Refer to scheduler via hydra and not charon.
[strongswan.git] / src / libcharon / sa / tasks / child_create.c
1 /*
2 * Copyright (C) 2008 Tobias Brunner
3 * Copyright (C) 2005-2008 Martin Willi
4 * Copyright (C) 2005 Jan Hutter
5 * Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #include "child_create.h"
19
20 #include <hydra.h>
21 #include <daemon.h>
22 #include <crypto/diffie_hellman.h>
23 #include <credentials/certificates/x509.h>
24 #include <encoding/payloads/sa_payload.h>
25 #include <encoding/payloads/ke_payload.h>
26 #include <encoding/payloads/ts_payload.h>
27 #include <encoding/payloads/nonce_payload.h>
28 #include <encoding/payloads/notify_payload.h>
29 #include <processing/jobs/delete_ike_sa_job.h>
30 #include <processing/jobs/inactivity_job.h>
31
32
33 typedef struct private_child_create_t private_child_create_t;
34
35 /**
36 * Private members of a child_create_t task.
37 */
38 struct private_child_create_t {
39
40 /**
41 * Public methods and task_t interface.
42 */
43 child_create_t public;
44
45 /**
46 * Assigned IKE_SA.
47 */
48 ike_sa_t *ike_sa;
49
50 /**
51 * Are we the initiator?
52 */
53 bool initiator;
54
55 /**
56 * nonce chosen by us
57 */
58 chunk_t my_nonce;
59
60 /**
61 * nonce chosen by peer
62 */
63 chunk_t other_nonce;
64
65 /**
66 * config to create the CHILD_SA from
67 */
68 child_cfg_t *config;
69
70 /**
71 * list of proposal candidates
72 */
73 linked_list_t *proposals;
74
75 /**
76 * selected proposal to use for CHILD_SA
77 */
78 proposal_t *proposal;
79
80 /**
81 * traffic selectors for initiators side
82 */
83 linked_list_t *tsi;
84
85 /**
86 * traffic selectors for responders side
87 */
88 linked_list_t *tsr;
89
90 /**
91 * source of triggering packet
92 */
93 traffic_selector_t *packet_tsi;
94
95 /**
96 * destination of triggering packet
97 */
98 traffic_selector_t *packet_tsr;
99
100 /**
101 * optional diffie hellman exchange
102 */
103 diffie_hellman_t *dh;
104
105 /**
106 * group used for DH exchange
107 */
108 diffie_hellman_group_t dh_group;
109
110 /**
111 * IKE_SAs keymat
112 */
113 keymat_t *keymat;
114
115 /**
116 * mode the new CHILD_SA uses (transport/tunnel/beet)
117 */
118 ipsec_mode_t mode;
119
120 /**
121 * IPComp transform to use
122 */
123 ipcomp_transform_t ipcomp;
124
125 /**
126 * IPComp transform proposed or accepted by the other peer
127 */
128 ipcomp_transform_t ipcomp_received;
129
130 /**
131 * Own allocated SPI
132 */
133 u_int32_t my_spi;
134
135 /**
136 * SPI received in proposal
137 */
138 u_int32_t other_spi;
139
140 /**
141 * Own allocated Compression Parameter Index (CPI)
142 */
143 u_int16_t my_cpi;
144
145 /**
146 * Other Compression Parameter Index (CPI), received via IPCOMP_SUPPORTED
147 */
148 u_int16_t other_cpi;
149
150 /**
151 * reqid to use if we are rekeying
152 */
153 u_int32_t reqid;
154
155 /**
156 * CHILD_SA which gets established
157 */
158 child_sa_t *child_sa;
159
160 /**
161 * successfully established the CHILD?
