2 * Copyright (C) 2011 Martin Willi
3 * Copyright (C) 2011 revosec AG
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 #include "quick_mode.h"
21 #include <sa/ikev1/keymat_v1.h>
22 #include <encoding/payloads/sa_payload.h>
23 #include <encoding/payloads/nonce_payload.h>
24 #include <encoding/payloads/ke_payload.h>
25 #include <encoding/payloads/id_payload.h>
26 #include <encoding/payloads/payload.h>
27 #include <sa/ikev1/tasks/informational.h>
28 #include <sa/ikev1/tasks/quick_delete.h>
30 typedef struct private_quick_mode_t private_quick_mode_t
;
33 * Private members of a quick_mode_t task.
35 struct private_quick_mode_t
{
38 * Public methods and task_t interface.
48 * TRUE if we are initiating quick mode
53 * Traffic selector of initiator
55 traffic_selector_t
*tsi
;
58 * Traffic selector of responder
60 traffic_selector_t
*tsr
;
83 * selected CHILD_SA proposal
88 * Config of CHILD_SA to establish
93 * CHILD_SA we are about to establish
103 * DH exchange, when PFS is in use
105 diffie_hellman_t
*dh
;
108 * Negotiated lifetime of new SA
113 * Negotaited lifebytes of new SA
117 /** states of quick mode */
125 * Install negotiated CHILD_SA
127 static bool install(private_quick_mode_t
*this)
129 status_t status
, status_i
, status_o
;
130 chunk_t encr_i
, encr_r
, integ_i
, integ_r
;
131 linked_list_t
*tsi
, *tsr
;
133 this->child_sa
->set_proposal(this->child_sa
, this->proposal
);
134 this->child_sa
->set_state(this->child_sa
, CHILD_INSTALLING
);
135 this->child_sa
->set_mode(this->child_sa
, MODE_TUNNEL
);
136 this->child_sa
->set_protocol(this->child_sa
,
137 this->proposal
->get_protocol(this->proposal
));
139 status_i
= status_o
= FAILED
;
140 encr_i
= encr_r
= integ_i
= integ_r
= chunk_empty
;
141 tsi
= linked_list_create();
142 tsr
= linked_list_create();
143 tsi
->insert_last(tsi
, this->tsi
);
144 tsr
->insert_last(tsr
, this->tsr
);
145 if (this->keymat
->derive_child_keys(this->keymat
, this->proposal
, this->dh
,
146 this->spi_i
, this->spi_r
, this->nonce_i
, this->nonce_r
,
147 &encr_i
, &integ_i
, &encr_r
, &integ_r
))
151 status_i
= this->child_sa
->install(this->child_sa
, encr_r
, integ_r
,
152 this->spi_i
, 0, TRUE
, FALSE
, tsi
, tsr
);
153 status_o
= this->child_sa
->install(this->child_sa
, encr_i
, integ_i
,
154 this->spi_r
, 0, FALSE
, FALSE
, tsi
, tsr
);
158 status_i
= this->child_sa
->install(this->child_sa
, encr_i
, integ_i
,
159 this->spi_r
, 0, TRUE
, FALSE
, tsr
, tsi
);
160 status_o
= this->child_sa
->install(this->child_sa
, encr_r
, integ_r
,
161 this->spi_i
, 0, FALSE
, FALSE
, tsr
, tsi
);
164 chunk_clear(&integ_i
);
165 chunk_clear(&integ_r
);
166 chunk_clear(&encr_i
);
167 chunk_clear(&encr_r
);
169 if (status_i
!= SUCCESS
|| status_o
!= SUCCESS
)
171 DBG1(DBG_IKE
, "unable to install %s%s%sIPsec SA (SAD) in kernel",
172 (status_i
!= SUCCESS
) ?
"inbound " : "",
173 (status_i
!= SUCCESS
&& status_o
!= SUCCESS
) ?
"and ": "",
174 (status_o
!= SUCCESS
) ?
