src/libcharon/sa/ikev1/tasks/quick_mode.c

   1 /*
   2  * Copyright (C) 2012 Tobias Brunner
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * Copyright (C) 2011 Martin Willi
   6  * Copyright (C) 2011 revosec AG
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 #include "quick_mode.h"
  20
  21 #include <string.h>
  22
  23 #include <daemon.h>
  24 #include <sa/ikev1/keymat_v1.h>
  25 #include <encoding/payloads/sa_payload.h>
  26 #include <encoding/payloads/nonce_payload.h>
  27 #include <encoding/payloads/ke_payload.h>
  28 #include <encoding/payloads/id_payload.h>
  29 #include <encoding/payloads/payload.h>
  30 #include <sa/ikev1/tasks/informational.h>
  31 #include <sa/ikev1/tasks/quick_delete.h>
  32 #include <processing/jobs/inactivity_job.h>
  33
  34 typedef struct private_quick_mode_t private_quick_mode_t;
  35
  36 /**
  37  * Private members of a quick_mode_t task.
  38  */
  39 struct private_quick_mode_t {
  40
  41         /**
  42          * Public methods and task_t interface.
  43          */
  44         quick_mode_t public;
  45
  46         /**
  47          * Assigned IKE_SA.
  48          */
  49         ike_sa_t *ike_sa;
  50
  51         /**
  52          * TRUE if we are initiating quick mode
  53          */
  54         bool initiator;
  55
  56         /**
  57          * Traffic selector of initiator
  58          */
  59         traffic_selector_t *tsi;
  60
  61         /**
  62          * Traffic selector of responder
  63          */
  64         traffic_selector_t *tsr;
  65
  66         /**
  67          * Initiators nonce
  68          */
  69         chunk_t nonce_i;
  70
  71         /**
  72          * Responder nonce
  73          */
  74         chunk_t nonce_r;
  75
  76         /**
  77          * Initiators ESP SPI
  78          */
  79         u_int32_t spi_i;
  80
  81         /**
  82          * Responder ESP SPI
  83          */
  84         u_int32_t spi_r;
  85
  86         /**
  87          * Initiators IPComp CPI
  88          */
  89         u_int16_t cpi_i;
  90
  91         /**
  92          * Responders IPComp CPI
  93          */
  94         u_int16_t cpi_r;
  95
  96         /**
  97          * selected CHILD_SA proposal
  98          */
  99         proposal_t *proposal;
 100
 101         /**
 102          * Config of CHILD_SA to establish
 103          */
 104         child_cfg_t *config;
 105
 106         /**
 107          * CHILD_SA we are about to establish
 108          */
 109         child_sa_t *child_sa;
 110
 111         /**
 112          * IKEv1 keymat
 113          */
 114         keymat_v1_t *keymat;
 115
 116         /**
 117          * DH exchange, when PFS is in use
 118          */
 119         diffie_hellman_t *dh;
 120
 121         /**
 122          * Negotiated lifetime of new SA
 123          */
 124         u_int32_t lifetime;
 125
 126         /**
 127          * Negotaited lifebytes of new SA
 128          */
 129         u_int64_t lifebytes;
 130
 131         /**
 132          * Reqid to use, 0 for auto-allocate
 133          */
 134         u_int32_t reqid;
 135
 136         /**
 137          * SPI of SA we rekey
 138          */
 139         u_int32_t rekey;
 140
 141         /**
 142          * Negotiated mode, tunnel or transport
 143          */
 144         ipsec_mode_t mode;
 145
 146         /**
 147          * Use UDP encapsulation
 148          */
 149         bool udp;
 150
 151         /** states of quick mode */
 152         enum {
 153                 QM_INIT,
 154                 QM_NEGOTIATED,
 155         } state;
 156 };
 157
 158 /**
 159  * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
 160  */
 161 static void schedule_inactivity_timeout(private_quick_mode_t *this)
 162 {
 163         u_int32_t timeout;
 164         bool close_ike;
 165
 166         timeout = this->config->get_inactivity(this->config);
 167         if (timeout)
 168         {
 169                 close_ike = lib->settings->get_bool(lib->settings,
 170                                                                 "%s.inactivity_close_ike", FALSE, charon->name);
 171                 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
 172                                 inactivity_job_create(this->child_sa->get_reqid(this->child_sa),
 173                                                                           timeout, close_ike), timeout);
 174         }
 175 }
 176
 177 /**
 178  * Check if we have a an address pool configured
 179  */
 180 static bool have_pool(ike_sa_t *ike_sa)
 181 {
 182         enumerator_t *enumerator;
 183         peer_cfg_t *peer_cfg;
 184         char *pool;
 185         bool found = FALSE;
 186
 187         peer_cfg = ike_sa->get_peer_cfg(ike_sa);
 188         if (peer_cfg)
 189         {
 190                 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
 191                 if (enumerator->enumerate(enumerator, &pool))
 192                 {
 193                         found = TRUE;
 194                 }
 195                 enumerator->destroy(enumerator);
 196         }
 197         return found;
 198 }
 199
 200 /**
 201  * Get host to use for dynamic traffic selectors
 202  */
 203 static host_t *get_dynamic_host(ike_sa_t *ike_sa, bool local)
 204 {
 205         enumerator_t *enumerator;
 206         host_t *host;
 207
 208         enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
 209         if (!enumerator->enumerate(enumerator, &host))
 210         {
 211                 if (local)
 212                 {
 213                         host = ike_sa->get_my_host(ike_sa);
 214                 }
 215                 else
 216                 {
 217                         if (have_pool(ike_sa))
 218                         {
 219                                 /* we have an IP address pool, but didn't negotiate a
 220                                  * virtual IP. */
 221                                 host = NULL;
 222                         }
 223                         else
 224                         {
 225                                 host = ike_sa->get_other_host(ike_sa);
 226                         }
 227                 }
 228         }
 229         enumerator->destroy(enumerator);
 230         return host;
 231 }
 232
 233 /**
 234  * Install negotiated CHILD_SA
 235  */
 236 static bool install(private_quick_mode_t *this)
 237 {
 238         status_t status, status_i, status_o;
 239         chunk_t encr_i, encr_r, integ_i, integ_r;
 240         linked_list_t *tsi, *tsr;
 241         child_sa_t *old = NULL;
 242
 243         this->child_sa->set_proposal(this->child_sa, this->proposal);
 244         this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
 245         this->child_sa->set_mode(this->child_sa, this->mode);
 246
