src/charon/sa/connect_manager.c

   1 /*
   2  * Copyright (C) 2007-2008 Tobias Brunner
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  *
  15  * $Id$
  16  */
  17
  18 #include "connect_manager.h"
  19
  20 #include <pthread.h>
  21 #include <math.h>
  22
  23 #include <daemon.h>
  24 #include <utils/linked_list.h>
  25 #include <crypto/hashers/hasher.h>
  26
  27 #include <processing/jobs/callback_job.h>
  28 #include <processing/jobs/initiate_mediation_job.h>
  29 #include <encoding/payloads/endpoint_notify.h>
  30
  31 /* base timeout
  32  * the check interval is ME_INTERVAL * active checklists (N) */
  33  #define ME_INTERVAL 20 /* ms */
  34 /* retransmission timeout is first ME_RTO_B * N for ME_BOOST retransmissions
  35  * then gets reduced to ME_RTO * N. */
  36 /* number of initial retransmissions sent in short interval */
  37 #define ME_BOOST 2
  38 /* retransmission timeout */
  39 #define ME_RTO 100 /* ms */
  40 /* max number of retransmissions */
  41 #define ME_MAX_RETRANS 9
  42
  43
  44 typedef struct private_connect_manager_t private_connect_manager_t;
  45
  46 /**
  47  * Additional private members of connect_manager_t.
  48  */
  49 struct private_connect_manager_t {
  50         /**
  51          * Public interface of connect_manager_t.
  52          */
  53          connect_manager_t public;
  54
  55          /**
  56           * Lock for exclusivly accessing the manager.
  57           */
  58          pthread_mutex_t mutex;
  59
  60          /**
  61           * Hasher to generate signatures
  62           */
  63          hasher_t *hasher;
  64
  65          /**
  66           * Linked list with initiated mediated connections
  67           */
  68          linked_list_t *initiated;
  69
  70          /**
  71           * Linked list with checklists (hash table with connect ID as key would be better).
  72           */
  73          linked_list_t *checklists;
  74 };
  75
  76 typedef enum check_state_t check_state_t;
  77
  78 enum check_state_t {
  79         CHECK_NONE,
  80         CHECK_WAITING,
  81         CHECK_IN_PROGRESS,
  82         CHECK_SUCCEEDED,
  83         CHECK_FAILED
  84 };
  85
  86 typedef struct endpoint_pair_t endpoint_pair_t;
  87
  88 /**
  89  * An entry in the check list.
  90  */
  91 struct endpoint_pair_t {
  92         /** pair id */
  93         u_int32_t id;
  94
  95         /** priority */
  96         u_int64_t priority;
  97
  98         /** local endpoint */
  99     host_t *local;
 100
 101     /** remote endpoint */
 102     host_t *remote;
 103
 104     /** state */
 105     check_state_t state;
 106
 107     /** number of retransmissions */
 108     u_int32_t retransmitted;
 109
 110     /** the generated packet */
 111     packet_t *packet;
 112 };
 113
 114 /**
 115  * Destroys an endpoint pair
 116  */
 117 static void endpoint_pair_destroy(endpoint_pair_t *this)
 118 {
 119         DESTROY_IF(this->local);
 120     DESTROY_IF(this->remote);
 121     DESTROY_IF(this->packet);
 122         free(this);
 123 }
 124
 125 /**
 126  * Creates a new entry for the list.
 127  */
 128 static endpoint_pair_t *endpoint_pair_create(endpoint_notify_t *initiator,
 129                 endpoint_notify_t *responder, bool initiator_is_local)
 130 {
 131         endpoint_pair_t *this = malloc_thing(endpoint_pair_t);
 132
 133         this->id = 0;
 134
 135         u_int32_t pi = initiator->get_priority(initiator);
 136         u_int32_t pr = responder->get_priority(responder);
 137         this->priority = pow(2, 32) * min(pi, pr) + 2 * max(pi, pr) + (pi > pr ? 1 : 0);
 138
 139         this->local = initiator_is_local ? initiator->get_base(initiator) : responder->get_base(responder);
 140         this->local = this->local->clone(this->local);
 141         this->remote = initiator_is_local ? responder->get_host(responder) : initiator->get_host(initiator);
 142         this->remote = this->remote->clone(this->remote);
 143
 144         this->state = CHECK_WAITING;
 145         this->retransmitted = 0;
 146         this->packet = NULL;
 147
 148         return this;
 149 }
 150
 151
 152 typedef struct check_list_t check_list_t;
 153
 154 /**
 155  * An entry in the linked list.
 156  */
 157 struct check_list_t {
 158
 159         struct {
 160                 /** initiator's id */
 161                 identification_t *id;
 162
 163                 /** initiator's key */
 164                 chunk_t key;
 165
 166                 /** initiator's endpoints */
 167                 linked_list_t *endpoints;
 168         } initiator;
 169
 170         struct {
 171                 /** responder's id */
 172                 identification_t *id;
 173
 174                 /** responder's key */
 175                 chunk_t key;
 176
 177                 /** responder's endpoints */
 178                 linked_list_t *endpoints;
 179         } responder;
 180
 181         /** connect id */
 182         chunk_t connect_id;
 183
 184     /** list of endpoint pairs */
 185     linked_list_t *pairs;
 186
 187     /** pairs queued for triggered checks */
 188     linked_list_t *triggered;
 189
 190     /** state */
 191     check_state_t state;
 192
 193     /** TRUE if this is the initiator */
 194         bool is_initiator;
 195
 196 };
 197
 198 /**
 199  * Destroys a checklist
 200  */
 201 static void check_list_destroy(check_list_t *this)
 202 {
 203         DESTROY_IF(this->initiator.id);
 204         DESTROY_IF(this->responder.id);
 205
 206         chunk_free(&this->connect_id);
 207         chunk_free(&this->initiator.key);
 208         chunk_free(&this->responder.key);
 209
 210         DESTROY_OFFSET_IF(this->initiator.endpoints, offsetof(endpoint_notify_t, destroy));
 211         DESTROY_OFFSET_IF(this->responder.endpoints, offsetof(endpoint_notify_t, destroy));
 212
 213         DESTROY_FUNCTION_IF(this->pairs, (void*)endpoint_pair_destroy);
 214         /* this list contains some of the same elements as contained in this->pairs */
 215         DESTROY_IF(this->triggered);
 216
 217         free(this);
 218 }
 219
 220 /**
 221  * Creates a new checklist
 222  */
 223 static check_list_t *check_list_create(identification_t *initiator, identification_t *responder,
 224                 chunk_t connect_id, chunk_t initiator_key, linked_list_t *initiator_endpoints,
 225                 bool is_initiator)
 226 {
 227         check_list_t *this = malloc_thing(check_list_t);
 228
 229         this->connect_id = chunk_clone(connect_id);
 230
 231         this->initiator.id = initiator->clone(initiator);
 232         this->initiator.key = chunk_clone(initiator_key);
 233         this->initiator.endpoints = initiator_endpoints->clone_offset(initiator_endpoints, offsetof(endpoint_notify_t, clone));
 234
 235         this->responder.id = responder->clone(responder);
 236         this->responder.key = chunk_empty;
 237     this->responder.endpoints = NULL;
 238
 239     this->pairs = linked_list_create();
 240     this->triggered = linked_list_create();
 241     this->state = CHECK_NONE;
 242     this->is_initiator = is_initiator;
