2 * Copyright (C) 2012 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
5 * Copyright (C) 2011 Martin Willi
6 * Copyright (C) 2011 revosec AG
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * Copyright (C) 2012 Volker RĂ¼melin
22 * Permission is hereby granted, free of charge, to any person obtaining a copy
23 * of this software and associated documentation files (the "Software"), to deal
24 * in the Software without restriction, including without limitation the rights
25 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
26 * copies of the Software, and to permit persons to whom the Software is
27 * furnished to do so, subject to the following conditions:
29 * The above copyright notice and this permission notice shall be included in
30 * all copies or substantial portions of the Software.
32 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
33 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
34 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
35 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
36 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
37 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
41 #include "quick_mode.h"
46 #include <sa/ikev1/keymat_v1.h>
47 #include <encoding/payloads/sa_payload.h>
48 #include <encoding/payloads/nonce_payload.h>
49 #include <encoding/payloads/ke_payload.h>
50 #include <encoding/payloads/id_payload.h>
51 #include <encoding/payloads/payload.h>
52 #include <sa/ikev1/tasks/informational.h>
53 #include <sa/ikev1/tasks/quick_delete.h>
54 #include <processing/jobs/inactivity_job.h>
56 typedef struct private_quick_mode_t private_quick_mode_t
;
59 * Private members of a quick_mode_t task.
61 struct private_quick_mode_t
{
64 * Public methods and task_t interface.
74 * TRUE if we are initiating quick mode
79 * Traffic selector of initiator
81 traffic_selector_t
*tsi
;
84 * Traffic selector of responder
86 traffic_selector_t
*tsr
;
109 * Initiators IPComp CPI
114 * Responders IPComp CPI
119 * selected CHILD_SA proposal
121 proposal_t
*proposal
;
124 * Config of CHILD_SA to establish
129 * CHILD_SA we are about to establish
131 child_sa_t
*child_sa
;
139 * DH exchange, when PFS is in use
141 diffie_hellman_t
*dh
;
144 * Negotiated lifetime of new SA
149 * Negotaited lifebytes of new SA
154 * Reqid to use, 0 for auto-allocate
164 * Negotiated mode, tunnel or transport
169 * Use UDP encapsulation
173 /** states of quick mode */
181 * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
183 static void schedule_inactivity_timeout(private_quick_mode_t
*this)
188 timeout
= this->config
->get_inactivity(this->config
);
191 close_ike
= lib
->settings
->get_bool(lib
->settings
,
192 "%s.inactivity_close_ike", FALSE
, charon
->name
);
193 lib
->scheduler
->schedule_job(lib
->scheduler
, (job_t
*)
194 inactivity_job_create(this->child_sa
->get_reqid(this->child_sa
),
195 timeout
, close_ike
), timeout
);
200 * Check if we have a an address pool configured
202 static bool have_pool(ike_sa_t
*ike_sa
)
204 enumerator_t
*enumerator
;
205 peer_cfg_t
*peer_cfg
;
209 peer_cfg
= ike_sa
->get_peer_cfg(ike_sa
);
212 enumerator
= peer_cfg
->create_pool_enumerator(peer_cfg
);
213 if (enumerator
->enumerate(enumerator
, &pool
))
217 enumerator
->destroy(enumerator
);
223 * Get hosts to use for dynamic traffic selectors
225 static linked_list_t
*get_dynamic_hosts(ike_sa_t
*ike_sa
, bool local
)
227 enumerator_t
*enumerator
;
231 list
= linked_list_create();
232 enumerator
= ike_sa
->create_virtual_ip_enumerator(ike_sa
, local
);
233 while (enumerator
->enumerate(enumerator
, &host
))
235 list
->insert_last(list
, host
);
237 enumerator
->destroy(enumerator
);
239 if (list
->get_count(list
) == 0)
240 { /* no virtual IPs assigned */
243 host
= ike_sa
->get_my_host(ike_sa
);
244 list
->insert_last(list
, host
);
246 else if (!have_pool(ike_sa
))
247 { /* use host only if we don't have a pool configured */
248 host
= ike_sa
->get_other_host(ike_sa
);
249 list
->insert_last(list
, host
);
256 * Install negotiated CHILD_SA
258 static bool install(private_quick_mode_t
*this)
260 status_t status
, status_i
, status_o
;
261 chunk_t encr_i
