src/libcharon/sa/ikev1/tasks/quick_mode.c

   1 /*
   2  * Copyright (C) 2012 Tobias Brunner
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * Copyright (C) 2011 Martin Willi
   6  * Copyright (C) 2011 revosec AG
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 #include "quick_mode.h"
  20
  21 #include <string.h>
  22
  23 #include <daemon.h>
  24 #include <sa/ikev1/keymat_v1.h>
  25 #include <encoding/payloads/sa_payload.h>
  26 #include <encoding/payloads/nonce_payload.h>
  27 #include <encoding/payloads/ke_payload.h>
  28 #include <encoding/payloads/id_payload.h>
  29 #include <encoding/payloads/payload.h>
  30 #include <sa/ikev1/tasks/informational.h>
  31 #include <sa/ikev1/tasks/quick_delete.h>
  32 #include <processing/jobs/inactivity_job.h>
  33
  34 typedef struct private_quick_mode_t private_quick_mode_t;
  35
  36 /**
  37  * Private members of a quick_mode_t task.
  38  */
  39 struct private_quick_mode_t {
  40
  41         /**
  42          * Public methods and task_t interface.
  43          */
  44         quick_mode_t public;
  45
  46         /**
  47          * Assigned IKE_SA.
  48          */
  49         ike_sa_t *ike_sa;
  50
  51         /**
  52          * TRUE if we are initiating quick mode
  53          */
  54         bool initiator;
  55
  56         /**
  57          * Traffic selector of initiator
  58          */
  59         traffic_selector_t *tsi;
  60
  61         /**
  62          * Traffic selector of responder
  63          */
  64         traffic_selector_t *tsr;
  65
  66         /**
  67          * Initiators nonce
  68          */
  69         chunk_t nonce_i;
  70
  71         /**
  72          * Responder nonce
  73          */
  74         chunk_t nonce_r;
  75
  76         /**
  77          * Initiators ESP SPI
  78          */
  79         u_int32_t spi_i;
  80
  81         /**
  82          * Responder ESP SPI
  83          */
  84         u_int32_t spi_r;
  85
  86         /**
  87          * Initiators IPComp CPI
  88          */
  89         u_int16_t cpi_i;
  90
  91         /**
  92          * Responders IPComp CPI
  93          */
  94         u_int16_t cpi_r;
  95
  96         /**
  97          * selected CHILD_SA proposal
  98          */
  99         proposal_t *proposal;
 100
 101         /**
 102          * Config of CHILD_SA to establish
 103          */
 104         child_cfg_t *config;
 105
 106         /**
 107          * CHILD_SA we are about to establish
 108          */
 109         child_sa_t *child_sa;
 110
 111         /**
 112          * IKEv1 keymat
 113          */
 114         keymat_v1_t *keymat;
 115
 116         /**
 117          * DH exchange, when PFS is in use
 118          */
 119         diffie_hellman_t *dh;
 120
 121         /**
 122          * Negotiated lifetime of new SA
 123          */
 124         u_int32_t lifetime;
 125
 126         /**
 127          * Negotaited lifebytes of new SA
 128          */
 129         u_int64_t lifebytes;
 130
 131         /**
 132          * Reqid to use, 0 for auto-allocate
 133          */
 134         u_int32_t reqid;
 135
 136         /**
 137          * SPI of SA we rekey
 138          */
 139         u_int32_t rekey;
 140
 141         /**
 142          * Negotiated mode, tunnel or transport
 143          */
 144         ipsec_mode_t mode;
 145
 146         /**
 147          * Use UDP encapsulation
 148          */
 149         bool udp;
 150
 151         /** states of quick mode */
 152         enum {
 153                 QM_INIT,
 154                 QM_NEGOTIATED,
 155         } state;
 156 };
 157
 158 /**
 159  * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
 160  */
 161 static void schedule_inactivity_timeout(private_quick_mode_t *this)
 162 {
 163         u_int32_t timeout;
 164         bool close_ike;
 165
 166         timeout = this->config->get_inactivity(this->config);
 167         if (timeout)
 168         {
 169                 close_ike = lib->settings->get_bool(lib->settings,
 170                                                                 "%s.inactivity_close_ike", FALSE, charon->name);
 171                 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
 172                                 inactivity_job_create(this->child_sa->get_reqid(this->child_sa),
 173                                                                           timeout, close_ike), timeout);
 174         }
 175 }
 176
 177 /**
 178  * Check if we have a an address pool configured
 179  */
 180 static bool have_pool(ike_sa_t *ike_sa)
 181 {
 182         enumerator_t *enumerator;
 183         peer_cfg_t *peer_cfg;
 184         char *pool;
 185         bool found = FALSE;
 186
 187         peer_cfg = ike_sa->get_peer_cfg(ike_sa);
 188         if (peer_cfg)
 189         {
 190                 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
 191                 if (enumerator->enumerate(enumerator, &pool))
 192                 {
 193                         found = TRUE;
 194                 }
 195                 enumerator->destroy(enumerator);
 196         }
 197         return found;
 198 }
 199
 200 /**
 201  * Get hosts to use for dynamic traffic selectors
 202  */
 203 static linked_list_t *get_dynamic_hosts(ike_sa_t *ike_sa, bool local)
 204 {
 205         enumerator_t *enumerator;
 206         linked_list_t *list;
 207         host_t *host;
 208
 209         list = linked_list_create();
 210         enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
 211         while (enumerator->enumerate(enumerator, &host))
 212         {
 213                 list->insert_last(list, host);
 214         }
 215         enumerator->destroy(enumerator);
 216
 217         if (list->get_count(list) == 0)
 218         {       /* no virtual IPs assigned */
 219                 if (local)
 220                 {
 221                         host = ike_sa->get_my_host(ike_sa);
 222                         list->insert_last(list, host);
 223                 }
 224                 else if (!have_pool(ike_sa))
 225                 {       /* use host only if we don't have a pool configured */
 226                         host = ike_sa->get_other_host(ike_sa);
 227                         list->insert_last(list, host);
 228                 }
 229         }
 230         return list;
 231 }
 232
 233 /**
 234  * Install negotiated CHILD_SA
 235  */
 236 static bool install(private_quick_mode_t *this)
 237 {
 238         status_t status, status_i, status_o;
 239         chunk_t encr_i, encr_r, integ_i, integ_r;
 240         linked_list_t *tsi, *tsr;
 241         child_sa_t *old = NULL;
 242
 243         this->child_sa->set_proposal(this->child_sa, this->proposal);
 244         this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
