From a39c28bb352b984d1391266bb77387d44ff04bd2 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 11 Aug 2014 16:09:35 +0200 Subject: [PATCH 1/6] android: Report error if CHILD_SA rekeying fails --- .../android/jni/libandroidbridge/backend/android_service.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/frontends/android/jni/libandroidbridge/backend/android_service.c b/src/frontends/android/jni/libandroidbridge/backend/android_service.c index e60c491c1..b2852e54e 100644 --- a/src/frontends/android/jni/libandroidbridge/backend/android_service.c +++ b/src/frontends/android/jni/libandroidbridge/backend/android_service.c @@ -484,6 +484,12 @@ METHOD(listener_t, alert, bool, charonservice->update_status(charonservice, CHARONSERVICE_PEER_AUTH_ERROR); break; + case ALERT_KEEP_ON_CHILD_SA_FAILURE: + /* because close_ike_on_child_failure is set this is only + * triggered when CHILD_SA rekeying failed */ + charonservice->update_status(charonservice, + CHARONSERVICE_GENERIC_ERROR); + break; case ALERT_PEER_INIT_UNREACHABLE: this->lock->read_lock(this->lock); if (this->tunfd < 0) From ac1b3a6dddaf004a46539d1bb2730f7b21429457 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 11 Aug 2014 16:34:28 +0200 Subject: [PATCH 2/6] android: Reestablish IKE_SA if CHILD_SA rekeying failed --- .../backend/android_service.c | 39 +++++++++++++++++-- 1 file changed, 36 insertions(+), 3 deletions(-) diff --git a/src/frontends/android/jni/libandroidbridge/backend/android_service.c b/src/frontends/android/jni/libandroidbridge/backend/android_service.c index b2852e54e..1a6a9203d 100644 --- a/src/frontends/android/jni/libandroidbridge/backend/android_service.c +++ b/src/frontends/android/jni/libandroidbridge/backend/android_service.c @@ -418,6 +418,31 @@ CALLBACK(terminate, job_requeue_t, return JOB_REQUEUE_NONE; } +/** + * Reestablish the IKE_SA with the given unique ID + */ +CALLBACK(reestablish, job_requeue_t, + u_int32_t *id) +{ + ike_sa_t *ike_sa; + + ike_sa = charon->ike_sa_manager->checkout_by_id(charon->ike_sa_manager, + *id, FALSE); + if (ike_sa) + { + if (ike_sa->reauth(ike_sa) == DESTROY_ME) + { + charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, + ike_sa); + } + else + { + charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa); + } + } + return JOB_REQUEUE_NONE; +} + METHOD(listener_t, child_updown, bool, private_android_service_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up) @@ -485,11 +510,19 @@ METHOD(listener_t, alert, bool, CHARONSERVICE_PEER_AUTH_ERROR); break; case ALERT_KEEP_ON_CHILD_SA_FAILURE: + { + u_int32_t *id = malloc_thing(u_int32_t); + /* because close_ike_on_child_failure is set this is only - * triggered when CHILD_SA rekeying failed */ - charonservice->update_status(charonservice, - CHARONSERVICE_GENERIC_ERROR); + * triggered when CHILD_SA rekeying failed. reestablish it in + * the hope that the initial setup works again. */ + *id = ike_sa->get_unique_id(ike_sa); + lib->processor->queue_job(lib->processor, + (job_t*)callback_job_create_with_prio( + (callback_job_cb_t)reestablish, id, free, + (callback_job_cancel_t)return_false, JOB_PRIO_HIGH)); break; + } case ALERT_PEER_INIT_UNREACHABLE: this->lock->read_lock(this->lock); if (this->tunfd < 0) From 8e52dc27333aba0cade1822d7948f96709724adf Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 11 Aug 2014 18:08:24 +0200 Subject: [PATCH 3/6] proposal: Fix equals() --- src/libcharon/config/proposal.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/libcharon/config/proposal.c b/src/libcharon/config/proposal.c index 4d881cd2f..50d3c6f66 100644 --- a/src/libcharon/config/proposal.c +++ b/src/libcharon/config/proposal.c @@ -337,7 +337,7 @@ static bool algo_list_equals(private_proposal_t *this, proposal_t *other, break; } } - if (e2->enumerate(e2, &alg2, ks2)) + if (e2->enumerate(e2, &alg2, &ks2)) { /* other has more algs */ equals = FALSE; @@ -594,7 +594,7 @@ METHOD(proposal_t, destroy, void, } /* - * Describtion in header-file + * Described in header */ proposal_t *proposal_create(protocol_id_t protocol, u_int number) { @@ -787,7 +787,7 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead) } /* - * Describtion in header-file + * Described in header */ proposal_t *proposal_create_default(protocol_id_t protocol) { @@ -826,7 +826,7 @@ proposal_t *proposal_create_default(protocol_id_t protocol) } /* - * Describtion in header-file + * Described in header */ proposal_t *proposal_create_default_aead(protocol_id_t protocol) { @@ -853,7 +853,7 @@ proposal_t *proposal_create_default_aead(protocol_id_t protocol) } /* - * Describtion in header-file + * Described in header */ proposal_t *proposal_create_from_string(protocol_id_t protocol, const char *algs) { From f92399ef1865ae557aa97b61ea3ee2dac6220766 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 11 Aug 2014 18:12:36 +0200 Subject: [PATCH 4/6] child-cfg: Ignore duplicate proposals If ESP proposals are added once with and once without DH groups duplicates result during IKE_AUTH when DH groups are stripped. --- src/libcharon/config/child_cfg.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/libcharon/config/child_cfg.c b/src/libcharon/config/child_cfg.c index 7e4a1433d..ed7c0d406 100644 --- a/src/libcharon/config/child_cfg.c +++ b/src/libcharon/config/child_cfg.c @@ -163,6 +163,11 @@ METHOD(child_cfg_t, add_proposal, void, } } +static bool match_proposal(proposal_t *item, proposal_t *proposal) +{ + return item->equals(item, proposal); +} + METHOD(child_cfg_t, get_proposals, linked_list_t*, private_child_cfg_t *this, bool strip_dh) { @@ -178,6 +183,12 @@ METHOD(child_cfg_t, get_proposals, linked_list_t*, { current->strip_dh(current, MODP_NONE); } + if (proposals->find_first(proposals, (linked_list_match_t)match_proposal, + NULL, current) == SUCCESS) + { + current->destroy(current); + continue; + } proposals->insert_last(proposals, current); } enumerator->destroy(enumerator); From 1fe3b0283834089819b4ad671c1b0337df2ba9e0 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 11 Aug 2014 18:17:00 +0200 Subject: [PATCH 5/6] android: Add DH groups to ESP proposals --- .../jni/libandroidbridge/backend/android_service.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/frontends/android/jni/libandroidbridge/backend/android_service.c b/src/frontends/android/jni/libandroidbridge/backend/android_service.c index 1a6a9203d..0bab31d5b 100644 --- a/src/frontends/android/jni/libandroidbridge/backend/android_service.c +++ b/src/frontends/android/jni/libandroidbridge/backend/android_service.c @@ -726,8 +726,18 @@ static job_requeue_t initiate(private_android_service_t *this) child_cfg = child_cfg_create("android", &lifetime, NULL, TRUE, MODE_TUNNEL, ACTION_NONE, ACTION_RESTART, ACTION_RESTART, FALSE, 0, 0, NULL, NULL, 0); - /* create an ESP proposal with the algorithms currently supported by - * libipsec, no PFS for now */ + /* create ESP proposals with and without DH groups, let responder decide + * if PFS is used */ + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes128gcm16-aes256gcm16-ecp256")); + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes128-sha256-ecp256-modp3072")); + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes256-sha384-ecp521-modp8192")); + child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, + "aes128-aes192-aes256-sha1-sha256-sha384-sha512-" + "ecp256-ecp384-ecp521-" + "modp2048-modp3072-modp4096-modp1024")); child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, "aes128gcm16-aes256gcm16")); child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP, From f9ceb5b54349bfd4667d8f9579d228073de3ec7d Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 11 Aug 2014 18:19:29 +0200 Subject: [PATCH 6/6] android: Reduce CHILD_SA lifetime --- .../android/jni/libandroidbridge/backend/android_service.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/frontends/android/jni/libandroidbridge/backend/android_service.c b/src/frontends/android/jni/libandroidbridge/backend/android_service.c index 0bab31d5b..881ff00f1 100644 --- a/src/frontends/android/jni/libandroidbridge/backend/android_service.c +++ b/src/frontends/android/jni/libandroidbridge/backend/android_service.c @@ -673,8 +673,8 @@ static job_requeue_t initiate(private_android_service_t *this) auth_cfg_t *auth; lifetime_cfg_t lifetime = { .time = { - .life = 10800, /* 3h */ - .rekey = 10200, /* 2h50min */ + .life = 3600, /* 1h */ + .rekey = 3000, /* 50min */ .jitter = 300 /* 5min */ } };