162 */
163 bool established;
164
165 /**
166 * whether the CHILD_SA rekeys an existing one
167 */
168 bool rekey;
169 };
170
171 /**
172 * get the nonce from a message
173 */
174 static status_t get_nonce(message_t *message, chunk_t *nonce)
175 {
176 nonce_payload_t *payload;
177
178 payload = (nonce_payload_t*)message->get_payload(message, NONCE);
179 if (payload == NULL)
180 {
181 return FAILED;
182 }
183 *nonce = payload->get_nonce(payload);
184 return NEED_MORE;
185 }
186
187 /**
188 * generate a new nonce to include in a CREATE_CHILD_SA message
189 */
190 static status_t generate_nonce(chunk_t *nonce)
191 {
192 rng_t *rng;
193
194 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
195 if (!rng)
196 {
197 DBG1(DBG_IKE, "error generating nonce value, no RNG found");
198 return FAILED;
199 }
200 rng->allocate_bytes(rng, NONCE_SIZE, nonce);
201 rng->destroy(rng);
202 return SUCCESS;
203 }
204
205 /**
206 * Check a list of traffic selectors if any selector belongs to host
207 */
208 static bool ts_list_is_host(linked_list_t *list, host_t *host)
209 {
210 traffic_selector_t *ts;
211 bool is_host = TRUE;
212 iterator_t *iterator = list->create_iterator(list, TRUE);
213
214 while (is_host && iterator->iterate(iterator, (void**)&ts))
215 {
216 is_host = is_host && ts->is_host(ts, host);
217 }
218 iterator->destroy(iterator);
219 return is_host;
220 }
221
222 /**
223 * Allocate SPIs and update proposals
224 */
225 static bool allocate_spi(private_child_create_t *this)
226 {
227 enumerator_t *enumerator;
228 proposal_t *proposal;
229
230 /* TODO: allocate additional SPI for AH if we have such proposals */
231 this->my_spi = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
232 if (this->my_spi)
233 {
234 if (this->initiator)
235 {
236 enumerator = this->proposals->create_enumerator(this->proposals);
237 while (enumerator->enumerate(enumerator, &proposal))
238 {
239 proposal->set_spi(proposal, this->my_spi);
240 }
241 enumerator->destroy(enumerator);
242 }
243 else
244 {
245 this->proposal->set_spi(this->proposal, this->my_spi);
246 }
247 return TRUE;
248 }
249 return FALSE;
250 }
251
252 /**
253 * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
254 */
255 static void schedule_inactivity_timeout(private_child_create_t *this)
256 {
257 u_int32_t timeout;
258 bool close_ike;
259
260 timeout = this->config->get_inactivity(this->config);
261 if (timeout)
262 {
263 close_ike = lib->settings->get_bool(lib->settings,
264 "charon.inactivity_close_ike", FALSE);
265 hydra->scheduler->schedule_job(hydra->scheduler, (job_t*)
266 inactivity_job_create(this->child_sa->get_reqid(this->child_sa),
267 timeout, close_ike), timeout);
268 }
269 }
270
271 /**
272 * Install a CHILD_SA for usage, return value:
273 * - FAILED: no acceptable proposal
274 * - INVALID_ARG: diffie hellman group inacceptable
275 * - NOT_FOUND: TS inacceptable
276 */
277 static status_t select_and_install(private_child_create_t *this,
278 bool no_dh, bool ike_auth)
279 {
280 status_t status, status_i, status_o;
281 chunk_t nonce_i, nonce_r;
282 chunk_t encr_i = chunk_empty, encr_r = chunk_empty;
283 chunk_t integ_i = chunk_empty, integ_r = chunk_empty;
284 linked_list_t *my_ts, *other_ts;
285 host_t *me, *other, *other_vip, *my_vip;
286 bool private;
287
288 if (this->proposals == NULL)
289 {
290 DBG1(DBG_IKE, "SA payload missing in message");
291 return FAILED;
292 }
293 if (this->tsi == NULL || this->tsr == NULL)
294 {
295 DBG1(DBG_IKE, "TS payloads missing in message");
296 return NOT_FOUND;
297 }
298
299 me = this->ike_sa->get_my_host(this->ike_sa);
300 other = this->ike_sa->get_other_host(this->ike_sa);
301 my_vip = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
302 other_vip = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
303
304 private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
305 this->proposal = this->config->select_proposal(this->config,
306 this->proposals, no_dh, private);
307 if (this->proposal == NULL)
308 {
309 DBG1(DBG_IKE, "no acceptable proposal found");
310 return FAILED;
311 }
312 this->other_spi = this->proposal->get_spi(this->proposal);
313
314 if (!this->initiator && !allocate_spi(this))
315 { /* responder has no SPI allocated yet */
316 DBG1(DBG_IKE, "allocating SPI failed");
317 return FAILED;
318 }
319 this->child_sa->set_proposal(this->child_sa, this->proposal);
320
321 if (!this->proposal->has_dh_group(this->proposal, this->dh_group))
322 {
323 u_int16_t group;
324
325 if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
326 &group, NULL))
327 {
328 DBG1(DBG_IKE, "DH group %N inacceptable, requesting %N",
329 diffie_hellman_group_names, this->dh_group,
330 diffie_hellman_group_names, group);
331 this->dh_group = group;