 245         this->child_sa->set_mode(this->child_sa, this->mode);
 246
 247         if (this->cpi_i && this->cpi_r)
 248         {       /* DEFLATE is the only transform we currently support */
 249                 this->child_sa->set_ipcomp(this->child_sa, IPCOMP_DEFLATE);
 250         }
 251         else
 252         {
 253                 this->cpi_i = this->cpi_r = 0;
 254         }
 255
 256         this->child_sa->set_protocol(this->child_sa,
 257                                                                  this->proposal->get_protocol(this->proposal));
 258
 259         status_i = status_o = FAILED;
 260         encr_i = encr_r = integ_i = integ_r = chunk_empty;
 261         tsi = linked_list_create_with_items(this->tsi->clone(this->tsi), NULL);
 262         tsr = linked_list_create_with_items(this->tsr->clone(this->tsr), NULL);
 263         if (this->initiator)
 264         {
 265                 charon->bus->narrow(charon->bus, this->child_sa,
 266                                                         NARROW_INITIATOR_POST_AUTH, tsi, tsr);
 267         }
 268         else
 269         {
 270                 charon->bus->narrow(charon->bus, this->child_sa,
 271                                                         NARROW_RESPONDER_POST, tsr, tsi);
 272         }
 273         if (tsi->get_count(tsi) == 0 || tsr->get_count(tsr) == 0)
 274         {
 275                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 276                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 277                 DBG1(DBG_IKE, "no acceptable traffic selectors found");
 278                 return FALSE;
 279         }
 280
 281         if (this->keymat->derive_child_keys(this->keymat, this->proposal, this->dh,
 282                                                 this->spi_i, this->spi_r, this->nonce_i, this->nonce_r,
 283                                                 &encr_i, &integ_i, &encr_r, &integ_r))
 284         {
 285                 if (this->initiator)
 286                 {
 287                         status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
 288                                                         this->spi_i, this->cpi_i, TRUE, FALSE, tsi, tsr);
 289                         status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
 290                                                         this->spi_r, this->cpi_r, FALSE, FALSE, tsi, tsr);
 291                 }
 292                 else
 293                 {
 294                         status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
 295                                                         this->spi_r, this->cpi_r, TRUE, FALSE, tsr, tsi);
 296                         status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
 297                                                         this->spi_i, this->cpi_i, FALSE, FALSE, tsr, tsi);
 298                 }
 299         }
 300         chunk_clear(&integ_i);
 301         chunk_clear(&integ_r);
 302         chunk_clear(&encr_i);
 303         chunk_clear(&encr_r);
 304
 305         if (status_i != SUCCESS || status_o != SUCCESS)
 306         {
 307                 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
 308                         (status_i != SUCCESS) ? "inbound " : "",
 309                         (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
 310                         (status_o != SUCCESS) ? "outbound " : "");
 311                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 312                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 313                 return FALSE;
 314         }
 315
 316         if (this->initiator)
 317         {
 318                 status = this->child_sa->add_policies(this->child_sa, tsi, tsr);
 319         }
 320         else
 321         {
 322                 status = this->child_sa->add_policies(this->child_sa, tsr, tsi);
 323         }
 324         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 325         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 326         if (status != SUCCESS)
 327         {
 328                 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
 329                 return FALSE;
 330         }
 331
 332         charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
 333                                                         this->dh, this->nonce_i, this->nonce_r);
 334
 335         /* add to IKE_SA, and remove from task */
 336         this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 337         this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
 338
 339         DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
 340                  "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
 341                  this->child_sa->get_name(this->child_sa),
 342                  this->child_sa->get_reqid(this->child_sa),
 343                  ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
 344                  ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
 345                  this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
 346                  this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
 347
 348         if (this->rekey)
 349         {
 350                 old = this->ike_sa->get_child_sa(this->ike_sa,
 351                                                                 this->proposal->get_protocol(this->proposal),
 352                                                                 this->rekey, TRUE);
 353         }
 354         if (old)
 355         {
 356                 charon->bus->child_rekey(charon->bus, old, this->child_sa);
 357         }
 358         else
 359         {
 360                 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
 361         }
 362         if (!this->rekey)
 363         {
 364                 schedule_inactivity_timeout(this);
 365         }
 366         this->child_sa = NULL;
 367         return TRUE;
 368 }
 369
 370 /**
 371  * Generate and add NONCE
 372  */
 373 static bool add_nonce(private_quick_mode_t *this, chunk_t *nonce,
 374                                           message_t *message)
 375 {
 376         nonce_payload_t *nonce_payload;
 377         nonce_gen_t *nonceg;
 378
 379         nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
 380         if (!nonceg)
 381         {
 382                 DBG1(DBG_IKE, "no nonce generator found to create nonce");
 383                 return FALSE;
 384         }
 385         if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, nonce))
 386         {
 387                 DBG1(DBG_IKE, "nonce allocation failed");
 388                 nonceg->destroy(nonceg);
 389                 return FALSE;
 390         }
 391         nonceg->destroy(nonceg);
