![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to child_create.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / sa / ikev2 / tasks|
Return to child_create.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / sa / ikev2 / tasks |
1.1 misho 1: /*
2: * Copyright (C) 2008-2019 Tobias Brunner
3: * Copyright (C) 2005-2008 Martin Willi
4: * Copyright (C) 2005 Jan Hutter
5: * HSR Hochschule fuer Technik Rapperswil
6: *
7: * This program is free software; you can redistribute it and/or modify it
8: * under the terms of the GNU General Public License as published by the
9: * Free Software Foundation; either version 2 of the License, or (at your
10: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11: *
12: * This program is distributed in the hope that it will be useful, but
13: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15: * for more details.
16: */
17:
18: #include "child_create.h"
19:
20: #include <daemon.h>
21: #include <sa/ikev2/keymat_v2.h>
22: #include <crypto/diffie_hellman.h>
23: #include <credentials/certificates/x509.h>
24: #include <encoding/payloads/sa_payload.h>
25: #include <encoding/payloads/ke_payload.h>
26: #include <encoding/payloads/ts_payload.h>
27: #include <encoding/payloads/nonce_payload.h>
28: #include <encoding/payloads/notify_payload.h>
29: #include <encoding/payloads/delete_payload.h>
30: #include <processing/jobs/delete_ike_sa_job.h>
31: #include <processing/jobs/inactivity_job.h>
32: #include <processing/jobs/initiate_tasks_job.h>
33:
34: typedef struct private_child_create_t private_child_create_t;
35:
36: /**
37: * Private members of a child_create_t task.
38: */
39: struct private_child_create_t {
40:
41: /**
42: * Public methods and task_t interface.
43: */
44: child_create_t public;
45:
46: /**
47: * Assigned IKE_SA.
48: */
49: ike_sa_t *ike_sa;
50:
51: /**
52: * Are we the initiator?
53: */
54: bool initiator;
55:
56: /**
57: * nonce chosen by us
58: */
59: chunk_t my_nonce;
60:
61: /**
62: * nonce chosen by peer
63: */
64: chunk_t other_nonce;
65:
66: /**
67: * nonce generator
68: */
69: nonce_gen_t *nonceg;
70:
71: /**
72: * config to create the CHILD_SA from
73: */
74: child_cfg_t *config;
75:
76: /**
77: * list of proposal candidates
78: */
79: linked_list_t *proposals;
80:
81: /**
82: * selected proposal to use for CHILD_SA
83: */
84: proposal_t *proposal;
85:
86: /**
87: * traffic selectors for initiators side
88: */
89: linked_list_t *tsi;
90:
91: /**
92: * traffic selectors for responders side
93: */
94: linked_list_t *tsr;
95:
96: /**
97: * source of triggering packet
98: */
99: traffic_selector_t *packet_tsi;
100:
101: /**
102: * destination of triggering packet
103: */
104: traffic_selector_t *packet_tsr;
105:
106: /**
107: * optional diffie hellman exchange
108: */
109: diffie_hellman_t *dh;
110:
111: /**
112: * Applying DH public value failed?
113: */
114: bool dh_failed;
115:
116: /**
117: * group used for DH exchange
118: */
119: diffie_hellman_group_t dh_group;
120:
121: /**
122: * IKE_SAs keymat
123: */
124: keymat_v2_t *keymat;
125:
126: /**
127: * mode the new CHILD_SA uses (transport/tunnel/beet)
128: */
129: ipsec_mode_t mode;
130:
131: /**
132: * peer accepts TFC padding for this SA
133: */
134: bool tfcv3;
135:
136: /**
137: * IPComp transform to use
138: */
139: ipcomp_transform_t ipcomp;
140:
141: /**
142: * IPComp transform proposed or accepted by the other peer
143: */
144: ipcomp_transform_t ipcomp_received;
145:
146: /**
147: * IPsec protocol
148: */
149: protocol_id_t proto;
150:
151: /**
152: * Own allocated SPI
153: */
154: uint32_t my_spi;
155:
156: /**
157: * SPI received in proposal
158: */
159: uint32_t other_spi;
160:
161: /**
162: * Own allocated Compression Parameter Index (CPI)
163: */
164: uint16_t my_cpi;
165:
166: /**
167: * Other Compression Parameter Index (CPI), received via IPCOMP_SUPPORTED
168: */
169: uint16_t other_cpi;
170:
171: /**
172: * Data collected to create the CHILD_SA
173: */
174: child_sa_create_t child;
175:
176: /**
177: * CHILD_SA which gets established
178: */
179: child_sa_t *child_sa;
180:
181: /**
182: * successfully established the CHILD?
183: */
184: bool established;
185:
186: /**
187: * whether the CHILD_SA rekeys an existing one
188: */
189: bool rekey;
190:
191: /**
192: * whether we are retrying with another DH group
193: */
194: bool retry;
195: };
196:
197: /**
198: * Schedule a retry if creating the CHILD_SA temporary failed
199: */
200: static void schedule_delayed_retry(private_child_create_t *this)
201: {
202: child_create_t *task;
203: uint32_t retry;
204:
205: retry = RETRY_INTERVAL - (random() % RETRY_JITTER);
206:
207: task = child_create_create(this->ike_sa,
208: this->config->get_ref(this->config), FALSE,
209: this->packet_tsi, this->packet_tsr);
210: task->use_reqid(task, this->child.reqid);
211: task->use_marks(task, this->child.mark_in, this->child.mark_out);
212: task->use_if_ids(task, this->child.if_id_in, this->child.if_id_out);
213:
214: DBG1(DBG_IKE, "creating CHILD_SA failed, trying again in %d seconds",
215: retry);
216: this->ike_sa->queue_task_delayed(this->ike_sa, (task_t*)task, retry);
217: }
218:
219: /**
220: * get the nonce from a message
221: */
222: static status_t get_nonce(message_t *message, chunk_t *nonce)
223: {
224: nonce_payload_t *payload;
225:
226: payload = (nonce_payload_t*)message->get_payload(message, PLV2_NONCE);
227: if (payload == NULL)
228: {
229: return FAILED;
230: }
231: *nonce = payload->get_nonce(payload);
232: return NEED_MORE;
233: }
234:
235: /**
236: * generate a new nonce to include in a CREATE_CHILD_SA message
237: */
238: static bool generate_nonce(private_child_create_t *this)
239: {
240: this->nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
241: if (!this->nonceg)
242: {
243: DBG1(DBG_IKE, "no nonce generator found to create nonce");
244: return FALSE;
245: }
246: if (!this->nonceg->allocate_nonce(this->nonceg, NONCE_SIZE,
247: &this->my_nonce))
248: {
249: DBG1(DBG_IKE, "nonce allocation failed");
250: return FALSE;
251: }
252: return TRUE;
253: }
254:
255: /**
256: * Check a list of traffic selectors if any selector belongs to host
257: */
258: static bool ts_list_is_host(linked_list_t *list, host_t *host)
259: {
260: traffic_selector_t *ts;
261: bool is_host = TRUE;
262: enumerator_t *enumerator = list->create_enumerator(list);
263:
264: while (is_host && enumerator->enumerate(enumerator, (void**)&ts))
265: {
266: is_host = is_host && ts->is_host(ts, host);
267: }
268: enumerator->destroy(enumerator);
269: return is_host;
270: }
271:
272: /**
273: * Allocate local SPI
274: */
275: static bool allocate_spi(private_child_create_t *this)
276: {
277: proposal_t *proposal;
278:
279: if (this->initiator)
280: {
281: this->proto = PROTO_ESP;
282: /* we just get a SPI for the first protocol. TODO: If we ever support
283: * proposal lists with mixed protocols, we'd need multiple SPIs */
284: if (this->proposals->get_first(this->proposals,
285: (void**)&proposal) == SUCCESS)
286: {
287: this->proto = proposal->get_protocol(proposal);
288: }
289: }
290: else
291: {
292: this->proto = this->proposal->get_protocol(this->proposal);
293: }
294: this->my_spi = this->child_sa->alloc_spi(this->child_sa, this->proto);
295: return this->my_spi != 0;
296: }
297:
298: /**
299: * Update the proposals with the allocated SPIs as initiator and check the DH
