ikev1: Always send ID payloads (traffic selectors) during Quick Mode
[strongswan.git] / src / libcharon / sa / ikev1 / tasks / quick_mode.c
1 /*
2 * Copyright (C) 2012 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
4 *
5 * Copyright (C) 2011 Martin Willi
6 * Copyright (C) 2011 revosec AG
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 /*
20 * Copyright (C) 2012 Volker RĂ¼melin
21 *
22 * Permission is hereby granted, free of charge, to any person obtaining a copy
23 * of this software and associated documentation files (the "Software"), to deal
24 * in the Software without restriction, including without limitation the rights
25 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
26 * copies of the Software, and to permit persons to whom the Software is
27 * furnished to do so, subject to the following conditions:
28 *
29 * The above copyright notice and this permission notice shall be included in
30 * all copies or substantial portions of the Software.
31 *
32 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
33 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
34 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
35 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
36 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
37 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
38 * THE SOFTWARE.
39 */
40
41 #include "quick_mode.h"
42
43 #include <string.h>
44
45 #include <daemon.h>
46 #include <sa/ikev1/keymat_v1.h>
47 #include <encoding/payloads/sa_payload.h>
48 #include <encoding/payloads/nonce_payload.h>
49 #include <encoding/payloads/ke_payload.h>
50 #include <encoding/payloads/id_payload.h>
51 #include <encoding/payloads/payload.h>
52 #include <sa/ikev1/tasks/informational.h>
53 #include <sa/ikev1/tasks/quick_delete.h>
54 #include <processing/jobs/inactivity_job.h>
55
56 typedef struct private_quick_mode_t private_quick_mode_t;
57
58 /**
59 * Private members of a quick_mode_t task.
60 */
61 struct private_quick_mode_t {
62
63 /**
64 * Public methods and task_t interface.
65 */
66 quick_mode_t public;
67
68 /**
69 * Assigned IKE_SA.
70 */
71 ike_sa_t *ike_sa;
72
73 /**
74 * TRUE if we are initiating quick mode
75 */
76 bool initiator;
77
78 /**
79 * Traffic selector of initiator
80 */
81 traffic_selector_t *tsi;
82
83 /**
84 * Traffic selector of responder
85 */
86 traffic_selector_t *tsr;
87
88 /**
89 * Initiators nonce
90 */
91 chunk_t nonce_i;
92
93 /**
94 * Responder nonce
95 */
96 chunk_t nonce_r;
97
98 /**
99 * Initiators ESP SPI
100 */
101 u_int32_t spi_i;
102
103 /**
104 * Responder ESP SPI
105 */
106 u_int32_t spi_r;
107
108 /**
109 * Initiators IPComp CPI
110 */
111 u_int16_t cpi_i;
112
113 /**
114 * Responders IPComp CPI
115 */
116 u_int16_t cpi_r;
117
118 /**
119 * selected CHILD_SA proposal
120 */
121 proposal_t *proposal;
122
123 /**
124 * Config of CHILD_SA to establish
125 */
126 child_cfg_t *config;
127
128 /**
129 * CHILD_SA we are about to establish
130 */
131 child_sa_t *child_sa;
132
133 /**
134 * IKEv1 keymat
135 */
136 keymat_v1_t *keymat;
137
138 /**
139 * DH exchange, when PFS is in use
140 */
141 diffie_hellman_t *dh;
142
143 /**
144 * Negotiated lifetime of new SA
145 */
146 u_int32_t lifetime;
147
148 /**
149 * Negotaited lifebytes of new SA
150 */
151 u_int64_t lifebytes;
152
153 /**
154 * Reqid to use, 0 for auto-allocate
155 */
156 u_int32_t reqid;
157
158 /**
159 * SPI of SA we rekey
160 */
161 u_int32_t rekey;
162
163 /**
164 * Negotiated mode, tunnel or transport
165 */
166 ipsec_mode_t mode;
167
168 /**
169 * Use UDP encapsulation
170 */
171 bool udp;
172
173 /** states of quick mode */
174 enum {
175 QM_INIT,
176 QM_NEGOTIATED,
177 } state;
178 };
179
180 /**
181 * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
182 */
183 static void schedule_inactivity_timeout(private_quick_mode_t *this)
184 {
185 u_int32_t timeout;
186 bool close_ike;
187
188 timeout = this->config->get_inactivity(this->config);
189 if (timeout)
190 {
191 close_ike = lib->settings->get_bool(lib->settings,
192 "%s.inactivity_close_ike", FALSE, charon->name);
193 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
194 inactivity_job_create(this->child_sa->get_reqid(this->child_sa),
195 timeout, close_ike), timeout);
196 }
197 }
198
199 /**
200 * Check if we have a an address pool configured
201 */
202 static bool have_pool(ike_sa_t *ike_sa)
203 {
204 enumerator_t *enumerator;
205 peer_cfg_t *peer_cfg;