332 return INVALID_ARG;
333 }
334 /* the selected proposal does not use a DH group */
335 DBG1(DBG_IKE, "ignoring KE exchange, agreed on a non-PFS proposal");
336 DESTROY_IF(this->dh);
337 this->dh = NULL;
338 this->dh_group = MODP_NONE;
339 }
340
341 if (my_vip == NULL)
342 {
343 my_vip = me;
344 }
345 if (other_vip == NULL)
346 {
347 other_vip = other;
348 }
349
350 if (this->initiator)
351 {
352 nonce_i = this->my_nonce;
353 nonce_r = this->other_nonce;
354 my_ts = this->tsi;
355 other_ts = this->tsr;
356 }
357 else
358 {
359 nonce_r = this->my_nonce;
360 nonce_i = this->other_nonce;
361 my_ts = this->tsr;
362 other_ts = this->tsi;
363 }
364 my_ts = this->config->get_traffic_selectors(this->config, TRUE, my_ts,
365 my_vip);
366 other_ts = this->config->get_traffic_selectors(this->config, FALSE, other_ts,
367 other_vip);
368
369 if (this->initiator)
370 {
371 if (ike_auth)
372 {
373 charon->bus->narrow(charon->bus, this->child_sa,
374 NARROW_INITIATOR_POST_NOAUTH, my_ts, other_ts);
375 }
376 else
377 {
378 charon->bus->narrow(charon->bus, this->child_sa,
379 NARROW_INITIATOR_POST_AUTH, my_ts, other_ts);
380 }
381 }
382 else
383 {
384 charon->bus->narrow(charon->bus, this->child_sa,
385 NARROW_RESPONDER, my_ts, other_ts);
386 }
387
388 if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
389 {
390 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
391 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
392 DBG1(DBG_IKE, "no acceptable traffic selectors found");
393 return NOT_FOUND;
394 }
395
396 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
397 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
398 if (this->initiator)
399 {
400 this->tsi = my_ts;
401 this->tsr = other_ts;
402 }
403 else
404 {
405 this->tsr = my_ts;
406 this->tsi = other_ts;
407 }
408
409 if (!this->initiator)
410 {
411 /* check if requested mode is acceptable, downgrade if required */
412 switch (this->mode)
413 {
414 case MODE_TRANSPORT:
415 if (!this->config->use_proxy_mode(this->config) &&
416 (!ts_list_is_host(this->tsi, other) ||
417 !ts_list_is_host(this->tsr, me))
418 )
419 {
420 this->mode = MODE_TUNNEL;
421 DBG1(DBG_IKE, "not using transport mode, not host-to-host");
422 }
423 else if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
424 {
425 this->mode = MODE_TUNNEL;
426 DBG1(DBG_IKE, "not using transport mode, connection NATed");
427 }
428 break;
429 case MODE_BEET:
430 if (!ts_list_is_host(this->tsi, NULL) ||
431 !ts_list_is_host(this->tsr, NULL))
432 {
433 this->mode = MODE_TUNNEL;
434 DBG1(DBG_IKE, "not using BEET mode, not host-to-host");
435 }
436 break;
437 default:
438 break;
439 }
440 }
441
442 this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
443 this->child_sa->set_ipcomp(this->child_sa, this->ipcomp);
444 this->child_sa->set_mode(this->child_sa, this->mode);
445 this->child_sa->set_protocol(this->child_sa,
446 this->proposal->get_protocol(this->proposal));
447
448 if (this->my_cpi == 0 || this->other_cpi == 0 || this->ipcomp == IPCOMP_NONE)
449 {
450 this->my_cpi = this->other_cpi = 0;
451 this->ipcomp = IPCOMP_NONE;
452 }
453 status_i = status_o = FAILED;
454 if (this->keymat->derive_child_keys(this->keymat, this->proposal,
455 this->dh, nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
456 {
457 if (this->initiator)
458 {
459 status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
460 this->my_spi, this->my_cpi, TRUE, my_ts, other_ts);
461 status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
462 this->other_spi, this->other_cpi, FALSE, my_ts, other_ts);
463 }
464 else
465 {
466 status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
467 this->my_spi, this->my_cpi, TRUE, my_ts, other_ts);
468 status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
469 this->other_spi, this->other_cpi, FALSE, my_ts, other_ts);
470 }
471 }
472 chunk_clear(&integ_i);
473 chunk_clear(&integ_r);
474 chunk_clear(&encr_i);
475 chunk_clear(&encr_r);
476
477 if (status_i != SUCCESS || status_o != SUCCESS)
478 {
479 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
480 (status_i != SUCCESS) ? "inbound " : "",
481 (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
482 (status_o != SUCCESS) ? "outbound " : "");
483 return FAILED;
484 }
485
486 status = this->child_sa->add_policies(this->child_sa, my_ts, other_ts);
487 if (status != SUCCESS)
488 {
489 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
490 return NOT_FOUND;
491 }
492
493 charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
494 this->dh, nonce_i, nonce_r);
495
496 /* add to IKE_SA, and remove from task */
497 this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
498 this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
