src/charon/sa/ike_sa.c

   1 /*
   2  * Copyright (C) 2006-2008 Tobias Brunner
   3  * Copyright (C) 2006 Daniel Roethlisberger
   4  * Copyright (C) 2005-2009 Martin Willi
   5  * Copyright (C) 2005 Jan Hutter
   6  * Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 #include <string.h>
  20 #include <sys/stat.h>
  21 #include <errno.h>
  22 #include <time.h>
  23
  24 #include "ike_sa.h"
  25
  26 #include <library.h>
  27 #include <daemon.h>
  28 #include <utils/linked_list.h>
  29 #include <utils/lexparser.h>
  30 #include <sa/task_manager.h>
  31 #include <sa/tasks/ike_init.h>
  32 #include <sa/tasks/ike_natd.h>
  33 #include <sa/tasks/ike_mobike.h>
  34 #include <sa/tasks/ike_auth.h>
  35 #include <sa/tasks/ike_auth_lifetime.h>
  36 #include <sa/tasks/ike_config.h>
  37 #include <sa/tasks/ike_cert_pre.h>
  38 #include <sa/tasks/ike_cert_post.h>
  39 #include <sa/tasks/ike_rekey.h>
  40 #include <sa/tasks/ike_reauth.h>
  41 #include <sa/tasks/ike_delete.h>
  42 #include <sa/tasks/ike_dpd.h>
  43 #include <sa/tasks/child_create.h>
  44 #include <sa/tasks/child_delete.h>
  45 #include <sa/tasks/child_rekey.h>
  46 #include <processing/jobs/retransmit_job.h>
  47 #include <processing/jobs/delete_ike_sa_job.h>
  48 #include <processing/jobs/send_dpd_job.h>
  49 #include <processing/jobs/send_keepalive_job.h>
  50 #include <processing/jobs/rekey_ike_sa_job.h>
  51
  52 #ifdef ME
  53 #include <sa/tasks/ike_me.h>
  54 #include <processing/jobs/initiate_mediation_job.h>
  55 #endif
  56
  57 ENUM(ike_sa_state_names, IKE_CREATED, IKE_DESTROYING,
  58         "CREATED",
  59         "CONNECTING",
  60         "ESTABLISHED",
  61         "PASSIVE",
  62         "REKEYING",
  63         "DELETING",
  64         "DESTROYING",
  65 );
  66
  67 typedef struct private_ike_sa_t private_ike_sa_t;
  68 typedef struct attribute_entry_t attribute_entry_t;
  69
  70 /**
  71  * Private data of an ike_sa_t object.
  72  */
  73 struct private_ike_sa_t {
  74
  75         /**
  76          * Public members
  77          */
  78         ike_sa_t public;
  79
  80         /**
  81          * Identifier for the current IKE_SA.
  82          */
  83         ike_sa_id_t *ike_sa_id;
  84
  85         /**
  86          * unique numerical ID for this IKE_SA.
  87          */
  88         u_int32_t unique_id;
  89
  90         /**
  91          * Current state of the IKE_SA
  92          */
  93         ike_sa_state_t state;
  94
  95         /**
  96          * IKE configuration used to set up this IKE_SA
  97          */
  98         ike_cfg_t *ike_cfg;
  99
 100         /**
 101          * Peer and authentication information to establish IKE_SA.
 102          */
 103         peer_cfg_t *peer_cfg;
 104
 105         /**
 106          * currently used authentication ruleset, local (as auth_cfg_t)
 107          */
 108         auth_cfg_t *my_auth;
 109
 110         /**
 111          * currently used authentication constraints, remote (as auth_cfg_t)
 112          */
 113         auth_cfg_t *other_auth;
 114
 115         /**
 116          * Selected IKE proposal
 117          */
 118         proposal_t *proposal;
 119
 120         /**
 121          * Juggles tasks to process messages
 122          */
 123         task_manager_t *task_manager;
 124
 125         /**
 126          * Address of local host
 127          */
 128         host_t *my_host;
 129
 130         /**
 131          * Address of remote host
 132          */
 133         host_t *other_host;
 134
 135 #ifdef ME
 136         /**
 137          * Are we mediation server
 138          */
 139         bool is_mediation_server;
 140
 141         /**
 142          * Server reflexive host
 143          */
 144         host_t *server_reflexive_host;
 145
 146         /**
 147          * Connect ID
 148          */
 149         chunk_t connect_id;
 150 #endif /* ME */
 151
 152         /**
 153          * Identification used for us
 154          */
 155         identification_t *my_id;
 156
 157         /**
 158          * Identification used for other
 159          */
 160         identification_t *other_id;
 161
 162         /**
 163          * set of extensions the peer supports
 164          */
 165         ike_extension_t extensions;
 166
 167         /**
 168          * set of condition flags currently enabled for this IKE_SA
 169          */
 170         ike_condition_t conditions;
 171
 172         /**
 173          * Linked List containing the child sa's of the current IKE_SA.
 174          */
 175         linked_list_t *child_sas;
 176
 177         /**
 178          * keymat of this IKE_SA
 179          */
 180         keymat_t *keymat;
 181
 182         /**
 183          * Virtual IP on local host, if any
 184          */
 185         host_t *my_virtual_ip;
 186
 187         /**
 188          * Virtual IP on remote host, if any
 189          */
 190         host_t *other_virtual_ip;
 191
 192         /**
 193          * List of configuration attributes (attribute_entry_t)
 194          */
 195         linked_list_t *attributes;
 196
 197         /**
 198          * list of peers additional addresses, transmitted via MOBIKE
 199          */
 200         linked_list_t *additional_addresses;
 201
 202         /**
 203          * previously value of received DESTINATION_IP hash
 204          */
 205         chunk_t nat_detection_dest;
 206
 207         /**
 208          * number pending UPDATE_SA_ADDRESS (MOBIKE)
 209          */
 210         u_int32_t pending_updates;
 211
 212         /**
 213          * NAT keep alive interval
 214          */
 215         u_int32_t keepalive_interval;
 216
 217         /**
 218          * Timestamps for this IKE_SA
 219          */
 220         u_int32_t stats[STAT_MAX];
 221
 222         /**
 223          * how many times we have retried so far (keyingtries)
 224          */
 225         u_int32_t keyingtry;
 226
 227         /**
 228          * local host address to be used for IKE, set via MIGRATE kernel message
 229          */
 230         host_t *local_host;
 231
 232         /**
 233          * remote host address to be used for IKE, set via MIGRATE kernel message
 234          */
 235         host_t *remote_host;
 236 };
 237
 238 /**
 239  * Entry to maintain install configuration attributes during IKE_SA lifetime
 240  */
 241 struct attribute_entry_t {
 242         /** handler used to install this attribute */
 243         attribute_handler_t *handler;
 244         /** attribute type */
 245         configuration_attribute_type_t type;
 246         /** attribute data */
 247         chunk_t data;
 248 };
 249
 250 /**
 251  * get the time of the latest traffic processed by the kernel
 252  */
 253 static time_t get_use_time(private_ike_sa_t* this, bool inbound)
 254 {
 255         enumerator_t *enumerator;
 256         child_sa_t *child_sa;
 257         time_t use_time, current;
 258
 259         if (inbound)
 260         {
 261                 use_time = this->stats[STAT_INBOUND];
 262         }
 263         else
 264         {
 265                 use_time = this->stats[STAT_OUTBOUND];
 266         }
 267         enumerator = this->child_sas->create_enumerator(this->child_sas);
 268         while (enumerator->enumerate(enumerator, &child_sa))
 269         {
 270                 child_sa->get_usestats(child_sa, inbound, &current, NULL);
 271                 use_time = max(use_time, current);
 272         }
 273         enumerator->destroy(enumerator);
 274
 275         return use_time;
 276 }
 277
 278 /**
 279  * Implementation of ike_sa_t.get_unique_id
 280  */
 281 static u_int32_t get_unique_id(private_ike_sa_t *this)
 282 {
 283         return this->unique_id;
 284 }
 285
 286 /**
 287  * Implementation of ike_sa_t.get_name.
 288  */
 289 static char *get_name(private_ike_sa_t *this)
 290 {
 291         if (this->peer_cfg)
 292         {
 293                 return this->peer_cfg->get_name(this->peer_cfg);
 294         }
 295         return "(unnamed)";
 296 }
 297
 298 /**
 299  * Implementation of ike_sa_t.get_statistic.
 300  */
 301 static u_int32_t get_statistic(private_ike_sa_t *this, statistic_t kind)
 302 {
 303         if (kind < STAT_MAX)
 304         {
 305                 return this->stats[kind];
 306         }
 307         return 0;
 308 }
 309
 310 /**
 311  * Implementation of ike_sa_t.get_my_host.
