92df0f0f8afac35c219c0a438b199da552de9559
[strongswan.git] / src / libcharon / sa / ikev1 / tasks / quick_mode.c
1 /*
2 * Copyright (C) 2012 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
4 *
5 * Copyright (C) 2011 Martin Willi
6 * Copyright (C) 2011 revosec AG
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 /*
20 * Copyright (C) 2012 Volker RĂ¼melin
21 *
22 * Permission is hereby granted, free of charge, to any person obtaining a copy
23 * of this software and associated documentation files (the "Software"), to deal
24 * in the Software without restriction, including without limitation the rights
25 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
26 * copies of the Software, and to permit persons to whom the Software is
27 * furnished to do so, subject to the following conditions:
28 *
29 * The above copyright notice and this permission notice shall be included in
30 * all copies or substantial portions of the Software.
31 *
32 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
33 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
34 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
35 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
36 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
37 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
38 * THE SOFTWARE.
39 */
40
41 #include "quick_mode.h"
42
43 #include <string.h>
44
45 #include <daemon.h>
46 #include <sa/ikev1/keymat_v1.h>
47 #include <encoding/payloads/sa_payload.h>
48 #include <encoding/payloads/nonce_payload.h>
49 #include <encoding/payloads/ke_payload.h>
50 #include <encoding/payloads/id_payload.h>
51 #include <encoding/payloads/payload.h>
52 #include <sa/ikev1/tasks/informational.h>
53 #include <sa/ikev1/tasks/quick_delete.h>
54 #include <processing/jobs/inactivity_job.h>
55
56 typedef struct private_quick_mode_t private_quick_mode_t;
57
58 /**
59 * Private members of a quick_mode_t task.
60 */
61 struct private_quick_mode_t {
62
63 /**
64 * Public methods and task_t interface.
65 */
66 quick_mode_t public;
67
68 /**
69 * Assigned IKE_SA.
70 */
71 ike_sa_t *ike_sa;
72
73 /**
74 * TRUE if we are initiating quick mode
75 */
76 bool initiator;
77
78 /**
79 * Traffic selector of initiator
80 */
81 traffic_selector_t *tsi;
82
83 /**
84 * Traffic selector of responder
85 */
86 traffic_selector_t *tsr;
87
88 /**
89 * Initiators nonce
90 */
91 chunk_t nonce_i;
92
93 /**
94 * Responder nonce
95 */
96 chunk_t nonce_r;
97
98 /**
99 * Initiators ESP SPI
100 */
101 u_int32_t spi_i;
102
103 /**
104 * Responder ESP SPI
105 */
106 u_int32_t spi_r;
107
108 /**
109 * Initiators IPComp CPI
110 */
111 u_int16_t cpi_i;
112
113 /**
114 * Responders IPComp CPI
115 */
116 u_int16_t cpi_r;
117
118 /**
119 * selected CHILD_SA proposal
120 */
121 proposal_t *proposal;
122
123 /**
124 * Config of CHILD_SA to establish
125 */
126 child_cfg_t *config;
127
128 /**
129 * CHILD_SA we are about to establish
130 */
131 child_sa_t *child_sa;
132
133 /**
134 * IKEv1 keymat
135 */
136 keymat_v1_t *keymat;
137
138 /**
139 * DH exchange, when PFS is in use
140 */
141 diffie_hellman_t *dh;
142
143 /**
144 * Negotiated lifetime of new SA
145 */
146 u_int32_t lifetime;
147
148 /**
149 * Negotaited lifebytes of new SA
150 */
151 u_int64_t lifebytes;
152
153 /**
154 * Reqid to use, 0 for auto-allocate
155 */
156 u_int32_t reqid;
157
158 /**
159 * SPI of SA we rekey
160 */
161 u_int32_t rekey;
162
163 /**
164 * Negotiated mode, tunnel or transport
165 */
166 ipsec_mode_t mode;
167
168 /**
169 * Use UDP encapsulation
170 */
171 bool udp;
172
173 /** states of quick mode */
174 enum {
175 QM_INIT,
176 QM_NEGOTIATED,
177 } state;
178 };
179
180 /**
181 * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
182 */
183 static void schedule_inactivity_timeout(private_quick_mode_t *this)
184 {
185 u_int32_t timeout;
186 bool close_ike;
187
188 timeout = this->config->get_inactivity(this->config);
189 if (timeout)
190 {
191 close_ike = lib->settings->get_bool(lib->settings,
192 "%s.inactivity_close_ike", FALSE, charon->name);
193 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
194 inactivity_job_create(this->child_sa->get_reqid(this->child_sa),
195 timeout, close_ike), timeout);
196 }
197 }
198
199 /**
200 * Check if we have a an address pool configured
201 */
202 static bool have_pool(ike_sa_t *ike_sa)
203 {
204 enumerator_t *enumerator;
205 peer_cfg_t *peer_cfg;
206 char *pool;
207 bool found = FALSE;
208
209 peer_cfg = ike_sa->get_peer_cfg(ike_sa);
210 if (peer_cfg)
211 {