 392
 393         nonce_payload = nonce_payload_create(NONCE_V1);
 394         nonce_payload->set_nonce(nonce_payload, *nonce);
 395         message->add_payload(message, &nonce_payload->payload_interface);
 396
 397         return TRUE;
 398 }
 399
 400 /**
 401  * Extract nonce from NONCE payload
 402  */
 403 static bool get_nonce(private_quick_mode_t *this, chunk_t *nonce,
 404                                           message_t *message)
 405 {
 406         nonce_payload_t *nonce_payload;
 407
 408         nonce_payload = (nonce_payload_t*)message->get_payload(message, NONCE_V1);
 409         if (!nonce_payload)
 410         {
 411                 DBG1(DBG_IKE, "NONCE payload missing in message");
 412                 return FALSE;
 413         }
 414         *nonce = nonce_payload->get_nonce(nonce_payload);
 415
 416         return TRUE;
 417 }
 418
 419 /**
 420  * Add KE payload to message
 421  */
 422 static void add_ke(private_quick_mode_t *this, message_t *message)
 423 {
 424         ke_payload_t *ke_payload;
 425
 426         ke_payload = ke_payload_create_from_diffie_hellman(KEY_EXCHANGE_V1, this->dh);
 427         message->add_payload(message, &ke_payload->payload_interface);
 428 }
 429
 430 /**
 431  * Get DH value from a KE payload
 432  */
 433 static bool get_ke(private_quick_mode_t *this, message_t *message)
 434 {
 435         ke_payload_t *ke_payload;
 436
 437         ke_payload = (ke_payload_t*)message->get_payload(message, KEY_EXCHANGE_V1);
 438         if (!ke_payload)
 439         {
 440                 DBG1(DBG_IKE, "KE payload missing");
 441                 return FALSE;
 442         }
 443         this->dh->set_other_public_value(this->dh,
 444                                                                 ke_payload->get_key_exchange_data(ke_payload));
 445         return TRUE;
 446 }
 447
 448 /**
 449  * Select a traffic selector from configuration
 450  */
 451 static traffic_selector_t* select_ts(private_quick_mode_t *this, bool local,
 452                                                                          linked_list_t *supplied)
 453 {
 454         traffic_selector_t *ts;
 455         linked_list_t *list, *hosts;
 456
 457         hosts = get_dynamic_hosts(this->ike_sa, local);
 458         list = this->config->get_traffic_selectors(this->config,
 459                                                                                            local, supplied, hosts);
 460         hosts->destroy(hosts);
 461         if (list->get_first(list, (void**)&ts) == SUCCESS)
 462         {
 463                 ts = ts->clone(ts);
 464         }
 465         else
 466         {
 467                 DBG1(DBG_IKE, "%s traffic selector missing in configuration",
 468                          local ? "local" : "local");
 469                 ts = NULL;
 470         }
 471         list->destroy_offset(list, offsetof(traffic_selector_t, destroy));
 472         return ts;
 473 }
 474
 475 /**
 476  * Add selected traffic selectors to message
 477  */
 478 static void add_ts(private_quick_mode_t *this, message_t *message)
 479 {
 480         id_payload_t *id_payload;
 481         host_t *hsi, *hsr;
 482
 483         if (this->initiator)
 484         {
 485                 hsi = this->ike_sa->get_my_host(this->ike_sa);
 486                 hsr = this->ike_sa->get_other_host(this->ike_sa);
 487         }
 488         else
 489         {
 490                 hsr = this->ike_sa->get_my_host(this->ike_sa);
 491                 hsi = this->ike_sa->get_other_host(this->ike_sa);
 492         }
 493         /* add ID payload only if negotiating non host2host tunnels */
 494         if (!this->tsi->is_host(this->tsi, hsi) ||
 495                 !this->tsr->is_host(this->tsr, hsr) ||
 496                 this->tsi->get_protocol(this->tsi) ||
 497                 this->tsr->get_protocol(this->tsr) ||
 498                 this->tsi->get_from_port(this->tsi) ||
 499                 this->tsr->get_from_port(this->tsr) ||
 500                 this->tsi->get_to_port(this->tsi) != 65535 ||
 501                 this->tsr->get_to_port(this->tsr) != 65535)
 502         {
 503                 id_payload = id_payload_create_from_ts(this->tsi);
 504                 message->add_payload(message, &id_payload->payload_interface);
 505                 id_payload = id_payload_create_from_ts(this->tsr);
 506                 message->add_payload(message, &id_payload->payload_interface);
 507         }
 508 }
 509
 510 /**
 511  * Get traffic selectors from received message
 512  */
 513 static bool get_ts(private_quick_mode_t *this, message_t *message)
 514 {
 515         traffic_selector_t *tsi = NULL, *tsr = NULL;
 516         enumerator_t *enumerator;
 517         id_payload_t *id_payload;
 518         payload_t *payload;
 519         host_t *hsi, *hsr;
 520         bool first = TRUE;
 521
 522         enumerator = message->create_payload_enumerator(message);
 523         while (enumerator->enumerate(enumerator, &payload))
 524         {
 525                 if (payload->get_type(payload) == ID_V1)
 526                 {
 527                         id_payload = (id_payload_t*)payload;
 528
 529                         if (first)
 530                         {
 531                                 tsi = id_payload->get_ts(id_payload);
 532                                 first = FALSE;
 533                         }
 534                         else
 535                         {
 536                                 tsr = id_payload->get_ts(id_payload);
 537                                 break;
 538                         }
 539                 }
 540         }
 541         enumerator->destroy(enumerator);
 542
 543         /* create host2host selectors if ID payloads missing */
 544         if (this->initiator)
 545         {
 546                 hsi = this->ike_sa->get_my_host(this->ike_sa);
 547                 hsr = this->ike_sa->get_other_host(this->ike_sa);
 548         }
 549         else
 550         {
 551                 hsr = this->ike_sa->get_my_host(this->ike_sa);
 552                 hsi = this->ike_sa->get_other_host(this->ike_sa);
 553         }
 554         if (!tsi)
 555         {
 556                 tsi = traffic_selector_create_from_subnet(hsi->clone(hsi),
 557                                                         hsi->get_family(hsi) == AF_INET ? 32 : 128, 0, 0);
 558         }
 559         if (!tsr)
 560         {
 561                 tsr = traffic_selector_create_from_subnet(hsr->clone(hsr),
 562                                                         hsr->get_family(hsr) == AF_INET ? 32 : 128, 0, 0);
 563         }
 564         if (!this->initiator && this->mode == MODE_TRANSPORT && this->udp &&
 565            (!tsi->is_host(tsi, hsi) || !tsr->is_host(tsr, hsr)))