 312  */
 313 static host_t *get_my_host(private_ike_sa_t *this)
 314 {
 315         return this->my_host;
 316 }
 317
 318 /**
 319  * Implementation of ike_sa_t.set_my_host.
 320  */
 321 static void set_my_host(private_ike_sa_t *this, host_t *me)
 322 {
 323         DESTROY_IF(this->my_host);
 324         this->my_host = me;
 325 }
 326
 327 /**
 328  * Implementation of ike_sa_t.get_other_host.
 329  */
 330 static host_t *get_other_host(private_ike_sa_t *this)
 331 {
 332         return this->other_host;
 333 }
 334
 335 /**
 336  * Implementation of ike_sa_t.set_other_host.
 337  */
 338 static void set_other_host(private_ike_sa_t *this, host_t *other)
 339 {
 340         DESTROY_IF(this->other_host);
 341         this->other_host = other;
 342 }
 343
 344 /**
 345  * Implementation of ike_sa_t.get_peer_cfg
 346  */
 347 static peer_cfg_t* get_peer_cfg(private_ike_sa_t *this)
 348 {
 349         return this->peer_cfg;
 350 }
 351
 352 /**
 353  * Implementation of ike_sa_t.set_peer_cfg
 354  */
 355 static void set_peer_cfg(private_ike_sa_t *this, peer_cfg_t *peer_cfg)
 356 {
 357         DESTROY_IF(this->peer_cfg);
 358         peer_cfg->get_ref(peer_cfg);
 359         this->peer_cfg = peer_cfg;
 360
 361         if (this->ike_cfg == NULL)
 362         {
 363                 this->ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
 364                 this->ike_cfg->get_ref(this->ike_cfg);
 365         }
 366 }
 367
 368 /**
 369  * Implementation of ike_sa_t.get_auth_cfg
 370  */
 371 static auth_cfg_t* get_auth_cfg(private_ike_sa_t *this, bool local)
 372 {
 373         if (local)
 374         {
 375                 return this->my_auth;
 376         }
 377         return this->other_auth;
 378 }
 379
 380 /**
 381  * Implementation of ike_sa_t.get_proposal
 382  */
 383 static proposal_t* get_proposal(private_ike_sa_t *this)
 384 {
 385         return this->proposal;
 386 }
 387
 388 /**
 389  * Implementation of ike_sa_t.set_proposal
 390  */
 391 static void set_proposal(private_ike_sa_t *this, proposal_t *proposal)
 392 {
 393         DESTROY_IF(this->proposal);
 394         this->proposal = proposal->clone(proposal);
 395 }
 396
 397 /**
 398  * Implementation of ike_sa_t.set_message_id
 399  */
 400 static void set_message_id(private_ike_sa_t *this, bool initiate, u_int32_t mid)
 401 {
 402         if (initiate)
 403         {
 404                 this->task_manager->reset(this->task_manager, mid, UINT_MAX);
 405         }
 406         else
 407         {
 408                 this->task_manager->reset(this->task_manager, UINT_MAX, mid);
 409         }
 410 }
 411
 412 /**
 413  * Implementation of ike_sa_t.send_keepalive
 414  */
 415 static void send_keepalive(private_ike_sa_t *this)
 416 {
 417         send_keepalive_job_t *job;
 418         time_t last_out, now, diff;
 419
 420         if (!(this->conditions & COND_NAT_HERE) || this->keepalive_interval == 0)
 421         {       /* disable keep alives if we are not NATed anymore */
 422                 return;
 423         }
 424
 425         last_out = get_use_time(this, FALSE);
 426         now = time_monotonic(NULL);
 427
 428         diff = now - last_out;
 429
 430         if (diff >= this->keepalive_interval)
 431         {
 432                 packet_t *packet;
 433                 chunk_t data;
 434
 435                 packet = packet_create();
 436                 packet->set_source(packet, this->my_host->clone(this->my_host));
 437                 packet->set_destination(packet, this->other_host->clone(this->other_host));
 438                 data.ptr = malloc(1);
 439                 data.ptr[0] = 0xFF;
 440                 data.len = 1;
 441                 packet->set_data(packet, data);
 442                 DBG1(DBG_IKE, "sending keep alive");
 443                 charon->sender->send(charon->sender, packet);
 444                 diff = 0;
 445         }
 446         job = send_keepalive_job_create(this->ike_sa_id);
 447         charon->scheduler->schedule_job(charon->scheduler, (job_t*)job,
 448                                                                         this->keepalive_interval - diff);
 449 }
 450
 451 /**
 452  * Implementation of ike_sa_t.get_ike_cfg
 453  */
 454 static ike_cfg_t *get_ike_cfg(private_ike_sa_t *this)
 455 {
 456         return this->ike_cfg;
 457 }
 458
 459 /**
 460  * Implementation of ike_sa_t.set_ike_cfg
 461  */
 462 static void set_ike_cfg(private_ike_sa_t *this, ike_cfg_t *ike_cfg)
 463 {
 464         ike_cfg->get_ref(ike_cfg);
 465         this->ike_cfg = ike_cfg;
 466 }
 467
 468 /**
 469  * Implementation of ike_sa_t.enable_extension.
 470  */
 471 static void enable_extension(private_ike_sa_t *this, ike_extension_t extension)
 472 {
 473         this->extensions |= extension;
 474 }
 475
 476 /**
 477  * Implementation of ike_sa_t.has_extension.
 478  */
 479 static bool supports_extension(private_ike_sa_t *this, ike_extension_t extension)
 480 {
 481         return (this->extensions & extension) != FALSE;
 482 }
 483
 484 /**
 485  * Implementation of ike_sa_t.has_condition.
 486  */
 487 static bool has_condition(private_ike_sa_t *this, ike_condition_t condition)
 488 {
 489         return (this->conditions & condition) != FALSE;
 490 }
 491
 492 /**
 493  * Implementation of ike_sa_t.enable_condition.
 494  */
 495 static void set_condition(private_ike_sa_t *this, ike_condition_t condition,
 496                                                   bool enable)
 497 {
 498         if (has_condition(this, condition) != enable)
 499         {
 500                 if (enable)
 501                 {
 502                         this->conditions |= condition;
 503                         switch (condition)
 504                         {
 505                                 case COND_NAT_HERE:
 506                                         DBG1(DBG_IKE, "local host is behind NAT, sending keep alives");
 507                                         this->conditions |= COND_NAT_ANY;
 508                                         send_keepalive(this);
 509                                         break;
 510                                 case COND_NAT_THERE:
 511                                         DBG1(DBG_IKE, "remote host is behind NAT");
 512                                         this->conditions |= COND_NAT_ANY;
 513                                         break;
 514                                 case COND_NAT_FAKE:
 515                                         DBG1(DBG_IKE, "faking NAT situation to enforce UDP encapsulation");
 516                                         this->conditions |= COND_NAT_ANY;
 517                                         break;
 518                                 default:
 519                                         break;
 520                         }
 521                 }
 522                 else
 523                 {
 524                         this->conditions &= ~condition;
 525                         switch (condition)
 526                         {
 527                                 case COND_NAT_HERE:
 528                                 case COND_NAT_FAKE:
 529                                 case COND_NAT_THERE:
 530                                         set_condition(this, COND_NAT_ANY,
 531                                                                   has_condition(this, COND_NAT_HERE) ||
 532                                                                   has_condition(this, COND_NAT_THERE) ||
 533                                                                   has_condition(this, COND_NAT_FAKE));
 534                                         break;
 535                                 default:
 536                                         break;
 537                         }
 538                 }
 539         }
 540 }
 541
 542 /**
 543  * Implementation of ike_sa_t.send_dpd
 544  */
 545 static status_t send_dpd(private_ike_sa_t *this)
 546 {
 547         job_t *job;
 548         time_t diff, delay;
 549
 550         delay = this->peer_cfg->get_dpd(this->peer_cfg);
 551
 552         if (delay == 0)
 553         {
 554                 /* DPD disabled */
 555                 return SUCCESS;
 556         }
 557
 558         if (this->task_manager->busy(this->task_manager))
 559         {
 560                 /* an exchange is in the air, no need to start a DPD check */
 561                 diff = 0;
 562         }
 563         else
 564         {
 565                 /* check if there was any inbound traffic */
 566                 time_t last_in, now;
 567                 last_in = get_use_time(this, TRUE);
 568                 now = time_monotonic(NULL);
 569                 diff = now - last_in;
 570                 if (diff >= delay)
 571                 {
 572                         /* to long ago, initiate dead peer detection */
 573                         task_t *task;
 574                         ike_mobike_t *mobike;
 575
 576                         if (supports_extension(this, EXT_MOBIKE) &&
 577                                 has_condition(this, COND_NAT_HERE))
 578                         {
 579                                 /* use mobike enabled DPD to detect NAT mapping changes */
 580                                 mobike = ike_mobike_create(&this->public, TRUE);
 581                                 mobike->dpd(mobike);
 582                                 task = &mobike->task;
 583                         }
 584                         else
 585                         {
 586                                 task = (task_t*)ike_dpd_create(TRUE);
 587                         }
 588                         diff = 0;
 589                         DBG1(DBG_IKE, "sending DPD request");
 590
 591                         this->task_manager->queue_task(this->task_manager, task);
 592                         this->task_manager->initiate(this->task_manager);
 593                 }
 594         }
 595         /* recheck in "interval" seconds */
 596         job = (job_t*)send_dpd_job_create(this->ike_sa_id);
 597         charon->scheduler->schedule_job(charon->scheduler, job, delay - diff);
 598         return SUCCESS;
 599 }
 600
 601 /**
 602  * Implementation of ike_sa_t.get_state.
