2 * Copyright (C) 2012-2015 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
5 * Copyright (C) 2011 Martin Willi
6 * Copyright (C) 2011 revosec AG
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * Copyright (C) 2012 Volker RĂ¼melin
22 * Permission is hereby granted, free of charge, to any person obtaining a copy
23 * of this software and associated documentation files (the "Software"), to deal
24 * in the Software without restriction, including without limitation the rights
25 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
26 * copies of the Software, and to permit persons to whom the Software is
27 * furnished to do so, subject to the following conditions:
29 * The above copyright notice and this permission notice shall be included in
30 * all copies or substantial portions of the Software.
32 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
33 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
34 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
35 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
36 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
37 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
41 #include "quick_mode.h"
46 #include <sa/ikev1/keymat_v1.h>
47 #include <encoding/payloads/sa_payload.h>
48 #include <encoding/payloads/nonce_payload.h>
49 #include <encoding/payloads/ke_payload.h>
50 #include <encoding/payloads/id_payload.h>
51 #include <encoding/payloads/payload.h>
52 #include <sa/ikev1/tasks/informational.h>
53 #include <sa/ikev1/tasks/quick_delete.h>
54 #include <processing/jobs/inactivity_job.h>
56 typedef struct private_quick_mode_t private_quick_mode_t
;
59 * Private members of a quick_mode_t task.
61 struct private_quick_mode_t
{
64 * Public methods and task_t interface.
74 * TRUE if we are initiating quick mode
79 * Traffic selector of initiator
81 traffic_selector_t
*tsi
;
84 * Traffic selector of responder
86 traffic_selector_t
*tsr
;
109 * Initiators IPComp CPI
114 * Responders IPComp CPI
119 * selected CHILD_SA proposal
121 proposal_t
*proposal
;
124 * Config of CHILD_SA to establish
129 * CHILD_SA we are about to establish
131 child_sa_t
*child_sa
;
139 * DH exchange, when PFS is in use
141 diffie_hellman_t
*dh
;
144 * Negotiated lifetime of new SA
149 * Negotiated lifebytes of new SA
154 * Reqid to use, 0 for auto-allocate
159 * Explicit inbound mark value to use, if any
164 * Explicit inbound mark value to use, if any
174 * Delete old child after successful rekey
179 * Negotiated mode, tunnel or transport
184 * SA protocol (ESP|AH) negotiated
189 * Use UDP encapsulation
194 * Message ID of handled quick mode exchange
198 /** states of quick mode */
206 * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
208 static void schedule_inactivity_timeout(private_quick_mode_t
*this)
213 timeout
= this->config
->get_inactivity(this->config
);
216 close_ike
= lib
->settings
->get_bool(lib
->settings
,
217 "%s.inactivity_close_ike", FALSE
, lib
->ns
);
218 lib
->scheduler
->schedule_job(lib
->scheduler
, (job_t
*)
219 inactivity_job_create(this->child_sa
->get_unique_id(this->child_sa
),
220 timeout
, close_ike
), timeout
);
225 * Check if we have a an address pool configured
227 static bool have_pool(ike_sa_t
*ike_sa
)
229 enumerator_t
*enumerator
;
230 peer_cfg_t
*peer_cfg
;
234 peer_cfg
= ike_sa
->get_peer_cfg(ike_sa
);
237 enumerator
= peer_cfg
->create_pool_enumerator(peer_cfg
);
238 if (enumerator
->enumerate(enumerator
, &pool
))
242 enumerator
->destroy(enumerator
);
248 * Get hosts to use for dynamic traffic selectors
250 static linked_list_t
*get_dynamic_hosts(ike_sa_t
*ike_sa
, bool local
)
252 enumerator_t
*enumerator
;
256 list
= linked_list_create();
257 enumerator
= ike_sa
->create_virtual_ip_enumerator(ike_sa
, local
);
258 while (enumerator
->enumerate(enumerator
, &host
))
260 list
->insert_last(list
, host
);
262 enumerator
->destroy(enumerator
);
264 if (list
->get_count(list
) == 0)
265 { /* no virtual IPs assigned */
268 host
= ike_sa
->get_my_host(ike_sa
);
269 list
->insert_last(list
, host
);
271 else if (!have_pool(ike_sa
))
272 { /* use host only if we don't have a pool configured */
