 909                 case QM_NEGOTIATED:
 910                 {
 911                         return SUCCESS;
 912                 }
 913                 default:
 914                         return FAILED;
 915         }
 916 }
 917
 918 /**
 919  * Check for notify errors, return TRUE if error found
 920  */
 921 static bool has_notify_errors(private_quick_mode_t *this, message_t *message)
 922 {
 923         enumerator_t *enumerator;
 924         payload_t *payload;
 925         bool err = FALSE;
 926
 927         enumerator = message->create_payload_enumerator(message);
 928         while (enumerator->enumerate(enumerator, &payload))
 929         {
 930                 if (payload->get_type(payload) == PLV1_NOTIFY)
 931                 {
 932                         notify_payload_t *notify;
 933                         notify_type_t type;
 934
 935                         notify = (notify_payload_t*)payload;
 936                         type = notify->get_notify_type(notify);
 937                         if (type < 16384)
 938                         {
 939
 940                                 DBG1(DBG_IKE, "received %N error notify",
 941                                          notify_type_names, type);
 942                                 err = TRUE;
 943                         }
 944                         else
 945                         {
 946                                 DBG1(DBG_IKE, "received %N notify", notify_type_names, type);
 947                         }
 948                 }
 949         }
 950         enumerator->destroy(enumerator);
 951
 952         return err;
 953 }
 954
 955 /**
 956  * Check if this is a rekey for an existing CHILD_SA, reuse reqid if so
 957  */
 958 static void check_for_rekeyed_child(private_quick_mode_t *this)
 959 {
 960         enumerator_t *enumerator, *policies;
 961         traffic_selector_t *local, *remote;
 962         child_sa_t *child_sa;
 963         proposal_t *proposal;
 964         char *name;
 965
 966         name = this->config->get_name(this->config);
 967         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
 968         while (this->reqid == 0 && enumerator->enumerate(enumerator, &child_sa))
 969         {
 970                 if (streq(child_sa->get_name(child_sa), name))
 971                 {
 972                         proposal = child_sa->get_proposal(child_sa);
 973                         switch (child_sa->get_state(child_sa))
 974                         {
 975                                 case CHILD_INSTALLED:
 976                                 case CHILD_REKEYING:
 977                                         policies = child_sa->create_policy_enumerator(child_sa);
 978                                         if (policies->enumerate(policies, &local, &remote) &&
 979                                                 local->equals(local, this->tsr) &&
 980                                                 remote->equals(remote, this->tsi) &&
 981                                                 this->proposal->equals(this->proposal, proposal))
 982                                         {
 983                                                 this->reqid = child_sa->get_reqid(child_sa);
 984                                                 this->rekey = child_sa->get_spi(child_sa, TRUE);
 985                                                 this->mark_in = child_sa->get_mark(child_sa,
 986                                                                                                                         TRUE).value;
 987                                                 this->mark_out = child_sa->get_mark(child_sa,
 988                                                                                                                         FALSE).value;
 989                                                 child_sa->set_state(child_sa, CHILD_REKEYING);
 990                                                 DBG1(DBG_IKE, "detected rekeying of CHILD_SA %s{%u}",
 991                                                          child_sa->get_name(child_sa),
 992                                                          child_sa->get_unique_id(child_sa));
 993                                         }
 994                                         policies->destroy(policies);
 995                                 break;
 996                         default:
 997                                 break;
 998                         }
 999                 }
1000         }
1001         enumerator->destroy(enumerator);
1002 }
1003
1004 METHOD(task_t, process_r, status_t,
1005         private_quick_mode_t *this, message_t *message)
1006 {
1007         switch (this->state)
1008         {
1009                 case QM_INIT:
1010                 {
1011                         sa_payload_t *sa_payload;
1012                         linked_list_t *tsi, *tsr, *hostsi, *hostsr, *list = NULL;
1013                         peer_cfg_t *peer_cfg;
1014                         u_int16_t group;
1015                         bool private;
1016
1017                         sa_payload = (sa_payload_t*)message->get_payload(message,
1018                                                                                                         PLV1_SECURITY_ASSOCIATION);
1019                         if (!sa_payload)
1020                         {
1021                                 DBG1(DBG_IKE, "sa payload missing");
1022                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1023                         }
1024
1025                         this->mode = sa_payload->get_encap_mode(sa_payload, &this->udp);
1026
1027                         if (!get_ts(this, message))
1028                         {
1029                                 return FAILED;
1030                         }
1031                         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1032                         tsi = linked_list_create_with_items(this->tsi, NULL);
1033                         tsr = linked_list_create_with_items(this->tsr, NULL);
1034                         this->tsi = this->tsr = NULL;
1035                         hostsi = get_dynamic_hosts(this->ike_sa, FALSE);
1036                         hostsr = get_dynamic_hosts(this->ike_sa, TRUE);
1037                         this->config = peer_cfg->select_child_cfg(peer_cfg, tsr, tsi,
