src/libcharon/sa/tasks/quick_mode.c

   1 /*
   2  * Copyright (C) 2011 Martin Willi
   3  * Copyright (C) 2011 revosec AG
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "quick_mode.h"
  17
  18 #include <string.h>
  19
  20 #include <daemon.h>
  21 #include <sa/keymat_v1.h>
  22 #include <encoding/payloads/sa_payload.h>
  23 #include <encoding/payloads/nonce_payload.h>
  24 #include <encoding/payloads/id_payload.h>
  25
  26 typedef struct private_quick_mode_t private_quick_mode_t;
  27
  28 /**
  29  * Private members of a quick_mode_t task.
  30  */
  31 struct private_quick_mode_t {
  32
  33         /**
  34          * Public methods and task_t interface.
  35          */
  36         quick_mode_t public;
  37
  38         /**
  39          * Assigned IKE_SA.
  40          */
  41         ike_sa_t *ike_sa;
  42
  43         /**
  44          * TRUE if we are initiating quick mode
  45          */
  46         bool initiator;
  47
  48         /**
  49          * Traffic selector of initiator
  50          */
  51         traffic_selector_t *tsi;
  52
  53         /**
  54          * Traffic selector of responder
  55          */
  56         traffic_selector_t *tsr;
  57
  58         /**
  59          * Initiators nonce
  60          */
  61         chunk_t nonce_i;
  62
  63         /**
  64          * Responder nonce
  65          */
  66         chunk_t nonce_r;
  67
  68         /**
  69          * Initiators ESP SPI
  70          */
  71         u_int32_t spi_i;
  72
  73         /**
  74          * Responder ESP SPI
  75          */
  76         u_int32_t spi_r;
  77
  78         /**
  79          * selected CHILD_SA proposal
  80          */
  81         proposal_t *proposal;
  82
  83         /**
  84          * Config of CHILD_SA to establish
  85          */
  86         child_cfg_t *config;
  87
  88         /**
  89          * CHILD_SA we are about to establish
  90          */
  91         child_sa_t *child_sa;
  92
  93         /**
  94          * IKEv1 keymat
  95          */
  96         keymat_v1_t *keymat;
  97
  98         /** states of quick mode */
  99         enum {
 100                 QM_INIT,
 101                 QM_NEGOTIATED,
 102         } state;
 103 };
 104
 105 /**
 106  * Install negotiated CHILD_SA
 107  */
 108 static bool install(private_quick_mode_t *this)
 109 {
 110         status_t status, status_i, status_o;
 111         chunk_t encr_i, encr_r, integ_i, integ_r;
 112         linked_list_t *tsi, *tsr;
 113
 114         this->child_sa->set_proposal(this->child_sa, this->proposal);
 115         this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
 116         this->child_sa->set_mode(this->child_sa, MODE_TUNNEL);
 117         this->child_sa->set_protocol(this->child_sa,
 118                                                                  this->proposal->get_protocol(this->proposal));
 119
 120         status_i = status_o = FAILED;
 121         encr_i = encr_r = integ_i = integ_r = chunk_empty;
 122         tsi = linked_list_create();
 123         tsr = linked_list_create();
 124         tsi->insert_last(tsi, this->tsi);
 125         tsr->insert_last(tsr, this->tsr);
 126         if (this->keymat->derive_child_keys(this->keymat, this->proposal, NULL,
 127                                                 this->spi_i, this->spi_r, this->nonce_i, this->nonce_r,
 128                                                 &encr_i, &integ_i, &encr_r, &integ_r))
 129         {
 130                 if (this->initiator)
 131                 {
 132                         status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
 133                                                         this->spi_i, 0, TRUE, FALSE, tsi, tsr);
 134                         status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
 135                                                         this->spi_r, 0, FALSE, FALSE, tsi, tsr);
 136                 }
 137                 else
 138                 {
 139                         status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
 140                                                         this->spi_r, 0, TRUE, FALSE, tsr, tsi);
 141                         status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
 142                                                         this->spi_i, 0, FALSE, FALSE, tsr, tsi);
 143                 }
 144         }
 145         chunk_clear(&integ_i);
 146         chunk_clear(&integ_r);
 147         chunk_clear(&encr_i);
 148         chunk_clear(&encr_r);
 149
 150         if (status_i != SUCCESS || status_o != SUCCESS)
 151         {
 152                 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
 153                         (status_i != SUCCESS) ? "inbound " : "",
 154                         (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
 155                         (status_o != SUCCESS) ? "outbound " : "");
 156                 tsi->destroy(tsi);
 157                 tsr->destroy(tsr);
 158                 return FALSE;
 159         }
 160
 161         if (this->initiator)
 162         {
 163                 status = this->child_sa->add_policies(this->child_sa, tsi, tsr);
 164         }
 165         else
 166         {
 167                 status = this->child_sa->add_policies(this->child_sa, tsr, tsi);
 168         }
 169         tsi->destroy(tsi);
 170         tsr->destroy(tsr);
 171         if (status != SUCCESS)
 172         {
 173                 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