273 host
= ike_sa
->get_other_host(ike_sa
);
274 list
->insert_last(list
, host
);
281 * Install negotiated CHILD_SA
283 static bool install(private_quick_mode_t
*this)
285 status_t status
, status_i
, status_o
;
286 chunk_t encr_i
, encr_r
, integ_i
, integ_r
;
287 linked_list_t
*tsi
, *tsr
, *my_ts
, *other_ts
;
288 child_sa_t
*old
= NULL
;
290 this->child_sa
->set_proposal(this->child_sa
, this->proposal
);
291 this->child_sa
->set_state(this->child_sa
, CHILD_INSTALLING
);
292 this->child_sa
->set_mode(this->child_sa
, this->mode
);
294 if (this->cpi_i
&& this->cpi_r
)
295 { /* DEFLATE is the only transform we currently support */
296 this->child_sa
->set_ipcomp(this->child_sa
, IPCOMP_DEFLATE
);
300 this->cpi_i
= this->cpi_r
= 0;
303 this->child_sa
->set_protocol(this->child_sa
,
304 this->proposal
->get_protocol(this->proposal
));
306 status_i
= status_o
= FAILED
;
307 encr_i
= encr_r
= integ_i
= integ_r
= chunk_empty
;
308 tsi
= linked_list_create_with_items(this->tsi
->clone(this->tsi
), NULL
);
309 tsr
= linked_list_create_with_items(this->tsr
->clone(this->tsr
), NULL
);
312 charon
->bus
->narrow(charon
->bus
, this->child_sa
,
313 NARROW_INITIATOR_POST_AUTH
, tsi
, tsr
);
317 charon
->bus
->narrow(charon
->bus
, this->child_sa
,
318 NARROW_RESPONDER_POST
, tsr
, tsi
);
320 if (tsi
->get_count(tsi
) == 0 || tsr
->get_count(tsr
) == 0)
322 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
323 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
324 DBG1(DBG_IKE
, "no acceptable traffic selectors found");
328 if (this->keymat
->derive_child_keys(this->keymat
, this->proposal
, this->dh
,
329 this->spi_i
, this->spi_r
, this->nonce_i
, this->nonce_r
,
330 &encr_i
, &integ_i
, &encr_r
, &integ_r
))
334 status_i
= this->child_sa
->install(this->child_sa
,
335 encr_r
, integ_r
, this->spi_i
, this->cpi_i
,
336 this->initiator
, TRUE
, FALSE
, tsi
, tsr
);
337 status_o
= this->child_sa
->install(this->child_sa
,
338 encr_i
, integ_i
, this->spi_r
, this->cpi_r
,
339 this->initiator
, FALSE
, FALSE
, tsi
, tsr
);
343 status_i
= this->child_sa
->install(this->child_sa
,
344 encr_i
, integ_i
, this->spi_r
, this->cpi_r
,
345 this->initiator
, TRUE
, FALSE
, tsr
, tsi
);
346 status_o
= this->child_sa
->install(this->child_sa
,
347 encr_r
, integ_r
, this->spi_i
, this->cpi_i
,
348 this->initiator
, FALSE
, FALSE
, tsr
, tsi
);
351 chunk_clear(&integ_i
);
352 chunk_clear(&integ_r
);
353 chunk_clear(&encr_i
);
354 chunk_clear(&encr_r
);
356 if (status_i
!= SUCCESS
|| status_o
!= SUCCESS
)
358 DBG1(DBG_IKE
, "unable to install %s%s%sIPsec SA (SAD) in kernel",
359 (status_i
!= SUCCESS
) ? "inbound " : "",
360 (status_i
!= SUCCESS
&& status_o
!= SUCCESS
) ? "and ": "",
361 (status_o
!= SUCCESS
) ? "outbound " : "");
362 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
363 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
369 status
= this->child_sa
->add_policies(this->child_sa
, tsi
, tsr
);
373 status
= this->child_sa
->add_policies(this->child_sa
, tsr
, tsi
);
375 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
376 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
377 if (status
!= SUCCESS
)
379 DBG1(DBG_IKE
, "unable to install IPsec policies (SPD) in kernel");
383 charon
->bus
->child_keys(charon
->bus
, this->child_sa
, this->initiator
,
384 this->dh
, this->nonce_i
, this->nonce_r
);
386 /* add to IKE_SA, and remove from task */
387 this->child_sa
->set_state(this->child_sa
, CHILD_INSTALLED
);
388 this->ike_sa
->add_child_sa(this->ike_sa
, this->child_sa
);
390 my_ts
= linked_list_create_from_enumerator(
391 this->child_sa
->create_ts_enumerator(this->child_sa
, TRUE
));
392 other_ts
= linked_list_create_from_enumerator(
393 this->child_sa
->create_ts_enumerator(this->child_sa
, FALSE
));
395 DBG0(DBG_IKE
, "CHILD_SA %s{%d} established "
396 "with SPIs %.8x_i %.8x_o and TS %#R === %#R",
397 this->child_sa
->get_name(this->child_sa
),
398 this->child_sa
->get_unique_id(this->child_sa
),
399 ntohl(this->child_sa
->get_spi(this->child_sa
, TRUE
)),
400 ntohl(this->child_sa
->get_spi(this->child_sa
, FALSE
)), my_ts
, other_ts
);
