src/libcharon/sa/ikev1/tasks/main_mode.c

   1 /*
   2  * Copyright (C) 2011-2012 Tobias Brunner
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * Copyright (C) 2011 Martin Willi
   6  * Copyright (C) 2011 revosec AG
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 #include "main_mode.h"
  20
  21 #include <string.h>
  22
  23 #include <daemon.h>
  24 #include <sa/ikev1/phase1.h>
  25 #include <encoding/payloads/sa_payload.h>
  26 #include <encoding/payloads/id_payload.h>
  27 #include <encoding/payloads/hash_payload.h>
  28 #include <sa/ikev1/tasks/xauth.h>
  29 #include <sa/ikev1/tasks/mode_config.h>
  30 #include <sa/ikev1/tasks/informational.h>
  31 #include <sa/ikev1/tasks/isakmp_delete.h>
  32 #include <processing/jobs/adopt_children_job.h>
  33 #include <processing/jobs/delete_ike_sa_job.h>
  34
  35 typedef struct private_main_mode_t private_main_mode_t;
  36
  37 /**
  38  * Private members of a main_mode_t task.
  39  */
  40 struct private_main_mode_t {
  41
  42         /**
  43          * Public methods and task_t interface.
  44          */
  45         main_mode_t public;
  46
  47         /**
  48          * Assigned IKE_SA.
  49          */
  50         ike_sa_t *ike_sa;
  51
  52         /**
  53          * Are we the initiator?
  54          */
  55         bool initiator;
  56
  57         /**
  58          * Common phase 1 helper class
  59          */
  60         phase1_t *ph1;
  61
  62         /**
  63          * IKE config to establish
  64          */
  65         ike_cfg_t *ike_cfg;
  66
  67         /**
  68          * Peer config to use
  69          */
  70         peer_cfg_t *peer_cfg;
  71
  72         /**
  73          * selected IKE proposal
  74          */
  75         proposal_t *proposal;
  76
  77         /**
  78          * Negotiated SA lifetime
  79          */
  80         uint32_t lifetime;
  81
  82         /**
  83          * Negotiated authentication method
  84          */
  85         auth_method_t method;
  86
  87         /** states of main mode */
  88         enum {
  89                 MM_INIT,
  90                 MM_SA,
  91                 MM_KE,
  92                 MM_AUTH,
  93         } state;
  94 };
  95
  96 /**
  97  * Set IKE_SA to established state
  98  */
  99 static bool establish(private_main_mode_t *this)
 100 {
 101         if (!charon->bus->authorize(charon->bus, TRUE))
 102         {
 103                 DBG1(DBG_IKE, "final authorization hook forbids IKE_SA, cancelling");
 104                 return FALSE;
 105         }
 106
 107         DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
 108                  this->ike_sa->get_name(this->ike_sa),
 109                  this->ike_sa->get_unique_id(this->ike_sa),
 110                  this->ike_sa->get_my_host(this->ike_sa),
 111                  this->ike_sa->get_my_id(this->ike_sa),
 112                  this->ike_sa->get_other_host(this->ike_sa),
 113                  this->ike_sa->get_other_id(this->ike_sa));
 114
 115         this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
 116         charon->bus->ike_updown(charon->bus, this->ike_sa, TRUE);
 117
 118         return TRUE;
 119 }
 120
 121 /**
 122  * Check for notify errors, return TRUE if error found
 123  */
 124 static bool has_notify_errors(private_main_mode_t *this, message_t *message)
 125 {
 126         enumerator_t *enumerator;
 127         payload_t *payload;
 128         bool err = FALSE;
 129
 130         enumerator = message->create_payload_enumerator(message);
 131         while (enumerator->enumerate(enumerator, &payload))
 132         {
 133                 if (payload->get_type(payload) == PLV1_NOTIFY)
 134                 {
 135                         notify_payload_t *notify;
 136                         notify_type_t type;
 137
 138                         notify = (notify_payload_t*)payload;
 139                         type = notify->get_notify_type(notify);
 140                         if (type < 16384)
 141                         {
 142                                 DBG1(DBG_IKE, "received %N error notify",
 143                                          notify_type_names, type);
 144                                 err = TRUE;
 145                         }
 146                         else if (type == INITIAL_CONTACT_IKEV1)
 147                         {
 148                                 if (!this->initiator && this->state == MM_AUTH)
 149                                 {
 150                                         /* If authenticated and received INITIAL_CONTACT,
 151                                          * delete any existing IKE_SAs with that peer.