212 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
213 if (enumerator->enumerate(enumerator, &pool))
214 {
215 found = TRUE;
216 }
217 enumerator->destroy(enumerator);
218 }
219 return found;
220 }
221
222 /**
223 * Get hosts to use for dynamic traffic selectors
224 */
225 static linked_list_t *get_dynamic_hosts(ike_sa_t *ike_sa, bool local)
226 {
227 enumerator_t *enumerator;
228 linked_list_t *list;
229 host_t *host;
230
231 list = linked_list_create();
232 enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
233 while (enumerator->enumerate(enumerator, &host))
234 {
235 list->insert_last(list, host);
236 }
237 enumerator->destroy(enumerator);
238
239 if (list->get_count(list) == 0)
240 { /* no virtual IPs assigned */
241 if (local)
242 {
243 host = ike_sa->get_my_host(ike_sa);
244 list->insert_last(list, host);
245 }
246 else if (!have_pool(ike_sa))
247 { /* use host only if we don't have a pool configured */
248 host = ike_sa->get_other_host(ike_sa);
249 list->insert_last(list, host);
250 }
251 }
252 return list;
253 }
254
255 /**
256 * Install negotiated CHILD_SA
257 */
258 static bool install(private_quick_mode_t *this)
259 {
260 status_t status, status_i, status_o;
261 chunk_t encr_i, encr_r, integ_i, integ_r;
262 linked_list_t *tsi, *tsr, *my_ts, *other_ts;
263 child_sa_t *old = NULL;
264
265 this->child_sa->set_proposal(this->child_sa, this->proposal);
266 this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
267 this->child_sa->set_mode(this->child_sa, this->mode);
268
269 if (this->cpi_i && this->cpi_r)
270 { /* DEFLATE is the only transform we currently support */
271 this->child_sa->set_ipcomp(this->child_sa, IPCOMP_DEFLATE);
272 }
273 else
274 {
275 this->cpi_i = this->cpi_r = 0;
276 }
277
278 this->child_sa->set_protocol(this->child_sa,
279 this->proposal->get_protocol(this->proposal));
280
281 status_i = status_o = FAILED;
282 encr_i = encr_r = integ_i = integ_r = chunk_empty;
283 tsi = linked_list_create_with_items(this->tsi->clone(this->tsi), NULL);
284 tsr = linked_list_create_with_items(this->tsr->clone(this->tsr), NULL);
285 if (this->initiator)
286 {
287 charon->bus->narrow(charon->bus, this->child_sa,
288 NARROW_INITIATOR_POST_AUTH, tsi, tsr);
289 }
290 else
291 {
292 charon->bus->narrow(charon->bus, this->child_sa,
293 NARROW_RESPONDER_POST, tsr, tsi);
294 }
295 if (tsi->get_count(tsi) == 0 || tsr->get_count(tsr) == 0)
296 {
297 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
298 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
299 DBG1(DBG_IKE, "no acceptable traffic selectors found");
300 return FALSE;
301 }
302
303 if (this->keymat->derive_child_keys(this->keymat, this->proposal, this->dh,
304 this->spi_i, this->spi_r, this->nonce_i, this->nonce_r,
305 &encr_i, &integ_i, &encr_r, &integ_r))
306 {
307 if (this->initiator)
308 {
309 status_i = this->child_sa->install(this->child_sa,
310 encr_r, integ_r, this->spi_i, this->cpi_i,
311 this->initiator, TRUE, FALSE, tsi, tsr);
312 status_o = this->child_sa->install(this->child_sa,
313 encr_i, integ_i, this->spi_r, this->cpi_r,
314 this->initiator, FALSE, FALSE, tsi, tsr);
315 }
316 else
317 {
318 status_i = this->child_sa->install(this->child_sa,
319 encr_i, integ_i, this->spi_r, this->cpi_r,
320 this->initiator, TRUE, FALSE, tsr, tsi);
321 status_o = this->child_sa->install(this->child_sa,
322 encr_r, integ_r, this->spi_i, this->cpi_i,
323 this->initiator, FALSE, FALSE, tsr, tsi);
324 }
325 }
326 chunk_clear(&integ_i);
327 chunk_clear(&integ_r);
328 chunk_clear(&encr_i);
329 chunk_clear(&encr_r);
330
331 if (status_i != SUCCESS || status_o != SUCCESS)
332 {
333 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
334 (status_i != SUCCESS) ? "inbound " : "",
335 (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
336 (status_o != SUCCESS) ? "outbound " : "");
337 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
338 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
339 return FALSE;
340 }
341
342 if (this->initiator)
343 {
344 status = this->child_sa->add_policies(this->child_sa, tsi, tsr);
345 }
346 else
347 {
348 status = this->child_sa->add_policies(this->child_sa, tsr, tsi);
349 }
350 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
351 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
352 if (status != SUCCESS)
353 {
354 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
355 return FALSE;
356 }
357
358 charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
359 this->dh, this->nonce_i, this->nonce_r);
360