499 this->established = TRUE;
500
501 if (!this->rekey)
502 { /* a rekeyed SA uses the same reqid, no need for a new job */
503 schedule_inactivity_timeout(this);
504 }
505 return SUCCESS;
506 }
507
508 /**
509 * build the payloads for the message
510 */
511 static void build_payloads(private_child_create_t *this, message_t *message)
512 {
513 sa_payload_t *sa_payload;
514 nonce_payload_t *nonce_payload;
515 ke_payload_t *ke_payload;
516 ts_payload_t *ts_payload;
517
518 /* add SA payload */
519 if (this->initiator)
520 {
521 sa_payload = sa_payload_create_from_proposal_list(this->proposals);
522 }
523 else
524 {
525 sa_payload = sa_payload_create_from_proposal(this->proposal);
526 }
527 message->add_payload(message, (payload_t*)sa_payload);
528
529 /* add nonce payload if not in IKE_AUTH */
530 if (message->get_exchange_type(message) == CREATE_CHILD_SA)
531 {
532 nonce_payload = nonce_payload_create();
533 nonce_payload->set_nonce(nonce_payload, this->my_nonce);
534 message->add_payload(message, (payload_t*)nonce_payload);
535 }
536
537 /* diffie hellman exchange, if PFS enabled */
538 if (this->dh)
539 {
540 ke_payload = ke_payload_create_from_diffie_hellman(this->dh);
541 message->add_payload(message, (payload_t*)ke_payload);
542 }
543
544 /* add TSi/TSr payloads */
545 ts_payload = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
546 message->add_payload(message, (payload_t*)ts_payload);
547 ts_payload = ts_payload_create_from_traffic_selectors(FALSE, this->tsr);
548 message->add_payload(message, (payload_t*)ts_payload);
549
550 /* add a notify if we are not in tunnel mode */
551 switch (this->mode)
552 {
553 case MODE_TRANSPORT:
554 message->add_notify(message, FALSE, USE_TRANSPORT_MODE, chunk_empty);
555 break;
556 case MODE_BEET:
557 message->add_notify(message, FALSE, USE_BEET_MODE, chunk_empty);
558 break;
559 default:
560 break;
561 }
562 }
563
564 /**
565 * Adds an IPCOMP_SUPPORTED notify to the message, allocating a CPI
566 */
567 static void add_ipcomp_notify(private_child_create_t *this,
568 message_t *message, u_int8_t ipcomp)
569 {
570 if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
571 {
572 DBG1(DBG_IKE, "IPComp is not supported if either peer is natted, "
573 "IPComp disabled");
574 return;
575 }
576
577 this->my_cpi = this->child_sa->alloc_cpi(this->child_sa);
578 if (this->my_cpi)
579 {
580 this->ipcomp = ipcomp;
581 message->add_notify(message, FALSE, IPCOMP_SUPPORTED,
582 chunk_cata("cc", chunk_from_thing(this->my_cpi),
583 chunk_from_thing(ipcomp)));
584 }
585 else
586 {
587 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, IPComp disabled");
588 }
589 }
590
591 /**
592 * handle a received notify payload
593 */
594 static void handle_notify(private_child_create_t *this, notify_payload_t *notify)
595 {
596 switch (notify->get_notify_type(notify))
597 {
598 case USE_TRANSPORT_MODE:
599 this->mode = MODE_TRANSPORT;
600 break;
601 case USE_BEET_MODE:
602 if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
603 { /* handle private use notify only if we know its meaning */
604 this->mode = MODE_BEET;
605 }
606 else
607 {
608 DBG1(DBG_IKE, "received a notify strongSwan uses for BEET "
609 "mode, but peer implementation unknown, skipped");
610 }
611 break;
612 case IPCOMP_SUPPORTED:
613 {
614 ipcomp_transform_t ipcomp;
615 u_int16_t cpi;
616 chunk_t data;
617
618 data = notify->get_notification_data(notify);
619 cpi = *(u_int16_t*)data.ptr;
620 ipcomp = (ipcomp_transform_t)(*(data.ptr + 2));
621 switch (ipcomp)
622 {
623 case IPCOMP_DEFLATE:
624 this->other_cpi = cpi;
625 this->ipcomp_received = ipcomp;
626 break;
627 case IPCOMP_LZS:
628 case IPCOMP_LZJH:
629 default:
630 DBG1(DBG_IKE, "received IPCOMP_SUPPORTED notify with a "
631 "transform ID we don't support %N",
632 ipcomp_transform_names, ipcomp);
633 break;
634 }
635 }
636 default:
637 break;
638 }
639 }
640
641 /**
642 * Read payloads from message
643 */
644 static void process_payloads(private_child_create_t *this, message_t *message)
645 {
646 enumerator_t *enumerator;
647 payload_t *payload;
648 sa_payload_t *sa_payload;
649 ke_payload_t *ke_payload;
650 ts_payload_t *ts_payload;
651
652 /* defaults to TUNNEL mode */
653 this->mode = MODE_TUNNEL;
654
655 enumerator = message->create_payload_enumerator(message);
656 while (enumerator->enumerate(enumerator, &payload))
657 {
658 switch (payload->get_type(payload))
659 {
660 case SECURITY_ASSOCIATION:
661 sa_payload = (sa_payload_t*)payload;
662 this->proposals = sa_payload->get_proposals(sa_payload);
663 break;
664 case KEY_EXCHANGE:
665 ke_payload = (ke_payload_t*)payload;
666 if (!this->initiator)
667 {
668 this->dh_group = ke_payload->get_dh_group_number(ke_payload);