 247         if (this->cpi_i && this->cpi_r)
 248         {       /* DEFLATE is the only transform we currently support */
 249                 this->child_sa->set_ipcomp(this->child_sa, IPCOMP_DEFLATE);
 250         }
 251         else
 252         {
 253                 this->cpi_i = this->cpi_r = 0;
 254         }
 255
 256         this->child_sa->set_protocol(this->child_sa,
 257                                                                  this->proposal->get_protocol(this->proposal));
 258
 259         status_i = status_o = FAILED;
 260         encr_i = encr_r = integ_i = integ_r = chunk_empty;
 261         tsi = linked_list_create();
 262         tsr = linked_list_create();
 263         tsi->insert_last(tsi, this->tsi->clone(this->tsi));
 264         tsr->insert_last(tsr, this->tsr->clone(this->tsr));
 265         if (this->initiator)
 266         {
 267                 charon->bus->narrow(charon->bus, this->child_sa,
 268                                                         NARROW_INITIATOR_POST_AUTH, tsi, tsr);
 269         }
 270         else
 271         {
 272                 charon->bus->narrow(charon->bus, this->child_sa,
 273                                                         NARROW_RESPONDER_POST, tsr, tsi);
 274         }
 275         if (tsi->get_count(tsi) == 0 || tsr->get_count(tsr) == 0)
 276         {
 277                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 278                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 279                 DBG1(DBG_IKE, "no acceptable traffic selectors found");
 280                 return FALSE;
 281         }
 282
 283         if (this->keymat->derive_child_keys(this->keymat, this->proposal, this->dh,
 284                                                 this->spi_i, this->spi_r, this->nonce_i, this->nonce_r,
 285                                                 &encr_i, &integ_i, &encr_r, &integ_r))
 286         {
 287                 if (this->initiator)
 288                 {
 289                         status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
 290                                                         this->spi_i, this->cpi_i, TRUE, FALSE, tsi, tsr);
 291                         status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
 292                                                         this->spi_r, this->cpi_r, FALSE, FALSE, tsi, tsr);
 293                 }
 294                 else
 295                 {
 296                         status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
 297                                                         this->spi_r, this->cpi_r, TRUE, FALSE, tsr, tsi);
 298                         status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
 299                                                         this->spi_i, this->cpi_i, FALSE, FALSE, tsr, tsi);
 300                 }
 301         }
 302         chunk_clear(&integ_i);
 303         chunk_clear(&integ_r);
 304         chunk_clear(&encr_i);
 305         chunk_clear(&encr_r);
 306
 307         if (status_i != SUCCESS || status_o != SUCCESS)
 308         {
 309                 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
 310                         (status_i != SUCCESS) ? "inbound " : "",
 311                         (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
 312                         (status_o != SUCCESS) ? "outbound " : "");
 313                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 314                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 315                 return FALSE;
 316         }
 317
 318         if (this->initiator)
 319         {
 320                 status = this->child_sa->add_policies(this->child_sa, tsi, tsr);
 321         }
 322         else
 323         {
 324                 status = this->child_sa->add_policies(this->child_sa, tsr, tsi);
 325         }
 326         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 327         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 328         if (status != SUCCESS)
 329         {
 330                 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
 331                 return FALSE;
 332         }
 333
 334         charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
 335                                                         this->dh, this->nonce_i, this->nonce_r);
 336
 337         /* add to IKE_SA, and remove from task */
 338         this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 339         this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
 340
 341         DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
 342                  "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
 343                  this->child_sa->get_name(this->child_sa),
 344                  this->child_sa->get_reqid(this->child_sa),
 345                  ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
 346                  ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
 347                  this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
 348                  this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
 349
 350         if (this->rekey)
 351         {
 352                 old = this->ike_sa->get_child_sa(this->ike_sa,
 353                                                                 this->proposal->get_protocol(this->proposal),
 354                                                                 this->rekey, TRUE);
 355         }
 356         if (old)
 357         {
 358                 charon->bus->child_rekey(charon->bus, old, this->child_sa);
 359         }
 360         else
 361         {
 362                 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
 363         }
 364         if (!this->rekey)
 365         {
 366                 schedule_inactivity_timeout(this);
 367         }
 368         this->child_sa = NULL;
 369         return TRUE;
 370 }
 371
 372 /**
 373  * Generate and add NONCE
 374  */
 375 static bool add_nonce(private_quick_mode_t *this, chunk_t *nonce,
 376                                           message_t *message)
 377 {
 378         nonce_payload_t *nonce_payload;
 379         nonce_gen_t *nonceg;
 380
 381         nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
 382         if (!nonceg)
 383         {
 384                 DBG1(DBG_IKE, "no nonce generator found to create nonce");
 385                 return FALSE;
 386         }
 387         if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, nonce))
 388         {
 389                 DBG1(DBG_IKE, "nonce allocation failed");
 390                 nonceg->destroy(nonceg);
 391                 return FALSE;
 392         }
 393         nonceg->destroy(nonceg);
 394