, encr_r
, integ_i
, integ_r
;
262 linked_list_t
*tsi
, *tsr
;
263 child_sa_t
*old
= NULL
;
265 this->child_sa
->set_proposal(this->child_sa
, this->proposal
);
266 this->child_sa
->set_state(this->child_sa
, CHILD_INSTALLING
);
267 this->child_sa
->set_mode(this->child_sa
, this->mode
);
269 if (this->cpi_i
&& this->cpi_r
)
270 { /* DEFLATE is the only transform we currently support */
271 this->child_sa
->set_ipcomp(this->child_sa
, IPCOMP_DEFLATE
);
275 this->cpi_i
= this->cpi_r
= 0;
278 this->child_sa
->set_protocol(this->child_sa
,
279 this->proposal
->get_protocol(this->proposal
));
281 status_i
= status_o
= FAILED
;
282 encr_i
= encr_r
= integ_i
= integ_r
= chunk_empty
;
283 tsi
= linked_list_create_with_items(this->tsi
->clone(this->tsi
), NULL
);
284 tsr
= linked_list_create_with_items(this->tsr
->clone(this->tsr
), NULL
);
287 charon
->bus
->narrow(charon
->bus
, this->child_sa
,
288 NARROW_INITIATOR_POST_AUTH
, tsi
, tsr
);
292 charon
->bus
->narrow(charon
->bus
, this->child_sa
,
293 NARROW_RESPONDER_POST
, tsr
, tsi
);
295 if (tsi
->get_count(tsi
) == 0 || tsr
->get_count(tsr
) == 0)
297 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
298 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
299 DBG1(DBG_IKE
, "no acceptable traffic selectors found");
303 if (this->keymat
->derive_child_keys(this->keymat
, this->proposal
, this->dh
,
304 this->spi_i
, this->spi_r
, this->nonce_i
, this->nonce_r
,
305 &encr_i
, &integ_i
, &encr_r
, &integ_r
))
309 status_i
= this->child_sa
->install(this->child_sa
, encr_r
, integ_r
,
310 this->spi_i
, this->cpi_i
, TRUE
, FALSE
, tsi
, tsr
);
311 status_o
= this->child_sa
->install(this->child_sa
, encr_i
, integ_i
,
312 this->spi_r
, this->cpi_r
, FALSE
, FALSE
, tsi
, tsr
);
316 status_i
= this->child_sa
->install(this->child_sa
, encr_i
, integ_i
,
317 this->spi_r
, this->cpi_r
, TRUE
, FALSE
, tsr
, tsi
);
318 status_o
= this->child_sa
->install(this->child_sa
, encr_r
, integ_r
,
319 this->spi_i
, this->cpi_i
, FALSE
, FALSE
, tsr
, tsi
);
322 chunk_clear(&integ_i
);
323 chunk_clear(&integ_r
);
324 chunk_clear(&encr_i
);
325 chunk_clear(&encr_r
);
327 if (status_i
!= SUCCESS
|| status_o
!= SUCCESS
)
329 DBG1(DBG_IKE
, "unable to install %s%s%sIPsec SA (SAD) in kernel",
330 (status_i
!= SUCCESS
) ?
"inbound " : "",
331 (status_i
!= SUCCESS
&& status_o
!= SUCCESS
) ?
"and ": "",
332 (status_o
!= SUCCESS
) ?
"outbound " : "");
333 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
334 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
340 status
= this->child_sa
->add_policies(this->child_sa
, tsi
, tsr
);
344 status
= this->child_sa
->add_policies(this->child_sa
, tsr
, tsi
);
346 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
347 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
348 if (status
!= SUCCESS
)
350 DBG1(DBG_IKE
, "unable to install IPsec policies (SPD) in kernel");
354 charon
->bus
->child_keys(charon
->bus
, this->child_sa
, this->initiator
,
355 this->dh
, this->nonce_i
, this->nonce_r
);
357 /* add to IKE_SA, and remove from task */
358 this->child_sa
->set_state(this->child_sa
, CHILD_INSTALLED
);
359 this->ike_sa
->add_child_sa(this->ike_sa
, this->child_sa
);
361 DBG0(DBG_IKE
, "CHILD_SA %s{%d} established "
362 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
363 this->child_sa
->get_name(this->child_sa
),
364 this->child_sa
->get_reqid(this->child_sa
),
365 ntohl(this->child_sa
->get_spi(this->child_sa
, TRUE
)),
366 ntohl(this->child_sa
->get_spi(this->child_sa
, FALSE
)),
367 this->child_sa
->get_traffic_selectors(this->child_sa
, TRUE
),
368 this->child_sa
->get_traffic_selectors(this->child_sa
, FALSE
));
372 old
= this->ike_sa
->get_child_sa(this->ike_sa
,
373 this->proposal
->get_protocol(this->proposal
),
378 charon
->bus
->child_rekey(charon
->bus
, old
, this->child_sa
);
382 charon
->bus
->child_updown(charon
->bus
, this->child_sa
, TRUE
);
386 schedule_inactivity_timeout(this);
388 this->child_sa
= NULL
;
393 * Generate and add NONCE
395 static bool add_nonce(private_quick_mode_t
*this, chunk_t
*nonce
,
398 nonce_payload_t
*nonce_payload
;
401 nonceg