206 char *pool;
207 bool found = FALSE;
208
209 peer_cfg = ike_sa->get_peer_cfg(ike_sa);
210 if (peer_cfg)
211 {
212 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
213 if (enumerator->enumerate(enumerator, &pool))
214 {
215 found = TRUE;
216 }
217 enumerator->destroy(enumerator);
218 }
219 return found;
220 }
221
222 /**
223 * Get hosts to use for dynamic traffic selectors
224 */
225 static linked_list_t *get_dynamic_hosts(ike_sa_t *ike_sa, bool local)
226 {
227 enumerator_t *enumerator;
228 linked_list_t *list;
229 host_t *host;
230
231 list = linked_list_create();
232 enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
233 while (enumerator->enumerate(enumerator, &host))
234 {
235 list->insert_last(list, host);
236 }
237 enumerator->destroy(enumerator);
238
239 if (list->get_count(list) == 0)
240 { /* no virtual IPs assigned */
241 if (local)
242 {
243 host = ike_sa->get_my_host(ike_sa);
244 list->insert_last(list, host);
245 }
246 else if (!have_pool(ike_sa))
247 { /* use host only if we don't have a pool configured */
248 host = ike_sa->get_other_host(ike_sa);
249 list->insert_last(list, host);
250 }
251 }
252 return list;
253 }
254
255 /**
256 * Install negotiated CHILD_SA
257 */
258 static bool install(private_quick_mode_t *this)
259 {
260 status_t status, status_i, status_o;
261 chunk_t encr_i, encr_r, integ_i, integ_r;
262 linked_list_t *tsi, *tsr, *my_ts, *other_ts;
263 child_sa_t *old = NULL;
264
265 this->child_sa->set_proposal(this->child_sa, this->proposal);
266 this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
267 this->child_sa->set_mode(this->child_sa, this->mode);
268
269 if (this->cpi_i && this->cpi_r)
270 { /* DEFLATE is the only transform we currently support */
271 this->child_sa->set_ipcomp(this->child_sa, IPCOMP_DEFLATE);
272 }
273 else
274 {
275 this->cpi_i = this->cpi_r = 0;
276 }
277
278 this->child_sa->set_protocol(this->child_sa,
279 this->proposal->get_protocol(this->proposal));
280
281 status_i = status_o = FAILED;
282 encr_i = encr_r = integ_i = integ_r = chunk_empty;
283 tsi = linked_list_create_with_items(this->tsi->clone(this->tsi), NULL);
284 tsr = linked_list_create_with_items(this->tsr->clone(this->tsr), NULL);
285 if (this->initiator)
286 {
287 charon->bus->narrow(charon->bus, this->child_sa,
288 NARROW_INITIATOR_POST_AUTH, tsi, tsr);
289 }
290 else
291 {
292 charon->bus->narrow(charon->bus, this->child_sa,
293 NARROW_RESPONDER_POST, tsr, tsi);
294 }
295 if (tsi->get_count(tsi) == 0 || tsr->get_count(tsr) == 0)
296 {
297 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
298 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
299 DBG1(DBG_IKE, "no acceptable traffic selectors found");
300 return FALSE;
301 }
302
303 if (this->keymat->derive_child_keys(this->keymat, this->proposal, this->dh,
304 this->spi_i, this->spi_r, this->nonce_i, this->nonce_r,
305 &encr_i, &integ_i, &encr_r, &integ_r))
306 {
307 if (this->initiator)
308 {
309 status_i = this->child_sa->install(this->child_sa,
310 encr_r, integ_r, this->spi_i, this->cpi_i,
311 this->initiator, TRUE, FALSE, tsi, tsr);
312 status_o = this->child_sa->install(this->child_sa,
313 encr_i, integ_i, this->spi_r, this->cpi_r,
314 this->initiator, FALSE, FALSE, tsi, tsr);
315 }
316 else
317 {
318 status_i = this->child_sa->install(this->child_sa,
319 encr_i, integ_i, this->spi_r, this->cpi_r,
320 this->initiator, TRUE, FALSE, tsr, tsi);
321 status_o = this->child_sa->install(this->child_sa,
322 encr_r, integ_r, this->spi_i, this->cpi_i,
323 this->initiator, FALSE, FALSE, tsr, tsi);
324 }
325 }
326 chunk_clear(&integ_i);
327 chunk_clear(&integ_r);
328 chunk_clear(&encr_i);
329 chunk_clear(&encr_r);
330
331 if (status_i != SUCCESS || status_o != SUCCESS)
332 {
333 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
334 (status_i != SUCCESS) ? "inbound " : "",
335 (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
336 (status_o != SUCCESS) ? "outbound " : "");
337 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
338 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
339 return FALSE;
340 }
341
342 if (this->initiator)
343 {
344 status = this->child_sa->add_policies(this->child_sa, tsi, tsr);
345 }
346 else
347 {
348 status = this->child_sa->add_policies(this->child_sa, tsr, tsi);
349 }
350 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
351 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
352 if (status != SUCCESS)