 395         nonce_payload = nonce_payload_create(NONCE_V1);
 396         nonce_payload->set_nonce(nonce_payload, *nonce);
 397         message->add_payload(message, &nonce_payload->payload_interface);
 398
 399         return TRUE;
 400 }
 401
 402 /**
 403  * Extract nonce from NONCE payload
 404  */
 405 static bool get_nonce(private_quick_mode_t *this, chunk_t *nonce,
 406                                           message_t *message)
 407 {
 408         nonce_payload_t *nonce_payload;
 409
 410         nonce_payload = (nonce_payload_t*)message->get_payload(message, NONCE_V1);
 411         if (!nonce_payload)
 412         {
 413                 DBG1(DBG_IKE, "NONCE payload missing in message");
 414                 return FALSE;
 415         }
 416         *nonce = nonce_payload->get_nonce(nonce_payload);
 417
 418         return TRUE;
 419 }
 420
 421 /**
 422  * Add KE payload to message
 423  */
 424 static void add_ke(private_quick_mode_t *this, message_t *message)
 425 {
 426         ke_payload_t *ke_payload;
 427
 428         ke_payload = ke_payload_create_from_diffie_hellman(KEY_EXCHANGE_V1, this->dh);
 429         message->add_payload(message, &ke_payload->payload_interface);
 430 }
 431
 432 /**
 433  * Get DH value from a KE payload
 434  */
 435 static bool get_ke(private_quick_mode_t *this, message_t *message)
 436 {
 437         ke_payload_t *ke_payload;
 438
 439         ke_payload = (ke_payload_t*)message->get_payload(message, KEY_EXCHANGE_V1);
 440         if (!ke_payload)
 441         {
 442                 DBG1(DBG_IKE, "KE payload missing");
 443                 return FALSE;
 444         }
 445         this->dh->set_other_public_value(this->dh,
 446                                                                 ke_payload->get_key_exchange_data(ke_payload));
 447         return TRUE;
 448 }
 449
 450 /**
 451  * Select a traffic selector from configuration
 452  */
 453 static traffic_selector_t* select_ts(private_quick_mode_t *this, bool local,
 454                                                                          linked_list_t *supplied)
 455 {
 456         traffic_selector_t *ts;
 457         linked_list_t *list;
 458
 459         list = this->config->get_traffic_selectors(this->config, local,
 460                                                         supplied, get_dynamic_host(this->ike_sa, local));
 461         if (list->get_first(list, (void**)&ts) == SUCCESS)
 462         {
 463                 if (this->initiator && list->get_count(list) > 1)
 464                 {
 465                         DBG1(DBG_IKE, "configuration has more than one %s traffic selector,"
 466                                  " using first only", local ? "local" : "remote");
 467                 }
 468                 ts = ts->clone(ts);
 469         }
 470         else
 471         {
 472                 DBG1(DBG_IKE, "%s traffic selector missing in configuration",
 473                          local ? "local" : "local");
 474                 ts = NULL;
 475         }
 476         list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
 477         return ts;
 478 }
 479
 480 /**
 481  * Add selected traffic selectors to message
 482  */
 483 static void add_ts(private_quick_mode_t *this, message_t *message)
 484 {
 485         id_payload_t *id_payload;
 486         host_t *hsi, *hsr;
 487
 488         if (this->initiator)
 489         {
 490                 hsi = this->ike_sa->get_my_host(this->ike_sa);
 491                 hsr = this->ike_sa->get_other_host(this->ike_sa);
 492         }
 493         else
 494         {
 495                 hsr = this->ike_sa->get_my_host(this->ike_sa);
 496                 hsi = this->ike_sa->get_other_host(this->ike_sa);
 497         }
 498         /* add ID payload only if negotiating non host2host tunnels */
 499         if (!this->tsi->is_host(this->tsi, hsi) ||
 500                 !this->tsr->is_host(this->tsr, hsr) ||
 501                 this->tsi->get_protocol(this->tsi) ||
 502                 this->tsr->get_protocol(this->tsr) ||
 503                 this->tsi->get_from_port(this->tsi) ||
 504                 this->tsr->get_from_port(this->tsr) ||
 505                 this->tsi->get_to_port(this->tsi) != 65535 ||
 506                 this->tsr->get_to_port(this->tsr) != 65535)
 507         {
 508                 id_payload = id_payload_create_from_ts(this->tsi);
 509                 message->add_payload(message, &id_payload->payload_interface);
 510                 id_payload = id_payload_create_from_ts(this->tsr);
 511                 message->add_payload(message, &id_payload->payload_interface);
 512         }
 513 }
 514
 515 /**
 516  * Get traffic selectors from received message
 517  */
 518 static bool get_ts(private_quick_mode_t *this, message_t *message)
 519 {
 520         traffic_selector_t *tsi = NULL, *tsr = NULL;
 521         enumerator_t *enumerator;
 522         id_payload_t *id_payload;
 523         payload_t *payload;
 524         host_t *hsi, *hsr;
 525         bool first = TRUE;
 526
 527         enumerator = message->create_payload_enumerator(message);
 528         while (enumerator->enumerate(enumerator, &payload))
 529         {
 530                 if (payload->get_type(payload) == ID_V1)
 531                 {
 532                         id_payload = (id_payload_t*)payload;
 533
 534                         if (first)
 535                         {
 536                                 tsi = id_payload->get_ts(id_payload);
 537                                 first = FALSE;
 538                         }
 539                         else
 540                         {
 541                                 tsr = id_payload->get_ts(id_payload);
 542                                 break;
 543                         }
 544                 }
 545         }
 546         enumerator->destroy(enumerator);
 547
 548         /* create host2host selectors if ID payloads missing */
 549         if (this->initiator)
 550         {
 551                 hsi = this->ike_sa->get_my_host(this->ike_sa);
 552                 hsr = this->ike_sa->get_other_host(this->ike_sa);
 553         }
 554         else
 555         {
 556                 hsr = this->ike_sa->get_my_host(this->ike_sa);
 557                 hsi = this->ike_sa->get_other_host(this->ike_sa);
 558         }
 559         if (!tsi)
 560         {
 561                 tsi = traffic_selector_create_from_subnet(hsi->clone(hsi),
 562                                                         hsi->get_family(hsi) == AF_INET ? 32 : 128, 0, 0);
 563         }
 564         if (!tsr)
 565         {
 566                 tsr = traffic_selector_create_from_subnet(hsr->clone(hsr),
 567                                                         hsr->get_family(hsr) == AF_INET ? 32 : 128, 0, 0);