 243
 244         return this;
 245 }
 246
 247
 248 typedef struct waiting_sa_t waiting_sa_t;
 249
 250 /**
 251  * For an initiator, the data stored about a waiting mediated sa
 252  */
 253 struct waiting_sa_t {
 254         /** ike sa id */
 255         ike_sa_id_t *ike_sa_id;
 256
 257         /** list of child_cfg_t */
 258         linked_list_t *childs;
 259 };
 260
 261 /**
 262  * Destroys a queued mediated sa
 263  */
 264 static void waiting_sa_destroy(waiting_sa_t *this)
 265 {
 266         DESTROY_IF(this->ike_sa_id);
 267         this->childs->destroy_offset(this->childs, offsetof(child_cfg_t, destroy));
 268         free(this);
 269 }
 270
 271 /**
 272  * Creates a new mediated sa object
 273  */
 274 static waiting_sa_t *waiting_sa_create(ike_sa_id_t *ike_sa_id)
 275 {
 276         waiting_sa_t *this = malloc_thing(waiting_sa_t);
 277
 278         this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
 279         this->childs = linked_list_create();
 280
 281         return this;
 282 }
 283
 284 typedef struct initiated_t initiated_t;
 285
 286 /**
 287  * For an initiator, the data stored about initiated mediation connections
 288  */
 289 struct initiated_t {
 290         /** my id */
 291         identification_t *id;
 292
 293         /** peer id */
 294         identification_t *peer_id;
 295
 296         /** list of mediated sas */
 297         linked_list_t *mediated;
 298 };
 299
 300 /**
 301  * Destroys a queued initiation
 302  */
 303 static void initiated_destroy(initiated_t *this)
 304 {
 305         DESTROY_IF(this->id);
 306         DESTROY_IF(this->peer_id);
 307         this->mediated->destroy_function(this->mediated, (void*)waiting_sa_destroy);
 308         free(this);
 309 }
 310
 311 /**
 312  * Creates a queued initiation
 313  */
 314 static initiated_t *initiated_create(identification_t *id, identification_t *peer_id)
 315 {
 316         initiated_t *this = malloc_thing(initiated_t);
 317
 318         this->id = id->clone(id);
 319         this->peer_id = peer_id->clone(peer_id);
 320         this->mediated = linked_list_create();
 321
 322         return this;
 323 }
 324
 325
 326 typedef struct check_t check_t;
 327
 328 /**
 329  * Data exchanged in a connectivity check
 330  */
 331 struct check_t {
 332         /** message id */
 333         u_int32_t mid;
 334
 335         /** source of the connectivity check */
 336         host_t *src;
 337
 338         /** destination of the connectivity check */
 339         host_t *dst;
 340
 341         /** connect id */
 342         chunk_t connect_id;
 343
 344         /** endpoint */
 345         endpoint_notify_t *endpoint;
 346
 347         /** raw endpoint payload (to verify the signature) */
 348         chunk_t endpoint_raw;
 349
 350     /** connect auth */
 351     chunk_t auth;
 352 };
 353
 354 /**
 355  * Destroys a connectivity check
 356  */
 357 static void check_destroy(check_t *this)
 358 {
 359         chunk_free(&this->connect_id);
 360         chunk_free(&this->endpoint_raw);
 361         chunk_free(&this->auth);
 362         DESTROY_IF(this->endpoint);
 363         free(this);
 364 }
 365
 366 /**
 367  * Creates a new connectivity check
 368  */
 369 static check_t *check_create()
 370 {
 371         check_t *this = malloc_thing(check_t);
 372
 373         this->connect_id = chunk_empty;
 374         this->auth = chunk_empty;
 375         this->endpoint_raw = chunk_empty;
 376         this->endpoint = NULL;
 377
 378         this->mid = 0;
 379
 380         return this;
 381 }
 382
 383 typedef struct sender_data_t sender_data_t;
 384
 385 /**
 386  * Data required by the sender
 387  */
 388 struct sender_data_t {
 389         /** connect manager */
 390         private_connect_manager_t *connect_manager;
 391
 392         /** connect id */
 393         chunk_t connect_id;
 394 };
 395
 396 /**
 397  * Destroys a sender data object
 398  */
 399 static void sender_data_destroy(sender_data_t *this)
 400 {
 401         chunk_free(&this->connect_id);
 402         free(this);
 403 }
 404
 405 /**
 406  * Creates a new sender data object
 407  */
 408 static sender_data_t *sender_data_create(private_connect_manager_t *connect_manager, chunk_t connect_id)
 409 {
 410         sender_data_t *this = malloc_thing(sender_data_t);
 411         this->connect_manager = connect_manager;
 412         this->connect_id = connect_id;
 413         return this;
 414 }
 415
 416 typedef struct retransmit_data_t retransmit_data_t;
 417
 418 /**
 419  * Data required by the retransmission job
 420  */
 421 struct retransmit_data_t {
 422         /** connect manager */
 423         private_connect_manager_t *connect_manager;
 424
 425         /** connect id */
 426         chunk_t connect_id;
 427
 428         /** message (pair) id */
 429         u_int32_t mid;
 430 };
 431
 432 /**
 433  * Destroys a retransmission data object
 434  */
 435 static void retransmit_data_destroy(retransmit_data_t *this)
 436 {
 437         chunk_free(&this->connect_id);
 438         free(this);
 439 }
 440
 441 /**
 442  * Creates a new retransmission data object
 443  */
 444 static retransmit_data_t *retransmit_data_create(private_connect_manager_t *connect_manager,
 445                 chunk_t connect_id, u_int32_t mid)
 446 {
 447         retransmit_data_t *this = malloc_thing(retransmit_data_t);
 448
 449         this->connect_manager = connect_manager;
 450         this->connect_id = connect_id;
 451         this->mid = mid;
 452
 453         return this;
 454 }
 455
 456 typedef struct initiate_data_t initiate_data_t;
 457
 458 /**
 459  * Data required by the initiate mediated
 460  */
 461 struct initiate_data_t {
 462         /** checklist */
 463         check_list_t *checklist;
 464
 465         /** waiting mediated connections */
 466         initiated_t *initiated;
 467 };
 468
 469 /**
 470  * Destroys a initiate data object
 471  */
 472 static void initiate_data_destroy(initiate_data_t *this)
 473 {
 474         check_list_destroy(this->checklist);
 475         initiated_destroy(this->initiated);
 476         free(this);
 477 }
 478
 479 /**
 480  * Creates a new initiate data object
 481  */
 482 static initiate_data_t *initiate_data_create(check_list_t *checklist, initiated_t *initiated)
 483 {
 484         initiate_data_t *this = malloc_thing(initiate_data_t);
 485
 486         this->checklist = checklist;
 487         this->initiated = initiated;
 488
 489         return this;
 490 }
 491
 492 /**
 493  * Find an initiated connection by the peers' ids
 494  */
 495 static bool match_initiated_by_ids(initiated_t *current, identification_t *id,
 496                 identification_t *peer_id)
 497 {
 498         return id->equals(id, current->id) && peer_id->equals(peer_id, current->peer_id);
 499 }
 500
 501 static status_t get_initiated_by_ids(private_connect_manager_t *this,
 502                 identification_t *id, identification_t *peer_id, initiated_t **initiated)
 503 {
 504         return this->initiated->find_first(this->initiated,
