src/libcharon/sa/ikev1/tasks/quick_mode.c

   1 /*
   2  * Copyright (C) 2012 Tobias Brunner
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * Copyright (C) 2011 Martin Willi
   6  * Copyright (C) 2011 revosec AG
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 /*
  20  * Copyright (C) 2012 Volker Rümelin
  21  *
  22  * Permission is hereby granted, free of charge, to any person obtaining a copy
  23  * of this software and associated documentation files (the "Software"), to deal
  24  * in the Software without restriction, including without limitation the rights
  25  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  26  * copies of the Software, and to permit persons to whom the Software is
  27  * furnished to do so, subject to the following conditions:
  28  *
  29  * The above copyright notice and this permission notice shall be included in
  30  * all copies or substantial portions of the Software.
  31  *
  32  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  33  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  34  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  35  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  36  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  37  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  38  * THE SOFTWARE.
  39  */
  40
  41 #include "quick_mode.h"
  42
  43 #include <string.h>
  44
  45 #include <daemon.h>
  46 #include <sa/ikev1/keymat_v1.h>
  47 #include <encoding/payloads/sa_payload.h>
  48 #include <encoding/payloads/nonce_payload.h>
  49 #include <encoding/payloads/ke_payload.h>
  50 #include <encoding/payloads/id_payload.h>
  51 #include <encoding/payloads/payload.h>
  52 #include <sa/ikev1/tasks/informational.h>
  53 #include <sa/ikev1/tasks/quick_delete.h>
  54 #include <processing/jobs/inactivity_job.h>
  55
  56 typedef struct private_quick_mode_t private_quick_mode_t;
  57
  58 /**
  59  * Private members of a quick_mode_t task.
  60  */
  61 struct private_quick_mode_t {
  62
  63         /**
  64          * Public methods and task_t interface.
  65          */
  66         quick_mode_t public;
  67
  68         /**
  69          * Assigned IKE_SA.
  70          */
  71         ike_sa_t *ike_sa;
  72
  73         /**
  74          * TRUE if we are initiating quick mode
  75          */
  76         bool initiator;
  77
  78         /**
  79          * Traffic selector of initiator
  80          */
  81         traffic_selector_t *tsi;
  82
  83         /**
  84          * Traffic selector of responder
  85          */
  86         traffic_selector_t *tsr;
  87
  88         /**
  89          * Initiators nonce
  90          */
  91         chunk_t nonce_i;
  92
  93         /**
  94          * Responder nonce
  95          */
  96         chunk_t nonce_r;
  97
  98         /**
  99          * Initiators ESP SPI
 100          */
 101         u_int32_t spi_i;
 102
 103         /**
 104          * Responder ESP SPI
 105          */
 106         u_int32_t spi_r;
 107
 108         /**
 109          * Initiators IPComp CPI
 110          */
 111         u_int16_t cpi_i;
 112
 113         /**
 114          * Responders IPComp CPI
 115          */
 116         u_int16_t cpi_r;
 117
 118         /**
 119          * selected CHILD_SA proposal
 120          */
 121         proposal_t *proposal;
 122
 123         /**
 124          * Config of CHILD_SA to establish
 125          */
 126         child_cfg_t *config;
 127
 128         /**
 129          * CHILD_SA we are about to establish
 130          */
 131         child_sa_t *child_sa;
 132
 133         /**
 134          * IKEv1 keymat
 135          */
 136         keymat_v1_t *keymat;
 137
 138         /**
 139          * DH exchange, when PFS is in use
 140          */
 141         diffie_hellman_t *dh;
 142
 143         /**
 144          * Negotiated lifetime of new SA
 145          */
 146         u_int32_t lifetime;
 147
 148         /**
 149          * Negotaited lifebytes of new SA
 150          */
 151         u_int64_t lifebytes;
 152
 153         /**
 154          * Reqid to use, 0 for auto-allocate
 155          */
 156         u_int32_t reqid;
 157
 158         /**
 159          * SPI of SA we rekey
 160          */
 161         u_int32_t rekey;
 162
 163         /**
 164          * Negotiated mode, tunnel or transport
 165          */
 166         ipsec_mode_t mode;
 167
 168         /**
 169          * Use UDP encapsulation
 170          */
 171         bool udp;
 172
 173         /** states of quick mode */
 174         enum {
 175                 QM_INIT,
 176                 QM_NEGOTIATED,
 177         } state;
 178 };
 179
 180 /**
 181  * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
 182  */
 183 static void schedule_inactivity_timeout(private_quick_mode_t *this)
 184 {
 185         u_int32_t timeout;
 186         bool close_ike;
 187
 188         timeout = this->config->get_inactivity(this->config);
 189         if (timeout)
 190         {
 191                 close_ike = lib->settings->get_bool(lib->settings,
 192                                                                 "%s.inactivity_close_ike", FALSE, charon->name);
 193                 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
 194                                 inactivity_job_create(this->child_sa->get_reqid(this->child_sa),
 195                                                                           timeout, close_ike), timeout);
 196         }
 197 }
 198
 199 /**
 200  * Check if we have a an address pool configured
 201  */
 202 static bool have_pool(ike_sa_t *ike_sa)
 203 {
 204         enumerator_t *enumerator;
 205         peer_cfg_t *peer_cfg;
 206         char *pool;
 207         bool found = FALSE;
 208
 209         peer_cfg = ike_sa->get_peer_cfg(ike_sa);
 210         if (peer_cfg)
 211         {
 212                 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
 213                 if (enumerator->enumerate(enumerator, &pool))
 214                 {
 215                         found = TRUE;
 216                 }
 217                 enumerator->destroy(enumerator);
 218         }
 219         return found;
 220 }
 221
 222 /**
 223  * Get hosts to use for dynamic traffic selectors
 224  */
 225 static linked_list_t *get_dynamic_hosts(ike_sa_t *ike_sa, bool local)
 226 {
 227         enumerator_t *enumerator;
 228         linked_list_t *list;
 229         host_t *host;
 230
 231         list = linked_list_create();
 232         enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
 233         while (enumerator->enumerate(enumerator, &host))
 234         {
 235                 list->insert_last(list, host);
 236         }
 237         enumerator->destroy(enumerator);
 238
 239         if (list->get_count(list) == 0)
 240         {       /* no virtual IPs assigned */
 241                 if (local)
 242                 {
 243                         host = ike_sa->get_my_host(ike_sa);
 244                         list->insert_last(list, host);
 245                 }
 246                 else if (!have_pool(ike_sa))