 568         }
 569         if (!this->initiator && this->mode == MODE_TRANSPORT && this->udp &&
 570            (!tsi->is_host(tsi, hsi) || !tsr->is_host(tsr, hsr)))
 571         {       /* change TS in case of a NAT in transport mode */
 572                 DBG2(DBG_IKE, "changing received traffic selectors %R=== %R due to NAT",
 573                          tsi, tsr);
 574                 tsi->set_address(tsi, hsi);
 575                 tsr->set_address(tsr, hsr);
 576         }
 577
 578         if (this->initiator)
 579         {
 580                 /* check if peer selection valid */
 581                 if (!tsr->is_contained_in(tsr, this->tsr) ||
 582                         !tsi->is_contained_in(tsi, this->tsi))
 583                 {
 584                         DBG1(DBG_IKE, "peer selected invalid traffic selectors: ",
 585                                  "%R for %R, %R for %R", tsi, this->tsi, tsr, this->tsr);
 586                         tsi->destroy(tsi);
 587                         tsr->destroy(tsr);
 588                         return FALSE;
 589                 }
 590                 this->tsi->destroy(this->tsi);
 591                 this->tsr->destroy(this->tsr);
 592                 this->tsi = tsi;
 593                 this->tsr = tsr;
 594         }
 595         else
 596         {
 597                 this->tsi = tsi;
 598                 this->tsr = tsr;
 599         }
 600         return TRUE;
 601 }
 602
 603 /**
 604  * Add NAT-OA payloads
 605  */
 606 static void add_nat_oa_payloads(private_quick_mode_t *this, message_t *message)
 607 {
 608         identification_t *id;
 609         id_payload_t *nat_oa;
 610         host_t *src, *dst;
 611
 612         src = message->get_source(message);
 613         dst = message->get_destination(message);
 614
 615         src = this->initiator ? src : dst;
 616         dst = this->initiator ? dst : src;
 617
 618         /* first NAT-OA is the initiator's address */
 619         id = identification_create_from_sockaddr(src->get_sockaddr(src));
 620         nat_oa = id_payload_create_from_identification(NAT_OA_V1, id);
 621         message->add_payload(message, (payload_t*)nat_oa);
 622         id->destroy(id);
 623
 624         /* second NAT-OA is that of the responder */
 625         id = identification_create_from_sockaddr(dst->get_sockaddr(dst));
 626         nat_oa = id_payload_create_from_identification(NAT_OA_V1, id);
 627         message->add_payload(message, (payload_t*)nat_oa);
 628         id->destroy(id);
 629 }
 630
 631 /**
 632  * Look up lifetimes
 633  */
 634 static void get_lifetimes(private_quick_mode_t *this)
 635 {
 636         lifetime_cfg_t *lft;
 637
 638         lft = this->config->get_lifetime(this->config);
 639         if (lft->time.life)
 640         {
 641                 this->lifetime = lft->time.life;
 642         }
 643         else if (lft->bytes.life)
 644         {
 645                 this->lifebytes = lft->bytes.life;
 646         }
 647         free(lft);
 648 }
 649
 650 /**
 651  * Check and apply lifetimes
 652  */
 653 static void apply_lifetimes(private_quick_mode_t *this, sa_payload_t *sa_payload)
 654 {
 655         u_int32_t lifetime;
 656         u_int64_t lifebytes;
 657
 658         lifetime = sa_payload->get_lifetime(sa_payload);
 659         lifebytes = sa_payload->get_lifebytes(sa_payload);
 660         if (this->lifetime != lifetime)
 661         {
 662                 DBG1(DBG_IKE, "received %us lifetime, configured %us",
 663                          lifetime, this->lifetime);
 664                 this->lifetime = lifetime;
 665         }
 666         if (this->lifebytes != lifebytes)
 667         {
 668                 DBG1(DBG_IKE, "received %llu lifebytes, configured %llu",
 669                          lifebytes, this->lifebytes);
 670                 this->lifebytes = lifebytes;
 671         }
 672 }
 673
 674 /**
 675  * Set the task ready to build notify error message
 676  */
 677 static status_t send_notify(private_quick_mode_t *this, notify_type_t type)
 678 {
 679         notify_payload_t *notify;
 680
 681         notify = notify_payload_create_from_protocol_and_type(NOTIFY_V1,
 682                                                                                                                   PROTO_ESP, type);
 683         notify->set_spi(notify, this->spi_i);
 684
 685         this->ike_sa->queue_task(this->ike_sa,
 686                                                 (task_t*)informational_create(this->ike_sa, notify));
 687         /* cancel all active/passive tasks in favour of informational */
 688         this->ike_sa->flush_queue(this->ike_sa,
 689                                         this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
 690         return ALREADY_DONE;
 691 }
 692
 693 METHOD(task_t, build_i, status_t,
 694         private_quick_mode_t *this, message_t *message)
 695 {
 696         switch (this->state)
 697         {
 698                 case QM_INIT:
 699                 {
 700                         enumerator_t *enumerator;
 701                         sa_payload_t *sa_payload;
 702                         linked_list_t *list, *tsi, *tsr;
 703                         proposal_t *proposal;
 704                         diffie_hellman_group_t group;
 705
 706                         this->udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
 707                         this->mode = this->config->get_mode(this->config);
 708                         this->child_sa = child_sa_create(
 709                                                                         this->ike_sa->get_my_host(this->ike_sa),
 710                                                                         this->ike_sa->get_other_host(this->ike_sa),
 711                                                                         this->config, this->reqid, this->udp);
 712
 713                         if (this->udp && this->mode == MODE_TRANSPORT)
 714                         {
 715                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
 716                                 add_nat_oa_payloads(this, message);
 717                         }
 718
 719                         if (this->config->use_ipcomp(this->config))
 720                         {
 721                                 if (this->udp)
 722                                 {
 723                                         DBG1(DBG_IKE, "IPComp is not supported if either peer is "
 724                                                  "natted, IPComp disabled");
 725                                 }
 726                                 else
 727                                 {
 728                                         this->cpi_i = this->child_sa->alloc_cpi(this->child_sa);