361 /* add to IKE_SA, and remove from task */
362 this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
363 this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
364
365 my_ts = linked_list_create_from_enumerator(
366 this->child_sa->create_ts_enumerator(this->child_sa, TRUE));
367 other_ts = linked_list_create_from_enumerator(
368 this->child_sa->create_ts_enumerator(this->child_sa, FALSE));
369
370 DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
371 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
372 this->child_sa->get_name(this->child_sa),
373 this->child_sa->get_reqid(this->child_sa),
374 ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
375 ntohl(this->child_sa->get_spi(this->child_sa, FALSE)), my_ts, other_ts);
376
377 my_ts->destroy(my_ts);
378 other_ts->destroy(other_ts);
379
380 if (this->rekey)
381 {
382 old = this->ike_sa->get_child_sa(this->ike_sa,
383 this->proposal->get_protocol(this->proposal),
384 this->rekey, TRUE);
385 }
386 if (old)
387 {
388 charon->bus->child_rekey(charon->bus, old, this->child_sa);
389 }
390 else
391 {
392 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
393 }
394 if (!this->rekey)
395 {
396 schedule_inactivity_timeout(this);
397 }
398 this->child_sa = NULL;
399 return TRUE;
400 }
401
402 /**
403 * Generate and add NONCE
404 */
405 static bool add_nonce(private_quick_mode_t *this, chunk_t *nonce,
406 message_t *message)
407 {
408 nonce_payload_t *nonce_payload;
409 nonce_gen_t *nonceg;
410
411 nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
412 if (!nonceg)
413 {
414 DBG1(DBG_IKE, "no nonce generator found to create nonce");
415 return FALSE;
416 }
417 if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, nonce))
418 {
419 DBG1(DBG_IKE, "nonce allocation failed");
420 nonceg->destroy(nonceg);
421 return FALSE;
422 }
423 nonceg->destroy(nonceg);
424
425 nonce_payload = nonce_payload_create(NONCE_V1);
426 nonce_payload->set_nonce(nonce_payload, *nonce);
427 message->add_payload(message, &nonce_payload->payload_interface);
428
429 return TRUE;
430 }
431
432 /**
433 * Extract nonce from NONCE payload
434 */
435 static bool get_nonce(private_quick_mode_t *this, chunk_t *nonce,
436 message_t *message)
437 {
438 nonce_payload_t *nonce_payload;
439
440 nonce_payload = (nonce_payload_t*)message->get_payload(message, NONCE_V1);
441 if (!nonce_payload)
442 {
443 DBG1(DBG_IKE, "NONCE payload missing in message");
444 return FALSE;
445 }
446 *nonce = nonce_payload->get_nonce(nonce_payload);
447
448 return TRUE;
449 }
450
451 /**
452 * Add KE payload to message
453 */
454 static void add_ke(private_quick_mode_t *this, message_t *message)
455 {
456 ke_payload_t *ke_payload;
457
458 ke_payload = ke_payload_create_from_diffie_hellman(KEY_EXCHANGE_V1, this->dh);
459 message->add_payload(message, &ke_payload->payload_interface);
460 }
461
462 /**
463 * Get DH value from a KE payload
464 */
465 static bool get_ke(private_quick_mode_t *this, message_t *message)
466 {
467 ke_payload_t *ke_payload;
468
469 ke_payload = (ke_payload_t*)message->get_payload(message, KEY_EXCHANGE_V1);
470 if (!ke_payload)
471 {
472 DBG1(DBG_IKE, "KE payload missing");
473 return FALSE;
474 }
475 this->dh->set_other_public_value(this->dh,
476 ke_payload->get_key_exchange_data(ke_payload));
477 return TRUE;
478 }
479
480 /**
481 * Select a traffic selector from configuration
482 */
483 static traffic_selector_t* select_ts(private_quick_mode_t *this, bool local,
484 linked_list_t *supplied)
485 {
486 traffic_selector_t *ts;
487 linked_list_t *list, *hosts;
488
489 hosts = get_dynamic_hosts(this->ike_sa, local);
490 list = this->config->get_traffic_selectors(this->config,
491 local, supplied, hosts);
492 hosts->destroy(hosts);
493 if (list->get_first(list, (void**)&ts) == SUCCESS)
494 {
495 ts = ts->clone(ts);
496 }
497 else
498 {
499 DBG1(DBG_IKE, "%s traffic selector missing in configuration",
500 local ? "local" : "local");
501 ts = NULL;
502 }
503 list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
504 return ts;
505 }
506
507 /**
508 * Add selected traffic selectors to message
509 */
510 static void add_ts(private_quick_mode_t *this, message_t *message)
511 {
512 id_payload_t *id_payload;
513 host_t *hsi, *hsr;
514
515 if (this->initiator)
516 {
517 hsi = this->ike_sa->get_my_host(this->ike_sa);
518 hsr = this->ike_sa->get_other_host(this->ike_sa);
519 }
520 else
521 {
522 hsr = this->ike_sa->get_my_host(this->ike_sa);
523 hsi = this->ike_sa->get_other_host(this->ike_sa);
524 }