 152                                          * The delete takes place when the SA is checked in due
 153                                          * to other id not known until the 3rd message.*/
 154                                         this->ike_sa->set_condition(this->ike_sa,
 155                                                                                                 COND_INIT_CONTACT_SEEN, TRUE);
 156                                 }
 157                         }
 158                         else
 159                         {
 160                                 DBG1(DBG_IKE, "received %N notify", notify_type_names, type);
 161                         }
 162                 }
 163         }
 164         enumerator->destroy(enumerator);
 165
 166         return err;
 167 }
 168
 169 /**
 170  * Queue a task sending a notify in an INFORMATIONAL exchange
 171  */
 172 static status_t send_notify(private_main_mode_t *this, notify_type_t type)
 173 {
 174         notify_payload_t *notify;
 175         ike_sa_id_t *ike_sa_id;
 176         uint64_t spi_i, spi_r;
 177         chunk_t spi;
 178
 179         notify = notify_payload_create_from_protocol_and_type(PLV1_NOTIFY,
 180                                                                                                                   PROTO_IKE, type);
 181         ike_sa_id = this->ike_sa->get_id(this->ike_sa);
 182         spi_i = ike_sa_id->get_initiator_spi(ike_sa_id);
 183         spi_r = ike_sa_id->get_responder_spi(ike_sa_id);
 184         spi = chunk_cata("cc", chunk_from_thing(spi_i), chunk_from_thing(spi_r));
 185         notify->set_spi_data(notify, spi);
 186
 187         this->ike_sa->queue_task(this->ike_sa,
 188                                                 (task_t*)informational_create(this->ike_sa, notify));
 189         /* cancel all active/passive tasks in favour of informational */
 190         this->ike_sa->flush_queue(this->ike_sa,
 191                                         this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
 192         return ALREADY_DONE;
 193 }
 194
 195 /**
 196  * Queue a delete task if authentication failed as initiator
 197  */
 198 static status_t send_delete(private_main_mode_t *this)
 199 {
 200         this->ike_sa->queue_task(this->ike_sa,
 201                                                 (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
 202         /* cancel all active tasks in favour of informational */
 203         this->ike_sa->flush_queue(this->ike_sa,
 204                                         this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
 205         return ALREADY_DONE;
 206 }
 207
 208 /**
 209  * Add an INITIAL_CONTACT notify if first contact with peer
 210  */
 211 static void add_initial_contact(private_main_mode_t *this, message_t *message,
 212                                                                 identification_t *idi)
 213 {
 214         identification_t *idr;
 215         host_t *host;
 216         notify_payload_t *notify;
 217         ike_sa_id_t *ike_sa_id;
 218         uint64_t spi_i, spi_r;
 219         chunk_t spi;
 220
 221         idr = this->ph1->get_id(this->ph1, this->peer_cfg, FALSE);
 222         if (idr && !idr->contains_wildcards(idr))
 223         {
 224                 if (this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
 225                 {
 226                         host = this->ike_sa->get_other_host(this->ike_sa);
 227                         if (!charon->ike_sa_manager->has_contact(charon->ike_sa_manager,
 228                                                                                 idi, idr, host->get_family(host)))
 229                         {
 230                                 notify = notify_payload_create_from_protocol_and_type(
 231                                                                 PLV1_NOTIFY, PROTO_IKE, INITIAL_CONTACT_IKEV1);
 232                                 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
 233                                 spi_i = ike_sa_id->get_initiator_spi(ike_sa_id);
 234                                 spi_r = ike_sa_id->get_responder_spi(ike_sa_id);
 235                                 spi = chunk_cata("cc", chunk_from_thing(spi_i),
 236                                                                  chunk_from_thing(spi_r));
 237                                 notify->set_spi_data(notify, spi);
 238                                 message->add_payload(message, (payload_t*)notify);
 239                         }
 240                 }
 241         }
 242 }
 243
 244 METHOD(task_t, build_i, status_t,
 245         private_main_mode_t *this, message_t *message)
 246 {
 247         switch (this->state)
 248         {
 249                 case MM_INIT:
 250                 {
 251                         sa_payload_t *sa_payload;
 252                         linked_list_t *proposals;
 253                         packet_t *packet;
 254
 255                         DBG0(DBG_IKE, "initiating Main Mode IKE_SA %s[%d] to %H",
 256                                  this->ike_sa->get_name(this->ike_sa),
 257                                  this->ike_sa->get_unique_id(this->ike_sa),
 258                                  this->ike_sa->get_other_host(this->ike_sa));