402 my_ts
->destroy(my_ts
);
403 other_ts
->destroy(other_ts
);
407 old
= this->ike_sa
->get_child_sa(this->ike_sa
,
408 this->proposal
->get_protocol(this->proposal
),
413 charon
->bus
->child_rekey(charon
->bus
, old
, this->child_sa
);
414 /* rekeyed CHILD_SAs stay installed until they expire or are deleted
415 * by the other peer */
416 old
->set_state(old
, CHILD_REKEYED
);
417 /* as initiator we delete the CHILD_SA if configured to do so */
418 if (this->initiator
&& this->delete)
420 this->ike_sa
->queue_task(this->ike_sa
,
421 (task_t
*)quick_delete_create(this->ike_sa
,
422 this->proposal
->get_protocol(this->proposal
),
423 this->rekey
, TRUE
, FALSE
));
428 charon
->bus
->child_updown(charon
->bus
, this->child_sa
, TRUE
);
430 schedule_inactivity_timeout(this);
431 this->child_sa
= NULL
;
436 * Generate and add NONCE
438 static bool add_nonce(private_quick_mode_t
*this, chunk_t
*nonce
,
441 nonce_payload_t
*nonce_payload
;
444 nonceg
= this->keymat
->keymat
.create_nonce_gen(&this->keymat
->keymat
);
447 DBG1(DBG_IKE
, "no nonce generator found to create nonce");
450 if (!nonceg
->allocate_nonce(nonceg
, NONCE_SIZE
, nonce
))
452 DBG1(DBG_IKE
, "nonce allocation failed");
453 nonceg
->destroy(nonceg
);
456 nonceg
->destroy(nonceg
);
458 nonce_payload
= nonce_payload_create(PLV1_NONCE
);
459 nonce_payload
->set_nonce(nonce_payload
, *nonce
);
460 message
->add_payload(message
, &nonce_payload
->payload_interface
);
466 * Extract nonce from NONCE payload
468 static bool get_nonce(private_quick_mode_t
*this, chunk_t
*nonce
,
471 nonce_payload_t
*nonce_payload
;
473 nonce_payload
= (nonce_payload_t
*)message
->get_payload(message
, PLV1_NONCE
);
476 DBG1(DBG_IKE
, "NONCE payload missing in message");
479 *nonce
= nonce_payload
->get_nonce(nonce_payload
);
485 * Add KE payload to message
487 static bool add_ke(private_quick_mode_t
*this, message_t
*message
)
489 ke_payload_t
*ke_payload
;
491 ke_payload
= ke_payload_create_from_diffie_hellman(PLV1_KEY_EXCHANGE
,
495 DBG1(DBG_IKE
, "creating KE payload failed");
498 message
->add_payload(message
, &ke_payload
->payload_interface
);
503 * Get DH value from a KE payload
505 static bool get_ke(private_quick_mode_t
*this, message_t
*message
)
507 ke_payload_t
*ke_payload
;
509 ke_payload
= (ke_payload_t
*)message
->get_payload(message
, PLV1_KEY_EXCHANGE
);
512 DBG1(DBG_IKE
, "KE payload missing");
515 if (!this->dh
->set_other_public_value(this->dh
,
516 ke_payload
->get_key_exchange_data(ke_payload
)))
518 DBG1(DBG_IKE
, "unable to apply received KE value");
525 * Select a traffic selector from configuration
527 static traffic_selector_t
* select_ts(private_quick_mode_t
*this, bool local
,
528 linked_list_t
*supplied
)
530 traffic_selector_t
*ts
;
531 linked_list_t
*list
, *hosts
;
533 hosts
= get_dynamic_hosts(this->ike_sa
, local
);
534 list
= this->config
->get_traffic_selectors(this->config
,
535 local
, supplied
, hosts
);
536 hosts
->destroy(hosts
);
537 if (list
->get_first(list
, (void**)&ts
) == SUCCESS
)
543 DBG1(DBG_IKE
, "%s traffic selector missing in configuration",
544 local
? "local" : "remote");
547 list
->destroy_offset(list
, offsetof(traffic_selector_t
, destroy
));
552 * Add selected traffic selectors to message
554 static void add_ts(private_quick_mode_t
*this, message_t
*message
)
556 id_payload_t
*id_payload
;
558 id_payload
= id_payload_create_from_ts(this->tsi
);
559 message
->add_payload(message
, &id_payload
->payload_interface
);
560 id_payload
= id_payload_create_from_ts(this->tsr
);
561 message
->add_payload(message
, &id_payload
->payload_interface
);
565 * Get traffic selectors from received message
567 static bool get_ts(private_quick_mode_t
*this, message_t
*message
)
569 traffic_selector_t
*tsi
= NULL
, *tsr
= NULL
;
570 enumerator_t
*enumerator
;
571 id_payload_t
*id_payload
;
576 enumerator
= message
->create_payload_enumerator(message
);
577 while (enumerator
->enumerate(enumerator
, &payload
))
579 if (payload
->get_type(payload
) == PLV1_ID
)
581 id_payload
= (id_payload_t
*)payload
;
585 tsi
= id_payload
->get_ts(id_payload
);
590 tsr
= id_payload
->get_ts(id_payload
);