353 {
354 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
355 return FALSE;
356 }
357
358 charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
359 this->dh, this->nonce_i, this->nonce_r);
360
361 /* add to IKE_SA, and remove from task */
362 this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
363 this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
364
365 my_ts = linked_list_create_from_enumerator(
366 this->child_sa->create_ts_enumerator(this->child_sa, TRUE));
367 other_ts = linked_list_create_from_enumerator(
368 this->child_sa->create_ts_enumerator(this->child_sa, FALSE));
369
370 DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
371 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
372 this->child_sa->get_name(this->child_sa),
373 this->child_sa->get_reqid(this->child_sa),
374 ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
375 ntohl(this->child_sa->get_spi(this->child_sa, FALSE)), my_ts, other_ts);
376
377 my_ts->destroy(my_ts);
378 other_ts->destroy(other_ts);
379
380 if (this->rekey)
381 {
382 old = this->ike_sa->get_child_sa(this->ike_sa,
383 this->proposal->get_protocol(this->proposal),
384 this->rekey, TRUE);
385 }
386 if (old)
387 {
388 charon->bus->child_rekey(charon->bus, old, this->child_sa);
389 }
390 else
391 {
392 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
393 }
394 if (!this->rekey)
395 {
396 schedule_inactivity_timeout(this);
397 }
398 this->child_sa = NULL;
399 return TRUE;
400 }
401
402 /**
403 * Generate and add NONCE
404 */
405 static bool add_nonce(private_quick_mode_t *this, chunk_t *nonce,
406 message_t *message)
407 {
408 nonce_payload_t *nonce_payload;
409 nonce_gen_t *nonceg;
410
411 nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
412 if (!nonceg)
413 {
414 DBG1(DBG_IKE, "no nonce generator found to create nonce");
415 return FALSE;
416 }
417 if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, nonce))
418 {
419 DBG1(DBG_IKE, "nonce allocation failed");
420 nonceg->destroy(nonceg);
421 return FALSE;
422 }
423 nonceg->destroy(nonceg);
424
425 nonce_payload = nonce_payload_create(NONCE_V1);
426 nonce_payload->set_nonce(nonce_payload, *nonce);
427 message->add_payload(message, &nonce_payload->payload_interface);
428
429 return TRUE;
430 }
431
432 /**
433 * Extract nonce from NONCE payload
434 */
435 static bool get_nonce(private_quick_mode_t *this, chunk_t *nonce,
436 message_t *message)
437 {
438 nonce_payload_t *nonce_payload;
439
440 nonce_payload = (nonce_payload_t*)message->get_payload(message, NONCE_V1);
441 if (!nonce_payload)
442 {
443 DBG1(DBG_IKE, "NONCE payload missing in message");
444 return FALSE;
445 }
446 *nonce = nonce_payload->get_nonce(nonce_payload);
447
448 return TRUE;
449 }
450
451 /**
452 * Add KE payload to message
453 */
454 static void add_ke(private_quick_mode_t *this, message_t *message)
455 {
456 ke_payload_t *ke_payload;
457
458 ke_payload = ke_payload_create_from_diffie_hellman(KEY_EXCHANGE_V1, this->dh);
459 message->add_payload(message, &ke_payload->payload_interface);
460 }
461
462 /**
463 * Get DH value from a KE payload
464 */
465 static bool get_ke(private_quick_mode_t *this, message_t *message)
466 {
467 ke_payload_t *ke_payload;
468
469 ke_payload = (ke_payload_t*)message->get_payload(message, KEY_EXCHANGE_V1);
470 if (!ke_payload)
471 {
472 DBG1(DBG_IKE, "KE payload missing");
473 return FALSE;
474 }
475 this->dh->set_other_public_value(this->dh,
476 ke_payload->get_key_exchange_data(ke_payload));
477 return TRUE;
478 }
479
480 /**
481 * Select a traffic selector from configuration
482 */
483 static traffic_selector_t* select_ts(private_quick_mode_t *this, bool local,
484 linked_list_t *supplied)
485 {
486 traffic_selector_t *ts;
487 linked_list_t *list, *hosts;
488
489 hosts = get_dynamic_hosts(this->ike_sa, local);
490 list = this->config->get_traffic_selectors(this->config,
491 local, supplied, hosts);
492 hosts->destroy(hosts);
493 if (list->get_first(list, (void**)&ts) == SUCCESS)
494 {
495 ts = ts->clone(ts);
496 }
497 else
498 {
499 DBG1(DBG_IKE, "%s traffic selector missing in configuration",
500 local ? "local" : "local");
501 ts = NULL;
502 }
503 list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
504 return ts;
505 }
506
507 /**
508 * Add selected traffic selectors to message
509 */
510 static void add_ts(private_quick_mode_t *this, message_t *message)
511 {
512 id_payload_t *id_payload;
513