300: * group and promote it if necessary
301: */
302: static bool update_and_check_proposals(private_child_create_t *this)
303: {
304: enumerator_t *enumerator;
305: proposal_t *proposal;
306: linked_list_t *other_dh_groups;
307: bool found = FALSE;
308:
309: other_dh_groups = linked_list_create();
310: enumerator = this->proposals->create_enumerator(this->proposals);
311: while (enumerator->enumerate(enumerator, &proposal))
312: {
313: proposal->set_spi(proposal, this->my_spi);
314:
315: /* move the selected DH group to the front, if any */
316: if (this->dh_group != MODP_NONE)
317: { /* proposals that don't contain the selected group are
318: * moved to the back */
319: if (!proposal->promote_dh_group(proposal, this->dh_group))
320: {
321: this->proposals->remove_at(this->proposals, enumerator);
322: other_dh_groups->insert_last(other_dh_groups, proposal);
323: }
324: else
325: {
326: found = TRUE;
327: }
328: }
329: }
330: enumerator->destroy(enumerator);
331: enumerator = other_dh_groups->create_enumerator(other_dh_groups);
332: while (enumerator->enumerate(enumerator, (void**)&proposal))
333: { /* no need to remove from the list as we destroy it anyway*/
334: this->proposals->insert_last(this->proposals, proposal);
335: }
336: enumerator->destroy(enumerator);
337: other_dh_groups->destroy(other_dh_groups);
338:
339: return this->dh_group == MODP_NONE || found;
340: }
341:
342: /**
343: * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
344: */
345: static void schedule_inactivity_timeout(private_child_create_t *this)
346: {
347: uint32_t timeout, id;
348: bool close_ike;
349:
350: timeout = this->config->get_inactivity(this->config);
351: if (timeout)
352: {
353: close_ike = lib->settings->get_bool(lib->settings,
354: "%s.inactivity_close_ike", FALSE, lib->ns);
355: id = this->child_sa->get_unique_id(this->child_sa);
356: lib->scheduler->schedule_job(lib->scheduler, (job_t*)
357: inactivity_job_create(id, timeout, close_ike), timeout);
358: }
359: }
360:
361: /**
362: * Check if we have a an address pool configured
363: */
364: static bool have_pool(ike_sa_t *ike_sa)
365: {
366: enumerator_t *enumerator;
367: peer_cfg_t *peer_cfg;
368: char *pool;
369: bool found = FALSE;
370:
371: peer_cfg = ike_sa->get_peer_cfg(ike_sa);
372: if (peer_cfg)
373: {
374: enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
375: if (enumerator->enumerate(enumerator, &pool))
376: {
377: found = TRUE;
378: }
379: enumerator->destroy(enumerator);
380: }
381: return found;
382: }
383:
384: /**
385: * Get hosts to use for dynamic traffic selectors
386: */
387: static linked_list_t *get_dynamic_hosts(ike_sa_t *ike_sa, bool local)
388: {
389: enumerator_t *enumerator;
390: linked_list_t *list;
391: host_t *host;
392:
393: list = linked_list_create();
394: enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
395: while (enumerator->enumerate(enumerator, &host))
396: {
397: list->insert_last(list, host);
398: }
399: enumerator->destroy(enumerator);
400:
401: if (list->get_count(list) == 0)
402: { /* no virtual IPs assigned */
403: if (local)
404: {
405: host = ike_sa->get_my_host(ike_sa);
406: list->insert_last(list, host);
407: }
408: else if (!have_pool(ike_sa))
409: { /* use host only if we don't have a pool configured */
410: host = ike_sa->get_other_host(ike_sa);
411: list->insert_last(list, host);
412: }
413: }
414: return list;
415: }
416:
417: /**
418: * Substitute any host address with NATed address in traffic selector
419: */
420: static linked_list_t* get_transport_nat_ts(private_child_create_t *this,
421: bool local, linked_list_t *in)
422: {
423: enumerator_t *enumerator;
424: linked_list_t *out;
425: traffic_selector_t *ts;
426: host_t *ike, *first = NULL;
427: uint8_t mask;
428:
429: if (local)
430: {
431: ike = this->ike_sa->get_my_host(this->ike_sa);
432: }
433: else
434: {
435: ike = this->ike_sa->get_other_host(this->ike_sa);
436: }
437:
438: out = linked_list_create();
439:
440: enumerator = in->create_enumerator(in);
441: while (enumerator->enumerate(enumerator, &ts))
442: {
443: /* require that all selectors match the first "host" selector */
444: if (ts->is_host(ts, first))
445: {
446: if (!first)
447: {
448: ts->to_subnet(ts, &first, &mask);
449: }
450: ts = ts->clone(ts);
451: ts->set_address(ts, ike);
452: out->insert_last(out, ts);
453: }
454: }
455: enumerator->destroy(enumerator);
456: DESTROY_IF(first);
457:
458: return out;
459: }
460:
461: /**
462: * Narrow received traffic selectors with configuration
463: */
464: static linked_list_t* narrow_ts(private_child_create_t *this, bool local,
465: linked_list_t *in)
466: {
467: linked_list_t *hosts, *nat, *ts;
468: ike_condition_t cond;
469:
470: cond = local ? COND_NAT_HERE : COND_NAT_THERE;
471: hosts = get_dynamic_hosts(this->ike_sa, local);
472:
473: if (this->mode == MODE_TRANSPORT &&
474: this->ike_sa->has_condition(this->ike_sa, cond))
475: {
476: nat = get_transport_nat_ts(this, local, in);
477: ts = this->config->get_traffic_selectors(this->config, local, nat,
478: hosts, TRUE);
479: nat->destroy_offset(nat, offsetof(traffic_selector_t, destroy));
480: }
481: else
482: {
483: ts = this->config->get_traffic_selectors(this->config, local, in,
484: hosts, TRUE);
485: }
486:
487: hosts->destroy(hosts);
488:
489: return ts;
490: }
491:
492: /**
493: * Check if requested mode is acceptable
494: */
495: static bool check_mode(private_child_create_t *this, host_t *i, host_t *r)
496: {
497: switch (this->mode)
498: {
499: case MODE_TRANSPORT:
500: if (!this->config->has_option(this->config, OPT_PROXY_MODE) &&
501: (!ts_list_is_host(this->tsi, i) ||
502: !ts_list_is_host(this->tsr, r))
503: )
504: {
505: DBG1(DBG_IKE, "not using transport mode, not host-to-host");
506: return FALSE;
507: }
508: if (this->config->get_mode(this->config) != MODE_TRANSPORT)
509: {
510: return FALSE;
511: }
512: break;
513: case MODE_BEET:
514: if (!ts_list_is_host(this->tsi, NULL) ||
515: !ts_list_is_host(this->tsr, NULL))
516: {
517: DBG1(DBG_IKE, "not using BEET mode, not host-to-host");
518: return FALSE;
519: }
520: if (this->config->get_mode(this->config) != MODE_BEET)
521: {
522: return FALSE;
523: }
524: break;
525: default:
526: break;
527: }
528: return TRUE;
529: }
530:
531: /**
532: * Install a CHILD_SA for usage, return value:
533: * - FAILED: no acceptable proposal
534: * - INVALID_ARG: diffie hellman group unacceptable
535: * - NOT_FOUND: TS unacceptable
536: */
537: static status_t select_and_install(private_child_create_t *this,
538: bool no_dh, bool ike_auth)
539: {
540: status_t status, status_i, status_o;
541: child_sa_outbound_state_t out_state;
542: chunk_t nonce_i, nonce_r;
543: chunk_t encr_i = chunk_empty, encr_r = chunk_empty;
544: chunk_t integ_i = chunk_empty, integ_r = chunk_empty;
545: linked_list_t *my_ts, *other_ts;
546: host_t *me, *other;
547: proposal_selection_flag_t flags = 0;
548:
549: if (this->proposals == NULL)
550: {
551: DBG1(DBG_IKE, "SA payload missing in message");
552: return FAILED;
553: }
554: if (this->tsi == NULL || this->tsr == NULL)
555: {
556: DBG1(DBG_IKE, "TS payloads missing in message");
557: return NOT_FOUND;
558: }
559:
560: me = this->ike_sa->get_my_host(this->ike_sa);
561: other = this->ike_sa->get_other_host(this->ike_sa);
562:
563: if (no_dh)
564: {
565: flags |= PROPOSAL_SKIP_DH;
566: }
567: if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN) &&