595 enumerator
->destroy(enumerator
);
597 /* create host2host selectors if ID payloads missing */
600 hsi
= this->ike_sa
->get_my_host(this->ike_sa
);
601 hsr
= this->ike_sa
->get_other_host(this->ike_sa
);
605 hsr
= this->ike_sa
->get_my_host(this->ike_sa
);
606 hsi
= this->ike_sa
->get_other_host(this->ike_sa
);
610 tsi
= traffic_selector_create_from_subnet(hsi
->clone(hsi
),
611 hsi
->get_family(hsi
) == AF_INET
? 32 : 128, 0, 0, 65535);
615 tsr
= traffic_selector_create_from_subnet(hsr
->clone(hsr
),
616 hsr
->get_family(hsr
) == AF_INET
? 32 : 128, 0, 0, 65535);
618 if (this->mode
== MODE_TRANSPORT
&& this->udp
&&
619 (!tsi
->is_host(tsi
, hsi
) || !tsr
->is_host(tsr
, hsr
)))
620 { /* change TS in case of a NAT in transport mode */
621 DBG2(DBG_IKE
, "changing received traffic selectors %R=== %R due to NAT",
623 tsi
->set_address(tsi
, hsi
);
624 tsr
->set_address(tsr
, hsr
);
629 traffic_selector_t
*tsisub
, *tsrsub
;
631 /* check if peer selection is valid */
632 tsisub
= this->tsi
->get_subset(this->tsi
, tsi
);
633 tsrsub
= this->tsr
->get_subset(this->tsr
, tsr
);
634 if (!tsisub
|| !tsrsub
)
636 DBG1(DBG_IKE
, "peer selected invalid traffic selectors: "
637 "%R for %R, %R for %R", tsi
, this->tsi
, tsr
, this->tsr
);
646 this->tsi
->destroy(this->tsi
);
647 this->tsr
->destroy(this->tsr
);
662 static encap_t
get_encap(ike_sa_t
* ike_sa
, bool udp
)
668 if (ike_sa
->supports_extension(ike_sa
, EXT_NATT_DRAFT_02_03
))
670 return ENCAP_UDP_DRAFT_00_03
;
676 * Get NAT-OA payload type (RFC 3947 or RFC 3947 drafts).
678 static payload_type_t
get_nat_oa_payload_type(ike_sa_t
*ike_sa
)
680 if (ike_sa
->supports_extension(ike_sa
, EXT_NATT_DRAFT_02_03
))
682 return PLV1_NAT_OA_DRAFT_00_03
;
688 * Add NAT-OA payloads
690 static void add_nat_oa_payloads(private_quick_mode_t
*this, message_t
*message
)
692 identification_t
*id
;
693 id_payload_t
*nat_oa
;
695 payload_type_t nat_oa_payload_type
;
697 src
= message
->get_source(message
);
698 dst
= message
->get_destination(message
);
700 src
= this->initiator
? src
: dst
;
701 dst
= this->initiator
? dst
: src
;
703 nat_oa_payload_type
= get_nat_oa_payload_type(this->ike_sa
);
705 /* first NAT-OA is the initiator's address */
706 id
= identification_create_from_sockaddr(src
->get_sockaddr(src
));
707 nat_oa
= id_payload_create_from_identification(nat_oa_payload_type
, id
);
708 message
->add_payload(message
, (payload_t
*)nat_oa
);
711 /* second NAT-OA is that of the responder */
712 id
= identification_create_from_sockaddr(dst
->get_sockaddr(dst
));
713 nat_oa
= id_payload_create_from_identification(nat_oa_payload_type
, id
);
714 message
->add_payload(message
, (payload_t
*)nat_oa
);
721 static void get_lifetimes(private_quick_mode_t
*this)
725 lft
= this->config
->get_lifetime(this->config
, TRUE
);
728 this->lifetime
= lft
->time
.life
;
732 this->lifebytes
= lft
->bytes
.life
;
738 * Check and apply lifetimes
740 static void apply_lifetimes(private_quick_mode_t
*this, sa_payload_t
*sa_payload
)
745 lifetime
= sa_payload
->get_lifetime(sa_payload
);
746 lifebytes
= sa_payload
->get_lifebytes(sa_payload
);
747 if (this->lifetime
!= lifetime
)
749 DBG1(DBG_IKE
, "received %us lifetime, configured %us",
750 lifetime
, this->lifetime
);
751 this->lifetime
= lifetime
;
753 if (this->lifebytes
!= lifebytes
)
755 DBG1(DBG_IKE
, "received %llu lifebytes, configured %llu",
756 lifebytes
, this->lifebytes
);
757 this->lifebytes
= lifebytes
;
762 * Set the task ready to build notify error message
764 static status_t
send_notify(private_quick_mode_t
*this, notify_type_t type
)
766 notify_payload_t
*notify
;
768 notify
= notify_payload_create_from_protocol_and_type(PLV1_NOTIFY
,
770 notify
->set_spi(notify
, this->spi_i
);
772 this->ike_sa
->queue_task(this->ike_sa
,
773 (task_t
*)informational_create(this->ike_sa
, notify
));
774 /* cancel all active/passive tasks in favour of informational */
775 this->ike_sa
->flush_queue(this->ike_sa
,
776 this->initiator
? TASK_QUEUE_ACTIVE
: TASK_QUEUE_PASSIVE
);
781 * Prepare a list of proposals from child_config containing only the specified
782 * DH group, unless it is set to MODP_NONE.