 174                 return FALSE;
 175         }
 176
 177         charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
 178                                                         NULL, this->nonce_i, this->nonce_r);
 179
 180         /* add to IKE_SA, and remove from task */
 181         this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 182         this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
 183
 184         DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
 185                  "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
 186                  this->child_sa->get_name(this->child_sa),
 187                  this->child_sa->get_reqid(this->child_sa),
 188                  ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
 189                  ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
 190                  this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
 191                  this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
 192
 193         charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
 194
 195         this->child_sa = NULL;
 196
 197         return TRUE;
 198 }
 199
 200 /**
 201  * Generate and add NONCE
 202  */
 203 static bool add_nonce(private_quick_mode_t *this, chunk_t *nonce,
 204                                           message_t *message)
 205 {
 206         nonce_payload_t *nonce_payload;
 207         rng_t *rng;
 208
 209         rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 210         if (!rng)
 211         {
 212                 DBG1(DBG_IKE, "no RNG found to create nonce");
 213                 return FALSE;
 214         }
 215         rng->allocate_bytes(rng, NONCE_SIZE, nonce);
 216         rng->destroy(rng);
 217
 218         nonce_payload = nonce_payload_create(NONCE_V1);
 219         nonce_payload->set_nonce(nonce_payload, *nonce);
 220         message->add_payload(message, &nonce_payload->payload_interface);
 221
 222         return TRUE;
 223 }
 224
 225 /**
 226  * Extract nonce from NONCE payload
 227  */
 228 static bool get_nonce(private_quick_mode_t *this, chunk_t *nonce,
 229                                           message_t *message)
 230 {
 231         nonce_payload_t *nonce_payload;
 232
 233         nonce_payload = (nonce_payload_t*)message->get_payload(message, NONCE_V1);
 234         if (!nonce_payload)
 235         {
 236                 DBG1(DBG_IKE, "NONCE payload missing in message");
 237                 return FALSE;
 238         }
 239         *nonce = nonce_payload->get_nonce(nonce_payload);
 240
 241         return TRUE;
 242 }
 243
 244 METHOD(task_t, build_i, status_t,
 245         private_quick_mode_t *this, message_t *message)
 246 {
 247         switch (this->state)
 248         {
 249                 case QM_INIT:
 250                 {
 251                         enumerator_t *enumerator;
 252                         sa_payload_t *sa_payload;
 253                         id_payload_t *id_payload;
 254                         traffic_selector_t *ts;
 255                         linked_list_t *list;
 256                         proposal_t *proposal;
 257
 258                         this->child_sa = child_sa_create(
 259                                                                         this->ike_sa->get_my_host(this->ike_sa),
 260                                                                         this->ike_sa->get_other_host(this->ike_sa),
 261                                                                         this->config, 0, FALSE);
 262
 263                         list = this->config->get_proposals(this->config, TRUE);
 264
 265                         this->spi_i = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
 266                         if (!this->spi_i)
 267                         {
 268                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
 269                                 return FAILED;
 270                         }
 271                         enumerator = list->create_enumerator(list);
 272                         while (enumerator->enumerate(enumerator, &proposal))
 273                         {
 274                                 proposal->set_spi(proposal, this->spi_i);
 275                         }
 276                         enumerator->destroy(enumerator);
 277
 278                         sa_payload = sa_payload_create_from_proposal_list(
 279                                                                                                 SECURITY_ASSOCIATION_V1, list);
 280                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 281                         message->add_payload(message, &sa_payload->payload_interface);
 282
 283                         if (!add_nonce(this, &this->nonce_i, message))
 284                         {
 285                                 return FAILED;
 286                         }
 287
 288                         list = this->config->get_traffic_selectors(this->config, TRUE, NULL,
 289                                                                         this->ike_sa->get_my_host(this->ike_sa));
 290                         if (list->get_first(list, (void**)&ts) != SUCCESS)
 291                         {
 292                                 list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
 293                                 DBG1(DBG_IKE, "traffic selector missing");
 294                                 return FAILED;