 729                                         if (!this->cpi_i)
 730                                         {
 731                                                 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, "
 732                                                          "IPComp disabled");
 733                                         }
 734                                 }
 735                         }
 736
 737                         this->spi_i = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
 738                         if (!this->spi_i)
 739                         {
 740                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
 741                                 return FAILED;
 742                         }
 743
 744                         list = this->config->get_proposals(this->config, FALSE);
 745                         enumerator = list->create_enumerator(list);
 746                         while (enumerator->enumerate(enumerator, &proposal))
 747                         {
 748                                 proposal->set_spi(proposal, this->spi_i);
 749                         }
 750                         enumerator->destroy(enumerator);
 751
 752                         get_lifetimes(this);
 753                         sa_payload = sa_payload_create_from_proposals_v1(list,
 754                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
 755                                                                 this->mode, this->udp, this->cpi_i);
 756                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 757                         message->add_payload(message, &sa_payload->payload_interface);
 758
 759                         if (!add_nonce(this, &this->nonce_i, message))
 760                         {
 761                                 return FAILED;
 762                         }
 763
 764                         group = this->config->get_dh_group(this->config);
 765                         if (group != MODP_NONE)
 766                         {
 767                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
 768                                                                                                                   group);
 769                                 if (!this->dh)
 770                                 {
 771                                         DBG1(DBG_IKE, "configured DH group %N not supported",
 772                                                  diffie_hellman_group_names, group);
 773                                         return FAILED;
 774                                 }
 775                                 add_ke(this, message);
 776                         }
 777                         if (!this->tsi)
 778                         {
 779                                 this->tsi = select_ts(this, TRUE, NULL);
 780                         }
 781                         if (!this->tsr)
 782                         {
 783                                 this->tsr = select_ts(this, FALSE, NULL);
 784                         }
 785                         tsi = linked_list_create();
 786                         tsr = linked_list_create();
 787                         tsi->insert_last(tsi, this->tsi);
 788                         tsr->insert_last(tsr, this->tsr);
 789                         this->tsi = this->tsr = NULL;
 790                         charon->bus->narrow(charon->bus, this->child_sa,
 791                                                                 NARROW_INITIATOR_PRE_AUTH, tsi, tsr);
 792                         tsi->remove_first(tsi, (void**)&this->tsi);
 793                         tsr->remove_first(tsr, (void**)&this->tsr);
 794                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 795                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 796                         if (!this->tsi || !this->tsr)
 797                         {
 798                                 return FAILED;
 799                         }
 800                         add_ts(this, message);
 801                         return NEED_MORE;
 802                 }
 803                 case QM_NEGOTIATED:
 804                 {
 805                         return SUCCESS;
 806                 }
 807                 default:
 808                         return FAILED;
 809         }
 810 }
 811
 812 /**
 813  * Check for notify errors, return TRUE if error found
 814  */
 815 static bool has_notify_errors(private_quick_mode_t *this, message_t *message)
 816 {
 817         enumerator_t *enumerator;
 818         payload_t *payload;
 819         bool err = FALSE;
 820
 821         enumerator = message->create_payload_enumerator(message);
 822         while (enumerator->enumerate(enumerator, &payload))
 823         {
 824                 if (payload->get_type(payload) == NOTIFY_V1)
 825                 {
 826                         notify_payload_t *notify;
 827                         notify_type_t type;
 828
 829                         notify = (notify_payload_t*)payload;
 830                         type = notify->get_notify_type(notify);
 831                         if (type < 16384)
 832                         {
 833
 834                                 DBG1(DBG_IKE, "received %N error notify",
 835                                          notify_type_names, type);
 836                                 err = TRUE;
 837                         }
 838                         else
 839                         {
 840                                 DBG1(DBG_IKE, "received %N notify", notify_type_names, type);
 841                         }
 842                 }
 843         }
 844         enumerator->destroy(enumerator);
 845
 846         return err;
 847 }
 848
 849 /**
 850  * Check if this is a rekey for an existing CHILD_SA, reuse reqid if so
 851  */
 852 static void check_for_rekeyed_child(private_quick_mode_t *this)
 853 {
 854         enumerator_t *enumerator, *policies;
 855         traffic_selector_t *local, *remote;
 856         child_sa_t *child_sa;
 857
 858         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
 859         while (this->reqid == 0 && enumerator->enumerate(enumerator, &child_sa))
 860         {
 861                 if (child_sa->get_state(child_sa) == CHILD_INSTALLED &&
 862                         streq(child_sa->get_name(child_sa),
 863                                   this->config->get_name(this->config)))
 864                 {
 865                         policies = child_sa->create_policy_enumerator(child_sa);
 866                         if (policies->enumerate(policies, &local, &remote))
 867                         {
 868                                 if (local->equals(local, this->tsr) &&