 566         {       /* change TS in case of a NAT in transport mode */
 567                 DBG2(DBG_IKE, "changing received traffic selectors %R=== %R due to NAT",
 568                          tsi, tsr);
 569                 tsi->set_address(tsi, hsi);
 570                 tsr->set_address(tsr, hsr);
 571         }
 572
 573         if (this->initiator)
 574         {
 575                 /* check if peer selection valid */
 576                 if (!tsr->is_contained_in(tsr, this->tsr) ||
 577                         !tsi->is_contained_in(tsi, this->tsi))
 578                 {
 579                         DBG1(DBG_IKE, "peer selected invalid traffic selectors: ",
 580                                  "%R for %R, %R for %R", tsi, this->tsi, tsr, this->tsr);
 581                         tsi->destroy(tsi);
 582                         tsr->destroy(tsr);
 583                         return FALSE;
 584                 }
 585                 this->tsi->destroy(this->tsi);
 586                 this->tsr->destroy(this->tsr);
 587                 this->tsi = tsi;
 588                 this->tsr = tsr;
 589         }
 590         else
 591         {
 592                 this->tsi = tsi;
 593                 this->tsr = tsr;
 594         }
 595         return TRUE;
 596 }
 597
 598 /**
 599  * Add NAT-OA payloads
 600  */
 601 static void add_nat_oa_payloads(private_quick_mode_t *this, message_t *message)
 602 {
 603         identification_t *id;
 604         id_payload_t *nat_oa;
 605         host_t *src, *dst;
 606
 607         src = message->get_source(message);
 608         dst = message->get_destination(message);
 609
 610         src = this->initiator ? src : dst;
 611         dst = this->initiator ? dst : src;
 612
 613         /* first NAT-OA is the initiator's address */
 614         id = identification_create_from_sockaddr(src->get_sockaddr(src));
 615         nat_oa = id_payload_create_from_identification(NAT_OA_V1, id);
 616         message->add_payload(message, (payload_t*)nat_oa);
 617         id->destroy(id);
 618
 619         /* second NAT-OA is that of the responder */
 620         id = identification_create_from_sockaddr(dst->get_sockaddr(dst));
 621         nat_oa = id_payload_create_from_identification(NAT_OA_V1, id);
 622         message->add_payload(message, (payload_t*)nat_oa);
 623         id->destroy(id);
 624 }
 625
 626 /**
 627  * Look up lifetimes
 628  */
 629 static void get_lifetimes(private_quick_mode_t *this)
 630 {
 631         lifetime_cfg_t *lft;
 632
 633         lft = this->config->get_lifetime(this->config);
 634         if (lft->time.life)
 635         {
 636                 this->lifetime = lft->time.life;
 637         }
 638         else if (lft->bytes.life)
 639         {
 640                 this->lifebytes = lft->bytes.life;
 641         }
 642         free(lft);
 643 }
 644
 645 /**
 646  * Check and apply lifetimes
 647  */
 648 static void apply_lifetimes(private_quick_mode_t *this, sa_payload_t *sa_payload)
 649 {
 650         u_int32_t lifetime;
 651         u_int64_t lifebytes;
 652
 653         lifetime = sa_payload->get_lifetime(sa_payload);
 654         lifebytes = sa_payload->get_lifebytes(sa_payload);
 655         if (this->lifetime != lifetime)
 656         {
 657                 DBG1(DBG_IKE, "received %us lifetime, configured %us",
 658                          lifetime, this->lifetime);
 659                 this->lifetime = lifetime;
 660         }
 661         if (this->lifebytes != lifebytes)
 662         {
 663                 DBG1(DBG_IKE, "received %llu lifebytes, configured %llu",
 664                          lifebytes, this->lifebytes);
 665                 this->lifebytes = lifebytes;
 666         }
 667 }
 668
 669 /**
 670  * Set the task ready to build notify error message
 671  */
 672 static status_t send_notify(private_quick_mode_t *this, notify_type_t type)
 673 {
 674         notify_payload_t *notify;
 675
 676         notify = notify_payload_create_from_protocol_and_type(NOTIFY_V1,
 677                                                                                                                   PROTO_ESP, type);
 678         notify->set_spi(notify, this->spi_i);
 679
 680         this->ike_sa->queue_task(this->ike_sa,
 681                                                 (task_t*)informational_create(this->ike_sa, notify));
 682         /* cancel all active/passive tasks in favour of informational */
 683         this->ike_sa->flush_queue(this->ike_sa,
 684                                         this->initiator ? TASK_QUEUE_ACTIVE : TASK_QUEUE_PASSIVE);
 685         return ALREADY_DONE;
 686 }
 687
 688 METHOD(task_t, build_i, status_t,
 689         private_quick_mode_t *this, message_t *message)
 690 {
 691         switch (this->state)
 692         {
 693                 case QM_INIT:
 694                 {
 695                         enumerator_t *enumerator;
 696                         sa_payload_t *sa_payload;
 697                         linked_list_t *list, *tsi, *tsr;
 698                         proposal_t *proposal;
 699                         diffie_hellman_group_t group;
 700
 701                         this->udp = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
 702                         this->mode = this->config->get_mode(this->config);
 703                         this->child_sa = child_sa_create(
 704                                                                         this->ike_sa->get_my_host(this->ike_sa),
 705                                                                         this->ike_sa->get_other_host(this->ike_sa),
 706                                                                         this->config, this->reqid, this->udp);
 707
 708                         if (this->udp && this->mode == MODE_TRANSPORT)
 709                         {
 710                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
 711                                 add_nat_oa_payloads(this, message);
 712                         }
 713
 714                         if (this->config->use_ipcomp(this->config))
 715                         {
 716                                 if (this->udp)
 717                                 {
 718                                         DBG1(DBG_IKE, "IPComp is not supported if either peer is "
 719                                                  "natted, IPComp disabled");
 720                                 }
 721                                 else
 722                                 {
 723                                         this->cpi_i = this->child_sa->alloc_cpi(this->child_sa);
 724                                         if (!this->cpi_i)
 725                                         {