 247                 {       /* use host only if we don't have a pool configured */
 248                         host = ike_sa->get_other_host(ike_sa);
 249                         list->insert_last(list, host);
 250                 }
 251         }
 252         return list;
 253 }
 254
 255 /**
 256  * Install negotiated CHILD_SA
 257  */
 258 static bool install(private_quick_mode_t *this)
 259 {
 260         status_t status, status_i, status_o;
 261         chunk_t encr_i, encr_r, integ_i, integ_r;
 262         linked_list_t *tsi, *tsr;
 263         child_sa_t *old = NULL;
 264
 265         this->child_sa->set_proposal(this->child_sa, this->proposal);
 266         this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
 267         this->child_sa->set_mode(this->child_sa, this->mode);
 268
 269         if (this->cpi_i && this->cpi_r)
 270         {       /* DEFLATE is the only transform we currently support */
 271                 this->child_sa->set_ipcomp(this->child_sa, IPCOMP_DEFLATE);
 272         }
 273         else
 274         {
 275                 this->cpi_i = this->cpi_r = 0;
 276         }
 277
 278         this->child_sa->set_protocol(this->child_sa,
 279                                                                  this->proposal->get_protocol(this->proposal));
 280
 281         status_i = status_o = FAILED;
 282         encr_i = encr_r = integ_i = integ_r = chunk_empty;
 283         tsi = linked_list_create_with_items(this->tsi->clone(this->tsi), NULL);
 284         tsr = linked_list_create_with_items(this->tsr->clone(this->tsr), NULL);
 285         if (this->initiator)
 286         {
 287                 charon->bus->narrow(charon->bus, this->child_sa,
 288                                                         NARROW_INITIATOR_POST_AUTH, tsi, tsr);
 289         }
 290         else
 291         {
 292                 charon->bus->narrow(charon->bus, this->child_sa,
 293                                                         NARROW_RESPONDER_POST, tsr, tsi);
 294         }
 295         if (tsi->get_count(tsi) == 0 || tsr->get_count(tsr) == 0)
 296         {
 297                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 298                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 299                 DBG1(DBG_IKE, "no acceptable traffic selectors found");
 300                 return FALSE;
 301         }
 302
 303         if (this->keymat->derive_child_keys(this->keymat, this->proposal, this->dh,
 304                                                 this->spi_i, this->spi_r, this->nonce_i, this->nonce_r,
 305                                                 &encr_i, &integ_i, &encr_r, &integ_r))
 306         {
 307                 if (this->initiator)
 308                 {
 309                         status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
 310                                                         this->spi_i, this->cpi_i, TRUE, FALSE, tsi, tsr);
 311                         status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
 312                                                         this->spi_r, this->cpi_r, FALSE, FALSE, tsi, tsr);
 313                 }
 314                 else
 315                 {
 316                         status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
 317                                                         this->spi_r, this->cpi_r, TRUE, FALSE, tsr, tsi);
 318                         status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
 319                                                         this->spi_i, this->cpi_i, FALSE, FALSE, tsr, tsi);
 320                 }
 321         }
 322         chunk_clear(&integ_i);
 323         chunk_clear(&integ_r);
 324         chunk_clear(&encr_i);
 325         chunk_clear(&encr_r);
 326
 327         if (status_i != SUCCESS || status_o != SUCCESS)
 328         {
 329                 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
 330                         (status_i != SUCCESS) ? "inbound " : "",
 331                         (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
 332                         (status_o != SUCCESS) ? "outbound " : "");
 333                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 334                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 335                 return FALSE;
 336         }
 337
 338         if (this->initiator)
 339         {
 340                 status = this->child_sa->add_policies(this->child_sa, tsi, tsr);
 341         }
 342         else
 343         {
 344                 status = this->child_sa->add_policies(this->child_sa, tsr, tsi);
 345         }
 346         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 347         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 348         if (status != SUCCESS)
 349         {
 350                 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
 351                 return FALSE;
 352         }
 353
 354         charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
 355                                                         this->dh, this->nonce_i, this->nonce_r);
 356
 357         /* add to IKE_SA, and remove from task */
 358         this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 359         this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
 360
 361         DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
 362                  "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
 363                  this->child_sa->get_name(this->child_sa),
 364                  this->child_sa->get_reqid(this->child_sa),
 365                  ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
 366                  ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
 367                  this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
 368                  this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
 369
 370         if (this->rekey)
 371         {
 372                 old = this->ike_sa->get_child_sa(this->ike_sa,
 373                                                                 this->proposal->get_protocol(this->proposal),
 374                                                                 this->rekey, TRUE);
 375         }
 376         if (old)
 377         {
 378                 charon->bus->child_rekey(charon->bus, old, this->child_sa);
 379         }
 380         else
 381         {
 382                 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
 383         }
 384         if (!this->rekey)
 385         {
 386                 schedule_inactivity_timeout(this);
 387         }
 388         this->child_sa = NULL;
 389         return TRUE;
 390 }
 391
 392 /**
 393  * Generate and add NONCE
 394  */
 395 static bool add_nonce(private_quick_mode_t *this, chunk_t *nonce,
 396                                           message_t *message)
 397 {
 398         nonce_payload_t *nonce_payload;
 399         nonce_gen_t *nonceg;
 400
 401         nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
 402         if (!nonceg)
 403         {