1038                                                                                                           hostsr, hostsi);
1039                         hostsi->destroy(hostsi);
1040                         hostsr->destroy(hostsr);
1041                         if (this->config)
1042                         {
1043                                 this->tsi = select_ts(this, FALSE, tsi);
1044                                 this->tsr = select_ts(this, TRUE, tsr);
1045                         }
1046                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1047                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1048                         if (!this->config || !this->tsi || !this->tsr ||
1049                                 this->mode != this->config->get_mode(this->config))
1050                         {
1051                                 DBG1(DBG_IKE, "no matching CHILD_SA config found");
1052                                 return send_notify(this, INVALID_ID_INFORMATION);
1053                         }
1054
1055                         if (this->config->use_ipcomp(this->config))
1056                         {
1057                                 list = sa_payload->get_ipcomp_proposals(sa_payload,
1058                                                                                                                 &this->cpi_i);
1059                                 if (!list->get_count(list))
1060                                 {
1061                                         DBG1(DBG_IKE, "expected IPComp proposal but peer did "
1062                                                  "not send one, IPComp disabled");
1063                                         this->cpi_i = 0;
1064                                 }
1065                         }
1066                         if (!list || !list->get_count(list))
1067                         {
1068                                 DESTROY_IF(list);
1069                                 list = sa_payload->get_proposals(sa_payload);
1070                         }
1071                         private = this->ike_sa->supports_extension(this->ike_sa,
1072                                                                                                            EXT_STRONGSWAN);
1073                         this->proposal = this->config->select_proposal(this->config,
1074                                                                                                                    list, FALSE, private);
1075                         list->destroy_offset(list, offsetof(proposal_t, destroy));
1076
1077                         get_lifetimes(this);
1078                         apply_lifetimes(this, sa_payload);
1079
1080                         if (!this->proposal)
1081                         {
1082                                 DBG1(DBG_IKE, "no matching proposal found, sending %N",
1083                                          notify_type_names, NO_PROPOSAL_CHOSEN);
1084                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1085                         }
1086                         this->spi_i = this->proposal->get_spi(this->proposal);
1087
1088                         if (!get_nonce(this, &this->nonce_i, message))
1089                         {
1090                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1091                         }
1092
1093                         if (this->proposal->get_algorithm(this->proposal,
1094                                                                                 DIFFIE_HELLMAN_GROUP, &group, NULL))
1095                         {
1096                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
1097                                                                                                                   group);
1098                                 if (!this->dh)
1099                                 {
1100                                         DBG1(DBG_IKE, "negotiated DH group %N not supported",
1101                                                  diffie_hellman_group_names, group);
1102                                         return send_notify(this, INVALID_KEY_INFORMATION);
1103                                 }
1104                                 if (!get_ke(this, message))
1105                                 {
1106                                         return send_notify(this, INVALID_PAYLOAD_TYPE);
1107                                 }
1108                         }
1109
1110                         check_for_rekeyed_child(this);
1111
1112                         this->child_sa = child_sa_create(
1113                                                                         this->ike_sa->get_my_host(this->ike_sa),
1114                                                                         this->ike_sa->get_other_host(this->ike_sa),
1115                                                                         this->config, this->reqid, this->udp,
1116                                                                         this->mark_in, this->mark_out);
1117
1118                         tsi = linked_list_create_with_items(this->tsi, NULL);
1119                         tsr = linked_list_create_with_items(this->tsr, NULL);
1120                         this->tsi = this->tsr = NULL;
1121                         charon->bus->narrow(charon->bus, this->child_sa,
1122                                                                 NARROW_RESPONDER, tsr, tsi);
1123                         if (tsi->remove_first(tsi, (void**)&this->tsi) != SUCCESS ||
1124                                 tsr->remove_first(tsr, (void**)&this->tsr) != SUCCESS)
1125                         {
1126                                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1127                                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1128                                 return send_notify(this, INVALID_ID_INFORMATION);
1129                         }
1130                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1131                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1132
1133                         return NEED_MORE;
1134                 }
1135                 case QM_NEGOTIATED:
1136                 {