568: !lib->settings->get_bool(lib->settings, "%s.accept_private_algs",
569: FALSE, lib->ns))
570: {
571: flags |= PROPOSAL_SKIP_PRIVATE;
572: }
573: if (!lib->settings->get_bool(lib->settings,
574: "%s.prefer_configured_proposals", TRUE, lib->ns))
575: {
576: flags |= PROPOSAL_PREFER_SUPPLIED;
577: }
578: this->proposal = this->config->select_proposal(this->config,
579: this->proposals, flags);
580: if (this->proposal == NULL)
581: {
582: DBG1(DBG_IKE, "no acceptable proposal found");
583: charon->bus->alert(charon->bus, ALERT_PROPOSAL_MISMATCH_CHILD,
584: this->proposals);
585: return FAILED;
586: }
587: this->other_spi = this->proposal->get_spi(this->proposal);
588:
589: if (!this->initiator)
590: {
591: if (!allocate_spi(this))
592: {
593: /* responder has no SPI allocated yet */
594: DBG1(DBG_IKE, "allocating SPI failed");
595: return FAILED;
596: }
597: this->proposal->set_spi(this->proposal, this->my_spi);
598: }
599: this->child_sa->set_proposal(this->child_sa, this->proposal);
600:
601: if (!this->proposal->has_dh_group(this->proposal, this->dh_group))
602: {
603: uint16_t group;
604:
605: if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
606: &group, NULL))
607: {
608: DBG1(DBG_IKE, "DH group %N unacceptable, requesting %N",
609: diffie_hellman_group_names, this->dh_group,
610: diffie_hellman_group_names, group);
611: this->dh_group = group;
612: return INVALID_ARG;
613: }
614: /* the selected proposal does not use a DH group */
615: DBG1(DBG_IKE, "ignoring KE exchange, agreed on a non-PFS proposal");
616: DESTROY_IF(this->dh);
617: this->dh = NULL;
618: this->dh_group = MODP_NONE;
619: }
620:
621: if (this->initiator)
622: {
623: nonce_i = this->my_nonce;
624: nonce_r = this->other_nonce;
625: my_ts = narrow_ts(this, TRUE, this->tsi);
626: other_ts = narrow_ts(this, FALSE, this->tsr);
627: }
628: else
629: {
630: nonce_r = this->my_nonce;
631: nonce_i = this->other_nonce;
632: my_ts = narrow_ts(this, TRUE, this->tsr);
633: other_ts = narrow_ts(this, FALSE, this->tsi);
634: }
635:
636: if (this->initiator)
637: {
638: if (ike_auth)
639: {
640: charon->bus->narrow(charon->bus, this->child_sa,
641: NARROW_INITIATOR_POST_NOAUTH, my_ts, other_ts);
642: }
643: else
644: {
645: charon->bus->narrow(charon->bus, this->child_sa,
646: NARROW_INITIATOR_POST_AUTH, my_ts, other_ts);
647: }
648: }
649: else
650: {
651: charon->bus->narrow(charon->bus, this->child_sa,
652: NARROW_RESPONDER, my_ts, other_ts);
653: }
654:
655: if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
656: {
657: charon->bus->alert(charon->bus, ALERT_TS_MISMATCH, this->tsi, this->tsr);
658: my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
659: other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
660: DBG1(DBG_IKE, "no acceptable traffic selectors found");
661: return NOT_FOUND;
662: }
663:
664: this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
665: this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
666: if (this->initiator)
667: {
668: this->tsi = my_ts;
669: this->tsr = other_ts;
670:
671: if (!check_mode(this, me, other))
672: {
673: DBG1(DBG_IKE, "%N mode requested by responder is unacceptable",
674: ipsec_mode_names, this->mode);
675: return FAILED;
676: }
677: }
678: else
679: {
680: this->tsr = my_ts;
681: this->tsi = other_ts;
682:
683: if (!check_mode(this, other, me))
684: {
685: this->mode = MODE_TUNNEL;
686: }
687: }
688:
689: if (!this->initiator)
690: {
691: /* use a copy of the traffic selectors, as the POST hook should not
692: * change payloads */
693: my_ts = this->tsr->clone_offset(this->tsr,
694: offsetof(traffic_selector_t, clone));
695: other_ts = this->tsi->clone_offset(this->tsi,
696: offsetof(traffic_selector_t, clone));
697: charon->bus->narrow(charon->bus, this->child_sa,
698: NARROW_RESPONDER_POST, my_ts, other_ts);
699:
700: if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
701: {
702: my_ts->destroy_offset(my_ts,
703: offsetof(traffic_selector_t, destroy));
704: other_ts->destroy_offset(other_ts,
705: offsetof(traffic_selector_t, destroy));
706: return NOT_FOUND;
707: }
708: }
709:
710: this->child_sa->set_policies(this->child_sa, my_ts, other_ts);
711: if (!this->initiator)
712: {
713: my_ts->destroy_offset(my_ts,
714: offsetof(traffic_selector_t, destroy));
715: other_ts->destroy_offset(other_ts,
716: offsetof(traffic_selector_t, destroy));
717: }
718:
719: this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
720: this->child_sa->set_ipcomp(this->child_sa, this->ipcomp);
721: this->child_sa->set_mode(this->child_sa, this->mode);
722: this->child_sa->set_protocol(this->child_sa,
723: this->proposal->get_protocol(this->proposal));
724:
725: if (this->my_cpi == 0 || this->other_cpi == 0 || this->ipcomp == IPCOMP_NONE)
726: {
727: this->my_cpi = this->other_cpi = 0;
728: this->ipcomp = IPCOMP_NONE;
729: }
730: status_i = status_o = FAILED;
731: if (this->keymat->derive_child_keys(this->keymat, this->proposal,
732: this->dh, nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
733: {
734: if (this->initiator)
735: {
736: status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
737: this->my_spi, this->my_cpi, this->initiator,
738: TRUE, this->tfcv3);
739: }
740: else
741: {
742: status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
743: this->my_spi, this->my_cpi, this->initiator,
744: TRUE, this->tfcv3);
745: }
746: if (this->rekey)
747: { /* during rekeyings we install the outbound SA and/or policies
748: * separately: as responder when we receive the delete for the old
749: * SA, as initiator pretty much immediately in the ike-rekey task,
750: * unless there was a rekey collision that we lost */
751: if (this->initiator)
752: {
753: status_o = this->child_sa->register_outbound(this->child_sa,
754: encr_i, integ_i, this->other_spi, this->other_cpi,
755: this->tfcv3);
756: }
757: else
758: {
759: status_o = this->child_sa->register_outbound(this->child_sa,
760: encr_r, integ_r, this->other_spi, this->other_cpi,
761: this->tfcv3);
762: }
763: }
764: else if (this->initiator)
765: {
766: status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
767: this->other_spi, this->other_cpi, this->initiator,
768: FALSE, this->tfcv3);
769: }
770: else
771: {
772: status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
773: this->other_spi, this->other_cpi, this->initiator,
774: FALSE, this->tfcv3);
775: }
776: }
777:
778: if (status_i != SUCCESS || status_o != SUCCESS)
779: {
780: DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
781: (status_i != SUCCESS) ? "inbound " : "",
782: (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
783: (status_o != SUCCESS) ? "outbound " : "");
784: charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_SA_FAILED,
785: this->child_sa);
786: status = FAILED;
787: }
788: else
789: {
790: status = this->child_sa->install_policies(this->child_sa);
791:
792: if (status != SUCCESS)
793: {
794: DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
795: charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_POLICY_FAILED,
796: this->child_sa);
797: status = NOT_FOUND;
798: }
799: else
800: {
801: charon->bus->child_derived_keys(charon->bus, this->child_sa,
802: this->initiator, encr_i, encr_r,
803: integ_i, integ_r);
804: }
805: }
806: chunk_clear(&integ_i);
807: chunk_clear(&integ_r);
808: chunk_clear(&encr_i);
809: chunk_clear(&encr_r);
810:
811: if (status != SUCCESS)
812: {
813: return status;
814: }
815:
816: charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
817: this->dh, nonce_i, nonce_r);
818:
819: my_ts = linked_list_create_from_enumerator(
820: this->child_sa->create_ts_enumerator(this->child_sa, TRUE));
821: other_ts = linked_list_create_from_enumerator(
822: this->child_sa->create_ts_enumerator(this->child_sa, FALSE));
823: out_state = this->child_sa->get_outbound_state(this->child_sa);
824:
825: DBG0(DBG_IKE, "%sCHILD_SA %s{%d} established "
826: "with SPIs %.8x_i %.8x_o and TS %#R === %#R",
827: (out_state == CHILD_OUTBOUND_INSTALLED) ? "" : "inbound ",
828: this->child_sa->get_name(this->child_sa),
829: this->child_sa->get_unique_id(this->child_sa),
830: ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
831: ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
832: my_ts, other_ts);
833:
834: my_ts->destroy(my_ts);
835: other_ts->destroy(other_ts);
836:
837: this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
838: this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
839: this->established = TRUE;
840:
841: schedule_inactivity_timeout(this);
842: return SUCCESS;
843: }
844:
845: /**
846: * build the payloads for the message
847: */
848: static bool build_payloads(private_child_create_t *this, message_t *message)
849: {
850: sa_payload_t *sa_payload;
851: nonce_payload_t *nonce_payload;
852: ke_payload_t *ke_payload;
853: ts_payload_t *ts_payload;
854: kernel_feature_t features;
855:
856: /* add SA payload */
857: if (this->initiator)
858: {
859: sa_payload = sa_payload_create_from_proposals_v2(this->proposals);
860: }
861: else
862: {
863: sa_payload = sa_payload_create_from_proposal_v2(this->proposal);
864: }
865: message->add_payload(message, (payload_t*)sa_payload);
866:
867: /* add nonce payload if not in IKE_AUTH */
868: if (message->get_exchange_type(message) == CREATE_CHILD_SA)
869: {
870: nonce_payload = nonce_payload_create(PLV2_NONCE);
871: nonce_payload->set_nonce(nonce_payload, this->my_nonce);
872: message->add_payload(message, (payload_t*)nonce_payload);
873: }
874:
875: /* diffie hellman exchange, if PFS enabled */
876: if (this->dh)
877: {
878: ke_payload = ke_payload_create_from_diffie_hellman(PLV2_KEY_EXCHANGE,
879: this->dh);
880: if (!ke_payload)
881: {
882: DBG1(DBG_IKE, "creating KE payload failed");
883: return FALSE;
884: }
885: message->add_payload(message, (payload_t*)ke_payload);
886: }
887:
888: /* add TSi/TSr payloads */
889: ts_payload = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
890: message->add_payload(message, (payload_t*)ts_payload);
891: ts_payload = ts_payload_create_from_traffic_selectors(FALSE, this->tsr);
892: message->add_payload(message, (payload_t*)ts_payload);
893:
894: /* add a notify if we are not in tunnel mode */
895: switch (this->mode)
896: {
897: case MODE_TRANSPORT:
898: message->add_notify(message, FALSE, USE_TRANSPORT_MODE, chunk_empty);
899: break;
900: case MODE_BEET:
901: message->add_notify(message, FALSE, USE_BEET_MODE, chunk_empty);
902: break;
903: default:
904: break;
905: }
906:
907: features = charon->kernel->get_features(charon->kernel);
908: if (!(features & KERNEL_ESP_V3_TFC))
909: {
910: message->add_notify(message, FALSE, ESP_TFC_PADDING_NOT_SUPPORTED,
911: chunk_empty);
912: }
913: return TRUE;
914: }
915:
916: /**
917: * Adds an IPCOMP_SUPPORTED notify to the message, allocating a CPI
918: */
919: static void add_ipcomp_notify(private_child_create_t *this,
920: message_t *message, uint8_t ipcomp)
921: {
922: this->my_cpi = this->child_sa->alloc_cpi(this->child_sa);
923: if (this->my_cpi)
924: {
925: this->ipcomp = ipcomp;
926: message->add_notify(message, FALSE, IPCOMP_SUPPORTED,
927: chunk_cata("cc", chunk_from_thing(this->my_cpi),
928: chunk_from_thing(ipcomp)));
929: }
930: else
931: {
932: DBG1(DBG_IKE, "unable to allocate a CPI from kernel, IPComp disabled");
933: }
934: }
935:
936: /**
937: * handle a received notify payload
938: */
939: static void handle_notify(private_child_create_t *this, notify_payload_t *notify)
940: {
941: switch (notify->get_notify_type(notify))
942: {
943: case USE_TRANSPORT_MODE:
944: this->mode = MODE_TRANSPORT;
945: break;
946: case USE_BEET_MODE:
947: if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
948: { /* handle private use notify only if we know its meaning */
949: this->mode = MODE_BEET;
950: }
951: else
952: {
953: DBG1(DBG_IKE, "received a notify strongSwan uses for BEET "
954: "mode, but peer implementation unknown, skipped");
955: }
956: break;
957: case IPCOMP_SUPPORTED:
958: {
959: ipcomp_transform_t ipcomp;
960: uint16_t cpi;
961: chunk_t data;
962:
963: data = notify->get_notification_data(notify);
964: cpi = *(uint16_t*)data.ptr;
965: ipcomp = (ipcomp_transform_t)(*(data.ptr + 2));
966: switch (ipcomp)
967: {
968: case IPCOMP_DEFLATE:
969: this->other_cpi = cpi;
970: this->ipcomp_received = ipcomp;
971: break;
972: case IPCOMP_LZS:
973: case IPCOMP_LZJH:
974: default:
975: DBG1(DBG_IKE, "received IPCOMP_SUPPORTED notify with a "
976: "transform ID we don't support %N",
977: ipcomp_transform_names, ipcomp);
978: break;
979: }
980: break;
981: }
982: case ESP_TFC_PADDING_NOT_SUPPORTED:
983: DBG1(DBG_IKE, "received %N, not using ESPv3 TFC padding",
984: notify_type_names, notify->get_notify_type(notify));
985: this->tfcv3 = FALSE;
986: break;
987: default:
988: break;
989: }
990: }
991:
992: /**
993: * Read payloads from message
994: */
995: static void process_payloads(private_child_create_t *this, message_t *message)
996: {
997: enumerator_t *enumerator;
998: payload_t *payload;
999: sa_payload_t *sa_payload;
1000: ke_payload_t *ke_payload;
1001: ts_payload_t *ts_payload;
1002:
1003: /* defaults to TUNNEL mode */
1004: this->mode = MODE_TUNNEL;
1005:
1006: enumerator = message->create_payload_enumerator(message);
1007: while (enumerator->enumerate(enumerator, &payload))
1008: {
1009: switch (payload->get_type(payload))
1010: {
1011: case PLV2_SECURITY_ASSOCIATION:
1012: sa_payload = (sa_payload_t*)payload;
1013: this->proposals = sa_payload->get_proposals(sa_payload);
1014: break;
1015: case PLV2_KEY_EXCHANGE:
1016: ke_payload = (ke_payload_t*)payload;
1017: if (!this->initiator)
1018: {
1019: this->dh_group = ke_payload->get_dh_group_number(ke_payload);
1020: this->dh = this->keymat->keymat.create_dh(
1021: &this->keymat->keymat, this->dh_group);
1022: }
1023: else if (this->dh)
1024: {
1025: this->dh_failed = this->dh->get_dh_group(this->dh) !=
1026: ke_payload->get_dh_group_number(ke_payload);
1027: }
1028: if (this->dh && !this->dh_failed)
1029: {
1030: this->dh_failed = !this->dh->set_other_public_value(this->dh,
1031: ke_payload->get_key_exchange_data(ke_payload));
1032: }
1033: break;
1034: case PLV2_TS_INITIATOR:
1035: ts_payload = (ts_payload_t*)payload;
1036: this->tsi = ts_payload->get_traffic_selectors(ts_payload);
1037: break;
1038: case PLV2_TS_RESPONDER:
1039: ts_payload = (ts_payload_t*)payload;
1040: this->tsr = ts_payload->get_traffic_selectors(ts_payload);
1041: break;
1042: case PLV2_NOTIFY:
1043: handle_notify(this, (notify_payload_t*)payload);
1044: break;
1045: default:
1046: break;
1047: }
1048: }
1049: enumerator->destroy(enumerator);
1050: }
1051:
1052: /**
1053: * Check if we should defer the creation of this CHILD_SA until after the
1054: * IKE_SA has been established childless.
