4 * @brief Implementation of ike_sa_t.
9 * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
10 * Copyright (C) 2005-2006 Martin Willi
11 * Copyright (C) 2005 Jan Hutter
12 * Hochschule fuer Technik Rapperswil
14 * This program is free software; you can redistribute it and/or modify it
15 * under the terms of the GNU General Public License as published by the
16 * Free Software Foundation; either version 2 of the License, or (at your
17 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
19 * This program is distributed in the hope that it will be useful, but
20 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
21 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
34 #include <utils/linked_list.h>
35 #include <utils/lexparser.h>
36 #include <crypto/diffie_hellman.h>
37 #include <crypto/prf_plus.h>
38 #include <crypto/crypters/crypter.h>
39 #include <crypto/hashers/hasher.h>
40 #include <encoding/payloads/sa_payload.h>
41 #include <encoding/payloads/nonce_payload.h>
42 #include <encoding/payloads/ke_payload.h>
43 #include <encoding/payloads/delete_payload.h>
44 #include <encoding/payloads/transform_substructure.h>
45 #include <encoding/payloads/transform_attribute.h>
46 #include <encoding/payloads/ts_payload.h>
47 #include <sa/task_manager.h>
48 #include <sa/tasks/ike_init.h>
49 #include <sa/tasks/ike_natd.h>
50 #include <sa/tasks/ike_auth.h>
51 #include <sa/tasks/ike_config.h>
52 #include <sa/tasks/ike_cert.h>
53 #include <sa/tasks/ike_rekey.h>
54 #include <sa/tasks/ike_delete.h>
55 #include <sa/tasks/ike_dpd.h>
56 #include <sa/tasks/child_create.h>
57 #include <sa/tasks/child_delete.h>
58 #include <sa/tasks/child_rekey.h>
59 #include <processing/jobs/retransmit_job.h>
60 #include <processing/jobs/delete_ike_sa_job.h>
61 #include <processing/jobs/send_dpd_job.h>
62 #include <processing/jobs/send_keepalive_job.h>
63 #include <processing/jobs/rekey_ike_sa_job.h>
64 #include <processing/jobs/route_job.h>
65 #include <processing/jobs/initiate_job.h>
69 #define RESOLV_CONF "/etc/resolv.conf"
72 ENUM(ike_sa_state_names
, IKE_CREATED
, IKE_DELETING
,
80 typedef struct private_ike_sa_t private_ike_sa_t
;
83 * Private data of an ike_sa_t object.
85 struct private_ike_sa_t
{
93 * Identifier for the current IKE_SA.
95 ike_sa_id_t
*ike_sa_id
;
98 * unique numerical ID for this IKE_SA.
103 * Current state of the IKE_SA
105 ike_sa_state_t state
;
108 * IKE configuration used to set up this IKE_SA
113 * Peer and authentication information to establish IKE_SA.
115 peer_cfg_t
*peer_cfg
;
118 * Juggles tasks to process messages
120 task_manager_t
*task_manager
;
123 * Address of local host
128 * Address of remote host
133 * Identification used for us
135 identification_t
*my_id
;
138 * Identification used for other
140 identification_t
*other_id
;
143 * Linked List containing the child sa's of the current IKE_SA.
145 linked_list_t
*child_sas
;
148 * crypter for inbound traffic
150 crypter_t
*crypter_in
;
153 * crypter for outbound traffic
155 crypter_t
*crypter_out
;
158 * Signer for inbound traffic
163 * Signer for outbound traffic
165 signer_t
*signer_out
;
168 * Multi purpose prf, set key, use it, forget it
173 * Prf function for derivating keymat child SAs
178 * PRF to build outging authentication data
183 * PRF to verify incoming authentication data
188 * NAT status of local host.
193 * NAT status of remote host.
198 * Virtual IP on local host, if any
200 host_t
*my_virtual_ip
;
203 * Virtual IP on remote host, if any
205 host_t
*other_virtual_ip
;
208 * List of DNS servers installed by us
210 linked_list_t
*dns_servers
;
213 * Timestamps for this IKE_SA
216 /** last IKE message received */
218 /** last IKE message sent */
220 /** when IKE_SA became established */
221 u_int32_t established
;
222 /** when IKE_SA gets rekeyed */
224 /** when IKE_SA gets deleted */
229 * how many times we have retried so far (keyingtries)
235 * get the time of the latest traffic processed by the kernel
237 static time_t get_use_time(private_ike_sa_t
* this, bool inbound
)
239 iterator_t
*iterator
;
240 child_sa_t
*child_sa
;
241 time_t latest
= 0, use_time
;
243 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
244 while (iterator
->iterate(iterator
, (void**)&child_sa
))
246 if (child_sa
->get_use_time(child_sa
, inbound
, &use_time
) == SUCCESS
)
248 latest
= max(latest
, use_time
);
251 iterator
->destroy(iterator
);
255 return max(this->time
.inbound
, latest
);
259 return max(this->time
.outbound
, latest
);
264 * Implementation of ike_sa_t.get_unique_id
266 static u_int32_t
get_unique_id(private_ike_sa_t
*this)
268 return this->unique_id
;
272 * Implementation of ike_sa_t.get_name.
274 static char *get_name(private_ike_sa_t
*this)
278 return this->peer_cfg
->get_name(this->peer_cfg
);
284 * Implementation of ike_sa_t.get_my_host.
286 static host_t
*get_my_host(private_ike_sa_t
*this)
288 return this->my_host
;
292 * Implementation of ike_sa_t.set_my_host.
294 static void set_my_host(private_ike_sa_t
*this, host_t
*me
)
296 DESTROY_IF(this->my_host
);
301 * Implementation of ike_sa_t.get_other_host.
303 static host_t
*get_other_host(private_ike_sa_t
*this)
305 return this->other_host
;
309 * Implementation of ike_sa_t.set_other_host.