784 static linked_list_t
*get_proposals(private_quick_mode_t
*this,
785 diffie_hellman_group_t group
)
788 proposal_t
*proposal
;
789 enumerator_t
*enumerator
;
791 list
= this->config
->get_proposals(this->config
, FALSE
);
792 enumerator
= list
->create_enumerator(list
);
793 while (enumerator
->enumerate(enumerator
, &proposal
))
795 if (group
!= MODP_NONE
)
797 if (!proposal
->has_dh_group(proposal
, group
))
799 list
->remove_at(list
, enumerator
);
800 proposal
->destroy(proposal
);
803 proposal
->strip_dh(proposal
, group
);
805 proposal
->set_spi(proposal
, this->spi_i
);
807 enumerator
->destroy(enumerator
);
812 METHOD(task_t
, build_i
, status_t
,
813 private_quick_mode_t
*this, message_t
*message
)
819 sa_payload_t
*sa_payload
;
820 linked_list_t
*list
, *tsi
, *tsr
;
821 proposal_t
*proposal
;
822 diffie_hellman_group_t group
;
825 this->udp
= this->ike_sa
->has_condition(this->ike_sa
, COND_NAT_ANY
);
826 this->mode
= this->config
->get_mode(this->config
);
827 this->child_sa
= child_sa_create(
828 this->ike_sa
->get_my_host(this->ike_sa
),
829 this->ike_sa
->get_other_host(this->ike_sa
),
830 this->config
, this->reqid
, this->udp
,
831 this->mark_in
, this->mark_out
);
833 if (this->udp
&& this->mode
== MODE_TRANSPORT
)
835 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
836 add_nat_oa_payloads(this, message
);
839 if (this->config
->use_ipcomp(this->config
))
841 this->cpi_i
= this->child_sa
->alloc_cpi(this->child_sa
);
844 DBG1(DBG_IKE
, "unable to allocate a CPI from kernel, "
849 list
= this->config
->get_proposals(this->config
, MODP_NONE
);
850 if (list
->get_first(list
, (void**)&proposal
) == SUCCESS
)
852 this->proto
= proposal
->get_protocol(proposal
);
854 list
->destroy_offset(list
, offsetof(proposal_t
, destroy
));
855 this->spi_i
= this->child_sa
->alloc_spi(this->child_sa
, this->proto
);
858 DBG1(DBG_IKE
, "allocating SPI from kernel failed");
862 group
= this->config
->get_dh_group(this->config
);
863 if (group
!= MODP_NONE
)
865 proposal_t
*proposal
;
866 uint16_t preferred_group
;
868 proposal
= this->ike_sa
->get_proposal(this->ike_sa
);
869 proposal
->get_algorithm(proposal
, DIFFIE_HELLMAN_GROUP
,
870 &preferred_group
, NULL
);
871 /* try the negotiated DH group from IKE_SA */
872 list
= get_proposals(this, preferred_group
);
873 if (list
->get_count(list
))
875 group
= preferred_group
;
879 /* fall back to the first configured DH group */
881 list
= get_proposals(this, group
);
884 this->dh
= this->keymat
->keymat
.create_dh(&this->keymat
->keymat
,
888 DBG1(DBG_IKE
, "configured DH group %N not supported",
889 diffie_hellman_group_names
, group
);
890 list
->destroy_offset(list
, offsetof(proposal_t
, destroy
));
896 list
= get_proposals(this, MODP_NONE
);
900 encap
= get_encap(this->ike_sa
, this->udp
);
901 sa_payload
= sa_payload_create_from_proposals_v1(list
,
902 this->lifetime
, this->lifebytes
, AUTH_NONE
,
903 this->mode
, encap
, this->cpi_i
);
904 list
->destroy_offset(list
, offsetof(proposal_t
, destroy
));
905 message
->add_payload(message
, &sa_payload
->payload_interface
);
907 if (!add_nonce(this, &this->nonce_i
, message
))
911 if (group
!= MODP_NONE
)
913 if (!add_ke(this, message
))
920 this->tsi
= select_ts(this, TRUE
, NULL
);
924 this->tsr
= select_ts(this, FALSE
, NULL
);
926 tsi
= linked_list_create_with_items(this->tsi
, NULL
);
927 tsr
= linked_list_create_with_items(this->tsr
, NULL
);
928 this->tsi
= this->tsr
= NULL
;
929 charon
->bus
->narrow(charon
->bus
, this->child_sa
,
930 NARROW_INITIATOR_PRE_AUTH
, tsi
, tsr
);
931 tsi
->remove_first(tsi
, (void**)&this->tsi
);
932 tsr
->remove_first(tsr
, (void**)&this->tsr
);
933 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
934 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
935 if (!this->tsi
|| !this->tsr
)
939 add_ts(this, message
);
952 * Check for notify errors, return TRUE if error found
954 static bool has_notify_errors(private_quick_mode_t
*this, message_t
*message
)
956 enumerator_t
*enumerator
;
960 enumerator
= message
->create_payload_enumerator(message
);