 726                                                 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, "
 727                                                          "IPComp disabled");
 728                                         }
 729                                 }
 730                         }
 731
 732                         this->spi_i = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
 733                         if (!this->spi_i)
 734                         {
 735                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
 736                                 return FAILED;
 737                         }
 738
 739                         list = this->config->get_proposals(this->config, FALSE);
 740                         enumerator = list->create_enumerator(list);
 741                         while (enumerator->enumerate(enumerator, &proposal))
 742                         {
 743                                 proposal->set_spi(proposal, this->spi_i);
 744                         }
 745                         enumerator->destroy(enumerator);
 746
 747                         get_lifetimes(this);
 748                         sa_payload = sa_payload_create_from_proposals_v1(list,
 749                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
 750                                                                 this->mode, this->udp, this->cpi_i);
 751                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 752                         message->add_payload(message, &sa_payload->payload_interface);
 753
 754                         if (!add_nonce(this, &this->nonce_i, message))
 755                         {
 756                                 return FAILED;
 757                         }
 758
 759                         group = this->config->get_dh_group(this->config);
 760                         if (group != MODP_NONE)
 761                         {
 762                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
 763                                                                                                                   group);
 764                                 if (!this->dh)
 765                                 {
 766                                         DBG1(DBG_IKE, "configured DH group %N not supported",
 767                                                  diffie_hellman_group_names, group);
 768                                         return FAILED;
 769                                 }
 770                                 add_ke(this, message);
 771                         }
 772                         if (!this->tsi)
 773                         {
 774                                 this->tsi = select_ts(this, TRUE, NULL);
 775                         }
 776                         if (!this->tsr)
 777                         {
 778                                 this->tsr = select_ts(this, FALSE, NULL);
 779                         }
 780                         tsi = linked_list_create_with_items(this->tsi, NULL);
 781                         tsr = linked_list_create_with_items(this->tsr, NULL);
 782                         this->tsi = this->tsr = NULL;
 783                         charon->bus->narrow(charon->bus, this->child_sa,
 784                                                                 NARROW_INITIATOR_PRE_AUTH, tsi, tsr);
 785                         tsi->remove_first(tsi, (void**)&this->tsi);
 786                         tsr->remove_first(tsr, (void**)&this->tsr);
 787                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 788                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 789                         if (!this->tsi || !this->tsr)
 790                         {
 791                                 return FAILED;
 792                         }
 793                         add_ts(this, message);
 794                         return NEED_MORE;
 795                 }
 796                 case QM_NEGOTIATED:
 797                 {
 798                         return SUCCESS;
 799                 }
 800                 default:
 801                         return FAILED;
 802         }
 803 }
 804
 805 /**
 806  * Check for notify errors, return TRUE if error found
 807  */
 808 static bool has_notify_errors(private_quick_mode_t *this, message_t *message)
 809 {
 810         enumerator_t *enumerator;
 811         payload_t *payload;
 812         bool err = FALSE;
 813
 814         enumerator = message->create_payload_enumerator(message);
 815         while (enumerator->enumerate(enumerator, &payload))
 816         {
 817                 if (payload->get_type(payload) == NOTIFY_V1)
 818                 {
 819                         notify_payload_t *notify;
 820                         notify_type_t type;
 821
 822                         notify = (notify_payload_t*)payload;
 823                         type = notify->get_notify_type(notify);
 824                         if (type < 16384)
 825                         {
 826
 827                                 DBG1(DBG_IKE, "received %N error notify",
 828                                          notify_type_names, type);
 829                                 err = TRUE;
 830                         }
 831                         else
 832                         {
 833                                 DBG1(DBG_IKE, "received %N notify", notify_type_names, type);
 834                         }
 835                 }
 836         }
 837         enumerator->destroy(enumerator);
 838
 839         return err;
 840 }
 841
 842 /**
 843  * Check if this is a rekey for an existing CHILD_SA, reuse reqid if so
 844  */
 845 static void check_for_rekeyed_child(private_quick_mode_t *this)
 846 {
 847         enumerator_t *enumerator, *policies;
 848         traffic_selector_t *local, *remote;
 849         child_sa_t *child_sa;
 850
 851         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
 852         while (this->reqid == 0 && enumerator->enumerate(enumerator, &child_sa))
 853         {
 854                 if (child_sa->get_state(child_sa) == CHILD_INSTALLED &&
 855                         streq(child_sa->get_name(child_sa),
 856                                   this->config->get_name(this->config)))
 857                 {
 858                         policies = child_sa->create_policy_enumerator(child_sa);
 859                         if (policies->enumerate(policies, &local, &remote))
 860                         {
 861                                 if (local->equals(local, this->tsr) &&
 862                                         remote->equals(remote, this->tsi) &&
 863                                         this->proposal->equals(this->proposal,
 864                                                                                    child_sa->get_proposal(child_sa)))
