child-sa: Replace reqid based marks by "unique" marks
[strongswan.git] / src / libcharon / sa / ikev2 / tasks / child_create.c
1 /*
2 * Copyright (C) 2008 Tobias Brunner
3 * Copyright (C) 2005-2008 Martin Willi
4 * Copyright (C) 2005 Jan Hutter
5 * Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #include "child_create.h"
19
20 #include <daemon.h>
21 #include <hydra.h>
22 #include <sa/ikev2/keymat_v2.h>
23 #include <crypto/diffie_hellman.h>
24 #include <credentials/certificates/x509.h>
25 #include <encoding/payloads/sa_payload.h>
26 #include <encoding/payloads/ke_payload.h>
27 #include <encoding/payloads/ts_payload.h>
28 #include <encoding/payloads/nonce_payload.h>
29 #include <encoding/payloads/notify_payload.h>
30 #include <encoding/payloads/delete_payload.h>
31 #include <processing/jobs/delete_ike_sa_job.h>
32 #include <processing/jobs/inactivity_job.h>
33
34
35 typedef struct private_child_create_t private_child_create_t;
36
37 /**
38 * Private members of a child_create_t task.
39 */
40 struct private_child_create_t {
41
42 /**
43 * Public methods and task_t interface.
44 */
45 child_create_t public;
46
47 /**
48 * Assigned IKE_SA.
49 */
50 ike_sa_t *ike_sa;
51
52 /**
53 * Are we the initiator?
54 */
55 bool initiator;
56
57 /**
58 * nonce chosen by us
59 */
60 chunk_t my_nonce;
61
62 /**
63 * nonce chosen by peer
64 */
65 chunk_t other_nonce;
66
67 /**
68 * config to create the CHILD_SA from
69 */
70 child_cfg_t *config;
71
72 /**
73 * list of proposal candidates
74 */
75 linked_list_t *proposals;
76
77 /**
78 * selected proposal to use for CHILD_SA
79 */
80 proposal_t *proposal;
81
82 /**
83 * traffic selectors for initiators side
84 */
85 linked_list_t *tsi;
86
87 /**
88 * traffic selectors for responders side
89 */
90 linked_list_t *tsr;
91
92 /**
93 * source of triggering packet
94 */
95 traffic_selector_t *packet_tsi;
96
97 /**
98 * destination of triggering packet
99 */
100 traffic_selector_t *packet_tsr;
101
102 /**
103 * optional diffie hellman exchange
104 */
105 diffie_hellman_t *dh;
106
107 /**
108 * group used for DH exchange
109 */
110 diffie_hellman_group_t dh_group;
111
112 /**
113 * IKE_SAs keymat
114 */
115 keymat_v2_t *keymat;
116
117 /**
118 * mode the new CHILD_SA uses (transport/tunnel/beet)
119 */
120 ipsec_mode_t mode;
121
122 /**
123 * peer accepts TFC padding for this SA
124 */
125 bool tfcv3;
126
127 /**
128 * IPComp transform to use
129 */
130 ipcomp_transform_t ipcomp;
131
132 /**
133 * IPComp transform proposed or accepted by the other peer
134 */
135 ipcomp_transform_t ipcomp_received;
136
137 /**
138 * Own allocated SPI
139 */
140 u_int32_t my_spi;
141
142 /**
143 * SPI received in proposal
144 */
145 u_int32_t other_spi;
146
147 /**
148 * Own allocated Compression Parameter Index (CPI)
149 */
150 u_int16_t my_cpi;
151
152 /**
153 * Other Compression Parameter Index (CPI), received via IPCOMP_SUPPORTED
154 */
155 u_int16_t other_cpi;
156
157 /**
158 * reqid to use if we are rekeying
159 */
160 u_int32_t reqid;
161
162 /**
163 * Explicit inbound mark value
164 */
165 u_int mark_in;
166
167 /**
168 * Explicit outbound mark value
169 */
170 u_int mark_out;
171
172 /**
173 * CHILD_SA which gets established
174 */
175 child_sa_t *child_sa;
176
177 /**
178 * successfully established the CHILD?
179 */
180 bool established;
181
182 /**
183 * whether the CHILD_SA rekeys an existing one
184 */
185 bool rekey;
186
187 /**
188 * whether we are retrying with another DH group
189 */
190 bool retry;
191 };
192
193 /**
194 * get the nonce from a message
195 */
196 static status_t get_nonce(message_t *message, chunk_t *nonce)
197 {
198 nonce_payload_t *payload;
199
200 payload = (nonce_payload_t*)message->get_payload(message, PLV2_NONCE);
201 if (payload == NULL)
202 {
203 return FAILED;
204 }
205 *nonce = payload->get_nonce(payload);
206 return NEED_MORE;
207 }
208
209 /**
210 * generate a new nonce to include in a CREATE_CHILD_SA message
211 */
212 static status_t generate_nonce(private_child_create_t *this)
213 {
214 nonce_gen_t *nonceg;
215
216 nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
217 if (!nonceg)
218 {
219 DBG1(DBG_IKE, "no nonce generator found to create nonce");
220 return FAILED;
221 }
222 if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, &this->my_nonce))
223 {
224 DBG1(DBG_IKE, "nonce allocation failed");
225 nonceg->destroy(nonceg);
226 return FAILED;
227 }
228 nonceg->destroy(nonceg);
229
230 return SUCCESS;
231 }
232
233 /**
234 * Check a list of traffic selectors if any selector belongs to host
235 */
236 static bool ts_list_is_host(linked_list_t *list, host_t *host)
237 {
238 traffic_selector_t *ts;
239 bool is_host = TRUE;
240 enumerator_t *enumerator = list->create_enumerator(list);
241
242 while (is_host && enumerator->enumerate(enumerator, (void**)&ts))
243 {
244 is_host = is_host && ts->is_host(ts, host);
245 }
246 enumerator->destroy(enumerator);
247 return is_host;
248 }
249
250 /**
251 * Allocate SPIs and update proposals
252 */
253 static bool allocate_spi(private_child_create_t *this)
254 {
255 enumerator_t *enumerator;
256 proposal_t *proposal;
257 protocol_id_t proto = PROTO_ESP;
258
259 if (this->initiator)
260 {
261 /* we just get a SPI for the first protocol. TODO: If we ever support
262 * proposal lists with mixed protocols, we'd need multiple SPIs */
263 if (this->proposals->get_first(this->proposals,
264 (void**)&proposal) == SUCCESS)
265 {
266 proto = proposal->get_protocol(proposal);
267 }
268 }
269 else
270 {
271 proto = this->proposal->get_protocol(this->proposal);
272 }