514 id_payload = id_payload_create_from_ts(this->tsi);
515 message->add_payload(message, &id_payload->payload_interface);
516 id_payload = id_payload_create_from_ts(this->tsr);
517 message->add_payload(message, &id_payload->payload_interface);
518 }
519
520 /**
521 * Get traffic selectors from received message
522 */
523 static bool get_ts(private_quick_mode_t *this, message_t *message)
524 {
525 traffic_selector_t *tsi = NULL, *tsr = NULL;
526 enumerator_t *enumerator;
527 id_payload_t *id_payload;
528 payload_t *payload;
529 host_t *hsi, *hsr;
530 bool first = TRUE;
531
532 enumerator = message->create_payload_enumerator(message);
533 while (enumerator->enumerate(enumerator, &payload))
534 {
535 if (payload->get_type(payload) == ID_V1)
536 {
537 id_payload = (id_payload_t*)payload;
538
539 if (first)
540 {
541 tsi = id_payload->get_ts(id_payload);
542 first = FALSE;
543 }
544 else
545 {
546 tsr = id_payload->get_ts(id_payload);
547 break;
548 }
549 }
550 }
551 enumerator->destroy(enumerator);
552
553 /* create host2host selectors if ID payloads missing */
554 if (this->initiator)
555 {
556 hsi = this->ike_sa->get_my_host(this->ike_sa);
557 hsr = this->ike_sa->get_other_host(this->ike_sa);
558 }
559 else
560 {
561 hsr = this->ike_sa->get_my_host(this->ike_sa);
562 hsi = this->ike_sa->get_other_host(this->ike_sa);
563 }
564 if (!tsi)
565 {
566 tsi = traffic_selector_create_from_subnet(hsi->clone(hsi),
567 hsi->get_family(hsi) == AF_INET ? 32 : 128, 0, 0, 65535);
568 }
569 if (!tsr)
570 {
571 tsr = traffic_selector_create_from_subnet(hsr->clone(hsr),
572 hsr->get_family(hsr) == AF_INET ? 32 : 128, 0, 0, 65535);
573 }
574 if (this->mode == MODE_TRANSPORT && this->udp &&
575 (!tsi->is_host(tsi, hsi) || !tsr->is_host(tsr, hsr)))
576 { /* change TS in case of a NAT in transport mode */
577 DBG2(DBG_IKE, "changing received traffic selectors %R=== %R due to NAT",
578 tsi, tsr);
579 tsi->set_address(tsi, hsi);
580 tsr->set_address(tsr, hsr);
581 }
582
583 if (this->initiator)
584 {
585 traffic_selector_t *tsisub, *tsrsub;
586
587 /* check if peer selection is valid */
588 tsisub = this->tsi->get_subset(this->tsi, tsi);
589 tsrsub = this->tsr->get_subset(this->tsr, tsr);
590 if (!tsisub || !tsrsub)
591 {
592 DBG1(DBG_IKE, "peer selected invalid traffic selectors: "
593 "%R for %R, %R for %R", tsi, this->tsi, tsr, this->tsr);
594 DESTROY_IF(tsisub);
595 DESTROY_IF(tsrsub);
596 tsi->destroy(tsi);
597 tsr->destroy(tsr);
598 return FALSE;
599 }
600 tsi->destroy(tsi);
601 tsr->destroy(tsr);
602 this->tsi->destroy(this->tsi);
603 this->tsr->destroy(this->tsr);
604 this->tsi = tsisub;
605 this->tsr = tsrsub;
606 }
607 else
608 {
609 this->tsi = tsi;
610 this->tsr = tsr;
611 }
612 return TRUE;
613 }
614
615 /**
616 * Get encap
617 */
618 static encap_t get_encap(ike_sa_t* ike_sa, bool udp)
619 {
620 if (!udp)
621 {
622 return ENCAP_NONE;
623 }
624 if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
625 {
626 return ENCAP_UDP_DRAFT_00_03;
627 }
628 return ENCAP_UDP;
629 }
630
631 /**
632 * Get NAT-OA payload type (RFC 3947 or RFC 3947 drafts).
633 */
634 static payload_type_t get_nat_oa_payload_type(ike_sa_t *ike_sa)
635 {
636 if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
637 {
638 return NAT_OA_DRAFT_00_03_V1;
639 }
640 return NAT_OA_V1;
641 }
642
643 /**
644 * Add NAT-OA payloads
645 */
646 static void add_nat_oa_payloads(private_quick_mode_t *this, message_t *message)
647 {
648 identification_t *id;
649 id_payload_t *nat_oa;
650 host_t *src, *dst;
651 payload_type_t nat_oa_payload_type;
652
653 src = message->get_source(message);
654 dst = message->get_destination(message);
655
656 src = this->initiator ? src : dst;
657 dst = this->initiator ? dst : src;
658
659 nat_oa_payload_type = get_nat_oa_payload_type(this->ike_sa);
660
661 /* first NAT-OA is the initiator's address */
662 id = identification_create_from_sockaddr(src->get_sockaddr(src));
663 nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
664 message->add_payload(message, (payload_t*)nat_oa);
665 id->destroy(id);
666
667 /* second NAT-OA is that of the responder */
668 id = identification_create_from_sockaddr(dst->get_sockaddr(dst));
669 nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
670 message->add_payload(message, (payload_t*)nat_oa);
671 id->destroy(id);
672 }
673
674 /**
675 * Look up lifetimes
676 */
677 static void get_lifetimes(private_quick_mode_t *this)
678 {
679 lifetime_cfg_t *lft;