 404                 DBG1(DBG_IKE, "no nonce generator found to create nonce");
 405                 return FALSE;
 406         }
 407         if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, nonce))
 408         {
 409                 DBG1(DBG_IKE, "nonce allocation failed");
 410                 nonceg->destroy(nonceg);
 411                 return FALSE;
 412         }
 413         nonceg->destroy(nonceg);
 414
 415         nonce_payload = nonce_payload_create(NONCE_V1);
 416         nonce_payload->set_nonce(nonce_payload, *nonce);
 417         message->add_payload(message, &nonce_payload->payload_interface);
 418
 419         return TRUE;
 420 }
 421
 422 /**
 423  * Extract nonce from NONCE payload
 424  */
 425 static bool get_nonce(private_quick_mode_t *this, chunk_t *nonce,
 426                                           message_t *message)
 427 {
 428         nonce_payload_t *nonce_payload;
 429
 430         nonce_payload = (nonce_payload_t*)message->get_payload(message, NONCE_V1);
 431         if (!nonce_payload)
 432         {
 433                 DBG1(DBG_IKE, "NONCE payload missing in message");
 434                 return FALSE;
 435         }
 436         *nonce = nonce_payload->get_nonce(nonce_payload);
 437
 438         return TRUE;
 439 }
 440
 441 /**
 442  * Add KE payload to message
 443  */
 444 static void add_ke(private_quick_mode_t *this, message_t *message)
 445 {
 446         ke_payload_t *ke_payload;
 447
 448         ke_payload = ke_payload_create_from_diffie_hellman(KEY_EXCHANGE_V1, this->dh);
 449         message->add_payload(message, &ke_payload->payload_interface);
 450 }
 451
 452 /**
 453  * Get DH value from a KE payload
 454  */
 455 static bool get_ke(private_quick_mode_t *this, message_t *message)
 456 {
 457         ke_payload_t *ke_payload;
 458
 459         ke_payload = (ke_payload_t*)message->get_payload(message, KEY_EXCHANGE_V1);
 460         if (!ke_payload)
 461         {
 462                 DBG1(DBG_IKE, "KE payload missing");
 463                 return FALSE;
 464         }
 465         this->dh->set_other_public_value(this->dh,
 466                                                                 ke_payload->get_key_exchange_data(ke_payload));
 467         return TRUE;
 468 }
 469
 470 /**
 471  * Select a traffic selector from configuration
 472  */
 473 static traffic_selector_t* select_ts(private_quick_mode_t *this, bool local,
 474                                                                          linked_list_t *supplied)
 475 {
 476         traffic_selector_t *ts;
 477         linked_list_t *list, *hosts;
 478
 479         hosts = get_dynamic_hosts(this->ike_sa, local);
 480         list = this->config->get_traffic_selectors(this->config,
 481                                                                                            local, supplied, hosts);
 482         hosts->destroy(hosts);
 483         if (list->get_first(list, (void**)&ts) == SUCCESS)
 484         {
 485                 ts = ts->clone(ts);
 486         }
 487         else
 488         {
 489                 DBG1(DBG_IKE, "%s traffic selector missing in configuration",
 490                          local ? "local" : "local");
 491                 ts = NULL;
 492         }
 493         list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
 494         return ts;
 495 }
 496
 497 /**
 498  * Add selected traffic selectors to message
 499  */
 500 static void add_ts(private_quick_mode_t *this, message_t *message)
 501 {
 502         id_payload_t *id_payload;
 503         host_t *hsi, *hsr;
 504
 505         if (this->initiator)
 506         {
 507                 hsi = this->ike_sa->get_my_host(this->ike_sa);
 508                 hsr = this->ike_sa->get_other_host(this->ike_sa);
 509         }
 510         else
 511         {
 512                 hsr = this->ike_sa->get_my_host(this->ike_sa);
 513                 hsi = this->ike_sa->get_other_host(this->ike_sa);
 514         }
 515         /* add ID payload only if negotiating non host2host tunnels */
 516         if (!this->tsi->is_host(this->tsi, hsi) ||
 517                 !this->tsr->is_host(this->tsr, hsr) ||
 518                 this->tsi->get_protocol(this->tsi) ||
 519                 this->tsr->get_protocol(this->tsr) ||
 520                 this->tsi->get_from_port(this->tsi) ||
 521                 this->tsr->get_from_port(this->tsr) ||
 522                 this->tsi->get_to_port(this->tsi) != 65535 ||
 523                 this->tsr->get_to_port(this->tsr) != 65535)
 524         {
 525                 id_payload = id_payload_create_from_ts(this->tsi);
 526                 message->add_payload(message, &id_payload->payload_interface);
 527                 id_payload = id_payload_create_from_ts(this->tsr);
 528                 message->add_payload(message, &id_payload->payload_interface);
 529         }
 530 }
 531
 532 /**
 533  * Get traffic selectors from received message
 534  */
 535 static bool get_ts(private_quick_mode_t *this, message_t *message)
 536 {
 537         traffic_selector_t *tsi = NULL, *tsr = NULL;
 538         enumerator_t *enumerator;
 539         id_payload_t *id_payload;
 540         payload_t *payload;
 541         host_t *hsi, *hsr;
 542         bool first = TRUE;
 543
 544         enumerator = message->create_payload_enumerator(message);
 545         while (enumerator->enumerate(enumerator, &payload))
 546         {
 547                 if (payload->get_type(payload) == ID_V1)
 548                 {
 549                         id_payload = (id_payload_t*)payload;
 550
 551                         if (first)
 552                         {
 553                                 tsi = id_payload->get_ts(id_payload);
 554                                 first = FALSE;
 555                         }
 556                         else
 557                         {
 558                                 tsr = id_payload->get_ts(id_payload);
 559                                 break;
 560                         }
 561                 }
 562         }
 563         enumerator->destroy(enumerator);
 564
 565         /* create host2host selectors if ID payloads missing */
 566         if (this->initiator)
 567         {
 568                 hsi = this->ike_sa->get_my_host(this->ike_sa);
 569                 hsr = this->ike_sa->get_other_host(this->ike_sa);
 570         }
 571         else
 572         {
 573                 hsr = this->ike_sa->get_my_host(this->ike_sa);
 574                 hsi = this->ike_sa->get_other_host(this->ike_sa);
 575         }
 576         if (!tsi)
 577         {
 578                 tsi = traffic_selector_create_from_subnet(hsi->clone(hsi),
 579                                                         hsi->get_family(hsi) == AF_INET ? 32 : 128, 0, 0);
 580         }
 581         if (!tsr)
 582         {
 583                 tsr = traffic_selector_create_from_subnet(hsr->clone(hsr),
 584                                                         hsr->get_family(hsr) == AF_INET ? 32 : 128, 0, 0);
 585         }
 586         if (this->mode == MODE_TRANSPORT && this->udp &&
 587            (!tsi->is_host(tsi, hsi) || !tsr->is_host(tsr, hsr)))