273 this->my_spi = this->child_sa->alloc_spi(this->child_sa, proto);
274 if (this->my_spi)
275 {
276 if (this->initiator)
277 {
278 enumerator = this->proposals->create_enumerator(this->proposals);
279 while (enumerator->enumerate(enumerator, &proposal))
280 {
281 proposal->set_spi(proposal, this->my_spi);
282 }
283 enumerator->destroy(enumerator);
284 }
285 else
286 {
287 this->proposal->set_spi(this->proposal, this->my_spi);
288 }
289 return TRUE;
290 }
291 return FALSE;
292 }
293
294 /**
295 * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
296 */
297 static void schedule_inactivity_timeout(private_child_create_t *this)
298 {
299 u_int32_t timeout;
300 bool close_ike;
301
302 timeout = this->config->get_inactivity(this->config);
303 if (timeout)
304 {
305 close_ike = lib->settings->get_bool(lib->settings,
306 "%s.inactivity_close_ike", FALSE, lib->ns);
307 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
308 inactivity_job_create(this->child_sa->get_reqid(this->child_sa),
309 timeout, close_ike), timeout);
310 }
311 }
312
313 /**
314 * Check if we have a an address pool configured
315 */
316 static bool have_pool(ike_sa_t *ike_sa)
317 {
318 enumerator_t *enumerator;
319 peer_cfg_t *peer_cfg;
320 char *pool;
321 bool found = FALSE;
322
323 peer_cfg = ike_sa->get_peer_cfg(ike_sa);
324 if (peer_cfg)
325 {
326 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
327 if (enumerator->enumerate(enumerator, &pool))
328 {
329 found = TRUE;
330 }
331 enumerator->destroy(enumerator);
332 }
333 return found;
334 }
335
336 /**
337 * Get hosts to use for dynamic traffic selectors
338 */
339 static linked_list_t *get_dynamic_hosts(ike_sa_t *ike_sa, bool local)
340 {
341 enumerator_t *enumerator;
342 linked_list_t *list;
343 host_t *host;
344
345 list = linked_list_create();
346 enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
347 while (enumerator->enumerate(enumerator, &host))
348 {
349 list->insert_last(list, host);
350 }
351 enumerator->destroy(enumerator);
352
353 if (list->get_count(list) == 0)
354 { /* no virtual IPs assigned */
355 if (local)
356 {
357 host = ike_sa->get_my_host(ike_sa);
358 list->insert_last(list, host);
359 }
360 else if (!have_pool(ike_sa))
361 { /* use host only if we don't have a pool configured */
362 host = ike_sa->get_other_host(ike_sa);
363 list->insert_last(list, host);
364 }
365 }
366 return list;
367 }
368
369 /**
370 * Substitude any host address with NATed address in traffic selector
371 */
372 static linked_list_t* get_transport_nat_ts(private_child_create_t *this,
373 bool local, linked_list_t *in)
374 {
375 enumerator_t *enumerator;
376 linked_list_t *out;
377 traffic_selector_t *ts;
378 host_t *ike, *first = NULL;
379 u_int8_t mask;
380
381 if (local)
382 {
383 ike = this->ike_sa->get_my_host(this->ike_sa);
384 }
385 else
386 {
387 ike = this->ike_sa->get_other_host(this->ike_sa);
388 }
389
390 out = linked_list_create();
391
392 enumerator = in->create_enumerator(in);
393 while (enumerator->enumerate(enumerator, &ts))
394 {
395 /* require that all selectors match the first "host" selector */
396 if (ts->is_host(ts, first))
397 {
398 if (!first)
399 {
400 ts->to_subnet(ts, &first, &mask);
401 }
402 ts = ts->clone(ts);
403 ts->set_address(ts, ike);
404 out->insert_last(out, ts);
405 }
406 }
407 enumerator->destroy(enumerator);
408 DESTROY_IF(first);
409
410 return out;
411 }
412
413 /**
414 * Narrow received traffic selectors with configuration
415 */
416 static linked_list_t* narrow_ts(private_child_create_t *this, bool local,
417 linked_list_t *in)
418 {
419 linked_list_t *hosts, *nat, *ts;
420 ike_condition_t cond;
421
422 cond = local ? COND_NAT_HERE : COND_NAT_THERE;
423 hosts = get_dynamic_hosts(this->ike_sa, local);
424
425 if (this->mode == MODE_TRANSPORT &&
426 this->ike_sa->has_condition(this->ike_sa, cond))
427 {
428 nat = get_transport_nat_ts(this, local, in);
429 ts = this->config->get_traffic_selectors(this->config, local, nat, hosts);
430 nat->destroy_offset(nat, offsetof(traffic_selector_t, destroy));
431 }
432 else
433 {
434 ts = this->config->get_traffic_selectors(this->config, local, in, hosts);
435 }
436
437 hosts->destroy(hosts);
438
439 return ts;
440 }
441
442 /**
443 * Install a CHILD_SA for usage, return value:
444 * - FAILED: no acceptable proposal
445 * - INVALID_ARG: diffie hellman group inacceptable
446 * - NOT_FOUND: TS inacceptable
447 */
448 static status_t select_and_install(private_child_create_t *this,
449 bool no_dh, bool ike_auth)
450 {
451 status_t status, status_i, status_o;
452 chunk_t nonce_i, nonce_r;
453 chunk_t encr_i = chunk_empty, encr_r = chunk_empty;
454 chunk_t integ_i = chunk_empty, integ_r = chunk_empty;
455 linked_list_t *my_ts, *other_ts;
456 host_t *me, *other;
457 bool private;
458
459 if (this->proposals == NULL)
460 {
461 DBG1(DBG_IKE, "SA payload missing in message");
462 return FAILED;
463 }
464 if (this->tsi == NULL || this->tsr == NULL)
465 {
466 DBG1(DBG_IKE, "TS payloads missing in message");
467 return NOT_FOUND;
468 }
469
470 me = this->ike_sa->get_my_host(this->ike_sa);
471 other = this->ike_sa->get_other_host(this->ike_sa);
472
473 private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
474 this->proposal = this->config->select_proposal(this->config,
475 this->proposals, no_dh, private);
476 if (this->proposal == NULL)
477 {
478 DBG1(DBG_IKE, "no acceptable proposal found");
479 charon->bus->alert(charon->bus, ALERT_PROPOSAL_MISMATCH_CHILD,
480 this->proposals);
481 return FAILED;
482 }
483 this->other_spi = this->proposal->get_spi(this->proposal);
484