669 this->dh = this->keymat->create_dh(this->keymat, this->dh_group);
670 }
671 if (this->dh)
672 {
673 this->dh->set_other_public_value(this->dh,
674 ke_payload->get_key_exchange_data(ke_payload));
675 }
676 break;
677 case TRAFFIC_SELECTOR_INITIATOR:
678 ts_payload = (ts_payload_t*)payload;
679 this->tsi = ts_payload->get_traffic_selectors(ts_payload);
680 break;
681 case TRAFFIC_SELECTOR_RESPONDER:
682 ts_payload = (ts_payload_t*)payload;
683 this->tsr = ts_payload->get_traffic_selectors(ts_payload);
684 break;
685 case NOTIFY:
686 handle_notify(this, (notify_payload_t*)payload);
687 break;
688 default:
689 break;
690 }
691 }
692 enumerator->destroy(enumerator);
693 }
694
695 /**
696 * Implementation of task_t.build for initiator
697 */
698 static status_t build_i(private_child_create_t *this, message_t *message)
699 {
700 host_t *me, *other, *vip;
701 peer_cfg_t *peer_cfg;
702
703 switch (message->get_exchange_type(message))
704 {
705 case IKE_SA_INIT:
706 return get_nonce(message, &this->my_nonce);
707 case CREATE_CHILD_SA:
708 if (generate_nonce(&this->my_nonce) != SUCCESS)
709 {
710 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
711 return SUCCESS;
712 }
713 if (this->dh_group == MODP_NONE)
714 {
715 this->dh_group = this->config->get_dh_group(this->config);
716 }
717 break;
718 case IKE_AUTH:
719 if (message->get_message_id(message) != 1)
720 {
721 /* send only in the first request, not in subsequent rounds */
722 return NEED_MORE;
723 }
724 break;
725 default:
726 break;
727 }
728
729 if (this->reqid)
730 {
731 DBG0(DBG_IKE, "establishing CHILD_SA %s{%d}",
732 this->config->get_name(this->config), this->reqid);
733 }
734 else
735 {
736 DBG0(DBG_IKE, "establishing CHILD_SA %s",
737 this->config->get_name(this->config));
738 }
739
740 /* reuse virtual IP if we already have one */
741 me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
742 if (me == NULL)
743 {
744 me = this->ike_sa->get_my_host(this->ike_sa);
745 }
746 other = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
747 if (other == NULL)
748 {
749 other = this->ike_sa->get_other_host(this->ike_sa);
750 }
751
752 /* check if we want a virtual IP, but don't have one */
753 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
754 vip = peer_cfg->get_virtual_ip(peer_cfg);
755 if (!this->reqid && vip)
756 {
757 /* propose a 0.0.0.0/0 or ::/0 subnet when we use virtual ip */
758 vip = host_create_any(vip->get_family(vip));
759 this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
760 NULL, vip);
761 vip->destroy(vip);
762 }
763 else
764 { /* but narrow it for host2host / if we already have a vip */
765 this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
766 NULL, me);
767 }
768 this->tsr = this->config->get_traffic_selectors(this->config, FALSE,
769 NULL, other);
770
771 if (this->packet_tsi)
772 {
773 this->tsi->insert_first(this->tsi,
774 this->packet_tsi->clone(this->packet_tsi));
775 }
776 if (this->packet_tsr)
777 {
778 this->tsr->insert_first(this->tsr,
779 this->packet_tsr->clone(this->packet_tsr));
780 }
781 this->proposals = this->config->get_proposals(this->config,
782 this->dh_group == MODP_NONE);
783 this->mode = this->config->get_mode(this->config);
784 if (this->mode == MODE_TRANSPORT &&
785 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
786 {
787 this->mode = MODE_TUNNEL;
788 DBG1(DBG_IKE, "not using transport mode, connection NATed");
789 }
790
791 this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
792 this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
793 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
794
795 if (!allocate_spi(this))
796 {
797 DBG1(DBG_IKE, "unable to allocate SPIs from kernel");
798 return FAILED;
799 }
800
801 if (this->dh_group != MODP_NONE)
802 {
803 this->dh = this->keymat->create_dh(this->keymat, this->dh_group);
804 }
805
806 if (this->config->use_ipcomp(this->config))
807 {
808 /* IPCOMP_DEFLATE is the only transform we support at the moment */
809 add_ipcomp_notify(this, message, IPCOMP_DEFLATE);
810 }
811
812 if (message->get_exchange_type(message) == IKE_AUTH)
813 {
814 charon->bus->narrow(charon->bus, this->child_sa,
815 NARROW_INITIATOR_PRE_NOAUTH, this->tsi, this->tsr);
816 }
817 else
818 {
819 charon->bus->narrow(charon->bus, this->child_sa,
820 NARROW_INITIATOR_PRE_AUTH, this->tsi, this->tsr);
821 }
822
823 build_payloads(this, message);
824
825 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
826 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
827 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
828 this->tsi = NULL;
829 this->tsr = NULL;
830 this->proposals = NULL;
831
832 return NEED_MORE;
833 }
834
835 /**