311 static void set_other_host(private_ike_sa_t
*this, host_t
*other
)
313 DESTROY_IF(this->other_host
);
314 this->other_host
= other
;
318 * Implementation of ike_sa_t.get_peer_cfg
320 static peer_cfg_t
* get_peer_cfg(private_ike_sa_t
*this)
322 return this->peer_cfg
;
326 * Implementation of ike_sa_t.set_peer_cfg
328 static void set_peer_cfg(private_ike_sa_t
*this, peer_cfg_t
*peer_cfg
)
331 identification_t
*my_id
, *other_id
;
333 peer_cfg
->get_ref(peer_cfg
);
334 this->peer_cfg
= peer_cfg
;
335 if (this->ike_cfg
== NULL
)
337 this->ike_cfg
= peer_cfg
->get_ike_cfg(peer_cfg
);
338 this->ike_cfg
->get_ref(this->ike_cfg
);
341 /* apply values, so we are ready to initate/acquire */
342 if (this->my_host
->is_anyaddr(this->my_host
))
344 me
= this->ike_cfg
->get_my_host(this->ike_cfg
);
345 set_my_host(this, me
->clone(me
));
347 if (this->other_host
->is_anyaddr(this->other_host
))
349 other
= this->ike_cfg
->get_other_host(this->ike_cfg
);
350 set_other_host(this, other
->clone(other
));
352 my_id
= this->peer_cfg
->get_my_id(this->peer_cfg
);
353 other_id
= this->peer_cfg
->get_other_id(this->peer_cfg
);
354 DESTROY_IF(this->my_id
);
355 DESTROY_IF(this->other_id
);
356 this->my_id
= my_id
->clone(my_id
);
357 this->other_id
= other_id
->clone(other_id
);
361 * Implementation of ike_sa_t.get_ike_cfg
363 static ike_cfg_t
*get_ike_cfg(private_ike_sa_t
*this)
365 return this->ike_cfg
;
369 * Implementation of ike_sa_t.set_ike_cfg
371 static void set_ike_cfg(private_ike_sa_t
*this, ike_cfg_t
*ike_cfg
)
373 ike_cfg
->get_ref(ike_cfg
);
374 this->ike_cfg
= ike_cfg
;
378 * Implementation of ike_sa_t.send_dpd
380 static status_t
send_dpd(private_ike_sa_t
*this)
385 delay
= this->peer_cfg
->get_dpd_delay(this->peer_cfg
);
393 if (this->task_manager
->busy(this->task_manager
))
395 /* an exchange is in the air, no need to start a DPD check */
400 /* check if there was any inbound traffic */
402 last_in
= get_use_time(this, TRUE
);
404 diff
= now
- last_in
;
407 /* to long ago, initiate dead peer detection */
410 task
= (task_t
*)ike_dpd_create(TRUE
);
412 DBG1(DBG_IKE
, "sending DPD request");
414 this->task_manager
->queue_task(this->task_manager
, task
);
415 this->task_manager
->initiate(this->task_manager
);
418 /* recheck in "interval" seconds */
419 job
= send_dpd_job_create(this->ike_sa_id
);
420 charon
->event_queue
->add_relative(charon
->event_queue
, (job_t
*)job
,
421 (delay
- diff
) * 1000);
426 * Implementation of ike_sa_t.send_keepalive
428 static void send_keepalive(private_ike_sa_t
*this)
430 send_keepalive_job_t
*job
;
431 time_t last_out
, now
, diff
, interval
;
433 last_out
= get_use_time(this, FALSE
);
436 diff
= now
- last_out
;
437 interval
= charon
->configuration
->get_keepalive_interval(charon
->configuration
);
439 if (diff
>= interval
)
444 packet
= packet_create();
445 packet
->set_source(packet
, this->my_host
->clone(this->my_host
));
446 packet
->set_destination(packet
, this->other_host
->clone(this->other_host
));
447 data
.ptr
= malloc(1);
450 packet
->set_data(packet
, data
);
451 charon
->sender
->send(charon
->sender
, packet
);
452 DBG1(DBG_IKE
, "sending keep alive");
455 job
= send_keepalive_job_create(this->ike_sa_id
);
456 charon
->event_queue
->add_relative(charon
->event_queue
, (job_t
*)job
,
457 (interval
- diff
) * 1000);
461 * Implementation of ike_sa_t.get_state.
463 static ike_sa_state_t
get_state(private_ike_sa_t
*this)
469 * Implementation of ike_sa_t.set_state.
471 static void set_state(private_ike_sa_t
*this, ike_sa_state_t state
)
473 DBG1(DBG_IKE
, "IKE_SA state change: %N => %N",
474 ike_sa_state_names
, this->state
,
475 ike_sa_state_names
, state
);
479 case IKE_ESTABLISHED
:
481 if (this->state
== IKE_CONNECTING
)
484 u_int32_t now
= time(NULL
);
485 u_int32_t soft
, hard
;
488 this->time
.established
= now
;
489 /* start DPD checks */
492 /* schedule rekeying/reauthentication */
493 soft
= this->peer_cfg
->get_lifetime(this->peer_cfg
, TRUE
);
494 hard
= this->peer_cfg
->get_lifetime(this->peer_cfg
, FALSE
);
495 reauth
= this->peer_cfg
->use_reauth(this->peer_cfg
);
496 DBG1(DBG_IKE
, "scheduling %s in %ds, maximum lifetime %ds",
497 reauth
? "reauthentication": "rekeying", soft
, hard
);
501 this->time
.rekey
= now
+ soft
;
502 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, reauth
);
503 charon
->event_queue
->add_relative(charon
->event_queue
, job
,
509 this->time
.delete = now
+ hard
;
510 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
511 charon
->event_queue
->add_relative(charon
->event_queue
, job
,
519 /* delete may fail if a packet gets lost, so set a timeout */
520 job_t
*job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
521 charon
->event_queue
->add_relative(charon
->event_queue
, job
,
522 charon
->configuration
->get_half_open_ike_sa_timeout(
523 charon
->configuration
));
534 * Implementation of ike_sa_t.reset
536 static void reset(private_ike_sa_t
*this)
538 /* the responder ID is reset, as peer may choose another one */
539 if (this->ike_sa_id
->is_initiator(this->ike_sa_id
))
541 this->ike_sa_id
->set_responder_spi(this->ike_sa_id
, 0);
544 set_state(this, IKE_CREATED
);
546 this->task_manager
->reset(this->task_manager
);
550 * Update hosts, as addresses may change (NAT)
552 static void update_hosts(private_ike_sa_t
*this, host_t
*me
, host_t
*other
)
554 iterator_t
*iterator
= NULL
;
555 child_sa_t
*child_sa
= NULL
;
556 host_diff_t my_diff
, other_diff
;
558 if (this->my_host
->is_anyaddr(this->my_host
) ||
559 this->other_host
->is_anyaddr(this->other_host
))
561 /* on first received message */
562 this->my_host
->destroy(this->my_host
);
563 this->my_host
= me
->clone(me
);
564 this->other_host
->destroy(this->other_host
);
565 this->other_host
= other
->clone(other
);
569 my_diff
= me
->get_differences(me
, this->my_host
);
570 other_diff
= other
->get_differences(other
, this->other_host
);
572 if (!my_diff
&& !other_diff
)
579 this->my_host
->destroy(this->my_host
);
580 this->my_host
= me
->clone(me
);
585 /* update without restrictions if we are not NATted */
588 this->other_host
->destroy(this->other_host
);
589 this->other_host
= other
->clone(other
);
594 /* if we are natted, only port may change */
595 if (other_diff
& HOST_DIFF_ADDR
)
599 else if (other_diff
& HOST_DIFF_PORT
)
601 this->other_host
->set_port(this->other_host
, other
->get_port(other
));
604 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
605 while (iterator
->iterate(iterator
, (void**)&child_sa
))
607 child_sa
->update_hosts(child_sa
, this->my_host
, this->other_host
,
608 my_diff
, other_diff
);
610 iterator
->destroy(iterator
);
614 * Implementation of ike_sa_t.generate
616 static status_t
generate_message(private_ike_sa_t
*this, message_t
*message
,
619 this->time
.outbound
= time(NULL
);
620 message
->set_ike_sa_id(message
, this->ike_sa_id
);
621 message
->set_destination(message
, this->other_host
->clone(this->other_host
));
622 message
->set_source(message
, this->my_host
->clone(this->my_host
));
623 return message
->generate(message
, this->crypter_out
, this->signer_out
, packet
);
627 * send a notify back to the sender
629 static void send_notify_response(private_ike_sa_t
*this, message_t
*request
,
635 response
= message_create();
636 response
->set_exchange_type(response
, request
->get_exchange_type(request
));
637 response
->set_request(response
, FALSE
);
638 response
->set_message_id(response
, request
->get_message_id(request
));
639 response
->add_notify(response
, FALSE
, type
, chunk_empty
);
640 if (this->my_host
->is_anyaddr(this->my_host
))
642 this->my_host
->destroy(this->my_host
);
643 this->my_host
= request
->get_destination(request
);
644 this->my_host
= this->my_host
->clone(this->my_host
);
646 if (this->other_host
->is_anyaddr(this->other_host
))
648 this->other_host
->destroy(this->other_host
);
649 this->other_host
= request
->get_source(request
);
650 this->other_host
= this->other_host
->clone(this->other_host
);
652 if (generate_message(this, response
, &packet
) == SUCCESS
)
654 charon
->sender
->send(charon
->sender
, packet
);
656 response
->destroy(response
);
660 * Implementation of ike_sa_t.process_message.
