src/libcharon/sa/ikev2/tasks/child_create.c

   1 /*
   2  * Copyright (C) 2008 Tobias Brunner
   3  * Copyright (C) 2005-2008 Martin Willi
   4  * Copyright (C) 2005 Jan Hutter
   5  * Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  */
  17
  18 #include "child_create.h"
  19
  20 #include <daemon.h>
  21 #include <sa/ikev2/keymat_v2.h>
  22 #include <crypto/diffie_hellman.h>
  23 #include <credentials/certificates/x509.h>
  24 #include <encoding/payloads/sa_payload.h>
  25 #include <encoding/payloads/ke_payload.h>
  26 #include <encoding/payloads/ts_payload.h>
  27 #include <encoding/payloads/nonce_payload.h>
  28 #include <encoding/payloads/notify_payload.h>
  29 #include <processing/jobs/delete_ike_sa_job.h>
  30 #include <processing/jobs/inactivity_job.h>
  31
  32
  33 typedef struct private_child_create_t private_child_create_t;
  34
  35 /**
  36  * Private members of a child_create_t task.
  37  */
  38 struct private_child_create_t {
  39
  40         /**
  41          * Public methods and task_t interface.
  42          */
  43         child_create_t public;
  44
  45         /**
  46          * Assigned IKE_SA.
  47          */
  48         ike_sa_t *ike_sa;
  49
  50         /**
  51          * Are we the initiator?
  52          */
  53         bool initiator;
  54
  55         /**
  56          * nonce chosen by us
  57          */
  58         chunk_t my_nonce;
  59
  60         /**
  61          * nonce chosen by peer
  62          */
  63         chunk_t other_nonce;
  64
  65         /**
  66          * config to create the CHILD_SA from
  67          */
  68         child_cfg_t *config;
  69
  70         /**
  71          * list of proposal candidates
  72          */
  73         linked_list_t *proposals;
  74
  75         /**
  76          * selected proposal to use for CHILD_SA
  77          */
  78         proposal_t *proposal;
  79
  80         /**
  81          * traffic selectors for initiators side
  82          */
  83         linked_list_t *tsi;
  84
  85         /**
  86          * traffic selectors for responders side
  87          */
  88         linked_list_t *tsr;
  89
  90         /**
  91          * source of triggering packet
  92          */
  93         traffic_selector_t *packet_tsi;
  94
  95         /**
  96          * destination of triggering packet
  97          */
  98         traffic_selector_t *packet_tsr;
  99
 100         /**
 101          * optional diffie hellman exchange
 102          */
 103         diffie_hellman_t *dh;
 104
 105         /**
 106          * group used for DH exchange
 107          */
 108         diffie_hellman_group_t dh_group;
 109
 110         /**
 111          * IKE_SAs keymat
 112          */
 113         keymat_v2_t *keymat;
 114
 115         /**
 116          * mode the new CHILD_SA uses (transport/tunnel/beet)
 117          */
 118         ipsec_mode_t mode;
 119
 120         /**
 121          * peer accepts TFC padding for this SA
 122          */
 123         bool tfcv3;
 124
 125         /**
 126          * IPComp transform to use
 127          */
 128         ipcomp_transform_t ipcomp;
 129
 130         /**
 131          * IPComp transform proposed or accepted by the other peer
 132          */
 133         ipcomp_transform_t ipcomp_received;
 134
 135         /**
 136          * Own allocated SPI
 137          */
 138         u_int32_t my_spi;
 139
 140         /**
 141          * SPI received in proposal
 142          */
 143         u_int32_t other_spi;
 144
 145         /**
 146          * Own allocated Compression Parameter Index (CPI)
 147          */
 148         u_int16_t my_cpi;
 149
 150         /**
 151          * Other Compression Parameter Index (CPI), received via IPCOMP_SUPPORTED
 152          */
 153         u_int16_t other_cpi;
 154
 155         /**
 156          * reqid to use if we are rekeying
 157          */
 158         u_int32_t reqid;
 159
 160         /**
 161          * CHILD_SA which gets established
 162          */
 163         child_sa_t *child_sa;
 164
 165         /**
 166          * successfully established the CHILD?
 167          */
 168         bool established;
 169
 170         /**
 171          * whether the CHILD_SA rekeys an existing one
 172          */
 173         bool rekey;
 174
 175         /**
 176          * whether we are retrying with another DH group
 177          */
 178         bool retry;
 179 };
 180
 181 /**
 182  * get the nonce from a message
 183  */
 184 static status_t get_nonce(message_t *message, chunk_t *nonce)
 185 {
 186         nonce_payload_t *payload;
 187
 188         payload = (nonce_payload_t*)message->get_payload(message, NONCE);
 189         if (payload == NULL)
 190         {
 191                 return FAILED;
 192         }
 193         *nonce = payload->get_nonce(payload);
 194         return NEED_MORE;
 195 }
 196
 197 /**
 198  * generate a new nonce to include in a CREATE_CHILD_SA message
 199  */
 200 static status_t generate_nonce(private_child_create_t *this)
 201 {
 202         nonce_gen_t *nonceg;
 203
 204         nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
 205         if (!nonceg)
 206         {
 207                 DBG1(DBG_IKE, "no nonce generator found to create nonce");
 208                 return FAILED;
 209         }
 210         if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, &this->my_nonce))
 211         {
 212                 DBG1(DBG_IKE, "nonce allocation failed");
 213                 nonceg->destroy(nonceg);
 214                 return FAILED;
 215         }
 216         nonceg->destroy(nonceg);
 217
 218         return SUCCESS;
 219 }
 220
 221 /**
 222  * Check a list of traffic selectors if any selector belongs to host
 223  */
 224 static bool ts_list_is_host(linked_list_t *list, host_t *host)
 225 {
 226         traffic_selector_t *ts;
 227         bool is_host = TRUE;
 228         enumerator_t *enumerator = list->create_enumerator(list);
 229
 230         while (is_host && enumerator->enumerate(enumerator, (void**)&ts))
 231         {
 232                 is_host = is_host && ts->is_host(ts, host);
 233         }
 234         enumerator->destroy(enumerator);
 235         return is_host;
 236 }
 237
 238 /**
 239  * Allocate SPIs and update proposals
 240  */
 241 static bool allocate_spi(private_child_create_t *this)
 242 {
 243         enumerator_t *enumerator;
 244         proposal_t *proposal;
 245
 246         /* TODO: allocate additional SPI for AH if we have such proposals */
 247         this->my_spi = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
 248         if (this->my_spi)
 249         {
 250                 if (this->initiator)
 251                 {
 252                         enumerator = this->proposals->create_enumerator(this->proposals);
 253                         while (enumerator->enumerate(enumerator, &proposal))
 254                         {
 255                                 proposal->set_spi(proposal, this->my_spi);
 256                         }
 257                         enumerator->destroy(enumerator);
 258                 }
 259                 else
 260                 {
 261                         this->proposal->set_spi(this->proposal, this->my_spi);
 262                 }
 263                 return TRUE;
 264         }
 265         return FALSE;
 266 }
 267
 268 /**
 269  * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