 588         {       /* change TS in case of a NAT in transport mode */
 589                 DBG2(DBG_IKE, "changing received traffic selectors %R=== %R due to NAT",
 590                          tsi, tsr);
 591                 tsi->set_address(tsi, hsi);
 592                 tsr->set_address(tsr, hsr);
 593         }
 594
 595         if (this->initiator)
 596         {
 597                 /* check if peer selection is valid */
 598                 if (!tsr->is_contained_in(tsr, this->tsr) ||
 599                         !tsi->is_contained_in(tsi, this->tsi))
 600                 {
 601                         DBG1(DBG_IKE, "peer selected invalid traffic selectors: "
 602                                  "%R for %R, %R for %R", tsi, this->tsi, tsr, this->tsr);
 603                         tsi->destroy(tsi);
 604                         tsr->destroy(tsr);
 605                         return FALSE;
 606                 }
 607                 this->tsi->destroy(this->tsi);
 608                 this->tsr->destroy(this->tsr);
 609                 this->tsi = tsi;
 610                 this->tsr = tsr;
 611         }
 612         else
 613         {
 614                 this->tsi = tsi;
 615                 this->tsr = tsr;
 616         }
 617         return TRUE;
 618 }
 619
 620 /**
 621  * Get encap
 622  */
 623 static encap_t get_encap(ike_sa_t* ike_sa, bool udp)
 624 {
 625         if (!udp)
 626         {
 627                 return ENCAP_NONE;
 628         }
 629         if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
 630         {
 631                 return ENCAP_UDP_DRAFT_00_03;
 632         }
 633         return ENCAP_UDP;
 634 }
 635
 636 /**
 637  * Get NAT-OA payload type (RFC 3947 or RFC 3947 drafts).
 638  */
 639 static payload_type_t get_nat_oa_payload_type(ike_sa_t *ike_sa)
 640 {
 641         if (ike_sa->supports_extension(ike_sa, EXT_NATT_DRAFT_02_03))
 642         {
 643                 return NAT_OA_DRAFT_00_03_V1;
 644         }
 645         return NAT_OA_V1;
 646 }
 647
 648 /**
 649  * Add NAT-OA payloads
 650  */
 651 static void add_nat_oa_payloads(private_quick_mode_t *this, message_t *message)
 652 {
 653         identification_t *id;
 654         id_payload_t *nat_oa;
 655         host_t *src, *dst;
 656         payload_type_t nat_oa_payload_type;
 657
 658         src = message->get_source(message);
 659         dst = message->get_destination(message);
 660
 661         src = this->initiator ? src : dst;
 662         dst = this->initiator ? dst : src;
 663
 664         nat_oa_payload_type = get_nat_oa_payload_type(this->ike_sa);
 665
 666         /* first NAT-OA is the initiator's address */
 667         id = identification_create_from_sockaddr(src->get_sockaddr(src));
 668         nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
 669         message->add_payload(message, (payload_t*)nat_oa);
 670         id->destroy(id);
 671
 672         /* second NAT-OA is that of the responder */
 673         id = identification_create_from_sockaddr(dst->get_sockaddr(dst));
 674         nat_oa = id_payload_create_from_identification(nat_oa_payload_type, id);
 675         message->add_payload(message, (payload_t*)nat_oa);
 676         id->destroy(id);
 677 }
 678
 679 /**
 680  * Look up lifetimes
 681  */
 682 static void get_lifetimes(private_quick_mode_t *this)
 683 {
 684         lifetime_cfg_t *lft;
 685
 686         lft = this->config->get_lifetime(this->config);
 687         if (lft->time.life)
 688         {
 689                 this->lifetime = lft->time.life;
 690         }
 691         else if (lft->bytes.life)
 692         {
 693                 this->lifebytes = lft->bytes.life;
 694         }
 695         free(lft);
 696 }
 697
 698 /**
 699  * Check and apply lifetimes
 700  */
 701 static void apply_lifetimes(private_quick_mode_t *this, sa_payload_t *sa_payload)
 702 {
 703         u_int32_t lifetime;
 704         u_int64_t lifebytes;
 705
 706         lifetime = sa_payload->get_lifetime(sa_payload);
 707         lifebytes = sa_payload->get_lifebytes(sa_payload);
 708         if (this->lifetime != lifetime)
 709         {
 710                 DBG1(DBG_IKE, "received %us lifetime, configured %us",
 711                          lifetime, this->lifetime);
 712                 this->lifetime = lifetime;
 713         }
 714         if (this->lifebytes != lifebytes)
 715         {
 716                 DBG1(DBG_IKE, "received %llu lifebytes, configured %llu",
 717                          lifebytes, this->lifebytes);
 718                 this->lifebytes = lifebytes;
 719         }
 720 }
 721
 722 /**
 723  * Set the task ready to build notify error message
 724  */
 725 static status_t send_notify(private_quick_mode_t *this, notify_type_t type)
 726 {
 727         notify_payload_t *notify;
 728
 729         notify = notify_payload_create_from_protocol_and_type(NOTIFY_V1,
 730                                                                                                                   PROTO_ESP, type);
 731         notify->set_spi(notify, this->spi_i);
 732
 733         this->ike_sa->queue_task(this->ike_sa,
 734                                                 (task_t*)informational_create(this->ike_sa, notify));
 735         /* cancel all active/passive tasks in favour of informational */
 736         this->ike_sa->flush_queue(this->ike_sa,
 737                                         this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
 738         return ALREADY_DONE;
 739 }
 740
 741 METHOD(task_t, build_i, status_t,
 742         private_quick_mode_t *this, message_t *message)
 743 {
 744         switch (this->state)
 745         {
 746                 case QM_INIT:
 747                 {
 748                         enumerator_t *enumerator;
 749                         sa_payload_t *sa_payload;
 750                         linked_list_t *list, *tsi, *tsr;
 751                         proposal_t *proposal;
 752                         diffie_hellman_group_t group;
 753                         encap_t encap;
 754
 755                         this->udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
 756                         this->mode = this->config->get_mode(this->config);
 757                         this->child_sa = child_sa_create(
 758                                                                         this->ike_sa->get_my_host(this->ike_sa),
 759                                                                         this->ike_sa->get_other_host(this->ike_sa),
 760                                                                         this->config, this->reqid, this->udp);
 761
 762                         if (this->udp && this->mode == MODE_TRANSPORT)
 763                         {
 764                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
 765                                 add_nat_oa_payloads(this, message);
 766                         }
 767
 768                         if (this->config->use_ipcomp(this->config))
 769                         {
 770                                 if (this->udp)