 603  */
 604 static ike_sa_state_t get_state(private_ike_sa_t *this)
 605 {
 606         return this->state;
 607 }
 608
 609 /**
 610  * Implementation of ike_sa_t.set_state.
 611  */
 612 static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
 613 {
 614         DBG2(DBG_IKE, "IKE_SA %s[%d] state change: %N => %N",
 615                  get_name(this), this->unique_id,
 616                  ike_sa_state_names, this->state,
 617                  ike_sa_state_names, state);
 618
 619         switch (state)
 620         {
 621                 case IKE_ESTABLISHED:
 622                 {
 623                         if (this->state == IKE_CONNECTING ||
 624                                 this->state == IKE_PASSIVE)
 625                         {
 626                                 job_t *job;
 627                                 u_int32_t t;
 628
 629                                 /* calculate rekey, reauth and lifetime */
 630                                 this->stats[STAT_ESTABLISHED] = time_monotonic(NULL);
 631
 632                                 /* schedule rekeying if we have a time which is smaller than
 633                                  * an already scheduled rekeying */
 634                                 t = this->peer_cfg->get_rekey_time(this->peer_cfg);
 635                                 if (t && (this->stats[STAT_REKEY] == 0 ||
 636                                         (this->stats[STAT_REKEY] > t + this->stats[STAT_ESTABLISHED])))
 637                                 {
 638                                         this->stats[STAT_REKEY] = t + this->stats[STAT_ESTABLISHED];
 639                                         job = (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, FALSE);
 640                                         charon->scheduler->schedule_job(charon->scheduler, job, t);
 641                                         DBG1(DBG_IKE, "scheduling rekeying in %ds", t);
 642                                 }
 643                                 t = this->peer_cfg->get_reauth_time(this->peer_cfg);
 644                                 if (t && (this->stats[STAT_REAUTH] == 0 ||
 645                                         (this->stats[STAT_REAUTH] > t + this->stats[STAT_ESTABLISHED])))
 646                                 {
 647                                         this->stats[STAT_REAUTH] = t + this->stats[STAT_ESTABLISHED];
 648                                         job = (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE);
 649                                         charon->scheduler->schedule_job(charon->scheduler, job, t);
 650                                         DBG1(DBG_IKE, "scheduling reauthentication in %ds", t);
 651                                 }
 652                                 t = this->peer_cfg->get_over_time(this->peer_cfg);
 653                                 if (this->stats[STAT_REKEY] || this->stats[STAT_REAUTH])
 654                                 {
 655                                         if (this->stats[STAT_REAUTH] == 0)
 656                                         {
 657                                                 this->stats[STAT_DELETE] = this->stats[STAT_REKEY];
 658                                         }
 659                                         else if (this->stats[STAT_REKEY] == 0)
 660                                         {
 661                                                 this->stats[STAT_DELETE] = this->stats[STAT_REAUTH];
 662                                         }
 663                                         else
 664                                         {
 665                                                 this->stats[STAT_DELETE] = min(this->stats[STAT_REKEY],
 666                                                                                                            this->stats[STAT_REAUTH]);
 667                                         }
 668                                         this->stats[STAT_DELETE] += t;
 669                                         t = this->stats[STAT_DELETE] - this->stats[STAT_ESTABLISHED];
 670                                         job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE);
 671                                         charon->scheduler->schedule_job(charon->scheduler, job, t);
 672                                         DBG1(DBG_IKE, "maximum IKE_SA lifetime %ds", t);
 673                                 }
 674
 675                                 /* start DPD checks */
 676                                 send_dpd(this);
 677                         }
 678                         break;
 679                 }
 680                 case IKE_DELETING:
 681                 {
 682                         /* delete may fail if a packet gets lost, so set a timeout */
 683                         job_t *job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE);
 684                         charon->scheduler->schedule_job(charon->scheduler, job,
 685                                                                                         HALF_OPEN_IKE_SA_TIMEOUT);
 686                         break;
 687                 }
 688                 default:
 689                         break;
 690         }
 691         charon->bus->ike_state_change(charon->bus, &this->public, state);
 692         this->state = state;
 693 }
 694
 695 /**
 696  * Implementation of ike_sa_t.reset
 697  */
 698 static void reset(private_ike_sa_t *this)
 699 {
 700         /*  the responder ID is reset, as peer may choose another one */
 701         if (this->ike_sa_id->is_initiator(this->ike_sa_id))
 702         {
 703                 this->ike_sa_id->set_responder_spi(this->ike_sa_id, 0);
 704         }
 705
 706         set_state(this, IKE_CREATED);
 707
 708         this->task_manager->reset(this->task_manager, 0, 0);
 709 }
 710
 711 /**
 712  * Implementation of ike_sa_t.get_keymat
 713  */
 714 static keymat_t* get_keymat(private_ike_sa_t *this)
 715 {
 716         return this->keymat;
 717 }
 718
 719 /**
 720  * Implementation of ike_sa_t.set_virtual_ip
 721  */
 722 static void set_virtual_ip(private_ike_sa_t *this, bool local, host_t *ip)
 723 {
 724         if (local)
 725         {
 726                 DBG1(DBG_IKE, "installing new virtual IP %H", ip);
 727                 if (charon->kernel_interface->add_ip(charon->kernel_interface, ip,
 728                                                                                          this->my_host) == SUCCESS)
 729                 {
 730                         if (this->my_virtual_ip)
 731                         {
 732                                 DBG1(DBG_IKE, "removing old virtual IP %H", this->my_virtual_ip);
 733                                 charon->kernel_interface->del_ip(charon->kernel_interface,
 734                                                                                                  this->my_virtual_ip);
 735                         }
 736                         DESTROY_IF(this->my_virtual_ip);
 737                         this->my_virtual_ip = ip->clone(ip);
 738                 }
 739                 else
 740                 {
 741                         DBG1(DBG_IKE, "installing virtual IP %H failed", ip);
 742                         this->my_virtual_ip = NULL;
 743                 }
 744         }
 745         else
 746         {
 747                 DESTROY_IF(this->other_virtual_ip);
 748                 this->other_virtual_ip = ip->clone(ip);
 749         }
 750 }
 751
 752 /**
 753  * Implementation of ike_sa_t.get_virtual_ip
 754  */
 755 static host_t* get_virtual_ip(private_ike_sa_t *this, bool local)
 756 {
 757         if (local)
 758         {
 759                 return this->my_virtual_ip;
 760         }
 761         else
 762         {
 763                 return this->other_virtual_ip;
 764         }
 765 }
 766
 767 /**
 768  * Implementation of ike_sa_t.add_additional_address.
 769  */
 770 static void add_additional_address(private_ike_sa_t *this, host_t *host)
 771 {
 772         this->additional_addresses->insert_last(this->additional_addresses, host);
 773 }
 774
 775 /**
 776  * Implementation of ike_sa_t.create_additional_address_iterator.
 777  */
 778 static iterator_t* create_additional_address_iterator(private_ike_sa_t *this)
 779 {
 780         return this->additional_addresses->create_iterator(
 781                                                                                         this->additional_addresses, TRUE);
 782 }
 783
 784 /**
 785  * Implementation of ike_sa_t.has_mapping_changed
 786  */
 787 static bool has_mapping_changed(private_ike_sa_t *this, chunk_t hash)
 788 {
 789         if (this->nat_detection_dest.ptr == NULL)
 790         {
 791                 this->nat_detection_dest = chunk_clone(hash);
 792                 return FALSE;
 793         }
 794         if (chunk_equals(hash, this->nat_detection_dest))
 795         {
 796                 return FALSE;
 797         }
 798         free(this->nat_detection_dest.ptr);
 799         this->nat_detection_dest = chunk_clone(hash);
 800         return TRUE;
 801 }
 802
 803 /**
 804  * Implementation of ike_sa_t.set_pending_updates.
 805  */
 806 static void set_pending_updates(private_ike_sa_t *this, u_int32_t updates)
 807 {
 808         this->pending_updates = updates;
 809 }
 810
 811 /**
 812  * Implementation of ike_sa_t.get_pending_updates.