 270  */
 271 static void schedule_inactivity_timeout(private_child_create_t *this)
 272 {
 273         u_int32_t timeout;
 274         bool close_ike;
 275
 276         timeout = this->config->get_inactivity(this->config);
 277         if (timeout)
 278         {
 279                 close_ike = lib->settings->get_bool(lib->settings,
 280                                                                 "%s.inactivity_close_ike", FALSE, charon->name);
 281                 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
 282                                 inactivity_job_create(this->child_sa->get_reqid(this->child_sa),
 283                                                                           timeout, close_ike), timeout);
 284         }
 285 }
 286
 287 /**
 288  * Check if we have a an address pool configured
 289  */
 290 static bool have_pool(ike_sa_t *ike_sa)
 291 {
 292         enumerator_t *enumerator;
 293         peer_cfg_t *peer_cfg;
 294         char *pool;
 295         bool found = FALSE;
 296
 297         peer_cfg = ike_sa->get_peer_cfg(ike_sa);
 298         if (peer_cfg)
 299         {
 300                 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
 301                 if (enumerator->enumerate(enumerator, &pool))
 302                 {
 303                         found = TRUE;
 304                 }
 305                 enumerator->destroy(enumerator);
 306         }
 307         return found;
 308 }
 309
 310 /**
 311  * Get host to use for dynamic traffic selectors
 312  */
 313 static host_t *get_dynamic_host(ike_sa_t *ike_sa, bool local)
 314 {
 315         enumerator_t *enumerator;
 316         host_t *host;
 317
 318         enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
 319         if (!enumerator->enumerate(enumerator, &host))
 320         {
 321                 if (local)
 322                 {
 323                         host = ike_sa->get_my_host(ike_sa);
 324                 }
 325                 else
 326                 {
 327                         if (have_pool(ike_sa))
 328                         {
 329                                 /* we have an IP address pool, but didn't negotiate a
 330                                  * virtual IP. */
 331                                 host = NULL;
 332                         }
 333                         else
 334                         {
 335                                 host = ike_sa->get_other_host(ike_sa);
 336                         }
 337                 }
 338         }
 339         enumerator->destroy(enumerator);
 340         return host;
 341 }
 342
 343 /**
 344  * Install a CHILD_SA for usage, return value:
 345  * - FAILED: no acceptable proposal
 346  * - INVALID_ARG: diffie hellman group inacceptable
 347  * - NOT_FOUND: TS inacceptable
 348  */
 349 static status_t select_and_install(private_child_create_t *this,
 350                                                                    bool no_dh, bool ike_auth)
 351 {
 352         status_t status, status_i, status_o;
 353         chunk_t nonce_i, nonce_r;
 354         chunk_t encr_i = chunk_empty, encr_r = chunk_empty;
 355         chunk_t integ_i = chunk_empty, integ_r = chunk_empty;
 356         linked_list_t *my_ts, *other_ts;
 357         host_t *me, *other;
 358         bool private;
 359
 360         if (this->proposals == NULL)
 361         {
 362                 DBG1(DBG_IKE, "SA payload missing in message");
 363                 return FAILED;
 364         }
 365         if (this->tsi == NULL || this->tsr == NULL)
 366         {
 367                 DBG1(DBG_IKE, "TS payloads missing in message");
 368                 return NOT_FOUND;
 369         }
 370
 371         me = this->ike_sa->get_my_host(this->ike_sa);
 372         other = this->ike_sa->get_other_host(this->ike_sa);
 373
 374         private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
 375         this->proposal = this->config->select_proposal(this->config,
 376                                                                                         this->proposals, no_dh, private);
 377         if (this->proposal == NULL)
 378         {
 379                 DBG1(DBG_IKE, "no acceptable proposal found");
 380                 return FAILED;
 381         }
 382         this->other_spi = this->proposal->get_spi(this->proposal);
 383
 384         if (!this->initiator && !allocate_spi(this))
 385         {       /* responder has no SPI allocated yet */
 386                 DBG1(DBG_IKE, "allocating SPI failed");
 387                 return FAILED;
 388         }
 389         this->child_sa->set_proposal(this->child_sa, this->proposal);
 390
 391         if (!this->proposal->has_dh_group(this->proposal, this->dh_group))
 392         {
 393                 u_int16_t group;
 394
 395                 if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
 396                                                                                   &group, NULL))
 397                 {
 398                         DBG1(DBG_IKE, "DH group %N inacceptable, requesting %N",
 399                                  diffie_hellman_group_names, this->dh_group,
 400                                  diffie_hellman_group_names, group);
 401                         this->dh_group = group;
 402                         return INVALID_ARG;
 403                 }
 404                 /* the selected proposal does not use a DH group */
 405                 DBG1(DBG_IKE, "ignoring KE exchange, agreed on a non-PFS proposal");
 406                 DESTROY_IF(this->dh);
 407                 this->dh = NULL;
 408                 this->dh_group = MODP_NONE;
 409         }
 410
 411         if (this->initiator)
 412         {
 413                 nonce_i = this->my_nonce;
 414                 nonce_r = this->other_nonce;
 415                 my_ts = this->tsi;
 416                 other_ts = this->tsr;
 417         }
 418         else
 419         {
 420                 nonce_r = this->my_nonce;
 421                 nonce_i = this->other_nonce;
 422                 my_ts = this->tsr;
 423                 other_ts = this->tsi;
 424         }
 425         my_ts = this->config->get_traffic_selectors(this->config, TRUE, my_ts,
 426                                                                                 get_dynamic_host(this->ike_sa, TRUE));
 427         other_ts = this->config->get_traffic_selectors(this->config, FALSE, other_ts,
 428                                                                                 get_dynamic_host(this->ike_sa, FALSE));
 429
 430         if (this->initiator)
 431         {
 432                 if (ike_auth)
 433                 {
 434                         charon->bus->narrow(charon->bus, this->child_sa,
 435                                                                 NARROW_INITIATOR_POST_NOAUTH, my_ts, other_ts);
 436                 }
 437                 else
 438                 {
 439                         charon->bus->narrow(charon->bus, this->child_sa,
 440                                                                 NARROW_INITIATOR_POST_AUTH, my_ts, other_ts);
 441                 }
 442         }
 443         else
 444         {
 445                 charon->bus->narrow(charon->bus, this->child_sa,
 446                                                         NARROW_RESPONDER, my_ts, other_ts);