485 if (!this->initiator && !allocate_spi(this))
486 { /* responder has no SPI allocated yet */
487 DBG1(DBG_IKE, "allocating SPI failed");
488 return FAILED;
489 }
490 this->child_sa->set_proposal(this->child_sa, this->proposal);
491
492 if (!this->proposal->has_dh_group(this->proposal, this->dh_group))
493 {
494 u_int16_t group;
495
496 if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
497 &group, NULL))
498 {
499 DBG1(DBG_IKE, "DH group %N inacceptable, requesting %N",
500 diffie_hellman_group_names, this->dh_group,
501 diffie_hellman_group_names, group);
502 this->dh_group = group;
503 return INVALID_ARG;
504 }
505 /* the selected proposal does not use a DH group */
506 DBG1(DBG_IKE, "ignoring KE exchange, agreed on a non-PFS proposal");
507 DESTROY_IF(this->dh);
508 this->dh = NULL;
509 this->dh_group = MODP_NONE;
510 }
511
512 if (this->initiator)
513 {
514 nonce_i = this->my_nonce;
515 nonce_r = this->other_nonce;
516 my_ts = narrow_ts(this, TRUE, this->tsi);
517 other_ts = narrow_ts(this, FALSE, this->tsr);
518 }
519 else
520 {
521 nonce_r = this->my_nonce;
522 nonce_i = this->other_nonce;
523 my_ts = narrow_ts(this, TRUE, this->tsr);
524 other_ts = narrow_ts(this, FALSE, this->tsi);
525 }
526
527 if (this->initiator)
528 {
529 if (ike_auth)
530 {
531 charon->bus->narrow(charon->bus, this->child_sa,
532 NARROW_INITIATOR_POST_NOAUTH, my_ts, other_ts);
533 }
534 else
535 {
536 charon->bus->narrow(charon->bus, this->child_sa,
537 NARROW_INITIATOR_POST_AUTH, my_ts, other_ts);
538 }
539 }
540 else
541 {
542 charon->bus->narrow(charon->bus, this->child_sa,
543 NARROW_RESPONDER, my_ts, other_ts);
544 }
545
546 if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
547 {
548 charon->bus->alert(charon->bus, ALERT_TS_MISMATCH, this->tsi, this->tsr);
549 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
550 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
551 DBG1(DBG_IKE, "no acceptable traffic selectors found");
552 return NOT_FOUND;
553 }
554
555 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
556 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
557 if (this->initiator)
558 {
559 this->tsi = my_ts;
560 this->tsr = other_ts;
561 }
562 else
563 {
564 this->tsr = my_ts;
565 this->tsi = other_ts;
566 }
567
568 if (!this->initiator)
569 {
570 /* check if requested mode is acceptable, downgrade if required */
571 switch (this->mode)
572 {
573 case MODE_TRANSPORT:
574 if (!this->config->use_proxy_mode(this->config) &&
575 (!ts_list_is_host(this->tsi, other) ||
576 !ts_list_is_host(this->tsr, me))
577 )
578 {
579 this->mode = MODE_TUNNEL;
580 DBG1(DBG_IKE, "not using transport mode, not host-to-host");
581 }
582 if (this->config->get_mode(this->config) != MODE_TRANSPORT)
583 {
584 this->mode = MODE_TUNNEL;
585 }
586 break;
587 case MODE_BEET:
588 if (!ts_list_is_host(this->tsi, NULL) ||
589 !ts_list_is_host(this->tsr, NULL))
590 {
591 this->mode = MODE_TUNNEL;
592 DBG1(DBG_IKE, "not using BEET mode, not host-to-host");
593 }
594 if (this->config->get_mode(this->config) != MODE_BEET)
595 {
596 this->mode = MODE_TUNNEL;
597 }
598 break;
599 default:
600 break;
601 }
602 }
603
604 this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
605 this->child_sa->set_ipcomp(this->child_sa, this->ipcomp);
606 this->child_sa->set_mode(this->child_sa, this->mode);
607 this->child_sa->set_protocol(this->child_sa,
608 this->proposal->get_protocol(this->proposal));
609
610 if (this->my_cpi == 0 || this->other_cpi == 0 || this->ipcomp == IPCOMP_NONE)
611 {
612 this->my_cpi = this->other_cpi = 0;
613 this->ipcomp = IPCOMP_NONE;
614 }
615 status_i = status_o = FAILED;
616 if (this->keymat->derive_child_keys(this->keymat, this->proposal,
617 this->dh, nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
618 {
619 if (this->initiator)
620 {
621 status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
622 this->my_spi, this->my_cpi, this->initiator,
623 TRUE, this->tfcv3, my_ts, other_ts);
624 status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
625 this->other_spi, this->other_cpi, this->initiator,
626 FALSE, this->tfcv3, my_ts, other_ts);
627 }
628 else
629 {
630 status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
631 this->my_spi, this->my_cpi, this->initiator,
632 TRUE, this->tfcv3, my_ts, other_ts);
633 status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
634 this->other_spi, this->other_cpi, this->initiator,
635 FALSE, this->tfcv3, my_ts, other_ts);
636 }
637 }
638 chunk_clear(&integ_i);
639 chunk_clear(&integ_r);
640 chunk_clear(&encr_i);
641 chunk_clear(&encr_r);
642
643 if (status_i != SUCCESS || status_o != SUCCESS)
644 {
645 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
646 (status_i != SUCCESS) ? "inbound " : "",
647 (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
648 (status_o != SUCCESS) ? "outbound " : "");
649 charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_SA_FAILED,
650 this->child_sa);
651 return FAILED;
652 }
653
654 if (this->initiator)
655 {
656 status = this->child_sa->add_policies(this->child_sa, my_ts, other_ts);
657 }
658 else
659 {
660 /* use a copy of the traffic selectors, as the POST hook should not
661 * change payloads */
662 my_ts = this->tsr->clone_offset(this->tsr,
663 offsetof(traffic_selector_t, clone));
664 other_ts = this->tsi->clone_offset(this->tsi,
665 offsetof(traffic_selector_t, clone));
666 charon->bus->narrow(charon->bus, this->child_sa,
667 NARROW_RESPONDER_POST, my_ts, other_ts);
668 if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
669 {
670 status = FAILED;
671 }
672 else
673 {