= this->keymat
->keymat
.create_nonce_gen(&this->keymat
->keymat
);
404 DBG1(DBG_IKE
, "no nonce generator found to create nonce");
407 if (!nonceg
->allocate_nonce(nonceg
, NONCE_SIZE
, nonce
))
409 DBG1(DBG_IKE
, "nonce allocation failed");
410 nonceg
->destroy(nonceg
);
413 nonceg
->destroy(nonceg
);
415 nonce_payload
= nonce_payload_create(NONCE_V1
);
416 nonce_payload
->set_nonce(nonce_payload
, *nonce
);
417 message
->add_payload(message
, &nonce_payload
->payload_interface
);
423 * Extract nonce from NONCE payload
425 static bool get_nonce(private_quick_mode_t
*this, chunk_t
*nonce
,
428 nonce_payload_t
*nonce_payload
;
430 nonce_payload
= (nonce_payload_t
*)message
->get_payload(message
, NONCE_V1
);
433 DBG1(DBG_IKE
, "NONCE payload missing in message");
436 *nonce
= nonce_payload
->get_nonce(nonce_payload
);
442 * Add KE payload to message
444 static void add_ke(private_quick_mode_t
*this, message_t
*message
)
446 ke_payload_t
*ke_payload
;
448 ke_payload
= ke_payload_create_from_diffie_hellman(KEY_EXCHANGE_V1
, this->dh
);
449 message
->add_payload(message
, &ke_payload
->payload_interface
);
453 * Get DH value from a KE payload
455 static bool get_ke(private_quick_mode_t
*this, message_t
*message
)
457 ke_payload_t
*ke_payload
;
459 ke_payload
= (ke_payload_t
*)message
->get_payload(message
, KEY_EXCHANGE_V1
);
462 DBG1(DBG_IKE
, "KE payload missing");
465 this->dh
->set_other_public_value(this->dh
,
466 ke_payload
->get_key_exchange_data(ke_payload
));
471 * Select a traffic selector from configuration
473 static traffic_selector_t
* select_ts(private_quick_mode_t
*this, bool local
,
474 linked_list_t
*supplied
)
476 traffic_selector_t
*ts
;
477 linked_list_t
*list
, *hosts
;
479 hosts
= get_dynamic_hosts(this->ike_sa
, local
);
480 list
= this->config
->get_traffic_selectors(this->config
,
481 local
, supplied
, hosts
);
482 hosts
->destroy(hosts
);
483 if (list
->get_first(list
, (void**)&ts
) == SUCCESS
)
489 DBG1(DBG_IKE
, "%s traffic selector missing in configuration",
490 local ?
"local" : "local");
493 list
->destroy_offset(list
, offsetof(traffic_selector_t
, destroy
));
498 * Add selected traffic selectors to message
500 static void add_ts(private_quick_mode_t
*this, message_t
*message
)
502 id_payload_t
*id_payload
;
507 hsi
= this->ike_sa
->get_my_host(this->ike_sa
);
508 hsr
= this->ike_sa
->get_other_host(this->ike_sa
);
512 hsr
= this->ike_sa
->get_my_host(this->ike_sa
);
513 hsi
= this->ike_sa
->get_other_host(this->ike_sa
);
515 /* add ID payload only if negotiating non host2host tunnels */
516 if (!this->tsi
->is_host(this->tsi
, hsi
) ||
517 !this->tsr
->is_host(this->tsr
, hsr
) ||
518 this->tsi
->get_protocol(this->tsi
) ||
519 this->tsr
->get_protocol(this->tsr
) ||
520 this->tsi
->get_from_port(this->tsi
) ||
521 this->tsr
->get_from_port(this->tsr
) ||
522 this->tsi
->get_to_port(this->tsi
) != 65535 ||
523 this->tsr
->get_to_port(this->tsr
) != 65535)
525 id_payload
= id_payload_create_from_ts(this->tsi
);
526 message
->add_payload(message
, &id_payload
->payload_interface
);
527 id_payload
= id_payload_create_from_ts(this->tsr
);
528 message
->add_payload(message
, &id_payload
->payload_interface
);
533 * Get traffic selectors from received message
535 static bool get_ts(private_quick_mode_t
*this, message_t
*message
)
537 traffic_selector_t
*tsi
= NULL
, *tsr
= NULL
;
538 enumerator_t
*enumerator
;
539 id_payload_t
*id_payload
;
544 enumerator
= message
->create_payload_enumerator(message
);
545 while (enumerator
->enumerate(enumerator
, &payload
))
547 if (payload
->get_type(payload
) == ID_V1
)
549 id_payload
= (id_payload_t
*)payload
;
553 tsi
= id_payload
->get_ts(id_payload
);
558 tsr
= id_payload
->get_ts(id_payload
);
563 enumerator
->destroy(enumerator
);
565 /* create host2host selectors if ID payloads missing */
568 hsi
= this->ike_sa
->get_my_host(this->ike_sa
);
569 hsr
= this->ike_sa
->get_other_host(this->ike_sa
);
573 hsr
= this->ike_sa
->get_my_host(this->ike_sa
);
574 hsi
= this->ike_sa
->get_other_host(this->ike_sa
);
578 tsi
= traffic_selector_create_from_subnet(hsi
->clone(hsi
),
579 hsi
->get_family(hsi
) == AF_INET ?