 447         }
 448
 449         if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
 450         {
 451                 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
 452                 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
 453                 DBG1(DBG_IKE, "no acceptable traffic selectors found");
 454                 return NOT_FOUND;
 455         }
 456
 457         this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
 458         this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
 459         if (this->initiator)
 460         {
 461                 this->tsi = my_ts;
 462                 this->tsr = other_ts;
 463         }
 464         else
 465         {
 466                 this->tsr = my_ts;
 467                 this->tsi = other_ts;
 468         }
 469
 470         if (!this->initiator)
 471         {
 472                 /* check if requested mode is acceptable, downgrade if required */
 473                 switch (this->mode)
 474                 {
 475                         case MODE_TRANSPORT:
 476                                 if (!this->config->use_proxy_mode(this->config) &&
 477                                            (!ts_list_is_host(this->tsi, other) ||
 478                                                 !ts_list_is_host(this->tsr, me))
 479                                    )
 480                                 {
 481                                         this->mode = MODE_TUNNEL;
 482                                         DBG1(DBG_IKE, "not using transport mode, not host-to-host");
 483                                 }
 484                                 else if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
 485                                 {
 486                                         this->mode = MODE_TUNNEL;
 487                                         DBG1(DBG_IKE, "not using transport mode, connection NATed");
 488                                 }
 489                                 break;
 490                         case MODE_BEET:
 491                                 if (!ts_list_is_host(this->tsi, NULL) ||
 492                                         !ts_list_is_host(this->tsr, NULL))
 493                                 {
 494                                         this->mode = MODE_TUNNEL;
 495                                         DBG1(DBG_IKE, "not using BEET mode, not host-to-host");
 496                                 }
 497                                 break;
 498                         default:
 499                                 break;
 500                 }
 501         }
 502
 503         this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
 504         this->child_sa->set_ipcomp(this->child_sa, this->ipcomp);
 505         this->child_sa->set_mode(this->child_sa, this->mode);
 506         this->child_sa->set_protocol(this->child_sa,
 507                                                                  this->proposal->get_protocol(this->proposal));
 508
 509         if (this->my_cpi == 0 || this->other_cpi == 0 || this->ipcomp == IPCOMP_NONE)
 510         {
 511                 this->my_cpi = this->other_cpi = 0;
 512                 this->ipcomp = IPCOMP_NONE;
 513         }
 514         status_i = status_o = FAILED;
 515         if (this->keymat->derive_child_keys(this->keymat, this->proposal,
 516                         this->dh, nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
 517         {
 518                 if (this->initiator)
 519                 {
 520                         status_i = this->child_sa->install(this->child_sa,
 521                                                         encr_r, integ_r, this->my_spi, this->my_cpi,
 522                                                         TRUE, this->tfcv3, my_ts, other_ts);
 523                         status_o = this->child_sa->install(this->child_sa,
 524                                                         encr_i, integ_i, this->other_spi, this->other_cpi,
 525                                                         FALSE, this->tfcv3, my_ts, other_ts);
 526                 }
 527                 else
 528                 {
 529                         status_i = this->child_sa->install(this->child_sa,
 530                                                         encr_i, integ_i, this->my_spi, this->my_cpi,
 531                                                         TRUE, this->tfcv3, my_ts, other_ts);
 532                         status_o = this->child_sa->install(this->child_sa,
 533                                                         encr_r, integ_r, this->other_spi, this->other_cpi,
 534                                                         FALSE, this->tfcv3, my_ts, other_ts);
 535                 }
 536         }
 537         chunk_clear(&integ_i);
 538         chunk_clear(&integ_r);
 539         chunk_clear(&encr_i);
 540         chunk_clear(&encr_r);
 541
 542         if (status_i != SUCCESS || status_o != SUCCESS)
 543         {
 544                 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
 545                         (status_i != SUCCESS) ? "inbound " : "",
 546                         (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
 547                         (status_o != SUCCESS) ? "outbound " : "");
 548                 return FAILED;
 549         }
 550
 551         if (this->initiator)
 552         {
 553                 status = this->child_sa->add_policies(this->child_sa, my_ts, other_ts);
 554         }
 555         else
 556         {
 557                 /* use a copy of the traffic selectors, as the POST hook should not
 558                  * change payloads */
 559                 my_ts = this->tsr->clone_offset(this->tsr,
 560                                                                                 offsetof(traffic_selector_t, clone));
 561                 other_ts = this->tsi->clone_offset(this->tsi,
 562                                                                                 offsetof(traffic_selector_t, clone));
 563                 charon->bus->narrow(charon->bus, this->child_sa,
 564                                                         NARROW_RESPONDER_POST, my_ts, other_ts);
 565                 if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
 566                 {
 567                         status = FAILED;
 568                 }
 569                 else
 570                 {
 571                         status = this->child_sa->add_policies(this->child_sa,
 572                                                                                                    my_ts, other_ts);
 573                 }
 574                 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
 575                 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
 576         }
 577         if (status != SUCCESS)
 578         {
 579                 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
 580                 return NOT_FOUND;
 581         }
 582
 583         charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
 584                                                         this->dh, nonce_i, nonce_r);
 585
 586         /* add to IKE_SA, and remove from task */
 587         this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 588         this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