961 while (enumerator
->enumerate(enumerator
, &payload
))
963 if (payload
->get_type(payload
) == PLV1_NOTIFY
)
965 notify_payload_t
*notify
;
968 notify
= (notify_payload_t
*)payload
;
969 type
= notify
->get_notify_type(notify
);
973 DBG1(DBG_IKE
, "received %N error notify",
974 notify_type_names
, type
);
979 DBG1(DBG_IKE
, "received %N notify", notify_type_names
, type
);
983 enumerator
->destroy(enumerator
);
989 * Check if this is a rekey for an existing CHILD_SA, reuse reqid if so
991 static void check_for_rekeyed_child(private_quick_mode_t
*this)
993 enumerator_t
*enumerator
, *policies
;
994 traffic_selector_t
*local
, *remote
;
995 child_sa_t
*child_sa
;
996 proposal_t
*proposal
;
999 name
= this->config
->get_name(this->config
);
1000 enumerator
= this->ike_sa
->create_child_sa_enumerator(this->ike_sa
);
1001 while (this->reqid
== 0 && enumerator
->enumerate(enumerator
, &child_sa
))
1003 if (streq(child_sa
->get_name(child_sa
), name
))
1005 proposal
= child_sa
->get_proposal(child_sa
);
1006 switch (child_sa
->get_state(child_sa
))
1008 case CHILD_INSTALLED
:
1009 case CHILD_REKEYING
:
1010 policies
= child_sa
->create_policy_enumerator(child_sa
);
1011 if (policies
->enumerate(policies
, &local
, &remote
) &&
1012 local
->equals(local
, this->tsr
) &&
1013 remote
->equals(remote
, this->tsi
) &&
1014 this->proposal
->equals(this->proposal
, proposal
))
1016 this->reqid
= child_sa
->get_reqid(child_sa
);
1017 this->rekey
= child_sa
->get_spi(child_sa
, TRUE
);
1018 this->mark_in
= child_sa
->get_mark(child_sa
,
1020 this->mark_out
= child_sa
->get_mark(child_sa
,
1022 child_sa
->set_state(child_sa
, CHILD_REKEYING
);
1023 DBG1(DBG_IKE
, "detected rekeying of CHILD_SA %s{%u}",
1024 child_sa
->get_name(child_sa
),
1025 child_sa
->get_unique_id(child_sa
));
1027 policies
->destroy(policies
);
1035 enumerator
->destroy(enumerator
);
1038 METHOD(task_t
, process_r
, status_t
,
1039 private_quick_mode_t
*this, message_t
*message
)
1041 if (this->mid
&& this->mid
!= message
->get_message_id(message
))
1042 { /* not responsible for this quick mode exchange */
1046 switch (this->state
)
1050 sa_payload_t
*sa_payload
;
1051 linked_list_t
*tsi
, *tsr
, *hostsi
, *hostsr
, *list
= NULL
;
1052 peer_cfg_t
*peer_cfg
;
1054 bool private, prefer_configured
;
1056 sa_payload
= (sa_payload_t
*)message
->get_payload(message
,
1057 PLV1_SECURITY_ASSOCIATION
);
1060 DBG1(DBG_IKE
, "sa payload missing");
1061 return send_notify(this, INVALID_PAYLOAD_TYPE
);
1064 this->mode
= sa_payload
->get_encap_mode(sa_payload
, &this->udp
);
1066 if (!get_ts(this, message
))
1070 peer_cfg
= this->ike_sa
->get_peer_cfg(this->ike_sa
);
1071 tsi
= linked_list_create_with_items(this->tsi
, NULL
);
1072 tsr
= linked_list_create_with_items(this->tsr
, NULL
);
1073 this->tsi
= this->tsr
= NULL
;
1074 hostsi
= get_dynamic_hosts(this->ike_sa
, FALSE
);
1075 hostsr
= get_dynamic_hosts(this->ike_sa
, TRUE
);
1076 this->config
= peer_cfg
->select_child_cfg(peer_cfg
, tsr
, tsi
,
1078 hostsi
->destroy(hostsi
);
1079 hostsr
->destroy(hostsr
);
1082 this->tsi
= select_ts(this, FALSE
, tsi
);
1083 this->tsr
= select_ts(this, TRUE
, tsr
);
1085 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
1086 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
1087 if (!this->config
|| !this->tsi
|| !this->tsr
||
1088 this->mode
!= this->config
->get_mode(this->config
))
1090 DBG1(DBG_IKE
, "no matching CHILD_SA config found");
1091 return send_notify(this, INVALID_ID_INFORMATION
);
1094 if (this->config
->use_ipcomp(this->config
))
1096 list
= sa_payload
->get_ipcomp_proposals(sa_payload
,
1098 if (!list
->get_count(list
))
1100 DBG1(DBG_IKE
, "expected IPComp proposal but peer did "
1101 "not send one, IPComp disabled");
1105 if (!list
|| !list
->get_count(list
))
1108 list
= sa_payload
->get_proposals(sa_payload
);
1110 private = this->ike_sa
->supports_extension(this->ike_sa
,
1112 prefer_configured
= lib
->settings
->get_bool(lib
->settings
,
1113 "%s.prefer_configured_proposals", TRUE
, lib
->ns
);
1114 this->proposal
= this->config
->select_proposal(this->config