662 static status_t
process_message(private_ike_sa_t
*this, message_t
*message
)
667 is_request
= message
->get_request(message
);
669 status
= message
->parse_body(message
, this->crypter_in
, this->signer_in
);
670 if (status
!= SUCCESS
)
678 DBG1(DBG_IKE
, "ciritcal unknown payloads found");
681 send_notify_response(this, message
, UNSUPPORTED_CRITICAL_PAYLOAD
);
685 DBG1(DBG_IKE
, "message parsing failed");
688 send_notify_response(this, message
, INVALID_SYNTAX
);
692 DBG1(DBG_IKE
, "message verification failed");
695 send_notify_response(this, message
, INVALID_SYNTAX
);
699 DBG1(DBG_IKE
, "integrity check failed");
703 DBG1(DBG_IKE
, "found encrypted message, but no keys available");
706 send_notify_response(this, message
, INVALID_SYNTAX
);
712 DBG1(DBG_IKE
, "%N %s with message ID %d processing failed",
713 exchange_type_names
, message
->get_exchange_type(message
),
714 message
->get_request(message
) ? "request" : "response",
715 message
->get_message_id(message
));
722 me
= message
->get_destination(message
);
723 other
= message
->get_source(message
);
725 /* if this IKE_SA is virgin, we check for a config */
726 if (this->ike_cfg
== NULL
)
729 this->ike_cfg
= charon
->cfg_store
->get_ike_cfg(charon
->cfg_store
,
731 if (this->ike_cfg
== NULL
)
733 /* no config found for these hosts, destroy */
734 DBG1(DBG_IKE
, "no IKE config found for %H...%H, sending %N",
735 me
, other
, notify_type_names
, NO_PROPOSAL_CHOSEN
);
736 send_notify_response(this, message
, NO_PROPOSAL_CHOSEN
);
739 /* add a timeout if peer does not establish it completely */
740 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, FALSE
);
741 charon
->event_queue
->add_relative(charon
->event_queue
, job
,
742 charon
->configuration
->get_half_open_ike_sa_timeout(
743 charon
->configuration
));
746 /* check if message is trustworthy, and update host information */
747 if (this->state
== IKE_CREATED
||
748 message
->get_exchange_type(message
) != IKE_SA_INIT
)
750 update_hosts(this, me
, other
);
751 this->time
.inbound
= time(NULL
);
753 return this->task_manager
->process_message(this->task_manager
, message
);
758 * Implementation of ike_sa_t.initiate.
760 static status_t
initiate(private_ike_sa_t
*this, child_cfg_t
*child_cfg
)
764 if (this->state
== IKE_CREATED
)
767 if (this->other_host
->is_anyaddr(this->other_host
))
769 SIG(IKE_UP_START
, "initiating IKE_SA");
770 SIG(IKE_UP_FAILED
, "unable to initiate to %%any");
774 task
= (task_t
*)ike_init_create(&this->public, TRUE
, NULL
);
775 this->task_manager
->queue_task(this->task_manager
, task
);
776 task
= (task_t
*)ike_natd_create(&this->public, TRUE
);
777 this->task_manager
->queue_task(this->task_manager
, task
);
778 task
= (task_t
*)ike_cert_create(&this->public, TRUE
);
779 this->task_manager
->queue_task(this->task_manager
, task
);
780 task
= (task_t
*)ike_auth_create(&this->public, TRUE
);
781 this->task_manager
->queue_task(this->task_manager
, task
);
782 task
= (task_t
*)ike_config_create(&this->public, TRUE
);
783 this->task_manager
->queue_task(this->task_manager
, task
);
786 task
= (task_t
*)child_create_create(&this->public, child_cfg
);
787 this->task_manager
->queue_task(this->task_manager
, task
);
789 return this->task_manager
->initiate(this->task_manager
);
793 * Implementation of ike_sa_t.acquire.
795 static status_t
acquire(private_ike_sa_t
*this, u_int32_t reqid
)
797 child_cfg_t
*child_cfg
;
798 iterator_t
*iterator
;
799 child_sa_t
*current
, *child_sa
= NULL
;
801 child_create_t
*child_create
;
803 if (this->state
== IKE_DELETING
)
805 SIG(CHILD_UP_START
, "acquiring CHILD_SA on kernel request");
806 SIG(CHILD_UP_FAILED
, "acquiring CHILD_SA (reqid %d) failed: "
807 "IKE_SA is deleting", reqid
);
812 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
813 while (iterator
->iterate(iterator
, (void**)¤t
))
815 if (current
->get_reqid(current
) == reqid
)
821 iterator
->destroy(iterator
);
824 SIG(CHILD_UP_START
, "acquiring CHILD_SA on kernel request");
825 SIG(CHILD_UP_FAILED
, "acquiring CHILD_SA (reqid %d) failed: "
826 "CHILD_SA not found", reqid
);
831 if (this->state
== IKE_CREATED
)
833 task
= (task_t
*)ike_init_create(&this->public, TRUE
, NULL
);
834 this->task_manager
->queue_task(this->task_manager
, task
);
835 task
= (task_t
*)ike_natd_create(&this->public, TRUE
);
836 this->task_manager
->queue_task(this->task_manager
, task
);
837 task
= (task_t
*)ike_cert_create(&this->public, TRUE
);
838 this->task_manager
->queue_task(this->task_manager
, task
);
839 task
= (task_t
*)ike_auth_create(&this->public, TRUE
);
840 this->task_manager
->queue_task(this->task_manager
, task
);
841 task
= (task_t
*)ike_config_create(&this->public, TRUE
);
842 this->task_manager
->queue_task(this->task_manager
, task
);
845 child_cfg
= child_sa
->get_config(child_sa
);
846 child_create
= child_create_create(&this->public, child_cfg
);
847 child_create
->use_reqid(child_create
, reqid
);
848 this->task_manager
->queue_task(this->task_manager
, (task_t
*)child_create
);
850 return this->task_manager
->initiate(this->task_manager
);
854 * Implementation of ike_sa_t.route.
856 static status_t
route(private_ike_sa_t
*this, child_cfg_t
*child_cfg
)
858 child_sa_t
*child_sa
;
859 iterator_t
*iterator
;
860 linked_list_t
*my_ts
, *other_ts
;
863 SIG(CHILD_ROUTE_START
, "routing CHILD_SA");
865 /* check if not already routed*/
866 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
867 while (iterator
->iterate(iterator
, (void**)&child_sa
))
869 if (child_sa
->get_state(child_sa
) == CHILD_ROUTED
&&
870 streq(child_sa
->get_name(child_sa
), child_cfg
->get_name(child_cfg
)))
872 iterator
->destroy(iterator
);
873 SIG(CHILD_ROUTE_FAILED
, "CHILD_SA with such a config already routed");
877 iterator
->destroy(iterator
);
883 SIG(CHILD_ROUTE_FAILED
,
884 "unable to route CHILD_SA, as its IKE_SA gets deleted");
888 case IKE_ESTABLISHED
:
893 /* install kernel policies */
894 child_sa
= child_sa_create(this->my_host
, this->other_host
, this->my_id
,
895 this->other_id
, child_cfg
, FALSE
, 0);
897 my_ts
= child_cfg
->get_traffic_selectors(child_cfg
, TRUE
, NULL
,
899 other_ts
= child_cfg
->get_traffic_selectors(child_cfg
, FALSE
, NULL
,
901 status
= child_sa
->add_policies(child_sa
, my_ts
, other_ts
,
902 child_cfg
->get_mode(child_cfg
));
903 my_ts
->destroy_offset(my_ts
, offsetof(traffic_selector_t
, destroy
));
904 other_ts
->destroy_offset(other_ts
, offsetof(traffic_selector_t
, destroy
));
905 if (status
== SUCCESS
)
907 this->child_sas
->insert_last(this->child_sas
, child_sa
);
908 SIG(CHILD_ROUTE_SUCCESS
, "CHILD_SA routed");
912 SIG(CHILD_ROUTE_FAILED
, "routing CHILD_SA failed");
918 * Implementation of ike_sa_t.unroute.