 771                                 {
 772                                         DBG1(DBG_IKE, "IPComp is not supported if either peer is "
 773                                                  "natted, IPComp disabled");
 774                                 }
 775                                 else
 776                                 {
 777                                         this->cpi_i = this->child_sa->alloc_cpi(this->child_sa);
 778                                         if (!this->cpi_i)
 779                                         {
 780                                                 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, "
 781                                                          "IPComp disabled");
 782                                         }
 783                                 }
 784                         }
 785
 786                         this->spi_i = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
 787                         if (!this->spi_i)
 788                         {
 789                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
 790                                 return FAILED;
 791                         }
 792                         group = this->config->get_dh_group(this->config);
 793                         if (group != MODP_NONE)
 794                         {
 795                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
 796                                                                                                                   group);
 797                                 if (!this->dh)
 798                                 {
 799                                         DBG1(DBG_IKE, "configured DH group %N not supported",
 800                                                  diffie_hellman_group_names, group);
 801                                         return FAILED;
 802                                 }
 803                         }
 804
 805                         list = this->config->get_proposals(this->config, FALSE);
 806                         enumerator = list->create_enumerator(list);
 807                         while (enumerator->enumerate(enumerator, &proposal))
 808                         {
 809                                 if (group != MODP_NONE)
 810                                 {
 811                                         if (!proposal->has_dh_group(proposal, group))
 812                                         {
 813                                                 list->remove_at(list, enumerator);
 814                                                 proposal->destroy(proposal);
 815                                                 continue;
 816                                         }
 817                                         proposal->strip_dh(proposal, group);
 818                                 }
 819                                 proposal->set_spi(proposal, this->spi_i);
 820                         }
 821                         enumerator->destroy(enumerator);
 822
 823                         get_lifetimes(this);
 824                         encap = get_encap(this->ike_sa, this->udp);
 825                         sa_payload = sa_payload_create_from_proposals_v1(list,
 826                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
 827                                                                 this->mode, encap, this->cpi_i);
 828                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 829                         message->add_payload(message, &sa_payload->payload_interface);
 830
 831                         if (!add_nonce(this, &this->nonce_i, message))
 832                         {
 833                                 return FAILED;
 834                         }
 835                         if (group != MODP_NONE)
 836                         {
 837                                 add_ke(this, message);
 838                         }
 839                         if (!this->tsi)
 840                         {
 841                                 this->tsi = select_ts(this, TRUE, NULL);
 842                         }
 843                         if (!this->tsr)
 844                         {
 845                                 this->tsr = select_ts(this, FALSE, NULL);
 846                         }
 847                         tsi = linked_list_create_with_items(this->tsi, NULL);
 848                         tsr = linked_list_create_with_items(this->tsr, NULL);
 849                         this->tsi = this->tsr = NULL;
 850                         charon->bus->narrow(charon->bus, this->child_sa,
 851                                                                 NARROW_INITIATOR_PRE_AUTH, tsi, tsr);
 852                         tsi->remove_first(tsi, (void**)&this->tsi);
 853                         tsr->remove_first(tsr, (void**)&this->tsr);
 854                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 855                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 856                         if (!this->tsi || !this->tsr)
 857                         {
 858                                 return FAILED;
 859                         }
 860                         add_ts(this, message);
 861                         return NEED_MORE;
 862                 }
 863                 case QM_NEGOTIATED:
 864                 {
 865                         return SUCCESS;
 866                 }
 867                 default:
 868                         return FAILED;
 869         }
 870 }
 871
 872 /**
 873  * Check for notify errors, return TRUE if error found
 874  */
 875 static bool has_notify_errors(private_quick_mode_t *this, message_t *message)
 876 {
 877         enumerator_t *enumerator;
 878         payload_t *payload;
 879         bool err = FALSE;
 880
 881         enumerator = message->create_payload_enumerator(message);
 882         while (enumerator->enumerate(enumerator, &payload))
 883         {
 884                 if (payload->get_type(payload) == NOTIFY_V1)
 885                 {
 886                         notify_payload_t *notify;
 887                         notify_type_t type;
 888
 889                         notify = (notify_payload_t*)payload;
 890                         type = notify->get_notify_type(notify);
 891                         if (type < 16384)
 892                         {
 893
 894                                 DBG1(DBG_IKE, "received %N error notify",
 895                                          notify_type_names, type);
 896                                 err = TRUE;
 897                         }
 898                         else
 899                         {
 900                                 DBG1(DBG_IKE, "received %N notify", notify_type_names, type);
 901                         }
 902                 }
 903         }
 904         enumerator->destroy(enumerator);
 905
 906         return err;
 907 }
 908
 909 /**
 910  * Check if this is a rekey for an existing CHILD_SA, reuse reqid if so
 911  */
 912 static void check_for_rekeyed_child(private_quick_mode_t *this)