674 status = this->child_sa->add_policies(this->child_sa,
675 my_ts, other_ts);
676 }
677 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
678 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
679 }
680 if (status != SUCCESS)
681 {
682 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
683 charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_POLICY_FAILED,
684 this->child_sa);
685 return NOT_FOUND;
686 }
687
688 charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
689 this->dh, nonce_i, nonce_r);
690
691 /* add to IKE_SA, and remove from task */
692 this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
693 this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
694 this->established = TRUE;
695
696 if (!this->rekey)
697 { /* a rekeyed SA uses the same reqid, no need for a new job */
698 schedule_inactivity_timeout(this);
699 }
700
701 my_ts = linked_list_create_from_enumerator(
702 this->child_sa->create_ts_enumerator(this->child_sa, TRUE));
703 other_ts = linked_list_create_from_enumerator(
704 this->child_sa->create_ts_enumerator(this->child_sa, FALSE));
705
706 DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
707 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
708 this->child_sa->get_name(this->child_sa),
709 this->child_sa->get_reqid(this->child_sa),
710 ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
711 ntohl(this->child_sa->get_spi(this->child_sa, FALSE)), my_ts, other_ts);
712
713 my_ts->destroy(my_ts);
714 other_ts->destroy(other_ts);
715
716 return SUCCESS;
717 }
718
719 /**
720 * build the payloads for the message
721 */
722 static void build_payloads(private_child_create_t *this, message_t *message)
723 {
724 sa_payload_t *sa_payload;
725 nonce_payload_t *nonce_payload;
726 ke_payload_t *ke_payload;
727 ts_payload_t *ts_payload;
728 kernel_feature_t features;
729
730 /* add SA payload */
731 if (this->initiator)
732 {
733 sa_payload = sa_payload_create_from_proposals_v2(this->proposals);
734 }
735 else
736 {
737 sa_payload = sa_payload_create_from_proposal_v2(this->proposal);
738 }
739 message->add_payload(message, (payload_t*)sa_payload);
740
741 /* add nonce payload if not in IKE_AUTH */
742 if (message->get_exchange_type(message) == CREATE_CHILD_SA)
743 {
744 nonce_payload = nonce_payload_create(PLV2_NONCE);
745 nonce_payload->set_nonce(nonce_payload, this->my_nonce);
746 message->add_payload(message, (payload_t*)nonce_payload);
747 }
748
749 /* diffie hellman exchange, if PFS enabled */
750 if (this->dh)
751 {
752 ke_payload = ke_payload_create_from_diffie_hellman(PLV2_KEY_EXCHANGE,
753 this->dh);
754 message->add_payload(message, (payload_t*)ke_payload);
755 }
756
757 /* add TSi/TSr payloads */
758 ts_payload = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
759 message->add_payload(message, (payload_t*)ts_payload);
760 ts_payload = ts_payload_create_from_traffic_selectors(FALSE, this->tsr);
761 message->add_payload(message, (payload_t*)ts_payload);
762
763 /* add a notify if we are not in tunnel mode */
764 switch (this->mode)
765 {
766 case MODE_TRANSPORT:
767 message->add_notify(message, FALSE, USE_TRANSPORT_MODE, chunk_empty);
768 break;
769 case MODE_BEET:
770 message->add_notify(message, FALSE, USE_BEET_MODE, chunk_empty);
771 break;
772 default:
773 break;
774 }
775
776 features = hydra->kernel_interface->get_features(hydra->kernel_interface);
777 if (!(features & KERNEL_ESP_V3_TFC))
778 {
779 message->add_notify(message, FALSE, ESP_TFC_PADDING_NOT_SUPPORTED,
780 chunk_empty);
781 }
782 }
783
784 /**
785 * Adds an IPCOMP_SUPPORTED notify to the message, allocating a CPI
786 */
787 static void add_ipcomp_notify(private_child_create_t *this,
788 message_t *message, u_int8_t ipcomp)
789 {
790 this->my_cpi = this->child_sa->alloc_cpi(this->child_sa);
791 if (this->my_cpi)
792 {
793 this->ipcomp = ipcomp;
794 message->add_notify(message, FALSE, IPCOMP_SUPPORTED,
795 chunk_cata("cc", chunk_from_thing(this->my_cpi),
796 chunk_from_thing(ipcomp)));
797 }
798 else
799 {
800 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, IPComp disabled");
801 }
802 }
803
804 /**
805 * handle a received notify payload
806 */
807 static void handle_notify(private_child_create_t *this, notify_payload_t *notify)
808 {
809 switch (notify->get_notify_type(notify))
810 {
811 case USE_TRANSPORT_MODE:
812 this->mode = MODE_TRANSPORT;
813 break;
814 case USE_BEET_MODE:
815 if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
816 { /* handle private use notify only if we know its meaning */
817 this->mode = MODE_BEET;
818 }
819 else
820 {
821 DBG1(DBG_IKE, "received a notify strongSwan uses for BEET "
822 "mode, but peer implementation unknown, skipped");
823 }
824 break;
825 case IPCOMP_SUPPORTED:
826 {
827 ipcomp_transform_t ipcomp;
828 u_int16_t cpi;
829 chunk_t data;
830
831 data = notify->get_notification_data(notify);
832 cpi = *(u_int16_t*)data.ptr;
833 ipcomp = (ipcomp_transform_t)(*(data.ptr + 2));
834 switch (ipcomp)
835 {
836 case IPCOMP_DEFLATE:
837 this->other_cpi = cpi;
838 this->ipcomp_received = ipcomp;
839 break;
840 case IPCOMP_LZS:
841 case IPCOMP_LZJH:
842 default:
843 DBG1(DBG_IKE, "received IPCOMP_SUPPORTED notify with a "
844 "transform ID we don't support %N",
845 ipcomp_transform_names, ipcomp);
846 break;
847 }
848 break;
849 }
850 case ESP_TFC_PADDING_NOT_SUPPORTED:
851 DBG1(DBG_IKE, "received %N, not using ESPv3 TFC padding",
852 notify_type_names, notify->get_notify_type(notify));
853 this->tfcv3 = FALSE;
854 break;
855 default:
856 break;
857 }
858 }
859
860 /**
861 * Read payloads from message