525 /* add ID payload only if negotiating non host2host tunnels */
526 if (!this->tsi->is_host(this->tsi, hsi) ||
527 !this->tsr->is_host(this->tsr, hsr) ||
528 this->tsi->get_protocol(this->tsi) ||
529 this->tsr->get_protocol(this->tsr) ||
530 this->tsi->get_from_port(this->tsi) ||
531 this->tsr->get_from_port(this->tsr) ||
532 this->tsi->get_to_port(this->tsi) != 65535 ||
533 this->tsr->get_to_port(this->tsr) != 65535)
534 {
535 id_payload = id_payload_create_from_ts(this->tsi);
536 message->add_payload(message, &id_payload->payload_interface);
537 id_payload = id_payload_create_from_ts(this->tsr);
538 message->add_payload(message, &id_payload->payload_interface);
539 }
540 }
541
542 /**
543 * Get traffic selectors from received message
544 */
545 static bool get_ts(private_quick_mode_t *this, message_t *message)
546 {
547 traffic_selector_t *tsi = NULL, *tsr = NULL;
548 enumerator_t *enumerator;
549 id_payload_t *id_payload;
550 payload_t *payload;
551 host_t *hsi, *hsr;
552 bool first = TRUE;
553
554 enumerator = message->create_payload_enumerator(message);
555 while (enumerator->enumerate(enumerator, &payload))
556 {
557 if (payload->get_type(payload) == ID_V1)
558 {
559 id_payload = (id_payload_t*)payload;
560
561 if (first)
562 {
563 tsi = id_payload->get_ts(id_payload);
564 first = FALSE;
565 }
566 else
567 {
568 tsr = id_payload->get_ts(id_payload);
569 break;
570 }
571 }
572 }
573 enumerator->destroy(enumerator);
574
575 /* create host2host selectors if ID payloads missing */
576 if (this->initiator)
577 {
578 hsi = this->ike_sa->get_my_host(this->ike_sa);
579 hsr = this->ike_sa->get_other_host(this->ike_sa);
580 }
581 else
582 {
583 hsr = this->ike_sa->get_my_host(this->ike_sa);
584 hsi = this->ike_sa->get_other_host(this->ike_sa);
585 }
586 if (!tsi)
587 {
588 tsi = traffic_selector_create_from_subnet(hsi->clone(hsi),
589 hsi->get_family(hsi) == AF_INET ? 32 : 128, 0, 0, 65535);
590 }
591 if (!tsr)
592 {
593 tsr = traffic_selector_create_from_subnet(hsr->clone(hsr),
594 hsr->get_family(hsr) == AF_INET ? 32 : 128, 0, 0, 65535);
595 }
596 if (this->mode == MODE_TRANSPORT && this->udp &&
597 (!tsi->is_host(tsi, hsi) || !tsr->is_host(tsr, hsr)))
598 { /* change TS in case of a NAT in transport mode */
599 DBG2(DBG_IKE, "changing received traffic selectors %R=== %R due to NAT",
600 tsi, tsr);
601 tsi->set_address(tsi, hsi);
602 tsr->set_address(tsr, hsr);
603 }
604
605 if (this->initiator)
606 {
607 traffic_selector_t *tsisub, *tsrsub;
608
609 /* check if peer selection is valid */
610 tsisub = this->tsi->get_subset(this->tsi, tsi);
611 tsrsub = this->tsr->get_subset(this->tsr, tsr);
612 if (!tsisub || !tsrsub)
613 {
614 DBG1(DBG_IKE, "peer selected invalid traffic selectors: "
615 "%R for %R, %R for %R", tsi, this->tsi, tsr, this->tsr);
616 DESTROY_IF(tsisub);
617 DESTROY_IF(tsrsub);
618 tsi->destroy(tsi);
619 tsr->destroy(tsr);
620 return FALSE;
621 }
622 tsi->destroy(tsi);
623 tsr->destroy(tsr);
624 this->tsi->destroy(this->tsi);
625 this->tsr->destroy(this->tsr);
626 this->tsi = tsisub;
627 this->tsr = tsrsub;
628 }
629 else
630 {
631 this->tsi = tsi;
632 this->tsr = tsr;
633 }
634 return TRUE;
635 }
636
637 /**
638 * Get encap
639 */
640 static encap_t get_encap(ike_sa_t* ike_sa, bool udp)
641 {
642 if (!udp)
643 {
644 return ENCAP_NONE;
645 }
646 if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
647 {
648 return ENCAP_UDP_DRAFT_00_03;
649 }
650 return ENCAP_UDP;
651 }
652
653 /**
654 * Get NAT-OA payload type (RFC 3947 or RFC 3947 drafts).
655 */
656 static payload_type_t get_nat_oa_payload_type(ike_sa_t *ike_sa)
657 {
658 if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
659 {
660 return NAT_OA_DRAFT_00_03_V1;
661 }
662 return NAT_OA_V1;
663 }
664
665 /**
666 * Add NAT-OA payloads
667 */
668 static void add_nat_oa_payloads(private_quick_mode_t *this, message_t *message)
669 {
670 identification_t *id;
671 id_payload_t *nat_oa;
672 host_t *src, *dst;
673 payload_type_t nat_oa_payload_type;
674
675 src = message->get_source(message);
676 dst = message->get_destination(message);
677
678 src = this->initiator ? src : dst;
679 dst = this->initiator ? dst : src;
680
681 nat_oa_payload_type = get_nat_oa_payload_type(this->ike_sa);
682
683 /* first NAT-OA is the initiator's address */
684 id = identification_create_from_sockaddr(src->get_sockaddr(src));
685 nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
686 message->add_payload(message, (payload_t*)nat_oa);
687 id->destroy(id);
688
689 /* second NAT-OA is that of the responder */