 813  */
 814 static u_int32_t get_pending_updates(private_ike_sa_t *this)
 815 {
 816         return this->pending_updates;
 817 }
 818
 819 /**
 820  * Update hosts, as addresses may change (NAT)
 821  */
 822 static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
 823 {
 824         bool update = FALSE;
 825
 826         if (me == NULL)
 827         {
 828                 me = this->my_host;
 829         }
 830         if (other == NULL)
 831         {
 832                 other = this->other_host;
 833         }
 834
 835         /* apply hosts on first received message */
 836         if (this->my_host->is_anyaddr(this->my_host) ||
 837                 this->other_host->is_anyaddr(this->other_host))
 838         {
 839                 set_my_host(this, me->clone(me));
 840                 set_other_host(this, other->clone(other));
 841                 update = TRUE;
 842         }
 843         else
 844         {
 845                 /* update our address in any case */
 846                 if (!me->equals(me, this->my_host))
 847                 {
 848                         set_my_host(this, me->clone(me));
 849                         update = TRUE;
 850                 }
 851
 852                 if (!other->equals(other, this->other_host))
 853                 {
 854                         /* update others adress if we are NOT NATed,
 855                          * and allow port changes if we are NATed */
 856                         if (!has_condition(this, COND_NAT_HERE) ||
 857                                 other->ip_equals(other, this->other_host))
 858                         {
 859                                 set_other_host(this, other->clone(other));
 860                                 update = TRUE;
 861                         }
 862                 }
 863         }
 864
 865         /* update all associated CHILD_SAs, if required */
 866         if (update)
 867         {
 868                 iterator_t *iterator;
 869                 child_sa_t *child_sa;
 870
 871                 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
 872                 while (iterator->iterate(iterator, (void**)&child_sa))
 873                 {
 874                         if (child_sa->update(child_sa, this->my_host,
 875                                                 this->other_host, this->my_virtual_ip,
 876                                                 has_condition(this, COND_NAT_ANY)) == NOT_SUPPORTED)
 877                         {
 878                                 this->public.rekey_child_sa(&this->public,
 879                                                 child_sa->get_protocol(child_sa),
 880                                                 child_sa->get_spi(child_sa, TRUE));
 881                         }
 882                 }
 883                 iterator->destroy(iterator);
 884         }
 885 }
 886
 887 /**
 888  * Implementation of ike_sa_t.generate
 889  */
 890 static status_t generate_message(private_ike_sa_t *this, message_t *message,
 891                                                                  packet_t **packet)
 892 {
 893         this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
 894         message->set_ike_sa_id(message, this->ike_sa_id);
 895         return message->generate(message,
 896                                 this->keymat->get_crypter(this->keymat, FALSE),
 897                                 this->keymat->get_signer(this->keymat, FALSE), packet);
 898 }
 899
 900 /**
 901  * send a notify back to the sender
 902  */
 903 static void send_notify_response(private_ike_sa_t *this, message_t *request,
 904                                                                  notify_type_t type)
 905 {
 906         message_t *response;
 907         packet_t *packet;
 908
 909         response = message_create();
 910         response->set_exchange_type(response, request->get_exchange_type(request));
 911         response->set_request(response, FALSE);
 912         response->set_message_id(response, request->get_message_id(request));
 913         response->add_notify(response, FALSE, type, chunk_empty);
 914         if (this->my_host->is_anyaddr(this->my_host))
 915         {
 916                 this->my_host->destroy(this->my_host);
 917                 this->my_host = request->get_destination(request);
 918                 this->my_host = this->my_host->clone(this->my_host);
 919         }
 920         if (this->other_host->is_anyaddr(this->other_host))
 921         {
 922                 this->other_host->destroy(this->other_host);
 923                 this->other_host = request->get_source(request);
 924                 this->other_host = this->other_host->clone(this->other_host);
 925         }
 926         response->set_source(response, this->my_host->clone(this->my_host));
 927         response->set_destination(response, this->other_host->clone(this->other_host));
 928         if (generate_message(this, response, &packet) == SUCCESS)
 929         {
 930                 charon->sender->send(charon->sender, packet);
 931         }
 932         response->destroy(response);
 933 }
 934
 935 /**
 936  * Implementation of ike_sa_t.set_kmaddress.
 937  */
 938 static void set_kmaddress(private_ike_sa_t *this, host_t *local, host_t *remote)
 939 {
 940         DESTROY_IF(this->local_host);
 941         DESTROY_IF(this->remote_host);
 942         this->local_host = local->clone(local);
 943         this->remote_host = remote->clone(remote);
 944 }
 945
 946 #ifdef ME
 947 /**
 948  * Implementation of ike_sa_t.act_as_mediation_server.
 949  */
 950 static void act_as_mediation_server(private_ike_sa_t *this)
 951 {
 952         charon->mediation_manager->update_sa_id(charon->mediation_manager,
 953                         this->other_id, this->ike_sa_id);
 954         this->is_mediation_server = TRUE;
 955 }
 956
 957 /**
 958  * Implementation of ike_sa_t.get_server_reflexive_host.
 959  */
 960 static host_t *get_server_reflexive_host(private_ike_sa_t *this)
 961 {
 962         return this->server_reflexive_host;
 963 }
 964
 965 /**
 966  * Implementation of ike_sa_t.set_server_reflexive_host.
 967  */
 968 static void set_server_reflexive_host(private_ike_sa_t *this, host_t *host)
 969 {
 970         DESTROY_IF(this->server_reflexive_host);
 971         this->server_reflexive_host = host;
 972 }
 973
 974 /**
 975  * Implementation of ike_sa_t.get_connect_id.
 976  */
 977 static chunk_t get_connect_id(private_ike_sa_t *this)
 978 {
 979         return this->connect_id;
 980 }
 981
 982 /**
 983  * Implementation of ike_sa_t.respond
 984  */
 985 static status_t respond(private_ike_sa_t *this, identification_t *peer_id,
 986                                                 chunk_t connect_id)
 987 {
 988         ike_me_t *task = ike_me_create(&this->public, TRUE);
 989         task->respond(task, peer_id, connect_id);
 990         this->task_manager->queue_task(this->task_manager, (task_t*)task);
 991         return this->task_manager->initiate(this->task_manager);
 992 }
 993
 994 /**
 995  * Implementation of ike_sa_t.callback
 996  */
 997 static status_t callback(private_ike_sa_t *this, identification_t *peer_id)
 998 {
 999         ike_me_t *task = ike_me_create(&this->public, TRUE);
1000         task->callback(task, peer_id);
1001         this->task_manager->queue_task(this->task_manager, (task_t*)task);
1002         return this->task_manager->initiate(this->task_manager);
1003 }
1004
1005 /**
1006  * Implementation of ike_sa_t.relay
1007  */
1008 static status_t relay(private_ike_sa_t *this, identification_t *requester,
1009                                           chunk_t connect_id, chunk_t connect_key,
1010                                           linked_list_t *endpoints, bool response)
1011 {
1012         ike_me_t *task = ike_me_create(&this->public, TRUE);
1013         task->relay(task, requester, connect_id, connect_key, endpoints, response);
1014         this->task_manager->queue_task(this->task_manager, (task_t*)task);
1015         return this->task_manager->initiate(this->task_manager);
1016 }
1017
1018 /**
1019  * Implementation of ike_sa_t.initiate_mediation
1020  */
1021 static status_t initiate_mediation(private_ike_sa_t *this,
1022                                                                    peer_cfg_t *mediated_cfg)
1023 {
1024         ike_me_t *task = ike_me_create(&this->public, TRUE);
1025         task->connect(task, mediated_cfg->get_peer_id(mediated_cfg));
1026         this->task_manager->queue_task(this->task_manager, (task_t*)task);
1027         return this->task_manager->initiate(this->task_manager);
1028 }
1029
1030 /**
1031  * Implementation of ike_sa_t.initiate_mediated
1032  */
1033 static status_t initiate_mediated(private_ike_sa_t *this, host_t *me,
1034                                                                   host_t *other, chunk_t connect_id)
1035 {
1036         set_my_host(this, me->clone(me));
1037         set_other_host(this, other->clone(other));
1038         chunk_free(&this->connect_id);
1039         this->connect_id = chunk_clone(connect_id);
1040         return this->task_manager->initiate(this->task_manager);
1041 }
1042 #endif /* ME */
1043
1044 /**
1045  * Resolve DNS host in configuration
1046  */
1047 static void resolve_hosts(private_ike_sa_t *this)
1048 {
1049         host_t *host;
1050
1051         if (this->remote_host)
1052         {
1053                 host = this->remote_host->clone(this->remote_host);
1054                 host->set_port(host, IKEV2_UDP_PORT);
1055         }
1056         else
1057         {
1058                 host = host_create_from_dns(this->ike_cfg->get_other_addr(this->ike_cfg),
1059                                                                         0, IKEV2_UDP_PORT);
1060         }
1061         if (host)
1062         {
1063                 set_other_host(this, host);
1064         }
1065
1066         if (this->local_host)
1067         {
1068                 host = this->local_host->clone(this->local_host);
1069                 host->set_port(host, IKEV2_UDP_PORT);
1070         }
1071         else
1072         {
1073                 int family = 0;
1074
1075                 /* use same address family as for other */
1076                 if (!this->other_host->is_anyaddr(this->other_host))
1077                 {
1078                         family = this->other_host->get_family(this->other_host);
1079                 }
1080                 host = host_create_from_dns(this->ike_cfg->get_my_addr(this->ike_cfg),
1081                                                                         family, IKEV2_UDP_PORT);
1082
1083                 if (host && host->is_anyaddr(host) &&
1084                         !this->other_host->is_anyaddr(this->other_host))
1085                 {
1086                         host->destroy(host);
1087                         host = charon->kernel_interface->get_source_addr(
1088                                                         charon->kernel_interface, this->other_host, NULL);
1089                         if (host)
1090                         {