"outbound " : "");
182 status
= this->child_sa
->add_policies(this->child_sa
, tsi
, tsr
);
186 status
= this->child_sa
->add_policies(this->child_sa
, tsr
, tsi
);
190 if (status
!= SUCCESS
)
192 DBG1(DBG_IKE
, "unable to install IPsec policies (SPD) in kernel");
196 charon
->bus
->child_keys(charon
->bus
, this->child_sa
, this->initiator
,
197 this->dh
, this->nonce_i
, this->nonce_r
);
199 /* add to IKE_SA, and remove from task */
200 this->child_sa
->set_state(this->child_sa
, CHILD_INSTALLED
);
201 this->ike_sa
->add_child_sa(this->ike_sa
, this->child_sa
);
203 DBG0(DBG_IKE
, "CHILD_SA %s{%d} established "
204 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
205 this->child_sa
->get_name(this->child_sa
),
206 this->child_sa
->get_reqid(this->child_sa
),
207 ntohl(this->child_sa
->get_spi(this->child_sa
, TRUE
)),
208 ntohl(this->child_sa
->get_spi(this->child_sa
, FALSE
)),
209 this->child_sa
->get_traffic_selectors(this->child_sa
, TRUE
),
210 this->child_sa
->get_traffic_selectors(this->child_sa
, FALSE
));
212 charon
->bus
->child_updown(charon
->bus
, this->child_sa
, TRUE
);
214 this->child_sa
= NULL
;
220 * Generate and add NONCE
222 static bool add_nonce(private_quick_mode_t
*this, chunk_t
*nonce
,
225 nonce_payload_t
*nonce_payload
;
228 rng
= lib
->crypto
->create_rng(lib
->crypto
, RNG_WEAK
);
231 DBG1(DBG_IKE
, "no RNG found to create nonce");
234 rng
->allocate_bytes(rng
, NONCE_SIZE
, nonce
);
237 nonce_payload
= nonce_payload_create(NONCE_V1
);
238 nonce_payload
->set_nonce(nonce_payload
, *nonce
);
239 message
->add_payload(message
, &nonce_payload
->payload_interface
);
245 * Extract nonce from NONCE payload
247 static bool get_nonce(private_quick_mode_t
*this, chunk_t
*nonce
,
250 nonce_payload_t
*nonce_payload
;
252 nonce_payload
= (nonce_payload_t
*)message
->get_payload(message
, NONCE_V1
);
255 DBG1(DBG_IKE
, "NONCE payload missing in message");
258 *nonce
= nonce_payload
->get_nonce(nonce_payload
);
264 * Add KE payload to message
266 static void add_ke(private_quick_mode_t
*this, message_t
*message
)
268 ke_payload_t
*ke_payload
;
270 ke_payload
= ke_payload_create_from_diffie_hellman(KEY_EXCHANGE_V1
, this->dh
);
271 message
->add_payload(message
, &ke_payload
->payload_interface
);
275 * Get DH value from a KE payload
277 static bool get_ke(private_quick_mode_t
*this, message_t
*message
)
279 ke_payload_t
*ke_payload
;
281 ke_payload
= (ke_payload_t
*)message
->get_payload(message
, KEY_EXCHANGE_V1
);
284 DBG1(DBG_IKE
, "KE payload missing");
287 this->dh
->set_other_public_value(this->dh
,
288 ke_payload
->get_key_exchange_data(ke_payload
));
293 * Select a traffic selector from configuration
295 static traffic_selector_t
* select_ts(private_quick_mode_t
*this, bool local
,
296 linked_list_t
*supplied
)
298 traffic_selector_t
*ts
;
302 host
= this->ike_sa
->get_virtual_ip(this->ike_sa
, local
);
307 host
= this->ike_sa
->get_my_host(this->ike_sa
);
311 host
= this->ike_sa
->get_other_host(this->ike_sa
);
314 list
= this->config
->get_traffic_selectors(this->config
, local
,
316 if (list
->get_first(list
, (void**)&ts
) == SUCCESS
)
318 if (list
->get_count(list
) > 1)
320 DBG1(DBG_IKE
, "configuration has more than one %s traffic selector,"
321 " using first only", local ?
"local" : "remote");
327 DBG1(DBG_IKE
, "%s traffic selector missing in configuration",
328 local ?