 913 {
 914         enumerator_t *enumerator, *policies;
 915         traffic_selector_t *local, *remote;
 916         child_sa_t *child_sa;
 917
 918         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
 919         while (this->reqid == 0 && enumerator->enumerate(enumerator, &child_sa))
 920         {
 921                 if (child_sa->get_state(child_sa) == CHILD_INSTALLED &&
 922                         streq(child_sa->get_name(child_sa),
 923                                   this->config->get_name(this->config)))
 924                 {
 925                         policies = child_sa->create_policy_enumerator(child_sa);
 926                         if (policies->enumerate(policies, &local, &remote))
 927                         {
 928                                 if (local->equals(local, this->tsr) &&
 929                                         remote->equals(remote, this->tsi) &&
 930                                         this->proposal->equals(this->proposal,
 931                                                                                    child_sa->get_proposal(child_sa)))
 932                                 {
 933                                         this->reqid = child_sa->get_reqid(child_sa);
 934                                         this->rekey = child_sa->get_spi(child_sa, TRUE);
 935                                         child_sa->set_state(child_sa, CHILD_REKEYING);
 936                                         DBG1(DBG_IKE, "detected rekeying of CHILD_SA %s{%u}",
 937                                                  child_sa->get_name(child_sa), this->reqid);
 938                                 }
 939                         }
 940                         policies->destroy(policies);
 941                 }
 942         }
 943         enumerator->destroy(enumerator);
 944 }
 945
 946 METHOD(task_t, process_r, status_t,
 947         private_quick_mode_t *this, message_t *message)
 948 {
 949         switch (this->state)
 950         {
 951                 case QM_INIT:
 952                 {
 953                         sa_payload_t *sa_payload;
 954                         linked_list_t *tsi, *tsr, *hostsi, *hostsr, *list = NULL;
 955                         peer_cfg_t *peer_cfg;
 956                         u_int16_t group;
 957                         bool private;
 958
 959                         sa_payload = (sa_payload_t*)message->get_payload(message,
 960                                                                                                         SECURITY_ASSOCIATION_V1);
 961                         if (!sa_payload)
 962                         {
 963                                 DBG1(DBG_IKE, "sa payload missing");
 964                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 965                         }
 966
 967                         this->mode = sa_payload->get_encap_mode(sa_payload, &this->udp);
 968
 969                         if (!get_ts(this, message))
 970                         {
 971                                 return FAILED;
 972                         }
 973                         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 974                         tsi = linked_list_create_with_items(this->tsi, NULL);
 975                         tsr = linked_list_create_with_items(this->tsr, NULL);
 976                         this->tsi = this->tsr = NULL;
 977                         hostsi = get_dynamic_hosts(this->ike_sa, FALSE);
 978                         hostsr = get_dynamic_hosts(this->ike_sa, TRUE);
 979                         this->config = peer_cfg->select_child_cfg(peer_cfg, tsr, tsi,
 980                                                                                                           hostsr, hostsi);
 981                         hostsi->destroy(hostsi);
 982                         hostsr->destroy(hostsr);
 983                         if (this->config)
 984                         {
 985                                 this->tsi = select_ts(this, FALSE, tsi);
 986                                 this->tsr = select_ts(this, TRUE, tsr);
 987                         }
 988                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 989                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 990                         if (!this->config || !this->tsi || !this->tsr)
 991                         {
 992                                 DBG1(DBG_IKE, "no matching CHILD_SA config found");
 993                                 return send_notify(this, INVALID_ID_INFORMATION);
 994                         }
 995
 996                         if (this->config->use_ipcomp(this->config))
 997                         {
 998                                 if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
 999                                 {
1000                                         DBG1(DBG_IKE, "IPComp is not supported if either peer is "
1001                                                  "natted, IPComp disabled");
1002                                 }
1003                                 else
1004                                 {
1005                                         list = sa_payload->get_ipcomp_proposals(sa_payload,
1006                                                                                                                         &this->cpi_i);
1007                                         if (!list->get_count(list))
1008                                         {
1009                                                 DBG1(DBG_IKE, "expected IPComp proposal but peer did "
1010                                                          "not send one, IPComp disabled");
1011                                                 this->cpi_i = 0;
1012                                         }
1013                                 }
1014                         }
1015                         if (!list || !list->get_count(list))
1016                         {
1017                                 DESTROY_IF(list);
1018                                 list = sa_payload->get_proposals(sa_payload);
1019                         }
1020                         private = this->ike_sa->supports_extension(this->ike_sa,
1021                                                                                                            EXT_STRONGSWAN);
1022                         this->proposal = this->config->select_proposal(this->config,
1023                                                                                                                    list, FALSE, private);
1024                         list->destroy_offset(list, offsetof(proposal_t, destroy));
1025
1026                         get_lifetimes(this);
1027                         apply_lifetimes(this, sa_payload);
1028
1029                         if (!this->proposal)
1030                         {
1031                                 DBG1(DBG_IKE, "no matching proposal found, sending %N",
1032                                          notify_type_names, NO_PROPOSAL_CHOSEN);
