src/libcharon/sa/ikev1/tasks/quick_mode.c

   1 /*
   2  * Copyright (C) 2012 Tobias Brunner
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * Copyright (C) 2011 Martin Willi
   6  * Copyright (C) 2011 revosec AG
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 #include "quick_mode.h"
  20
  21 #include <string.h>
  22
  23 #include <daemon.h>
  24 #include <sa/ikev1/keymat_v1.h>
  25 #include <encoding/payloads/sa_payload.h>
  26 #include <encoding/payloads/nonce_payload.h>
  27 #include <encoding/payloads/ke_payload.h>
  28 #include <encoding/payloads/id_payload.h>
  29 #include <encoding/payloads/payload.h>
  30 #include <sa/ikev1/tasks/informational.h>
  31 #include <sa/ikev1/tasks/quick_delete.h>
  32 #include <processing/jobs/inactivity_job.h>
  33
  34 typedef struct private_quick_mode_t private_quick_mode_t;
  35
  36 /**
  37  * Private members of a quick_mode_t task.
  38  */
  39 struct private_quick_mode_t {
  40
  41         /**
  42          * Public methods and task_t interface.
  43          */
  44         quick_mode_t public;
  45
  46         /**
  47          * Assigned IKE_SA.
  48          */
  49         ike_sa_t *ike_sa;
  50
  51         /**
  52          * TRUE if we are initiating quick mode
  53          */
  54         bool initiator;
  55
  56         /**
  57          * Traffic selector of initiator
  58          */
  59         traffic_selector_t *tsi;
  60
  61         /**
  62          * Traffic selector of responder
  63          */
  64         traffic_selector_t *tsr;
  65
  66         /**
  67          * Initiators nonce
  68          */
  69         chunk_t nonce_i;
  70
  71         /**
  72          * Responder nonce
  73          */
  74         chunk_t nonce_r;
  75
  76         /**
  77          * Initiators ESP SPI
  78          */
  79         u_int32_t spi_i;
  80
  81         /**
  82          * Responder ESP SPI
  83          */
  84         u_int32_t spi_r;
  85
  86         /**
  87          * Initiators IPComp CPI
  88          */
  89         u_int16_t cpi_i;
  90
  91         /**
  92          * Responders IPComp CPI
  93          */
  94         u_int16_t cpi_r;
  95
  96         /**
  97          * selected CHILD_SA proposal
  98          */
  99         proposal_t *proposal;
 100
 101         /**
 102          * Config of CHILD_SA to establish
 103          */
 104         child_cfg_t *config;
 105
 106         /**
 107          * CHILD_SA we are about to establish
 108          */
 109         child_sa_t *child_sa;
 110
 111         /**
 112          * IKEv1 keymat
 113          */
 114         keymat_v1_t *keymat;
 115
 116         /**
 117          * DH exchange, when PFS is in use
 118          */
 119         diffie_hellman_t *dh;
 120
 121         /**
 122          * Negotiated lifetime of new SA
 123          */
 124         u_int32_t lifetime;
 125
 126         /**
 127          * Negotaited lifebytes of new SA
 128          */
 129         u_int64_t lifebytes;
 130
 131         /**
 132          * Reqid to use, 0 for auto-allocate
 133          */
 134         u_int32_t reqid;
 135
 136         /**
 137          * SPI of SA we rekey
 138          */
 139         u_int32_t rekey;
 140
 141         /**
 142          * Negotiated mode, tunnel or transport
 143          */
 144         ipsec_mode_t mode;
 145
 146         /**
 147          * Use UDP encapsulation
 148          */
 149         bool udp;
 150
 151         /** states of quick mode */
 152         enum {
 153                 QM_INIT,
 154                 QM_NEGOTIATED,
 155         } state;
 156 };
 157
 158 /**
 159  * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
 160  */
 161 static void schedule_inactivity_timeout(private_quick_mode_t *this)
 162 {
 163         u_int32_t timeout;
 164         bool close_ike;
 165
 166         timeout = this->config->get_inactivity(this->config);
 167         if (timeout)
 168         {
 169                 close_ike = lib->settings->get_bool(lib->settings,
 170                                                                 "%s.inactivity_close_ike", FALSE, charon->name);
 171                 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
 172                                 inactivity_job_create(this->child_sa->get_reqid(this->child_sa),
 173                                                                           timeout, close_ike), timeout);
 174         }
 175 }
 176
 177 /**
 178  * Install negotiated CHILD_SA
 179  */
 180 static bool install(private_quick_mode_t *this)
 181 {
 182         status_t status, status_i, status_o;
 183         chunk_t encr_i, encr_r, integ_i, integ_r;
 184         linked_list_t *tsi, *tsr;
 185         child_sa_t *old = NULL;
 186
 187         this->child_sa->set_proposal(this->child_sa, this->proposal);
 188         this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
 189         this->child_sa->set_mode(this->child_sa, this->mode);
 190
 191         if (this->cpi_i && this->cpi_r)
 192         {       /* DEFLATE is the only transform we currently support */
 193                 this->child_sa->set_ipcomp(this->child_sa, IPCOMP_DEFLATE);
 194         }
 195         else
 196         {
 197                 this->cpi_i = this->cpi_r = 0;
 198         }
 199
 200         this->child_sa->set_protocol(this->child_sa,
 201                                                                  this->proposal->get_protocol(this->proposal));
 202
 203         status_i = status_o = FAILED;
 204         encr_i = encr_r = integ_i = integ_r = chunk_empty;
 205         tsi = linked_list_create();
 206         tsr = linked_list_create();
 207         tsi->insert_last(tsi, this->tsi->clone(this->tsi));
 208         tsr->insert_last(tsr, this->tsr->clone(this->tsr));
 209         if (this->initiator)
 210         {
 211                 charon->bus->narrow(charon->bus, this->child_sa,
 212                                                         NARROW_INITIATOR_POST_AUTH, tsi, tsr);
 213         }
 214         else
 215         {
 216                 charon->bus->narrow(charon->bus, this->child_sa,
 217                                                         NARROW_RESPONDER, tsr, tsi);
 218         }
 219         if (tsi->get_count(tsi) == 0 || tsr->get_count(tsr) == 0)
 220         {
 221                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 222                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 223                 DBG1(DBG_IKE, "no acceptable traffic selectors found");