 505                                 (linked_list_match_t)match_initiated_by_ids,
 506                                 (void**)initiated, id, peer_id);
 507 }
 508
 509 /**
 510  * Removes data about initiated connections
 511  */
 512 static void remove_initiated(private_connect_manager_t *this, initiated_t *initiated)
 513 {
 514         iterator_t *iterator;
 515         initiated_t *current;
 516
 517         iterator = this->initiated->create_iterator(this->initiated, TRUE);
 518         while (iterator->iterate(iterator, (void**)&current))
 519         {
 520                 if (current == initiated)
 521                 {
 522                         iterator->remove(iterator);
 523                         break;
 524                 }
 525         }
 526         iterator->destroy(iterator);
 527 }
 528
 529 /**
 530  * Finds a waiting sa
 531  */
 532 static bool match_waiting_sa(waiting_sa_t *current, ike_sa_id_t *ike_sa_id)
 533 {
 534         return ike_sa_id->equals(ike_sa_id, current->ike_sa_id);
 535 }
 536
 537 static status_t get_waiting_sa(initiated_t *initiated, ike_sa_id_t *ike_sa_id, waiting_sa_t **waiting_sa)
 538 {
 539         return initiated->mediated->find_first(initiated->mediated,
 540                                 (linked_list_match_t)match_waiting_sa,
 541                                 (void**)waiting_sa, ike_sa_id);
 542 }
 543
 544 /**
 545  * Find the checklist with a specific connect ID
 546  */
 547 static bool match_checklist_by_id(check_list_t *current, chunk_t *connect_id)
 548 {
 549         return chunk_equals(*connect_id, current->connect_id);
 550 }
 551
 552 static status_t get_checklist_by_id(private_connect_manager_t *this,
 553                 chunk_t connect_id, check_list_t **check_list)
 554 {
 555         return this->checklists->find_first(this->checklists,
 556                                 (linked_list_match_t)match_checklist_by_id,
 557                                 (void**)check_list, &connect_id);
 558 }
 559
 560 /**
 561  * Removes a checklist
 562  */
 563 static void remove_checklist(private_connect_manager_t *this, check_list_t *checklist)
 564 {
 565         iterator_t *iterator;
 566         check_list_t *current;
 567
 568         iterator = this->checklists->create_iterator(this->checklists, TRUE);
 569         while (iterator->iterate(iterator, (void**)&current))
 570         {
 571                 if (current == checklist)
 572                 {
 573                         iterator->remove(iterator);
 574                         break;
 575                 }
 576         }
 577         iterator->destroy(iterator);
 578 }
 579
 580 /**
 581  * Checks if a list of endpoint_notify_t contains a certain host_t
 582  */
 583 static bool match_endpoint_by_host(endpoint_notify_t *current, host_t *host)
 584 {
 585         return host->equals(host, current->get_host(current));
 586 }
 587
 588 static status_t endpoints_contain(linked_list_t *endpoints, host_t *host, endpoint_notify_t **endpoint)
 589 {
 590         return endpoints->find_first(endpoints,
 591                                 (linked_list_match_t)match_endpoint_by_host,
 592                                 (void**)endpoint, host);
 593 }
 594
 595 /**
 596  * Updates the state of the whole checklist
 597  */
 598 static void update_checklist_state(check_list_t *checklist)
 599 {
 600         iterator_t *iterator;
 601         endpoint_pair_t *current;
 602         bool in_progress = FALSE, succeeded = FALSE;
 603
 604         iterator = checklist->pairs->create_iterator(checklist->pairs, TRUE);
 605         while (iterator->iterate(iterator, (void**)&current))
 606         {
 607                 switch(current->state)
 608                 {
 609                         case CHECK_WAITING:
 610                                 /* at least one is still waiting -> checklist remains
 611                                  * in waiting state */
 612                                 iterator->destroy(iterator);
 613                                 return;
 614                         case CHECK_IN_PROGRESS:
 615                                 in_progress = TRUE;
 616                                 break;
 617                         case CHECK_SUCCEEDED:
 618                                 succeeded = TRUE;
 619                                 break;
 620                         default:
 621                                 break;
 622                 }
 623         }
 624         iterator->destroy(iterator);
 625
 626         if (in_progress)
 627         {
 628                 checklist->state = CHECK_IN_PROGRESS;
 629         }
 630         else if (succeeded)
 631         {
 632                 checklist->state = CHECK_SUCCEEDED;
 633         }
 634         else
 635         {
 636                 checklist->state = CHECK_FAILED;
 637         }
 638 }
 639
 640 /**
 641  * Inserts an endpoint pair into the list of pairs ordered by priority (high to low)
 642  */
 643 static void insert_pair_by_priority(linked_list_t *pairs, endpoint_pair_t *pair)
 644 {
 645         iterator_t *iterator;
 646         endpoint_pair_t *current;
 647         bool inserted = FALSE;
 648
 649         iterator = pairs->create_iterator(pairs, TRUE);
 650         while (iterator->iterate(iterator, (void**)&current))
 651         {
 652                 if (current->priority < pair->priority)
 653                 {
 654                         iterator->insert_before(iterator, pair);
 655                         inserted = TRUE;
 656                         break;
 657                 }
 658         }
 659         iterator->destroy(iterator);
 660
 661         if (!inserted)
 662         {
 663                 pairs->insert_last(pairs, pair);
 664         }
 665 }
 666
 667 /**
 668  * Searches a list of endpoint_pair_t for a pair with specific host_ts
 669  */
 670 static bool match_pair_by_hosts(endpoint_pair_t *current, host_t *local, host_t *remote)
 671 {
 672         return local->equals(local, current->local) && remote->equals(remote, current->remote);
 673 }
 674
 675 static status_t get_pair_by_hosts(linked_list_t *pairs, host_t *local, host_t *remote, endpoint_pair_t **pair)
 676 {
 677         return pairs->find_first(pairs,
 678                                 (linked_list_match_t)match_pair_by_hosts,
 679                                 (void**)pair, local, remote);
 680 }
 681
 682 static bool match_pair_by_id(endpoint_pair_t *current, u_int32_t *id)
 683 {
 684         return current->id == *id;
 685 }
 686
 687 /**
 688  * Searches for a pair with a specific id
 689  */
 690 static status_t get_pair_by_id(check_list_t *checklist, u_int32_t id, endpoint_pair_t **pair)
 691 {
 692         return checklist->pairs->find_first(checklist->pairs,
 693                                 (linked_list_match_t)match_pair_by_id,
 694                                 (void**)pair, &id);
 695 }
 696
 697 static bool match_succeeded_pair(endpoint_pair_t *current)
 698 {
 699         return current->state == CHECK_SUCCEEDED;
 700 }
 701
 702 /**
 703  * Returns the best pair of state CHECK_SUCCEEDED from a checklist.