680
681 lft = this->config->get_lifetime(this->config);
682 if (lft->time.life)
683 {
684 this->lifetime = lft->time.life;
685 }
686 else if (lft->bytes.life)
687 {
688 this->lifebytes = lft->bytes.life;
689 }
690 free(lft);
691 }
692
693 /**
694 * Check and apply lifetimes
695 */
696 static void apply_lifetimes(private_quick_mode_t *this, sa_payload_t *sa_payload)
697 {
698 u_int32_t lifetime;
699 u_int64_t lifebytes;
700
701 lifetime = sa_payload->get_lifetime(sa_payload);
702 lifebytes = sa_payload->get_lifebytes(sa_payload);
703 if (this->lifetime != lifetime)
704 {
705 DBG1(DBG_IKE, "received %us lifetime, configured %us",
706 lifetime, this->lifetime);
707 this->lifetime = lifetime;
708 }
709 if (this->lifebytes != lifebytes)
710 {
711 DBG1(DBG_IKE, "received %llu lifebytes, configured %llu",
712 lifebytes, this->lifebytes);
713 this->lifebytes = lifebytes;
714 }
715 }
716
717 /**
718 * Set the task ready to build notify error message
719 */
720 static status_t send_notify(private_quick_mode_t *this, notify_type_t type)
721 {
722 notify_payload_t *notify;
723
724 notify = notify_payload_create_from_protocol_and_type(NOTIFY_V1,
725 PROTO_ESP, type);
726 notify->set_spi(notify, this->spi_i);
727
728 this->ike_sa->queue_task(this->ike_sa,
729 (task_t*)informational_create(this->ike_sa, notify));
730 /* cancel all active/passive tasks in favour of informational */
731 this->ike_sa->flush_queue(this->ike_sa,
732 this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
733 return ALREADY_DONE;
734 }
735
736 METHOD(task_t, build_i, status_t,
737 private_quick_mode_t *this, message_t *message)
738 {
739 switch (this->state)
740 {
741 case QM_INIT:
742 {
743 enumerator_t *enumerator;
744 sa_payload_t *sa_payload;
745 linked_list_t *list, *tsi, *tsr;
746 proposal_t *proposal;
747 diffie_hellman_group_t group;
748 encap_t encap;
749
750 this->udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
751 this->mode = this->config->get_mode(this->config);
752 this->child_sa = child_sa_create(
753 this->ike_sa->get_my_host(this->ike_sa),
754 this->ike_sa->get_other_host(this->ike_sa),
755 this->config, this->reqid, this->udp);
756
757 if (this->udp && this->mode == MODE_TRANSPORT)
758 {
759 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
760 add_nat_oa_payloads(this, message);
761 }
762
763 if (this->config->use_ipcomp(this->config))
764 {
765 this->cpi_i = this->child_sa->alloc_cpi(this->child_sa);
766 if (!this->cpi_i)
767 {
768 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, "
769 "IPComp disabled");
770 }
771 }
772
773 this->spi_i = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
774 if (!this->spi_i)
775 {
776 DBG1(DBG_IKE, "allocating SPI from kernel failed");
777 return FAILED;
778 }
779 group = this->config->get_dh_group(this->config);
780 if (group != MODP_NONE)
781 {
782 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
783 group);
784 if (!this->dh)
785 {
786 DBG1(DBG_IKE, "configured DH group %N not supported",
787 diffie_hellman_group_names, group);
788 return FAILED;
789 }
790 }
791
792 list = this->config->get_proposals(this->config, FALSE);
793 enumerator = list->create_enumerator(list);
794 while (enumerator->enumerate(enumerator, &proposal))
795 {
796 if (group != MODP_NONE)
797 {
798 if (!proposal->has_dh_group(proposal, group))
799 {
800 list->remove_at(list, enumerator);
801 proposal->destroy(proposal);
802 continue;
803 }
804 proposal->strip_dh(proposal, group);
805 }
806 proposal->set_spi(proposal, this->spi_i);
807 }
808 enumerator->destroy(enumerator);
809
810 get_lifetimes(this);
811 encap = get_encap(this->ike_sa, this->udp);
812 sa_payload = sa_payload_create_from_proposals_v1(list,
813 this->lifetime, this->lifebytes, AUTH_NONE,
814 this->mode, encap, this->cpi_i);
815 list->destroy_offset(list, offsetof(proposal_t, destroy));
816 message->add_payload(message, &sa_payload->payload_interface);
817
818 if (!add_nonce(this, &this->nonce_i, message))
819 {
820 return FAILED;
821 }
822 if (group != MODP_NONE)
823 {
824 add_ke(this, message);
825 }
826 if (!this->tsi)
827 {
828 this->tsi = select_ts(this, TRUE, NULL);
829 }
830 if (!this->tsr)
831 {
832 this->tsr = select_ts(this, FALSE, NULL);
833 }
834 tsi = linked_list_create_with_items(this->tsi, NULL);
835 tsr = linked_list_create_with_items(this->tsr, NULL);
836 this->tsi = this->tsr = NULL;
837 charon->bus->narrow(charon->bus, this->child_sa,