32 : 128, 0, 0);
583 tsr
= traffic_selector_create_from_subnet(hsr
->clone(hsr
),
584 hsr
->get_family(hsr
) == AF_INET ?
32 : 128, 0, 0);
586 if (this->mode
== MODE_TRANSPORT
&& this->udp
&&
587 (!tsi
->is_host(tsi
, hsi
) || !tsr
->is_host(tsr
, hsr
)))
588 { /* change TS in case of a NAT in transport mode */
589 DBG2(DBG_IKE
, "changing received traffic selectors %R=== %R due to NAT",
591 tsi
->set_address(tsi
, hsi
);
592 tsr
->set_address(tsr
, hsr
);
597 /* check if peer selection is valid */
598 if (!tsr
->is_contained_in(tsr
, this->tsr
) ||
599 !tsi
->is_contained_in(tsi
, this->tsi
))
601 DBG1(DBG_IKE
, "peer selected invalid traffic selectors: "
602 "%R for %R, %R for %R", tsi
, this->tsi
, tsr
, this->tsr
);
607 this->tsi
->destroy(this->tsi
);
608 this->tsr
->destroy(this->tsr
);
623 static encap_t
get_encap(ike_sa_t
* ike_sa
, bool udp
)
629 if (ike_sa
->supports_extension(ike_sa
, EXT_NATT_DRAFT_02_03
))
631 return ENCAP_UDP_DRAFT_00_03
;
637 * Get NAT-OA payload type (RFC 3947 or RFC 3947 drafts).
639 static payload_type_t
get_nat_oa_payload_type(ike_sa_t
*ike_sa
)
641 if (ike_sa
->supports_extension(ike_sa
, EXT_NATT_DRAFT_02_03
))
643 return NAT_OA_DRAFT_00_03_V1
;
649 * Add NAT-OA payloads
651 static void add_nat_oa_payloads(private_quick_mode_t
*this, message_t
*message
)
653 identification_t
*id
;
654 id_payload_t
*nat_oa
;
656 payload_type_t nat_oa_payload_type
;
658 src
= message
->get_source(message
);
659 dst
= message
->get_destination(message
);
661 src
= this->initiator ? src
: dst
;
662 dst
= this->initiator ? dst
: src
;
664 nat_oa_payload_type
= get_nat_oa_payload_type(this->ike_sa
);
666 /* first NAT-OA is the initiator's address */
667 id
= identification_create_from_sockaddr(src
->get_sockaddr(src
));
668 nat_oa
= id_payload_create_from_identification(nat_oa_payload_type
, id
);
669 message
->add_payload(message
, (payload_t
*)nat_oa
);
672 /* second NAT-OA is that of the responder */
673 id
= identification_create_from_sockaddr(dst
->get_sockaddr(dst
));
674 nat_oa
= id_payload_create_from_identification(nat_oa_payload_type
, id
);
675 message
->add_payload(message
, (payload_t
*)nat_oa
);
682 static void get_lifetimes(private_quick_mode_t
*this)
686 lft
= this->config
->get_lifetime(this->config
);
689 this->lifetime
= lft
->time
.life
;
691 else if (lft
->bytes
.life
)
693 this->lifebytes
= lft
->bytes
.life
;
699 * Check and apply lifetimes
701 static void apply_lifetimes(private_quick_mode_t
*this, sa_payload_t
*sa_payload
)
706 lifetime
= sa_payload
->get_lifetime(sa_payload
);
707 lifebytes
= sa_payload
->get_lifebytes(sa_payload
);
708 if (this->lifetime
!= lifetime
)
710 DBG1(DBG_IKE
, "received %us lifetime, configured %us",
711 lifetime
, this->lifetime
);
712 this->lifetime
= lifetime
;
714 if (this->lifebytes
!= lifebytes
)
716 DBG1(DBG_IKE
, "received %llu lifebytes, configured %llu",
717 lifebytes
, this->lifebytes
);
718 this->lifebytes
= lifebytes
;
723 * Set the task ready to build notify error message
725 static status_t
send_notify(private_quick_mode_t
*this, notify_type_t type
)
727 notify_payload_t
*notify
;
729 notify
= notify_payload_create_from_protocol_and_type(NOTIFY_V1
,
731 notify
->set_spi(notify
, this->spi_i
);
733 this->ike_sa
->queue_task(this->ike_sa
,
734 (task_t
*)informational_create(this->ike_sa
, notify
));
735 /* cancel all active/passive tasks in favour of informational */
736 this->ike_sa
->flush_queue(this->ike_sa