 704  */
 705 static status_t get_best_valid_pair(check_list_t *checklist, endpoint_pair_t **pair)
 706 {
 707         return checklist->pairs->find_first(checklist->pairs,
 708                                 (linked_list_match_t)match_succeeded_pair,
 709                                 (void**)pair);
 710 }
 711
 712 static bool match_waiting_pair(endpoint_pair_t *current)
 713 {
 714         return current->state == CHECK_WAITING;
 715 }
 716
 717 /**
 718  * Returns and *removes* the first triggered pair in state CHECK_WAITING.
 719  */
 720 static status_t get_triggered_pair(check_list_t *checklist, endpoint_pair_t **pair)
 721 {
 722         iterator_t *iterator;
 723         endpoint_pair_t *current;
 724         status_t status = NOT_FOUND;
 725
 726         iterator = checklist->triggered->create_iterator(checklist->triggered, TRUE);
 727         while (iterator->iterate(iterator, (void**)&current))
 728         {
 729                 iterator->remove(iterator);
 730
 731                 if (current->state == CHECK_WAITING)
 732                 {
 733                         if (pair)
 734                         {
 735                                 *pair = current;
 736                         }
 737                         status = SUCCESS;
 738                         break;
 739                 }
 740         }
 741         iterator->destroy(iterator);
 742
 743         return status;
 744 }
 745
 746 /**
 747  * Prunes identical pairs with lower priority from the list
 748  * Note: this function also numbers the remaining pairs serially
 749  */
 750 static void prune_pairs(linked_list_t *pairs)
 751 {
 752         iterator_t *iterator, *search;
 753         endpoint_pair_t *current, *other;
 754         u_int32_t id = 0;
 755
 756         iterator = pairs->create_iterator(pairs, TRUE);
 757         search = pairs->create_iterator(pairs, TRUE);
 758         while (iterator->iterate(iterator, (void**)&current))
 759         {
 760                 current->id = ++id;
 761
 762                 while (search->iterate(search, (void**)&other))
 763                 {
 764                         if (current == other)
 765                         {
 766                                 continue;
 767                         }
 768
 769                         if (current->local->equals(current->local, other->local) &&
 770                                         current->remote->equals(current->remote, other->remote))
 771                         {
 772                                 /* since the list of pairs is sorted by priority in descending
 773                                  * order, and we iterate the list from the beginning, we are
 774                                  * sure that the priority of 'other' is lower than that of
 775                                  * 'current', remove it */
 776                                 DBG1(DBG_IKE, "pruning endpoint pair %H - %H with priority %d",
 777                                                 other->local, other->remote, other->priority);
 778                                 search->remove(search);
 779                                 endpoint_pair_destroy(other);
 780                         }
 781                 }
 782                 search->reset(search);
 783         }
 784         search->destroy(search);
 785         iterator->destroy(iterator);
 786 }
 787
 788 /**
 789  * Builds a list of endpoint pairs
 790  */
 791 static void build_pairs(check_list_t *checklist)
 792 {
 793         iterator_t *iterator_i, *iterator_r;
 794         endpoint_notify_t *initiator, *responder;
 795
 796         iterator_i = checklist->initiator.endpoints->create_iterator(checklist->initiator.endpoints, TRUE);
 797         while (iterator_i->iterate(iterator_i, (void**)&initiator))
 798         {
 799                 iterator_r = checklist->responder.endpoints->create_iterator(checklist->responder.endpoints, TRUE);
 800                 while (iterator_r->iterate(iterator_r, (void**)&responder))
 801                 {
 802                         if (initiator->get_family(initiator) != responder->get_family(responder))
 803                         {
 804                                 continue;
 805                         }
 806
 807                         insert_pair_by_priority(checklist->pairs,
 808                                         endpoint_pair_create(initiator, responder, checklist->is_initiator));
 809                 }
 810                 iterator_r->destroy(iterator_r);
 811         }
 812         iterator_i->destroy(iterator_i);
 813
 814         prune_pairs(checklist->pairs);
 815 }
 816
 817 /**
 818  * Processes the payloads of a connectivity check and returns the extracted data
 819  */
 820 static status_t process_payloads(message_t *message, check_t *check)
 821 {
 822         iterator_t *iterator;
 823         payload_t *payload;
 824
 825         iterator = message->get_payload_iterator(message);
 826         while (iterator->iterate(iterator, (void**)&payload))
 827         {
 828                 if (payload->get_type(payload) != NOTIFY)
 829                 {
 830                         DBG1(DBG_IKE, "ignoring payload of type '%N' while processing "
 831                                         "connectivity check", payload_type_names, payload->get_type(payload));
 832                         continue;
 833                 }
 834
 835                 notify_payload_t *notify = (notify_payload_t*)payload;
 836
 837                 switch (notify->get_notify_type(notify))
 838                 {
 839                         case ME_ENDPOINT:
 840                         {
 841                                 if (check->endpoint)
 842                                 {
 843                                         DBG1(DBG_IKE, "connectivity check contains multiple ME_ENDPOINT notifies");
 844                                         break;
 845                                 }
 846
 847                                 endpoint_notify_t *endpoint = endpoint_notify_create_from_payload(notify);
 848                                 if (!endpoint)
 849                                 {
 850                                         DBG1(DBG_IKE, "received invalid ME_ENDPOINT notify");
 851                                         break;
 852                                 }
 853                                 check->endpoint = endpoint;
 854                                 check->endpoint_raw = chunk_clone(notify->get_notification_data(notify));
 855                                 DBG2(DBG_IKE, "received ME_ENDPOINT notify");
 856                                 break;
 857                         }
 858                         case ME_CONNECTID:
 859                         {
 860                                 if (check->connect_id.ptr)
 861                                 {
 862                                         DBG1(DBG_IKE, "connectivity check contains multiple ME_CONNECTID notifies");
 863                                         break;
 864                                 }
 865                                 check->connect_id = chunk_clone(notify->get_notification_data(notify));
 866                                 DBG2(DBG_IKE, "received ME_CONNECTID %#B", &check->connect_id);
 867                                 break;
 868                         }
 869                         case ME_CONNECTAUTH:
 870                         {
 871                                 if (check->auth.ptr)
 872                                 {
 873                                         DBG1(DBG_IKE, "connectivity check contains multiple ME_CONNECTAUTH notifies");
 874                                         break;
 875                                 }
 876                                 check->auth = chunk_clone(notify->get_notification_data(notify));
 877                                 DBG2(DBG_IKE, "received ME_CONNECTAUTH %#B", &check->auth);
 878                                 break;
 879                         }
 880                         default:
 881                                 break;
 882                 }
 883         }
 884         iterator->destroy(iterator);
 885
 886         if (!check->connect_id.ptr || !check->endpoint || !check->auth.ptr)
 887         {
 888                 DBG1(DBG_IKE, "at least one payload was missing from the connectivity check");
 889                 return FAILED;
 890         }
 891
 892         return SUCCESS;
 893 }
 894
 895 /**
 896  * Builds the signature for a connectivity check
 897  */
 898 static chunk_t build_signature(private_connect_manager_t *this,
 899                 check_list_t *checklist, check_t *check, bool outbound)
 900 {
 901         chunk_t mid_chunk, key_chunk, sig_chunk;
 902         chunk_t sig_hash;
 903
 904         mid_chunk = chunk_from_thing(check->mid);
 905
 906         key_chunk = (checklist->is_initiator && outbound) || (!checklist->is_initiator && !outbound)
 907                                         ? checklist->initiator.key : checklist->responder.key;
 908
 909         /* signature = SHA1( MID | ME_CONNECTID | ME_ENDPOINT | ME_CONNECTKEY ) */
 910         sig_chunk = chunk_cat("cccc", mid_chunk, check->connect_id, check->endpoint_raw, key_chunk);
 911         this->hasher->allocate_hash(this->hasher, sig_chunk, &sig_hash);
 912         DBG3(DBG_IKE, "sig_chunk %B", &sig_chunk);
 913         DBG3(DBG_IKE, "sig_hash %B", &sig_hash);
 914
 915         chunk_free(&sig_chunk);
 916         return sig_hash;
 917 }
 918
 919 static void queue_retransmission(private_connect_manager_t *this, check_list_t *checklist, endpoint_pair_t *pair);
 920 static void schedule_checks(private_connect_manager_t *this, check_list_t *checklist, u_int32_t time);
 921 static void finish_checks(private_connect_manager_t *this, check_list_t *checklist);
 922
 923 /**
 924  * This function is triggered for each sent check after a specific timeout
 925  */
 926 static job_requeue_t retransmit(retransmit_data_t *data)
 927 {
 928         private_connect_manager_t *this = data->connect_manager;
 929
 930         pthread_mutex_lock(&(this->mutex));
 931
 932         check_list_t *checklist;
 933         if (get_checklist_by_id(this, data->connect_id, &checklist) != SUCCESS)
 934         {
 935                 DBG1(DBG_IKE, "checklist with id '%B' not found, can't retransmit connectivity check",
 936                                 &data->connect_id);
 937                 pthread_mutex_unlock(&(this->mutex));
 938                 return JOB_REQUEUE_NONE;
 939         }
 940
 941         endpoint_pair_t *pair;
 942         if (get_pair_by_id(checklist, data->mid, &pair) != SUCCESS)
 943         {
 944                 DBG1(DBG_IKE, "pair with id '%d' not found, can't retransmit connectivity check",
 945                                 data->mid);
 946                 goto retransmit_end;
 947         }
 948
 949         if (pair->state != CHECK_IN_PROGRESS)
 950         {
 951                 DBG2(DBG_IKE, "pair with id '%d' is in wrong state [%d], don't retransmit the connectivity check",
 952                                 data->mid, pair->state);
 953                 goto retransmit_end;
 954         }
 955
 956         if (++pair->retransmitted >= ME_MAX_RETRANS)
 957         {
 958                 DBG2(DBG_IKE, "pair with id '%d' failed after %d retransmissions",
 959                                 data->mid, pair->retransmitted);
 960                 pair->state = CHECK_FAILED;
 961                 goto retransmit_end;
 962         }
 963
 964         charon->sender->send(charon->sender, pair->packet->clone(pair->packet));
 965
 966         queue_retransmission(this, checklist, pair);
 967
 968 retransmit_end:
 969         update_checklist_state(checklist);
 970
 971         switch(checklist->state)
 972         {
 973                 case CHECK_SUCCEEDED:
 974                 case CHECK_FAILED:
 975                         finish_checks(this, checklist);
 976                         break;
 977                 default:
 978                         break;
 979         }
 980
 981         pthread_mutex_unlock(&(this->mutex));
 982
 983         /* we reschedule it manually */
 984         return JOB_REQUEUE_NONE;
 985 }
 986
 987 /**
 988  * Queues a retransmission job
 989  */
 990 static void queue_retransmission(private_connect_manager_t *this, check_list_t *checklist, endpoint_pair_t *pair)
 991 {
 992         retransmit_data_t *data = retransmit_data_create(this, chunk_clone(checklist->connect_id), pair->id);
 993         job_t *job = (job_t*)callback_job_create((callback_job_cb_t)retransmit, data, (callback_job_cleanup_t)retransmit_data_destroy, NULL);
 994
 995         /*
 996         u_int32_t NW = 0;
 997         checklist->pairs->invoke_function(checklist->pairs, (linked_list_invoke_t)count_waiting_pairs, &NW);
 998         u_int32_t rto = max(ME_INTERVAL * N * (NW + 1), ME_RTO_MIN);
 999         */
1000         u_int32_t N = this->checklists->get_count(this->checklists);
1001         u_int32_t rto = ME_INTERVAL * N;
1002         if (pair->retransmitted > ME_BOOST)
1003         {
1004                 rto = ME_RTO * N;
1005         }
1006         DBG2(DBG_IKE, "retransmission of pair '%d' in %dms - %d active checklist(s)", pair->id, rto, N);
1007         charon->scheduler->schedule_job(charon->scheduler, (job_t*)job, rto);
1008 }
1009
1010 /**
1011  * Sends a check
1012  */
1013 static void send_check(private_connect_manager_t *this, check_list_t *checklist,
1014                 check_t *check, endpoint_pair_t *pair, bool request)
1015 {
1016         message_t *message = message_create();
1017         message->set_message_id(message, check->mid);
1018         message->set_exchange_type(message, INFORMATIONAL);
1019         message->set_request(message, request);
1020         message->set_destination(message, check->dst->clone(check->dst));
1021         message->set_source(message, check->src->clone(check->src));
1022
1023         message->set_ike_sa_id(message, ike_sa_id_create(0, 0, request));
1024
1025         message->add_notify(message, FALSE, ME_CONNECTID, check->connect_id);
1026         DBG2(DBG_IKE, "send ME_CONNECTID %#B", &check->connect_id);
1027
1028         notify_payload_t *endpoint = check->endpoint->build_notify(check->endpoint);
1029         check->endpoint_raw = chunk_clone(endpoint->get_notification_data(endpoint));
1030         message->add_payload(message, (payload_t*)endpoint);
1031         DBG2(DBG_IKE, "send ME_ENDPOINT notify");
1032
1033         check->auth = build_signature(this, checklist, check, TRUE);
1034         message->add_notify(message, FALSE, ME_CONNECTAUTH, check->auth);
1035         DBG2(DBG_IKE, "send ME_CONNECTAUTH %#B", &check->auth);
1036
1037         packet_t *packet;