838 NARROW_INITIATOR_PRE_AUTH, tsi, tsr);
839 tsi->remove_first(tsi, (void**)&this->tsi);
840 tsr->remove_first(tsr, (void**)&this->tsr);
841 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
842 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
843 if (!this->tsi || !this->tsr)
844 {
845 return FAILED;
846 }
847 add_ts(this, message);
848 return NEED_MORE;
849 }
850 case QM_NEGOTIATED:
851 {
852 return SUCCESS;
853 }
854 default:
855 return FAILED;
856 }
857 }
858
859 /**
860 * Check for notify errors, return TRUE if error found
861 */
862 static bool has_notify_errors(private_quick_mode_t *this, message_t *message)
863 {
864 enumerator_t *enumerator;
865 payload_t *payload;
866 bool err = FALSE;
867
868 enumerator = message->create_payload_enumerator(message);
869 while (enumerator->enumerate(enumerator, &payload))
870 {
871 if (payload->get_type(payload) == NOTIFY_V1)
872 {
873 notify_payload_t *notify;
874 notify_type_t type;
875
876 notify = (notify_payload_t*)payload;
877 type = notify->get_notify_type(notify);
878 if (type < 16384)
879 {
880
881 DBG1(DBG_IKE, "received %N error notify",
882 notify_type_names, type);
883 err = TRUE;
884 }
885 else
886 {
887 DBG1(DBG_IKE, "received %N notify", notify_type_names, type);
888 }
889 }
890 }
891 enumerator->destroy(enumerator);
892
893 return err;
894 }
895
896 /**
897 * Check if this is a rekey for an existing CHILD_SA, reuse reqid if so
898 */
899 static void check_for_rekeyed_child(private_quick_mode_t *this)
900 {
901 enumerator_t *enumerator, *policies;
902 traffic_selector_t *local, *remote;
903 child_sa_t *child_sa;
904 proposal_t *proposal;
905 char *name;
906
907 name = this->config->get_name(this->config);
908 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
909 while (this->reqid == 0 && enumerator->enumerate(enumerator, &child_sa))
910 {
911 if (streq(child_sa->get_name(child_sa), name))
912 {
913 proposal = child_sa->get_proposal(child_sa);
914 switch (child_sa->get_state(child_sa))
915 {
916 case CHILD_INSTALLED:
917 case CHILD_REKEYING:
918 policies = child_sa->create_policy_enumerator(child_sa);
919 if (policies->enumerate(policies, &local, &remote) &&
920 local->equals(local, this->tsr) &&
921 remote->equals(remote, this->tsi) &&
922 this->proposal->equals(this->proposal, proposal))
923 {
924 this->reqid = child_sa->get_reqid(child_sa);
925 this->rekey = child_sa->get_spi(child_sa, TRUE);
926 child_sa->set_state(child_sa, CHILD_REKEYING);
927 DBG1(DBG_IKE, "detected rekeying of CHILD_SA %s{%u}",
928 child_sa->get_name(child_sa), this->reqid);
929 }
930 policies->destroy(policies);
931 break;
932 default:
933 break;
934 }
935 }
936 }
937 enumerator->destroy(enumerator);
938 }
939
940 METHOD(task_t, process_r, status_t,
941 private_quick_mode_t *this, message_t *message)
942 {
943 switch (this->state)
944 {
945 case QM_INIT:
946 {
947 sa_payload_t *sa_payload;
948 linked_list_t *tsi, *tsr, *hostsi, *hostsr, *list = NULL;
949 peer_cfg_t *peer_cfg;
950 u_int16_t group;
951 bool private;
952
953 sa_payload = (sa_payload_t*)message->get_payload(message,
954 SECURITY_ASSOCIATION_V1);
955 if (!sa_payload)
956 {
957 DBG1(DBG_IKE, "sa payload missing");
958 return send_notify(this, INVALID_PAYLOAD_TYPE);
959 }
960
961 this->mode = sa_payload->get_encap_mode(sa_payload, &this->udp);
962
963 if (!get_ts(this, message))
964 {
965 return FAILED;
966 }
967 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
968 tsi = linked_list_create_with_items(this->tsi, NULL);
969 tsr = linked_list_create_with_items(this->tsr, NULL);
970 this->tsi = this->tsr = NULL;
971 hostsi = get_dynamic_hosts(this->ike_sa, FALSE);
972 hostsr = get_dynamic_hosts(this->ike_sa, TRUE);
973 this->config = peer_cfg->select_child_cfg(peer_cfg, tsr, tsi,
974 hostsr, hostsi);
975 hostsi->destroy(hostsi);
976 hostsr->destroy(hostsr);
977 if (this->config)
978 {
979 this->tsi = select_ts(this, FALSE, tsi);
980 this->tsr = select_ts(this, TRUE, tsr);
981 }
982 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
983 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
984 if (!this->config || !this->tsi || !this->tsr)
985 {
986 DBG1(DBG_IKE, "no matching CHILD_SA config found");
987 return send_notify(this, INVALID_ID_INFORMATION);
988 }
989
990 if (this->config->use_ipcomp(this->config))
991 {
992 list = sa_payload->get_ipcomp_proposals(sa_payload,
993 &this->cpi_i);
994 if (!list->get_count(list))
995 {