1055: */
1056: static status_t defer_child_sa(private_child_create_t *this)
1057: {
1058: ike_cfg_t *ike_cfg;
1059:
1060: ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
1061:
1062: if (this->ike_sa->supports_extension(this->ike_sa, EXT_IKE_CHILDLESS))
1063: {
1064: if (ike_cfg->childless(ike_cfg) == CHILDLESS_FORCE)
1065: {
1066: return NEED_MORE;
1067: }
1068: }
1069: else if (ike_cfg->childless(ike_cfg) == CHILDLESS_FORCE)
1070: {
1071: DBG1(DBG_IKE, "peer does not support childless IKE_SA initiation");
1072: return DESTROY_ME;
1073: }
1074: return NOT_SUPPORTED;
1075: }
1076:
1077: METHOD(task_t, build_i, status_t,
1078: private_child_create_t *this, message_t *message)
1079: {
1080: enumerator_t *enumerator;
1081: host_t *vip;
1082: peer_cfg_t *peer_cfg;
1083: linked_list_t *list;
1084:
1085: switch (message->get_exchange_type(message))
1086: {
1087: case IKE_SA_INIT:
1088: return get_nonce(message, &this->my_nonce);
1089: case CREATE_CHILD_SA:
1090: if (!generate_nonce(this))
1091: {
1092: message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN,
1093: chunk_empty);
1094: return SUCCESS;
1095: }
1096: if (!this->retry && this->dh_group == MODP_NONE)
1097: { /* during a rekeying the group might already be set */
1098: this->dh_group = this->config->get_dh_group(this->config);
1099: }
1100: break;
1101: case IKE_AUTH:
1102: if (message->get_message_id(message) != 1)
1103: {
1104: /* send only in the first request, not in subsequent rounds */
1105: return NEED_MORE;
1106: }
1107: switch (defer_child_sa(this))
1108: {
1109: case DESTROY_ME:
1110: /* config mismatch */
1111: return DESTROY_ME;
1112: case NEED_MORE:
1113: /* defer until after IKE_SA has been established */
1114: chunk_free(&this->my_nonce);
1115: return NEED_MORE;
1116: default:
1117: /* just continue to establish the CHILD_SA */
1118: break;
1119: }
1120: break;
1121: default:
1122: break;
1123: }
1124:
1125: /* check if we want a virtual IP, but don't have one */
1126: list = linked_list_create();
1127: peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1128: if (!this->rekey)
1129: {
1130: enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
1131: while (enumerator->enumerate(enumerator, &vip))
1132: {
1133: /* propose a 0.0.0.0/0 or ::/0 subnet when we use virtual ip */
1134: vip = host_create_any(vip->get_family(vip));
1135: list->insert_last(list, vip);
1136: }
1137: enumerator->destroy(enumerator);
1138: }
1139: if (list->get_count(list))
1140: {
1141: this->tsi = this->config->get_traffic_selectors(this->config,
1142: TRUE, NULL, list, TRUE);
1143: list->destroy_offset(list, offsetof(host_t, destroy));
1144: }
1145: else
1146: { /* no virtual IPs configured */
1147: list->destroy(list);
1148: list = get_dynamic_hosts(this->ike_sa, TRUE);
1149: this->tsi = this->config->get_traffic_selectors(this->config,
1150: TRUE, NULL, list, TRUE);
1151: list->destroy(list);
1152: }
1153: list = get_dynamic_hosts(this->ike_sa, FALSE);
1154: this->tsr = this->config->get_traffic_selectors(this->config,
1155: FALSE, NULL, list, TRUE);
1156: list->destroy(list);
1157:
1158: if (this->packet_tsi)
1159: {
1160: this->tsi->insert_first(this->tsi,
1161: this->packet_tsi->clone(this->packet_tsi));
1162: }
1163: if (this->packet_tsr)
1164: {
1165: this->tsr->insert_first(this->tsr,
1166: this->packet_tsr->clone(this->packet_tsr));
1167: }
1168: this->proposals = this->config->get_proposals(this->config,
1169: this->dh_group == MODP_NONE);
1170: this->mode = this->config->get_mode(this->config);
1171:
1172: this->child.if_id_in_def = this->ike_sa->get_if_id(this->ike_sa, TRUE);
1173: this->child.if_id_out_def = this->ike_sa->get_if_id(this->ike_sa, FALSE);
1174: this->child.encap = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
1175: this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
1176: this->ike_sa->get_other_host(this->ike_sa),
1177: this->config, &this->child);
1178:
1179: if (this->child.reqid)
1180: {
1181: DBG0(DBG_IKE, "establishing CHILD_SA %s{%d} reqid %d",
1182: this->child_sa->get_name(this->child_sa),
1183: this->child_sa->get_unique_id(this->child_sa), this->child.reqid);
1184: }
1185: else
1186: {
1187: DBG0(DBG_IKE, "establishing CHILD_SA %s{%d}",
1188: this->child_sa->get_name(this->child_sa),
1189: this->child_sa->get_unique_id(this->child_sa));
1190: }
1191:
1192: if (!allocate_spi(this))
1193: {
1194: DBG1(DBG_IKE, "unable to allocate SPIs from kernel");
1195: return FAILED;
1196: }
1197:
1198: if (!update_and_check_proposals(this))
1199: {
1200: DBG1(DBG_IKE, "requested DH group %N not contained in any of our "
1201: "proposals",
1202: diffie_hellman_group_names, this->dh_group);
1203: return FAILED;
1204: }
1205:
1206: if (this->dh_group != MODP_NONE)
1207: {
1208: this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
1209: this->dh_group);
1210: }
1211:
1212: if (this->config->has_option(this->config, OPT_IPCOMP))
1213: {
1214: /* IPCOMP_DEFLATE is the only transform we support at the moment */
1215: add_ipcomp_notify(this, message, IPCOMP_DEFLATE);
1216: }
1217:
1218: if (message->get_exchange_type(message) == IKE_AUTH)
1219: {
1220: charon->bus->narrow(charon->bus, this->child_sa,
1221: NARROW_INITIATOR_PRE_NOAUTH, this->tsi, this->tsr);
1222: }
1223: else
1224: {
1225: charon->bus->narrow(charon->bus, this->child_sa,
1226: NARROW_INITIATOR_PRE_AUTH, this->tsi, this->tsr);
1227: }
1228:
1229: if (!build_payloads(this, message))
1230: {
1231: return FAILED;
1232: }
1233:
1234: this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1235: this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1236: this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1237: this->tsi = NULL;
1238: this->tsr = NULL;
1239: this->proposals = NULL;
1240:
1241: return NEED_MORE;
1242: }
1243:
1244: METHOD(task_t, process_r, status_t,
1245: private_child_create_t *this, message_t *message)
1246: {
1247: switch (message->get_exchange_type(message))
1248: {
1249: case IKE_SA_INIT:
1250: return get_nonce(message, &this->other_nonce);
1251: case CREATE_CHILD_SA:
1252: get_nonce(message, &this->other_nonce);
1253: break;
1254: case IKE_AUTH:
1255: if (message->get_message_id(message) != 1)
1256: {
1257: /* only handle first AUTH payload, not additional rounds */
1258: return NEED_MORE;
1259: }
1260: default:
1261: break;
1262: }
1263:
1264: process_payloads(this, message);
1265:
1266: return NEED_MORE;
1267: }
1268:
1269: /**
1270: * handle CHILD_SA setup failure
1271: */
1272: static void handle_child_sa_failure(private_child_create_t *this,
1273: message_t *message)
1274: {
1275: bool is_first;
1276:
1277: is_first = message->get_exchange_type(message) == IKE_AUTH;
1278: if (is_first &&