"local" : "local");
331 list
->destroy_offset(list
, offsetof(traffic_selector_t
, destroy
));
336 * Add selected traffic selectors to message
338 static void add_ts(private_quick_mode_t
*this, message_t
*message
)
340 id_payload_t
*id_payload
;
345 hsi
= this->ike_sa
->get_my_host(this->ike_sa
);
346 hsr
= this->ike_sa
->get_other_host(this->ike_sa
);
350 hsr
= this->ike_sa
->get_my_host(this->ike_sa
);
351 hsi
= this->ike_sa
->get_other_host(this->ike_sa
);
353 /* add ID payload only if negotiating non host2host tunnels */
354 if (!this->tsi
->is_host(this->tsi
, hsi
) ||
355 !this->tsr
->is_host(this->tsr
, hsr
) ||
356 this->tsi
->get_protocol(this->tsi
) ||
357 this->tsr
->get_protocol(this->tsr
) ||
358 this->tsi
->get_from_port(this->tsi
) ||
359 this->tsr
->get_from_port(this->tsr
) ||
360 this->tsi
->get_to_port(this->tsi
) != 65535 ||
361 this->tsr
->get_to_port(this->tsr
) != 65535)
363 id_payload
= id_payload_create_from_ts(this->tsi
);
364 message
->add_payload(message
, &id_payload
->payload_interface
);
365 id_payload
= id_payload_create_from_ts(this->tsr
);
366 message
->add_payload(message
, &id_payload
->payload_interface
);
371 * Get traffic selectors from received message
373 static bool get_ts(private_quick_mode_t
*this, message_t
*message
)
375 traffic_selector_t
*tsi
= NULL
, *tsr
= NULL
;
376 enumerator_t
*enumerator
;
377 id_payload_t
*id_payload
;
382 enumerator
= message
->create_payload_enumerator(message
);
383 while (enumerator
->enumerate(enumerator
, &payload
))
385 if (payload
->get_type(payload
) == ID_V1
)
387 id_payload
= (id_payload_t
*)payload
;
391 tsi
= id_payload
->get_ts(id_payload
);
396 tsr
= id_payload
->get_ts(id_payload
);
401 enumerator
->destroy(enumerator
);
403 /* create host2host selectors if ID payloads missing */
406 hsi
= this->ike_sa
->get_my_host(this->ike_sa
);
407 hsr
= this->ike_sa
->get_other_host(this->ike_sa
);
411 hsr
= this->ike_sa
->get_my_host(this->ike_sa
);
412 hsi
= this->ike_sa
->get_other_host(this->ike_sa
);
416 tsi
= traffic_selector_create_from_subnet(hsi
->clone(hsi
),
417 hsi
->get_family(hsi
) == AF_INET ?
32 : 128, 0, 0);
421 tsr
= traffic_selector_create_from_subnet(hsr
->clone(hsr
),
422 hsr
->get_family(hsr
) == AF_INET ?
32 : 128, 0, 0);
426 /* check if peer selection valid */
427 if (!tsr
->is_contained_in(tsr
, this->tsr
) ||
428 !tsi
->is_contained_in(tsi
, this->tsi
))
430 DBG1(DBG_IKE
, "peer selected invalid traffic selectors: ",
431 "%R for %R, %R for %R", tsi
, this->tsi
, tsr
, this->tsr
);
436 this->tsi
->destroy(this->tsi
);
437 this->tsr
->destroy(this->tsr
);
450 * Add NAT-OA payloads
452 static void add_nat_oa_payloads(private_quick_mode_t
*this, message_t
*message
)
454 identification_t
*id
;
455 id_payload_t
*nat_oa
;
458 src
= message
->get_source(message
);
459 dst
= message
->get_destination(message
);
461 src
= this->initiator ? src
: dst
;
462 dst
= this->initiator ? dst
: src
;
464 /* first NAT-OA is the initiator's address */
465 id
= identification_create_from_sockaddr(src
->get_sockaddr(src
));
466 nat_oa
= id_payload_create_from_identification(NAT_OA_V1
, id
);
467 message
->add_payload(message
, (payload_t
*)nat_oa
);
470 /* second NAT-OA is that of the responder */
471 id
= identification_create_from_sockaddr(dst
->get_sockaddr(dst
));
472 nat_oa
= id_payload_create_from_identification(NAT_OA_V1
, id
);