 869                                         remote->equals(remote, this->tsi) &&
 870                                         this->proposal->equals(this->proposal,
 871                                                                                    child_sa->get_proposal(child_sa)))
 872                                 {
 873                                         this->reqid = child_sa->get_reqid(child_sa);
 874                                         this->rekey = child_sa->get_spi(child_sa, TRUE);
 875                                         child_sa->set_state(child_sa, CHILD_REKEYING);
 876                                         DBG1(DBG_IKE, "detected rekeying of CHILD_SA %s{%u}",
 877                                                  child_sa->get_name(child_sa), this->reqid);
 878                                 }
 879                         }
 880                         policies->destroy(policies);
 881                 }
 882         }
 883         enumerator->destroy(enumerator);
 884 }
 885
 886 METHOD(task_t, process_r, status_t,
 887         private_quick_mode_t *this, message_t *message)
 888 {
 889         switch (this->state)
 890         {
 891                 case QM_INIT:
 892                 {
 893                         sa_payload_t *sa_payload;
 894                         linked_list_t *tsi, *tsr, *list = NULL;
 895                         peer_cfg_t *peer_cfg;
 896                         u_int16_t group;
 897                         bool private;
 898
 899                         sa_payload = (sa_payload_t*)message->get_payload(message,
 900                                                                                                         SECURITY_ASSOCIATION_V1);
 901                         if (!sa_payload)
 902                         {
 903                                 DBG1(DBG_IKE, "sa payload missing");
 904                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 905                         }
 906
 907                         this->mode = sa_payload->get_encap_mode(sa_payload, &this->udp);
 908
 909                         if (!get_ts(this, message))
 910                         {
 911                                 return FAILED;
 912                         }
 913                         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 914                         tsi = linked_list_create();
 915                         tsr = linked_list_create();
 916                         tsi->insert_last(tsi, this->tsi);
 917                         tsr->insert_last(tsr, this->tsr);
 918                         this->tsi = this->tsr = NULL;
 919                         this->config = peer_cfg->select_child_cfg(peer_cfg, tsr, tsi,
 920                                                                                 get_dynamic_host(this->ike_sa, TRUE),
 921                                                                                 get_dynamic_host(this->ike_sa, FALSE));
 922                         if (this->config)
 923                         {
 924                                 this->tsi = select_ts(this, FALSE, tsi);
 925                                 this->tsr = select_ts(this, TRUE, tsr);
 926                         }
 927                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 928                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 929                         if (!this->config || !this->tsi || !this->tsr)
 930                         {
 931                                 DBG1(DBG_IKE, "no matching CHILD_SA config found");
 932                                 return send_notify(this, INVALID_ID_INFORMATION);
 933                         }
 934
 935                         if (this->config->use_ipcomp(this->config))
 936                         {
 937                                 if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
 938                                 {
 939                                         DBG1(DBG_IKE, "IPComp is not supported if either peer is "
 940                                                  "natted, IPComp disabled");
 941                                 }
 942                                 else
 943                                 {
 944                                         list = sa_payload->get_ipcomp_proposals(sa_payload,
 945                                                                                                                         &this->cpi_i);
 946                                         if (!list->get_count(list))
 947                                         {
 948                                                 DBG1(DBG_IKE, "expected IPComp proposal but peer did "
 949                                                          "not send one, IPComp disabled");
 950                                                 this->cpi_i = 0;
 951                                         }
 952                                 }
 953                         }
 954                         if (!list || !list->get_count(list))
 955                         {
 956                                 DESTROY_IF(list);
 957                                 list = sa_payload->get_proposals(sa_payload);
 958                         }
 959                         private = this->ike_sa->supports_extension(this->ike_sa,
 960                                                                                                            EXT_STRONGSWAN);
 961                         this->proposal = this->config->select_proposal(this->config,
 962                                                                                                                    list, FALSE, private);
 963                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 964
 965                         get_lifetimes(this);
 966                         apply_lifetimes(this, sa_payload);
 967
 968                         if (!this->proposal)
 969                         {
 970                                 DBG1(DBG_IKE, "no matching proposal found, sending %N",
 971                                          notify_type_names, NO_PROPOSAL_CHOSEN);
 972                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
 973                         }
 974                         this->spi_i = this->proposal->get_spi(this->proposal);
 975
 976                         if (!get_nonce(this, &this->nonce_i, message))
 977                         {
 978                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 979                         }
 980
 981                         if (this->proposal->get_algorithm(this->proposal,
 982                                                                                 DIFFIE_HELLMAN_GROUP, &group, NULL))
 983                         {