 589         this->established = TRUE;
 590
 591         if (!this->rekey)
 592         {       /* a rekeyed SA uses the same reqid, no need for a new job */
 593                 schedule_inactivity_timeout(this);
 594         }
 595         return SUCCESS;
 596 }
 597
 598 /**
 599  * build the payloads for the message
 600  */
 601 static void build_payloads(private_child_create_t *this, message_t *message)
 602 {
 603         sa_payload_t *sa_payload;
 604         nonce_payload_t *nonce_payload;
 605         ke_payload_t *ke_payload;
 606         ts_payload_t *ts_payload;
 607
 608         /* add SA payload */
 609         if (this->initiator)
 610         {
 611                 sa_payload = sa_payload_create_from_proposals_v2(this->proposals);
 612         }
 613         else
 614         {
 615                 sa_payload = sa_payload_create_from_proposal_v2(this->proposal);
 616         }
 617         message->add_payload(message, (payload_t*)sa_payload);
 618
 619         /* add nonce payload if not in IKE_AUTH */
 620         if (message->get_exchange_type(message) == CREATE_CHILD_SA)
 621         {
 622                 nonce_payload = nonce_payload_create(NONCE);
 623                 nonce_payload->set_nonce(nonce_payload, this->my_nonce);
 624                 message->add_payload(message, (payload_t*)nonce_payload);
 625         }
 626
 627         /* diffie hellman exchange, if PFS enabled */
 628         if (this->dh)
 629         {
 630                 ke_payload = ke_payload_create_from_diffie_hellman(KEY_EXCHANGE,
 631                                                                                                                    this->dh);
 632                 message->add_payload(message, (payload_t*)ke_payload);
 633         }
 634
 635         /* add TSi/TSr payloads */
 636         ts_payload = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
 637         message->add_payload(message, (payload_t*)ts_payload);
 638         ts_payload = ts_payload_create_from_traffic_selectors(FALSE, this->tsr);
 639         message->add_payload(message, (payload_t*)ts_payload);
 640
 641         /* add a notify if we are not in tunnel mode */
 642         switch (this->mode)
 643         {
 644                 case MODE_TRANSPORT:
 645                         message->add_notify(message, FALSE, USE_TRANSPORT_MODE, chunk_empty);
 646                         break;
 647                 case MODE_BEET:
 648                         message->add_notify(message, FALSE, USE_BEET_MODE, chunk_empty);
 649                         break;
 650                 default:
 651                         break;
 652         }
 653 }
 654
 655 /**
 656  * Adds an IPCOMP_SUPPORTED notify to the message, allocating a CPI
 657  */
 658 static void add_ipcomp_notify(private_child_create_t *this,
 659                                                                   message_t *message, u_int8_t ipcomp)
 660 {
 661         if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
 662         {
 663                 DBG1(DBG_IKE, "IPComp is not supported if either peer is natted, "
 664                          "IPComp disabled");
 665                 return;
 666         }
 667
 668         this->my_cpi = this->child_sa->alloc_cpi(this->child_sa);
 669         if (this->my_cpi)
 670         {
 671                 this->ipcomp = ipcomp;
 672                 message->add_notify(message, FALSE, IPCOMP_SUPPORTED,
 673                                                         chunk_cata("cc", chunk_from_thing(this->my_cpi),
 674                                                                            chunk_from_thing(ipcomp)));
 675         }
 676         else
 677         {
 678                 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, IPComp disabled");
 679         }
 680 }
 681
 682 /**
 683  * handle a received notify payload
 684  */
 685 static void handle_notify(private_child_create_t *this, notify_payload_t *notify)
 686 {
 687         switch (notify->get_notify_type(notify))
 688         {
 689                 case USE_TRANSPORT_MODE:
 690                         this->mode = MODE_TRANSPORT;
 691                         break;
 692                 case USE_BEET_MODE:
 693                         if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
 694                         {       /* handle private use notify only if we know its meaning */
 695                                 this->mode = MODE_BEET;
 696                         }
 697                         else
 698                         {
 699                                 DBG1(DBG_IKE, "received a notify strongSwan uses for BEET "
 700                                          "mode, but peer implementation unknown, skipped");
 701                         }
 702                         break;
 703                 case IPCOMP_SUPPORTED:
 704                 {
 705                         ipcomp_transform_t ipcomp;
 706                         u_int16_t cpi;
 707                         chunk_t data;
 708
 709                         data = notify->get_notification_data(notify);
 710                         cpi = *(u_int16_t*)data.ptr;
 711                         ipcomp = (ipcomp_transform_t)(*(data.ptr + 2));
 712                         switch (ipcomp)
 713                         {
 714                                 case IPCOMP_DEFLATE:
 715                                         this->other_cpi = cpi;
 716                                         this->ipcomp_received = ipcomp;
 717                                         break;
 718                                 case IPCOMP_LZS:
 719                                 case IPCOMP_LZJH:
 720                                 default:
 721                                         DBG1(DBG_IKE, "received IPCOMP_SUPPORTED notify with a "
 722                                                  "transform ID we don't support %N",
 723                                                  ipcomp_transform_names, ipcomp);
 724                                         break;
 725                         }
 726                         break;
 727                 }
 728                 case ESP_TFC_PADDING_NOT_SUPPORTED:
 729                         DBG1(DBG_IKE, "received %N, not using ESPv3 TFC padding",
 730                                  notify_type_names, notify->get_notify_type(notify));
 731                         this->tfcv3 = FALSE;
 732                         break;
 733                 default:
 734                         break;
 735         }
 736 }
 737
 738 /**
 739  * Read payloads from message
 740  */
 741 static void process_payloads(private_child_create_t *this, message_t *message)
 742 {
 743         enumerator_t *enumerator;
 744         payload_t *payload;
 745         sa_payload_t *sa_payload;
 746         ke_payload_t *ke_payload;
 747         ts_payload_t *ts_payload;
 748
 749         /* defaults to TUNNEL mode */
 750         this->mode = MODE_TUNNEL;
 751
 752         enumerator = message->create_payload_enumerator(message);
 753         while (enumerator->enumerate(enumerator, &payload))
 754         {
 755                 switch (payload->get_type(payload))
 756                 {
 757                         case SECURITY_ASSOCIATION:
 758                                 sa_payload = (sa_payload_t*)payload;