1038         if (message->generate(message, NULL, NULL, &packet) == SUCCESS)
1039         {
1040                 charon->sender->send(charon->sender, packet->clone(packet));
1041
1042                 if (request)
1043                 {
1044                         DESTROY_IF(pair->packet);
1045                         pair->packet = packet;
1046                         queue_retransmission(this, checklist, pair);
1047                 }
1048                 else
1049                 {
1050                         packet->destroy(packet);
1051                 }
1052         }
1053 }
1054
1055 /**
1056  * Queues a triggered check
1057  */
1058 static void queue_triggered_check(check_list_t *checklist, endpoint_pair_t *pair)
1059 {
1060         pair->state = CHECK_WAITING;
1061         checklist->triggered->insert_last(checklist->triggered, pair);
1062 }
1063
1064 /**
1065  * This function is triggered for each checklist at a specific interval
1066  */
1067 static job_requeue_t sender(sender_data_t *data)
1068 {
1069         private_connect_manager_t *this = data->connect_manager;
1070
1071         pthread_mutex_lock(&(this->mutex));
1072
1073         check_list_t *checklist;
1074         if (get_checklist_by_id(this, data->connect_id, &checklist) != SUCCESS)
1075         {
1076                 DBG1(DBG_IKE, "checklist with id '%B' not found, can't send connectivity check",
1077                                 &data->connect_id);
1078                 pthread_mutex_unlock(&(this->mutex));
1079                 return JOB_REQUEUE_NONE;
1080         }
1081
1082         endpoint_pair_t *pair;
1083         if (get_triggered_pair(checklist, &pair) != SUCCESS)
1084         {
1085                 DBG1(DBG_IKE, "no triggered check queued, sending an ordinary check");
1086
1087                 if (checklist->pairs->find_first(checklist->pairs,
1088                                 (linked_list_match_t)match_waiting_pair, (void**)&pair) != SUCCESS)
1089                 {
1090                         pthread_mutex_unlock(&(this->mutex));
1091                         DBG1(DBG_IKE, "no pairs in waiting state, aborting");
1092                         return JOB_REQUEUE_NONE;
1093                 }
1094         }
1095         else
1096         {
1097                 DBG1(DBG_IKE, "triggered check found");
1098         }
1099
1100         check_t *check = check_create();
1101         check->mid = pair->id;
1102         check->src = pair->local->clone(pair->local);
1103         check->dst = pair->remote->clone(pair->remote);
1104         check->connect_id = chunk_clone(checklist->connect_id);
1105         check->endpoint = endpoint_notify_create();
1106
1107         pair->state = CHECK_IN_PROGRESS;
1108
1109         send_check(this, checklist, check, pair, TRUE);
1110
1111         check_destroy(check);
1112
1113         /* schedule this job again */
1114         u_int32_t N = this->checklists->get_count(this->checklists);
1115         schedule_checks(this, checklist, ME_INTERVAL * N);
1116
1117         pthread_mutex_unlock(&(this->mutex));
1118
1119         /* we reschedule it manually */
1120         return JOB_REQUEUE_NONE;
1121 }
1122
1123 /**
1124  * Schedules checks for a checklist (time in ms)
1125  */
1126 static void schedule_checks(private_connect_manager_t *this, check_list_t *checklist, u_int32_t time)
1127 {
1128         chunk_t connect_id = chunk_clone(checklist->connect_id);
1129         sender_data_t *data = sender_data_create(this, connect_id);
1130         job_t *job = (job_t*)callback_job_create((callback_job_cb_t)sender, data, (callback_job_cleanup_t)sender_data_destroy, NULL);
1131         charon->scheduler->schedule_job(charon->scheduler, job, time);
1132 }
1133
1134 /**
1135  * Initiates waiting mediated connections
1136  */
1137 static job_requeue_t initiate_mediated(initiate_data_t *data)
1138 {
1139         check_list_t *checklist = data->checklist;
1140         initiated_t *initiated = data->initiated;
1141
1142         endpoint_pair_t *pair;
1143         if (get_best_valid_pair(checklist, &pair) == SUCCESS)
1144         {
1145                 waiting_sa_t *waiting_sa;
1146                 iterator_t *iterator = initiated->mediated->create_iterator(initiated->mediated, TRUE);
1147                 while (iterator->iterate(iterator, (void**)&waiting_sa))
1148                 {
1149                         ike_sa_t *sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager, waiting_sa->ike_sa_id);
1150                         if (sa->initiate_mediated(sa, pair->local, pair->remote, waiting_sa->childs,
1151                                         checklist->connect_id) != SUCCESS)
1152                         {
1153                                 SIG(IKE_UP_FAILED, "establishing the mediated connection failed");
1154                                 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, sa);
1155                         }
1156                         charon->ike_sa_manager->checkin(charon->ike_sa_manager, sa);
1157                 }
1158                 iterator->destroy(iterator);
1159         }
1160         else
1161         {
1162                 /* this should (can?) not happen */
1163         }
1164
1165         return JOB_REQUEUE_NONE;
1166 }
1167
1168 /**
1169  * Finishes checks for a checklist
1170  */
1171 static void finish_checks(private_connect_manager_t *this, check_list_t *checklist)
1172 {
1173         if (checklist->is_initiator)
1174         {
1175                 initiated_t *initiated;
1176                 if (get_initiated_by_ids(this, checklist->initiator.id,
1177                                 checklist->responder.id, &initiated) == SUCCESS)
1178                 {
1179                         remove_checklist(this, checklist);
1180                         remove_initiated(this, initiated);
1181
1182                         initiate_data_t *data = initiate_data_create(checklist, initiated);
1183                         job_t *job = (job_t*)callback_job_create((callback_job_cb_t)initiate_mediated, data, (callback_job_cleanup_t)initiate_data_destroy, NULL);
1184                         charon->processor->queue_job(charon->processor, job);
1185                         return;
1186                 }
1187                 else
1188                 {
1189                         DBG1(DBG_IKE, "there is no mediated connection waiting between '%D' "
1190                                         "and '%D'", checklist->initiator.id, checklist->responder.id);
1191                 }
1192         }
1193 }
1194
1195 /**
1196  * Process the response to one of our requests
1197  */
1198 static void process_response(private_connect_manager_t *this, check_t *check,
1199                 check_list_t *checklist)
1200 {
1201         endpoint_pair_t *pair;
1202         if (get_pair_by_id(checklist, check->mid, &pair) == SUCCESS)
1203         {
1204                 if (pair->local->equals(pair->local, check->dst) &&
1205                                 pair->remote->equals(pair->remote, check->src))
1206                 {
1207                         DBG1(DBG_IKE, "endpoint pair '%d' is valid: '%#H' - '%#H'", pair->id,
1208                                         pair->local, pair->remote);
1209                         pair->state = CHECK_SUCCEEDED;
1210                 }
1211
1212                 linked_list_t *local_endpoints = checklist->is_initiator ?