 984                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
 985                                                                                                                   group);
 986                                 if (!this->dh)
 987                                 {
 988                                         DBG1(DBG_IKE, "negotiated DH group %N not supported",
 989                                                  diffie_hellman_group_names, group);
 990                                         return send_notify(this, INVALID_KEY_INFORMATION);
 991                                 }
 992                                 if (!get_ke(this, message))
 993                                 {
 994                                         return send_notify(this, INVALID_PAYLOAD_TYPE);
 995                                 }
 996                         }
 997
 998                         check_for_rekeyed_child(this);
 999
1000                         this->child_sa = child_sa_create(
1001                                                                         this->ike_sa->get_my_host(this->ike_sa),
1002                                                                         this->ike_sa->get_other_host(this->ike_sa),
1003                                                                         this->config, this->reqid, this->udp);
1004
1005                         tsi = linked_list_create();
1006                         tsr = linked_list_create();
1007                         tsi->insert_last(tsi, this->tsi);
1008                         tsr->insert_last(tsr, this->tsr);
1009                         this->tsi = this->tsr = NULL;
1010                         charon->bus->narrow(charon->bus, this->child_sa,
1011                                                                 NARROW_RESPONDER, tsr, tsi);
1012                         if (tsi->remove_first(tsi, (void**)&this->tsi) != SUCCESS ||
1013                                 tsr->remove_first(tsr, (void**)&this->tsr) != SUCCESS)
1014                         {
1015                                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1016                                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1017                                 return send_notify(this, INVALID_ID_INFORMATION);
1018                         }
1019                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1020                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1021
1022                         return NEED_MORE;
1023                 }
1024                 case QM_NEGOTIATED:
1025                 {
1026                         if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
1027                                 has_notify_errors(this, message))
1028                         {
1029                                 return SUCCESS;
1030                         }
1031                         if (!install(this))
1032                         {
1033                                 ike_sa_t *ike_sa = this->ike_sa;
1034                                 task_t *task;
1035
1036                                 task = (task_t*)quick_delete_create(this->ike_sa,
1037                                                                 this->proposal->get_protocol(this->proposal),
1038                                                                 this->spi_i, TRUE, TRUE);
1039                                 /* flush_queue() destroys the current task */
1040                                 ike_sa->flush_queue(ike_sa, TASK_QUEUE_PASSIVE);
1041                                 ike_sa->queue_task(ike_sa, task);
1042                                 return ALREADY_DONE;
1043                         }
1044                         return SUCCESS;
1045                 }
1046                 default:
1047                         return FAILED;
1048         }
1049 }
1050
1051 METHOD(task_t, build_r, status_t,
1052         private_quick_mode_t *this, message_t *message)
1053 {
1054         switch (this->state)
1055         {
1056                 case QM_INIT:
1057                 {
1058                         sa_payload_t *sa_payload;
1059
1060                         this->spi_r = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
1061                         if (!this->spi_r)
1062                         {
1063                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
1064                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1065                         }
1066                         this->proposal->set_spi(this->proposal, this->spi_r);
1067
1068                         if (this->cpi_i)
1069                         {
1070                                 this->cpi_r = this->child_sa->alloc_cpi(this->child_sa);
1071                                 if (!this->cpi_r)
1072                                 {
1073                                         DBG1(DBG_IKE, "unable to allocate a CPI from "
1074                                                  "kernel, IPComp disabled");
1075                                         return send_notify(this, NO_PROPOSAL_CHOSEN);
1076                                 }
1077                         }
1078
1079                         if (this->udp && this->mode == MODE_TRANSPORT)
1080                         {
1081                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
1082                                 add_nat_oa_payloads(this, message);
1083                         }
1084
1085                         sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
1086                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
1087                                                                 this->mode, this->udp, this->cpi_r);
1088                         message->add_payload(message, &sa_payload->payload_interface);
1089
1090                         if (!add_nonce(this, &this->nonce_r, message))
1091                         {
1092                                 return FAILED;
1093                         }
1094                         if (this->dh)
1095                         {
1096                                 add_ke(this, message);
1097                         }
1098
1099                         add_ts(this, message);
1100
1101                         this->state = QM_NEGOTIATED;
1102                         return NEED_MORE;
1103                 }
1104                 default:
1105                         return FAILED;
1106         }
1107 }
1108
1109 METHOD(task_t, process_i, status_t,
1110         private_quick_mode_t *this, message_t *message)
1111 {
1112         switch (this->state)
1113         {
1114                 case QM_INIT:
1115                 {
1116                         sa_payload_t *sa_payload;