 865                                 {
 866                                         this->reqid = child_sa->get_reqid(child_sa);
 867                                         this->rekey = child_sa->get_spi(child_sa, TRUE);
 868                                         child_sa->set_state(child_sa, CHILD_REKEYING);
 869                                         DBG1(DBG_IKE, "detected rekeying of CHILD_SA %s{%u}",
 870                                                  child_sa->get_name(child_sa), this->reqid);
 871                                 }
 872                         }
 873                         policies->destroy(policies);
 874                 }
 875         }
 876         enumerator->destroy(enumerator);
 877 }
 878
 879 METHOD(task_t, process_r, status_t,
 880         private_quick_mode_t *this, message_t *message)
 881 {
 882         switch (this->state)
 883         {
 884                 case QM_INIT:
 885                 {
 886                         sa_payload_t *sa_payload;
 887                         linked_list_t *tsi, *tsr, *hostsi, *hostsr, *list = NULL;
 888                         peer_cfg_t *peer_cfg;
 889                         u_int16_t group;
 890                         bool private;
 891
 892                         sa_payload = (sa_payload_t*)message->get_payload(message,
 893                                                                                                         SECURITY_ASSOCIATION_V1);
 894                         if (!sa_payload)
 895                         {
 896                                 DBG1(DBG_IKE, "sa payload missing");
 897                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 898                         }
 899
 900                         this->mode = sa_payload->get_encap_mode(sa_payload, &this->udp);
 901
 902                         if (!get_ts(this, message))
 903                         {
 904                                 return FAILED;
 905                         }
 906                         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 907                         tsi = linked_list_create_with_items(this->tsi, NULL);
 908                         tsr = linked_list_create_with_items(this->tsr, NULL);
 909                         this->tsi = this->tsr = NULL;
 910                         hostsi = get_dynamic_hosts(this->ike_sa, FALSE);
 911                         hostsr = get_dynamic_hosts(this->ike_sa, TRUE);
 912                         this->config = peer_cfg->select_child_cfg(peer_cfg, tsr, tsi,
 913                                                                                                           hostsr, hostsi);
 914                         hostsi->destroy(hostsi);
 915                         hostsr->destroy(hostsr);
 916                         if (this->config)
 917                         {
 918                                 this->tsi = select_ts(this, FALSE, tsi);
 919                                 this->tsr = select_ts(this, TRUE, tsr);
 920                         }
 921                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
 922                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
 923                         if (!this->config || !this->tsi || !this->tsr)
 924                         {
 925                                 DBG1(DBG_IKE, "no matching CHILD_SA config found");
 926                                 return send_notify(this, INVALID_ID_INFORMATION);
 927                         }
 928
 929                         if (this->config->use_ipcomp(this->config))
 930                         {
 931                                 if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
 932                                 {
 933                                         DBG1(DBG_IKE, "IPComp is not supported if either peer is "
 934                                                  "natted, IPComp disabled");
 935                                 }
 936                                 else
 937                                 {
 938                                         list = sa_payload->get_ipcomp_proposals(sa_payload,
 939                                                                                                                         &this->cpi_i);
 940                                         if (!list->get_count(list))
 941                                         {
 942                                                 DBG1(DBG_IKE, "expected IPComp proposal but peer did "
 943                                                          "not send one, IPComp disabled");
 944                                                 this->cpi_i = 0;
 945                                         }
 946                                 }
 947                         }
 948                         if (!list || !list->get_count(list))
 949                         {
 950                                 DESTROY_IF(list);
 951                                 list = sa_payload->get_proposals(sa_payload);
 952                         }
 953                         private = this->ike_sa->supports_extension(this->ike_sa,
 954                                                                                                            EXT_STRONGSWAN);
 955                         this->proposal = this->config->select_proposal(this->config,
 956                                                                                                                    list, FALSE, private);
 957                         list->destroy_offset(list, offsetof(proposal_t, destroy));
 958
 959                         get_lifetimes(this);
 960                         apply_lifetimes(this, sa_payload);
 961
 962                         if (!this->proposal)
 963                         {
 964                                 DBG1(DBG_IKE, "no matching proposal found, sending %N",
 965                                          notify_type_names, NO_PROPOSAL_CHOSEN);
 966                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
 967                         }
 968                         this->spi_i = this->proposal->get_spi(this->proposal);
 969
 970                         if (!get_nonce(this, &this->nonce_i, message))
 971                         {
 972                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
 973                         }
 974
 975                         if (this->proposal->get_algorithm(this->proposal,
 976                                                                                 DIFFIE_HELLMAN_GROUP, &group, NULL))
 977                         {
 978                                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