996 DBG1(DBG_IKE, "expected IPComp proposal but peer did "
997 "not send one, IPComp disabled");
998 this->cpi_i = 0;
999 }
1000 }
1001 if (!list || !list->get_count(list))
1002 {
1003 DESTROY_IF(list);
1004 list = sa_payload->get_proposals(sa_payload);
1005 }
1006 private = this->ike_sa->supports_extension(this->ike_sa,
1007 EXT_STRONGSWAN);
1008 this->proposal = this->config->select_proposal(this->config,
1009 list, FALSE, private);
1010 list->destroy_offset(list, offsetof(proposal_t, destroy));
1011
1012 get_lifetimes(this);
1013 apply_lifetimes(this, sa_payload);
1014
1015 if (!this->proposal)
1016 {
1017 DBG1(DBG_IKE, "no matching proposal found, sending %N",
1018 notify_type_names, NO_PROPOSAL_CHOSEN);
1019 return send_notify(this, NO_PROPOSAL_CHOSEN);
1020 }
1021 this->spi_i = this->proposal->get_spi(this->proposal);
1022
1023 if (!get_nonce(this, &this->nonce_i, message))
1024 {
1025 return send_notify(this, INVALID_PAYLOAD_TYPE);
1026 }
1027
1028 if (this->proposal->get_algorithm(this->proposal,
1029 DIFFIE_HELLMAN_GROUP, &group, NULL))
1030 {
1031 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
1032 group);
1033 if (!this->dh)
1034 {
1035 DBG1(DBG_IKE, "negotiated DH group %N not supported",
1036 diffie_hellman_group_names, group);
1037 return send_notify(this, INVALID_KEY_INFORMATION);
1038 }
1039 if (!get_ke(this, message))
1040 {
1041 return send_notify(this, INVALID_PAYLOAD_TYPE);
1042 }
1043 }
1044
1045 check_for_rekeyed_child(this);
1046
1047 this->child_sa = child_sa_create(
1048 this->ike_sa->get_my_host(this->ike_sa),
1049 this->ike_sa->get_other_host(this->ike_sa),
1050 this->config, this->reqid, this->udp);
1051
1052 tsi = linked_list_create_with_items(this->tsi, NULL);
1053 tsr = linked_list_create_with_items(this->tsr, NULL);
1054 this->tsi = this->tsr = NULL;
1055 charon->bus->narrow(charon->bus, this->child_sa,
1056 NARROW_RESPONDER, tsr, tsi);
1057 if (tsi->remove_first(tsi, (void**)&this->tsi) != SUCCESS ||
1058 tsr->remove_first(tsr, (void**)&this->tsr) != SUCCESS)
1059 {
1060 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1061 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1062 return send_notify(this, INVALID_ID_INFORMATION);
1063 }
1064 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1065 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1066
1067 return NEED_MORE;
1068 }
1069 case QM_NEGOTIATED:
1070 {
1071 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
1072 has_notify_errors(this, message))
1073 {
1074 return SUCCESS;
1075 }
1076 if (!install(this))
1077 {
1078 ike_sa_t *ike_sa = this->ike_sa;
1079 task_t *task;
1080
1081 task = (task_t*)quick_delete_create(this->ike_sa,
1082 this->proposal->get_protocol(this->proposal),
1083 this->spi_i, TRUE, TRUE);
1084 /* flush_queue() destroys the current task */
1085 ike_sa->flush_queue(ike_sa, TASK_QUEUE_PASSIVE);
1086 ike_sa->queue_task(ike_sa, task);
1087 return ALREADY_DONE;
1088 }
1089 return SUCCESS;
1090 }
1091 default:
1092 return FAILED;
1093 }
1094 }
1095
1096 METHOD(task_t, build_r, status_t,
1097 private_quick_mode_t *this, message_t *message)
1098 {
1099 switch (this->state)
1100 {
1101 case QM_INIT:
1102 {
1103 sa_payload_t *sa_payload;
1104 encap_t encap;
1105
1106 this->spi_r = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
1107 if (!this->spi_r)
1108 {
1109 DBG1(DBG_IKE, "allocating SPI from kernel failed");
1110 return send_notify(this, NO_PROPOSAL_CHOSEN);
1111 }
1112 this->proposal->set_spi(this->proposal, this->spi_r);
1113
1114 if (this->cpi_i)
1115 {
1116 this->cpi_r = this->child_sa->alloc_cpi(this->child_sa);
1117 if (!this->cpi_r)
1118 {
1119 DBG1(DBG_IKE, "unable to allocate a CPI from "
1120 "kernel, IPComp disabled");
1121 return send_notify(this, NO_PROPOSAL_CHOSEN);
1122 }
1123 }
1124
1125 if (this->udp && this->mode == MODE_TRANSPORT)
1126 {
1127 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
1128 add_nat_oa_payloads(this, message);
1129 }
1130
1131 encap = get_encap(this->ike_sa, this->udp);
1132 sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
1133 this->lifetime, this->lifebytes, AUTH_NONE,
1134 this->mode, encap, this->cpi_r);
1135 message->add_payload(message, &sa_payload->payload_interface);
1136
1137 if (!add_nonce(this, &this->nonce_r, message))
1138 {
1139 return FAILED;
1140 }
1141 if (this->dh)
1142 {
1143 add_ke(this, message);
1144 }
1145
1146 add_ts(this, message);
1147