1279: lib->settings->get_bool(lib->settings,
1280: "%s.close_ike_on_child_failure", FALSE, lib->ns))
1281: {
1282: /* we delay the delete for 100ms, as the IKE_AUTH response must arrive
1283: * first */
1284: DBG1(DBG_IKE, "closing IKE_SA due CHILD_SA setup failure");
1285: lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
1286: delete_ike_sa_job_create(this->ike_sa->get_id(this->ike_sa), TRUE),
1287: 100);
1288: }
1289: else
1290: {
1291: DBG1(DBG_IKE, "failed to establish CHILD_SA, keeping IKE_SA");
1292: charon->bus->alert(charon->bus, ALERT_KEEP_ON_CHILD_SA_FAILURE,
1293: is_first);
1294: }
1295: }
1296:
1297: /**
1298: * Substitute transport mode NAT selectors, if applicable
1299: */
1300: static linked_list_t* get_ts_if_nat_transport(private_child_create_t *this,
1301: bool local, linked_list_t *in)
1302: {
1303: linked_list_t *out = NULL;
1304: ike_condition_t cond;
1305:
1306: if (this->mode == MODE_TRANSPORT)
1307: {
1308: cond = local ? COND_NAT_HERE : COND_NAT_THERE;
1309: if (this->ike_sa->has_condition(this->ike_sa, cond))
1310: {
1311: out = get_transport_nat_ts(this, local, in);
1312: if (out->get_count(out) == 0)
1313: {
1314: out->destroy(out);
1315: out = NULL;
1316: }
1317: }
1318: }
1319: return out;
1320: }
1321:
1322: /**
1323: * Select a matching CHILD config as responder
1324: */
1325: static child_cfg_t* select_child_cfg(private_child_create_t *this)
1326: {
1327: peer_cfg_t *peer_cfg;
1328: child_cfg_t *child_cfg = NULL;;
1329:
1330: peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1331: if (peer_cfg && this->tsi && this->tsr)
1332: {
1333: linked_list_t *listr, *listi, *tsr, *tsi;
1334:
1335: tsr = get_ts_if_nat_transport(this, TRUE, this->tsr);
1336: tsi = get_ts_if_nat_transport(this, FALSE, this->tsi);
1337:
1338: listr = get_dynamic_hosts(this->ike_sa, TRUE);
1339: listi = get_dynamic_hosts(this->ike_sa, FALSE);
1340: child_cfg = peer_cfg->select_child_cfg(peer_cfg,
1341: tsr ?: this->tsr, tsi ?: this->tsi,
1342: listr, listi);
1343: if ((tsi || tsr) && child_cfg &&
1344: child_cfg->get_mode(child_cfg) != MODE_TRANSPORT)
1345: {
1346: /* found a CHILD config, but it doesn't use transport mode */
1347: child_cfg->destroy(child_cfg);
1348: child_cfg = NULL;
1349: }
1350: if (!child_cfg && (tsi || tsr))
1351: {
1352: /* no match for the substituted NAT selectors, try it without */
1353: child_cfg = peer_cfg->select_child_cfg(peer_cfg,
1354: this->tsr, this->tsi, listr, listi);
1355: }
1356: listr->destroy(listr);
1357: listi->destroy(listi);
1358: DESTROY_OFFSET_IF(tsi, offsetof(traffic_selector_t, destroy));
1359: DESTROY_OFFSET_IF(tsr, offsetof(traffic_selector_t, destroy));
1360: }
1361:
1362: return child_cfg;
1363: }
1364:
1365: /**
1366: * Check how to handle a possibly childless IKE_SA
1367: */
1368: static status_t handle_childless(private_child_create_t *this)
1369: {
1370: ike_cfg_t *ike_cfg;
1371:
1372: ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
1373:
1374: if (!this->proposals && !this->tsi && !this->tsr)
1375: {
1376: /* looks like a childless IKE_SA, check if we allow it */
1377: if (ike_cfg->childless(ike_cfg) == CHILDLESS_NEVER)
1378: {
1379: /* we don't allow childless initiation */
1380: DBG1(DBG_IKE, "peer tried to initiate a childless IKE_SA");
1381: return INVALID_STATE;
1382: }
1383: return SUCCESS;
1384: }
1385:
1386: /* the peer apparently wants to create a regular IKE_SA */
1387: if (ike_cfg->childless(ike_cfg) == CHILDLESS_FORCE)
1388: {
1389: /* reject it if we only allow childless initiation */
1390: DBG1(DBG_IKE, "peer did not initiate a childless IKE_SA");
1391: return INVALID_STATE;
1392: }
1393: return NOT_SUPPORTED;
1394: }
1395:
1396: METHOD(task_t, build_r, status_t,
1397: private_child_create_t *this, message_t *message)
1398: {
1399: payload_t *payload;
1400: enumerator_t *enumerator;
1401: bool no_dh = TRUE, ike_auth = FALSE;
1402:
1403: switch (message->get_exchange_type(message))
1404: {
1405: case IKE_SA_INIT:
1406: return get_nonce(message, &this->my_nonce);
1407: case CREATE_CHILD_SA:
1408: if (!generate_nonce(this))
1409: {
1410: message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN,
1411: chunk_empty);
1412: return SUCCESS;
1413: }
1414: if (this->dh_failed)
1415: {
1416: DBG1(DBG_IKE, "applying DH public value failed");
1417: message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN,
1418: chunk_empty);
1419: return SUCCESS;
1420: }
1421: no_dh = FALSE;
1422: break;
1423: case IKE_AUTH:
1424: if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1425: { /* wait until all authentication round completed */
1426: return NEED_MORE;
1427: }
1428: if (this->ike_sa->has_condition(this->ike_sa, COND_REDIRECTED))
1429: { /* no CHILD_SA is created for redirected SAs */
1430: return SUCCESS;
1431: }
1432: switch (handle_childless(this))
1433: {
1434: case SUCCESS:
1435: /* no CHILD_SA built */
1436: return SUCCESS;
1437: case INVALID_STATE:
1438: message->add_notify(message, FALSE, INVALID_SYNTAX,
1439: chunk_empty);
1440: return FAILED;
1441: default:
1442: /* continue with regular initiation */
1443: break;
1444: }
1445: ike_auth = TRUE;
1446: default:
1447: break;
1448: }
1449:
1450: if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
1451: {
1452: DBG1(DBG_IKE, "unable to create CHILD_SA while rekeying IKE_SA");
1453: message->add_notify(message, TRUE, TEMPORARY_FAILURE, chunk_empty);
1454: return SUCCESS;
1455: }
1456: if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
1457: {
1458: DBG1(DBG_IKE, "unable to create CHILD_SA while deleting IKE_SA");
1459: message->add_notify(message, TRUE, TEMPORARY_FAILURE, chunk_empty);
1460: return SUCCESS;
1461: }
1462:
1463: if (this->config == NULL)
1464: {
1465: this->config = select_child_cfg(this);
1466: }
1467: if (this->config == NULL)
1468: {
1469: DBG1(DBG_IKE, "traffic selectors %#R === %#R unacceptable",
1470: this->tsr, this->tsi);
1471: charon->bus->alert(charon->bus, ALERT_TS_MISMATCH, this->tsi, this->tsr);
1472: message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
1473: handle_child_sa_failure(this, message);
1474: return SUCCESS;
1475: }
1476:
1477: /* check if ike_config_t included non-critical error notifies */
1478: enumerator = message->create_payload_enumerator(message);
1479: while (enumerator->enumerate(enumerator, &payload))
1480: {
1481: if (payload->get_type(payload) == PLV2_NOTIFY)
1482: {
1483: notify_payload_t *notify = (notify_payload_t*)payload;
1484:
1485: switch (notify->get_notify_type(notify))
1486: {
1487: case INTERNAL_ADDRESS_FAILURE:
1488: case FAILED_CP_REQUIRED:
1489: {
1490: DBG1(DBG_IKE,"configuration payload negotiation "
1491: "failed, no CHILD_SA built");
1492: enumerator->destroy(enumerator);