1137                         if (has_notify_errors(this, message))
1138                         {
1139                                 return SUCCESS;
1140                         }
1141                         if (message->get_exchange_type(message) == INFORMATIONAL_V1)
1142                         {
1143                                 if (message->get_payload(message, PLV1_DELETE))
1144                                 {
1145                                         /* If the DELETE for a Quick Mode follows immediately
1146                                          * after rekeying, we might receive it before the
1147                                          * third completing Quick Mode message. Ignore it, as
1148                                          * it gets handled by a separately queued delete task. */
1149                                         return NEED_MORE;
1150                                 }
1151                                 return SUCCESS;
1152                         }
1153                         if (!install(this))
1154                         {
1155                                 ike_sa_t *ike_sa = this->ike_sa;
1156                                 task_t *task;
1157
1158                                 task = (task_t*)quick_delete_create(this->ike_sa,
1159                                                                 this->proposal->get_protocol(this->proposal),
1160                                                                 this->spi_i, TRUE, TRUE);
1161                                 /* flush_queue() destroys the current task */
1162                                 ike_sa->flush_queue(ike_sa, TASK_QUEUE_PASSIVE);
1163                                 ike_sa->queue_task(ike_sa, task);
1164                                 return ALREADY_DONE;
1165                         }
1166                         return SUCCESS;
1167                 }
1168                 default:
1169                         return FAILED;
1170         }
1171 }
1172
1173 METHOD(task_t, build_r, status_t,
1174         private_quick_mode_t *this, message_t *message)
1175 {
1176         switch (this->state)
1177         {
1178                 case QM_INIT:
1179                 {
1180                         sa_payload_t *sa_payload;
1181                         encap_t encap;
1182
1183                         this->proto = this->proposal->get_protocol(this->proposal);
1184                         this->spi_r = this->child_sa->alloc_spi(this->child_sa, this->proto);
1185                         if (!this->spi_r)
1186                         {
1187                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
1188                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1189                         }
1190                         this->proposal->set_spi(this->proposal, this->spi_r);
1191
1192                         if (this->cpi_i)
1193                         {
1194                                 this->cpi_r = this->child_sa->alloc_cpi(this->child_sa);
1195                                 if (!this->cpi_r)
1196                                 {
1197                                         DBG1(DBG_IKE, "unable to allocate a CPI from "
1198                                                  "kernel, IPComp disabled");
1199                                         return send_notify(this, NO_PROPOSAL_CHOSEN);
1200                                 }
1201                         }
1202
1203                         if (this->udp && this->mode == MODE_TRANSPORT)
1204                         {
1205                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
1206                                 add_nat_oa_payloads(this, message);
1207                         }
1208
1209                         encap = get_encap(this->ike_sa, this->udp);
1210                         sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
1211                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
1212                                                                 this->mode, encap, this->cpi_r);
1213                         message->add_payload(message, &sa_payload->payload_interface);
1214
1215                         if (!add_nonce(this, &this->nonce_r, message))
1216                         {
1217                                 return FAILED;
1218                         }
1219                         if (this->dh)
1220                         {
1221                                 add_ke(this, message);
1222                         }
1223
1224                         add_ts(this, message);
1225
1226                         this->state = QM_NEGOTIATED;
1227                         return NEED_MORE;
1228                 }
1229                 case QM_NEGOTIATED:
1230                         if (message->get_exchange_type(message) == INFORMATIONAL_V1)
1231                         {
1232                                 /* skip INFORMATIONAL response if we received a INFORMATIONAL
1233                                  * delete, see process_r() */
1234                                 return ALREADY_DONE;
1235                         }
1236                         /* fall */
1237                 default:
1238                         return FAILED;
1239         }
1240 }
1241
1242 METHOD(task_t, process_i, status_t,
1243         private_quick_mode_t *this, message_t *message)
1244 {
1245         switch (this->state)
1246         {
1247                 case QM_INIT:
1248                 {
1249                         sa_payload_t *sa_payload;
1250                         linked_list_t *list = NULL;
1251                         bool private;
1252
1253                         sa_payload = (sa_payload_t*)message->get_payload(message,
1254                                                                                                         PLV1_SECURITY_ASSOCIATION);
1255                         if (!sa_payload)
1256                         {
1257                                 DBG1(DBG_IKE, "sa payload missing");
1258                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1259                         }
1260                         if (this->cpi_i)
1261                         {
1262                                 list = sa_payload->get_ipcomp_proposals(sa_payload,
1263                                                                                                                 &this->cpi_r);