1148 this->state = QM_NEGOTIATED;
1149 return NEED_MORE;
1150 }
1151 default:
1152 return FAILED;
1153 }
1154 }
1155
1156 METHOD(task_t, process_i, status_t,
1157 private_quick_mode_t *this, message_t *message)
1158 {
1159 switch (this->state)
1160 {
1161 case QM_INIT:
1162 {
1163 sa_payload_t *sa_payload;
1164 linked_list_t *list = NULL;
1165 bool private;
1166
1167 sa_payload = (sa_payload_t*)message->get_payload(message,
1168 SECURITY_ASSOCIATION_V1);
1169 if (!sa_payload)
1170 {
1171 DBG1(DBG_IKE, "sa payload missing");
1172 return send_notify(this, NO_PROPOSAL_CHOSEN);
1173 }
1174 if (this->cpi_i)
1175 {
1176 list = sa_payload->get_ipcomp_proposals(sa_payload,
1177 &this->cpi_r);
1178 if (!list->get_count(list))
1179 {
1180 DBG1(DBG_IKE, "peer did not acccept our IPComp proposal, "
1181 "IPComp disabled");
1182 this->cpi_i = 0;
1183 }
1184 }
1185 if (!list || !list->get_count(list))
1186 {
1187 DESTROY_IF(list);
1188 list = sa_payload->get_proposals(sa_payload);
1189 }
1190 private = this->ike_sa->supports_extension(this->ike_sa,
1191 EXT_STRONGSWAN);
1192 this->proposal = this->config->select_proposal(this->config,
1193 list, FALSE, private);
1194 list->destroy_offset(list, offsetof(proposal_t, destroy));
1195 if (!this->proposal)
1196 {
1197 DBG1(DBG_IKE, "no matching proposal found");
1198 return send_notify(this, NO_PROPOSAL_CHOSEN);
1199 }
1200 this->spi_r = this->proposal->get_spi(this->proposal);
1201
1202 apply_lifetimes(this, sa_payload);
1203
1204 if (!get_nonce(this, &this->nonce_r, message))
1205 {
1206 return send_notify(this, INVALID_PAYLOAD_TYPE);
1207 }
1208 if (this->dh && !get_ke(this, message))
1209 {
1210 return send_notify(this, INVALID_KEY_INFORMATION);
1211 }
1212 if (!get_ts(this, message))
1213 {
1214 return send_notify(this, INVALID_PAYLOAD_TYPE);
1215 }
1216 if (!install(this))
1217 {
1218 return send_notify(this, NO_PROPOSAL_CHOSEN);
1219 }
1220 this->state = QM_NEGOTIATED;
1221 return NEED_MORE;
1222 }
1223 default:
1224 return FAILED;
1225 }
1226 }
1227
1228 METHOD(task_t, get_type, task_type_t,
1229 private_quick_mode_t *this)
1230 {
1231 return TASK_QUICK_MODE;
1232 }
1233
1234 METHOD(quick_mode_t, use_reqid, void,
1235 private_quick_mode_t *this, u_int32_t reqid)
1236 {
1237 this->reqid = reqid;
1238 }
1239
1240 METHOD(quick_mode_t, rekey, void,
1241 private_quick_mode_t *this, u_int32_t spi)
1242 {
1243 this->rekey = spi;
1244 }
1245
1246 METHOD(task_t, migrate, void,
1247 private_quick_mode_t *this, ike_sa_t *ike_sa)
1248 {
1249 chunk_free(&this->nonce_i);
1250 chunk_free(&this->nonce_r);
1251 DESTROY_IF(this->tsi);
1252 DESTROY_IF(this->tsr);
1253 DESTROY_IF(this->proposal);
1254 DESTROY_IF(this->child_sa);
1255 DESTROY_IF(this->dh);
1256
1257 this->ike_sa = ike_sa;
1258 this->keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa);
1259 this->state = QM_INIT;
1260 this->tsi = NULL;
1261 this->tsr = NULL;
1262 this->proposal = NULL;
1263 this->child_sa = NULL;
1264 this->dh = NULL;
1265 this->spi_i = 0;
1266 this->spi_r = 0;
1267
1268 if (!this->initiator)
1269 {
1270 DESTROY_IF(this->config);
1271 this->config = NULL;
1272 }
1273 }
1274
1275 METHOD(task_t, destroy, void,
1276 private_quick_mode_t *this)
1277 {
1278 chunk_free(&this->nonce_i);
1279 chunk_free(&this->nonce_r);
1280 DESTROY_IF(this->tsi);
1281 DESTROY_IF(this->tsr);
1282 DESTROY_IF(this->proposal);
1283 DESTROY_IF(this->child_sa);
1284 DESTROY_IF(this->config);
1285 DESTROY_IF(this->dh);
1286 free(this);
1287 }
1288
1289 /*
1290 * Described in header.
1291 */
1292 quick_mode_t *quick_mode_create(ike_sa_t *ike_sa, child_cfg_t *config,
1293 traffic_selector_t *tsi, traffic_selector_t *tsr)
1294 {
1295 private_quick_mode_t *this;
1296
1297 INIT(this,
1298 .public = {
1299 .task = {
1300 .get_type = _get_type,
1301 .migrate = _migrate,
1302 .destroy = _destroy,
1303 },
1304 .use_reqid = _use_reqid,
1305 .rekey = _rekey,
1306 },
1307 .ike_sa = ike_sa,
1308 .initiator = config != NULL,
1309 .config = config,
1310 .keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa),
1311 .state = QM_INIT,
1312 .tsi = tsi ? tsi->clone(tsi) : NULL,
1313 .tsr = tsr ? tsr->clone(tsr) : NULL,
1314 );
1315
1316 if (config)
1317 {
1318 this->public.task.build = _build_i;
1319 this->public.task.process = _process_i;
1320 }
1321 else
1322 {
1323 this->public.task.build = _build_r;
1324 this->public.task.process = _process_r;
1325 }
1326
1327 return &this->public;
1328 }