1033                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1034                         }
1035                         this->spi_i = this->proposal->get_spi(this->proposal);
1036
1037                         if (!get_nonce(this, &this->nonce_i, message))
1038                         {
1039                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1040                         }
1041
1042                         if (this->proposal->get_algorithm(this->proposal,
1043                                                                                 DIFFIE_HELLMAN_GROUP, &group, NULL))
1044                         {
1045                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
1046                                                                                                                   group);
1047                                 if (!this->dh)
1048                                 {
1049                                         DBG1(DBG_IKE, "negotiated DH group %N not supported",
1050                                                  diffie_hellman_group_names, group);
1051                                         return send_notify(this, INVALID_KEY_INFORMATION);
1052                                 }
1053                                 if (!get_ke(this, message))
1054                                 {
1055                                         return send_notify(this, INVALID_PAYLOAD_TYPE);
1056                                 }
1057                         }
1058
1059                         check_for_rekeyed_child(this);
1060
1061                         this->child_sa = child_sa_create(
1062                                                                         this->ike_sa->get_my_host(this->ike_sa),
1063                                                                         this->ike_sa->get_other_host(this->ike_sa),
1064                                                                         this->config, this->reqid, this->udp);
1065
1066                         tsi = linked_list_create_with_items(this->tsi, NULL);
1067                         tsr = linked_list_create_with_items(this->tsr, NULL);
1068                         this->tsi = this->tsr = NULL;
1069                         charon->bus->narrow(charon->bus, this->child_sa,
1070                                                                 NARROW_RESPONDER, tsr, tsi);
1071                         if (tsi->remove_first(tsi, (void**)&this->tsi) != SUCCESS ||
1072                                 tsr->remove_first(tsr, (void**)&this->tsr) != SUCCESS)
1073                         {
1074                                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1075                                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1076                                 return send_notify(this, INVALID_ID_INFORMATION);
1077                         }
1078                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1079                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1080
1081                         return NEED_MORE;
1082                 }
1083                 case QM_NEGOTIATED:
1084                 {
1085                         if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
1086                                 has_notify_errors(this, message))
1087                         {
1088                                 return SUCCESS;
1089                         }
1090                         if (!install(this))
1091                         {
1092                                 ike_sa_t *ike_sa = this->ike_sa;
1093                                 task_t *task;
1094
1095                                 task = (task_t*)quick_delete_create(this->ike_sa,
1096                                                                 this->proposal->get_protocol(this->proposal),
1097                                                                 this->spi_i, TRUE, TRUE);
1098                                 /* flush_queue() destroys the current task */
1099                                 ike_sa->flush_queue(ike_sa, TASK_QUEUE_PASSIVE);
1100                                 ike_sa->queue_task(ike_sa, task);
1101                                 return ALREADY_DONE;
1102                         }
1103                         return SUCCESS;
1104                 }
1105                 default:
1106                         return FAILED;
1107         }
1108 }
1109
1110 METHOD(task_t, build_r, status_t,
1111         private_quick_mode_t *this, message_t *message)
1112 {
1113         switch (this->state)
1114         {
1115                 case QM_INIT:
1116                 {
1117                         sa_payload_t *sa_payload;
1118                         encap_t encap;
1119
1120                         this->spi_r = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
1121                         if (!this->spi_r)
1122                         {
1123                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
1124                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1125                         }
1126                         this->proposal->set_spi(this->proposal, this->spi_r);
1127
1128                         if (this->cpi_i)
1129                         {
1130                                 this->cpi_r = this->child_sa->alloc_cpi(this->child_sa);
1131                                 if (!this->cpi_r)
1132                                 {
1133                                         DBG1(DBG_IKE, "unable to allocate a CPI from "
1134                                                  "kernel, IPComp disabled");
1135                                         return send_notify(this, NO_PROPOSAL_CHOSEN);
1136                                 }
1137                         }
1138
1139                         if (this->udp && this->mode == MODE_TRANSPORT)
1140                         {
1141                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
1142                                 add_nat_oa_payloads(this, message);
1143                         }
1144
1145                         encap = get_encap(this->ike_sa, this->udp);
1146                         sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
1147                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
1148                                                                 this->mode, encap, this->cpi_r);
1149                         message->add_payload(message, &sa_payload->payload_interface);
1150
1151                         if (!add_nonce(this, &this->nonce_r, message))
1152                         {
1153                                 return FAILED;
1154                         }
1155                         if (this->dh)
1156                         {
1157                                 add_ke(this, message);
1158                         }
1159
1160                         add_ts(this, message);
1161
1162                         this->state = QM_NEGOTIATED;
1163                         return NEED_MORE;
1164                 }
1165                 default:
1166                         return FAILED;