1091                                 host->set_port(host, IKEV2_UDP_PORT);
1092                         }
1093                         else
1094                         {       /* fallback to address family specific %any(6), if configured */
1095                                 host = host_create_from_dns(
1096                                                                         this->ike_cfg->get_my_addr(this->ike_cfg),
1097                                                                         0, IKEV2_UDP_PORT);
1098                         }
1099                 }
1100         }
1101         if (host)
1102         {
1103                 set_my_host(this, host);
1104         }
1105 }
1106
1107 /**
1108  * Implementation of ike_sa_t.initiate
1109  */
1110 static status_t initiate(private_ike_sa_t *this,
1111                                                  child_cfg_t *child_cfg, u_int32_t reqid,
1112                                                  traffic_selector_t *tsi, traffic_selector_t *tsr)
1113 {
1114         task_t *task;
1115
1116         if (this->state == IKE_CREATED)
1117         {
1118                 resolve_hosts(this);
1119
1120                 if (this->other_host->is_anyaddr(this->other_host)
1121 #ifdef ME
1122                         && !this->peer_cfg->get_mediated_by(this->peer_cfg)
1123 #endif /* ME */
1124                         )
1125                 {
1126                         child_cfg->destroy(child_cfg);
1127                         DBG1(DBG_IKE, "unable to initiate to %%any");
1128                         return DESTROY_ME;
1129                 }
1130
1131                 set_condition(this, COND_ORIGINAL_INITIATOR, TRUE);
1132
1133                 task = (task_t*)ike_init_create(&this->public, TRUE, NULL);
1134                 this->task_manager->queue_task(this->task_manager, task);
1135                 task = (task_t*)ike_natd_create(&this->public, TRUE);
1136                 this->task_manager->queue_task(this->task_manager, task);
1137                 task = (task_t*)ike_cert_pre_create(&this->public, TRUE);
1138                 this->task_manager->queue_task(this->task_manager, task);
1139                 task = (task_t*)ike_auth_create(&this->public, TRUE);
1140                 this->task_manager->queue_task(this->task_manager, task);
1141                 task = (task_t*)ike_cert_post_create(&this->public, TRUE);
1142                 this->task_manager->queue_task(this->task_manager, task);
1143                 task = (task_t*)ike_config_create(&this->public, TRUE);
1144                 this->task_manager->queue_task(this->task_manager, task);
1145                 task = (task_t*)ike_auth_lifetime_create(&this->public, TRUE);
1146                 this->task_manager->queue_task(this->task_manager, task);
1147                 if (this->peer_cfg->use_mobike(this->peer_cfg))
1148                 {
1149                         task = (task_t*)ike_mobike_create(&this->public, TRUE);
1150                         this->task_manager->queue_task(this->task_manager, task);
1151                 }
1152 #ifdef ME
1153                 task = (task_t*)ike_me_create(&this->public, TRUE);
1154                 this->task_manager->queue_task(this->task_manager, task);
1155 #endif /* ME */
1156         }
1157
1158 #ifdef ME
1159         if (this->peer_cfg->is_mediation(this->peer_cfg))
1160         {
1161                 if (this->state == IKE_ESTABLISHED)
1162                 {
1163                         /* mediation connection is already established, retrigger state
1164                          * change to notify bus listeners */
1165                         DBG1(DBG_IKE, "mediation connection is already up");
1166                         set_state(this, IKE_ESTABLISHED);
1167                 }
1168                 DESTROY_IF(child_cfg);
1169         }
1170         else
1171 #endif /* ME */
1172         {
1173                 /* normal IKE_SA with CHILD_SA */
1174                 task = (task_t*)child_create_create(&this->public, child_cfg, FALSE,
1175                                                                                         tsi, tsr);
1176                 child_cfg->destroy(child_cfg);
1177                 if (reqid)
1178                 {
1179                         child_create_t *child_create = (child_create_t*)task;
1180                         child_create->use_reqid(child_create, reqid);
1181                 }
1182                 this->task_manager->queue_task(this->task_manager, task);
1183
1184 #ifdef ME
1185                 if (this->peer_cfg->get_mediated_by(this->peer_cfg))
1186                 {
1187                         /* mediated connection, initiate mediation process */
1188                         job_t *job = (job_t*)initiate_mediation_job_create(this->ike_sa_id);
1189                         charon->processor->queue_job(charon->processor, job);
1190                         return SUCCESS;
1191                 }
1192 #endif /* ME */
1193         }
1194
1195         return this->task_manager->initiate(this->task_manager);
1196 }
1197
1198 /**
1199  * Implementation of ike_sa_t.process_message.
1200  */
1201 static status_t process_message(private_ike_sa_t *this, message_t *message)
1202 {
1203         status_t status;
1204         bool is_request;
1205
1206         if (this->state == IKE_PASSIVE)
1207         {       /* do not handle messages in passive state */
1208                 return FAILED;
1209         }
1210
1211         is_request = message->get_request(message);
1212
1213         status = message->parse_body(message,
1214                                                                  this->keymat->get_crypter(this->keymat, TRUE),
1215                                                                  this->keymat->get_signer(this->keymat, TRUE));
1216         if (status != SUCCESS)
1217         {
1218
1219                 if (is_request)
1220                 {
1221                         switch (status)
1222                         {
1223                                 case NOT_SUPPORTED:
1224                                         DBG1(DBG_IKE, "critical unknown payloads found");
1225                                         if (is_request)
1226                                         {
1227                                                 send_notify_response(this, message, UNSUPPORTED_CRITICAL_PAYLOAD);
1228                                         }
1229                                         break;
1230                                 case PARSE_ERROR:
1231                                         DBG1(DBG_IKE, "message parsing failed");
1232                                         if (is_request)
1233                                         {
1234                                                 send_notify_response(this, message, INVALID_SYNTAX);
1235                                         }
1236                                         break;
1237                                 case VERIFY_ERROR:
1238                                         DBG1(DBG_IKE, "message verification failed");
1239                                         if (is_request)
1240                                         {
1241                                                 send_notify_response(this, message, INVALID_SYNTAX);
1242                                         }
1243                                         break;
1244                                 case FAILED:
1245                                         DBG1(DBG_IKE, "integrity check failed");
1246                                         /* ignored */
1247                                         break;
1248                                 case INVALID_STATE:
1249                                         DBG1(DBG_IKE, "found encrypted message, but no keys available");
1250                                         if (is_request)
1251                                         {
1252                                                 send_notify_response(this, message, INVALID_SYNTAX);
1253                                         }
1254                                 default:
1255                                         break;
1256                         }
1257                 }
1258                 DBG1(DBG_IKE, "%N %s with message ID %d processing failed",
1259                          exchange_type_names, message->get_exchange_type(message),
1260                          message->get_request(message) ? "request" : "response",
1261                          message->get_message_id(message));
1262
1263                 if (this->state == IKE_CREATED)
1264                 {       /* invalid initiation attempt, close SA */
1265                         return DESTROY_ME;
1266                 }
1267                 return status;
1268         }
1269         else
1270         {
1271                 host_t *me, *other;
1272
1273                 me = message->get_destination(message);
1274                 other = message->get_source(message);
1275
1276                 /* if this IKE_SA is virgin, we check for a config */
1277                 if (this->ike_cfg == NULL)
1278                 {
1279                         job_t *job;
1280                         this->ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1281                                                                                                                   me, other);
1282                         if (this->ike_cfg == NULL)
1283                         {
1284                                 /* no config found for these hosts, destroy */
1285                                 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1286                                          me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1287                                 send_notify_response(this, message, NO_PROPOSAL_CHOSEN);
1288                                 return DESTROY_ME;
1289                         }
1290                         /* add a timeout if peer does not establish it completely */
1291                         job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, FALSE);
1292                         charon->scheduler->schedule_job(charon->scheduler, job,
1293                                                                                         HALF_OPEN_IKE_SA_TIMEOUT);
1294                 }
1295                 this->stats[STAT_INBOUND] = time_monotonic(NULL);
1296                 /* check if message is trustworthy, and update host information */
1297                 if (this->state == IKE_CREATED || this->state == IKE_CONNECTING ||
1298                         message->get_exchange_type(message) != IKE_SA_INIT)
1299                 {
1300                         if (!supports_extension(this, EXT_MOBIKE))
1301                         {       /* with MOBIKE, we do no implicit updates */
1302                                 update_hosts(this, me, other);
1303                         }
1304                 }
1305                 return this->task_manager->process_message(this->task_manager, message);
1306         }
1307 }
1308
1309 /**
1310  * Implementation of ike_sa_t.get_id.