1493: handle_child_sa_failure(this, message);
1494: return SUCCESS;
1495: }
1496: default:
1497: break;
1498: }
1499: }
1500: }
1501: enumerator->destroy(enumerator);
1502:
1503: this->child.if_id_in_def = this->ike_sa->get_if_id(this->ike_sa, TRUE);
1504: this->child.if_id_out_def = this->ike_sa->get_if_id(this->ike_sa, FALSE);
1505: this->child.encap = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
1506: this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
1507: this->ike_sa->get_other_host(this->ike_sa),
1508: this->config, &this->child);
1509:
1510: if (this->ipcomp_received != IPCOMP_NONE)
1511: {
1512: if (this->config->has_option(this->config, OPT_IPCOMP))
1513: {
1514: add_ipcomp_notify(this, message, this->ipcomp_received);
1515: }
1516: else
1517: {
1518: DBG1(DBG_IKE, "received %N notify but IPComp is disabled, ignoring",
1519: notify_type_names, IPCOMP_SUPPORTED);
1520: }
1521: }
1522:
1523: switch (select_and_install(this, no_dh, ike_auth))
1524: {
1525: case SUCCESS:
1526: break;
1527: case NOT_FOUND:
1528: message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
1529: handle_child_sa_failure(this, message);
1530: return SUCCESS;
1531: case INVALID_ARG:
1532: {
1533: uint16_t group = htons(this->dh_group);
1534: message->add_notify(message, FALSE, INVALID_KE_PAYLOAD,
1535: chunk_from_thing(group));
1536: return SUCCESS;
1537: }
1538: case FAILED:
1539: default:
1540: message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
1541: handle_child_sa_failure(this, message);
1542: return SUCCESS;
1543: }
1544:
1545: if (!build_payloads(this, message))
1546: {
1547: message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
1548: handle_child_sa_failure(this, message);
1549: return SUCCESS;
1550: }
1551:
1552: if (!this->rekey)
1553: { /* invoke the child_up() hook if we are not rekeying */
1554: charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1555: }
1556: return SUCCESS;
1557: }
1558:
1559: /**
1560: * Raise alerts for received notify errors
1561: */
1562: static void raise_alerts(private_child_create_t *this, notify_type_t type)
1563: {
1564: linked_list_t *list;
1565:
1566: switch (type)
1567: {
1568: case NO_PROPOSAL_CHOSEN:
1569: list = this->config->get_proposals(this->config, FALSE);
1570: charon->bus->alert(charon->bus, ALERT_PROPOSAL_MISMATCH_CHILD, list);
1571: list->destroy_offset(list, offsetof(proposal_t, destroy));
1572: break;
1573: default:
1574: break;
1575: }
1576: }
1577:
1578: METHOD(task_t, build_i_delete, status_t,
1579: private_child_create_t *this, message_t *message)
1580: {
1581: message->set_exchange_type(message, INFORMATIONAL);
1582: if (this->my_spi && this->proto)
1583: {
1584: delete_payload_t *del;
1585:
1586: del = delete_payload_create(PLV2_DELETE, this->proto);
1587: del->add_spi(del, this->my_spi);
1588: message->add_payload(message, (payload_t*)del);
1589:
1590: DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
1591: protocol_id_names, this->proto, ntohl(this->my_spi));
1592: }
1593: return NEED_MORE;
1594: }
1595:
1596: /**
1597: * Change task to delete the failed CHILD_SA as initiator
1598: */
1599: static status_t delete_failed_sa(private_child_create_t *this)
1600: {
1601: if (this->my_spi && this->proto)
1602: {
1603: this->public.task.build = _build_i_delete;
1604: this->public.task.process = (void*)return_success;
1605: return NEED_MORE;
1606: }
1607: return SUCCESS;
1608: }
1609:
1610: METHOD(task_t, process_i, status_t,
1611: private_child_create_t *this, message_t *message)
1612: {
1613: enumerator_t *enumerator;
1614: payload_t *payload;
1615: bool no_dh = TRUE, ike_auth = FALSE;
1616:
1617: switch (message->get_exchange_type(message))
1618: {
1619: case IKE_SA_INIT:
1620: return get_nonce(message, &this->other_nonce);
1621: case CREATE_CHILD_SA:
1622: get_nonce(message, &this->other_nonce);
1623: no_dh = FALSE;
1624: break;
1625: case IKE_AUTH:
1626: if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1627: { /* wait until all authentication round completed */
1628: return NEED_MORE;
1629: }
1630: if (defer_child_sa(this) == NEED_MORE)
1631: { /* defer until after IKE_SA has been established */
1632: chunk_free(&this->other_nonce);
1633: return NEED_MORE;
1634: }
1635: ike_auth = TRUE;
1636: default:
1637: break;
1638: }
1639:
1640: /* check for erroneous notifies */
1641: enumerator = message->create_payload_enumerator(message);
1642: while (enumerator->enumerate(enumerator, &payload))
1643: {
1644: if (payload->get_type(payload) == PLV2_NOTIFY)
1645: {
1646: notify_payload_t *notify = (notify_payload_t*)payload;
1647: notify_type_t type = notify->get_notify_type(notify);
1648:
1649: switch (type)
1650: {
1651: /* handle notify errors related to CHILD_SA only */
1652: case NO_PROPOSAL_CHOSEN:
1653: case SINGLE_PAIR_REQUIRED:
1654: case NO_ADDITIONAL_SAS:
1655: case INTERNAL_ADDRESS_FAILURE:
1656: case FAILED_CP_REQUIRED:
1657: case TS_UNACCEPTABLE:
1658: case INVALID_SELECTORS:
1659: {
1660: DBG1(DBG_IKE, "received %N notify, no CHILD_SA built",
1661: notify_type_names, type);
1662: enumerator->destroy(enumerator);
1663: raise_alerts(this, type);
1664: handle_child_sa_failure(this, message);
1665: /* an error in CHILD_SA creation is not critical */
1666: return SUCCESS;
1667: }
1668: case TEMPORARY_FAILURE:
1669: {
1670: DBG1(DBG_IKE, "received %N notify, will retry later",
1671: notify_type_names, type);
1672: enumerator->destroy(enumerator);
1673: if (!this->rekey)
1674: { /* the rekey task will retry itself if necessary */
1675: schedule_delayed_retry(this);
1676: }
1677: return SUCCESS;
1678: }
1679: case INVALID_KE_PAYLOAD:
1680: {
1681: chunk_t data;
1682: uint16_t group = MODP_NONE;
1683:
1684: data = notify->get_notification_data(notify);
1685: if (data.len == sizeof(group))
1686: {
1687: memcpy(&group, data.ptr, data.len);
1688: group = ntohs(group);
1689: }
1690: if (this->retry)
1691: {
1692: DBG1(DBG_IKE, "already retried with DH group %N, "
1693: "ignore requested %N", diffie_hellman_group_names,
1694: this->dh_group, diffie_hellman_group_names, group);
1695: handle_child_sa_failure(this, message);
1696: /* an error in CHILD_SA creation is not critical */
1697: return SUCCESS;
1698: }
1699: DBG1(DBG_IKE, "peer didn't accept DH group %N, "
1700: "it requested %N", diffie_hellman_group_names,
1701: this->dh_group, diffie_hellman_group_names, group);
1702: this->retry = TRUE;
1703: this->dh_group = group;
1704: this->child_sa->set_state(this->child_sa, CHILD_RETRYING);
1705: this->public.task.migrate(&this->public.task, this->ike_sa);
1706: enumerator->destroy(enumerator);
1707: return NEED_MORE;
1708: }
1709: default:
1710: {
1711: if (message->get_exchange_type(message) == CREATE_CHILD_SA)