 759                                 this->proposals = sa_payload->get_proposals(sa_payload);
 760                                 break;
 761                         case KEY_EXCHANGE:
 762                                 ke_payload = (ke_payload_t*)payload;
 763                                 if (!this->initiator)
 764                                 {
 765                                         this->dh_group = ke_payload->get_dh_group_number(ke_payload);
 766                                         this->dh = this->keymat->keymat.create_dh(
 767                                                                                 &this->keymat->keymat, this->dh_group);
 768                                 }
 769                                 if (this->dh)
 770                                 {
 771                                         this->dh->set_other_public_value(this->dh,
 772                                                                 ke_payload->get_key_exchange_data(ke_payload));
 773                                 }
 774                                 break;
 775                         case TRAFFIC_SELECTOR_INITIATOR:
 776                                 ts_payload = (ts_payload_t*)payload;
 777                                 this->tsi = ts_payload->get_traffic_selectors(ts_payload);
 778                                 break;
 779                         case TRAFFIC_SELECTOR_RESPONDER:
 780                                 ts_payload = (ts_payload_t*)payload;
 781                                 this->tsr = ts_payload->get_traffic_selectors(ts_payload);
 782                                 break;
 783                         case NOTIFY:
 784                                 handle_notify(this, (notify_payload_t*)payload);
 785                                 break;
 786                         default:
 787                                 break;
 788                 }
 789         }
 790         enumerator->destroy(enumerator);
 791 }
 792
 793 METHOD(task_t, build_i, status_t,
 794         private_child_create_t *this, message_t *message)
 795 {
 796         enumerator_t *enumerator;
 797         host_t *vip;
 798         peer_cfg_t *peer_cfg;
 799
 800         switch (message->get_exchange_type(message))
 801         {
 802                 case IKE_SA_INIT:
 803                         return get_nonce(message, &this->my_nonce);
 804                 case CREATE_CHILD_SA:
 805                         if (generate_nonce(this) != SUCCESS)
 806                         {
 807                                 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
 808                                 return SUCCESS;
 809                         }
 810                         if (!this->retry)
 811                         {
 812                                 this->dh_group = this->config->get_dh_group(this->config);
 813                         }
 814                         break;
 815                 case IKE_AUTH:
 816                         if (message->get_message_id(message) != 1)
 817                         {
 818                                 /* send only in the first request, not in subsequent rounds */
 819                                 return NEED_MORE;
 820                         }
 821                         break;
 822                 default:
 823                         break;
 824         }
 825
 826         if (this->reqid)
 827         {
 828                 DBG0(DBG_IKE, "establishing CHILD_SA %s{%d}",
 829                          this->config->get_name(this->config), this->reqid);
 830         }
 831         else
 832         {
 833                 DBG0(DBG_IKE, "establishing CHILD_SA %s",
 834                          this->config->get_name(this->config));
 835         }
 836
 837         /* check if we want a virtual IP, but don't have one */
 838         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 839         enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
 840         if (!this->reqid && enumerator->enumerate(enumerator, &vip))
 841         {
 842                 /* propose a 0.0.0.0/0 or ::/0 subnet when we use virtual ip */
 843                 vip = host_create_any(vip->get_family(vip));
 844                 this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
 845                                                                                                                 NULL, vip);
 846                 vip->destroy(vip);
 847         }
 848         else
 849         {       /* but narrow it for host2host / if we already have a vip */
 850                 this->tsi = this->config->get_traffic_selectors(this->config, TRUE, NULL,
 851                                                                                 get_dynamic_host(this->ike_sa, TRUE));
 852         }
 853         enumerator->destroy(enumerator);
 854         this->tsr = this->config->get_traffic_selectors(this->config, FALSE, NULL,
 855                                                                                 get_dynamic_host(this->ike_sa, FALSE));
 856
 857         if (this->packet_tsi)
 858         {
 859                 this->tsi->insert_first(this->tsi,
 860                                                                 this->packet_tsi->clone(this->packet_tsi));
 861         }
 862         if (this->packet_tsr)
 863         {
 864                 this->tsr->insert_first(this->tsr,
 865                                                                 this->packet_tsr->clone(this->packet_tsr));
 866         }
 867         this->proposals = this->config->get_proposals(this->config,
 868                                                                                                   this->dh_group == MODP_NONE);
 869         this->mode = this->config->get_mode(this->config);
 870         if (this->mode == MODE_TRANSPORT &&
 871                 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
 872         {
 873                 this->mode = MODE_TUNNEL;
 874                 DBG1(DBG_IKE, "not using transport mode, connection NATed");
 875         }
 876
 877         this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
 878                         this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
 879                         this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
 880
 881         if (!allocate_spi(this))
 882         {
 883                 DBG1(DBG_IKE, "unable to allocate SPIs from kernel");
 884                 return FAILED;
 885         }
 886
 887         if (this->dh_group != MODP_NONE)
 888         {
 889                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
 890                                                                                                   this->dh_group);
 891         }
 892
 893         if (this->config->use_ipcomp(this->config))
 894         {
 895                 /* IPCOMP_DEFLATE is the only transform we support at the moment */
 896                 add_ipcomp_notify(this, message, IPCOMP_DEFLATE);
 897         }
 898
 899         if (message->get_exchange_type(message) == IKE_AUTH)
 900         {
 901                 charon->bus->narrow(charon->bus, this->child_sa,
 902                                                         NARROW_INITIATOR_PRE_NOAUTH, this->tsi, this->tsr);
 903         }
 904         else
 905         {
 906                 charon->bus->narrow(charon->bus, this->child_sa,