1311  */
1312 static ike_sa_id_t* get_id(private_ike_sa_t *this)
1313 {
1314         return this->ike_sa_id;
1315 }
1316
1317 /**
1318  * Implementation of ike_sa_t.get_my_id.
1319  */
1320 static identification_t* get_my_id(private_ike_sa_t *this)
1321 {
1322         return this->my_id;
1323 }
1324
1325 /**
1326  * Implementation of ike_sa_t.set_my_id.
1327  */
1328 static void set_my_id(private_ike_sa_t *this, identification_t *me)
1329 {
1330         DESTROY_IF(this->my_id);
1331         this->my_id = me;
1332 }
1333
1334 /**
1335  * Implementation of ike_sa_t.get_other_id.
1336  */
1337 static identification_t* get_other_id(private_ike_sa_t *this)
1338 {
1339         return this->other_id;
1340 }
1341
1342 /**
1343  * Implementation of ike_sa_t.set_other_id.
1344  */
1345 static void set_other_id(private_ike_sa_t *this, identification_t *other)
1346 {
1347         DESTROY_IF(this->other_id);
1348         this->other_id = other;
1349 }
1350
1351 /**
1352  * Implementation of ike_sa_t.add_child_sa.
1353  */
1354 static void add_child_sa(private_ike_sa_t *this, child_sa_t *child_sa)
1355 {
1356         this->child_sas->insert_last(this->child_sas, child_sa);
1357 }
1358
1359 /**
1360  * Implementation of ike_sa_t.get_child_sa.
1361  */
1362 static child_sa_t* get_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
1363                                                                 u_int32_t spi, bool inbound)
1364 {
1365         iterator_t *iterator;
1366         child_sa_t *current, *found = NULL;
1367
1368         iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1369         while (iterator->iterate(iterator, (void**)&current))
1370         {
1371                 if (current->get_spi(current, inbound) == spi &&
1372                         current->get_protocol(current) == protocol)
1373                 {
1374                         found = current;
1375                 }
1376         }
1377         iterator->destroy(iterator);
1378         return found;
1379 }
1380
1381 /**
1382  * Implementation of ike_sa_t.create_child_sa_iterator.
1383  */
1384 static iterator_t* create_child_sa_iterator(private_ike_sa_t *this)
1385 {
1386         return this->child_sas->create_iterator(this->child_sas, TRUE);
1387 }
1388
1389 /**
1390  * Implementation of ike_sa_t.rekey_child_sa.
1391  */
1392 static status_t rekey_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
1393                                                            u_int32_t spi)
1394 {
1395         child_rekey_t *child_rekey;
1396
1397         child_rekey = child_rekey_create(&this->public, protocol, spi);
1398         this->task_manager->queue_task(this->task_manager, &child_rekey->task);
1399         return this->task_manager->initiate(this->task_manager);
1400 }
1401
1402 /**
1403  * Implementation of ike_sa_t.delete_child_sa.
1404  */
1405 static status_t delete_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
1406                                                                 u_int32_t spi)
1407 {
1408         child_delete_t *child_delete;
1409
1410         child_delete = child_delete_create(&this->public, protocol, spi);
1411         this->task_manager->queue_task(this->task_manager, &child_delete->task);
1412         return this->task_manager->initiate(this->task_manager);
1413 }
1414
1415 /**
1416  * Implementation of ike_sa_t.destroy_child_sa.
1417  */
1418 static status_t destroy_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
1419                                                                  u_int32_t spi)
1420 {
1421         iterator_t *iterator;
1422         child_sa_t *child_sa;
1423         status_t status = NOT_FOUND;
1424
1425         iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1426         while (iterator->iterate(iterator, (void**)&child_sa))
1427         {
1428                 if (child_sa->get_protocol(child_sa) == protocol &&
1429                         child_sa->get_spi(child_sa, TRUE) == spi)
1430                 {
1431                         child_sa->destroy(child_sa);
1432                         iterator->remove(iterator);
1433                         status = SUCCESS;
1434                         break;
1435                 }
1436         }
1437         iterator->destroy(iterator);
1438         return status;
1439 }
1440
1441 /**
1442  * Implementation of public_ike_sa_t.delete.
1443  */
1444 static status_t delete_(private_ike_sa_t *this)
1445 {
1446         ike_delete_t *ike_delete;
1447
1448         switch (this->state)
1449         {
1450                 case IKE_ESTABLISHED:
1451                 case IKE_REKEYING:
1452                         ike_delete = ike_delete_create(&this->public, TRUE);
1453                         this->task_manager->queue_task(this->task_manager, &ike_delete->task);
1454                         return this->task_manager->initiate(this->task_manager);
1455                 case IKE_CREATED:
1456                         DBG1(DBG_IKE, "deleting unestablished IKE_SA");
1457                         break;
1458                 case IKE_PASSIVE:
1459                         break;
1460                 default:
1461                         DBG1(DBG_IKE, "destroying IKE_SA in state %N "
1462                                 "without notification", ike_sa_state_names, this->state);
1463                         break;
1464         }
1465         return DESTROY_ME;
1466 }
1467
1468 /**
1469  * Implementation of ike_sa_t.rekey.
1470  */
1471 static status_t rekey(private_ike_sa_t *this)
1472 {
1473         ike_rekey_t *ike_rekey;
1474
1475         ike_rekey = ike_rekey_create(&this->public, TRUE);
1476
1477         this->task_manager->queue_task(this->task_manager, &ike_rekey->task);
1478         return this->task_manager->initiate(this->task_manager);
1479 }
1480
1481 /**
1482  * Implementation of ike_sa_t.reauth
1483  */
1484 static status_t reauth(private_ike_sa_t *this)
1485 {
1486         task_t *task;
1487
1488         /* we can't reauthenticate as responder when we use EAP or virtual IPs.