 224                 return FALSE;
 225         }
 226
 227         if (this->keymat->derive_child_keys(this->keymat, this->proposal, this->dh,
 228                                                 this->spi_i, this->spi_r, this->nonce_i, this->nonce_r,
 229                                                 &encr_i, &integ_i, &encr_r, &integ_r))
 230         {
 231                 if (this->initiator)
 232                 {
 233                         status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
 234                                                         this->spi_i, this->cpi_i, TRUE, FALSE, tsi, tsr);
 235                         status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
 236                                                         this->spi_r, this->cpi_r, FALSE, FALSE, tsi, tsr);
 237                 }
 238                 else
 239                 {
 240                         status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
 241                                                         this->spi_r, this->cpi_r, TRUE, FALSE, tsr, tsi);
 242                         status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
 243                                                         this->spi_i, this->cpi_i, FALSE, FALSE, tsr, tsi);
 244                 }
 245         }
 246         chunk_clear(&integ_i);
 247         chunk_clear(&integ_r);
 248         chunk_clear(&encr_i);
 249         chunk_clear(&encr_r);
 250
 251         if (status_i != SUCCESS || status_o != SUCCESS)
 252         {
 253                 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
 254                         (status_i != SUCCESS) ? "inbound " : "",
 255                         (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
 256                         (status_o != SUCCESS) ? "outbound " : "");
 257                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 258                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 259                 return FALSE;
 260         }
 261
 262         if (this->initiator)
 263         {
 264                 status = this->child_sa->add_policies(this->child_sa, tsi, tsr);
 265         }
 266         else
 267         {
 268                 status = this->child_sa->add_policies(this->child_sa, tsr, tsi);
 269         }
 270         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 271         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 272         if (status != SUCCESS)
 273         {
 274                 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
 275                 return FALSE;
 276         }
 277
 278         charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
 279                                                         this->dh, this->nonce_i, this->nonce_r);
 280
 281         /* add to IKE_SA, and remove from task */
 282         this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 283         this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
 284
 285         DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
 286                  "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
 287                  this->child_sa->get_name(this->child_sa),
 288                  this->child_sa->get_reqid(this->child_sa),
 289                  ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
 290                  ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
 291                  this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
 292                  this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
 293
 294         if (this->rekey)
 295         {
 296                 old = this->ike_sa->get_child_sa(this->ike_sa,
 297                                                                 this->proposal->get_protocol(this->proposal),
 298                                                                 this->rekey, TRUE);
 299         }
 300         if (old)
 301         {
 302                 charon->bus->child_rekey(charon->bus, old, this->child_sa);
 303         }
 304         else
 305         {
 306                 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
 307         }
 308         if (!this->rekey)
 309         {
 310                 schedule_inactivity_timeout(this);
 311         }
 312         this->child_sa = NULL;
 313         return TRUE;
 314 }
 315
 316 /**
 317  * Generate and add NONCE
 318  */
 319 static bool add_nonce(private_quick_mode_t *this, chunk_t *nonce,
 320                                           message_t *message)
 321 {
 322         nonce_payload_t *nonce_payload;
 323         nonce_gen_t *nonceg;
 324
 325         nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
 326         if (!nonceg)
 327         {
 328                 DBG1(DBG_IKE, "no nonce generator found to create nonce");
 329                 return FALSE;
 330         }
 331         if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, nonce))
 332         {
 333                 DBG1(DBG_IKE, "nonce allocation failed");
 334                 nonceg->destroy(nonceg);
 335                 return FALSE;
 336         }
 337         nonceg->destroy(nonceg);
 338
 339         nonce_payload = nonce_payload_create(NONCE_V1);
 340         nonce_payload->set_nonce(nonce_payload, *nonce);
 341         message->add_payload(message, &nonce_payload->payload_interface);
 342
 343         return TRUE;
 344 }
 345
 346 /**
 347  * Extract nonce from NONCE payload
 348  */
 349 static bool get_nonce(private_quick_mode_t *this, chunk_t *nonce,
 350                                           message_t *message)
 351 {
 352         nonce_payload_t *nonce_payload;
 353
 354         nonce_payload = (nonce_payload_t*)message->get_payload(message, NONCE_V1);
 355         if (!nonce_payload)
 356         {
 357                 DBG1(DBG_IKE, "NONCE payload missing in message");
 358                 return FALSE;
 359         }
 360         *nonce = nonce_payload->get_nonce(nonce_payload);
 361
 362         return TRUE;
 363 }
 364
 365 /**
 366  * Add KE payload to message
 367  */
 368 static void add_ke(private_quick_mode_t *this, message_t *message)
 369 {
 370         ke_payload_t *ke_payload;
 371
 372         ke_payload = ke_payload_create_from_diffie_hellman(KEY_EXCHANGE_V1, this->dh);
 373         message->add_payload(message, &ke_payload->payload_interface);
 374 }
 375
 376 /**
 377  * Get DH value from a KE payload
 378  */
 379 static bool get_ke(private_quick_mode_t *this, message_t *message)