862 */
863 static void process_payloads(private_child_create_t *this, message_t *message)
864 {
865 enumerator_t *enumerator;
866 payload_t *payload;
867 sa_payload_t *sa_payload;
868 ke_payload_t *ke_payload;
869 ts_payload_t *ts_payload;
870
871 /* defaults to TUNNEL mode */
872 this->mode = MODE_TUNNEL;
873
874 enumerator = message->create_payload_enumerator(message);
875 while (enumerator->enumerate(enumerator, &payload))
876 {
877 switch (payload->get_type(payload))
878 {
879 case PLV2_SECURITY_ASSOCIATION:
880 sa_payload = (sa_payload_t*)payload;
881 this->proposals = sa_payload->get_proposals(sa_payload);
882 break;
883 case PLV2_KEY_EXCHANGE:
884 ke_payload = (ke_payload_t*)payload;
885 if (!this->initiator)
886 {
887 this->dh_group = ke_payload->get_dh_group_number(ke_payload);
888 this->dh = this->keymat->keymat.create_dh(
889 &this->keymat->keymat, this->dh_group);
890 }
891 if (this->dh)
892 {
893 this->dh->set_other_public_value(this->dh,
894 ke_payload->get_key_exchange_data(ke_payload));
895 }
896 break;
897 case PLV2_TS_INITIATOR:
898 ts_payload = (ts_payload_t*)payload;
899 this->tsi = ts_payload->get_traffic_selectors(ts_payload);
900 break;
901 case PLV2_TS_RESPONDER:
902 ts_payload = (ts_payload_t*)payload;
903 this->tsr = ts_payload->get_traffic_selectors(ts_payload);
904 break;
905 case PLV2_NOTIFY:
906 handle_notify(this, (notify_payload_t*)payload);
907 break;
908 default:
909 break;
910 }
911 }
912 enumerator->destroy(enumerator);
913 }
914
915 METHOD(task_t, build_i, status_t,
916 private_child_create_t *this, message_t *message)
917 {
918 enumerator_t *enumerator;
919 host_t *vip;
920 peer_cfg_t *peer_cfg;
921 linked_list_t *list;
922
923 switch (message->get_exchange_type(message))
924 {
925 case IKE_SA_INIT:
926 return get_nonce(message, &this->my_nonce);
927 case CREATE_CHILD_SA:
928 if (generate_nonce(this) != SUCCESS)
929 {
930 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
931 return SUCCESS;
932 }
933 if (!this->retry)
934 {
935 this->dh_group = this->config->get_dh_group(this->config);
936 }
937 break;
938 case IKE_AUTH:
939 if (message->get_message_id(message) != 1)
940 {
941 /* send only in the first request, not in subsequent rounds */
942 return NEED_MORE;
943 }
944 break;
945 default:
946 break;
947 }
948
949 if (this->reqid)
950 {
951 DBG0(DBG_IKE, "establishing CHILD_SA %s{%d}",
952 this->config->get_name(this->config), this->reqid);
953 }
954 else
955 {
956 DBG0(DBG_IKE, "establishing CHILD_SA %s",
957 this->config->get_name(this->config));
958 }
959
960 /* check if we want a virtual IP, but don't have one */
961 list = linked_list_create();
962 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
963 if (!this->rekey)
964 {
965 enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
966 while (enumerator->enumerate(enumerator, &vip))
967 {
968 /* propose a 0.0.0.0/0 or ::/0 subnet when we use virtual ip */
969 vip = host_create_any(vip->get_family(vip));
970 list->insert_last(list, vip);
971 }
972 enumerator->destroy(enumerator);
973 }
974 if (list->get_count(list))
975 {
976 this->tsi = this->config->get_traffic_selectors(this->config,
977 TRUE, NULL, list);
978 list->destroy_offset(list, offsetof(host_t, destroy));
979 }
980 else
981 { /* no virtual IPs configured */
982 list->destroy(list);
983 list = get_dynamic_hosts(this->ike_sa, TRUE);
984 this->tsi = this->config->get_traffic_selectors(this->config,
985 TRUE, NULL, list);
986 list->destroy(list);
987 }
988 list = get_dynamic_hosts(this->ike_sa, FALSE);
989 this->tsr = this->config->get_traffic_selectors(this->config,
990 FALSE, NULL, list);
991 list->destroy(list);
992
993 if (this->packet_tsi)
994 {
995 this->tsi->insert_first(this->tsi,
996 this->packet_tsi->clone(this->packet_tsi));
997 }
998 if (this->packet_tsr)
999 {
1000 this->tsr->insert_first(this->tsr,
1001 this->packet_tsr->clone(this->packet_tsr));
1002 }
1003 this->proposals = this->config->get_proposals(this->config,
1004 this->dh_group == MODP_NONE);
1005 this->mode = this->config->get_mode(this->config);
1006
1007 this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
1008 this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
1009 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY),
1010 this->mark_in, this->mark_out);
1011
1012 if (!allocate_spi(this))
1013 {
1014 DBG1(DBG_IKE, "unable to allocate SPIs from kernel");
1015 return FAILED;
1016 }
1017
1018 if (this->dh_group != MODP_NONE)
1019 {
1020 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
1021 this->dh_group);
1022 }
1023
1024 if (this->config->use_ipcomp(this->config))
1025 {
1026 /* IPCOMP_DEFLATE is the only transform we support at the moment */
1027 add_ipcomp_notify(this, message, IPCOMP_DEFLATE);
1028 }
1029
1030 if (message->get_exchange_type(message) == IKE_AUTH)
1031 {
1032 charon->bus->narrow(charon->bus, this->child_sa,
1033 NARROW_INITIATOR_PRE_NOAUTH, this->tsi, this->tsr);
1034 }
1035 else
1036 {
1037 charon->bus->narrow(charon->bus, this->child_sa,
1038 NARROW_INITIATOR_PRE_AUTH, this->tsi, this->tsr);
1039 }
1040
1041 build_payloads(this, message);
1042
1043 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1044 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1045 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1046 this->tsi = NULL;
1047 this->tsr = NULL;
1048 this->proposals = NULL;
1049
1050 return NEED_MORE;
1051 }
1052
1053 METHOD(task_t, process_r, status_t,
1054 private_child_create_t *this, message_t *message)
1055 {
1056 switch (message->get_exchange_type(message))
1057 {
1058 case IKE_SA_INIT:
1059 return get_nonce(message, &this->other_nonce);
1060 case CREATE_CHILD_SA:
1061 get_nonce(message, &this->other_nonce);
1062 break;
1063 case IKE_AUTH:
1064 if (message->get_message_id(message) != 1)
1065 {
1066 /* only handle first AUTH payload, not additional rounds */
1067 return NEED_MORE;
1068 }
1069 default:
1070 break;
1071 }
1072
1073 process_payloads(this, message);
1074
1075 return NEED_MORE;
1076 }
1077
1078 /**
1079 * handle CHILD_SA setup failure
1080 */
1081 static void handle_child_sa_failure(private_child_create_t *this,
1082 message_t *message)
1083 {
1084 if (message->get_exchange_type(message) == IKE_AUTH &&
1085 lib->settings->get_bool(lib->settings,
1086 "%s.close_ike_on_child_failure", FALSE, lib->ns))
1087 {
1088 /* we delay the delete for 100ms, as the IKE_AUTH response must arrive
1089 * first */
1090 DBG1(DBG_IKE, "closing IKE_SA due CHILD_SA setup failure");
1091 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
1092 delete_ike_sa_job_create(this->ike_sa->get_id(this->ike_sa), TRUE),
1093 100);
1094 }
1095 else
1096 {
1097 DBG1(DBG_IKE, "failed to establish CHILD_SA, keeping IKE_SA");
1098 charon->bus->alert(charon->bus, ALERT_KEEP_ON_CHILD_SA_FAILURE);
1099 }
1100 }
1101
1102 /**
1103 * Substitute transport mode NAT selectors, if applicable
1104 */
1105 static linked_list_t* get_ts_if_nat_transport(private_child_create_t *this,
1106 bool local, linked_list_t *in)
1107 {
1108 linked_list_t *out = NULL;
1109 ike_condition_t cond;
1110
1111 if (this->mode == MODE_TRANSPORT)
1112 {
1113 cond = local ? COND_NAT_HERE : COND_NAT_THERE;
1114 if (this->ike_sa->has_condition(this->ike_sa, cond))
1115 {
1116 out = get_transport_nat_ts(this, local, in);
1117 if (out->get_count(out) == 0)
1118 {
1119 out->destroy(out);
1120 out = NULL;
1121 }
1122 }
1123 }
1124 return out;
1125 }
1126
1127 /**
1128 * Select a matching CHILD config as responder
1129 */
1130 static child_cfg_t* select_child_cfg(private_child_create_t *this)
1131 {
1132 peer_cfg_t *peer_cfg;
1133 child_cfg_t *child_cfg = NULL;;
1134
1135 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1136 if (peer_cfg && this->tsi && this->tsr)
1137 {
1138 linked_list_t *listr, *listi, *tsr, *tsi;
1139
1140 tsr = get_ts_if_nat_transport(this, TRUE, this->tsr);
1141 tsi = get_ts_if_nat_transport(this, FALSE, this->tsi);
1142
1143 listr = get_dynamic_hosts(this->ike_sa, TRUE);
1144 listi = get_dynamic_hosts(this->ike_sa, FALSE);
1145 child_cfg = peer_cfg->select_child_cfg(peer_cfg,
1146 tsr ?: this->tsr, tsi ?: this->tsi,
1147 listr, listi);
1148 if ((tsi || tsr) && child_cfg &&
1149 child_cfg->get_mode(child_cfg) != MODE_TRANSPORT)
1150 {
1151 /* found a CHILD config, but it doesn't use transport mode */
1152 child_cfg->destroy(child_cfg);
1153 child_cfg = NULL;
1154 }
1155 if (!child_cfg && (tsi || tsr))
1156 {
1157 /* no match for the substituted NAT selectors, try it without */
1158 child_cfg = peer_cfg->select_child_cfg(peer_cfg,
1159 this->tsr, this->tsi, listr, listi);
1160 }
1161 listr->destroy(listr);
1162 listi->destroy(listi);
1163 DESTROY_OFFSET_IF(tsi, offsetof(traffic_selector_t, destroy));
1164 DESTROY_OFFSET_IF(tsr, offsetof(traffic_selector_t, destroy));
1165 }
1166
1167 return child_cfg;
1168 }
1169
1170 METHOD(task_t, build_r, status_t,
1171 private_child_create_t *this, message_t *message)
1172 {
1173 payload_t *payload;
1174 enumerator_t *enumerator;
1175 bool no_dh = TRUE, ike_auth = FALSE;
1176
1177 switch (message->get_exchange_type(message))
1178 {
1179 case IKE_SA_INIT:
1180 return get_nonce(message, &this->my_nonce);
1181 case CREATE_CHILD_SA:
1182 if (generate_nonce(this) != SUCCESS)
1183 {
1184 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN,
1185 chunk_empty);
1186 return SUCCESS;
1187 }
1188 no_dh = FALSE;
1189 break;
1190 case IKE_AUTH:
1191 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1192 { /* wait until all authentication round completed */
1193 return NEED_MORE;
1194 }
1195 ike_auth = TRUE;
1196 default:
1197 break;
1198 }
1199
1200 if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
1201 {
1202 DBG1(DBG_IKE, "unable to create CHILD_SA while rekeying IKE_SA");
1203 message->add_notify(message, TRUE, NO_ADDITIONAL_SAS, chunk_empty);
1204 return SUCCESS;
1205 }
1206 if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
1207 {
1208 DBG1(DBG_IKE, "unable to create CHILD_SA while deleting IKE_SA");
1209 message->add_notify(message, TRUE, NO_ADDITIONAL_SAS, chunk_empty);
1210 return SUCCESS;
1211 }
1212
1213 if (this->config == NULL)
1214 {
1215 this->config = select_child_cfg(this);
1216 }
1217 if (this->config == NULL)
1218 {
1219 DBG1(DBG_IKE, "traffic selectors %#R=== %#R inacceptable",
1220 this->tsr, this->tsi);
1221 charon->bus->alert(charon->bus, ALERT_TS_MISMATCH, this->tsi, this->tsr);
1222 message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
1223 handle_child_sa_failure(this, message);
1224 return SUCCESS;
1225 }
1226
1227 /* check if ike_config_t included non-critical error notifies */
1228 enumerator = message->create_payload_enumerator(message);
1229 while (enumerator->enumerate(enumerator, &payload))
1230 {
1231 if (payload->get_type(payload) == PLV2_NOTIFY)
1232 {
1233 notify_payload_t *notify = (notify_payload_t*)payload;
1234
1235 switch (notify->get_notify_type(notify))
1236 {
1237 case INTERNAL_ADDRESS_FAILURE:
1238 case FAILED_CP_REQUIRED:
1239 {
1240 DBG1(DBG_IKE,"configuration payload negotiation "
1241 "failed, no CHILD_SA built");
1242 enumerator->destroy(enumerator);
1243 handle_child_sa_failure(this, message);