1712: { /* handle notifies if not handled in IKE_AUTH */
1713: if (type <= 16383)
1714: {
1715: DBG1(DBG_IKE, "received %N notify error",
1716: notify_type_names, type);
1717: enumerator->destroy(enumerator);
1718: return SUCCESS;
1719: }
1720: DBG2(DBG_IKE, "received %N notify",
1721: notify_type_names, type);
1722: }
1723: break;
1724: }
1725: }
1726: }
1727: }
1728: enumerator->destroy(enumerator);
1729:
1730: process_payloads(this, message);
1731:
1732: if (this->ipcomp == IPCOMP_NONE && this->ipcomp_received != IPCOMP_NONE)
1733: {
1734: DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify without requesting"
1735: " one, no CHILD_SA built");
1736: handle_child_sa_failure(this, message);
1737: return delete_failed_sa(this);
1738: }
1739: else if (this->ipcomp != IPCOMP_NONE && this->ipcomp_received == IPCOMP_NONE)
1740: {
1741: DBG1(DBG_IKE, "peer didn't accept our proposed IPComp transforms, "
1742: "IPComp is disabled");
1743: this->ipcomp = IPCOMP_NONE;
1744: }
1745: else if (this->ipcomp != IPCOMP_NONE && this->ipcomp != this->ipcomp_received)
1746: {
1747: DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify we didn't propose, "
1748: "no CHILD_SA built");
1749: handle_child_sa_failure(this, message);
1750: return delete_failed_sa(this);
1751: }
1752:
1753: if (this->dh_failed)
1754: {
1755: DBG1(DBG_IKE, "applying DH public value failed");
1756: handle_child_sa_failure(this, message);
1757: return delete_failed_sa(this);
1758: }
1759:
1760: if (select_and_install(this, no_dh, ike_auth) == SUCCESS)
1761: {
1762: if (!this->rekey)
1763: { /* invoke the child_up() hook if we are not rekeying */
1764: charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1765: }
1766: }
1767: else
1768: {
1769: handle_child_sa_failure(this, message);
1770: return delete_failed_sa(this);
1771: }
1772: return SUCCESS;
1773: }
1774:
1775: METHOD(child_create_t, use_reqid, void,
1776: private_child_create_t *this, uint32_t reqid)
1777: {
1778: this->child.reqid = reqid;
1779: }
1780:
1781: METHOD(child_create_t, use_marks, void,
1782: private_child_create_t *this, uint32_t in, uint32_t out)
1783: {
1784: this->child.mark_in = in;
1785: this->child.mark_out = out;
1786: }
1787:
1788: METHOD(child_create_t, use_if_ids, void,
1789: private_child_create_t *this, uint32_t in, uint32_t out)
1790: {
1791: this->child.if_id_in = in;
1792: this->child.if_id_out = out;
1793: }
1794:
1795: METHOD(child_create_t, use_dh_group, void,
1796: private_child_create_t *this, diffie_hellman_group_t dh_group)
1797: {
1798: this->dh_group = dh_group;
1799: }
1800:
1801: METHOD(child_create_t, get_child, child_sa_t*,
1802: private_child_create_t *this)
1803: {
1804: return this->child_sa;
1805: }
1806:
1807: METHOD(child_create_t, set_config, void,
1808: private_child_create_t *this, child_cfg_t *cfg)
1809: {
1810: DESTROY_IF(this->config);
1811: this->config = cfg;
1812: }
1813:
1814: METHOD(child_create_t, get_lower_nonce, chunk_t,
1815: private_child_create_t *this)
1816: {
1817: if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
1818: min(this->my_nonce.len, this->other_nonce.len)) < 0)
1819: {
1820: return this->my_nonce;
1821: }
1822: else
1823: {
1824: return this->other_nonce;
1825: }
1826: }
1827:
1828: METHOD(task_t, get_type, task_type_t,
1829: private_child_create_t *this)
1830: {
1831: return TASK_CHILD_CREATE;
1832: }
1833:
1834: METHOD(task_t, migrate, void,
1835: private_child_create_t *this, ike_sa_t *ike_sa)
1836: {
1837: chunk_free(&this->my_nonce);
1838: chunk_free(&this->other_nonce);
1839: if (this->tsr)
1840: {
1841: this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1842: }
1843: if (this->tsi)
1844: {
1845: this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1846: }
1847: DESTROY_IF(this->child_sa);
1848: DESTROY_IF(this->proposal);
1849: DESTROY_IF(this->nonceg);
1850: DESTROY_IF(this->dh);
1851: this->dh_failed = FALSE;
1852: if (this->proposals)
1853: {
1854: this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1855: }
1856:
1857: this->ike_sa = ike_sa;
1858: this->keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa);
1859: this->proposal = NULL;
1860: this->proposals = NULL;
1861: this->tsi = NULL;
1862: this->tsr = NULL;
1863: this->dh = NULL;
1864: this->nonceg = NULL;
1865: this->child_sa = NULL;
1866: this->mode = MODE_TUNNEL;
1867: this->ipcomp = IPCOMP_NONE;
1868: this->ipcomp_received = IPCOMP_NONE;
1869: this->other_cpi = 0;
1870: this->established = FALSE;
1871: this->child = (child_sa_create_t){};
1872: }
1873:
1874: METHOD(task_t, destroy, void,
1875: private_child_create_t *this)
1876: {
1877: chunk_free(&this->my_nonce);
1878: chunk_free(&this->other_nonce);
1879: if (this->tsr)
1880: {
1881: this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1882: }
1883: if (this->tsi)
1884: {
1885: this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1886: }
1887: if (!this->established)
1888: {
1889: DESTROY_IF(this->child_sa);
1890: }
1891: DESTROY_IF(this->packet_tsi);
1892: DESTROY_IF(this->packet_tsr);
1893: DESTROY_IF(this->proposal);
1894: DESTROY_IF(this->dh);
1895: if (this->proposals)
1896: {
1897: this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1898: }
1899: DESTROY_IF(this->config);
1900: DESTROY_IF(this->nonceg);
1901: free(this);
1902: }
1903:
1904: /*
1905: * Described in header.
1906: */
1907: child_create_t *child_create_create(ike_sa_t *ike_sa,
1908: child_cfg_t *config, bool rekey,
1909: traffic_selector_t *tsi, traffic_selector_t *tsr)
1910: {
1911: private_child_create_t *this;
1912:
1913: INIT(this,
1914: .public = {
1915: .get_child = _get_child,
1916: .set_config = _set_config,
1917: .get_lower_nonce = _get_lower_nonce,
1918: .use_reqid = _use_reqid,
1919: .use_marks = _use_marks,
1920: .use_if_ids = _use_if_ids,
1921: .use_dh_group = _use_dh_group,
1922: .task = {
1923: .get_type = _get_type,
1924: .migrate = _migrate,
1925: .destroy = _destroy,
1926: },
1927: },
1928: .ike_sa = ike_sa,
1929: .config = config,
1930: .packet_tsi = tsi ? tsi->clone(tsi) : NULL,
1931: .packet_tsr = tsr ? tsr->clone(tsr) : NULL,
1932: .dh_group = MODP_NONE,
1933: .keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa),
1934: .mode = MODE_TUNNEL,
1935: .tfcv3 = TRUE,
1936: .ipcomp = IPCOMP_NONE,
1937: .ipcomp_received = IPCOMP_NONE,
1938: .rekey = rekey,
1939: .retry = FALSE,
1940: );
1941:
1942: if (config)
1943: {
1944: this->public.task.build = _build_i;
1945: this->public.task.process = _process_i;
1946: this->initiator = TRUE;
1947: }
1948: else
1949: {
1950: this->public.task.build = _build_r;
1951: this->public.task.process = _process_r;
1952: this->initiator = FALSE;
1953: }
1954: return &this->public;
1955: }