836 * Implementation of task_t.process for responder
837 */
838 static status_t process_r(private_child_create_t *this, message_t *message)
839 {
840 switch (message->get_exchange_type(message))
841 {
842 case IKE_SA_INIT:
843 return get_nonce(message, &this->other_nonce);
844 case CREATE_CHILD_SA:
845 get_nonce(message, &this->other_nonce);
846 break;
847 case IKE_AUTH:
848 if (message->get_message_id(message) != 1)
849 {
850 /* only handle first AUTH payload, not additional rounds */
851 return NEED_MORE;
852 }
853 default:
854 break;
855 }
856
857 process_payloads(this, message);
858
859 return NEED_MORE;
860 }
861
862 /**
863 * handle CHILD_SA setup failure
864 */
865 static void handle_child_sa_failure(private_child_create_t *this,
866 message_t *message)
867 {
868 if (message->get_exchange_type(message) == IKE_AUTH &&
869 lib->settings->get_bool(lib->settings,
870 "charon.close_ike_on_child_failure", FALSE))
871 {
872 /* we delay the delete for 100ms, as the IKE_AUTH response must arrive
873 * first */
874 DBG1(DBG_IKE, "closing IKE_SA due CHILD_SA setup failure");
875 hydra->scheduler->schedule_job_ms(hydra->scheduler, (job_t*)
876 delete_ike_sa_job_create(this->ike_sa->get_id(this->ike_sa), TRUE),
877 100);
878 }
879 }
880
881 /**
882 * Implementation of task_t.build for responder
883 */
884 static status_t build_r(private_child_create_t *this, message_t *message)
885 {
886 peer_cfg_t *peer_cfg;
887 payload_t *payload;
888 enumerator_t *enumerator;
889 bool no_dh = TRUE, ike_auth = FALSE;
890
891 switch (message->get_exchange_type(message))
892 {
893 case IKE_SA_INIT:
894 return get_nonce(message, &this->my_nonce);
895 case CREATE_CHILD_SA:
896 if (generate_nonce(&this->my_nonce) != SUCCESS)
897 {
898 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN,
899 chunk_empty);
900 return SUCCESS;
901 }
902 no_dh = FALSE;
903 break;
904 case IKE_AUTH:
905 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
906 { /* wait until all authentication round completed */
907 return NEED_MORE;
908 }
909 ike_auth = TRUE;
910 default:
911 break;
912 }
913
914 if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
915 {
916 DBG1(DBG_IKE, "unable to create CHILD_SA while rekeying IKE_SA");
917 message->add_notify(message, TRUE, NO_ADDITIONAL_SAS, chunk_empty);
918 return SUCCESS;
919 }
920
921 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
922 if (peer_cfg && this->tsi && this->tsr)
923 {
924 host_t *me, *other;
925
926 me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
927 if (me == NULL)
928 {
929 me = this->ike_sa->get_my_host(this->ike_sa);
930 }
931 other = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
932 if (other == NULL)
933 {
934 other = this->ike_sa->get_other_host(this->ike_sa);
935 }
936 this->config = peer_cfg->select_child_cfg(peer_cfg, this->tsr,
937 this->tsi, me, other);
938 }
939
940 if (this->config == NULL)
941 {
942 DBG1(DBG_IKE, "traffic selectors %#R=== %#R inacceptable",
943 this->tsr, this->tsi);
944 message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
945 handle_child_sa_failure(this, message);
946 return SUCCESS;
947 }
948
949 /* check if ike_config_t included non-critical error notifies */
950 enumerator = message->create_payload_enumerator(message);
951 while (enumerator->enumerate(enumerator, &payload))
952 {
953 if (payload->get_type(payload) == NOTIFY)
954 {
955 notify_payload_t *notify = (notify_payload_t*)payload;
956
957 switch (notify->get_notify_type(notify))
958 {
959 case INTERNAL_ADDRESS_FAILURE:
960 case FAILED_CP_REQUIRED:
961 {
962 DBG1(DBG_IKE,"configuration payload negotation "
963 "failed, no CHILD_SA built");
964 enumerator->destroy(enumerator);
965 handle_child_sa_failure(this, message);
966 return SUCCESS;
967 }
968 default:
969 break;
970 }
971 }
972 }
973 enumerator->destroy(enumerator);
974
975 this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
976 this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
977 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
978
979 if (this->ipcomp_received != IPCOMP_NONE)
980 {
981 if (this->config->use_ipcomp(this->config))
982 {
983 add_ipcomp_notify(this, message, this->ipcomp_received);
984 }
985 else
986 {
987 DBG1(DBG_IKE, "received %N notify but IPComp is disabled, ignoring",
988 notify_type_names, IPCOMP_SUPPORTED);
989 }
990 }
991
992 switch (select_and_install(this, no_dh, ike_auth))
993 {
994 case SUCCESS:
995 break;
996 case NOT_FOUND:
997 message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
998 handle_child_sa_failure(this, message);
999 return SUCCESS;
1000 case INVALID_ARG:
1001 {
1002 u_int16_t group = htons(this->dh_group);
1003 message->add_notify(message, FALSE, INVALID_KE_PAYLOAD,
1004 chunk_from_thing(group));