 380 {
 381         ke_payload_t *ke_payload;
 382
 383         ke_payload = (ke_payload_t*)message->get_payload(message, KEY_EXCHANGE_V1);
 384         if (!ke_payload)
 385         {
 386                 DBG1(DBG_IKE, "KE payload missing");
 387                 return FALSE;
 388         }
 389         this->dh->set_other_public_value(this->dh,
 390                                                                 ke_payload->get_key_exchange_data(ke_payload));
 391         return TRUE;
 392 }
 393
 394 /**
 395  * Select a traffic selector from configuration
 396  */
 397 static traffic_selector_t* select_ts(private_quick_mode_t *this, bool local,
 398                                                                          linked_list_t *supplied)
 399 {
 400         traffic_selector_t *ts;
 401         enumerator_t *enumerator;
 402         linked_list_t *list;
 403         host_t *host;
 404
 405         enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, local);
 406         if (!enumerator->enumerate(enumerator, &host))
 407         {
 408                 if (local)
 409                 {
 410                         host = this->ike_sa->get_my_host(this->ike_sa);
 411                 }
 412                 else
 413                 {
 414                         host = this->ike_sa->get_other_host(this->ike_sa);
 415                 }
 416         }
 417         enumerator->destroy(enumerator);
 418         list = this->config->get_traffic_selectors(this->config, local,
 419                                                                                            supplied, host);
 420         if (list->get_first(list, (void**)&ts) == SUCCESS)
 421         {
 422                 if (list->get_count(list) > 1)
 423                 {
 424                         DBG1(DBG_IKE, "configuration has more than one %s traffic selector,"
 425                                  " using first only", local ? "local" : "remote");
 426                 }
 427                 ts = ts->clone(ts);
 428         }
 429         else
 430         {
 431                 DBG1(DBG_IKE, "%s traffic selector missing in configuration",
 432                          local ? "local" : "local");
 433                 ts = NULL;
 434         }
 435         list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
 436         return ts;
 437 }
 438
 439 /**
 440  * Add selected traffic selectors to message
 441  */
 442 static void add_ts(private_quick_mode_t *this, message_t *message)
 443 {
 444         id_payload_t *id_payload;
 445         host_t *hsi, *hsr;
 446
 447         if (this->initiator)
 448         {
 449                 hsi = this->ike_sa->get_my_host(this->ike_sa);
 450                 hsr = this->ike_sa->get_other_host(this->ike_sa);
 451         }
 452         else
 453         {
 454                 hsr = this->ike_sa->get_my_host(this->ike_sa);
 455                 hsi = this->ike_sa->get_other_host(this->ike_sa);
 456         }
 457         /* add ID payload only if negotiating non host2host tunnels */
 458         if (!this->tsi->is_host(this->tsi, hsi) ||
 459                 !this->tsr->is_host(this->tsr, hsr) ||
 460                 this->tsi->get_protocol(this->tsi) ||
 461                 this->tsr->get_protocol(this->tsr) ||
 462                 this->tsi->get_from_port(this->tsi) ||
 463                 this->tsr->get_from_port(this->tsr) ||
 464                 this->tsi->get_to_port(this->tsi) != 65535 ||
 465                 this->tsr->get_to_port(this->tsr) != 65535)
 466         {
 467                 id_payload = id_payload_create_from_ts(this->tsi);
 468                 message->add_payload(message, &id_payload->payload_interface);
 469                 id_payload = id_payload_create_from_ts(this->tsr);
 470                 message->add_payload(message, &id_payload->payload_interface);
 471         }
 472 }
 473
 474 /**
 475  * Get traffic selectors from received message
 476  */
 477 static bool get_ts(private_quick_mode_t *this, message_t *message)
 478 {
 479         traffic_selector_t *tsi = NULL, *tsr = NULL;
 480         enumerator_t *enumerator;
 481         id_payload_t *id_payload;
 482         payload_t *payload;
 483         host_t *hsi, *hsr;
 484         bool first = TRUE;
 485
 486         enumerator = message->create_payload_enumerator(message);
 487         while (enumerator->enumerate(enumerator, &payload))
 488         {
 489                 if (payload->get_type(payload) == ID_V1)
 490                 {
 491                         id_payload = (id_payload_t*)payload;
 492
 493                         if (first)
 494                         {
 495                                 tsi = id_payload->get_ts(id_payload);
 496                                 first = FALSE;
 497                         }
 498                         else
 499                         {
 500                                 tsr = id_payload->get_ts(id_payload);
 501                                 break;
 502                         }
 503                 }
 504         }
 505         enumerator->destroy(enumerator);
 506
 507         /* create host2host selectors if ID payloads missing */
 508         if (this->initiator)
 509         {
 510                 hsi = this->ike_sa->get_my_host(this->ike_sa);
 511                 hsr = this->ike_sa->get_other_host(this->ike_sa);
 512         }
 513         else
 514         {
 515                 hsr = this->ike_sa->get_my_host(this->ike_sa);
 516                 hsi = this->ike_sa->get_other_host(this->ike_sa);
 517         }
 518         if (!tsi)
 519         {
 520                 tsi = traffic_selector_create_from_subnet(hsi->clone(hsi),
 521                                                         hsi->get_family(hsi) == AF_INET ? 32 : 128, 0, 0);
 522         }
 523         if (!tsr)
 524         {
 525                 tsr = traffic_selector_create_from_subnet(hsr->clone(hsr),
 526                                                         hsr->get_family(hsr) == AF_INET ? 32 : 128, 0, 0);
 527         }
 528         if (this->initiator)
 529         {
 530                 /* check if peer selection valid */
 531                 if (!tsr->is_contained_in(tsr, this->tsr) ||
 532                         !tsi->is_contained_in(tsi, this->tsi))
 533                 {
 534                         DBG1(DBG_IKE, "peer selected invalid traffic selectors: ",
 535                                  "%R for %R, %R for %R", tsi, this->tsi, tsr, this->tsr);