, list
,
1115 FALSE
, private, prefer_configured
);
1116 list
->destroy_offset(list
, offsetof(proposal_t
, destroy
));
1118 get_lifetimes(this);
1119 apply_lifetimes(this, sa_payload
);
1121 if (!this->proposal
)
1123 DBG1(DBG_IKE
, "no matching proposal found, sending %N",
1124 notify_type_names
, NO_PROPOSAL_CHOSEN
);
1125 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1127 this->spi_i
= this->proposal
->get_spi(this->proposal
);
1129 if (!get_nonce(this, &this->nonce_i
, message
))
1131 return send_notify(this, INVALID_PAYLOAD_TYPE
);
1134 if (this->proposal
->get_algorithm(this->proposal
,
1135 DIFFIE_HELLMAN_GROUP
, &group
, NULL
))
1137 this->dh
= this->keymat
->keymat
.create_dh(&this->keymat
->keymat
,
1141 DBG1(DBG_IKE
, "negotiated DH group %N not supported",
1142 diffie_hellman_group_names
, group
);
1143 return send_notify(this, INVALID_KEY_INFORMATION
);
1145 if (!get_ke(this, message
))
1147 return send_notify(this, INVALID_PAYLOAD_TYPE
);
1151 check_for_rekeyed_child(this);
1153 this->child_sa
= child_sa_create(
1154 this->ike_sa
->get_my_host(this->ike_sa
),
1155 this->ike_sa
->get_other_host(this->ike_sa
),
1156 this->config
, this->reqid
, this->udp
,
1157 this->mark_in
, this->mark_out
);
1159 tsi
= linked_list_create_with_items(this->tsi
, NULL
);
1160 tsr
= linked_list_create_with_items(this->tsr
, NULL
);
1161 this->tsi
= this->tsr
= NULL
;
1162 charon
->bus
->narrow(charon
->bus
, this->child_sa
,
1163 NARROW_RESPONDER
, tsr
, tsi
);
1164 if (tsi
->remove_first(tsi
, (void**)&this->tsi
) != SUCCESS
||
1165 tsr
->remove_first(tsr
, (void**)&this->tsr
) != SUCCESS
)
1167 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
1168 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
1169 return send_notify(this, INVALID_ID_INFORMATION
);
1171 tsi
->destroy_offset(tsi
, offsetof(traffic_selector_t
, destroy
));
1172 tsr
->destroy_offset(tsr
, offsetof(traffic_selector_t
, destroy
));
1178 if (has_notify_errors(this, message
))
1182 if (message
->get_exchange_type(message
) == INFORMATIONAL_V1
)
1184 if (message
->get_payload(message
, PLV1_DELETE
))
1186 /* If the DELETE for a Quick Mode follows immediately
1187 * after rekeying, we might receive it before the
1188 * third completing Quick Mode message. Ignore it, as
1189 * it gets handled by a separately queued delete task. */
1196 ike_sa_t
*ike_sa
= this->ike_sa
;
1199 task
= (task_t
*)quick_delete_create(this->ike_sa
,
1200 this->proposal
->get_protocol(this->proposal
),
1201 this->spi_i
, TRUE
, TRUE
);
1202 /* flush_queue() destroys the current task */
1203 ike_sa
->flush_queue(ike_sa
, TASK_QUEUE_PASSIVE
);
1204 ike_sa
->queue_task(ike_sa
, task
);
1205 return ALREADY_DONE
;
1214 METHOD(task_t
, build_r
, status_t
,
1215 private_quick_mode_t
*this, message_t
*message
)
1217 if (this->mid
&& this->mid
!= message
->get_message_id(message
))
1218 { /* not responsible for this quick mode exchange */
1222 switch (this->state
)
1226 sa_payload_t
*sa_payload
;
1229 this->proto
= this->proposal
->get_protocol(this->proposal
);
1230 this->spi_r
= this->child_sa
->alloc_spi(this->child_sa
, this->proto
);
1233 DBG1(DBG_IKE
, "allocating SPI from kernel failed");
1234 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1236 this->proposal
->set_spi(this->proposal
, this->spi_r
);
1240 this->cpi_r
= this->child_sa
->alloc_cpi(this->child_sa
);
1243 DBG1(DBG_IKE
, "unable to allocate a CPI from "
1244 "kernel, IPComp disabled");
1245 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1249 if (this->udp
&& this->mode
== MODE_TRANSPORT
)
1251 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
1252 add_nat_oa_payloads(this, message
);
1255 encap
= get_encap(this->ike_sa
, this->udp
);
1256 sa_payload
= sa_payload_create_from_proposal_v1(this->proposal
,
1257 this->lifetime
, this->lifebytes
, AUTH_NONE
,
1258 this->mode
, encap
, this->cpi_r
);
1259 message
->add_payload(message
, &sa_payload
->payload_interface
);
1261 if (!add_nonce(this, &this->nonce_r
, message
))
1267 if (!add_ke(this, message
))
1273 add_ts(this, message
);