1213                         checklist->initiator.endpoints : checklist->responder.endpoints;
1214
1215                 endpoint_notify_t *local_endpoint;
1216                 if (endpoints_contain(local_endpoints,
1217                                 check->endpoint->get_host(check->endpoint), &local_endpoint) != SUCCESS)
1218                 {
1219                         local_endpoint = endpoint_notify_create_from_host(PEER_REFLEXIVE,
1220                                         check->endpoint->get_host(check->endpoint), pair->local);
1221                         local_endpoint->set_priority(local_endpoint, check->endpoint->get_priority(check->endpoint));
1222                         local_endpoints->insert_last(local_endpoints, local_endpoint);
1223                 }
1224
1225                 update_checklist_state(checklist);
1226
1227                 switch(checklist->state)
1228                 {
1229                         case CHECK_SUCCEEDED:
1230                         case CHECK_FAILED:
1231                                 finish_checks(this, checklist);
1232                                 break;
1233                         default:
1234                                 break;
1235                 }
1236         }
1237         else
1238         {
1239                 DBG1(DBG_IKE, "pair with id '%d' not found", check->mid);
1240         }
1241 }
1242
1243 static void process_request(private_connect_manager_t *this, check_t *check,
1244                 check_list_t *checklist)
1245 {
1246         linked_list_t *remote_endpoints = checklist->is_initiator ?
1247                                 checklist->responder.endpoints : checklist->initiator.endpoints;
1248
1249         endpoint_notify_t *peer_reflexive, *remote_endpoint;
1250         peer_reflexive = endpoint_notify_create_from_host(PEER_REFLEXIVE, check->src, NULL);
1251         peer_reflexive->set_priority(peer_reflexive, check->endpoint->get_priority(check->endpoint));
1252
1253         if (endpoints_contain(remote_endpoints, check->src, &remote_endpoint) != SUCCESS)
1254         {
1255                 remote_endpoint = peer_reflexive->clone(peer_reflexive);
1256                 remote_endpoints->insert_last(remote_endpoints, remote_endpoint);
1257         }
1258
1259         endpoint_pair_t *pair;
1260         if (get_pair_by_hosts(checklist->pairs, check->dst, check->src, &pair) == SUCCESS)
1261         {
1262                 switch(pair->state)
1263                 {
1264                         case CHECK_IN_PROGRESS:
1265                                 /* prevent retransmissions */
1266                                 pair->retransmitted = ME_MAX_RETRANS;
1267                                 /* FIXME: we should wait to the next rto to send the triggered check
1268                                  * fall-through */
1269                         case CHECK_WAITING:
1270                         case CHECK_FAILED:
1271                                 queue_triggered_check(checklist, pair);
1272                                 break;
1273                         case CHECK_SUCCEEDED:
1274                         default:
1275                                 break;
1276                 }
1277         }
1278         else
1279         {
1280                 endpoint_notify_t *local_endpoint = endpoint_notify_create_from_host(HOST, check->dst, NULL);
1281
1282                 endpoint_notify_t *initiator = checklist->is_initiator ? local_endpoint : remote_endpoint;
1283                 endpoint_notify_t *responder = checklist->is_initiator ? remote_endpoint : local_endpoint;
1284
1285                 pair = endpoint_pair_create(initiator, responder, checklist->is_initiator);
1286                 pair->id = checklist->pairs->get_count(checklist->pairs) + 1;
1287
1288                 insert_pair_by_priority(checklist->pairs, pair);
1289
1290                 queue_triggered_check(checklist, pair);
1291
1292                 local_endpoint->destroy(local_endpoint);
1293         }
1294
1295
1296         check_t *response = check_create();
1297
1298         response->mid = check->mid;
1299         response->src = check->dst->clone(check->dst);
1300         response->dst = check->src->clone(check->src);
1301         response->connect_id = chunk_clone(check->connect_id);
1302         response->endpoint = peer_reflexive;
1303
1304         send_check(this, checklist, response, pair, FALSE);
1305
1306         check_destroy(response);
1307 }
1308
1309 /**
1310  * Implementation of connect_manager_t.process_check.
1311  */
1312 static void process_check(private_connect_manager_t *this, message_t *message)
1313 {
1314         if (message->parse_body(message, NULL, NULL) != SUCCESS)
1315         {
1316                 DBG1(DBG_IKE, "%N %s with message ID %d processing failed",
1317                          exchange_type_names, message->get_exchange_type(message),
1318                          message->get_request(message) ? "request" : "response",
1319                          message->get_message_id(message));
1320                 return;
1321         }
1322
1323         check_t *check = check_create();
1324         check->mid = message->get_message_id(message);
1325         check->src = message->get_source(message);
1326         check->dst = message->get_destination(message);
1327
1328         if (process_payloads(message, check) != SUCCESS)
1329         {
1330                 DBG1(DBG_IKE, "invalid connectivity check %s received",
1331                                 message->get_request(message) ? "request" : "response");
1332                 check_destroy(check);
1333                 return;
1334         }
1335
1336         pthread_mutex_lock(&(this->mutex));
1337
1338         check_list_t *checklist;
1339         if (get_checklist_by_id(this, check->connect_id, &checklist) != SUCCESS)
1340         {
1341                 DBG1(DBG_IKE, "checklist with id '%B' not found",
1342                                 &check->connect_id);
1343                 check_destroy(check);
1344                 pthread_mutex_unlock(&(this->mutex));
1345                 return;
1346         }
1347
1348         chunk_t sig = build_signature(this, checklist, check, FALSE);
1349         if (!chunk_equals(sig, check->auth))
1350         {
1351                 DBG1(DBG_IKE, "connectivity check verification failed");
1352                 check_destroy(check);
1353                 chunk_free(&sig);
1354                 pthread_mutex_unlock(&(this->mutex));
1355                 return;
1356         }
1357         chunk_free(&sig);
1358
1359         if (message->get_request(message))
1360         {
1361                 process_request(this, check, checklist);
1362         }
1363         else
1364         {
1365                 process_response(this, check, checklist);
1366         }
1367
1368         pthread_mutex_unlock(&(this->mutex));
1369
1370         check_destroy(check);
1371 }
1372
1373 /**
1374  * Implementation of connect_manager_t.check_and_register.
1375  */
1376 static bool check_and_register(private_connect_manager_t *this,
1377                         identification_t *id, identification_t *peer_id,
1378                         ike_sa_id_t *mediated_sa, child_cfg_t *child)
1379 {
1380         initiated_t *initiated;
1381         bool already_there = TRUE;
1382
1383         pthread_mutex_lock(&(this->mutex));
1384
1385         if (get_initiated_by_ids(this, id, peer_id, &initiated) != SUCCESS)
1386         {
1387                 DBG2(DBG_IKE, "registered waiting mediated connection with '%D'", peer_id);
1388                 initiated = initiated_create(id, peer_id);
1389                 this->initiated->insert_last(this->initiated, initiated);
1390                 already_there = FALSE;
1391         }
1392
1393         waiting_sa_t *waiting_sa;
1394         if (get_waiting_sa(initiated, mediated_sa, &waiting_sa) != SUCCESS)
1395         {
1396                 waiting_sa = waiting_sa_create(mediated_sa);
1397                 initiated->mediated->insert_last(initiated->mediated, waiting_sa);
1398         }
1399
1400         child->get_ref(child);
1401         waiting_sa->childs->insert_last(waiting_sa->childs, child);
1402
1403         pthread_mutex_unlock(&(this->mutex));
1404
1405         return already_there;
1406 }
1407
1408 /**
1409  * Implementation of connect_manager_t.check_and_initiate.
