diff options
Diffstat (limited to 'src/libcharon/sa/ikev1/tasks')
| -rw-r--r-- | src/libcharon/sa/ikev1/tasks/isakmp_delete.c | 5 | ||||
| -rw-r--r-- | src/libcharon/sa/ikev1/tasks/isakmp_natd.c | 18 | ||||
| -rw-r--r-- | src/libcharon/sa/ikev1/tasks/isakmp_vendor.c | 83 | ||||
| -rw-r--r-- | src/libcharon/sa/ikev1/tasks/quick_delete.c | 70 | ||||
| -rw-r--r-- | src/libcharon/sa/ikev1/tasks/quick_mode.c | 100 |
5 files changed, 190 insertions, 86 deletions
diff --git a/src/libcharon/sa/ikev1/tasks/isakmp_delete.c b/src/libcharon/sa/ikev1/tasks/isakmp_delete.c index 0640d13b1..a44f3c4a9 100644 --- a/src/libcharon/sa/ikev1/tasks/isakmp_delete.c +++ b/src/libcharon/sa/ikev1/tasks/isakmp_delete.c @@ -85,6 +85,11 @@ METHOD(task_t, process_r, status_t, this->ike_sa->get_other_host(this->ike_sa), this->ike_sa->get_other_id(this->ike_sa)); + if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED) + { + this->ike_sa->set_state(this->ike_sa, IKE_DELETING); + this->ike_sa->reestablish(this->ike_sa); + } this->ike_sa->set_state(this->ike_sa, IKE_DELETING); charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE); return DESTROY_ME; diff --git a/src/libcharon/sa/ikev1/tasks/isakmp_natd.c b/src/libcharon/sa/ikev1/tasks/isakmp_natd.c index 5a779ff62..fc6ac0771 100644 --- a/src/libcharon/sa/ikev1/tasks/isakmp_natd.c +++ b/src/libcharon/sa/ikev1/tasks/isakmp_natd.c @@ -97,6 +97,20 @@ struct private_isakmp_natd_t { }; /** + * Check if UDP encapsulation has to be forced either by config or required + * by the kernel interface + */ +static bool force_encap(ike_cfg_t *ike_cfg) +{ + if (!ike_cfg->force_encap(ike_cfg)) + { + return hydra->kernel_interface->get_features(hydra->kernel_interface) & + KERNEL_REQUIRE_UDP_ENCAPSULATION; + } + return TRUE; +} + +/** * Get NAT-D payload type (RFC 3947 or RFC 3947 drafts). */ static payload_type_t get_nat_d_payload_type(ike_sa_t *ike_sa) @@ -183,7 +197,7 @@ static hash_payload_t *build_natd_payload(private_isakmp_natd_t *this, bool src, chunk_t hash; config = this->ike_sa->get_ike_cfg(this->ike_sa); - if (src && config->force_encap(config)) + if (src && force_encap(config)) { hash = generate_natd_hash_faked(this); } @@ -297,7 +311,7 @@ static void process_payloads(private_isakmp_natd_t *this, message_t *message) !this->src_matched); config = this->ike_sa->get_ike_cfg(this->ike_sa); if (this->dst_matched && this->src_matched && - config->force_encap(config)) + force_encap(config)) { this->ike_sa->set_condition(this->ike_sa, COND_NAT_FAKE, TRUE); } diff --git a/src/libcharon/sa/ikev1/tasks/isakmp_vendor.c b/src/libcharon/sa/ikev1/tasks/isakmp_vendor.c index 2ff2b55e9..11155b287 100644 --- a/src/libcharon/sa/ikev1/tasks/isakmp_vendor.c +++ b/src/libcharon/sa/ikev1/tasks/isakmp_vendor.c @@ -67,6 +67,11 @@ struct private_isakmp_vendor_t { * Index of best nat traversal VID found */ int best_natt_ext; + + /** + * Number of times we have been invoked + */ + int count; }; /** @@ -175,8 +180,10 @@ static bool fragmentation_supported(chunk_t data, int i) return FALSE; } -METHOD(task_t, build, status_t, - private_isakmp_vendor_t *this, message_t *message) +/** + * Add supported vendor ID payloads + */ +static void build(private_isakmp_vendor_t *this, message_t *message) { vendor_id_payload_t *vid_payload; bool strongswan, cisco_unity, fragmentation; @@ -219,11 +226,12 @@ METHOD(task_t, build, status_t, message->add_payload(message, &vid_payload->payload_interface); } } - return this->initiator ? NEED_MORE : SUCCESS; } -METHOD(task_t, process, status_t, - private_isakmp_vendor_t *this, message_t *message) +/** + * Process vendor ID payloads + */ +static void process(private_isakmp_vendor_t *this, message_t *message) { enumerator_t *enumerator; payload_t *payload; @@ -289,14 +297,64 @@ METHOD(task_t, process, status_t, this->ike_sa->enable_extension(this->ike_sa, vendor_natt_ids[this->best_natt_ext].extension); } +} - return this->initiator ? SUCCESS : NEED_MORE; +METHOD(task_t, build_i, status_t, + private_isakmp_vendor_t *this, message_t *message) +{ + if (this->count++ == 0) + { + build(this, message); + } + if (message->get_exchange_type(message) == AGGRESSIVE && this->count > 1) + { + return SUCCESS; + } + return NEED_MORE; +} + +METHOD(task_t, process_r, status_t, + private_isakmp_vendor_t *this, message_t *message) +{ + this->count++; + process(this, message); + if (message->get_exchange_type(message) == AGGRESSIVE && this->count > 1) + { + return SUCCESS; + } + return NEED_MORE; +} + +METHOD(task_t, build_r, status_t, + private_isakmp_vendor_t *this, message_t *message) +{ + if (this->count == 1) + { + build(this, message); + } + if (message->get_exchange_type(message) == ID_PROT && this->count > 2) + { + return SUCCESS; + } + return NEED_MORE; +} + +METHOD(task_t, process_i, status_t, + private_isakmp_vendor_t *this, message_t *message) +{ + process(this, message); + if (message->get_exchange_type(message) == ID_PROT && this->count > 2) + { + return SUCCESS; + } + return NEED_MORE; } METHOD(task_t, migrate, void, private_isakmp_vendor_t *this, ike_sa_t *ike_sa) { this->ike_sa = ike_sa; + this->count = 0; } METHOD(task_t, get_type, task_type_t, @@ -321,8 +379,6 @@ isakmp_vendor_t *isakmp_vendor_create(ike_sa_t *ike_sa, bool initiator) INIT(this, .public = { .task = { - .build = _build, - .process = _process, .migrate = _migrate, .get_type = _get_type, .destroy = _destroy, @@ -333,5 +389,16 @@ isakmp_vendor_t *isakmp_vendor_create(ike_sa_t *ike_sa, bool initiator) .best_natt_ext = -1, ); + if (initiator) + { + this->public.task.build = _build_i; + this->public.task.process = _process_i; + } + else + { + this->public.task.build = _build_r; + this->public.task.process = _process_r; + } + return &this->public; } diff --git a/src/libcharon/sa/ikev1/tasks/quick_delete.c b/src/libcharon/sa/ikev1/tasks/quick_delete.c index e9f06cbe3..1a2cdb777 100644 --- a/src/libcharon/sa/ikev1/tasks/quick_delete.c +++ b/src/libcharon/sa/ikev1/tasks/quick_delete.c @@ -12,6 +12,27 @@ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. */ +/* + * Copyright (C) 2013 Oliver Smith + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in + * all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + * THE SOFTWARE. + */ #include "quick_delete.h" @@ -64,11 +85,13 @@ struct private_quick_delete_t { /** * Delete the specified CHILD_SA, if found */ -static bool delete_child(private_quick_delete_t *this, - protocol_id_t protocol, u_int32_t spi) +static bool delete_child(private_quick_delete_t *this, protocol_id_t protocol, + u_int32_t spi, bool remote_close) { u_int64_t bytes_in, bytes_out; child_sa_t *child_sa; + linked_list_t *my_ts, *other_ts; + child_cfg_t *child_cfg; bool rekeyed; child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE); @@ -85,15 +108,17 @@ static bool delete_child(private_quick_delete_t *this, rekeyed = child_sa->get_state(child_sa) == CHILD_REKEYING; child_sa->set_state(child_sa, CHILD_DELETING); + my_ts = linked_list_create_from_enumerator( + child_sa->create_ts_enumerator(child_sa, TRUE)); + other_ts = linked_list_create_from_enumerator( + child_sa->create_ts_enumerator(child_sa, FALSE)); if (this->expired) { DBG0(DBG_IKE, "closing expired CHILD_SA %s{%d} " "with SPIs %.8x_i %.8x_o and TS %#R=== %#R", child_sa->get_name(child_sa), child_sa->get_reqid(child_sa), ntohl(child_sa->get_spi(child_sa, TRUE)), - ntohl(child_sa->get_spi(child_sa, FALSE)), - child_sa->get_traffic_selectors(child_sa, TRUE), - child_sa->get_traffic_selectors(child_sa, FALSE)); + ntohl(child_sa->get_spi(child_sa, FALSE)), my_ts, other_ts); } else { @@ -105,18 +130,39 @@ static bool delete_child(private_quick_delete_t *this, child_sa->get_name(child_sa), child_sa->get_reqid(child_sa), ntohl(child_sa->get_spi(child_sa, TRUE)), bytes_in, ntohl(child_sa->get_spi(child_sa, FALSE)), bytes_out, - child_sa->get_traffic_selectors(child_sa, TRUE), - child_sa->get_traffic_selectors(child_sa, FALSE)); + my_ts, other_ts); } + my_ts->destroy(my_ts); + other_ts->destroy(other_ts); if (!rekeyed) { charon->bus->child_updown(charon->bus, child_sa, FALSE); - } - this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi); + if (remote_close) + { + child_cfg = child_sa->get_config(child_sa); + child_cfg->get_ref(child_cfg); - /* TODO-IKEv1: handle close action? */ + switch (child_sa->get_close_action(child_sa)) + { + case ACTION_RESTART: + child_cfg->get_ref(child_cfg); + this->ike_sa->initiate(this->ike_sa, child_cfg, + child_sa->get_reqid(child_sa), NULL, NULL); + break; + case ACTION_ROUTE: + charon->traps->install(charon->traps, + this->ike_sa->get_peer_cfg(this->ike_sa), + child_cfg, child_sa->get_reqid(child_sa)); + break; + default: + break; + } + child_cfg->destroy(child_cfg); + } + } + this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi); return TRUE; } @@ -124,7 +170,7 @@ static bool delete_child(private_quick_delete_t *this, METHOD(task_t, build_i, status_t, private_quick_delete_t *this, message_t *message) { - if (delete_child(this, this->protocol, this->spi) || this->force) + if (delete_child(this, this->protocol, this->spi, FALSE) || this->force) { delete_payload_t *delete_payload; @@ -172,7 +218,7 @@ METHOD(task_t, process_r, status_t, { DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI %.8x", protocol_id_names, protocol, ntohl(spi)); - if (!delete_child(this, protocol, spi)) + if (!delete_child(this, protocol, spi, TRUE)) { DBG1(DBG_IKE, "CHILD_SA not found, ignored"); continue; diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c index 7a0fb5788..6271e5b05 100644 --- a/src/libcharon/sa/ikev1/tasks/quick_mode.c +++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c @@ -259,7 +259,7 @@ static bool install(private_quick_mode_t *this) { status_t status, status_i, status_o; chunk_t encr_i, encr_r, integ_i, integ_r; - linked_list_t *tsi, *tsr; + linked_list_t *tsi, *tsr, *my_ts, *other_ts; child_sa_t *old = NULL; this->child_sa->set_proposal(this->child_sa, this->proposal); @@ -306,17 +306,21 @@ static bool install(private_quick_mode_t *this) { if (this->initiator) { - status_i = this->child_sa->install(this->child_sa, encr_r, integ_r, - this->spi_i, this->cpi_i, TRUE, FALSE, tsi, tsr); - status_o = this->child_sa->install(this->child_sa, encr_i, integ_i, - this->spi_r, this->cpi_r, FALSE, FALSE, tsi, tsr); + status_i = this->child_sa->install(this->child_sa, + encr_r, integ_r, this->spi_i, this->cpi_i, + this->initiator, TRUE, FALSE, tsi, tsr); + status_o = this->child_sa->install(this->child_sa, + encr_i, integ_i, this->spi_r, this->cpi_r, + this->initiator, FALSE, FALSE, tsi, tsr); } else { - status_i = this->child_sa->install(this->child_sa, encr_i, integ_i, - this->spi_r, this->cpi_r, TRUE, FALSE, tsr, tsi); - status_o = this->child_sa->install(this->child_sa, encr_r, integ_r, - this->spi_i, this->cpi_i, FALSE, FALSE, tsr, tsi); + status_i = this->child_sa->install(this->child_sa, + encr_i, integ_i, this->spi_r, this->cpi_r, + this->initiator, TRUE, FALSE, tsr, tsi); + status_o = this->child_sa->install(this->child_sa, + encr_r, integ_r, this->spi_i, this->cpi_i, + this->initiator, FALSE, FALSE, tsr, tsi); } } chunk_clear(&integ_i); @@ -358,14 +362,20 @@ static bool install(private_quick_mode_t *this) this->child_sa->set_state(this->child_sa, CHILD_INSTALLED); this->ike_sa->add_child_sa(this->ike_sa, this->child_sa); + my_ts = linked_list_create_from_enumerator( + this->child_sa->create_ts_enumerator(this->child_sa, TRUE)); + other_ts = linked_list_create_from_enumerator( + this->child_sa->create_ts_enumerator(this->child_sa, FALSE)); + DBG0(DBG_IKE, "CHILD_SA %s{%d} established " "with SPIs %.8x_i %.8x_o and TS %#R=== %#R", this->child_sa->get_name(this->child_sa), this->child_sa->get_reqid(this->child_sa), ntohl(this->child_sa->get_spi(this->child_sa, TRUE)), - ntohl(this->child_sa->get_spi(this->child_sa, FALSE)), - this->child_sa->get_traffic_selectors(this->child_sa, TRUE), - this->child_sa->get_traffic_selectors(this->child_sa, FALSE)); + ntohl(this->child_sa->get_spi(this->child_sa, FALSE)), my_ts, other_ts); + + my_ts->destroy(my_ts); + other_ts->destroy(other_ts); if (this->rekey) { @@ -500,33 +510,11 @@ static traffic_selector_t* select_ts(private_quick_mode_t *this, bool local, static void add_ts(private_quick_mode_t *this, message_t *message) { id_payload_t *id_payload; - host_t *hsi, *hsr; - if (this->initiator) - { - hsi = this->ike_sa->get_my_host(this->ike_sa); - hsr = this->ike_sa->get_other_host(this->ike_sa); - } - else - { - hsr = this->ike_sa->get_my_host(this->ike_sa); - hsi = this->ike_sa->get_other_host(this->ike_sa); - } - /* add ID payload only if negotiating non host2host tunnels */ - if (!this->tsi->is_host(this->tsi, hsi) || - !this->tsr->is_host(this->tsr, hsr) || - this->tsi->get_protocol(this->tsi) || - this->tsr->get_protocol(this->tsr) || - this->tsi->get_from_port(this->tsi) || - this->tsr->get_from_port(this->tsr) || - this->tsi->get_to_port(this->tsi) != 65535 || - this->tsr->get_to_port(this->tsr) != 65535) - { - id_payload = id_payload_create_from_ts(this->tsi); - message->add_payload(message, &id_payload->payload_interface); - id_payload = id_payload_create_from_ts(this->tsr); - message->add_payload(message, &id_payload->payload_interface); - } + id_payload = id_payload_create_from_ts(this->tsi); + message->add_payload(message, &id_payload->payload_interface); + id_payload = id_payload_create_from_ts(this->tsr); + message->add_payload(message, &id_payload->payload_interface); } /** @@ -774,19 +762,11 @@ METHOD(task_t, build_i, status_t, if (this->config->use_ipcomp(this->config)) { - if (this->udp) - { - DBG1(DBG_IKE, "IPComp is not supported if either peer is " - "natted, IPComp disabled"); - } - else + this->cpi_i = this->child_sa->alloc_cpi(this->child_sa); + if (!this->cpi_i) { - this->cpi_i = this->child_sa->alloc_cpi(this->child_sa); - if (!this->cpi_i) - { - DBG1(DBG_IKE, "unable to allocate a CPI from kernel, " - "IPComp disabled"); - } + DBG1(DBG_IKE, "unable to allocate a CPI from kernel, " + "IPComp disabled"); } } @@ -1009,21 +989,13 @@ METHOD(task_t, process_r, status_t, if (this->config->use_ipcomp(this->config)) { - if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY)) - { - DBG1(DBG_IKE, "IPComp is not supported if either peer is " - "natted, IPComp disabled"); - } - else + list = sa_payload->get_ipcomp_proposals(sa_payload, + &this->cpi_i); + if (!list->get_count(list)) { - list = sa_payload->get_ipcomp_proposals(sa_payload, - &this->cpi_i); - if (!list->get_count(list)) - { - DBG1(DBG_IKE, "expected IPComp proposal but peer did " - "not send one, IPComp disabled"); - this->cpi_i = 0; - } + DBG1(DBG_IKE, "expected IPComp proposal but peer did " + "not send one, IPComp disabled"); + this->cpi_i = 0; } } if (!list || !list->get_count(list)) |