,
737 this->initiator ? TASK_QUEUE_ACTIVE
: TASK_QUEUE_PASSIVE
);
741 METHOD(task_t
, build_i
, status_t
,
742 private_quick_mode_t
*this, message_t
*message
)
748 enumerator_t
*enumerator
;
749 sa_payload_t
*sa_payload
;
750 linked_list_t
*list
, *tsi
, *tsr
;
751 proposal_t
*proposal
;
752 diffie_hellman_group_t group
;
755 this->udp
= this->ike_sa
->has_condition(this->ike_sa
, COND_NAT_ANY
);
756 this->mode
= this->config
->get_mode(this->config
);
757 this->child_sa
= child_sa_create(
758 this->ike_sa
->get_my_host(this->ike_sa
),
759 this->ike_sa
->get_other_host(this->ike_sa
),
760 this->config
, this->reqid
, this->udp
);
762 if (this->udp
&& this->mode
== MODE_TRANSPORT
)
764 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
765 add_nat_oa_payloads(this, message
);
768 if (this->config
->use_ipcomp(this->config
))
772 DBG1(DBG_IKE
, "IPComp is not supported if either peer is "
773 "natted, IPComp disabled");
777 this->cpi_i
= this->child_sa
->alloc_cpi(this->child_sa
);
780 DBG1(DBG_IKE
, "unable to allocate a CPI from kernel, "
786 this->spi_i
= this->child_sa
->alloc_spi(this->child_sa
, PROTO_ESP
);
789 DBG1(DBG_IKE
, "allocating SPI from kernel failed");
792 group
= this->config
->get_dh_group(this->config
);
793 if (group
!= MODP_NONE
)
795 this->dh
= this->keymat
->keymat
.create_dh(&this->keymat
->keymat
,
799 DBG1(DBG_IKE
, "configured DH group %N not supported",
800 diffie_hellman_group_names
, group
);
805 list
= this->config
->get_proposals(this->config
, FALSE
);
806 enumerator
= list
->create_enumerator(list
);
807 while (enumerator
->enumerate(enumerator
, &proposal
))
809 if (group
!= MODP_NONE
)
811 if (!proposal
->has_dh_group(proposal
, group
))
813 list
->remove_at(list
, enumerator
);
814 proposal
->destroy(proposal
);
817 proposal
->strip_dh(proposal
, group
);
819 proposal
->set_spi(proposal
, this->spi_i
);
821 enumerator
->destroy(enumerator
);
824 encap
= get_encap(this->ike_sa
, this->udp
);
825 sa_payload
= sa_payload_create_from_proposals_v1(list
,
826 this->lifetime
, this->lifebytes
, AUTH_NONE
,
827 this->mode
, encap
, this->cpi_i
);
828 list
->destroy_offset(list
, offsetof(proposal_t
, destroy
));
829 message
->add_payload(message
, &sa_payload
->payload_interface
);
831 if (!add_nonce(this, &this->nonce_i
, message
))
835 if (group
!= MODP_NONE
)
837 add_ke(this, message
);
841 this->tsi
= select_ts(this, TRUE
, NULL
);
845 this->tsr
= select_ts(this, FALSE
, NULL
);
847 tsi
= linked_list_create_with_items(this->tsi
, NULL
);
848 tsr
= linked_list_create_with_items(this->tsr
, NULL
);
849 this->tsi
= this->tsr
= NULL
;
850 charon
->bus
->narrow(charon
->bus
, this->child_sa
,
851 NARROW_INITIATOR_PRE_AUTH
, tsi
, tsr
);
852 tsi
->remove_first(tsi
, (void**)&this->tsi
);
853 tsr
->remove_first(tsr
, (void**)&this->tsr
);
854 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
855 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
856 if (!this->tsi
|| !this->tsr
)
860 add_ts(this, message
);
873 * Check for notify errors, return TRUE if error found
875 static bool has_notify_errors(private_quick_mode_t
*this, message_t
*message
)
877 enumerator_t
*enumerator
;
881 enumerator
= message
->create_payload_enumerator(message
);
882 while (enumerator
->enumerate(enumerator
, &payload
))
884 if (payload
->get_type(payload
) == NOTIFY_V1
)
886 notify_payload_t
*notify
;
889 notify
= (notify_payload_t
*)payload
;
890 type
= notify