1117                         linked_list_t *list = NULL;
1118                         bool private;
1119
1120                         sa_payload = (sa_payload_t*)message->get_payload(message,
1121                                                                                                         SECURITY_ASSOCIATION_V1);
1122                         if (!sa_payload)
1123                         {
1124                                 DBG1(DBG_IKE, "sa payload missing");
1125                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1126                         }
1127                         if (this->cpi_i)
1128                         {
1129                                 list = sa_payload->get_ipcomp_proposals(sa_payload,
1130                                                                                                                 &this->cpi_r);
1131                                 if (!list->get_count(list))
1132                                 {
1133                                         DBG1(DBG_IKE, "peer did not acccept our IPComp proposal, "
1134                                                  "IPComp disabled");
1135                                         this->cpi_i = 0;
1136                                 }
1137                         }
1138                         if (!list || !list->get_count(list))
1139                         {
1140                                 DESTROY_IF(list);
1141                                 list = sa_payload->get_proposals(sa_payload);
1142                         }
1143                         private = this->ike_sa->supports_extension(this->ike_sa,
1144                                                                                                            EXT_STRONGSWAN);
1145                         this->proposal = this->config->select_proposal(this->config,
1146                                                                                                                    list, FALSE, private);
1147                         list->destroy_offset(list, offsetof(proposal_t, destroy));
1148                         if (!this->proposal)
1149                         {
1150                                 DBG1(DBG_IKE, "no matching proposal found");
1151                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1152                         }
1153                         this->spi_r = this->proposal->get_spi(this->proposal);
1154
1155                         apply_lifetimes(this, sa_payload);
1156
1157                         if (!get_nonce(this, &this->nonce_r, message))
1158                         {
1159                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1160                         }
1161                         if (this->dh && !get_ke(this, message))
1162                         {
1163                                 return send_notify(this, INVALID_KEY_INFORMATION);
1164                         }
1165                         if (!get_ts(this, message))
1166                         {
1167                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1168                         }
1169                         if (!install(this))
1170                         {
1171                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1172                         }
1173                         this->state = QM_NEGOTIATED;
1174                         return NEED_MORE;
1175                 }
1176                 default:
1177                         return FAILED;
1178         }
1179 }
1180
1181 METHOD(task_t, get_type, task_type_t,
1182         private_quick_mode_t *this)
1183 {
1184         return TASK_QUICK_MODE;
1185 }
1186
1187 METHOD(quick_mode_t, use_reqid, void,
1188         private_quick_mode_t *this, u_int32_t reqid)
1189 {
1190         this->reqid = reqid;
1191 }
1192
1193 METHOD(quick_mode_t, rekey, void,
1194         private_quick_mode_t *this, u_int32_t spi)
1195 {
1196         this->rekey = spi;
1197 }
1198
1199 METHOD(task_t, migrate, void,
1200         private_quick_mode_t *this, ike_sa_t *ike_sa)
1201 {
1202         chunk_free(&this->nonce_i);
1203         chunk_free(&this->nonce_r);
1204         DESTROY_IF(this->tsi);
1205         DESTROY_IF(this->tsr);
1206         DESTROY_IF(this->proposal);
1207         DESTROY_IF(this->child_sa);
1208         DESTROY_IF(this->dh);
1209
1210         this->ike_sa = ike_sa;
1211         this->keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa);
1212         this->state = QM_INIT;
1213         this->tsi = NULL;
1214         this->tsr = NULL;
1215         this->proposal = NULL;
1216         this->child_sa = NULL;
1217         this->dh = NULL;
1218         this->spi_i = 0;
1219         this->spi_r = 0;
1220
1221         if (!this->initiator)
1222         {
1223                 DESTROY_IF(this->config);
1224                 this->config = NULL;
1225         }
1226 }
1227
1228 METHOD(task_t, destroy, void,
1229         private_quick_mode_t *this)
1230 {
1231         chunk_free(&this->nonce_i);
1232         chunk_free(&this->nonce_r);
1233         DESTROY_IF(this->tsi);
1234         DESTROY_IF(this->tsr);
1235         DESTROY_IF(this->proposal);
1236         DESTROY_IF(this->child_sa);
1237         DESTROY_IF(this->config);
1238         DESTROY_IF(this->dh);
1239         free(this);
1240 }
1241
1242 /*
1243  * Described in header.
1244  */
1245 quick_mode_t *quick_mode_create(ike_sa_t *ike_sa, child_cfg_t *config,
1246                                                         traffic_selector_t *tsi, traffic_selector_t *tsr)
1247 {
1248         private_quick_mode_t *this;
1249
1250         INIT(this,
1251                 .public = {
1252                         .task = {
1253                                 .get_type = _get_type,
1254                                 .migrate = _migrate,
1255                                 .destroy = _destroy,
1256                         },
1257                         .use_reqid = _use_reqid,
1258                         .rekey = _rekey,
1259                 },
1260                 .ike_sa = ike_sa,
1261                 .initiator = config != NULL,
1262                 .config = config,
1263                 .keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa),
1264                 .state = QM_INIT,
1265                 .tsi = tsi ? tsi->clone(tsi) : NULL,
1266                 .tsr = tsr ? tsr->clone(tsr) : NULL,
1267         );
1268
1269         if (config)
1270         {
1271                 this->public.task.build = _build_i;
1272                 this->public.task.process = _process_i;
1273         }
1274         else
1275         {
1276                 this->public.task.build = _build_r;
1277                 this->public.task.process = _process_r;
1278         }
1279
1280         return &this->public;
1281 }