1244 return SUCCESS;
1245 }
1246 default:
1247 break;
1248 }
1249 }
1250 }
1251 enumerator->destroy(enumerator);
1252
1253 this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
1254 this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
1255 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY),
1256 this->mark_in, this->mark_out);
1257
1258 if (this->ipcomp_received != IPCOMP_NONE)
1259 {
1260 if (this->config->use_ipcomp(this->config))
1261 {
1262 add_ipcomp_notify(this, message, this->ipcomp_received);
1263 }
1264 else
1265 {
1266 DBG1(DBG_IKE, "received %N notify but IPComp is disabled, ignoring",
1267 notify_type_names, IPCOMP_SUPPORTED);
1268 }
1269 }
1270
1271 switch (select_and_install(this, no_dh, ike_auth))
1272 {
1273 case SUCCESS:
1274 break;
1275 case NOT_FOUND:
1276 message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
1277 handle_child_sa_failure(this, message);
1278 return SUCCESS;
1279 case INVALID_ARG:
1280 {
1281 u_int16_t group = htons(this->dh_group);
1282 message->add_notify(message, FALSE, INVALID_KE_PAYLOAD,
1283 chunk_from_thing(group));
1284 handle_child_sa_failure(this, message);
1285 return SUCCESS;
1286 }
1287 case FAILED:
1288 default:
1289 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
1290 handle_child_sa_failure(this, message);
1291 return SUCCESS;
1292 }
1293
1294 build_payloads(this, message);
1295
1296 if (!this->rekey)
1297 { /* invoke the child_up() hook if we are not rekeying */
1298 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1299 }
1300 return SUCCESS;
1301 }
1302
1303 /**
1304 * Raise alerts for received notify errors
1305 */
1306 static void raise_alerts(private_child_create_t *this, notify_type_t type)
1307 {
1308 linked_list_t *list;
1309
1310 switch (type)
1311 {
1312 case NO_PROPOSAL_CHOSEN:
1313 list = this->config->get_proposals(this->config, FALSE);
1314 charon->bus->alert(charon->bus, ALERT_PROPOSAL_MISMATCH_CHILD, list);
1315 list->destroy_offset(list, offsetof(proposal_t, destroy));
1316 break;
1317 default:
1318 break;
1319 }
1320 }
1321
1322 METHOD(task_t, build_i_delete, status_t,
1323 private_child_create_t *this, message_t *message)
1324 {
1325 message->set_exchange_type(message, INFORMATIONAL);
1326 if (this->child_sa && this->proposal)
1327 {
1328 protocol_id_t proto;
1329 delete_payload_t *del;
1330 u_int32_t spi;
1331
1332 proto = this->proposal->get_protocol(this->proposal);
1333 spi = this->child_sa->get_spi(this->child_sa, TRUE);
1334 del = delete_payload_create(PLV2_DELETE, proto);
1335 del->add_spi(del, spi);
1336 message->add_payload(message, (payload_t*)del);
1337
1338 DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
1339 protocol_id_names, proto, ntohl(spi));
1340 }
1341 return NEED_MORE;
1342 }
1343
1344 /**
1345 * Change task to delete the failed CHILD_SA as initiator
1346 */
1347 static status_t delete_failed_sa(private_child_create_t *this)
1348 {
1349 this->public.task.build = _build_i_delete;
1350 this->public.task.process = (void*)return_success;
1351 return NEED_MORE;
1352 }
1353
1354 METHOD(task_t, process_i, status_t,
1355 private_child_create_t *this, message_t *message)
1356 {
1357 enumerator_t *enumerator;
1358 payload_t *payload;
1359 bool no_dh = TRUE, ike_auth = FALSE;
1360
1361 switch (message->get_exchange_type(message))
1362 {
1363 case IKE_SA_INIT:
1364 return get_nonce(message, &this->other_nonce);
1365 case CREATE_CHILD_SA:
1366 get_nonce(message, &this->other_nonce);
1367 no_dh = FALSE;
1368 break;
1369 case IKE_AUTH:
1370 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1371 { /* wait until all authentication round completed */
1372 return NEED_MORE;
1373 }
1374 ike_auth = TRUE;
1375 default:
1376 break;
1377 }
1378
1379 /* check for erroneous notifies */
1380 enumerator = message->create_payload_enumerator(message);
1381 while (enumerator->enumerate(enumerator, &payload))
1382 {
1383 if (payload->get_type(payload) == PLV2_NOTIFY)
1384 {
1385 notify_payload_t *notify = (notify_payload_t*)payload;
1386 notify_type_t type = notify->get_notify_type(notify);
1387
1388 switch (type)
1389 {
1390 /* handle notify errors related to CHILD_SA only */
1391 case NO_PROPOSAL_CHOSEN:
1392 case SINGLE_PAIR_REQUIRED:
1393 case NO_ADDITIONAL_SAS:
1394 case INTERNAL_ADDRESS_FAILURE:
1395 case FAILED_CP_REQUIRED:
1396 case TS_UNACCEPTABLE:
1397 case INVALID_SELECTORS:
1398 {
1399 DBG1(DBG_IKE, "received %N notify, no CHILD_SA built",
1400 notify_type_names, type);
1401 enumerator->destroy(enumerator);
1402 raise_alerts(this, type);
1403 handle_child_sa_failure(this, message);
1404 /* an error in CHILD_SA creation is not critical */
1405 return SUCCESS;
1406 }
1407 case INVALID_KE_PAYLOAD:
1408 {
1409 chunk_t data;
1410 u_int16_t group = MODP_NONE;
1411
1412 data = notify->get_notification_data(notify);
1413 if (data.len == sizeof(group))
1414 {
1415 memcpy(&group, data.ptr, data.len);
1416 group = ntohs(group);
1417 }
1418 DBG1(DBG_IKE, "peer didn't accept DH group %N, "
1419 "it requested %N", diffie_hellman_group_names,
1420 this->dh_group, diffie_hellman_group_names, group);
1421 this->retry = TRUE;
1422 this->dh_group = group;
1423 this->child_sa->set_state(this->child_sa, CHILD_RETRYING);
1424 this->public.task.migrate(&this->public.task, this->ike_sa);
1425 enumerator->destroy(enumerator);
1426 return NEED_MORE;
1427 }
1428 default:
1429 {
1430 if (message->get_exchange_type(message) == CREATE_CHILD_SA)
1431 { /* handle notifies if not handled in IKE_AUTH */
1432 if (type <= 16383)
1433 {
1434 DBG1(DBG_IKE, "received %N notify error",