690 id = identification_create_from_sockaddr(dst->get_sockaddr(dst));
691 nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
692 message->add_payload(message, (payload_t*)nat_oa);
693 id->destroy(id);
694 }
695
696 /**
697 * Look up lifetimes
698 */
699 static void get_lifetimes(private_quick_mode_t *this)
700 {
701 lifetime_cfg_t *lft;
702
703 lft = this->config->get_lifetime(this->config);
704 if (lft->time.life)
705 {
706 this->lifetime = lft->time.life;
707 }
708 else if (lft->bytes.life)
709 {
710 this->lifebytes = lft->bytes.life;
711 }
712 free(lft);
713 }
714
715 /**
716 * Check and apply lifetimes
717 */
718 static void apply_lifetimes(private_quick_mode_t *this, sa_payload_t *sa_payload)
719 {
720 u_int32_t lifetime;
721 u_int64_t lifebytes;
722
723 lifetime = sa_payload->get_lifetime(sa_payload);
724 lifebytes = sa_payload->get_lifebytes(sa_payload);
725 if (this->lifetime != lifetime)
726 {
727 DBG1(DBG_IKE, "received %us lifetime, configured %us",
728 lifetime, this->lifetime);
729 this->lifetime = lifetime;
730 }
731 if (this->lifebytes != lifebytes)
732 {
733 DBG1(DBG_IKE, "received %llu lifebytes, configured %llu",
734 lifebytes, this->lifebytes);
735 this->lifebytes = lifebytes;
736 }
737 }
738
739 /**
740 * Set the task ready to build notify error message
741 */
742 static status_t send_notify(private_quick_mode_t *this, notify_type_t type)
743 {
744 notify_payload_t *notify;
745
746 notify = notify_payload_create_from_protocol_and_type(NOTIFY_V1,
747 PROTO_ESP, type);
748 notify->set_spi(notify, this->spi_i);
749
750 this->ike_sa->queue_task(this->ike_sa,
751 (task_t*)informational_create(this->ike_sa, notify));
752 /* cancel all active/passive tasks in favour of informational */
753 this->ike_sa->flush_queue(this->ike_sa,
754 this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
755 return ALREADY_DONE;
756 }
757
758 METHOD(task_t, build_i, status_t,
759 private_quick_mode_t *this, message_t *message)
760 {
761 switch (this->state)
762 {
763 case QM_INIT:
764 {
765 enumerator_t *enumerator;
766 sa_payload_t *sa_payload;
767 linked_list_t *list, *tsi, *tsr;
768 proposal_t *proposal;
769 diffie_hellman_group_t group;
770 encap_t encap;
771
772 this->udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
773 this->mode = this->config->get_mode(this->config);
774 this->child_sa = child_sa_create(
775 this->ike_sa->get_my_host(this->ike_sa),
776 this->ike_sa->get_other_host(this->ike_sa),
777 this->config, this->reqid, this->udp);
778
779 if (this->udp && this->mode == MODE_TRANSPORT)
780 {
781 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
782 add_nat_oa_payloads(this, message);
783 }
784
785 if (this->config->use_ipcomp(this->config))
786 {
787 this->cpi_i = this->child_sa->alloc_cpi(this->child_sa);
788 if (!this->cpi_i)
789 {
790 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, "
791 "IPComp disabled");
792 }
793 }
794
795 this->spi_i = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
796 if (!this->spi_i)
797 {
798 DBG1(DBG_IKE, "allocating SPI from kernel failed");
799 return FAILED;
800 }
801 group = this->config->get_dh_group(this->config);
802 if (group != MODP_NONE)
803 {
804 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
805 group);
806 if (!this->dh)
807 {
808 DBG1(DBG_IKE, "configured DH group %N not supported",
809 diffie_hellman_group_names, group);
810 return FAILED;
811 }
812 }
813
814 list = this->config->get_proposals(this->config, FALSE);
815 enumerator = list->create_enumerator(list);
816 while (enumerator->enumerate(enumerator, &proposal))
817 {
818 if (group != MODP_NONE)
819 {
820 if (!proposal->has_dh_group(proposal, group))
821 {
822 list->remove_at(list, enumerator);
823 proposal->destroy(proposal);
824 continue;
825 }
826 proposal->strip_dh(proposal, group);
827 }
828 proposal->set_spi(proposal, this->spi_i);
829 }
830 enumerator->destroy(enumerator);
831
832 get_lifetimes(this);
833 encap = get_encap(this->ike_sa, this->udp);
834 sa_payload = sa_payload_create_from_proposals_v1(list,
835 this->lifetime, this->lifebytes, AUTH_NONE,
836 this->mode, encap, this->cpi_i);
837 list->destroy_offset(list, offsetof(proposal_t, destroy));
838 message->add_payload(message, &sa_payload->payload_interface);
839
840 if (!add_nonce(this, &this->nonce_i, message))
841 {
842 return FAILED;
843 }
844 if (group != MODP_NONE)
845 {
846 add_ke(this, message);
847 }
848 if (!this->tsi)
849 {
850 this->tsi = select_ts(this, TRUE, NULL);
851 }
852 if (!this->tsr)
853 {