->get_notify_type(notify
);
894 DBG1(DBG_IKE
, "received %N error notify",
895 notify_type_names
, type
);
900 DBG1(DBG_IKE
, "received %N notify", notify_type_names
, type
);
904 enumerator
->destroy(enumerator
);
910 * Check if this is a rekey for an existing CHILD_SA, reuse reqid if so
912 static void check_for_rekeyed_child(private_quick_mode_t
*this)
914 enumerator_t
*enumerator
, *policies
;
915 traffic_selector_t
*local
, *remote
;
916 child_sa_t
*child_sa
;
918 enumerator
= this->ike_sa
->create_child_sa_enumerator(this->ike_sa
);
919 while (this->reqid
== 0 && enumerator
->enumerate(enumerator
, &child_sa
))
921 if (child_sa
->get_state(child_sa
) == CHILD_INSTALLED
&&
922 streq(child_sa
->get_name(child_sa
),
923 this->config
->get_name(this->config
)))
925 policies
= child_sa
->create_policy_enumerator(child_sa
);
926 if (policies
->enumerate(policies
, &local
, &remote
))
928 if (local
->equals(local
, this->tsr
) &&
929 remote
->equals(remote
, this->tsi
) &&
930 this->proposal
->equals(this->proposal
,
931 child_sa
->get_proposal(child_sa
)))
933 this->reqid
= child_sa
->get_reqid(child_sa
);
934 this->rekey
= child_sa
->get_spi(child_sa
, TRUE
);
935 child_sa
->set_state(child_sa
, CHILD_REKEYING
);
936 DBG1(DBG_IKE
, "detected rekeying of CHILD_SA %s{%u}",
937 child_sa
->get_name(child_sa
), this->reqid
);
940 policies
->destroy(policies
);
943 enumerator
->destroy(enumerator
);
946 METHOD(task_t
, process_r
, status_t
,
947 private_quick_mode_t
*this, message_t
*message
)
953 sa_payload_t
*sa_payload
;
954 linked_list_t
*tsi
, *tsr
, *hostsi
, *hostsr
, *list
= NULL
;
955 peer_cfg_t
*peer_cfg
;
959 sa_payload
= (sa_payload_t
*)message
->get_payload(message
,
960 SECURITY_ASSOCIATION_V1
);
963 DBG1(DBG_IKE
, "sa payload missing");
964 return send_notify(this, INVALID_PAYLOAD_TYPE
);
967 this->mode
= sa_payload
->get_encap_mode(sa_payload
, &this->udp
);
969 if (!get_ts(this, message
))
973 peer_cfg
= this->ike_sa
->get_peer_cfg(this->ike_sa
);
974 tsi
= linked_list_create_with_items(this->tsi
, NULL
);
975 tsr
= linked_list_create_with_items(this->tsr
, NULL
);
976 this->tsi
= this->tsr
= NULL
;
977 hostsi
= get_dynamic_hosts(this->ike_sa
, FALSE
);
978 hostsr
= get_dynamic_hosts(this->ike_sa
, TRUE
);
979 this->config
= peer_cfg
->select_child_cfg(peer_cfg
, tsr
, tsi
,
981 hostsi
->destroy(hostsi
);
982 hostsr
->destroy(hostsr
);
985 this->tsi
= select_ts(this, FALSE
, tsi
);
986 this->tsr
= select_ts(this, TRUE
, tsr
);
988 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
989 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
990 if (!this->config
|| !this->tsi
|| !this->tsr
)
992 DBG1(DBG_IKE
, "no matching CHILD_SA config found");
993 return send_notify(this, INVALID_ID_INFORMATION
);
996 if (this->config
->use_ipcomp(this->config
))
998 if (this->ike_sa
->has_condition(this->ike_sa
, COND_NAT_ANY
))
1000 DBG1(DBG_IKE
, "IPComp is not supported if either peer is "
1001 "natted, IPComp disabled");
1005 list
= sa_payload
->get_ipcomp_proposals(sa_payload
,
1007 if (!list
->get_count(list
))
1009 DBG1(DBG_IKE
, "expected IPComp proposal but peer did "
1010 "not send one, IPComp disabled");
1015 if (!list
|| !list
->get_count(list
))
1018 list
= sa_payload
->get_proposals(sa_payload
);
1020 private = this->ike_sa
->supports_extension(this->ike_sa
,
1022 this->proposal
= this->config
->select_proposal(this->config
,
1023 list
, FALSE
, private);
1024 list
->destroy_offset(list