 907                                                         NARROW_INITIATOR_PRE_AUTH, this->tsi, this->tsr);
 908         }
 909
 910         build_payloads(this, message);
 911
 912         this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
 913         this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
 914         this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
 915         this->tsi = NULL;
 916         this->tsr = NULL;
 917         this->proposals = NULL;
 918
 919         return NEED_MORE;
 920 }
 921
 922 METHOD(task_t, process_r, status_t,
 923         private_child_create_t *this, message_t *message)
 924 {
 925         switch (message->get_exchange_type(message))
 926         {
 927                 case IKE_SA_INIT:
 928                         return get_nonce(message, &this->other_nonce);
 929                 case CREATE_CHILD_SA:
 930                         get_nonce(message, &this->other_nonce);
 931                         break;
 932                 case IKE_AUTH:
 933                         if (message->get_message_id(message) != 1)
 934                         {
 935                                 /* only handle first AUTH payload, not additional rounds */
 936                                 return NEED_MORE;
 937                         }
 938                 default:
 939                         break;
 940         }
 941
 942         process_payloads(this, message);
 943
 944         return NEED_MORE;
 945 }
 946
 947 /**
 948  * handle CHILD_SA setup failure
 949  */
 950 static void handle_child_sa_failure(private_child_create_t *this,
 951                                                                         message_t *message)
 952 {
 953         if (message->get_exchange_type(message) == IKE_AUTH &&
 954                 lib->settings->get_bool(lib->settings,
 955                                                                 "%s.close_ike_on_child_failure", FALSE, charon->name))
 956         {
 957                 /* we delay the delete for 100ms, as the IKE_AUTH response must arrive
 958                  * first */
 959                 DBG1(DBG_IKE, "closing IKE_SA due CHILD_SA setup failure");
 960                 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
 961                         delete_ike_sa_job_create(this->ike_sa->get_id(this->ike_sa), TRUE),
 962                         100);
 963         }
 964         else
 965         {
 966                 DBG1(DBG_IKE, "failed to establish CHILD_SA, keeping IKE_SA");
 967         }
 968 }
 969
 970 METHOD(task_t, build_r, status_t,
 971         private_child_create_t *this, message_t *message)
 972 {
 973         peer_cfg_t *peer_cfg;
 974         payload_t *payload;
 975         enumerator_t *enumerator;
 976         bool no_dh = TRUE, ike_auth = FALSE;
 977
 978         switch (message->get_exchange_type(message))
 979         {
 980                 case IKE_SA_INIT:
 981                         return get_nonce(message, &this->my_nonce);
 982                 case CREATE_CHILD_SA:
 983                         if (generate_nonce(this) != SUCCESS)
 984                         {
 985                                 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN,
 986                                                                         chunk_empty);
 987                                 return SUCCESS;
 988                         }
 989                         no_dh = FALSE;
 990                         break;
 991                 case IKE_AUTH:
 992                         if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
 993                         {       /* wait until all authentication round completed */
 994                                 return NEED_MORE;
 995                         }
 996                         ike_auth = TRUE;
 997                 default:
 998                         break;
 999         }
1000
1001         if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
1002         {
1003                 DBG1(DBG_IKE, "unable to create CHILD_SA while rekeying IKE_SA");
1004                 message->add_notify(message, TRUE, NO_ADDITIONAL_SAS, chunk_empty);
1005                 return SUCCESS;
1006         }
1007
1008         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1009         if (!this->config && peer_cfg && this->tsi && this->tsr)
1010         {
1011                 this->config = peer_cfg->select_child_cfg(peer_cfg,
1012                                                                                 this->tsr, this->tsi,
1013                                                                                 get_dynamic_host(this->ike_sa, TRUE),
1014                                                                                 get_dynamic_host(this->ike_sa, FALSE));
1015         }
1016
1017         if (this->config == NULL)
1018         {
1019                 DBG1(DBG_IKE, "traffic selectors %#R=== %#R inacceptable",
1020                          this->tsr, this->tsi);
1021                 message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
1022                 handle_child_sa_failure(this, message);
1023                 return SUCCESS;
1024         }
1025
1026         /* check if ike_config_t included non-critical error notifies */
1027         enumerator = message->create_payload_enumerator(message);
1028         while (enumerator->enumerate(enumerator, &payload))
1029         {
1030                 if (payload->get_type(payload) == NOTIFY)
1031                 {
1032                         notify_payload_t *notify = (notify_payload_t*)payload;
1033
1034                         switch (notify->get_notify_type(notify))
1035                         {
1036                                 case INTERNAL_ADDRESS_FAILURE:
1037                                 case FAILED_CP_REQUIRED:
1038                                 {
1039                                         DBG1(DBG_IKE,"configuration payload negotiation "
1040                                                  "failed, no CHILD_SA built");
1041                                         enumerator->destroy(enumerator);
1042                                         handle_child_sa_failure(this, message);
1043                                         return SUCCESS;
1044                                 }
1045                                 default:
1046                                         break;
1047                         }
1048                 }
1049         }
1050         enumerator->destroy(enumerator);
1051
1052         this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
1053                         this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
1054                         this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
1055
1056         if (this->ipcomp_received != IPCOMP_NONE)
1057         {
1058                 if (this->config->use_ipcomp(this->config))
1059                 {
1060                         add_ipcomp_notify(this, message, this->ipcomp_received);
1061                 }
1062                 else
1063                 {
1064                         DBG1(DBG_IKE, "received %N notify but IPComp is disabled, ignoring",
1065                                  notify_type_names, IPCOMP_SUPPORTED);
1066                 }
1067         }
1068
1069         switch (select_and_install(this, no_dh, ike_auth))