854 this->tsr = select_ts(this, FALSE, NULL);
855 }
856 tsi = linked_list_create_with_items(this->tsi, NULL);
857 tsr = linked_list_create_with_items(this->tsr, NULL);
858 this->tsi = this->tsr = NULL;
859 charon->bus->narrow(charon->bus, this->child_sa,
860 NARROW_INITIATOR_PRE_AUTH, tsi, tsr);
861 tsi->remove_first(tsi, (void**)&this->tsi);
862 tsr->remove_first(tsr, (void**)&this->tsr);
863 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
864 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
865 if (!this->tsi || !this->tsr)
866 {
867 return FAILED;
868 }
869 add_ts(this, message);
870 return NEED_MORE;
871 }
872 case QM_NEGOTIATED:
873 {
874 return SUCCESS;
875 }
876 default:
877 return FAILED;
878 }
879 }
880
881 /**
882 * Check for notify errors, return TRUE if error found
883 */
884 static bool has_notify_errors(private_quick_mode_t *this, message_t *message)
885 {
886 enumerator_t *enumerator;
887 payload_t *payload;
888 bool err = FALSE;
889
890 enumerator = message->create_payload_enumerator(message);
891 while (enumerator->enumerate(enumerator, &payload))
892 {
893 if (payload->get_type(payload) == NOTIFY_V1)
894 {
895 notify_payload_t *notify;
896 notify_type_t type;
897
898 notify = (notify_payload_t*)payload;
899 type = notify->get_notify_type(notify);
900 if (type < 16384)
901 {
902
903 DBG1(DBG_IKE, "received %N error notify",
904 notify_type_names, type);
905 err = TRUE;
906 }
907 else
908 {
909 DBG1(DBG_IKE, "received %N notify", notify_type_names, type);
910 }
911 }
912 }
913 enumerator->destroy(enumerator);
914
915 return err;
916 }
917
918 /**
919 * Check if this is a rekey for an existing CHILD_SA, reuse reqid if so
920 */
921 static void check_for_rekeyed_child(private_quick_mode_t *this)
922 {
923 enumerator_t *enumerator, *policies;
924 traffic_selector_t *local, *remote;
925 child_sa_t *child_sa;
926 proposal_t *proposal;
927 char *name;
928
929 name = this->config->get_name(this->config);
930 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
931 while (this->reqid == 0 && enumerator->enumerate(enumerator, &child_sa))
932 {
933 if (streq(child_sa->get_name(child_sa), name))
934 {
935 proposal = child_sa->get_proposal(child_sa);
936 switch (child_sa->get_state(child_sa))
937 {
938 case CHILD_INSTALLED:
939 case CHILD_REKEYING:
940 policies = child_sa->create_policy_enumerator(child_sa);
941 if (policies->enumerate(policies, &local, &remote) &&
942 local->equals(local, this->tsr) &&
943 remote->equals(remote, this->tsi) &&
944 this->proposal->equals(this->proposal, proposal))
945 {
946 this->reqid = child_sa->get_reqid(child_sa);
947 this->rekey = child_sa->get_spi(child_sa, TRUE);
948 child_sa->set_state(child_sa, CHILD_REKEYING);
949 DBG1(DBG_IKE, "detected rekeying of CHILD_SA %s{%u}",
950 child_sa->get_name(child_sa), this->reqid);
951 }
952 policies->destroy(policies);
953 break;
954 default:
955 break;
956 }
957 }
958 }
959 enumerator->destroy(enumerator);
960 }
961
962 METHOD(task_t, process_r, status_t,
963 private_quick_mode_t *this, message_t *message)
964 {
965 switch (this->state)
966 {
967 case QM_INIT:
968 {
969 sa_payload_t *sa_payload;
970 linked_list_t *tsi, *tsr, *hostsi, *hostsr, *list = NULL;
971 peer_cfg_t *peer_cfg;
972 u_int16_t group;
973 bool private;
974
975 sa_payload = (sa_payload_t*)message->get_payload(message,
976 SECURITY_ASSOCIATION_V1);
977 if (!sa_payload)
978 {
979 DBG1(DBG_IKE, "sa payload missing");
980 return send_notify(this, INVALID_PAYLOAD_TYPE);
981 }
982
983 this->mode = sa_payload->get_encap_mode(sa_payload, &this->udp);
984
985 if (!get_ts(this, message))
986 {
987 return FAILED;
988 }
989 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
990 tsi = linked_list_create_with_items(this->tsi, NULL);
991 tsr = linked_list_create_with_items(this->tsr, NULL);
992 this->tsi = this->tsr = NULL;
993 hostsi = get_dynamic_hosts(this->ike_sa, FALSE);
994 hostsr = get_dynamic_hosts(this->ike_sa, TRUE);
995 this->config = peer_cfg->select_child_cfg(peer_cfg, tsr, tsi,
996 hostsr, hostsi);
997 hostsi->destroy(hostsi);
998 hostsr->destroy(hostsr);
999 if (this->config)
1000 {
1001 this->tsi = select_ts(this, FALSE, tsi);
1002 this->tsr = select_ts(this, TRUE, tsr);
1003 }
1004 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1005 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1006 if (!this->config || !this->tsi || !this->tsr)
1007 {
1008 DBG1(DBG_IKE, "no matching CHILD_SA config found");
1009 return send_notify(this, INVALID_ID_INFORMATION);
1010 }
1011