 259                         this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 260
 261                         this->ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 262                         this->peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 263                         this->peer_cfg->get_ref(this->peer_cfg);
 264
 265                         this->method = this->ph1->get_auth_method(this->ph1, this->peer_cfg);
 266                         if (this->method == AUTH_NONE)
 267                         {
 268                                 DBG1(DBG_CFG, "configuration uses unsupported authentication");
 269                                 return FAILED;
 270                         }
 271                         this->lifetime = this->peer_cfg->get_reauth_time(this->peer_cfg,
 272                                                                                                                          FALSE);
 273                         if (!this->lifetime)
 274                         {       /* fall back to rekey time of no rekey time configured */
 275                                 this->lifetime = this->peer_cfg->get_rekey_time(this->peer_cfg,
 276                                                                                                                                  FALSE);
 277                         }
 278                         this->lifetime += this->peer_cfg->get_over_time(this->peer_cfg);
 279                         proposals = this->ike_cfg->get_proposals(this->ike_cfg);
 280                         sa_payload = sa_payload_create_from_proposals_v1(proposals,
 281                                                                         this->lifetime, 0, this->method, MODE_NONE,
 282                                                                         ENCAP_NONE, 0);
 283                         proposals->destroy_offset(proposals, offsetof(proposal_t, destroy));
 284
 285                         message->add_payload(message, &sa_payload->payload_interface);
 286
 287                         /* pregenerate message to store SA payload */
 288                         if (this->ike_sa->generate_message(this->ike_sa, message,
 289                                                                                            &packet) != SUCCESS)
 290                         {
 291                                 DBG1(DBG_IKE, "pregenerating SA payload failed");
 292                                 return FAILED;
 293                         }
 294                         packet->destroy(packet);
 295                         if (!this->ph1->save_sa_payload(this->ph1, message))
 296                         {
 297                                 return FAILED;
 298                         }
 299
 300                         this->state = MM_SA;
 301                         return NEED_MORE;
 302                 }
 303                 case MM_SA:
 304                 {
 305                         uint16_t group;
 306
 307                         if (!this->ph1->create_hasher(this->ph1))
 308                         {
 309                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
 310                         }
 311                         if (!this->proposal->get_algorithm(this->proposal,
 312                                                                                 DIFFIE_HELLMAN_GROUP, &group, NULL))
 313                         {
 314                                 DBG1(DBG_IKE, "DH group selection failed");
 315                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
 316                         }
 317                         if (!this->ph1->create_dh(this->ph1, group))
 318                         {
 319                                 DBG1(DBG_IKE, "negotiated DH group not supported");
 320                                 return send_notify(this, INVALID_KEY_INFORMATION);
 321                         }
 322                         if (!this->ph1->add_nonce_ke(this->ph1, message))
 323                         {
 324                                 return send_notify(this, INVALID_KEY_INFORMATION);
 325                         }
 326                         this->state = MM_KE;
 327                         return NEED_MORE;
 328                 }
 329                 case MM_KE:
 330                 {
 331                         id_payload_t *id_payload;
 332                         identification_t *id;
 333
 334                         id = this->ph1->get_id(this->ph1, this->peer_cfg, TRUE);
 335                         this->ike_sa->set_my_id(this->ike_sa, id->clone(id));
 336                         id_payload = id_payload_create_from_identification(PLV1_ID, id);
 337                         message->add_payload(message, &id_payload->payload_interface);
 338
 339                         if (!this->ph1->build_auth(this->ph1, this->method, message,
 340                                                                            id_payload->get_encoded(id_payload)))
 341                         {
 342                                 charon->bus->alert(charon->bus, ALERT_LOCAL_AUTH_FAILED);
 343                                 return send_notify(this, AUTHENTICATION_FAILED);
 344                         }
 345
 346                         add_initial_contact(this, message, id);