920 static status_t
unroute(private_ike_sa_t
*this, child_cfg_t
*child_cfg
)
922 iterator_t
*iterator
;
923 child_sa_t
*child_sa
;
926 SIG(CHILD_UNROUTE_START
, "unrouting CHILD_SA");
928 /* find CHILD_SA in ROUTED state */
929 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
930 while (iterator
->iterate(iterator
, (void**)&child_sa
))
932 if (child_sa
->get_state(child_sa
) == CHILD_ROUTED
&&
933 streq(child_sa
->get_name(child_sa
), child_cfg
->get_name(child_cfg
)))
935 iterator
->remove(iterator
);
936 SIG(CHILD_UNROUTE_SUCCESS
, "CHILD_SA unrouted");
937 child_sa
->destroy(child_sa
);
942 iterator
->destroy(iterator
);
946 SIG(CHILD_UNROUTE_FAILED
, "CHILD_SA to unroute not found");
949 /* if we are not established, and we have no more routed childs, remove whole SA */
950 if (this->state
== IKE_CREATED
&&
951 this->child_sas
->get_count(this->child_sas
) == 0)
959 * Implementation of ike_sa_t.retransmit.
961 static status_t
retransmit(private_ike_sa_t
*this, u_int32_t message_id
)
963 this->time
.outbound
= time(NULL
);
964 if (this->task_manager
->retransmit(this->task_manager
, message_id
) != SUCCESS
)
966 child_cfg_t
*child_cfg
;
967 child_sa_t
* child_sa
;
968 linked_list_t
*to_route
, *to_restart
;
969 iterator_t
*iterator
;
971 /* send a proper signal to brief interested bus listeners */
976 /* retry IKE_SA_INIT if we have multiple keyingtries */
977 u_int32_t tries
= this->peer_cfg
->get_keyingtries(this->peer_cfg
);
979 if (tries
== 0 || tries
> this->keyingtry
)
981 SIG(IKE_UP_FAILED
, "peer not responding, trying again "
982 "(%d/%d) in background ", this->keyingtry
+ 1, tries
);
984 return this->task_manager
->initiate(this->task_manager
);
986 SIG(IKE_UP_FAILED
, "establishing IKE_SA failed, peer not responding");
990 SIG(IKE_REKEY_FAILED
, "rekeying IKE_SA failed, peer not responding");
993 SIG(IKE_DOWN_FAILED
, "proper IKE_SA delete failed, peer not responding");
999 /* summarize how we have to handle each child */
1000 to_route
= linked_list_create();
1001 to_restart
= linked_list_create();
1002 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1003 while (iterator
->iterate(iterator
, (void**)&child_sa
))
1005 child_cfg
= child_sa
->get_config(child_sa
);
1007 if (child_sa
->get_state(child_sa
) == CHILD_ROUTED
)
1009 /* reroute routed CHILD_SAs */
1010 to_route
->insert_last(to_route
, child_cfg
);
1014 /* use DPD action for established CHILD_SAs */
1015 switch (this->peer_cfg
->get_dpd_action(this->peer_cfg
))
1018 to_route
->insert_last(to_route
, child_cfg
);
1021 to_restart
->insert_last(to_restart
, child_cfg
);
1028 iterator
->destroy(iterator
);
1030 /* create a new IKE_SA if we have to route or to restart */
1031 if (to_route
->get_count(to_route
) || to_restart
->get_count(to_restart
))
1033 private_ike_sa_t
*new;
1036 new = (private_ike_sa_t
*)charon
->ike_sa_manager
->checkout_new(
1037 charon
->ike_sa_manager
, TRUE
);
1039 set_peer_cfg(new, this->peer_cfg
);
1040 /* use actual used host, not the wildcarded one in config */
1041 new->other_host
->destroy(new->other_host
);
1042 new->other_host
= this->other_host
->clone(this->other_host
);
1044 /* install routes */
1045 while (to_route
->remove_last(to_route
, (void**)&child_cfg
) == SUCCESS
)
1047 route(new, child_cfg
);
1050 /* restart children */
1051 if (to_restart
->get_count(to_restart
))
1053 task
= (task_t
*)ike_init_create(&new->public, TRUE
, NULL
);
1054 new->task_manager
->queue_task(new->task_manager
, task
);
1055 task
= (task_t
*)ike_natd_create(&new->public, TRUE
);
1056 new->task_manager
->queue_task(new->task_manager
, task
);
1057 task
= (task_t
*)ike_cert_create(&new->public, TRUE
);
1058 new->task_manager
->queue_task(new->task_manager
, task
);
1059 task
= (task_t
*)ike_config_create(&new->public, TRUE
);
1060 new->task_manager
->queue_task(new->task_manager
, task
);
1061 task
= (task_t
*)ike_auth_create(&new->public, TRUE
);
1062 new->task_manager
->queue_task(new->task_manager
, task
);
1064 while (to_restart
->remove_last(to_restart
, (void**)&child_cfg
) == SUCCESS
)
1066 task
= (task_t
*)child_create_create(&new->public, child_cfg
);
1067 new->task_manager
->queue_task(new->task_manager
, task
);
1069 new->task_manager
->initiate(new->task_manager
);
1071 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, &new->public);
1073 to_route
->destroy(to_route
);
1074 to_restart
->destroy(to_restart
);
1081 * Implementation of ike_sa_t.get_prf.
1083 static prf_t
*get_prf(private_ike_sa_t
*this)
1089 * Implementation of ike_sa_t.get_prf.
1091 static prf_t
*get_child_prf(private_ike_sa_t
*this)
1093 return this->child_prf
;
1097 * Implementation of ike_sa_t.get_auth_bild
1099 static prf_t
*get_auth_build(private_ike_sa_t
*this)
1101 return this->auth_build
;
1105 * Implementation of ike_sa_t.get_auth_verify
1107 static prf_t
*get_auth_verify(private_ike_sa_t
*this)
1109 return this->auth_verify
;
1113 * Implementation of ike_sa_t.get_id.
1115 static ike_sa_id_t
* get_id(private_ike_sa_t
*this)
1117 return this->ike_sa_id
;
1121 * Implementation of ike_sa_t.get_my_id.
1123 static identification_t
* get_my_id(private_ike_sa_t
*this)
1129 * Implementation of ike_sa_t.set_my_id.
1131 static void set_my_id(private_ike_sa_t
*this, identification_t
*me
)
1133 DESTROY_IF(this->my_id
);
1138 * Implementation of ike_sa_t.get_other_id.
1140 static identification_t
* get_other_id(private_ike_sa_t
*this)
1142 return this->other_id
;
1146 * Implementation of ike_sa_t.set_other_id.
1148 static void set_other_id(private_ike_sa_t
*this, identification_t
*other
)
1150 DESTROY_IF(this->other_id
);
1151 this->other_id
= other
;
1155 * Implementation of ike_sa_t.derive_keys.