1012 if (this->config->use_ipcomp(this->config))
1013 {
1014 list = sa_payload->get_ipcomp_proposals(sa_payload,
1015 &this->cpi_i);
1016 if (!list->get_count(list))
1017 {
1018 DBG1(DBG_IKE, "expected IPComp proposal but peer did "
1019 "not send one, IPComp disabled");
1020 this->cpi_i = 0;
1021 }
1022 }
1023 if (!list || !list->get_count(list))
1024 {
1025 DESTROY_IF(list);
1026 list = sa_payload->get_proposals(sa_payload);
1027 }
1028 private = this->ike_sa->supports_extension(this->ike_sa,
1029 EXT_STRONGSWAN);
1030 this->proposal = this->config->select_proposal(this->config,
1031 list, FALSE, private);
1032 list->destroy_offset(list, offsetof(proposal_t, destroy));
1033
1034 get_lifetimes(this);
1035 apply_lifetimes(this, sa_payload);
1036
1037 if (!this->proposal)
1038 {
1039 DBG1(DBG_IKE, "no matching proposal found, sending %N",
1040 notify_type_names, NO_PROPOSAL_CHOSEN);
1041 return send_notify(this, NO_PROPOSAL_CHOSEN);
1042 }
1043 this->spi_i = this->proposal->get_spi(this->proposal);
1044
1045 if (!get_nonce(this, &this->nonce_i, message))
1046 {
1047 return send_notify(this, INVALID_PAYLOAD_TYPE);
1048 }
1049
1050 if (this->proposal->get_algorithm(this->proposal,
1051 DIFFIE_HELLMAN_GROUP, &group, NULL))
1052 {
1053 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
1054 group);
1055 if (!this->dh)
1056 {
1057 DBG1(DBG_IKE, "negotiated DH group %N not supported",
1058 diffie_hellman_group_names, group);
1059 return send_notify(this, INVALID_KEY_INFORMATION);
1060 }
1061 if (!get_ke(this, message))
1062 {
1063 return send_notify(this, INVALID_PAYLOAD_TYPE);
1064 }
1065 }
1066
1067 check_for_rekeyed_child(this);
1068
1069 this->child_sa = child_sa_create(
1070 this->ike_sa->get_my_host(this->ike_sa),
1071 this->ike_sa->get_other_host(this->ike_sa),
1072 this->config, this->reqid, this->udp);
1073
1074 tsi = linked_list_create_with_items(this->tsi, NULL);
1075 tsr = linked_list_create_with_items(this->tsr, NULL);
1076 this->tsi = this->tsr = NULL;
1077 charon->bus->narrow(charon->bus, this->child_sa,
1078 NARROW_RESPONDER, tsr, tsi);
1079 if (tsi->remove_first(tsi, (void**)&this->tsi) != SUCCESS ||
1080 tsr->remove_first(tsr, (void**)&this->tsr) != SUCCESS)
1081 {
1082 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1083 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1084 return send_notify(this, INVALID_ID_INFORMATION);
1085 }
1086 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1087 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1088
1089 return NEED_MORE;
1090 }
1091 case QM_NEGOTIATED:
1092 {
1093 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
1094 has_notify_errors(this, message))
1095 {
1096 return SUCCESS;
1097 }
1098 if (!install(this))
1099 {
1100 ike_sa_t *ike_sa = this->ike_sa;
1101 task_t *task;
1102
1103 task = (task_t*)quick_delete_create(this->ike_sa,
1104 this->proposal->get_protocol(this->proposal),
1105 this->spi_i, TRUE, TRUE);
1106 /* flush_queue() destroys the current task */
1107 ike_sa->flush_queue(ike_sa, TASK_QUEUE_PASSIVE);
1108 ike_sa->queue_task(ike_sa, task);
1109 return ALREADY_DONE;
1110 }
1111 return SUCCESS;
1112 }
1113 default:
1114 return FAILED;
1115 }
1116 }
1117
1118 METHOD(task_t, build_r, status_t,
1119 private_quick_mode_t *this, message_t *message)
1120 {
1121 switch (this->state)
1122 {
1123 case QM_INIT:
1124 {
1125 sa_payload_t *sa_payload;
1126 encap_t encap;
1127
1128 this->spi_r = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
1129 if (!this->spi_r)
1130 {
1131 DBG1(DBG_IKE, "allocating SPI from kernel failed");
1132 return send_notify(this, NO_PROPOSAL_CHOSEN);
1133 }
1134 this->proposal->set_spi(this->proposal, this->spi_r);
1135
1136 if (this->cpi_i)
1137 {
1138 this->cpi_r = this->child_sa->alloc_cpi(this->child_sa);
1139 if (!this->cpi_r)
1140 {
1141 DBG1(DBG_IKE, "unable to allocate a CPI from "
1142 "kernel, IPComp disabled");
1143 return send_notify(this, NO_PROPOSAL_CHOSEN);
1144 }
1145 }
1146
1147 if (this->udp && this->mode == MODE_TRANSPORT)
1148 {
1149 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
1150 add_nat_oa_payloads(this, message);
1151 }
1152
1153 encap = get_encap(this->ike_sa, this->udp);
1154 sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
1155 this->lifetime, this->lifebytes, AUTH_NONE,
1156 this->mode, encap, this->cpi_r);
1157 message->add_payload(message, &sa_payload->payload_interface);
1158
1159 if (!add_nonce(this, &this->nonce_r, message))
1160 {
1161 return FAILED;
1162 }
1163 if (this->dh)