, offsetof(proposal_t
, destroy
));
1026 get_lifetimes(this);
1027 apply_lifetimes(this, sa_payload
);
1029 if (!this->proposal
)
1031 DBG1(DBG_IKE
, "no matching proposal found, sending %N",
1032 notify_type_names
, NO_PROPOSAL_CHOSEN
);
1033 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1035 this->spi_i
= this->proposal
->get_spi(this->proposal
);
1037 if (!get_nonce(this, &this->nonce_i
, message
))
1039 return send_notify(this, INVALID_PAYLOAD_TYPE
);
1042 if (this->proposal
->get_algorithm(this->proposal
,
1043 DIFFIE_HELLMAN_GROUP
, &group
, NULL
))
1045 this->dh
= this->keymat
->keymat
.create_dh(&this->keymat
->keymat
,
1049 DBG1(DBG_IKE
, "negotiated DH group %N not supported",
1050 diffie_hellman_group_names
, group
);
1051 return send_notify(this, INVALID_KEY_INFORMATION
);
1053 if (!get_ke(this, message
))
1055 return send_notify(this, INVALID_PAYLOAD_TYPE
);
1059 check_for_rekeyed_child(this);
1061 this->child_sa
= child_sa_create(
1062 this->ike_sa
->get_my_host(this->ike_sa
),
1063 this->ike_sa
->get_other_host(this->ike_sa
),
1064 this->config
, this->reqid
, this->udp
);
1066 tsi
= linked_list_create_with_items(this->tsi
, NULL
);
1067 tsr
= linked_list_create_with_items(this->tsr
, NULL
);
1068 this->tsi
= this->tsr
= NULL
;
1069 charon
->bus
->narrow(charon
->bus
, this->child_sa
,
1070 NARROW_RESPONDER
, tsr
, tsi
);
1071 if (tsi
->remove_first(tsi
, (void**)&this->tsi
) != SUCCESS
||
1072 tsr
->remove_first(tsr
, (void**)&this->tsr
) != SUCCESS
)
1074 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
1075 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
1076 return send_notify(this, INVALID_ID_INFORMATION
);
1078 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
1079 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
1085 if (message
->get_exchange_type(message
) == INFORMATIONAL_V1
||
1086 has_notify_errors(this, message
))
1092 ike_sa_t
*ike_sa
= this->ike_sa
;
1095 task
= (task_t
*)quick_delete_create(this->ike_sa
,
1096 this->proposal
->get_protocol(this->proposal
),
1097 this->spi_i
, TRUE
, TRUE
);
1098 /* flush_queue() destroys the current task */
1099 ike_sa
->flush_queue(ike_sa
, TASK_QUEUE_PASSIVE
);
1100 ike_sa
->queue_task(ike_sa
, task
);
1101 return ALREADY_DONE
;
1110 METHOD(task_t
, build_r
, status_t
,
1111 private_quick_mode_t
*this, message_t
*message
)
1113 switch (this->state
)
1117 sa_payload_t
*sa_payload
;
1120 this->spi_r
= this->child_sa
->alloc_spi(this->child_sa
, PROTO_ESP
);
1123 DBG1(DBG_IKE
, "allocating SPI from kernel failed");
1124 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1126 this->proposal
->set_spi(this->proposal
, this->spi_r
);
1130 this->cpi_r
= this->child_sa
->alloc_cpi(this->child_sa
);
1133 DBG1(DBG_IKE
, "unable to allocate a CPI from "
1134 "kernel, IPComp disabled");
1135 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1139 if (this->udp
&& this->mode
== MODE_TRANSPORT
)
1141 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
1142 add_nat_oa_payloads(this, message
);
1145 encap
= get_encap(this->ike_sa
, this->udp
);
1146 sa_payload
= sa_payload_create_from_proposal_v1(this->proposal
,
1147 this->lifetime
, this->lifebytes
, AUTH_NONE
,
1148 this->mode
, encap
, this->cpi_r
);
1149 message
->add_payload(message
, &sa_payload
->payload_interface
);
1151 if (!add_nonce(this, &this->nonce_r
, message
))
1157 add_ke(this, message
);
1160 add_ts(this, message
);
1162 this->state