1005 handle_child_sa_failure(this, message);
1006 return SUCCESS;
1007 }
1008 case FAILED:
1009 default:
1010 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
1011 handle_child_sa_failure(this, message);
1012 return SUCCESS;
1013 }
1014
1015 build_payloads(this, message);
1016
1017 DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
1018 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
1019 this->child_sa->get_name(this->child_sa),
1020 this->child_sa->get_reqid(this->child_sa),
1021 ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
1022 ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
1023 this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
1024 this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
1025
1026 if (!this->rekey)
1027 { /* invoke the child_up() hook if we are not rekeying */
1028 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1029 }
1030 return SUCCESS;
1031 }
1032
1033 /**
1034 * Implementation of task_t.process for initiator
1035 */
1036 static status_t process_i(private_child_create_t *this, message_t *message)
1037 {
1038 enumerator_t *enumerator;
1039 payload_t *payload;
1040 bool no_dh = TRUE, ike_auth = FALSE;
1041
1042 switch (message->get_exchange_type(message))
1043 {
1044 case IKE_SA_INIT:
1045 return get_nonce(message, &this->other_nonce);
1046 case CREATE_CHILD_SA:
1047 get_nonce(message, &this->other_nonce);
1048 no_dh = FALSE;
1049 break;
1050 case IKE_AUTH:
1051 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1052 { /* wait until all authentication round completed */
1053 return NEED_MORE;
1054 }
1055 ike_auth = TRUE;
1056 default:
1057 break;
1058 }
1059
1060 /* check for erronous notifies */
1061 enumerator = message->create_payload_enumerator(message);
1062 while (enumerator->enumerate(enumerator, &payload))
1063 {
1064 if (payload->get_type(payload) == NOTIFY)
1065 {
1066 notify_payload_t *notify = (notify_payload_t*)payload;
1067 notify_type_t type = notify->get_notify_type(notify);
1068
1069 switch (type)
1070 {
1071 /* handle notify errors related to CHILD_SA only */
1072 case NO_PROPOSAL_CHOSEN:
1073 case SINGLE_PAIR_REQUIRED:
1074 case NO_ADDITIONAL_SAS:
1075 case INTERNAL_ADDRESS_FAILURE:
1076 case FAILED_CP_REQUIRED:
1077 case TS_UNACCEPTABLE:
1078 case INVALID_SELECTORS:
1079 {
1080 DBG1(DBG_IKE, "received %N notify, no CHILD_SA built",
1081 notify_type_names, type);
1082 enumerator->destroy(enumerator);
1083 handle_child_sa_failure(this, message);
1084 /* an error in CHILD_SA creation is not critical */
1085 return SUCCESS;
1086 }
1087 case INVALID_KE_PAYLOAD:
1088 {
1089 chunk_t data;
1090 u_int16_t group = MODP_NONE;
1091
1092 data = notify->get_notification_data(notify);
1093 if (data.len == sizeof(group))
1094 {
1095 memcpy(&group, data.ptr, data.len);
1096 group = ntohs(group);
1097 }
1098 DBG1(DBG_IKE, "peer didn't accept DH group %N, "
1099 "it requested %N", diffie_hellman_group_names,
1100 this->dh_group, diffie_hellman_group_names, group);
1101 this->dh_group = group;
1102 this->public.task.migrate(&this->public.task, this->ike_sa);
1103 enumerator->destroy(enumerator);
1104 return NEED_MORE;
1105 }
1106 default:
1107 break;
1108 }
1109 }
1110 }
1111 enumerator->destroy(enumerator);
1112
1113 process_payloads(this, message);
1114
1115 if (this->ipcomp == IPCOMP_NONE && this->ipcomp_received != IPCOMP_NONE)
1116 {
1117 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify without requesting"
1118 " one, no CHILD_SA built");
1119 handle_child_sa_failure(this, message);
1120 return SUCCESS;
1121 }
1122 else if (this->ipcomp != IPCOMP_NONE && this->ipcomp_received == IPCOMP_NONE)
1123 {
1124 DBG1(DBG_IKE, "peer didn't accept our proposed IPComp transforms, "
1125 "IPComp is disabled");
1126 this->ipcomp = IPCOMP_NONE;
1127 }
1128 else if (this->ipcomp != IPCOMP_NONE && this->ipcomp != this->ipcomp_received)
1129 {
1130 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify we didn't propose, "
1131 "no CHILD_SA built");
1132 handle_child_sa_failure(this, message);
1133 return SUCCESS;
1134 }
1135
1136 if (select_and_install(this, no_dh, ike_auth) == SUCCESS)
1137 {
1138 DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
1139 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
1140 this->child_sa->get_name(this->child_sa),
1141 this->child_sa->get_reqid(this->child_sa),
1142 ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
1143 ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
1144 this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
1145 this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
1146
1147 if (!this->rekey)
1148 { /* invoke the child_up() hook if we are not rekeying */