473 message
->add_payload(message
, (payload_t
*)nat_oa
);
480 static void get_lifetimes(private_quick_mode_t
*this)
484 lft
= this->config
->get_lifetime(this->config
);
487 this->lifetime
= lft
->time
.life
;
489 else if (lft
->bytes
.life
)
491 this->lifebytes
= lft
->bytes
.life
;
497 * Check and apply lifetimes
499 static void apply_lifetimes(private_quick_mode_t
*this, sa_payload_t
*sa_payload
)
504 lifetime
= sa_payload
->get_lifetime(sa_payload
);
505 lifebytes
= sa_payload
->get_lifebytes(sa_payload
);
506 if (this->lifetime
!= lifetime
)
508 DBG1(DBG_IKE
, "received %us lifetime, configured %us, using lower",
509 lifetime
, this->lifetime
);
510 this->lifetime
= min(this->lifetime
, lifetime
);
512 if (this->lifebytes
!= lifebytes
)
514 DBG1(DBG_IKE
, "received %llu lifebytes, configured %llu, using lower",
515 lifebytes
, this->lifebytes
);
516 this->lifebytes
= min(this->lifebytes
, lifebytes
);
521 * Set the task ready to build notify error message
523 static status_t
send_notify(private_quick_mode_t
*this, notify_type_t type
)
525 notify_payload_t
*notify
;
527 notify
= notify_payload_create_from_protocol_and_type(NOTIFY_V1
,
529 notify
->set_spi(notify
, this->spi_i
);
531 this->ike_sa
->queue_task(this->ike_sa
,
532 (task_t
*)informational_create(this->ike_sa
, notify
));
533 /* cancel all active/passive tasks in favour of informational */
537 METHOD(task_t
, build_i
, status_t
,
538 private_quick_mode_t
*this, message_t
*message
)
544 enumerator_t
*enumerator
;
545 sa_payload_t
*sa_payload
;
547 proposal_t
*proposal
;
549 diffie_hellman_group_t group
;
550 bool udp
= this->ike_sa
->has_condition(this->ike_sa
, COND_NAT_ANY
);
552 this->child_sa
= child_sa_create(
553 this->ike_sa
->get_my_host(this->ike_sa
),
554 this->ike_sa
->get_other_host(this->ike_sa
),
555 this->config
, 0, udp
);
557 list
= this->config
->get_proposals(this->config
, FALSE
);
559 this->spi_i
= this->child_sa
->alloc_spi(this->child_sa
, PROTO_ESP
);
562 DBG1(DBG_IKE
, "allocating SPI from kernel failed");
565 enumerator
= list
->create_enumerator(list
);
566 while (enumerator
->enumerate(enumerator
, &proposal
))
568 proposal
->set_spi(proposal
, this->spi_i
);
570 enumerator
->destroy(enumerator
);
572 mode
= this->config
->get_mode(this->config
);
573 if (udp
&& mode
== MODE_TRANSPORT
)
575 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
576 add_nat_oa_payloads(this, message
);
580 sa_payload
= sa_payload_create_from_proposals_v1(list
,
581 this->lifetime
, this->lifebytes
, AUTH_NONE
,
583 list
->destroy_offset(list
, offsetof(proposal_t
, destroy
));
584 message
->add_payload(message
, &sa_payload
->payload_interface
);
586 if (!add_nonce(this, &this->nonce_i
, message
))
591 group
= this->config
->get_dh_group(this->config
);
592 if (group
!= MODP_NONE
)
594 this->dh
= this->keymat
->keymat
.create_dh(&this->keymat
->keymat
,
598 DBG1(DBG_IKE
, "configured DH group %N not supported",
599 diffie_hellman_group_names
, group
);
602 add_ke(this, message
);
604 this->tsi
= select_ts(this, TRUE
, NULL
);
605 this->tsr
= select_ts(this, FALSE
, NULL
);
606 if (!this->tsi
|| !this->tsr
)
610 add_ts(this, message
);
623 * Check for notify errors, return TRUE if error found
625 static bool has_notify_errors(private_quick_mode_t
*this, message_t
*message
)
627 enumerator_t
*enumerator
;
631 enumerator
= message