= QM_NEGOTIATED
;
1170 METHOD(task_t
, process_i
, status_t
,
1171 private_quick_mode_t
*this, message_t
*message
)
1173 switch (this->state
)
1177 sa_payload_t
*sa_payload
;
1178 linked_list_t
*list
= NULL
;
1181 sa_payload
= (sa_payload_t
*)message
->get_payload(message
,
1182 SECURITY_ASSOCIATION_V1
);
1185 DBG1(DBG_IKE
, "sa payload missing");
1186 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1190 list
= sa_payload
->get_ipcomp_proposals(sa_payload
,
1192 if (!list
->get_count(list
))
1194 DBG1(DBG_IKE
, "peer did not acccept our IPComp proposal, "
1199 if (!list
|| !list
->get_count(list
))
1202 list
= sa_payload
->get_proposals(sa_payload
);
1204 private = this->ike_sa
->supports_extension(this->ike_sa
,
1206 this->proposal
= this->config
->select_proposal(this->config
,
1207 list
, FALSE
, private);
1208 list
->destroy_offset(list
, offsetof(proposal_t
, destroy
));
1209 if (!this->proposal
)
1211 DBG1(DBG_IKE
, "no matching proposal found");
1212 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1214 this->spi_r
= this->proposal
->get_spi(this->proposal
);
1216 apply_lifetimes(this, sa_payload
);
1218 if (!get_nonce(this, &this->nonce_r
, message
))
1220 return send_notify(this, INVALID_PAYLOAD_TYPE
);
1222 if (this->dh
&& !get_ke(this, message
))
1224 return send_notify(this, INVALID_KEY_INFORMATION
);
1226 if (!get_ts(this, message
))
1228 return send_notify(this, INVALID_PAYLOAD_TYPE
);
1232 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1234 this->state
= QM_NEGOTIATED
;
1242 METHOD(task_t
, get_type
, task_type_t
,
1243 private_quick_mode_t
*this)
1245 return TASK_QUICK_MODE
;
1248 METHOD(quick_mode_t
, use_reqid
, void,
1249 private_quick_mode_t
*this, u_int32_t reqid
)
1251 this->reqid
= reqid
;
1254 METHOD(quick_mode_t
, rekey
, void,
1255 private_quick_mode_t
*this, u_int32_t spi
)
1260 METHOD(task_t
, migrate
, void,
1261 private_quick_mode_t
*this, ike_sa_t
*ike_sa
)
1263 chunk_free(&this->nonce_i
);
1264 chunk_free(&this->nonce_r
);
1265 DESTROY_IF(this->tsi
);
1266 DESTROY_IF(this->tsr
);
1267 DESTROY_IF(this->proposal
);
1268 DESTROY_IF(this->child_sa
);
1269 DESTROY_IF(this->dh
);
1271 this->ike_sa
= ike_sa
;
1272 this->keymat
= (keymat_v1_t
*)ike_sa
->get_keymat(ike_sa
);
1273 this->state
= QM_INIT
;
1276 this->proposal
= NULL
;
1277 this->child_sa
= NULL
;
1282 if (!this->initiator
)
1284 DESTROY_IF(this->config
);
1285 this->config
= NULL
;
1289 METHOD(task_t
, destroy
, void,
1290 private_quick_mode_t
*this)
1292 chunk_free(&this->nonce_i
);
1293 chunk_free(&this->nonce_r
);
1294 DESTROY_IF(this->tsi
);
1295 DESTROY_IF(this->tsr
);
1296 DESTROY_IF(this->proposal
);
1297 DESTROY_IF(this->child_sa
);
1298 DESTROY_IF(this->config
);
1299 DESTROY_IF(this->dh
);
1304 * Described in header.
1306 quick_mode_t
*quick_mode_create(ike_sa_t
*ike_sa
, child_cfg_t
*config
,
1307 traffic_selector_t
*tsi
, traffic_selector_t
*tsr
)
1309 private_quick_mode_t
*this;
1314 .get_type
= _get_type
,
1315 .migrate
= _migrate
,
1316 .destroy
= _destroy
,
1318 .use_reqid
= _use_reqid
,
1322 .initiator
= config
!= NULL
,
1324 .keymat
= (keymat_v1_t
*)ike_sa
->get_keymat(ike_sa
),
1326 .tsi
= tsi ? tsi
->clone(tsi
) : NULL
,
1327 .tsr
= tsr ? tsr
->clone(tsr
) : NULL
,
1332 this->public.task
.build
= _build_i
;
1333 this->public.task
.process
= _process_i
;
1337 this->public.task
.build
= _build_r
;
1338 this->public.task
.process
= _process_r
;
1341 return &this->public;