1410  */
1411 static void check_and_initiate(private_connect_manager_t *this, ike_sa_id_t *mediation_sa,
1412                 identification_t *id, identification_t *peer_id)
1413 {
1414         initiated_t *initiated;
1415
1416         pthread_mutex_lock(&(this->mutex));
1417
1418         if (get_initiated_by_ids(this, id, peer_id, &initiated) != SUCCESS)
1419         {
1420                 DBG2(DBG_IKE, "no waiting mediated connections with '%D'", peer_id);
1421                 pthread_mutex_unlock(&(this->mutex));
1422                 return;
1423         }
1424
1425         waiting_sa_t *waiting_sa;
1426         iterator_t *iterator = initiated->mediated->create_iterator(initiated->mediated, TRUE);
1427         while (iterator->iterate(iterator, (void**)&waiting_sa))
1428         {
1429                 job_t *job = (job_t*)reinitiate_mediation_job_create(mediation_sa,
1430                                 waiting_sa->ike_sa_id);
1431                 charon->processor->queue_job(charon->processor, job);
1432         }
1433
1434         pthread_mutex_unlock(&(this->mutex));
1435 }
1436
1437 /**
1438  * Implementation of connect_manager_t.set_initiator_data.
1439  */
1440 static status_t set_initiator_data(private_connect_manager_t *this,
1441                 identification_t *initiator, identification_t *responder,
1442                 chunk_t connect_id, chunk_t key, linked_list_t *endpoints, bool is_initiator)
1443 {
1444         check_list_t *checklist;
1445
1446         pthread_mutex_lock(&(this->mutex));
1447
1448         if (get_checklist_by_id(this, connect_id, NULL) == SUCCESS)
1449         {
1450                 DBG1(DBG_IKE, "checklist with id '%B' already exists, aborting",
1451                                 &connect_id);
1452                 pthread_mutex_unlock(&(this->mutex));
1453                 return FAILED;
1454         }
1455
1456         checklist = check_list_create(initiator, responder, connect_id, key, endpoints, is_initiator);
1457         this->checklists->insert_last(this->checklists, checklist);
1458
1459         pthread_mutex_unlock(&(this->mutex));
1460
1461         return SUCCESS;
1462 }
1463
1464 /**
1465  * Implementation of connect_manager_t.set_responder_data.
1466  */
1467 static status_t set_responder_data(private_connect_manager_t *this,
1468                 chunk_t connect_id, chunk_t key, linked_list_t *endpoints)
1469 {
1470         check_list_t *checklist;
1471
1472         pthread_mutex_lock(&(this->mutex));
1473
1474         if (get_checklist_by_id(this, connect_id, &checklist) != SUCCESS)
1475         {
1476                 DBG1(DBG_IKE, "checklist with id '%B' not found",
1477                                 &connect_id);
1478                 pthread_mutex_unlock(&(this->mutex));
1479                 return NOT_FOUND;
1480         }
1481
1482         checklist->responder.key = chunk_clone(key);
1483         checklist->responder.endpoints = endpoints->clone_offset(endpoints, offsetof(endpoint_notify_t, clone));
1484         checklist->state = CHECK_WAITING;
1485
1486         build_pairs(checklist);
1487
1488         /* send the first check immediately */
1489         schedule_checks(this, checklist, 0);
1490
1491         pthread_mutex_unlock(&(this->mutex));
1492
1493         return SUCCESS;
1494 }
1495
1496 /**
1497  * Implementation of connect_manager_t.stop_checks.
1498  */
1499 static status_t stop_checks(private_connect_manager_t *this, chunk_t connect_id)
1500 {
1501         check_list_t *checklist;
1502
1503         pthread_mutex_lock(&(this->mutex));
1504
1505         if (get_checklist_by_id(this, connect_id, &checklist) != SUCCESS)
1506         {
1507                 DBG1(DBG_IKE, "checklist with id '%B' not found",
1508                                 &connect_id);
1509                 pthread_mutex_unlock(&(this->mutex));
1510                 return NOT_FOUND;
1511         }
1512
1513         DBG1(DBG_IKE, "removing checklist with id '%B'", &connect_id);
1514
1515         remove_checklist(this, checklist);
1516         check_list_destroy(checklist);
1517
1518         pthread_mutex_unlock(&(this->mutex));
1519
1520         return SUCCESS;
1521 }
1522
1523 /**
1524  * Implementation of connect_manager_t.destroy.
1525  */
1526 static void destroy(private_connect_manager_t *this)
1527 {
1528         pthread_mutex_lock(&(this->mutex));
1529
1530         this->hasher->destroy(this->hasher);
1531         this->checklists->destroy_function(this->checklists, (void*)check_list_destroy);
1532         this->initiated->destroy_function(this->initiated, (void*)initiated_destroy);
1533
1534         pthread_mutex_unlock(&(this->mutex));
1535         pthread_mutex_destroy(&(this->mutex));
1536         free(this);
1537 }
1538
1539 /*
1540  * Described in header.
1541  */
1542 connect_manager_t *connect_manager_create()
1543 {
1544         private_connect_manager_t *this = malloc_thing(private_connect_manager_t);
1545
1546         this->public.destroy = (void(*)(connect_manager_t*))destroy;
1547         this->public.check_and_register = (bool(*)(connect_manager_t*,identification_t*,identification_t*,ike_sa_id_t*,child_cfg_t*))check_and_register;
1548         this->public.check_and_initiate = (void(*)(connect_manager_t*,ike_sa_id_t*,identification_t*,identification_t*))check_and_initiate;
1549         this->public.set_initiator_data = (status_t(*)(connect_manager_t*,identification_t*,identification_t*,chunk_t,chunk_t,linked_list_t*,bool))set_initiator_data;
1550         this->public.set_responder_data = (status_t(*)(connect_manager_t*,chunk_t,chunk_t,linked_list_t*))set_responder_data;
1551         this->public.process_check = (void(*)(connect_manager_t*,message_t*))process_check;
1552         this->public.stop_checks = (status_t(*)(connect_manager_t*,chunk_t))stop_checks;
1553
1554         this->hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
1555         if (this->hasher == NULL)
1556         {
1557                 DBG1(DBG_IKE, "unable to create connect manager, SHA1 not supported");
1558                 free(this);
1559                 return NULL;
1560         }
1561
1562         this->checklists = linked_list_create();
1563         this->initiated = linked_list_create();
1564
1565         pthread_mutex_init(&(this->mutex), NULL);
1566
1567         return (connect_manager_t*)this;
1568 }