1149 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1150 }
1151 }
1152 else
1153 {
1154 handle_child_sa_failure(this, message);
1155 }
1156 return SUCCESS;
1157 }
1158
1159 /**
1160 * Implementation of task_t.get_type
1161 */
1162 static task_type_t get_type(private_child_create_t *this)
1163 {
1164 return CHILD_CREATE;
1165 }
1166
1167 /**
1168 * Implementation of child_create_t.use_reqid
1169 */
1170 static void use_reqid(private_child_create_t *this, u_int32_t reqid)
1171 {
1172 this->reqid = reqid;
1173 }
1174
1175 /**
1176 * Implementation of child_create_t.get_child
1177 */
1178 static child_sa_t* get_child(private_child_create_t *this)
1179 {
1180 return this->child_sa;
1181 }
1182
1183 /**
1184 * Implementation of child_create_t.get_lower_nonce
1185 */
1186 static chunk_t get_lower_nonce(private_child_create_t *this)
1187 {
1188 if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
1189 min(this->my_nonce.len, this->other_nonce.len)) < 0)
1190 {
1191 return this->my_nonce;
1192 }
1193 else
1194 {
1195 return this->other_nonce;
1196 }
1197 }
1198
1199 /**
1200 * Implementation of task_t.migrate
1201 */
1202 static void migrate(private_child_create_t *this, ike_sa_t *ike_sa)
1203 {
1204 chunk_free(&this->my_nonce);
1205 chunk_free(&this->other_nonce);
1206 if (this->tsr)
1207 {
1208 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1209 }
1210 if (this->tsi)
1211 {
1212 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1213 }
1214 DESTROY_IF(this->child_sa);
1215 DESTROY_IF(this->proposal);
1216 DESTROY_IF(this->dh);
1217 if (this->proposals)
1218 {
1219 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1220 }
1221
1222 this->ike_sa = ike_sa;
1223 this->keymat = ike_sa->get_keymat(ike_sa);
1224 this->proposal = NULL;
1225 this->proposals = NULL;
1226 this->tsi = NULL;
1227 this->tsr = NULL;
1228 this->dh = NULL;
1229 this->child_sa = NULL;
1230 this->mode = MODE_TUNNEL;
1231 this->ipcomp = IPCOMP_NONE;
1232 this->ipcomp_received = IPCOMP_NONE;
1233 this->other_cpi = 0;
1234 this->reqid = 0;
1235 this->established = FALSE;
1236 }
1237
1238 /**
1239 * Implementation of task_t.destroy
1240 */
1241 static void destroy(private_child_create_t *this)
1242 {
1243 chunk_free(&this->my_nonce);
1244 chunk_free(&this->other_nonce);
1245 if (this->tsr)
1246 {
1247 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1248 }
1249 if (this->tsi)
1250 {
1251 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1252 }
1253 if (!this->established)
1254 {
1255 DESTROY_IF(this->child_sa);
1256 }
1257 DESTROY_IF(this->packet_tsi);
1258 DESTROY_IF(this->packet_tsr);
1259 DESTROY_IF(this->proposal);
1260 DESTROY_IF(this->dh);
1261 if (this->proposals)
1262 {
1263 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1264 }
1265
1266 DESTROY_IF(this->config);
1267 free(this);
1268 }
1269
1270 /*
1271 * Described in header.
1272 */
1273 child_create_t *child_create_create(ike_sa_t *ike_sa,
1274 child_cfg_t *config, bool rekey,
1275 traffic_selector_t *tsi, traffic_selector_t *tsr)
1276 {
1277 private_child_create_t *this = malloc_thing(private_child_create_t);
1278
1279 this->public.get_child = (child_sa_t*(*)(child_create_t*))get_child;
1280 this->public.get_lower_nonce = (chunk_t(*)(child_create_t*))get_lower_nonce;
1281 this->public.use_reqid = (void(*)(child_create_t*,u_int32_t))use_reqid;
1282 this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
1283 this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
1284 this->public.task.destroy = (void(*)(task_t*))destroy;
1285 if (config)
1286 {
1287 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
1288 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
1289 this->initiator = TRUE;
1290 config->get_ref(config);
1291 }
1292 else
1293 {
1294 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
1295 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
1296 this->initiator = FALSE;
1297 }
1298
1299 this->ike_sa = ike_sa;
1300 this->config = config;
1301 this->my_nonce = chunk_empty;
1302 this->other_nonce = chunk_empty;
1303 this->proposals = NULL;
1304 this->proposal = NULL;
1305 this->tsi = NULL;
1306 this->tsr = NULL;
1307 this->packet_tsi = tsi ? tsi->clone(tsi) : NULL;
1308 this->packet_tsr = tsr ? tsr->clone(tsr) : NULL;
1309 this->dh = NULL;
1310 this->dh_group = MODP_NONE;
1311 this->keymat = ike_sa->get_keymat(ike_sa);
1312 this->child_sa = NULL;
1313 this->mode = MODE_TUNNEL;
1314 this->ipcomp = IPCOMP_NONE;
1315 this->ipcomp_received = IPCOMP_NONE;
1316 this->my_spi = 0;
1317 this->other_spi = 0;
1318 this->my_cpi = 0;
1319 this->other_cpi = 0;
1320 this->reqid = 0;
1321 this->established = FALSE;
1322 this->rekey = rekey;
1323
1324 return &this->public;
1325 }