 979                                                                                                                   group);
 980                                 if (!this->dh)
 981                                 {
 982                                         DBG1(DBG_IKE, "negotiated DH group %N not supported",
 983                                                  diffie_hellman_group_names, group);
 984                                         return send_notify(this, INVALID_KEY_INFORMATION);
 985                                 }
 986                                 if (!get_ke(this, message))
 987                                 {
 988                                         return send_notify(this, INVALID_PAYLOAD_TYPE);
 989                                 }
 990                         }
 991
 992                         check_for_rekeyed_child(this);
 993
 994                         this->child_sa = child_sa_create(
 995                                                                         this->ike_sa->get_my_host(this->ike_sa),
 996                                                                         this->ike_sa->get_other_host(this->ike_sa),
 997                                                                         this->config, this->reqid, this->udp);
 998
 999                         tsi = linked_list_create_with_items(this->tsi, NULL);
1000                         tsr = linked_list_create_with_items(this->tsr, NULL);
1001                         this->tsi = this->tsr = NULL;
1002                         charon->bus->narrow(charon->bus, this->child_sa,
1003                                                                 NARROW_RESPONDER, tsr, tsi);
1004                         if (tsi->remove_first(tsi, (void**)&this->tsi) != SUCCESS ||
1005                                 tsr->remove_first(tsr, (void**)&this->tsr) != SUCCESS)
1006                         {
1007                                 tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1008                                 tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1009                                 return send_notify(this, INVALID_ID_INFORMATION);
1010                         }
1011                         tsi->destroy_offset(tsi, offsetof(traffic_selector_t, destroy));
1012                         tsr->destroy_offset(tsr, offsetof(traffic_selector_t, destroy));
1013
1014                         return NEED_MORE;
1015                 }
1016                 case QM_NEGOTIATED:
1017                 {
1018                         if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
1019                                 has_notify_errors(this, message))
1020                         {
1021                                 return SUCCESS;
1022                         }
1023                         if (!install(this))
1024                         {
1025                                 ike_sa_t *ike_sa = this->ike_sa;
1026                                 task_t *task;
1027
1028                                 task = (task_t*)quick_delete_create(this->ike_sa,
1029                                                                 this->proposal->get_protocol(this->proposal),
1030                                                                 this->spi_i, TRUE, TRUE);
1031                                 /* flush_queue() destroys the current task */
1032                                 ike_sa->flush_queue(ike_sa, TASK_QUEUE_PASSIVE);
1033                                 ike_sa->queue_task(ike_sa, task);
1034                                 return ALREADY_DONE;
1035                         }
1036                         return SUCCESS;
1037                 }
1038                 default:
1039                         return FAILED;
1040         }
1041 }
1042
1043 METHOD(task_t, build_r, status_t,
1044         private_quick_mode_t *this, message_t *message)
1045 {
1046         switch (this->state)
1047         {
1048                 case QM_INIT:
1049                 {
1050                         sa_payload_t *sa_payload;
1051
1052                         this->spi_r = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
1053                         if (!this->spi_r)
1054                         {
1055                                 DBG1(DBG_IKE, "allocating SPI from kernel failed");
1056                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1057                         }
1058                         this->proposal->set_spi(this->proposal, this->spi_r);
1059
1060                         if (this->cpi_i)
1061                         {
1062                                 this->cpi_r = this->child_sa->alloc_cpi(this->child_sa);
1063                                 if (!this->cpi_r)
1064                                 {
1065                                         DBG1(DBG_IKE, "unable to allocate a CPI from "
1066                                                  "kernel, IPComp disabled");
1067                                         return send_notify(this, NO_PROPOSAL_CHOSEN);
1068                                 }
1069                         }
1070
1071                         if (this->udp && this->mode == MODE_TRANSPORT)
1072                         {
1073                                 /* TODO-IKEv1: disable NAT-T for TRANSPORT mode by default? */
1074                                 add_nat_oa_payloads(this, message);
1075                         }
1076
1077                         sa_payload = sa_payload_create_from_proposal_v1(this->proposal,
1078                                                                 this->lifetime, this->lifebytes, AUTH_NONE,
1079                                                                 this->mode, this->udp, this->cpi_r);
1080                         message->add_payload(message, &sa_payload->payload_interface);
1081
1082                         if (!add_nonce(this, &this->nonce_r, message))
1083                         {
1084                                 return FAILED;
1085                         }
1086                         if (this->dh)
1087                         {
1088                                 add_ke(this, message);
1089                         }
1090
1091                         add_ts(this, message);
1092
1093                         this->state = QM_NEGOTIATED;
1094                         return NEED_MORE;
1095                 }
1096                 default:
1097                         return FAILED;
1098         }
1099 }
1100
1101 METHOD(task_t, process_i, status_t,
1102         private_quick_mode_t *this, message_t *message)
1103 {
1104         switch (this->state)
1105         {
1106                 case QM_INIT:
1107                 {
1108                         sa_payload_t *sa_payload;
1109                         linked_list_t *list = NULL;