1167         }
1168 }
1169
1170 METHOD(task_t, process_i, status_t,
1171         private_quick_mode_t *this, message_t *message)
1172 {
1173         switch (this->state)
1174         {
1175                 case QM_INIT:
1176                 {
1177                         sa_payload_t *sa_payload;
1178                         linked_list_t *list = NULL;
1179                         bool private;
1180
1181                         sa_payload = (sa_payload_t*)message->get_payload(message,
1182                                                                                                         SECURITY_ASSOCIATION_V1);
1183                         if (!sa_payload)
1184                         {
1185                                 DBG1(DBG_IKE, "sa payload missing");
1186                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1187                         }
1188                         if (this->cpi_i)
1189                         {
1190                                 list = sa_payload->get_ipcomp_proposals(sa_payload,
1191                                                                                                                 &this->cpi_r);
1192                                 if (!list->get_count(list))
1193                                 {
1194                                         DBG1(DBG_IKE, "peer did not acccept our IPComp proposal, "
1195                                                  "IPComp disabled");
1196                                         this->cpi_i = 0;
1197                                 }
1198                         }
1199                         if (!list || !list->get_count(list))
1200                         {
1201                                 DESTROY_IF(list);
1202                                 list = sa_payload->get_proposals(sa_payload);
1203                         }
1204                         private = this->ike_sa->supports_extension(this->ike_sa,
1205                                                                                                            EXT_STRONGSWAN);
1206                         this->proposal = this->config->select_proposal(this->config,
1207                                                                                                                    list, FALSE, private);
1208                         list->destroy_offset(list, offsetof(proposal_t, destroy));
1209                         if (!this->proposal)
1210                         {
1211                                 DBG1(DBG_IKE, "no matching proposal found");
1212                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1213                         }
1214                         this->spi_r = this->proposal->get_spi(this->proposal);
1215
1216                         apply_lifetimes(this, sa_payload);
1217
1218                         if (!get_nonce(this, &this->nonce_r, message))
1219                         {
1220                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1221                         }
1222                         if (this->dh && !get_ke(this, message))
1223                         {
1224                                 return send_notify(this, INVALID_KEY_INFORMATION);
1225                         }
1226                         if (!get_ts(this, message))
1227                         {
1228                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1229                         }
1230                         if (!install(this))
1231                         {
1232                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1233                         }
1234                         this->state = QM_NEGOTIATED;
1235                         return NEED_MORE;
1236                 }
1237                 default:
1238                         return FAILED;
1239         }
1240 }
1241
1242 METHOD(task_t, get_type, task_type_t,
1243         private_quick_mode_t *this)
1244 {
1245         return TASK_QUICK_MODE;
1246 }
1247
1248 METHOD(quick_mode_t, use_reqid, void,
1249         private_quick_mode_t *this, u_int32_t reqid)
1250 {
1251         this->reqid = reqid;
1252 }
1253
1254 METHOD(quick_mode_t, rekey, void,
1255         private_quick_mode_t *this, u_int32_t spi)
1256 {
1257         this->rekey = spi;
1258 }
1259
1260 METHOD(task_t, migrate, void,
1261         private_quick_mode_t *this, ike_sa_t *ike_sa)
1262 {
1263         chunk_free(&this->nonce_i);
1264         chunk_free(&this->nonce_r);
1265         DESTROY_IF(this->tsi);
1266         DESTROY_IF(this->tsr);
1267         DESTROY_IF(this->proposal);
1268         DESTROY_IF(this->child_sa);
1269         DESTROY_IF(this->dh);
1270
1271         this->ike_sa = ike_sa;
1272         this->keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa);
1273         this->state = QM_INIT;
1274         this->tsi = NULL;
1275         this->tsr = NULL;
1276         this->proposal = NULL;
1277         this->child_sa = NULL;
1278         this->dh = NULL;
1279         this->spi_i = 0;
1280         this->spi_r = 0;
1281
1282         if (!this->initiator)
1283         {
1284                 DESTROY_IF(this->config);
1285                 this->config = NULL;
1286         }
1287 }
1288
1289 METHOD(task_t, destroy, void,
1290         private_quick_mode_t *this)
1291 {
1292         chunk_free(&this->nonce_i);
1293         chunk_free(&this->nonce_r);
1294         DESTROY_IF(this->tsi);
1295         DESTROY_IF(this->tsr);
1296         DESTROY_IF(this->proposal);
1297         DESTROY_IF(this->child_sa);
1298         DESTROY_IF(this->config);
1299         DESTROY_IF(this->dh);
1300         free(this);
1301 }
1302
1303 /*
1304  * Described in header.
1305  */
1306 quick_mode_t *quick_mode_create(ike_sa_t *ike_sa, child_cfg_t *config,
1307                                                         traffic_selector_t *tsi, traffic_selector_t *tsr)
1308 {
1309         private_quick_mode_t *this;
1310
1311         INIT(this,
1312                 .public = {
1313                         .task = {
1314                                 .get_type = _get_type,
1315                                 .migrate = _migrate,
1316                                 .destroy = _destroy,
1317                         },
1318                         .use_reqid = _use_reqid,
1319                         .rekey = _rekey,
1320                 },
1321                 .ike_sa = ike_sa,
1322                 .initiator = config != NULL,
1323                 .config = config,
1324                 .keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa),
1325                 .state = QM_INIT,
1326                 .tsi = tsi ? tsi->clone(tsi) : NULL,
1327                 .tsr = tsr ? tsr->clone(tsr) : NULL,
1328         );
1329
1330         if (config)
1331         {
1332                 this->public.task.build = _build_i;
1333                 this->public.task.process = _process_i;
1334         }
1335         else
1336         {
1337                 this->public.task.build = _build_r;
1338                 this->public.task.process = _process_r;
1339         }
1340
1341         return &this->public;
1342 }