 536                         tsi->destroy(tsi);
 537                         tsr->destroy(tsr);
 538                         return FALSE;
 539                 }
 540                 this->tsi->destroy(this->tsi);
 541                 this->tsr->destroy(this->tsr);
 542                 this->tsi = tsi;
 543                 this->tsr = tsr;
 544         }
 545         else
 546         {
 547                 this->tsi = tsi;
 548                 this->tsr = tsr;
 549         }
 550         return TRUE;
 551 }
 552
 553 /**
 554  * Add NAT-OA payloads
 555  */
 556 static void add_nat_oa_payloads(private_quick_mode_t *this, message_t *message)
 557 {
 558         identification_t *id;
 559         id_payload_t *nat_oa;
 560         host_t *src, *dst;
 561
 562         src = message->get_source(message);
 563         dst = message->get_destination(message);
 564
 565         src = this->initiator ? src : dst;
 566         dst = this->initiator ? dst : src;
 567
 568         /* first NAT-OA is the initiator's address */
 569         id = identification_create_from_sockaddr(src->get_sockaddr(src));
 570         nat_oa = id_payload_create_from_identification(NAT_OA_V1, id);
 571         message->add_payload(message, (payload_t*)nat_oa);
 572         id->destroy(id);
 573
 574         /* second NAT-OA is that of the responder */
 575         id = identification_create_from_sockaddr(dst->get_sockaddr(dst));
 576         nat_oa = id_payload_create_from_identification(NAT_OA_V1, id);
 577         message->add_payload(message, (payload_t*)nat_oa);
 578         id->destroy(id);
 579 }
 580
 581 /**
 582  * Look up lifetimes
 583  */
 584 static void get_lifetimes(private_quick_mode_t *this)
 585 {
 586         lifetime_cfg_t *lft;
 587
 588         lft = this->config->get_lifetime(this->config);
 589         if (lft->time.life)
 590         {
 591                 this->lifetime = lft->time.life;
 592         }
 593         else if (lft->bytes.life)
 594         {
 595                 this->lifebytes = lft->bytes.life;
 596         }
 597         free(lft);
 598 }
 599
 600 /**
 601  * Check and apply lifetimes
 602  */
 603 static void apply_lifetimes(private_quick_mode_t *this, sa_payload_t *sa_payload)
 604 {
 605         u_int32_t lifetime;
 606         u_int64_t lifebytes;
 607
 608         lifetime = sa_payload->get_lifetime(sa_payload);
 609         lifebytes = sa_payload->get_lifebytes(sa_payload);
 610         if (this->lifetime != lifetime)
 611         {
 612                 DBG1(DBG_IKE, "received %us lifetime, configured %us",
 613                          lifetime, this->lifetime);
 614                 this->lifetime = lifetime;
 615         }
 616         if (this->lifebytes != lifebytes)
 617         {
 618                 DBG1(DBG_IKE, "received %llu lifebytes, configured %llu",
 619                          lifebytes, this->lifebytes);
 620                 this->lifebytes = lifebytes;
 621         }
 622 }
 623
 624 /**
 625  * Set the task ready to build notify error message
 626  */
 627 static status_t send_notify(private_quick_mode_t *this, notify_type_t type)
 628 {
 629         notify_payload_t *notify;
 630
 631         notify = notify_payload_create_from_protocol_and_type(NOTIFY_V1,
 632                                                                                                                   PROTO_ESP, type);
 633         notify->set_spi(notify, this->spi_i);
 634
 635         this->ike_sa->queue_task(this->ike_sa,
 636                                                 (task_t*)informational_create(this->ike_sa, notify));
 637         /* cancel all active/passive tasks in favour of informational */
 638         this->ike_sa->flush_queue(this->ike_sa,
 639                                         this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
 640         return ALREADY_DONE;
 641 }
 642
 643 METHOD(task_t, build_i, status_t,
 644         private_quick_mode_t *this, message_t *message)
 645 {
 646         switch (this->state)
 647         {
 648                 case QM_INIT:
 649                 {
 650                         enumerator_t *enumerator;
 651                         sa_payload_t *sa_payload;
 652                         linked_list_t *list, *tsi, *tsr;
 653                         proposal_t *proposal;
 654                         diffie_hellman_group_t group;
 655
 656                         this->udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
 657                         this->mode = this->config->get_mode(this->config);
 658                         this->child_sa = child_sa_create(
 659                                                                         this->ike_sa->get_my_host(this->ike_sa),
 660                                                                         this->ike_sa->get_other_host(this->ike_sa),
 661                                                                         this->config, this->reqid, this->udp);
 662
 663                         if (this->udp && this->mode == MODE_TRANSPORT)
 664                         {
 665                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
 666                                 add_nat_oa_payloads(this, message);
 667                         }
 668
 669                         if (this->config->use_ipcomp(this->config))
 670                         {
 671                                 if (this->udp)
 672                                 {
 673                                         DBG1(DBG_IKE, "IPComp is not supported if either peer is "
 674                                                  "natted, IPComp disabled");
 675                                 }
 676                                 else
 677                                 {
 678                                         this->cpi_i = this->child_sa->alloc_cpi(this->child_sa);
 679                                         if (!this->cpi_i)
 680                                         {
 681                                                 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, "
 682                                                          "IPComp disabled");
 683                                         }
 684                                 }
 685                         }
 686
 687                         this->spi_i = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
 688                         if (!this->spi_i)
 689                         {
 690                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