 347
 348                         this->state = MM_AUTH;
 349                         return NEED_MORE;
 350                 }
 351                 default:
 352                         return FAILED;
 353         }
 354 }
 355
 356 METHOD(task_t, process_r, status_t,
 357         private_main_mode_t *this, message_t *message)
 358 {
 359         switch (this->state)
 360         {
 361                 case MM_INIT:
 362                 {
 363                         linked_list_t *list;
 364                         sa_payload_t *sa_payload;
 365                         proposal_selection_flag_t flags = 0;
 366
 367                         this->ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 368                         DBG0(DBG_IKE, "%H is initiating a Main Mode IKE_SA",
 369                                  message->get_source(message));
 370                         this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 371
 372                         this->ike_sa->update_hosts(this->ike_sa,
 373                                                                            message->get_destination(message),
 374                                                                            message->get_source(message), TRUE);
 375
 376                         sa_payload = (sa_payload_t*)message->get_payload(message,
 377                                                                                                         PLV1_SECURITY_ASSOCIATION);
 378                         if (!sa_payload)
 379                         {
 380                                 DBG1(DBG_IKE, "SA payload missing");
 381                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 382                         }
 383                         if (!this->ph1->save_sa_payload(this->ph1, message))
 384                         {
 385                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 386                         }
 387
 388                         list = sa_payload->get_proposals(sa_payload);
 389                         if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)
 390                                 && !lib->settings->get_bool(lib->settings,
 391                                                                         "%s.accept_private_algs", FALSE, lib->ns))
 392                         {
 393                                 flags |= PROPOSAL_SKIP_PRIVATE;
 394                         }
 395                         if (!lib->settings->get_bool(lib->settings,
 396                                                         "%s.prefer_configured_proposals", TRUE, lib->ns))
 397                         {
 398                                 flags |= PROPOSAL_PREFER_SUPPLIED;
 399                         }
 400                         this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
 401                                                                                         list, flags);
 402                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 403                         if (!this->proposal)
 404                         {
 405                                 DBG1(DBG_IKE, "no proposal found");
 406                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
 407                         }
 408                         this->ike_sa->set_proposal(this->ike_sa, this->proposal);
 409
 410                         this->method = sa_payload->get_auth_method(sa_payload);
 411                         this->lifetime = sa_payload->get_lifetime(sa_payload,
 412                                                                                                           this->proposal);
 413
 414                         this->state = MM_SA;
 415                         return NEED_MORE;
 416                 }
 417                 case MM_SA:
 418                 {
 419                         uint16_t group;
 420
 421                         if (!this->ph1->create_hasher(this->ph1))
 422                         {
 423                                 return send_notify(this, INVALID_KEY_INFORMATION);
 424                         }
 425                         if (!this->proposal->get_algorithm(this->proposal,
 426                                                                                 DIFFIE_HELLMAN_GROUP, &group, NULL))
 427                         {
 428                                 DBG1(DBG_IKE, "DH group selection failed");
 429                                 return send_notify(this, INVALID_KEY_INFORMATION);
 430                         }
 431                         if (!this->ph1->create_dh(this->ph1, group))
 432                         {
 433                                 DBG1(DBG_IKE, "negotiated DH group not supported");
 434                                 return send_notify(this, INVALID_KEY_INFORMATION);
 435                         }
 436                         if (!this->ph1->get_nonce_ke(this->ph1, message))
 437                         {
 438                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 439                         }
 440                         this->state = MM_KE;
 441                         return NEED_MORE;
 442                 }
 443                 case MM_KE:
 444                 {