1489          * If the peer does not support RFC4478, there is no way to keep the
1490          * IKE_SA up. */
1491         if (!has_condition(this, COND_ORIGINAL_INITIATOR))
1492         {
1493                 DBG1(DBG_IKE, "initiator did not reauthenticate as requested");
1494                 if (this->other_virtual_ip != NULL ||
1495                         has_condition(this, COND_EAP_AUTHENTICATED)
1496 #ifdef ME
1497                         /* as mediation server we too cannot reauth the IKE_SA */
1498                         || this->is_mediation_server
1499 #endif /* ME */
1500                         )
1501                 {
1502                         time_t now = time_monotonic(NULL);
1503
1504                         DBG1(DBG_IKE, "IKE_SA will timeout in %V",
1505                                  &now, &this->stats[STAT_DELETE]);
1506                         return FAILED;
1507                 }
1508                 else
1509                 {
1510                         DBG1(DBG_IKE, "reauthenticating actively");
1511                 }
1512         }
1513         task = (task_t*)ike_reauth_create(&this->public);
1514         this->task_manager->queue_task(this->task_manager, task);
1515
1516         return this->task_manager->initiate(this->task_manager);
1517 }
1518
1519 /**
1520  * Implementation of ike_sa_t.reestablish
1521  */
1522 static status_t reestablish(private_ike_sa_t *this)
1523 {
1524         ike_sa_t *new;
1525         host_t *host;
1526         action_t action;
1527         iterator_t *iterator;
1528         child_sa_t *child_sa;
1529         child_cfg_t *child_cfg;
1530         bool restart = FALSE;
1531         status_t status = FAILED;
1532
1533         /* check if we have children to keep up at all */
1534         iterator = create_child_sa_iterator(this);
1535         while (iterator->iterate(iterator, (void**)&child_sa))
1536         {
1537                 child_cfg = child_sa->get_config(child_sa);
1538                 if (this->state == IKE_DELETING)
1539                 {
1540                         action = child_cfg->get_close_action(child_cfg);
1541                 }
1542                 else
1543                 {
1544                         action = child_cfg->get_dpd_action(child_cfg);
1545                 }
1546                 switch (action)
1547                 {
1548                         case ACTION_RESTART:
1549                                 restart = TRUE;
1550                                 break;
1551                         case ACTION_ROUTE:
1552                                 charon->traps->install(charon->traps, this->peer_cfg, child_cfg);
1553                                 break;
1554                         default:
1555                                 break;
1556                 }
1557         }
1558         iterator->destroy(iterator);
1559 #ifdef ME
1560         /* mediation connections have no children, keep them up anyway */
1561         if (this->peer_cfg->is_mediation(this->peer_cfg))
1562         {
1563                 restart = TRUE;
1564         }
1565 #endif /* ME */
1566         if (!restart)
1567         {
1568                 return FAILED;
1569         }
1570
1571         /* check if we are able to reestablish this IKE_SA */
1572         if (!has_condition(this, COND_ORIGINAL_INITIATOR) &&
1573                 (this->other_virtual_ip != NULL ||
1574                  has_condition(this, COND_EAP_AUTHENTICATED)
1575 #ifdef ME
1576                  || this->is_mediation_server
1577 #endif /* ME */
1578                 ))
1579         {
1580                 DBG1(DBG_IKE, "unable to reestablish IKE_SA due asymetric setup");
1581                 return FAILED;
1582         }
1583
1584         new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager, TRUE);
1585         new->set_peer_cfg(new, this->peer_cfg);
1586         host = this->other_host;
1587         new->set_other_host(new, host->clone(host));
1588         host = this->my_host;
1589         new->set_my_host(new, host->clone(host));
1590         /* if we already have a virtual IP, we reuse it */
1591         host = this->my_virtual_ip;
1592         if (host)
1593         {
1594                 new->set_virtual_ip(new, TRUE, host);
1595         }
1596
1597 #ifdef ME
1598         if (this->peer_cfg->is_mediation(this->peer_cfg))
1599         {
1600                 status = new->initiate(new, NULL, 0, NULL, NULL);
1601         }
1602         else
1603 #endif /* ME */
1604         {
1605                 iterator = create_child_sa_iterator(this);
1606                 while (iterator->iterate(iterator, (void**)&child_sa))
1607                 {
1608                         child_cfg = child_sa->get_config(child_sa);
1609                         if (this->state == IKE_DELETING)
1610                         {
1611                                 action = child_cfg->get_close_action(child_cfg);
1612                         }
1613                         else
1614                         {
1615                                 action = child_cfg->get_dpd_action(child_cfg);
1616                         }
1617                         switch (action)
1618                         {
1619                                 case ACTION_RESTART:
1620                                         DBG1(DBG_IKE, "restarting CHILD_SA %s",
1621                                                  child_cfg->get_name(child_cfg));
1622                                         child_cfg->get_ref(child_cfg);
1623                                         status = new->initiate(new, child_cfg, 0, NULL, NULL);
1624                                         break;
1625                                 default:
1626                                         continue;
1627                         }
1628                         if (status == DESTROY_ME)
1629                         {
1630                                 break;
1631                         }
1632                 }
1633                 iterator->destroy(iterator);
1634         }
1635
1636         if (status == DESTROY_ME)
1637         {
1638                 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1639                 status = FAILED;
1640         }
1641         else
1642         {
1643                 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1644                 status = SUCCESS;
1645         }
1646         charon->bus->set_sa(charon->bus, &this->public);
1647         return status;
1648 }
1649
1650 /**
1651  * Implementation of ike_sa_t.retransmit.
1652  */
1653 static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
1654 {
1655         this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
1656         if (this->task_manager->retransmit(this->task_manager, message_id) != SUCCESS)
1657         {
1658                 /* send a proper signal to brief interested bus listeners */
1659                 switch (this->state)
1660                 {
1661                         case IKE_CONNECTING:
1662                         {
1663                                 /* retry IKE_SA_INIT if we have multiple keyingtries */
1664                                 u_int32_t tries = this->peer_cfg->get_keyingtries(this->peer_cfg);
1665                                 this->keyingtry++;
1666                                 if (tries == 0 || tries > this->keyingtry)
1667                                 {
1668                                         DBG1(DBG_IKE, "peer not responding, trying again (%d/%d)",
1669                                                  this->keyingtry + 1, tries);
1670                                         reset(this);
1671                                         return this->task_manager->initiate(this->task_manager);
1672                                 }
1673                                 DBG1(DBG_IKE, "establishing IKE_SA failed, peer not responding");
1674                                 break;
1675                         }
1676                         case IKE_DELETING:
1677                                 DBG1(DBG_IKE, "proper IKE_SA delete failed, peer not responding");
1678                                 break;
1679                         case IKE_REKEYING:
1680                                 DBG1(DBG_IKE, "rekeying IKE_SA failed, peer not responding");
1681                                 /* FALL */
1682                         default:
1683                                 reestablish(this);
1684                                 break;
1685                 }
1686                 return DESTROY_ME;
1687         }
1688         return SUCCESS;
1689 }
1690
1691 /**
1692  * Implementation of ike_sa_t.set_auth_lifetime.
1693  */
1694 static void set_auth_lifetime(private_ike_sa_t *this, u_int32_t lifetime)
1695 {
1696         u_int32_t reduction = this->peer_cfg->get_over_time(this->peer_cfg);
1697         u_int32_t reauth_time = time_monotonic(NULL) + lifetime - reduction;
1698
1699         if (lifetime < reduction)
1700         {
1701                 DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, starting reauthentication",
1702                          lifetime);
1703                 charon->processor->queue_job(charon->processor,
1704                                         (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE));
1705         }
1706         else if (this->stats[STAT_REAUTH] == 0 ||
1707                          this->stats[STAT_REAUTH] > reauth_time)
1708         {
1709                 this->stats[STAT_REAUTH] = reauth_time;
1710                 DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, scheduling reauthentication"
1711                          " in %ds", lifetime, lifetime - reduction);
1712                 charon->scheduler->schedule_job(charon->scheduler,
1713                                                 (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE),
1714                                                 lifetime - reduction);
1715         }
1716         else
1717         {
1718                 DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, "
1719                          "reauthentication already scheduled in %ds", lifetime,
1720                          this->stats[STAT_REAUTH] - time_monotonic(NULL));
1721         }
1722 }
1723
1724 /**
1725  * Implementation of ike_sa_t.roam.
1726  */
1727 static status_t roam(private_ike_sa_t *this, bool address)
1728 {
1729         host_t *src;
1730         ike_mobike_t *mobike;
1731
1732         switch (this->state)
1733         {
1734                 case IKE_CREATED:
1735                 case IKE_DELETING:
1736                 case IKE_DESTROYING:
1737                 case IKE_PASSIVE:
1738                         return SUCCESS;
1739                 default:
1740                         break;
1741         }
1742         /* responder just updates the peer about changed address config */
1743         if (!this->ike_sa_id->is_initiator(this->ike_sa_id))
1744         {
1745                 if (supports_extension(this, EXT_MOBIKE) && address)
1746                 {
1747                         DBG1(DBG_IKE, "sending address list update using MOBIKE");
1748                         mobike = ike_mobike_create(&this->public, TRUE);
1749                         this->task_manager->queue_task(this->task_manager, (task_t*)mobike);
1750                         return this->task_manager->initiate(this->task_manager);
1751                 }
1752                 return SUCCESS;
1753         }
1754
1755         /* keep existing path if possible */
1756         src = charon->kernel_interface->get_source_addr(charon->kernel_interface,
1757                                                                                         this->other_host, this->my_host);
1758         if (src)
1759         {
1760                 if (src->ip_equals(src, this->my_host))
1761                 {
1762                         DBG2(DBG_IKE, "keeping connection path %H - %H",
1763                                  src, this->other_host);
1764                         src->destroy(src);
1765                         set_condition(this, COND_STALE, FALSE);
1766                         return SUCCESS;
1767                 }
1768                 src->destroy(src);
1769
1770         }
1771         else
1772         {
1773                 /* check if we find a route at all */
1774                 enumerator_t *enumerator;
1775                 host_t *addr;
1776
1777                 src = charon->kernel_interface->get_source_addr(charon->kernel_interface,
1778                                                                                                                 this->other_host, NULL);
1779                 if (!src)
1780                 {
1781                         enumerator = this->additional_addresses->create_enumerator(
1782                                                                                                         this->additional_addresses);
1783                         while (enumerator->enumerate(enumerator, &addr))
1784                         {
1785                                 DBG1(DBG_IKE, "looking for a route to %H ...", addr);
1786                                 src = charon->kernel_interface->get_source_addr(
1787                                                                                 charon->kernel_interface, addr, NULL);
1788                                 if (src)
1789                                 {
1790                                         break;
1791                                 }
1792                         }
1793                         enumerator->destroy(enumerator);
1794                 }
1795                 if (!src)
1796                 {
1797                         DBG1(DBG_IKE, "no route found to reach %H, MOBIKE update deferred",
1798                                  this->other_host);
1799                         set_condition(this, COND_STALE, TRUE);
1800                         return SUCCESS;
1801                 }
1802                 src->destroy(src);
1803         }
1804         set_condition(this, COND_STALE, FALSE);
1805
1806         /* update addresses with mobike, if supported ... */
1807         if (supports_extension(this, EXT_MOBIKE))
1808         {
1809                 DBG1(DBG_IKE, "requesting address change using MOBIKE");
1810                 mobike = ike_mobike_create(&this->public, TRUE);
1811                 mobike->roam(mobike, address);
1812                 this->task_manager->queue_task(this->task_manager, (task_t*)mobike);
1813                 return this->task_manager->initiate(this->task_manager);
1814         }
1815         DBG1(DBG_IKE, "reauthenticating IKE_SA due to address change");
1816         /* ... reauth if not */
1817         return reauth(this);
1818 }
1819
1820 /**
1821  * Implementation of ike_sa_t.add_configuration_attribute
1822  */
1823 static void add_configuration_attribute(private_ike_sa_t *this,
1824                                                         attribute_handler_t *handler,
1825                                                         configuration_attribute_type_t type, chunk_t data)
1826 {
1827         attribute_entry_t *entry = malloc_thing(attribute_entry_t);
1828
1829         entry->handler = handler;
1830         entry->type = type;
1831         entry->data = chunk_clone(data);
1832
1833         this->attributes->insert_last(this->attributes, entry);
1834 }
1835
1836 /**
1837  * Implementation of ike_sa_t.inherit.