 691                                 return FAILED;
 692                         }
 693
 694                         list = this->config->get_proposals(this->config, FALSE);
 695                         enumerator = list->create_enumerator(list);
 696                         while (enumerator->enumerate(enumerator, &proposal))
 697                         {
 698                                 proposal->set_spi(proposal, this->spi_i);
 699                         }
 700                         enumerator->destroy(enumerator);
 701
 702                         get_lifetimes(this);
 703                         sa_payload = sa_payload_create_from_proposals_v1(list,
 704                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
 705                                                                 this->mode, this->udp, this->cpi_i);
 706                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 707                         message->add_payload(message, &sa_payload->payload_interface);
 708
 709                         if (!add_nonce(this, &this->nonce_i, message))
 710                         {
 711                                 return FAILED;
 712                         }
 713
 714                         group = this->config->get_dh_group(this->config);
 715                         if (group != MODP_NONE)
 716                         {
 717                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
 718                                                                                                                   group);
 719                                 if (!this->dh)
 720                                 {
 721                                         DBG1(DBG_IKE, "configured DH group %N not supported",
 722                                                  diffie_hellman_group_names, group);
 723                                         return FAILED;
 724                                 }
 725                                 add_ke(this, message);
 726                         }
 727                         if (!this->tsi)
 728                         {
 729                                 this->tsi = select_ts(this, TRUE, NULL);
 730                         }
 731                         if (!this->tsr)
 732                         {
 733                                 this->tsr = select_ts(this, FALSE, NULL);
 734                         }
 735                         tsi = linked_list_create();
 736                         tsr = linked_list_create();
 737                         tsi->insert_last(tsi, this->tsi);
 738                         tsr->insert_last(tsr, this->tsr);
 739                         this->tsi = this->tsr = NULL;
 740                         charon->bus->narrow(charon->bus, this->child_sa,
 741                                                                 NARROW_INITIATOR_PRE_AUTH, tsi, tsr);
 742                         tsi->remove_first(tsi, (void**)&this->tsi);
 743                         tsr->remove_first(tsr, (void**)&this->tsr);
 744                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 745                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 746                         if (!this->tsi || !this->tsr)
 747                         {
 748                                 return FAILED;
 749                         }
 750                         add_ts(this, message);
 751                         return NEED_MORE;
 752                 }
 753                 case QM_NEGOTIATED:
 754                 {
 755                         return SUCCESS;
 756                 }
 757                 default:
 758                         return FAILED;
 759         }
 760 }
 761
 762 /**
 763  * Check for notify errors, return TRUE if error found
 764  */
 765 static bool has_notify_errors(private_quick_mode_t *this, message_t *message)
 766 {
 767         enumerator_t *enumerator;
 768         payload_t *payload;
 769         bool err = FALSE;
 770
 771         enumerator = message->create_payload_enumerator(message);
 772         while (enumerator->enumerate(enumerator, &payload))
 773         {
 774                 if (payload->get_type(payload) == NOTIFY_V1)
 775                 {
 776                         notify_payload_t *notify;
 777                         notify_type_t type;
 778
 779                         notify = (notify_payload_t*)payload;
 780                         type = notify->get_notify_type(notify);
 781                         if (type < 16384)
 782                         {
 783
 784                                 DBG1(DBG_IKE, "received %N error notify",
 785                                          notify_type_names, type);
 786                                 err = TRUE;
 787                         }
 788                         else
 789                         {
 790                                 DBG1(DBG_IKE, "received %N notify", notify_type_names, type);
 791                         }
 792                 }
 793         }
 794         enumerator->destroy(enumerator);
 795
 796         return err;
 797 }
 798
 799 /**
 800  * Check if this is a rekey for an existing CHILD_SA, reuse reqid if so
 801  */
 802 static void check_for_rekeyed_child(private_quick_mode_t *this)
 803 {
 804         enumerator_t *enumerator, *policies;
 805         traffic_selector_t *local, *remote;
 806         child_sa_t *child_sa;
 807
 808         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
 809         while (this->reqid == 0 && enumerator->enumerate(enumerator, &child_sa))
 810         {
 811                 if (child_sa->get_state(child_sa) == CHILD_INSTALLED &&
 812                         streq(child_sa->get_name(child_sa),
 813                                   this->config->get_name(this->config)))
 814                 {
 815                         policies = child_sa->create_policy_enumerator(child_sa);
 816                         if (policies->enumerate(policies, &local, &remote))
 817                         {
 818                                 if (local->equals(local, this->tsr) &&
 819                                         remote->equals(remote, this->tsi) &&
 820                                         this->proposal->equals(this->proposal,
 821                                                                                    child_sa->get_proposal(child_sa)))
 822                                 {
 823                                         this->reqid = child_sa->get_reqid(child_sa);