 445                         id_payload_t *id_payload;
 446                         identification_t *id;
 447
 448                         id_payload = (id_payload_t*)message->get_payload(message, PLV1_ID);
 449                         if (!id_payload)
 450                         {
 451                                 DBG1(DBG_IKE, "IDii payload missing");
 452                                 charon->bus->alert(charon->bus, ALERT_PEER_AUTH_FAILED);
 453                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 454                         }
 455                         id = id_payload->get_identification(id_payload);
 456                         this->ike_sa->set_other_id(this->ike_sa, id);
 457
 458                         while (TRUE)
 459                         {
 460                                 DESTROY_IF(this->peer_cfg);
 461                                 this->peer_cfg = this->ph1->select_config(this->ph1,
 462                                                                                                         this->method, FALSE, id);
 463                                 if (!this->peer_cfg)
 464                                 {
 465                                         charon->bus->alert(charon->bus, ALERT_PEER_AUTH_FAILED);
 466                                         return send_notify(this, AUTHENTICATION_FAILED);
 467                                 }
 468                                 this->ike_sa->set_peer_cfg(this->ike_sa, this->peer_cfg);
 469
 470                                 if (this->ph1->verify_auth(this->ph1, this->method, message,
 471                                                                                    id_payload->get_encoded(id_payload)))
 472                                 {
 473                                         break;
 474                                 }
 475                         }
 476
 477                         if (!charon->bus->authorize(charon->bus, FALSE))
 478                         {
 479                                 DBG1(DBG_IKE, "Main Mode authorization hook forbids IKE_SA, "
 480                                          "cancelling");
 481                                 charon->bus->alert(charon->bus, ALERT_PEER_AUTH_FAILED);
 482                                 return send_notify(this, AUTHENTICATION_FAILED);
 483                         }
 484
 485                         this->state = MM_AUTH;
 486                         if (has_notify_errors(this, message))
 487                         {
 488                                 return FAILED;
 489                         }
 490                         return NEED_MORE;
 491                 }
 492                 default:
 493                         return FAILED;
 494         }
 495 }
 496
 497 METHOD(task_t, build_r, status_t,
 498         private_main_mode_t *this, message_t *message)
 499 {
 500         switch (this->state)
 501         {
 502                 case MM_SA:
 503                 {
 504                         sa_payload_t *sa_payload;
 505
 506                         sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
 507                                                                         this->lifetime, 0, this->method, MODE_NONE,
 508                                                                         ENCAP_NONE, 0);
 509                         message->add_payload(message, &sa_payload->payload_interface);
 510
 511                         return NEED_MORE;
 512                 }
 513                 case MM_KE:
 514                 {
 515                         if (!this->ph1->add_nonce_ke(this->ph1, message))
 516                         {
 517                                 return send_notify(this, INVALID_KEY_INFORMATION);
 518                         }
 519                         if (!this->ph1->derive_keys(this->ph1, this->peer_cfg, this->method))
 520                         {
 521                                 return send_notify(this, INVALID_KEY_INFORMATION);
 522                         }
 523                         return NEED_MORE;
 524                 }
 525                 case MM_AUTH:
 526                 {
 527                         id_payload_t *id_payload;
 528                         identification_t *id;
 529                         adopt_children_job_t *job = NULL;
 530                         xauth_t *xauth = NULL;
 531
 532                         id = this->ph1->get_id(this->ph1, this->peer_cfg, TRUE);
 533                         this->ike_sa->set_my_id(this->ike_sa, id->clone(id));
 534
 535                         id_payload = id_payload_create_from_identification(PLV1_ID, id);
 536                         message->add_payload(message, &id_payload->payload_interface);
 537
 538                         if (!this->ph1->build_auth(this->ph1, this->method, message,
 539                                                                            id_payload->get_encoded(id_payload)))
 540                         {
 541                                 charon->bus->alert(charon->bus, ALERT_LOCAL_AUTH_FAILED);
 542                                 return send_notify(this, AUTHENTICATION_FAILED);
 543                         }
 544
 545                         switch (this->method)
 546                         {