1275 this->state
= QM_NEGOTIATED
;
1276 this->mid
= message
->get_message_id(message
);
1280 if (message
->get_exchange_type(message
) == INFORMATIONAL_V1
)
1282 /* skip INFORMATIONAL response if we received a INFORMATIONAL
1283 * delete, see process_r() */
1284 return ALREADY_DONE
;
1292 METHOD(task_t
, process_i
, status_t
,
1293 private_quick_mode_t
*this, message_t
*message
)
1295 switch (this->state
)
1299 sa_payload_t
*sa_payload
;
1300 linked_list_t
*list
= NULL
;
1303 sa_payload
= (sa_payload_t
*)message
->get_payload(message
,
1304 PLV1_SECURITY_ASSOCIATION
);
1307 DBG1(DBG_IKE
, "sa payload missing");
1308 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1312 list
= sa_payload
->get_ipcomp_proposals(sa_payload
,
1314 if (!list
->get_count(list
))
1316 DBG1(DBG_IKE
, "peer did not acccept our IPComp proposal, "
1321 if (!list
|| !list
->get_count(list
))
1324 list
= sa_payload
->get_proposals(sa_payload
);
1326 private = this->ike_sa
->supports_extension(this->ike_sa
,
1328 this->proposal
= this->config
->select_proposal(this->config
, list
,
1329 FALSE
, private, TRUE
);
1330 list
->destroy_offset(list
, offsetof(proposal_t
, destroy
));
1331 if (!this->proposal
)
1333 DBG1(DBG_IKE
, "no matching proposal found");
1334 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1336 this->spi_r
= this->proposal
->get_spi(this->proposal
);
1338 apply_lifetimes(this, sa_payload
);
1340 if (!get_nonce(this, &this->nonce_r
, message
))
1342 return send_notify(this, INVALID_PAYLOAD_TYPE
);
1344 if (this->dh
&& !get_ke(this, message
))
1346 return send_notify(this, INVALID_KEY_INFORMATION
);
1348 if (!get_ts(this, message
))
1350 return send_notify(this, INVALID_PAYLOAD_TYPE
);
1354 return send_notify(this, NO_PROPOSAL_CHOSEN
);
1356 this->state
= QM_NEGOTIATED
;
1364 METHOD(task_t
, get_type
, task_type_t
,
1365 private_quick_mode_t
*this)
1367 return TASK_QUICK_MODE
;
1370 METHOD(quick_mode_t
, get_mid
, uint32_t,
1371 private_quick_mode_t
*this)
1376 METHOD(quick_mode_t
, use_reqid
, void,
1377 private_quick_mode_t
*this, uint32_t reqid
)
1379 this->reqid
= reqid
;
1382 METHOD(quick_mode_t
, use_marks
, void,
1383 private_quick_mode_t
*this, u_int in
, u_int out
)
1386 this->mark_out
= out
;
1389 METHOD(quick_mode_t
, rekey
, void,
1390 private_quick_mode_t
*this, uint32_t spi
)
1395 METHOD(task_t
, migrate
, void,
1396 private_quick_mode_t
*this, ike_sa_t
*ike_sa
)
1398 chunk_free(&this->nonce_i
);
1399 chunk_free(&this->nonce_r
);
1400 DESTROY_IF(this->tsi
);
1401 DESTROY_IF(this->tsr
);
1402 DESTROY_IF(this->proposal
);
1403 DESTROY_IF(this->child_sa
);
1404 DESTROY_IF(this->dh
);
1406 this->ike_sa
= ike_sa
;
1407 this->keymat
= (keymat_v1_t
*)ike_sa
->get_keymat(ike_sa
);
1408 this->state
= QM_INIT
;
1412 this->proposal
= NULL
;
1413 this->child_sa
= NULL
;
1420 if (!this->initiator
)
1422 DESTROY_IF(this->config
);
1423 this->config
= NULL
;
1427 METHOD(task_t
, destroy
, void,
1428 private_quick_mode_t
*this)
1430 chunk_free(&this->nonce_i
);
1431 chunk_free(&this->nonce_r
);
1432 DESTROY_IF(this->tsi
);
1433 DESTROY_IF(this->tsr
);
1434 DESTROY_IF(this->proposal
);
1435 DESTROY_IF(this->child_sa
);
1436 DESTROY_IF(this->config
);
1437 DESTROY_IF(this->dh
);
1442 * Described in header.
1444 quick_mode_t
*quick_mode_create(ike_sa_t
*ike_sa
, child_cfg_t
*config
,
1445 traffic_selector_t
*tsi
, traffic_selector_t
*tsr
)
1447 private_quick_mode_t
*this;
1452 .get_type
= _get_type
,
1453 .migrate
= _migrate
,
1454 .destroy
= _destroy
,
1456 .get_mid
= _get_mid
,
1457 .use_reqid
= _use_reqid
,
1458 .use_marks
= _use_marks
,
1462 .initiator
= config
!= NULL
,
1464 .keymat
= (keymat_v1_t
*)ike_sa
->get_keymat(ike_sa
),
1466 .tsi
= tsi
? tsi
->clone(tsi
) : NULL
,
1467 .tsr
= tsr
? tsr
->clone(tsr
) : NULL
,
1469 .delete = lib
->settings
->get_bool(lib
->settings
,
1470 "%s.delete_rekeyed", FALSE
, lib
->ns
),
1475 this->public.task
.build
= _build_i
;
1476 this->public.task
.process
= _process_i
;
1480 this->public.task
.build
= _build_r
;
1481 this->public.task
.process
= _process_r
;
1484 return &this->public;