1157 static status_t
derive_keys(private_ike_sa_t
*this,
1158 proposal_t
*proposal
, chunk_t secret
,
1159 chunk_t nonce_i
, chunk_t nonce_r
,
1160 bool initiator
, prf_t
*child_prf
, prf_t
*old_prf
)
1162 prf_plus_t
*prf_plus
;
1163 chunk_t skeyseed
, key
, nonces
, prf_plus_seed
;
1166 crypter_t
*crypter_i
, *crypter_r
;
1167 signer_t
*signer_i
, *signer_r
;
1168 prf_t
*prf_i
, *prf_r
;
1169 u_int8_t spi_i_buf
[sizeof(u_int64_t
)], spi_r_buf
[sizeof(u_int64_t
)];
1170 chunk_t spi_i
= chunk_from_buf(spi_i_buf
);
1171 chunk_t spi_r
= chunk_from_buf(spi_r_buf
);
1173 /* Create SAs general purpose PRF first, we may use it here */
1174 if (!proposal
->get_algorithm(proposal
, PSEUDO_RANDOM_FUNCTION
, &algo
))
1176 DBG1(DBG_IKE
, "key derivation failed: no PSEUDO_RANDOM_FUNCTION");;
1179 this->prf
= prf_create(algo
->algorithm
);
1180 if (this->prf
== NULL
)
1182 DBG1(DBG_IKE
, "key derivation failed: PSEUDO_RANDOM_FUNCTION "
1183 "%N not supported!", pseudo_random_function_names
, algo
->algorithm
);
1187 DBG4(DBG_IKE
, "shared Diffie Hellman secret %B", &secret
);
1188 nonces
= chunk_cat("cc", nonce_i
, nonce_r
);
1189 *((u_int64_t
*)spi_i
.ptr
) = this->ike_sa_id
->get_initiator_spi(this->ike_sa_id
);
1190 *((u_int64_t
*)spi_r
.ptr
) = this->ike_sa_id
->get_responder_spi(this->ike_sa_id
);
1191 prf_plus_seed
= chunk_cat("ccc", nonces
, spi_i
, spi_r
);
1193 /* KEYMAT = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr)
1195 * if we are rekeying, SKEYSEED is built on another way
1197 if (child_prf
== NULL
) /* not rekeying */
1199 /* SKEYSEED = prf(Ni | Nr, g^ir) */
1200 this->prf
->set_key(this->prf
, nonces
);
1201 this->prf
->allocate_bytes(this->prf
, secret
, &skeyseed
);
1202 DBG4(DBG_IKE
, "SKEYSEED %B", &skeyseed
);
1203 this->prf
->set_key(this->prf
, skeyseed
);
1204 chunk_free(&skeyseed
);
1205 chunk_free(&secret
);
1206 prf_plus
= prf_plus_create(this->prf
, prf_plus_seed
);
1210 /* SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
1211 * use OLD SAs PRF functions for both prf_plus and prf */
1212 secret
= chunk_cat("mc", secret
, nonces
);
1213 child_prf
->allocate_bytes(child_prf
, secret
, &skeyseed
);
1214 DBG4(DBG_IKE
, "SKEYSEED %B", &skeyseed
);
1215 old_prf
->set_key(old_prf
, skeyseed
);
1216 chunk_free(&skeyseed
);
1217 chunk_free(&secret
);
1218 prf_plus
= prf_plus_create(old_prf
, prf_plus_seed
);
1220 chunk_free(&nonces
);
1221 chunk_free(&prf_plus_seed
);
1223 /* KEYMAT = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr */
1225 /* SK_d is used for generating CHILD_SA key mat => child_prf */
1226 proposal
->get_algorithm(proposal
, PSEUDO_RANDOM_FUNCTION
, &algo
);
1227 this->child_prf
= prf_create(algo
->algorithm
);
1228 key_size
= this->child_prf
->get_key_size(this->child_prf
);
1229 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1230 DBG4(DBG_IKE
, "Sk_d secret %B", &key
);
1231 this->child_prf
->set_key(this->child_prf
, key
);
1234 /* SK_ai/SK_ar used for integrity protection => signer_in/signer_out */
1235 if (!proposal
->get_algorithm(proposal
, INTEGRITY_ALGORITHM
, &algo
))
1237 DBG1(DBG_IKE
, "key derivation failed: no INTEGRITY_ALGORITHM");
1240 signer_i
= signer_create(algo
->algorithm
);
1241 signer_r
= signer_create(algo
->algorithm
);
1242 if (signer_i
== NULL
|| signer_r
== NULL
)
1244 DBG1(DBG_IKE
, "key derivation failed: INTEGRITY_ALGORITHM "
1245 "%N not supported!", integrity_algorithm_names
,algo
->algorithm
);
1248 key_size
= signer_i
->get_key_size(signer_i
);
1250 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1251 DBG4(DBG_IKE
, "Sk_ai secret %B", &key
);
1252 signer_i
->set_key(signer_i
, key
);
1255 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1256 DBG4(DBG_IKE
, "Sk_ar secret %B", &key
);
1257 signer_r
->set_key(signer_r
, key
);
1262 this->signer_in
= signer_r
;
1263 this->signer_out
= signer_i
;
1267 this->signer_in
= signer_i
;
1268 this->signer_out
= signer_r
;
1271 /* SK_ei/SK_er used for encryption => crypter_in/crypter_out */
1272 if (!proposal
->get_algorithm(proposal
, ENCRYPTION_ALGORITHM
, &algo
))
1274 DBG1(DBG_IKE
, "key derivation failed: no ENCRYPTION_ALGORITHM");
1277 crypter_i
= crypter_create(algo
->algorithm
, algo
->key_size
/ 8);
1278 crypter_r
= crypter_create(algo
->algorithm
, algo
->key_size
/ 8);
1279 if (crypter_i
== NULL
|| crypter_r
== NULL
)
1281 DBG1(DBG_IKE
, "key derivation failed: ENCRYPTION_ALGORITHM "
1282 "%N (key size %d) not supported!",
1283 encryption_algorithm_names
, algo
->algorithm
, algo
->key_size
);
1286 key_size
= crypter_i
->get_key_size(crypter_i
);
1288 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1289 DBG4(DBG_IKE
, "Sk_ei secret %B", &key
);
1290 crypter_i
->set_key(crypter_i
, key
);
1293 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1294 DBG4(DBG_IKE
, "Sk_er secret %B", &key
);
1295 crypter_r
->set_key(crypter_r
, key
);
1300 this->crypter_in
= crypter_r
;
1301 this->crypter_out
= crypter_i
;
1305 this->crypter_in
= crypter_i
;
1306 this->crypter_out
= crypter_r
;
1309 /* SK_pi/SK_pr used for authentication => prf_auth_i, prf_auth_r */
1310 proposal
->get_algorithm(proposal
, PSEUDO_RANDOM_FUNCTION
, &algo
);
1311 prf_i
= prf_create(algo
->algorithm
);
1312 prf_r
= prf_create(algo
->algorithm
);
1314 key_size
= prf_i
->get_key_size(prf_i
);
1315 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1316 DBG4(DBG_IKE
, "Sk_pi secret %B", &key
);
1317 prf_i
->set_key(prf_i
, key
);
1320 prf_plus
->allocate_bytes(prf_plus
, key_size
, &key
);
1321 DBG4(DBG_IKE
, "Sk_pr secret %B", &key
);
1322 prf_r
->set_key(prf_r
, key
);
1327 this->auth_verify
= prf_r
;
1328 this->auth_build
= prf_i
;
1332 this->auth_verify
= prf_i
;
1333 this->auth_build
= prf_r
;
1336 /* all done, prf_plus not needed anymore */
1337 prf_plus
->destroy(prf_plus
);
1343 * Implementation of ike_sa_t.add_child_sa.
1345 static void add_child_sa(private_ike_sa_t
*this, child_sa_t
*child_sa
)
1347 this->child_sas
->insert_last(this->child_sas
, child_sa
);
1351 * Implementation of ike_sa_t.get_child_sa.