 824                                         this->rekey = child_sa->get_spi(child_sa, TRUE);
 825                                         child_sa->set_state(child_sa, CHILD_REKEYING);
 826                                         DBG1(DBG_IKE, "detected rekeying of CHILD_SA %s{%u}",
 827                                                  child_sa->get_name(child_sa), this->reqid);
 828                                 }
 829                         }
 830                         policies->destroy(policies);
 831                 }
 832         }
 833         enumerator->destroy(enumerator);
 834 }
 835
 836 /**
 837  * Get host to use for dynamic traffic selectors
 838  */
 839 static host_t *get_dynamic_host(ike_sa_t *ike_sa, bool local)
 840 {
 841         enumerator_t *enumerator;
 842         host_t *host;
 843
 844         enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
 845         if (!enumerator->enumerate(enumerator, &host))
 846         {
 847                 if (local)
 848                 {
 849                         host = ike_sa->get_my_host(ike_sa);
 850                 }
 851                 else
 852                 {
 853                         host = ike_sa->get_other_host(ike_sa);
 854                 }
 855         }
 856         enumerator->destroy(enumerator);
 857         return host;
 858 }
 859
 860 METHOD(task_t, process_r, status_t,
 861         private_quick_mode_t *this, message_t *message)
 862 {
 863         switch (this->state)
 864         {
 865                 case QM_INIT:
 866                 {
 867                         sa_payload_t *sa_payload;
 868                         linked_list_t *tsi, *tsr, *list = NULL;
 869                         peer_cfg_t *peer_cfg;
 870                         u_int16_t group;
 871                         bool private;
 872
 873                         if (!get_ts(this, message))
 874                         {
 875                                 return FAILED;
 876                         }
 877                         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 878                         tsi = linked_list_create();
 879                         tsr = linked_list_create();
 880                         tsi->insert_last(tsi, this->tsi);
 881                         tsr->insert_last(tsr, this->tsr);
 882                         this->tsi = this->tsr = NULL;
 883                         this->config = peer_cfg->select_child_cfg(peer_cfg, tsr, tsi,
 884                                                                                 get_dynamic_host(this->ike_sa, TRUE),
 885                                                                                 get_dynamic_host(this->ike_sa, FALSE));
 886                         if (this->config)
 887                         {
 888                                 this->tsi = select_ts(this, FALSE, tsi);
 889                                 this->tsr = select_ts(this, TRUE, tsr);
 890                         }
 891                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 892                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 893                         if (!this->config || !this->tsi || !this->tsr)
 894                         {
 895                                 DBG1(DBG_IKE, "no matching CHILD_SA config found");
 896                                 return send_notify(this, INVALID_ID_INFORMATION);
 897                         }
 898
 899                         sa_payload = (sa_payload_t*)message->get_payload(message,
 900                                                                                                         SECURITY_ASSOCIATION_V1);
 901                         if (!sa_payload)
 902                         {
 903                                 DBG1(DBG_IKE, "sa payload missing");
 904                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 905                         }
 906                         if (this->config->use_ipcomp(this->config))
 907                         {
 908                                 if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
 909                                 {
 910                                         DBG1(DBG_IKE, "IPComp is not supported if either peer is "
 911                                                  "natted, IPComp disabled");
 912                                 }
 913                                 else
 914                                 {
 915                                         list = sa_payload->get_ipcomp_proposals(sa_payload,
 916                                                                                                                         &this->cpi_i);
 917                                         if (!list->get_count(list))
 918                                         {
 919                                                 DBG1(DBG_IKE, "expected IPComp proposal but peer did "
 920                                                          "not send one, IPComp disabled");
 921                                                 this->cpi_i = 0;
 922                                         }
 923                                 }
 924                         }
 925                         if (!list || !list->get_count(list))
 926                         {
 927                                 DESTROY_IF(list);
 928                                 list = sa_payload->get_proposals(sa_payload);
 929                         }
 930                         private = this->ike_sa->supports_extension(this->ike_sa,
 931                                                                                                            EXT_STRONGSWAN);
 932                         this->proposal = this->config->select_proposal(this->config,
 933                                                                                                                    list, FALSE, private);
 934                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 935
 936                         this->mode = sa_payload->get_encap_mode(sa_payload, &this->udp);
 937
 938                         get_lifetimes(this);
 939                         apply_lifetimes(this, sa_payload);
 940
 941                         if (!this->proposal)
 942                         {
 943                                 DBG1(DBG_IKE, "no matching proposal found, sending %N",
 944                                          notify_type_names, NO_PROPOSAL_CHOSEN);
 945                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