 295                         }
 296                         id_payload = id_payload_create_from_ts(ts);
 297                         this->tsi = ts->clone(ts);
 298                         list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
 299                         message->add_payload(message, &id_payload->payload_interface);
 300
 301                         list = this->config->get_traffic_selectors(this->config, FALSE, NULL,
 302                                                                         this->ike_sa->get_other_host(this->ike_sa));
 303                         if (list->get_first(list, (void**)&ts) != SUCCESS)
 304                         {
 305                                 list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
 306                                 DBG1(DBG_IKE, "traffic selector missing");
 307                                 return FAILED;
 308                         }
 309                         id_payload = id_payload_create_from_ts(ts);
 310                         this->tsr = ts->clone(ts);
 311                         list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
 312                         message->add_payload(message, &id_payload->payload_interface);
 313
 314                         return NEED_MORE;
 315                 }
 316                 case QM_NEGOTIATED:
 317                 {
 318                         return SUCCESS;
 319                 }
 320                 default:
 321                         return FAILED;
 322         }
 323 }
 324
 325 METHOD(task_t, process_r, status_t,
 326         private_quick_mode_t *this, message_t *message)
 327 {
 328         switch (this->state)
 329         {
 330                 case QM_INIT:
 331                 {
 332                         sa_payload_t *sa_payload;
 333                         id_payload_t *id_payload;
 334                         payload_t *payload;
 335                         linked_list_t *tsi, *tsr, *list;
 336                         peer_cfg_t *peer_cfg;
 337                         host_t *me, *other, *host;
 338                         enumerator_t *enumerator;
 339                         bool first = TRUE;
 340
 341                         enumerator = message->create_payload_enumerator(message);
 342                         while (enumerator->enumerate(enumerator, &payload))
 343                         {
 344                                 if (payload->get_type(payload) == ID_V1)
 345                                 {
 346                                         id_payload = (id_payload_t*)payload;
 347
 348                                         if (first)
 349                                         {
 350                                                 this->tsi = id_payload->get_ts(id_payload);
 351                                                 first = FALSE;
 352                                         }
 353                                         else
 354                                         {
 355                                                 this->tsr = id_payload->get_ts(id_payload);
 356                                                 break;
 357                                         }
 358                                 }
 359                         }
 360                         enumerator->destroy(enumerator);
 361
 362                         if (!this->tsi)
 363                         {
 364                                 host = this->ike_sa->get_other_host(this->ike_sa);
 365                                 this->tsi = traffic_selector_create_from_subnet(host->clone(host),
 366                                                 host->get_family(host) == AF_INET ? 32 : 128, 0, 0);
 367                         }
 368                         if (!this->tsr)
 369                         {
 370                                 host = this->ike_sa->get_my_host(this->ike_sa);
 371                                 this->tsr = traffic_selector_create_from_subnet(host->clone(host),
 372                                                 host->get_family(host) == AF_INET ? 32 : 128, 0, 0);
 373                         }
 374
 375                         me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
 376                         if (!me)
 377                         {
 378                                 me = this->ike_sa->get_my_host(this->ike_sa);
 379                         }
 380                         other = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
 381                         if (!other)
 382                         {
 383                                 other = this->ike_sa->get_other_host(this->ike_sa);
 384                         }
 385                         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 386                         tsi = linked_list_create();
 387                         tsr = linked_list_create();
 388                         tsi->insert_last(tsi, this->tsi);
 389                         tsr->insert_last(tsr, this->tsr);
 390                         this->config = peer_cfg->select_child_cfg(peer_cfg, tsr, tsi,
 391                                                                                                           me, other);
 392                         tsi->destroy(tsi);
 393                         tsr->destroy(tsr);
 394                         if (!this->config)
 395                         {
 396                                 DBG1(DBG_IKE, "no child config found");