1353 static child_sa_t
* get_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
,
1354 u_int32_t spi
, bool inbound
)
1356 iterator_t
*iterator
;
1357 child_sa_t
*current
, *found
= NULL
;
1359 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1360 while (iterator
->iterate(iterator
, (void**)¤t
))
1362 if (current
->get_spi(current
, inbound
) == spi
&&
1363 current
->get_protocol(current
) == protocol
)
1368 iterator
->destroy(iterator
);
1373 * Implementation of ike_sa_t.create_child_sa_iterator.
1375 static iterator_t
* create_child_sa_iterator(private_ike_sa_t
*this)
1377 return this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1381 * Implementation of ike_sa_t.rekey_child_sa.
1383 static status_t
rekey_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1385 child_sa_t
*child_sa
;
1386 child_rekey_t
*child_rekey
;
1388 child_sa
= get_child_sa(this, protocol
, spi
, TRUE
);
1391 child_rekey
= child_rekey_create(&this->public, child_sa
);
1392 this->task_manager
->queue_task(this->task_manager
, &child_rekey
->task
);
1393 return this->task_manager
->initiate(this->task_manager
);
1399 * Implementation of ike_sa_t.delete_child_sa.
1401 static status_t
delete_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1403 child_sa_t
*child_sa
;
1404 child_delete_t
*child_delete
;
1406 child_sa
= get_child_sa(this, protocol
, spi
, TRUE
);
1409 child_delete
= child_delete_create(&this->public, child_sa
);
1410 this->task_manager
->queue_task(this->task_manager
, &child_delete
->task
);
1411 return this->task_manager
->initiate(this->task_manager
);
1417 * Implementation of ike_sa_t.destroy_child_sa.
1419 static status_t
destroy_child_sa(private_ike_sa_t
*this, protocol_id_t protocol
,
1422 iterator_t
*iterator
;
1423 child_sa_t
*child_sa
;
1424 status_t status
= NOT_FOUND
;
1426 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1427 while (iterator
->iterate(iterator
, (void**)&child_sa
))
1429 if (child_sa
->get_protocol(child_sa
) == protocol
&&
1430 child_sa
->get_spi(child_sa
, TRUE
) == spi
)
1432 child_sa
->destroy(child_sa
);
1433 iterator
->remove(iterator
);
1438 iterator
->destroy(iterator
);
1443 * Implementation of public_ike_sa_t.delete.
1445 static status_t
delete_(private_ike_sa_t
*this)
1447 ike_delete_t
*ike_delete
;
1449 switch (this->state
)
1451 case IKE_ESTABLISHED
:
1452 DBG1(DBG_IKE
, "deleting IKE_SA");
1453 /* do not log when rekeyed */
1455 ike_delete
= ike_delete_create(&this->public, TRUE
);
1456 this->task_manager
->queue_task(this->task_manager
, &ike_delete
->task
);
1457 return this->task_manager
->initiate(this->task_manager
);
1459 DBG1(DBG_IKE
, "destroying IKE_SA in state %N without notification",
1460 ike_sa_state_names
, this->state
);
1467 * Implementation of ike_sa_t.rekey.
1469 static status_t
rekey(private_ike_sa_t
*this)
1471 ike_rekey_t
*ike_rekey
;
1473 ike_rekey
= ike_rekey_create(&this->public, TRUE
);
1475 this->task_manager
->queue_task(this->task_manager
, &ike_rekey
->task
);
1476 return this->task_manager
->initiate(this->task_manager
);
1480 * Implementation of ike_sa_t.reestablish
1482 static void reestablish(private_ike_sa_t
*this)
1484 private_ike_sa_t
*other
;
1485 iterator_t
*iterator
;
1486 child_sa_t
*child_sa
;
1487 child_cfg_t
*child_cfg
;
1491 other
= (private_ike_sa_t
*)charon
->ike_sa_manager
->checkout_new(
1492 charon
->ike_sa_manager
, TRUE
);
1494 set_peer_cfg(other
, this->peer_cfg
);
1495 other
->other_host
->destroy(other
->other_host
);
1496 other
->other_host
= this->other_host
->clone(this->other_host
);
1498 if (this->state
== IKE_ESTABLISHED
)
1500 task
= (task_t
*)ike_init_create(&other
->public, TRUE
, NULL
);
1501 other
->task_manager
->queue_task(other
->task_manager
, task
);
1502 task
= (task_t
*)ike_natd_create(&other
->public, TRUE
);
1503 other
->task_manager
->queue_task(other
->task_manager
, task
);
1504 task
= (task_t
*)ike_cert_create(&other
->public, TRUE
);
1505 other
->task_manager
->queue_task(other
->task_manager
, task
);
1506 task
= (task_t
*)ike_config_create(&other
->public, TRUE
);
1507 other
->task_manager
->queue_task(other
->task_manager
, task
);
1508 task
= (task_t
*)ike_auth_create(&other
->public, TRUE
);
1509 other
->task_manager
->queue_task(other
->task_manager
, task
);
1512 other
->task_manager
->adopt_tasks(other
->task_manager
, this->task_manager
);
1514 /* Create task for established children, adopt routed children directly */
1515 iterator
= this->child_sas
->create_iterator(this->child_sas
, TRUE
);
1516 while(iterator
->iterate(iterator
, (void**)&child_sa
))
1518 switch (child_sa
->get_state(child_sa
))
1522 iterator
->remove(iterator
);
1523 other
->child_sas
->insert_first(other
->child_sas
, child_sa
);
1528 child_cfg
= child_sa
->get_config(child_sa
);
1529 task
= (task_t
*)child_create_create(&other
->public, child_cfg
);
1530 other
->task_manager
->queue_task(other
->task_manager
, task
);
1535 iterator
->destroy(iterator
);
1537 other
->task_manager
->initiate(other
->task_manager
);
1539 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, &other
->public);
1541 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
1542 charon
->job_queue
->add(charon
->job_queue
, job
);
1546 * Implementation of ike_sa_t.inherit.
1548 static status_t
inherit(private_ike_sa_t
*this, private_ike_sa_t
*other
)
1550 child_sa_t
*child_sa
;
1553 /* apply hosts and ids */
1554 this->my_host
->destroy(this->my_host
);
1555 this->other_host
->destroy(this->other_host
);
1556 this->my_id
->destroy(this->my_id
);
1557 this->other_id
->destroy(this->other_id
);
1558 this->my_host
= other
->my_host
->clone(other
->my_host
);
1559 this->other_host
= other
->other_host
->clone(other
->other_host
);
1560 this->my_id
= other
->my_id
->clone(other
->my_id
);
1561 this->other_id
= other
->other_id
->clone(other
->other_id
);
1563 /* apply virtual assigned IPs... */
1564 if (other
->my_virtual_ip
)
1566 this->my_virtual_ip
= other
->my_virtual_ip
;
1567 other
->my_virtual_ip
= NULL
;
1569 if (other
->other_virtual_ip
)
1571 this->other_virtual_ip
= other
->other_virtual_ip
;
1572 other
->other_virtual_ip
= NULL
;
1575 /* ... and DNS servers */
1576 while (other
->dns_servers
->remove_last(other
->dns_servers
,
1577 (void**)&ip
) == SUCCESS
)
1579 this->dns_servers
->insert_first(this->dns_servers
, ip
);
1582 /* adopt all children */
1583 while (other
->child_sas
->remove_last(other
->child_sas
,
1584 (void**)&child_sa
) == SUCCESS
)
1586 this->child_sas
->insert_first(this->child_sas
, (void*)child_sa
);
1589 /* move pending tasks to the new IKE_SA */
1590 this->task_manager
->adopt_tasks(this->task_manager
, other
->task_manager
);
1592 /* we have to initate here, there may be new tasks to handle */
1593 return this->task_manager
->initiate(this->task_manager
);
1597 * Implementation of ike_sa_t.is_natt_enabled.