 946                         }
 947                         this->spi_i = this->proposal->get_spi(this->proposal);
 948
 949                         if (!get_nonce(this, &this->nonce_i, message))
 950                         {
 951                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 952                         }
 953
 954                         if (this->proposal->get_algorithm(this->proposal,
 955                                                                                 DIFFIE_HELLMAN_GROUP, &group, NULL))
 956                         {
 957                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
 958                                                                                                                   group);
 959                                 if (!this->dh)
 960                                 {
 961                                         DBG1(DBG_IKE, "negotiated DH group %N not supported",
 962                                                  diffie_hellman_group_names, group);
 963                                         return send_notify(this, INVALID_KEY_INFORMATION);
 964                                 }
 965                                 if (!get_ke(this, message))
 966                                 {
 967                                         return send_notify(this, INVALID_PAYLOAD_TYPE);
 968                                 }
 969                         }
 970
 971                         check_for_rekeyed_child(this);
 972
 973                         this->child_sa = child_sa_create(
 974                                                                         this->ike_sa->get_my_host(this->ike_sa),
 975                                                                         this->ike_sa->get_other_host(this->ike_sa),
 976                                                                         this->config, this->reqid, this->udp);
 977                         return NEED_MORE;
 978                 }
 979                 case QM_NEGOTIATED:
 980                 {
 981                         if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
 982                                 has_notify_errors(this, message))
 983                         {
 984                                 return SUCCESS;
 985                         }
 986                         if (!install(this))
 987                         {
 988                                 ike_sa_t *ike_sa = this->ike_sa;
 989                                 task_t *task;
 990
 991                                 task = (task_t*)quick_delete_create(this->ike_sa,
 992                                                                 this->proposal->get_protocol(this->proposal),
 993                                                                 this->spi_i, TRUE, TRUE);
 994                                 /* flush_queue() destroys the current task */
 995                                 ike_sa->flush_queue(ike_sa, TASK_QUEUE_PASSIVE);
 996                                 ike_sa->queue_task(ike_sa, task);
 997                                 return ALREADY_DONE;
 998                         }
 999                         return SUCCESS;
1000                 }
1001                 default:
1002                         return FAILED;
1003         }
1004 }
1005
1006 METHOD(task_t, build_r, status_t,
1007         private_quick_mode_t *this, message_t *message)
1008 {
1009         switch (this->state)
1010         {
1011                 case QM_INIT:
1012                 {
1013                         sa_payload_t *sa_payload;
1014
1015                         this->spi_r = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
1016                         if (!this->spi_r)
1017                         {
1018                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
1019                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1020                         }
1021                         this->proposal->set_spi(this->proposal, this->spi_r);
1022
1023                         if (this->cpi_i)
1024                         {
1025                                 this->cpi_r = this->child_sa->alloc_cpi(this->child_sa);
1026                                 if (!this->cpi_r)
1027                                 {
1028                                         DBG1(DBG_IKE, "unable to allocate a CPI from "
1029                                                  "kernel, IPComp disabled");
1030                                         return send_notify(this, NO_PROPOSAL_CHOSEN);
1031                                 }
1032                         }
1033
1034                         if (this->udp && this->mode == MODE_TRANSPORT)
1035                         {
1036                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
1037                                 add_nat_oa_payloads(this, message);
1038                         }
1039
1040                         sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
1041                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
1042                                                                 this->mode, this->udp, this->cpi_r);
1043                         message->add_payload(message, &sa_payload->payload_interface);
1044
1045                         if (!add_nonce(this, &this->nonce_r, message))
1046                         {
1047                                 return FAILED;
1048                         }
1049                         if (this->dh)
1050                         {
1051                                 add_ke(this, message);
1052                         }
1053
1054                         add_ts(this, message);
1055
1056                         this->state = QM_NEGOTIATED;
1057                         return NEED_MORE;
1058                 }
1059                 default:
1060                         return FAILED;
1061         }
1062 }
1063
1064 METHOD(task_t, process_i, status_t,
1065         private_quick_mode_t *this, message_t *message)
1066 {
1067         switch (this->state)
1068         {
1069                 case QM_INIT:
1070                 {
1071                         sa_payload_t *sa_payload;
1072                         linked_list_t *list = NULL;
1073                         bool private;
1074
1075                         sa_payload = (sa_payload_t*)message->get_payload(message,
1076                                                                                                         SECURITY_ASSOCIATION_V1);