1070         {
1071                 case SUCCESS:
1072                         break;
1073                 case NOT_FOUND:
1074                         message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
1075                         handle_child_sa_failure(this, message);
1076                         return SUCCESS;
1077                 case INVALID_ARG:
1078                 {
1079                         u_int16_t group = htons(this->dh_group);
1080                         message->add_notify(message, FALSE, INVALID_KE_PAYLOAD,
1081                                                                 chunk_from_thing(group));
1082                         handle_child_sa_failure(this, message);
1083                         return SUCCESS;
1084                 }
1085                 case FAILED:
1086                 default:
1087                         message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
1088                         handle_child_sa_failure(this, message);
1089                         return SUCCESS;
1090         }
1091
1092         build_payloads(this, message);
1093
1094         DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
1095                  "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
1096                  this->child_sa->get_name(this->child_sa),
1097                  this->child_sa->get_reqid(this->child_sa),
1098                  ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
1099                  ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
1100                  this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
1101                  this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
1102
1103         if (!this->rekey)
1104         {       /* invoke the child_up() hook if we are not rekeying */
1105                 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1106         }
1107         return SUCCESS;
1108 }
1109
1110 METHOD(task_t, process_i, status_t,
1111         private_child_create_t *this, message_t *message)
1112 {
1113         enumerator_t *enumerator;
1114         payload_t *payload;
1115         bool no_dh = TRUE, ike_auth = FALSE;
1116
1117         switch (message->get_exchange_type(message))
1118         {
1119                 case IKE_SA_INIT:
1120                         return get_nonce(message, &this->other_nonce);
1121                 case CREATE_CHILD_SA:
1122                         get_nonce(message, &this->other_nonce);
1123                         no_dh = FALSE;
1124                         break;
1125                 case IKE_AUTH:
1126                         if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1127                         {       /* wait until all authentication round completed */
1128                                 return NEED_MORE;
1129                         }
1130                         ike_auth = TRUE;
1131                 default:
1132                         break;
1133         }
1134
1135         /* check for erronous notifies */
1136         enumerator = message->create_payload_enumerator(message);
1137         while (enumerator->enumerate(enumerator, &payload))
1138         {
1139                 if (payload->get_type(payload) == NOTIFY)
1140                 {
1141                         notify_payload_t *notify = (notify_payload_t*)payload;
1142                         notify_type_t type = notify->get_notify_type(notify);
1143
1144                         switch (type)
1145                         {
1146                                 /* handle notify errors related to CHILD_SA only */
1147                                 case NO_PROPOSAL_CHOSEN:
1148                                 case SINGLE_PAIR_REQUIRED:
1149                                 case NO_ADDITIONAL_SAS:
1150                                 case INTERNAL_ADDRESS_FAILURE:
1151                                 case FAILED_CP_REQUIRED:
1152                                 case TS_UNACCEPTABLE:
1153                                 case INVALID_SELECTORS:
1154                                 {
1155                                         DBG1(DBG_IKE, "received %N notify, no CHILD_SA built",
1156                                                  notify_type_names, type);
1157                                         enumerator->destroy(enumerator);
1158                                         handle_child_sa_failure(this, message);
1159                                         /* an error in CHILD_SA creation is not critical */
1160                                         return SUCCESS;
1161                                 }
1162                                 case INVALID_KE_PAYLOAD:
1163                                 {
1164                                         chunk_t data;
1165                                         u_int16_t group = MODP_NONE;
1166
1167                                         data = notify->get_notification_data(notify);
1168                                         if (data.len == sizeof(group))
1169                                         {
1170                                                 memcpy(&group, data.ptr, data.len);
1171                                                 group = ntohs(group);
1172                                         }
1173                                         DBG1(DBG_IKE, "peer didn't accept DH group %N, "
1174                                                  "it requested %N", diffie_hellman_group_names,
1175                                                  this->dh_group, diffie_hellman_group_names, group);
1176                                         this->retry = TRUE;
1177                                         this->dh_group = group;
1178                                         this->public.task.migrate(&this->public.task, this->ike_sa);
1179                                         enumerator->destroy(enumerator);
1180                                         return NEED_MORE;
1181                                 }
1182                                 default:
1183                                 {
1184                                         if (message->get_exchange_type(message) == CREATE_CHILD_SA)
1185                                         {       /* handle notifies if not handled in IKE_AUTH */
1186                                                 if (type <= 16383)
1187                                                 {
1188                                                         DBG1(DBG_IKE, "received %N notify error",
1189                                                                  notify_type_names, type);
1190                                                         enumerator->destroy(enumerator);
1191                                                         return SUCCESS;
1192                                                 }
1193                                                 DBG2(DBG_IKE, "received %N notify",
1194                                                          notify_type_names, type);
1195                                         }
1196                                         break;
1197                                 }
1198                         }
1199                 }
1200         }
1201         enumerator->destroy(enumerator);
1202
1203         process_payloads(this, message);
1204
1205         if (this->ipcomp == IPCOMP_NONE && this->ipcomp_received != IPCOMP_NONE)