1599 static bool is_natt_enabled(private_ike_sa_t
*this)
1601 return this->nat_here
|| this->nat_there
;
1605 * Implementation of ike_sa_t.enable_natt.
1607 static void enable_natt(private_ike_sa_t
*this, bool local
)
1611 DBG1(DBG_IKE
, "local host is behind NAT, scheduling keep alives");
1612 this->nat_here
= TRUE
;
1613 send_keepalive(this);
1617 DBG1(DBG_IKE
, "remote host is behind NAT");
1618 this->nat_there
= TRUE
;
1623 * Implementation of ike_sa_t.set_virtual_ip
1625 static void set_virtual_ip(private_ike_sa_t
*this, bool local
, host_t
*ip
)
1629 DBG1(DBG_IKE
, "installing new virtual IP %H", ip
);
1630 if (this->my_virtual_ip
)
1632 DBG1(DBG_IKE
, "removing old virtual IP %H", this->my_virtual_ip
);
1633 charon
->kernel_interface
->del_ip(charon
->kernel_interface
,
1634 this->my_virtual_ip
,
1636 this->my_virtual_ip
->destroy(this->my_virtual_ip
);
1638 if (charon
->kernel_interface
->add_ip(charon
->kernel_interface
, ip
,
1639 this->my_host
) == SUCCESS
)
1641 this->my_virtual_ip
= ip
->clone(ip
);
1645 DBG1(DBG_IKE
, "installing virtual IP %H failed", ip
);
1646 this->my_virtual_ip
= NULL
;
1651 DESTROY_IF(this->other_virtual_ip
);
1652 this->other_virtual_ip
= ip
->clone(ip
);
1657 * Implementation of ike_sa_t.get_virtual_ip
1659 static host_t
* get_virtual_ip(private_ike_sa_t
*this, bool local
)
1663 return this->my_virtual_ip
;
1667 return this->other_virtual_ip
;
1672 * Implementation of ike_sa_t.remove_dns_server
1674 static void remove_dns_servers(private_ike_sa_t
*this)
1678 chunk_t contents
, line
, orig_line
, token
;
1679 char string
[INET6_ADDRSTRLEN
];
1681 iterator_t
*iterator
;
1683 if (this->dns_servers
->get_count(this->dns_servers
) == 0)
1685 /* don't touch anything if we have no nameservers installed */
1689 file
= fopen(RESOLV_CONF
, "r");
1690 if (file
== NULL
|| stat(RESOLV_CONF
, &stats
) != 0)
1692 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %m", RESOLV_CONF
);
1696 contents
= chunk_alloca((size_t)stats
.st_size
);
1698 if (fread(contents
.ptr
, 1, contents
.len
, file
) != contents
.len
)
1700 DBG1(DBG_IKE
, "unable to read DNS configuration file: %m");
1706 file
= fopen(RESOLV_CONF
, "w");
1709 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %m", RESOLV_CONF
);
1713 iterator
= this->dns_servers
->create_iterator(this->dns_servers
, TRUE
);
1714 while (fetchline(&contents
, &line
))
1718 if (extract_token(&token
, ' ', &line
) &&
1719 strncasecmp(token
.ptr
, "nameserver", token
.len
) == 0)
1721 if (!extract_token(&token
, ' ', &line
))
1725 iterator
->reset(iterator
);
1726 while (iterator
->iterate(iterator
, (void**)&ip
))
1728 snprintf(string
, sizeof(string
), "%H", ip
);
1729 if (strlen(string
) == token
.len
&&
1730 strncmp(token
.ptr
, string
, token
.len
) == 0)
1732 iterator
->remove(iterator
);
1742 /* write line untouched back to file */
1743 fwrite(orig_line
.ptr
, orig_line
.len
, 1, file
);
1744 fprintf(file
, "\n");
1747 iterator
->destroy(iterator
);
1752 * Implementation of ike_sa_t.add_dns_server
1754 static void add_dns_server(private_ike_sa_t
*this, host_t
*dns
)
1760 DBG1(DBG_IKE
, "installing DNS server %H", dns
);
1762 file
= fopen(RESOLV_CONF
, "a+");
1763 if (file
== NULL
|| stat(RESOLV_CONF
, &stats
) != 0)
1765 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %m", RESOLV_CONF
);
1769 contents
= chunk_alloca(stats
.st_size
);
1771 if (fread(contents
.ptr
, 1, contents
.len
, file
) != contents
.len
)
1773 DBG1(DBG_IKE
, "unable to read DNS configuration file: %m");
1779 file
= fopen(RESOLV_CONF
, "w");
1782 DBG1(DBG_IKE
, "unable to open DNS configuration file %s: %m", RESOLV_CONF
);
1786 if (fprintf(file
, "nameserver %H # added by strongSwan, assigned by %D\n",
1787 dns
, this->other_id
) < 0)
1789 DBG1(DBG_IKE
, "unable to write DNS configuration: %m");
1793 this->dns_servers
->insert_last(this->dns_servers
, dns
->clone(dns
));
1795 fwrite(contents
.ptr
, contents
.len
, 1, file
);
1801 * output handler in printf()
1803 static int print(FILE *stream
, const struct printf_info
*info
,
1804 const void *const *args
)
1807 bool reauth
= FALSE
;
1808 private_ike_sa_t
*this = *((private_ike_sa_t
**)(args
[0]));
1812 reauth
= this->peer_cfg
->use_reauth(this->peer_cfg
);
1817 return fprintf(stream
, "(null)");
1820 written
= fprintf(stream
, "%12s[%d]: %N, %H[%D]...%H[%D]", get_name(this),
1821 this->unique_id
, ike_sa_state_names
, this->state
,
1822 this->my_host
, this->my_id
, this->other_host
,
1824 if (this->time
.rekey
)
1826 written
+= fprintf(stream
, "\n%12s[%d]: IKE SPIs: %J, %s in %ds",
1827 get_name(this), this->unique_id
, this->ike_sa_id
,
1828 reauth
? "reauthentication" : "rekeying",
1829 this->time
.rekey
- time(NULL
));
1833 written
+= fprintf(stream
, "\n%12s[%d]: IKE SPIs: %J, rekeying disabled",
1834 get_name(this), this->unique_id
, this->ike_sa_id
);
1841 * register printf() handlers
1843 static void __attribute__ ((constructor
))print_register()
1845 register_printf_function(PRINTF_IKE_SA
, print
, arginfo_ptr
);
1849 * Implementation of ike_sa_t.destroy.
1851 static void destroy(private_ike_sa_t
*this)
1853 this->child_sas
->destroy_offset(this->child_sas
, offsetof(child_sa_t
, destroy
));
1855 DESTROY_IF(this->crypter_in
);
1856 DESTROY_IF(this->crypter_out
);
1857 DESTROY_IF(this->signer_in
);
1858 DESTROY_IF(this->signer_out
);
1859 DESTROY_IF(this->prf
);
1860 DESTROY_IF(this->child_prf
);
1861 DESTROY_IF(this->auth_verify
);
1862 DESTROY_IF(this->auth_build
);
1864 if (this->my_virtual_ip
)
1866 charon
->kernel_interface
->del_ip(charon
->kernel_interface
,
1867 this->my_virtual_ip
, this->my_host
);
1868 this->my_virtual_ip
->destroy(this->my_virtual_ip
);
1870 DESTROY_IF(this->other_virtual_ip
);
1872 remove_dns_servers(this);
1873 this->dns_servers
->destroy_offset(this->dns_servers
, offsetof(host_t
, destroy
));
1875 DESTROY_IF(this->my_host
);
1876 DESTROY_IF(this->other_host
);
1877 DESTROY_IF(this->my_id
);
1878 DESTROY_IF(this->other_id
);
1880 DESTROY_IF(this->ike_cfg
);
1881 DESTROY_IF(this->peer_cfg
);
1883 this->ike_sa_id
->destroy(this->ike_sa_id
);
1884 this->task_manager
->destroy(this->task_manager
);
1889 * Described in header.