->create_payload_enumerator(message
);
632 while (enumerator
->enumerate(enumerator
, &payload
))
634 if (payload
->get_type(payload
) == NOTIFY_V1
)
636 notify_payload_t
*notify
;
639 notify
= (notify_payload_t
*)payload
;
640 type
= notify
->get_notify_type(notify
);
644 DBG1(DBG_IKE
, "received %N error notify",
645 notify_type_names
, type
);
650 DBG1(DBG_IKE
, "received %N notify", notify_type_names
, type
);
654 enumerator
->destroy(enumerator
);
659 METHOD(task_t
, process_r
, status_t
,
660 private_quick_mode_t
*this, message_t
*message
)
666 sa_payload_t
*sa_payload
;
667 linked_list_t
*tsi
, *tsr
, *list
;
668 peer_cfg_t
*peer_cfg
;
671 bool udp
= this->ike_sa
->has_condition(this->ike_sa
, COND_NAT_ANY
);
673 if (!get_ts(this, message
))
677 me
= this->ike_sa
->get_virtual_ip(this->ike_sa
, TRUE
);
680 me
= this->ike_sa
->get_my_host(this->ike_sa
);
682 other
= this->ike_sa
->get_virtual_ip(this->ike_sa
, FALSE
);
685 other
= this->ike_sa
->get_other_host(this->ike_sa
);
687 peer_cfg
= this->ike_sa
->get_peer_cfg(this->ike_sa
);
688 tsi
= linked_list_create();
689 tsr
= linked_list_create();
690 tsi
->insert_last(tsi
, this->tsi
);
691 tsr
->insert_last(tsr
, this->tsr
);
692 this->tsi
= this->tsr
= NULL
;
693 this->config
= peer_cfg
->select_child_cfg(peer_cfg
, tsr
, tsi
,
697 this->tsi
= select_ts(this, FALSE
, tsi
);
698 this->tsr
= select_ts(this, TRUE
, tsr
);
700 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
701 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
702 if (!this->config
|| !this->tsi
|| !this->tsr
)
704 DBG1(DBG_IKE
, "no matching CHILD_SA config found");
705 return send_notify(this, INVALID_ID_INFORMATION
);
708 sa_payload
= (sa_payload_t
*)message
->get_payload(message
,
709 SECURITY_ASSOCIATION_V1
);
712 DBG1(DBG_IKE
, "sa payload missing");
713 return send_notify(this, INVALID_PAYLOAD_TYPE
);
715 list
= sa_payload
->get_proposals(sa_payload
);
716 this->proposal
= this->config
->select_proposal(this->config
,
718 list
->destroy_offset(list
, offsetof(proposal_t
, destroy
));
721 apply_lifetimes(this, sa_payload
);
725 DBG1(DBG_IKE
, "no matching proposal found, sending %N",
726 notify_type_names
, NO_PROPOSAL_CHOSEN
);
727 return send_notify(this, NO_PROPOSAL_CHOSEN
);
729 this->spi_i
= this->proposal
->get_spi(this->proposal
);
731 if (!get_nonce(this, &this->nonce_i
, message
))
733 return send_notify(this, INVALID_PAYLOAD_TYPE
);
736 if (this->proposal
->get_algorithm(this->proposal
,
737 DIFFIE_HELLMAN_GROUP
, &group
, NULL
))
739 this->dh
= this->keymat
->keymat
.create_dh(&this->keymat
->keymat
,
743 DBG1(DBG_IKE
, "negotiated DH group %N not supported",
744 diffie_hellman_group_names
, group
);
745 return send_notify(this, INVALID_KEY_INFORMATION
);
747 if (!get_ke(this, message
))
749 return send_notify(this, INVALID_PAYLOAD_TYPE
);
753 this->child_sa
= child_sa_create(
754 this->ike_sa
->get_my_host(this->ike_sa
),
755 this->ike_sa
->get_other_host(this->ike_sa
),
756 this->config
, 0, udp
);
761 if (message
->get_exchange_type(message
) == INFORMATIONAL_V1
||
762 has_notify_errors(this, message
))
768 this->ike_sa
->queue_task(this->ike_sa
,
769 (task_t
*)quick_delete_create(this->ike_sa
,
770 this->proposal
->get_protocol(this->proposal
),
781 METHOD(task_t
, build_r
, status_t
,
782 private_quick_mode_t
*this, message_t
*message
)
788 sa_payload_t
*sa_payload
;