1435 notify_type_names, type);
1436 enumerator->destroy(enumerator);
1437 return SUCCESS;
1438 }
1439 DBG2(DBG_IKE, "received %N notify",
1440 notify_type_names, type);
1441 }
1442 break;
1443 }
1444 }
1445 }
1446 }
1447 enumerator->destroy(enumerator);
1448
1449 process_payloads(this, message);
1450
1451 if (this->ipcomp == IPCOMP_NONE && this->ipcomp_received != IPCOMP_NONE)
1452 {
1453 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify without requesting"
1454 " one, no CHILD_SA built");
1455 handle_child_sa_failure(this, message);
1456 return delete_failed_sa(this);
1457 }
1458 else if (this->ipcomp != IPCOMP_NONE && this->ipcomp_received == IPCOMP_NONE)
1459 {
1460 DBG1(DBG_IKE, "peer didn't accept our proposed IPComp transforms, "
1461 "IPComp is disabled");
1462 this->ipcomp = IPCOMP_NONE;
1463 }
1464 else if (this->ipcomp != IPCOMP_NONE && this->ipcomp != this->ipcomp_received)
1465 {
1466 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify we didn't propose, "
1467 "no CHILD_SA built");
1468 handle_child_sa_failure(this, message);
1469 return delete_failed_sa(this);
1470 }
1471
1472 if (select_and_install(this, no_dh, ike_auth) == SUCCESS)
1473 {
1474 if (!this->rekey)
1475 { /* invoke the child_up() hook if we are not rekeying */
1476 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1477 }
1478 }
1479 else
1480 {
1481 handle_child_sa_failure(this, message);
1482 return delete_failed_sa(this);
1483 }
1484 return SUCCESS;
1485 }
1486
1487 METHOD(child_create_t, use_reqid, void,
1488 private_child_create_t *this, u_int32_t reqid)
1489 {
1490 this->reqid = reqid;
1491 }
1492
1493 METHOD(child_create_t, use_marks, void,
1494 private_child_create_t *this, u_int in, u_int out)
1495 {
1496 this->mark_in = in;
1497 this->mark_out = out;
1498 }
1499
1500 METHOD(child_create_t, get_child, child_sa_t*,
1501 private_child_create_t *this)
1502 {
1503 return this->child_sa;
1504 }
1505
1506 METHOD(child_create_t, set_config, void,
1507 private_child_create_t *this, child_cfg_t *cfg)
1508 {
1509 DESTROY_IF(this->config);
1510 this->config = cfg;
1511 }
1512
1513 METHOD(child_create_t, get_lower_nonce, chunk_t,
1514 private_child_create_t *this)
1515 {
1516 if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
1517 min(this->my_nonce.len, this->other_nonce.len)) < 0)
1518 {
1519 return this->my_nonce;
1520 }
1521 else
1522 {
1523 return this->other_nonce;
1524 }
1525 }
1526
1527 METHOD(task_t, get_type, task_type_t,
1528 private_child_create_t *this)
1529 {
1530 return TASK_CHILD_CREATE;
1531 }
1532
1533 METHOD(task_t, migrate, void,
1534 private_child_create_t *this, ike_sa_t *ike_sa)
1535 {
1536 chunk_free(&this->my_nonce);
1537 chunk_free(&this->other_nonce);
1538 if (this->tsr)
1539 {
1540 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1541 }
1542 if (this->tsi)
1543 {
1544 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1545 }
1546 DESTROY_IF(this->child_sa);
1547 DESTROY_IF(this->proposal);
1548 DESTROY_IF(this->dh);
1549 if (this->proposals)
1550 {
1551 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1552 }
1553
1554 this->ike_sa = ike_sa;
1555 this->keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa);
1556 this->proposal = NULL;
1557 this->proposals = NULL;
1558 this->tsi = NULL;
1559 this->tsr = NULL;
1560 this->dh = NULL;
1561 this->child_sa = NULL;
1562 this->mode = MODE_TUNNEL;
1563 this->ipcomp = IPCOMP_NONE;
1564 this->ipcomp_received = IPCOMP_NONE;
1565 this->other_cpi = 0;
1566 this->reqid = 0;
1567 this->mark_in = 0;
1568 this->mark_out = 0;
1569 this->established = FALSE;
1570 }
1571
1572 METHOD(task_t, destroy, void,
1573 private_child_create_t *this)
1574 {
1575 chunk_free(&this->my_nonce);
1576 chunk_free(&this->other_nonce);
1577 if (this->tsr)
1578 {
1579 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1580 }
1581 if (this->tsi)
1582 {
1583 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1584 }
1585 if (!this->established)
1586 {
1587 DESTROY_IF(this->child_sa);
1588 }
1589 DESTROY_IF(this->packet_tsi);
1590 DESTROY_IF(this->packet_tsr);
1591 DESTROY_IF(this->proposal);
1592 DESTROY_IF(this->dh);
1593 if (this->proposals)
1594 {
1595 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1596 }
1597
1598 DESTROY_IF(this->config);
1599 free(this);
1600 }
1601
1602 /*
1603 * Described in header.
1604 */
1605 child_create_t *child_create_create(ike_sa_t *ike_sa,
1606 child_cfg_t *config, bool rekey,
1607 traffic_selector_t *tsi, traffic_selector_t *tsr)
1608 {
1609 private_child_create_t *this;
1610
1611 INIT(this,
1612 .public = {
1613 .get_child = _get_child,
1614 .set_config = _set_config,
1615 .get_lower_nonce = _get_lower_nonce,
1616 .use_reqid = _use_reqid,
1617 .use_marks = _use_marks,
1618 .task = {
1619 .get_type = _get_type,
1620 .migrate = _migrate,
1621 .destroy = _destroy,
1622 },
1623 },
1624 .ike_sa = ike_sa,
1625 .config = config,
1626 .packet_tsi = tsi ? tsi->clone(tsi) : NULL,
1627 .packet_tsr = tsr ? tsr->clone(tsr) : NULL,
1628 .dh_group = MODP_NONE,
1629 .keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa),
1630 .mode = MODE_TUNNEL,
1631 .tfcv3 = TRUE,
1632 .ipcomp = IPCOMP_NONE,
1633 .ipcomp_received = IPCOMP_NONE,
1634 .rekey = rekey,
1635 .retry = FALSE,
1636 );
1637
1638 if (config)
1639 {
1640 this->public.task.build = _build_i;
1641 this->public.task.process = _process_i;
1642 this->initiator = TRUE;
1643 }
1644 else
1645 {
1646 this->public.task.build = _build_r;
1647 this->public.task.process = _process_r;
1648 this->initiator = FALSE;
1649 }
1650
1651 return &this->public;
1652 }