 547                                 case AUTH_XAUTH_INIT_PSK:
 548                                 case AUTH_XAUTH_INIT_RSA:
 549                                 case AUTH_HYBRID_INIT_RSA:
 550                                         xauth = xauth_create(this->ike_sa, TRUE);
 551                                         this->ike_sa->queue_task(this->ike_sa, (task_t*)xauth);
 552                                         break;
 553                                 case AUTH_XAUTH_RESP_PSK:
 554                                 case AUTH_XAUTH_RESP_RSA:
 555                                 case AUTH_HYBRID_RESP_RSA:
 556                                         /* wait for XAUTH request */
 557                                         break;
 558                                 default:
 559                                         if (charon->ike_sa_manager->check_uniqueness(
 560                                                                 charon->ike_sa_manager, this->ike_sa, FALSE))
 561                                         {
 562                                                 DBG1(DBG_IKE, "cancelling Main Mode due to uniqueness "
 563                                                          "policy");
 564                                                 return send_notify(this, AUTHENTICATION_FAILED);
 565                                         }
 566                                         if (!establish(this))
 567                                         {
 568                                                 charon->bus->alert(charon->bus, ALERT_PEER_AUTH_FAILED);
 569                                                 return send_notify(this, AUTHENTICATION_FAILED);
 570                                         }
 571                                         job = adopt_children_job_create(
 572                                                                                         this->ike_sa->get_id(this->ike_sa));
 573                                         break;
 574                         }
 575                         if (this->ph1->has_virtual_ip(this->ph1, this->peer_cfg))
 576                         {
 577                                 if (this->peer_cfg->use_pull_mode(this->peer_cfg))
 578                                 {
 579                                         this->ike_sa->queue_task(this->ike_sa,
 580                                                 (task_t*)mode_config_create(this->ike_sa, TRUE, TRUE));
 581                                 }
 582                         }
 583                         else if (this->ph1->has_pool(this->ph1, this->peer_cfg))
 584                         {
 585                                 if (!this->peer_cfg->use_pull_mode(this->peer_cfg))
 586                                 {
 587                                         if (job)
 588                                         {
 589                                                 job->queue_task(job, (task_t*)
 590                                                                 mode_config_create(this->ike_sa, TRUE, FALSE));
 591                                         }
 592                                         else if (xauth)
 593                                         {
 594                                                 xauth->queue_mode_config_push(xauth);
 595                                         }
 596                                         else
 597                                         {
 598                                                 this->ike_sa->queue_task(this->ike_sa, (task_t*)
 599                                                                 mode_config_create(this->ike_sa, TRUE, FALSE));
 600                                         }
 601                                 }
 602                         }
 603                         if (job)
 604                         {
 605                                 lib->processor->queue_job(lib->processor, (job_t*)job);
 606                         }
 607                         return SUCCESS;
 608                 }
 609                 default:
 610                         return FAILED;
 611         }
 612 }
 613
 614 /**
 615  * Schedule a timeout for the IKE_SA should it not establish
 616  */
 617 static void schedule_timeout(ike_sa_t *ike_sa)
 618 {
 619         job_t *job;
 620
 621         job = (job_t*)delete_ike_sa_job_create(ike_sa->get_id(ike_sa), FALSE);
 622         lib->scheduler->schedule_job(lib->scheduler, job, HALF_OPEN_IKE_SA_TIMEOUT);
 623 }
 624
 625 METHOD(task_t, process_i, status_t,
 626         private_main_mode_t *this, message_t *message)
 627 {
 628         switch (this->state)
 629         {
 630                 case MM_SA:
 631                 {
 632                         linked_list_t *list;
 633                         sa_payload_t *sa_payload;
 634                         auth_method_t method;
 635                         proposal_selection_flag_t flags = 0;
 636                         uint32_t lifetime;
 637
 638                         sa_payload = (sa_payload_t*)message->get_payload(message,
 639                                                                                                         PLV1_SECURITY_ASSOCIATION);
 640                         if (!sa_payload)
 641                         {