790 bool udp
= this->child_sa
->has_encap(this->child_sa
);
792 this->spi_r
= this->child_sa
->alloc_spi(this->child_sa
, PROTO_ESP
);
795 DBG1(DBG_IKE
, "allocating SPI from kernel failed");
796 return send_notify(this, NO_PROPOSAL_CHOSEN
);
798 this->proposal
->set_spi(this->proposal
, this->spi_r
);
800 mode
= this->config
->get_mode(this->config
);
801 if (udp
&& mode
== MODE_TRANSPORT
)
803 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
804 add_nat_oa_payloads(this, message
);
807 sa_payload
= sa_payload_create_from_proposal_v1(this->proposal
,
808 this->lifetime
, this->lifebytes
, AUTH_NONE
,
810 message
->add_payload(message
, &sa_payload
->payload_interface
);
812 if (!add_nonce(this, &this->nonce_r
, message
))
818 add_ke(this, message
);
821 add_ts(this, message
);
823 this->state
= QM_NEGOTIATED
;
831 METHOD(task_t
, process_i
, status_t
,
832 private_quick_mode_t
*this, message_t
*message
)
838 sa_payload_t
*sa_payload
;
841 sa_payload
= (sa_payload_t
*)message
->get_payload(message
,
842 SECURITY_ASSOCIATION_V1
);
845 DBG1(DBG_IKE
, "sa payload missing");
846 return send_notify(this, NO_PROPOSAL_CHOSEN
);
848 list
= sa_payload
->get_proposals(sa_payload
);
849 this->proposal
= this->config
->select_proposal(this->config
,
851 list
->destroy_offset(list
, offsetof(proposal_t
, destroy
));
854 DBG1(DBG_IKE
, "no matching proposal found");
855 return send_notify(this, NO_PROPOSAL_CHOSEN
);
857 this->spi_r
= this->proposal
->get_spi(this->proposal
);
859 apply_lifetimes(this, sa_payload
);
861 if (!get_nonce(this, &this->nonce_r
, message
))
863 return send_notify(this, INVALID_PAYLOAD_TYPE
);
865 if (this->dh
&& !get_ke(this, message
))
867 return send_notify(this, INVALID_KEY_INFORMATION
);
869 if (!get_ts(this, message
))
871 return send_notify(this, INVALID_PAYLOAD_TYPE
);
875 return send_notify(this, NO_PROPOSAL_CHOSEN
);
877 this->state
= QM_NEGOTIATED
;
885 METHOD(task_t
, get_type
, task_type_t
,
886 private_quick_mode_t
*this)
888 return TASK_QUICK_MODE
;
891 METHOD(task_t
, migrate
, void,
892 private_quick_mode_t
*this, ike_sa_t
*ike_sa
)
894 chunk_free(&this->nonce_i
);
895 chunk_free(&this->nonce_r
);
896 DESTROY_IF(this->tsi
);
897 DESTROY_IF(this->tsr
);
898 DESTROY_IF(this->proposal
);
899 DESTROY_IF(this->child_sa
);
900 DESTROY_IF(this->dh
);
902 this->ike_sa
= ike_sa
;
903 this->keymat
= (keymat_v1_t
*)ike_sa
->get_keymat(ike_sa
);
904 this->state
= QM_INIT
;
907 this->proposal
= NULL
;
908 this->child_sa
= NULL
;
913 if (!this->initiator
)
915 DESTROY_IF(this->config
);
920 METHOD(task_t
, destroy
, void,
921 private_quick_mode_t
*this)
923 chunk_free(&this->nonce_i
);
924 chunk_free(&this->nonce_r
);
925 DESTROY_IF(this->tsi
);
926 DESTROY_IF(this->tsr
);
927 DESTROY_IF(this->proposal
);
928 DESTROY_IF(this->child_sa
);
929 DESTROY_IF(this->config
);
930 DESTROY_IF(this->dh
);
935 * Described in header.
937 quick_mode_t
*quick_mode_create(ike_sa_t
*ike_sa
, child_cfg_t
*config
,
938 traffic_selector_t
*tsi
, traffic_selector_t
*tsr
)
940 private_quick_mode_t
*this;
945 .get_type
= _get_type
,
951 .initiator
= config
!= NULL
,
953 .keymat
= (keymat_v1_t
*)ike_sa
->get_keymat(ike_sa
),
959 this->public.task
.build
= _build_i
;
960 this->public.task
.process
= _process_i
;
964 this->public.task
.build
= _build_r
;
965 this->public.task
.process
= _process_r
;
968 return &this->public;