1264                                 if (!list->get_count(list))
1265                                 {
1266                                         DBG1(DBG_IKE, "peer did not acccept our IPComp proposal, "
1267                                                  "IPComp disabled");
1268                                         this->cpi_i = 0;
1269                                 }
1270                         }
1271                         if (!list || !list->get_count(list))
1272                         {
1273                                 DESTROY_IF(list);
1274                                 list = sa_payload->get_proposals(sa_payload);
1275                         }
1276                         private = this->ike_sa->supports_extension(this->ike_sa,
1277                                                                                                            EXT_STRONGSWAN);
1278                         this->proposal = this->config->select_proposal(this->config,
1279                                                                                                                    list, FALSE, private);
1280                         list->destroy_offset(list, offsetof(proposal_t, destroy));
1281                         if (!this->proposal)
1282                         {
1283                                 DBG1(DBG_IKE, "no matching proposal found");
1284                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1285                         }
1286                         this->spi_r = this->proposal->get_spi(this->proposal);
1287
1288                         apply_lifetimes(this, sa_payload);
1289
1290                         if (!get_nonce(this, &this->nonce_r, message))
1291                         {
1292                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1293                         }
1294                         if (this->dh && !get_ke(this, message))
1295                         {
1296                                 return send_notify(this, INVALID_KEY_INFORMATION);
1297                         }
1298                         if (!get_ts(this, message))
1299                         {
1300                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1301                         }
1302                         if (!install(this))
1303                         {
1304                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1305                         }
1306                         this->state = QM_NEGOTIATED;
1307                         return NEED_MORE;
1308                 }
1309                 default:
1310                         return FAILED;
1311         }
1312 }
1313
1314 METHOD(task_t, get_type, task_type_t,
1315         private_quick_mode_t *this)
1316 {
1317         return TASK_QUICK_MODE;
1318 }
1319
1320 METHOD(quick_mode_t, use_reqid, void,
1321         private_quick_mode_t *this, u_int32_t reqid)
1322 {
1323         this->reqid = reqid;
1324 }
1325
1326 METHOD(quick_mode_t, use_marks, void,
1327         private_quick_mode_t *this, u_int in, u_int out)
1328 {
1329         this->mark_in = in;
1330         this->mark_out = out;
1331 }
1332
1333 METHOD(quick_mode_t, rekey, void,
1334         private_quick_mode_t *this, u_int32_t spi)
1335 {
1336         this->rekey = spi;
1337 }
1338
1339 METHOD(task_t, migrate, void,
1340         private_quick_mode_t *this, ike_sa_t *ike_sa)
1341 {
1342         chunk_free(&this->nonce_i);
1343         chunk_free(&this->nonce_r);
1344         DESTROY_IF(this->tsi);
1345         DESTROY_IF(this->tsr);
1346         DESTROY_IF(this->proposal);
1347         DESTROY_IF(this->child_sa);
1348         DESTROY_IF(this->dh);
1349
1350         this->ike_sa = ike_sa;
1351         this->keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa);
1352         this->state = QM_INIT;
1353         this->tsi = NULL;
1354         this->tsr = NULL;
1355         this->proposal = NULL;
1356         this->child_sa = NULL;
1357         this->dh = NULL;
1358         this->spi_i = 0;
1359         this->spi_r = 0;
1360         this->mark_in = 0;
1361         this->mark_out = 0;
1362
1363         if (!this->initiator)
1364         {
1365                 DESTROY_IF(this->config);
1366                 this->config = NULL;
1367         }
1368 }
1369
1370 METHOD(task_t, destroy, void,
1371         private_quick_mode_t *this)
1372 {
1373         chunk_free(&this->nonce_i);
1374         chunk_free(&this->nonce_r);
1375         DESTROY_IF(this->tsi);
1376         DESTROY_IF(this->tsr);
1377         DESTROY_IF(this->proposal);
1378         DESTROY_IF(this->child_sa);
1379         DESTROY_IF(this->config);
1380         DESTROY_IF(this->dh);
1381         free(this);
1382 }
1383
1384 /*
1385  * Described in header.
1386  */
1387 quick_mode_t *quick_mode_create(ike_sa_t *ike_sa, child_cfg_t *config,
1388                                                         traffic_selector_t *tsi, traffic_selector_t *tsr)
1389 {
1390         private_quick_mode_t *this;
1391
1392         INIT(this,
1393                 .public = {
1394                         .task = {
1395                                 .get_type = _get_type,
1396                                 .migrate = _migrate,
1397                                 .destroy = _destroy,
1398                         },
1399                         .use_reqid = _use_reqid,
1400                         .use_marks = _use_marks,
1401                         .rekey = _rekey,
1402                 },
1403                 .ike_sa = ike_sa,
1404                 .initiator = config != NULL,
1405                 .config = config,
1406                 .keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa),
1407                 .state = QM_INIT,
1408                 .tsi = tsi ? tsi->clone(tsi) : NULL,
1409                 .tsr = tsr ? tsr->clone(tsr) : NULL,
1410                 .proto = PROTO_ESP,
1411         );
1412
1413         if (config)
1414         {
1415                 this->public.task.build = _build_i;
1416                 this->public.task.process = _process_i;
1417         }
1418         else
1419         {
1420                 this->public.task.build = _build_r;
1421                 this->public.task.process = _process_r;
1422         }
1423
1424         return &this->public;
1425 }