1110                         bool private;
1111
1112                         sa_payload = (sa_payload_t*)message->get_payload(message,
1113                                                                                                         SECURITY_ASSOCIATION_V1);
1114                         if (!sa_payload)
1115                         {
1116                                 DBG1(DBG_IKE, "sa payload missing");
1117                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1118                         }
1119                         if (this->cpi_i)
1120                         {
1121                                 list = sa_payload->get_ipcomp_proposals(sa_payload,
1122                                                                                                                 &this->cpi_r);
1123                                 if (!list->get_count(list))
1124                                 {
1125                                         DBG1(DBG_IKE, "peer did not acccept our IPComp proposal, "
1126                                                  "IPComp disabled");
1127                                         this->cpi_i = 0;
1128                                 }
1129                         }
1130                         if (!list || !list->get_count(list))
1131                         {
1132                                 DESTROY_IF(list);
1133                                 list = sa_payload->get_proposals(sa_payload);
1134                         }
1135                         private = this->ike_sa->supports_extension(this->ike_sa,
1136                                                                                                            EXT_STRONGSWAN);
1137                         this->proposal = this->config->select_proposal(this->config,
1138                                                                                                                    list, FALSE, private);
1139                         list->destroy_offset(list, offsetof(proposal_t, destroy));
1140                         if (!this->proposal)
1141                         {
1142                                 DBG1(DBG_IKE, "no matching proposal found");
1143                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1144                         }
1145                         this->spi_r = this->proposal->get_spi(this->proposal);
1146
1147                         apply_lifetimes(this, sa_payload);
1148
1149                         if (!get_nonce(this, &this->nonce_r, message))
1150                         {
1151                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1152                         }
1153                         if (this->dh && !get_ke(this, message))
1154                         {
1155                                 return send_notify(this, INVALID_KEY_INFORMATION);
1156                         }
1157                         if (!get_ts(this, message))
1158                         {
1159                                 return send_notify(this, INVALID_PAYLOAD_TYPE);
1160                         }
1161                         if (!install(this))
1162                         {
1163                                 return send_notify(this, NO_PROPOSAL_CHOSEN);
1164                         }
1165                         this->state = QM_NEGOTIATED;
1166                         return NEED_MORE;
1167                 }
1168                 default:
1169                         return FAILED;
1170         }
1171 }
1172
1173 METHOD(task_t, get_type, task_type_t,
1174         private_quick_mode_t *this)
1175 {
1176         return TASK_QUICK_MODE;
1177 }
1178
1179 METHOD(quick_mode_t, use_reqid, void,
1180         private_quick_mode_t *this, u_int32_t reqid)
1181 {
1182         this->reqid = reqid;
1183 }
1184
1185 METHOD(quick_mode_t, rekey, void,
1186         private_quick_mode_t *this, u_int32_t spi)
1187 {
1188         this->rekey = spi;
1189 }
1190
1191 METHOD(task_t, migrate, void,
1192         private_quick_mode_t *this, ike_sa_t *ike_sa)
1193 {
1194         chunk_free(&this->nonce_i);
1195         chunk_free(&this->nonce_r);
1196         DESTROY_IF(this->tsi);
1197         DESTROY_IF(this->tsr);
1198         DESTROY_IF(this->proposal);
1199         DESTROY_IF(this->child_sa);
1200         DESTROY_IF(this->dh);
1201
1202         this->ike_sa = ike_sa;
1203         this->keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa);
1204         this->state = QM_INIT;
1205         this->tsi = NULL;
1206         this->tsr = NULL;
1207         this->proposal = NULL;
1208         this->child_sa = NULL;
1209         this->dh = NULL;
1210         this->spi_i = 0;
1211         this->spi_r = 0;
1212
1213         if (!this->initiator)
1214         {
1215                 DESTROY_IF(this->config);
1216                 this->config = NULL;
1217         }
1218 }
1219
1220 METHOD(task_t, destroy, void,
1221         private_quick_mode_t *this)
1222 {
1223         chunk_free(&this->nonce_i);
1224         chunk_free(&this->nonce_r);
1225         DESTROY_IF(this->tsi);
1226         DESTROY_IF(this->tsr);
1227         DESTROY_IF(this->proposal);
1228         DESTROY_IF(this->child_sa);
1229         DESTROY_IF(this->config);
1230         DESTROY_IF(this->dh);
1231         free(this);
1232 }
1233
1234 /*
1235  * Described in header.
1236  */
1237 quick_mode_t *quick_mode_create(ike_sa_t *ike_sa, child_cfg_t *config,
1238                                                         traffic_selector_t *tsi, traffic_selector_t *tsr)
1239 {
1240         private_quick_mode_t *this;
1241
1242         INIT(this,
1243                 .public = {
1244                         .task = {
1245                                 .get_type = _get_type,
1246                                 .migrate = _migrate,
1247                                 .destroy = _destroy,
1248                         },
1249                         .use_reqid = _use_reqid,
1250                         .rekey = _rekey,
1251                 },
1252                 .ike_sa = ike_sa,
1253                 .initiator = config != NULL,
1254                 .config = config,
1255                 .keymat = (keymat_v1_t*)ike_sa->get_keymat(ike_sa),
1256                 .state = QM_INIT,
1257                 .tsi = tsi ? tsi->clone(tsi) : NULL,
1258                 .tsr = tsr ? tsr->clone(tsr) : NULL,
1259         );
1260
1261         if (config)
1262         {
1263                 this->public.task.build = _build_i;
1264                 this->public.task.process = _process_i;
1265         }
1266         else
1267         {
1268                 this->public.task.build = _build_r;
1269                 this->public.task.process = _process_r;
1270         }
1271
1272         return &this->public;
1273 }