1077                         if (!sa_payload)
1078                         {
1079                                 DBG1(DBG_IKE, "sa payload missing");
1080                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1081                         }
1082                         if (this->cpi_i)
1083                         {
1084                                 list = sa_payload->get_ipcomp_proposals(sa_payload,
1085                                                                                                                 &this->cpi_r);
1086                                 if (!list->get_count(list))
1087                                 {
1088                                         DBG1(DBG_IKE, "peer did not acccept our IPComp proposal, "
1089                                                  "IPComp disabled");
1090                                         this->cpi_i = 0;
1091                                 }
1092                         }
1093                         if (!list || !list->get_count(list))
1094                         {
1095                                 DESTROY_IF(list);
1096                                 list = sa_payload->get_proposals(sa_payload);
1097                         }
1098                         private = this->ike_sa->supports_extension(this->ike_sa,
1099                                                                                                            EXT_STRONGSWAN);
1100                         this->proposal = this->config->select_proposal(this->config,
1101                                                                                                                    list, FALSE, private);
1102                         list->destroy_offset(list, offsetof(proposal_t, destroy));
1103                         if (!this->proposal)
1104                         {
1105                                 DBG1(DBG_IKE, "no matching proposal found");
1106                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1107                         }
1108                         this->spi_r = this->proposal->get_spi(this->proposal);
1109
1110                         apply_lifetimes(this, sa_payload);
1111
1112                         if (!get_nonce(this, &this->nonce_r, message))
1113                         {
1114                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1115                         }
1116                         if (this->dh && !get_ke(this, message))
1117                         {
1118                                 return send_notify(this, INVALID_KEY_INFORMATION);
1119                         }
1120                         if (!get_ts(this, message))
1121                         {
1122                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1123                         }
1124                         if (!install(this))
1125                         {
1126                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1127                         }
1128                         this->state = QM_NEGOTIATED;
1129                         return NEED_MORE;
1130                 }
1131                 default:
1132                         return FAILED;
1133         }
1134 }
1135
1136 METHOD(task_t, get_type, task_type_t,
1137         private_quick_mode_t *this)
1138 {
1139         return TASK_QUICK_MODE;
1140 }
1141
1142 METHOD(quick_mode_t, use_reqid, void,
1143         private_quick_mode_t *this, u_int32_t reqid)
1144 {
1145         this->reqid = reqid;
1146 }
1147
1148 METHOD(quick_mode_t, rekey, void,
1149         private_quick_mode_t *this, u_int32_t spi)
1150 {
1151         this->rekey = spi;
1152 }
1153
1154 METHOD(task_t, migrate, void,
1155         private_quick_mode_t *this, ike_sa_t *ike_sa)
1156 {
1157         chunk_free(&this->nonce_i);
1158         chunk_free(&this->nonce_r);
1159         DESTROY_IF(this->tsi);
1160         DESTROY_IF(this->tsr);
1161         DESTROY_IF(this->proposal);
1162         DESTROY_IF(this->child_sa);
1163         DESTROY_IF(this->dh);
1164
1165         this->ike_sa = ike_sa;
1166         this->keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa);
1167         this->state = QM_INIT;
1168         this->tsi = NULL;
1169         this->tsr = NULL;
1170         this->proposal = NULL;
1171         this->child_sa = NULL;
1172         this->dh = NULL;
1173         this->spi_i = 0;
1174         this->spi_r = 0;
1175
1176         if (!this->initiator)
1177         {
1178                 DESTROY_IF(this->config);
1179                 this->config = NULL;
1180         }
1181 }
1182
1183 METHOD(task_t, destroy, void,
1184         private_quick_mode_t *this)
1185 {
1186         chunk_free(&this->nonce_i);
1187         chunk_free(&this->nonce_r);
1188         DESTROY_IF(this->tsi);
1189         DESTROY_IF(this->tsr);
1190         DESTROY_IF(this->proposal);
1191         DESTROY_IF(this->child_sa);
1192         DESTROY_IF(this->config);
1193         DESTROY_IF(this->dh);
1194         free(this);
1195 }
1196
1197 /*
1198  * Described in header.
1199  */
1200 quick_mode_t *quick_mode_create(ike_sa_t *ike_sa, child_cfg_t *config,
1201                                                         traffic_selector_t *tsi, traffic_selector_t *tsr)
1202 {
1203         private_quick_mode_t *this;
1204
1205         INIT(this,
1206                 .public = {
1207                         .task = {
1208                                 .get_type = _get_type,
1209                                 .migrate = _migrate,
1210                                 .destroy = _destroy,
1211                         },
1212                         .use_reqid = _use_reqid,
1213                         .rekey = _rekey,
1214                 },
1215                 .ike_sa = ike_sa,
1216                 .initiator = config != NULL,
1217                 .config = config,
1218                 .keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa),
1219                 .state = QM_INIT,
1220                 .tsi = tsi ? tsi->clone(tsi) : NULL,
1221                 .tsr = tsr ? tsr->clone(tsr) : NULL,
1222         );
1223
1224         if (config)
1225         {
1226                 this->public.task.build = _build_i;
1227                 this->public.task.process = _process_i;
1228         }
1229         else
1230         {
1231                 this->public.task.build = _build_r;
1232                 this->public.task.process = _process_r;
1233         }
1234
1235         return &this->public;
1236 }