1206         {
1207                 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify without requesting"
1208                          " one, no CHILD_SA built");
1209                 handle_child_sa_failure(this, message);
1210                 return SUCCESS;
1211         }
1212         else if (this->ipcomp != IPCOMP_NONE && this->ipcomp_received == IPCOMP_NONE)
1213         {
1214                 DBG1(DBG_IKE, "peer didn't accept our proposed IPComp transforms, "
1215                          "IPComp is disabled");
1216                 this->ipcomp = IPCOMP_NONE;
1217         }
1218         else if (this->ipcomp != IPCOMP_NONE && this->ipcomp != this->ipcomp_received)
1219         {
1220                 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify we didn't propose, "
1221                          "no CHILD_SA built");
1222                 handle_child_sa_failure(this, message);
1223                 return SUCCESS;
1224         }
1225
1226         if (select_and_install(this, no_dh, ike_auth) == SUCCESS)
1227         {
1228                 DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
1229                          "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
1230                          this->child_sa->get_name(this->child_sa),
1231                          this->child_sa->get_reqid(this->child_sa),
1232                          ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
1233                          ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
1234                          this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
1235                          this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
1236
1237                 if (!this->rekey)
1238                 {       /* invoke the child_up() hook if we are not rekeying */
1239                         charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1240                 }
1241         }
1242         else
1243         {
1244                 handle_child_sa_failure(this, message);
1245         }
1246         return SUCCESS;
1247 }
1248
1249 METHOD(child_create_t, use_reqid, void,
1250         private_child_create_t *this, u_int32_t reqid)
1251 {
1252         this->reqid = reqid;
1253 }
1254
1255 METHOD(child_create_t, get_child, child_sa_t*,
1256         private_child_create_t *this)
1257 {
1258         return this->child_sa;
1259 }
1260
1261 METHOD(child_create_t, set_config, void,
1262         private_child_create_t *this, child_cfg_t *cfg)
1263 {
1264         DESTROY_IF(this->config);
1265         this->config = cfg;
1266 }
1267
1268 METHOD(child_create_t, get_lower_nonce, chunk_t,
1269         private_child_create_t *this)
1270 {
1271         if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
1272                            min(this->my_nonce.len, this->other_nonce.len)) < 0)
1273         {
1274                 return this->my_nonce;
1275         }
1276         else
1277         {
1278                 return this->other_nonce;
1279         }
1280 }
1281
1282 METHOD(task_t, get_type, task_type_t,
1283         private_child_create_t *this)
1284 {
1285         return TASK_CHILD_CREATE;
1286 }
1287
1288 METHOD(task_t, migrate, void,
1289         private_child_create_t *this, ike_sa_t *ike_sa)
1290 {
1291         chunk_free(&this->my_nonce);
1292         chunk_free(&this->other_nonce);
1293         if (this->tsr)
1294         {
1295                 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1296         }
1297         if (this->tsi)
1298         {
1299                 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1300         }
1301         DESTROY_IF(this->child_sa);
1302         DESTROY_IF(this->proposal);
1303         DESTROY_IF(this->dh);
1304         if (this->proposals)
1305         {
1306                 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1307         }
1308
1309         this->ike_sa = ike_sa;
1310         this->keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa);
1311         this->proposal = NULL;
1312         this->proposals = NULL;
1313         this->tsi = NULL;
1314         this->tsr = NULL;
1315         this->dh = NULL;
1316         this->child_sa = NULL;
1317         this->mode = MODE_TUNNEL;
1318         this->ipcomp = IPCOMP_NONE;
1319         this->ipcomp_received = IPCOMP_NONE;
1320         this->other_cpi = 0;
1321         this->reqid = 0;
1322         this->established = FALSE;
1323 }
1324
1325 METHOD(task_t, destroy, void,
1326         private_child_create_t *this)
1327 {
1328         chunk_free(&this->my_nonce);
1329         chunk_free(&this->other_nonce);
1330         if (this->tsr)
1331         {
1332                 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1333         }
1334         if (this->tsi)
1335         {
1336                 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1337         }
1338         if (!this->established)
1339         {
1340                 DESTROY_IF(this->child_sa);
1341         }
1342         DESTROY_IF(this->packet_tsi);
1343         DESTROY_IF(this->packet_tsr);
1344         DESTROY_IF(this->proposal);
1345         DESTROY_IF(this->dh);
1346         if (this->proposals)
1347         {
1348                 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1349         }
1350
1351         DESTROY_IF(this->config);
1352         free(this);
1353 }
1354
1355 /*
1356  * Described in header.
1357  */
1358 child_create_t *child_create_create(ike_sa_t *ike_sa,
1359                                                         child_cfg_t *config, bool rekey,
1360                                                         traffic_selector_t *tsi, traffic_selector_t *tsr)
1361 {
1362         private_child_create_t *this;
1363
1364         INIT(this,
1365                 .public = {
1366                         .get_child = _get_child,
1367                         .set_config = _set_config,
1368                         .get_lower_nonce = _get_lower_nonce,
1369                         .use_reqid = _use_reqid,
1370                         .task = {
1371                                 .get_type = _get_type,
1372                                 .migrate = _migrate,
1373                                 .destroy = _destroy,
1374                         },
1375                 },
1376                 .ike_sa = ike_sa,
1377                 .config = config,
1378                 .packet_tsi = tsi ? tsi->clone(tsi) : NULL,
1379                 .packet_tsr = tsr ? tsr->clone(tsr) : NULL,
1380                 .dh_group = MODP_NONE,
1381                 .keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa),
1382                 .mode = MODE_TUNNEL,
1383                 .tfcv3 = TRUE,
1384                 .ipcomp = IPCOMP_NONE,
1385                 .ipcomp_received = IPCOMP_NONE,
1386                 .rekey = rekey,
1387                 .retry = FALSE,
1388         );
1389
1390         if (config)
1391         {
1392                 this->public.task.build = _build_i;
1393                 this->public.task.process = _process_i;
1394                 this->initiator = TRUE;
1395         }
1396         else
1397         {
1398                 this->public.task.build = _build_r;
1399                 this->public.task.process = _process_r;
1400                 this->initiator = FALSE;
1401         }
1402
1403         return &this->public;
1404 }