 397                                 return FAILED;
 398                         }
 399
 400                         sa_payload = (sa_payload_t*)message->get_payload(message,
 401                                                                                                         SECURITY_ASSOCIATION_V1);
 402                         if (!sa_payload)
 403                         {
 404                                 DBG1(DBG_IKE, "sa payload missing");
 405                                 return FAILED;
 406                         }
 407                         list = sa_payload->get_proposals(sa_payload);
 408                         this->proposal = this->config->select_proposal(this->config,
 409                                                                                                                    list, TRUE, FALSE);
 410                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 411                         if (!this->proposal)
 412                         {
 413                                 DBG1(DBG_IKE, "no matching proposal found");
 414                                 return FAILED;
 415                         }
 416                         this->spi_i = this->proposal->get_spi(this->proposal);
 417
 418                         if (!get_nonce(this, &this->nonce_i, message))
 419                         {
 420                                 return FAILED;
 421                         }
 422                         this->child_sa = child_sa_create(
 423                                                                         this->ike_sa->get_my_host(this->ike_sa),
 424                                                                         this->ike_sa->get_other_host(this->ike_sa),
 425                                                                         this->config, 0, FALSE);
 426                         return NEED_MORE;
 427                 }
 428                 case QM_NEGOTIATED:
 429                 {
 430                         if (!install(this))
 431                         {
 432                                 return FAILED;
 433                         }
 434                         return SUCCESS;
 435                 }
 436                 default:
 437                         return FAILED;
 438         }
 439 }
 440
 441 METHOD(task_t, build_r, status_t,
 442         private_quick_mode_t *this, message_t *message)
 443 {
 444         switch (this->state)
 445         {
 446                 case QM_INIT:
 447                 {
 448                         sa_payload_t *sa_payload;
 449                         id_payload_t *id_payload;
 450
 451                         this->spi_r = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
 452                         if (!this->spi_r)
 453                         {
 454                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
 455                                 return FAILED;
 456                         }
 457                         this->proposal->set_spi(this->proposal, this->spi_r);
 458
 459                         sa_payload = sa_payload_create_from_proposal(
 460                                                                         SECURITY_ASSOCIATION_V1, this->proposal);
 461                         message->add_payload(message, &sa_payload->payload_interface);
 462
 463                         if (!add_nonce(this, &this->nonce_r, message))
 464                         {
 465                                 return FAILED;
 466                         }
 467
 468                         id_payload = id_payload_create_from_ts(this->tsi);
 469                         message->add_payload(message, &id_payload->payload_interface);
 470                         id_payload = id_payload_create_from_ts(this->tsr);
 471                         message->add_payload(message, &id_payload->payload_interface);
 472
 473                         this->state = QM_NEGOTIATED;
 474                         return NEED_MORE;
 475                 }
 476                 default:
 477                         return FAILED;
 478         }
 479 }
 480
 481 METHOD(task_t, process_i, status_t,
 482         private_quick_mode_t *this, message_t *message)
 483 {
 484         switch (this->state)
 485         {
 486                 case QM_INIT:
 487                 {
 488                         sa_payload_t *sa_payload;
 489                         id_payload_t *id_payload;
 490                         payload_t *payload;
 491                         traffic_selector_t *tsi = NULL, *tsr = NULL;
 492                         linked_list_t *list;
 493                         enumerator_t *enumerator;
 494                         host_t *host;
 495                         bool first = TRUE;
 496
 497                         enumerator = message->create_payload_enumerator(message);
 498                         while (enumerator->enumerate(enumerator, &payload))
 499                         {
 500                                 if (payload->get_type(payload) == ID_V1)
 501                                 {
 502                                         id_payload = (id_payload_t*)payload;
 503
 504                                         if (first)
 505                                         {
 506                                                 tsi = id_payload->get_ts(id_payload);
 507                                                 first = FALSE;
 508                                         }
 509                                         else