1164 {
1165 add_ke(this, message);
1166 }
1167
1168 add_ts(this, message);
1169
1170 this->state = QM_NEGOTIATED;
1171 return NEED_MORE;
1172 }
1173 default:
1174 return FAILED;
1175 }
1176 }
1177
1178 METHOD(task_t, process_i, status_t,
1179 private_quick_mode_t *this, message_t *message)
1180 {
1181 switch (this->state)
1182 {
1183 case QM_INIT:
1184 {
1185 sa_payload_t *sa_payload;
1186 linked_list_t *list = NULL;
1187 bool private;
1188
1189 sa_payload = (sa_payload_t*)message->get_payload(message,
1190 SECURITY_ASSOCIATION_V1);
1191 if (!sa_payload)
1192 {
1193 DBG1(DBG_IKE, "sa payload missing");
1194 return send_notify(this, NO_PROPOSAL_CHOSEN);
1195 }
1196 if (this->cpi_i)
1197 {
1198 list = sa_payload->get_ipcomp_proposals(sa_payload,
1199 &this->cpi_r);
1200 if (!list->get_count(list))
1201 {
1202 DBG1(DBG_IKE, "peer did not acccept our IPComp proposal, "
1203 "IPComp disabled");
1204 this->cpi_i = 0;
1205 }
1206 }
1207 if (!list || !list->get_count(list))
1208 {
1209 DESTROY_IF(list);
1210 list = sa_payload->get_proposals(sa_payload);
1211 }
1212 private = this->ike_sa->supports_extension(this->ike_sa,
1213 EXT_STRONGSWAN);
1214 this->proposal = this->config->select_proposal(this->config,
1215 list, FALSE, private);
1216 list->destroy_offset(list, offsetof(proposal_t, destroy));
1217 if (!this->proposal)
1218 {
1219 DBG1(DBG_IKE, "no matching proposal found");
1220 return send_notify(this, NO_PROPOSAL_CHOSEN);
1221 }
1222 this->spi_r = this->proposal->get_spi(this->proposal);
1223
1224 apply_lifetimes(this, sa_payload);
1225
1226 if (!get_nonce(this, &this->nonce_r, message))
1227 {
1228 return send_notify(this, INVALID_PAYLOAD_TYPE);
1229 }
1230 if (this->dh && !get_ke(this, message))
1231 {
1232 return send_notify(this, INVALID_KEY_INFORMATION);
1233 }
1234 if (!get_ts(this, message))
1235 {
1236 return send_notify(this, INVALID_PAYLOAD_TYPE);
1237 }
1238 if (!install(this))
1239 {
1240 return send_notify(this, NO_PROPOSAL_CHOSEN);
1241 }
1242 this->state = QM_NEGOTIATED;
1243 return NEED_MORE;
1244 }
1245 default:
1246 return FAILED;
1247 }
1248 }
1249
1250 METHOD(task_t, get_type, task_type_t,
1251 private_quick_mode_t *this)
1252 {
1253 return TASK_QUICK_MODE;
1254 }
1255
1256 METHOD(quick_mode_t, use_reqid, void,
1257 private_quick_mode_t *this, u_int32_t reqid)
1258 {
1259 this->reqid = reqid;
1260 }
1261
1262 METHOD(quick_mode_t, rekey, void,
1263 private_quick_mode_t *this, u_int32_t spi)
1264 {
1265 this->rekey = spi;
1266 }
1267
1268 METHOD(task_t, migrate, void,
1269 private_quick_mode_t *this, ike_sa_t *ike_sa)
1270 {
1271 chunk_free(&this->nonce_i);
1272 chunk_free(&this->nonce_r);
1273 DESTROY_IF(this->tsi);
1274 DESTROY_IF(this->tsr);
1275 DESTROY_IF(this->proposal);
1276 DESTROY_IF(this->child_sa);
1277 DESTROY_IF(this->dh);
1278
1279 this->ike_sa = ike_sa;
1280 this->keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa);
1281 this->state = QM_INIT;
1282 this->tsi = NULL;
1283 this->tsr = NULL;
1284 this->proposal = NULL;
1285 this->child_sa = NULL;
1286 this->dh = NULL;
1287 this->spi_i = 0;
1288 this->spi_r = 0;
1289
1290 if (!this->initiator)
1291 {
1292 DESTROY_IF(this->config);
1293 this->config = NULL;
1294 }
1295 }
1296
1297 METHOD(task_t, destroy, void,
1298 private_quick_mode_t *this)
1299 {
1300 chunk_free(&this->nonce_i);
1301 chunk_free(&this->nonce_r);
1302 DESTROY_IF(this->tsi);
1303 DESTROY_IF(this->tsr);
1304 DESTROY_IF(this->proposal);
1305 DESTROY_IF(this->child_sa);
1306 DESTROY_IF(this->config);
1307 DESTROY_IF(this->dh);
1308 free(this);
1309 }
1310
1311 /*
1312 * Described in header.
1313 */
1314 quick_mode_t *quick_mode_create(ike_sa_t *ike_sa, child_cfg_t *config,
1315 traffic_selector_t *tsi, traffic_selector_t *tsr)
1316 {
1317 private_quick_mode_t *this;
1318
1319 INIT(this,
1320 .public = {
1321 .task = {
1322 .get_type = _get_type,
1323 .migrate = _migrate,
1324 .destroy = _destroy,
1325 },
1326 .use_reqid = _use_reqid,
1327 .rekey = _rekey,
1328 },
1329 .ike_sa = ike_sa,
1330 .initiator = config != NULL,
1331 .config = config,
1332 .keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa),
1333 .state = QM_INIT,
1334 .tsi = tsi ? tsi->clone(tsi) : NULL,
1335 .tsr = tsr ? tsr->clone(tsr) : NULL,
1336 );
1337
1338 if (config)
1339 {
1340 this->public.task.build = _build_i;
1341 this->public.task.process = _process_i;
1342 }
1343 else
1344 {
1345 this->public.task.build = _build_r;
1346 this->public.task.process = _process_r;
1347 }
1348
1349 return &this->public;
1350 }