1891 ike_sa_t
* ike_sa_create(ike_sa_id_t
*ike_sa_id
)
1893 private_ike_sa_t
*this = malloc_thing(private_ike_sa_t
);
1894 static u_int32_t unique_id
= 0;
1896 /* Public functions */
1897 this->public.get_state
= (ike_sa_state_t(*)(ike_sa_t
*)) get_state
;
1898 this->public.set_state
= (void(*)(ike_sa_t
*,ike_sa_state_t
)) set_state
;
1899 this->public.get_name
= (char*(*)(ike_sa_t
*))get_name
;
1900 this->public.process_message
= (status_t(*)(ike_sa_t
*, message_t
*)) process_message
;
1901 this->public.initiate
= (status_t(*)(ike_sa_t
*,child_cfg_t
*)) initiate
;
1902 this->public.route
= (status_t(*)(ike_sa_t
*,child_cfg_t
*)) route
;
1903 this->public.unroute
= (status_t(*)(ike_sa_t
*,child_cfg_t
*)) unroute
;
1904 this->public.acquire
= (status_t(*)(ike_sa_t
*,u_int32_t
)) acquire
;
1905 this->public.get_ike_cfg
= (ike_cfg_t
*(*)(ike_sa_t
*))get_ike_cfg
;
1906 this->public.set_ike_cfg
= (void(*)(ike_sa_t
*,ike_cfg_t
*))set_ike_cfg
;
1907 this->public.get_peer_cfg
= (peer_cfg_t
*(*)(ike_sa_t
*))get_peer_cfg
;
1908 this->public.set_peer_cfg
= (void(*)(ike_sa_t
*,peer_cfg_t
*))set_peer_cfg
;
1909 this->public.get_id
= (ike_sa_id_t
*(*)(ike_sa_t
*)) get_id
;
1910 this->public.get_my_host
= (host_t
*(*)(ike_sa_t
*)) get_my_host
;
1911 this->public.set_my_host
= (void(*)(ike_sa_t
*,host_t
*)) set_my_host
;
1912 this->public.get_other_host
= (host_t
*(*)(ike_sa_t
*)) get_other_host
;
1913 this->public.set_other_host
= (void(*)(ike_sa_t
*,host_t
*)) set_other_host
;
1914 this->public.get_my_id
= (identification_t
*(*)(ike_sa_t
*)) get_my_id
;
1915 this->public.set_my_id
= (void(*)(ike_sa_t
*,identification_t
*)) set_my_id
;
1916 this->public.get_other_id
= (identification_t
*(*)(ike_sa_t
*)) get_other_id
;
1917 this->public.set_other_id
= (void(*)(ike_sa_t
*,identification_t
*)) set_other_id
;
1918 this->public.retransmit
= (status_t (*) (ike_sa_t
*, u_int32_t
)) retransmit
;
1919 this->public.delete = (status_t(*)(ike_sa_t
*))delete_
;
1920 this->public.destroy
= (void(*)(ike_sa_t
*))destroy
;
1921 this->public.send_dpd
= (status_t (*)(ike_sa_t
*)) send_dpd
;
1922 this->public.send_keepalive
= (void (*)(ike_sa_t
*)) send_keepalive
;
1923 this->public.get_prf
= (prf_t
*(*) (ike_sa_t
*)) get_prf
;
1924 this->public.get_child_prf
= (prf_t
*(*) (ike_sa_t
*)) get_child_prf
;
1925 this->public.get_auth_verify
= (prf_t
*(*) (ike_sa_t
*)) get_auth_verify
;
1926 this->public.get_auth_build
= (prf_t
*(*) (ike_sa_t
*)) get_auth_build
;
1927 this->public.derive_keys
= (status_t (*) (ike_sa_t
*,proposal_t
*,chunk_t
,chunk_t
,chunk_t
,bool,prf_t
*,prf_t
*)) derive_keys
;
1928 this->public.add_child_sa
= (void (*) (ike_sa_t
*,child_sa_t
*)) add_child_sa
;
1929 this->public.get_child_sa
= (child_sa_t
* (*)(ike_sa_t
*,protocol_id_t
,u_int32_t
,bool)) get_child_sa
;
1930 this->public.create_child_sa_iterator
= (iterator_t
* (*)(ike_sa_t
*)) create_child_sa_iterator
;
1931 this->public.rekey_child_sa
= (status_t(*)(ike_sa_t
*,protocol_id_t
,u_int32_t
)) rekey_child_sa
;
1932 this->public.delete_child_sa
= (status_t(*)(ike_sa_t
*,protocol_id_t
,u_int32_t
)) delete_child_sa
;
1933 this->public.destroy_child_sa
= (status_t (*)(ike_sa_t
*,protocol_id_t
,u_int32_t
))destroy_child_sa
;
1934 this->public.enable_natt
= (void(*)(ike_sa_t
*, bool)) enable_natt
;
1935 this->public.is_natt_enabled
= (bool(*)(ike_sa_t
*)) is_natt_enabled
;
1936 this->public.rekey
= (status_t(*)(ike_sa_t
*))rekey
;
1937 this->public.reestablish
= (void(*)(ike_sa_t
*))reestablish
;
1938 this->public.inherit
= (status_t(*)(ike_sa_t
*,ike_sa_t
*))inherit
;
1939 this->public.generate_message
= (status_t(*)(ike_sa_t
*,message_t
*,packet_t
**))generate_message
;
1940 this->public.reset
= (void(*)(ike_sa_t
*))reset
;
1941 this->public.get_unique_id
= (u_int32_t(*)(ike_sa_t
*))get_unique_id
;
1942 this->public.set_virtual_ip
= (void(*)(ike_sa_t
*,bool,host_t
*))set_virtual_ip
;
1943 this->public.get_virtual_ip
= (host_t
*(*)(ike_sa_t
*,bool))get_virtual_ip
;
1944 this->public.add_dns_server
= (void(*)(ike_sa_t
*,host_t
*))add_dns_server
;
1946 /* initialize private fields */
1947 this->ike_sa_id
= ike_sa_id
->clone(ike_sa_id
);
1948 this->child_sas
= linked_list_create();
1949 this->my_host
= host_create_any(AF_INET
);
1950 this->other_host
= host_create_any(AF_INET
);
1951 this->my_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
);
1952 this->other_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
);
1953 this->crypter_in
= NULL
;
1954 this->crypter_out
= NULL
;
1955 this->signer_in
= NULL
;
1956 this->signer_out
= NULL
;
1958 this->auth_verify
= NULL
;
1959 this->auth_build
= NULL
;
1960 this->child_prf
= NULL
;
1961 this->nat_here
= FALSE
;
1962 this->nat_there
= FALSE
;
1963 this->state
= IKE_CREATED
;
1964 this->time
.inbound
= this->time
.outbound
= time(NULL
);
1965 this->time
.established
= 0;
1966 this->time
.rekey
= 0;
1967 this->time
.delete = 0;
1968 this->ike_cfg
= NULL
;
1969 this->peer_cfg
= NULL
;
1970 this->task_manager
= task_manager_create(&this->public);
1971 this->unique_id
= ++unique_id
;
1972 this->my_virtual_ip
= NULL
;
1973 this->other_virtual_ip
= NULL
;
1974 this->dns_servers
= linked_list_create();
1975 this->keyingtry
= 0;
1977 return &this->public;