 510                                         {
 511                                                 tsr = id_payload->get_ts(id_payload);
 512                                                 break;
 513                                         }
 514                                 }
 515                         }
 516                         enumerator->destroy(enumerator);
 517
 518                         if (!tsr)
 519                         {
 520                                 host = this->ike_sa->get_other_host(this->ike_sa);
 521                                 tsr = traffic_selector_create_from_subnet(host->clone(host),
 522                                                 host->get_family(host) == AF_INET ? 32 : 128, 0, 0);
 523                         }
 524                         if (!tsi)
 525                         {
 526                                 host = this->ike_sa->get_my_host(this->ike_sa);
 527                                 tsi = traffic_selector_create_from_subnet(host->clone(host),
 528                                                 host->get_family(host) == AF_INET ? 32 : 128, 0, 0);
 529                         }
 530
 531                         if (!tsr->is_contained_in(tsr, this->tsr) ||
 532                                 !tsi->is_contained_in(tsi, this->tsi))
 533                         {
 534                                 tsi->destroy(tsi);
 535                                 tsr->destroy(tsr);
 536                                 DBG1(DBG_IKE, "TS mismatch");
 537                                 return FAILED;
 538                         }
 539                         this->tsi->destroy(this->tsi);
 540                         this->tsr->destroy(this->tsr);
 541                         this->tsi = tsi;
 542                         this->tsr = tsr;
 543
 544                         sa_payload = (sa_payload_t*)message->get_payload(message,
 545                                                                                                         SECURITY_ASSOCIATION_V1);
 546                         if (!sa_payload)
 547                         {
 548                                 DBG1(DBG_IKE, "sa payload missing");
 549                                 return FAILED;
 550                         }
 551                         list = sa_payload->get_proposals(sa_payload);
 552                         this->proposal = this->config->select_proposal(this->config,
 553                                                                                                                    list, TRUE, FALSE);
 554                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 555                         if (!this->proposal)
 556                         {
 557                                 DBG1(DBG_IKE, "no matching proposal found");
 558                                 return FAILED;
 559                         }
 560                         this->spi_r = this->proposal->get_spi(this->proposal);
 561
 562                         if (!get_nonce(this, &this->nonce_r, message))
 563                         {
 564                                 return FAILED;
 565                         }
 566                         if (!install(this))
 567                         {
 568                                 return FAILED;
 569                         }
 570                         this->state = QM_NEGOTIATED;
 571                         return NEED_MORE;
 572                 }
 573                 default:
 574                         return FAILED;
 575         }
 576 }
 577
 578 METHOD(task_t, get_type, task_type_t,
 579         private_quick_mode_t *this)
 580 {
 581         return TASK_QUICK_MODE;
 582 }
 583
 584 METHOD(task_t, migrate, void,
 585         private_quick_mode_t *this, ike_sa_t *ike_sa)
 586 {
 587         this->ike_sa = ike_sa;
 588 }
 589
 590 METHOD(task_t, destroy, void,
 591         private_quick_mode_t *this)
 592 {
 593         chunk_free(&this->nonce_i);
 594         chunk_free(&this->nonce_r);
 595         DESTROY_IF(this->tsi);
 596         DESTROY_IF(this->tsr);
 597         DESTROY_IF(this->proposal);
 598         DESTROY_IF(this->child_sa);
 599         DESTROY_IF(this->config);
 600         free(this);
 601 }
 602
 603 /*
 604  * Described in header.
 605  */
 606 quick_mode_t *quick_mode_create(ike_sa_t *ike_sa, child_cfg_t *config,
 607                                                         traffic_selector_t *tsi, traffic_selector_t *tsr)
 608 {
 609         private_quick_mode_t *this;
 610
 611         INIT(this,
 612                 .public = {
 613                         .task = {
 614                                 .get_type = _get_type,
 615                                 .migrate = _migrate,
 616                                 .destroy = _destroy,
 617                         },
 618                 },
 619                 .ike_sa = ike_sa,
 620                 .initiator = config != NULL,
 621                 .config = config,
 622                 .keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa),
 623                 .state = QM_INIT,
 624         );
 625
 626         if (config)
 627         {
 628                 this->public.task.build = _build_i;
 629                 this->public.task.process = _process_i;
 630         }
 631         else
 632         {
 633                 this->public.task.build = _build_r;
 634                 this->public.task.process = _process_r;
 635         }
 636
 637         return &this->public;
 638 }