 642                                 DBG1(DBG_IKE, "SA payload missing");
 643                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 644                         }
 645                         list = sa_payload->get_proposals(sa_payload);
 646                         if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)
 647                                 && !lib->settings->get_bool(lib->settings,
 648                                                                         "%s.accept_private_algs", FALSE, lib->ns))
 649                         {
 650                                 flags |= PROPOSAL_SKIP_PRIVATE;
 651                         }
 652                         this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
 653                                                                                                                         list, flags);
 654                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 655                         if (!this->proposal)
 656                         {
 657                                 DBG1(DBG_IKE, "no proposal found");
 658                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
 659                         }
 660                         this->ike_sa->set_proposal(this->ike_sa, this->proposal);
 661
 662                         lifetime = sa_payload->get_lifetime(sa_payload, this->proposal);
 663                         if (lifetime != this->lifetime)
 664                         {
 665                                 DBG1(DBG_IKE, "received lifetime %us does not match configured "
 666                                          "lifetime %us", lifetime, this->lifetime);
 667                         }
 668                         this->lifetime = lifetime;
 669                         method = sa_payload->get_auth_method(sa_payload);
 670                         if (method != this->method)
 671                         {
 672                                 DBG1(DBG_IKE, "received %N authentication, but configured %N, "
 673                                          "continue with configured", auth_method_names, method,
 674                                          auth_method_names, this->method);
 675                         }
 676                         return NEED_MORE;
 677                 }
 678                 case MM_KE:
 679                 {
 680                         if (!this->ph1->get_nonce_ke(this->ph1, message))
 681                         {
 682                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 683                         }
 684                         if (!this->ph1->derive_keys(this->ph1, this->peer_cfg, this->method))
 685                         {
 686                                 return send_notify(this, INVALID_KEY_INFORMATION);
 687                         }
 688                         return NEED_MORE;
 689                 }
 690                 case MM_AUTH:
 691                 {
 692                         id_payload_t *id_payload;
 693                         identification_t *id, *cid;
 694
 695                         id_payload = (id_payload_t*)message->get_payload(message, PLV1_ID);
 696                         if (!id_payload)
 697                         {
 698                                 DBG1(DBG_IKE, "IDir payload missing");
 699                                 charon->bus->alert(charon->bus, ALERT_PEER_AUTH_FAILED);
 700                                 return send_delete(this);
 701                         }
 702                         id = id_payload->get_identification(id_payload);
 703                         cid = this->ph1->get_id(this->ph1, this->peer_cfg, FALSE);
 704                         if (cid && !id->matches(id, cid))
 705                         {
 706                                 DBG1(DBG_IKE, "IDir '%Y' does not match to '%Y'", id, cid);
 707                                 id->destroy(id);
 708                                 charon->bus->alert(charon->bus, ALERT_PEER_AUTH_FAILED);
 709                                 return send_delete(this);
 710                         }
 711                         this->ike_sa->set_other_id(this->ike_sa, id);
 712
 713                         if (!this->ph1->verify_auth(this->ph1, this->method, message,
 714                                                                                 id_payload->get_encoded(id_payload)))
 715                         {
 716                                 charon->bus->alert(charon->bus, ALERT_PEER_AUTH_FAILED);
 717                                 return send_delete(this);
 718                         }
 719                         if (!charon->bus->authorize(charon->bus, FALSE))
 720                         {
 721                                 DBG1(DBG_IKE, "Main Mode authorization hook forbids IKE_SA, "
 722                                          "cancelling");
 723                                 charon->bus->alert(charon->bus, ALERT_PEER_AUTH_FAILED);
 724                                 return send_delete(this);
 725                         }
 726
 727                         switch (this->method)
 728                         {
 729                                 case AUTH_XAUTH_INIT_PSK:
 730                                 case AUTH_XAUTH_INIT_RSA:
 731                                 case AUTH_HYBRID_INIT_RSA:
 732                                         /* wait for XAUTH request */
 733                                         schedule_timeout(this->ike_sa);
 734                                         break;
 735                                 case AUTH_XAUTH_RESP_PSK:
 736                                 case AUTH_XAUTH_RESP_RSA:
 737                                 case AUTH_HYBRID_RESP_RSA:
 738                                         this->ike_sa->queue_task(this->ike_sa,
 739                                                                         (task_t*)xauth_create(this->ike_sa, TRUE));
 740                                         break;
 741                                 default:
 742                                         if (charon->ike_sa_manager->check_uniqueness(
 743                                                                 charon->ike_sa_manager, this->ike_sa, FALSE))
 744                                         {
 745                                                 DBG1(DBG_IKE, "cancelling Main Mode due to uniqueness "
 746                                                          "policy");
 747                                                 return send_delete(this);
 748                                         }
 749                                         if (!establish(this))
 750                                         {
 751                                                 charon->bus->alert(charon->bus, ALERT_PEER_AUTH_FAILED);
 752                                                 return send_delete(this);
 753                                         }
 754                                         break;
 755                         }
 756                         /* check for and prepare mode config push/pull */
 757                         if (this->ph1->has_virtual_ip(this->ph1, this->peer_cfg))
 758                         {
 759                                 if (this->peer_cfg->use_pull_mode(this->peer_cfg))
 760                                 {
 761                                         this->ike_sa->queue_task(this->ike_sa,
 762                                                 (task_t*)mode_config_create(this->ike_sa, TRUE, TRUE));
 763                                 }
 764                                 else
 765                                 {
 766                                         schedule_timeout(this->ike_sa);
 767                                 }
 768                         }
 769                         else if (this->ph1->has_pool(this->ph1, this->peer_cfg))
 770                         {
 771                                 if (this->peer_cfg->use_pull_mode(this->peer_cfg))
 772                                 {
 773                                         schedule_timeout(this->ike_sa);
 774                                 }
 775                                 else
 776                                 {
 777                                         this->ike_sa->queue_task(this->ike_sa,
 778                                                 (task_t*)mode_config_create(this->ike_sa, TRUE, FALSE));
 779                                 }
 780                         }
 781                         return SUCCESS;
 782                 }
 783                 default:
 784                         return FAILED;
 785         }
 786 }
 787
 788 METHOD(task_t, get_type, task_type_t,
 789         private_main_mode_t *this)
 790 {
 791         return TASK_MAIN_MODE;
 792 }
 793
 794 METHOD(task_t, migrate, void,
 795         private_main_mode_t *this, ike_sa_t *ike_sa)
 796 {
 797         DESTROY_IF(this->peer_cfg);
 798         DESTROY_IF(this->proposal);
 799         this->ph1->destroy(this->ph1);
 800
 801         this->ike_sa = ike_sa;
 802         this->state = MM_INIT;
 803         this->peer_cfg = NULL;
 804         this->proposal = NULL;
 805         this->ph1 = phase1_create(ike_sa, this->initiator);
 806 }
 807
 808 METHOD(task_t, destroy, void,
 809         private_main_mode_t *this)
 810 {
 811         DESTROY_IF(this->peer_cfg);
 812         DESTROY_IF(this->proposal);
 813         this->ph1->destroy(this->ph1);
 814         free(this);
 815 }
 816
 817 /*
 818  * Described in header.
 819  */
 820 main_mode_t *main_mode_create(ike_sa_t *ike_sa, bool initiator)
 821 {
 822         private_main_mode_t *this;
 823
 824         INIT(this,
 825                 .public = {
 826                         .task = {
 827                                 .get_type = _get_type,
 828                                 .migrate = _migrate,
 829                                 .destroy = _destroy,
 830                         },
 831                 },
 832                 .ike_sa = ike_sa,
 833                 .ph1 = phase1_create(ike_sa, initiator),
 834                 .initiator = initiator,
 835                 .state = MM_INIT,
 836         );
 837
 838         if (initiator)
 839         {
 840                 this->public.task.build = _build_i;
 841                 this->public.task.process = _process_i;
 842         }
 843         else
 844         {
 845                 this->public.task.build = _build_r;
 846                 this->public.task.process = _process_r;
 847         }
 848
 849         return &this->public;
 850 }