1838  */
1839 static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
1840 {
1841         child_sa_t *child_sa;
1842         attribute_entry_t *entry;
1843
1844         /* apply hosts and ids */
1845         this->my_host->destroy(this->my_host);
1846         this->other_host->destroy(this->other_host);
1847         this->my_id->destroy(this->my_id);
1848         this->other_id->destroy(this->other_id);
1849         this->my_host = other->my_host->clone(other->my_host);
1850         this->other_host = other->other_host->clone(other->other_host);
1851         this->my_id = other->my_id->clone(other->my_id);
1852         this->other_id = other->other_id->clone(other->other_id);
1853
1854         /* apply virtual assigned IPs... */
1855         if (other->my_virtual_ip)
1856         {
1857                 this->my_virtual_ip = other->my_virtual_ip;
1858                 other->my_virtual_ip = NULL;
1859         }
1860         if (other->other_virtual_ip)
1861         {
1862                 this->other_virtual_ip = other->other_virtual_ip;
1863                 other->other_virtual_ip = NULL;
1864         }
1865
1866         /* ... and configuration attributes */
1867         while (other->attributes->remove_last(other->attributes,
1868                                                                                   (void**)&entry) == SUCCESS)
1869         {
1870                 this->attributes->insert_first(this->attributes, entry);
1871         }
1872
1873         /* inherit all conditions */
1874         this->conditions = other->conditions;
1875         if (this->conditions & COND_NAT_HERE)
1876         {
1877                 send_keepalive(this);
1878         }
1879
1880 #ifdef ME
1881         if (other->is_mediation_server)
1882         {
1883                 act_as_mediation_server(this);
1884         }
1885         else if (other->server_reflexive_host)
1886         {
1887                 this->server_reflexive_host = other->server_reflexive_host->clone(
1888                                 other->server_reflexive_host);
1889         }
1890 #endif /* ME */
1891
1892         /* adopt all children */
1893         while (other->child_sas->remove_last(other->child_sas,
1894                                                                                  (void**)&child_sa) == SUCCESS)
1895         {
1896                 this->child_sas->insert_first(this->child_sas, (void*)child_sa);
1897         }
1898
1899         /* move pending tasks to the new IKE_SA */
1900         this->task_manager->adopt_tasks(this->task_manager, other->task_manager);
1901
1902         /* reauthentication timeout survives a rekeying */
1903         if (other->stats[STAT_REAUTH])
1904         {
1905                 time_t reauth, delete, now = time_monotonic(NULL);
1906
1907                 this->stats[STAT_REAUTH] = other->stats[STAT_REAUTH];
1908                 reauth = this->stats[STAT_REAUTH] - now;
1909                 delete = reauth + this->peer_cfg->get_over_time(this->peer_cfg);
1910                 this->stats[STAT_DELETE] = this->stats[STAT_REAUTH] + delete;
1911                 DBG1(DBG_IKE, "rescheduling reauthentication in %ds after rekeying, "
1912                          "lifetime reduced to %ds", reauth, delete);
1913                 charon->scheduler->schedule_job(charon->scheduler,
1914                                 (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE), reauth);
1915                 charon->scheduler->schedule_job(charon->scheduler,
1916                                 (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE), delete);
1917         }
1918         /* we have to initate here, there may be new tasks to handle */
1919         return this->task_manager->initiate(this->task_manager);
1920 }
1921
1922 /**
1923  * Implementation of ike_sa_t.destroy.
1924  */
1925 static void destroy(private_ike_sa_t *this)
1926 {
1927         attribute_entry_t *entry;
1928
1929         charon->bus->set_sa(charon->bus, &this->public);
1930
1931         set_state(this, IKE_DESTROYING);
1932
1933         /* remove attributes first, as we pass the IKE_SA to the handler */
1934         while (this->attributes->remove_last(this->attributes,
1935                                                                                  (void**)&entry) == SUCCESS)
1936         {
1937                 lib->attributes->release(lib->attributes, entry->handler,
1938                                                                  this->other_id, entry->type, entry->data);
1939                 free(entry->data.ptr);
1940                 free(entry);
1941         }
1942         this->attributes->destroy(this->attributes);
1943
1944         this->child_sas->destroy_offset(this->child_sas, offsetof(child_sa_t, destroy));
1945
1946         /* unset SA after here to avoid usage by the listeners */
1947         charon->bus->set_sa(charon->bus, NULL);
1948
1949         this->task_manager->destroy(this->task_manager);
1950         this->keymat->destroy(this->keymat);
1951
1952         if (this->my_virtual_ip)
1953         {
1954                 charon->kernel_interface->del_ip(charon->kernel_interface,
1955                                                                                  this->my_virtual_ip);
1956                 this->my_virtual_ip->destroy(this->my_virtual_ip);
1957         }
1958         if (this->other_virtual_ip)
1959         {
1960                 if (this->peer_cfg && this->peer_cfg->get_pool(this->peer_cfg))
1961                 {
1962                         lib->attributes->release_address(lib->attributes,
1963                                                                         this->peer_cfg->get_pool(this->peer_cfg),
1964                                                                         this->other_virtual_ip, this->other_id);
1965                 }
1966                 this->other_virtual_ip->destroy(this->other_virtual_ip);
1967         }
1968         this->additional_addresses->destroy_offset(this->additional_addresses,
1969                                                                                                         offsetof(host_t, destroy));
1970 #ifdef ME
1971         if (this->is_mediation_server)
1972         {
1973                 charon->mediation_manager->remove(charon->mediation_manager,
1974                                                                                   this->ike_sa_id);
1975         }
1976         DESTROY_IF(this->server_reflexive_host);
1977         chunk_free(&this->connect_id);
1978 #endif /* ME */
1979         free(this->nat_detection_dest.ptr);
1980
1981         DESTROY_IF(this->my_host);
1982         DESTROY_IF(this->other_host);
1983         DESTROY_IF(this->my_id);
1984         DESTROY_IF(this->other_id);
1985         DESTROY_IF(this->local_host);
1986         DESTROY_IF(this->remote_host);
1987
1988         DESTROY_IF(this->ike_cfg);
1989         DESTROY_IF(this->peer_cfg);
1990         DESTROY_IF(this->proposal);
1991         this->my_auth->destroy(this->my_auth);
1992         this->other_auth->destroy(this->other_auth);
1993
1994         this->ike_sa_id->destroy(this->ike_sa_id);
1995         free(this);
1996 }
1997
1998 /*
1999  * Described in header.
2000  */
2001 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
2002 {
2003         private_ike_sa_t *this = malloc_thing(private_ike_sa_t);
2004         static u_int32_t unique_id = 0;
2005
2006         /* Public functions */
2007         this->public.get_state = (ike_sa_state_t (*)(ike_sa_t*)) get_state;
2008         this->public.set_state = (void (*)(ike_sa_t*,ike_sa_state_t)) set_state;
2009         this->public.get_name = (char* (*)(ike_sa_t*))get_name;
2010         this->public.get_statistic = (u_int32_t(*)(ike_sa_t*, statistic_t kind))get_statistic;
2011         this->public.process_message = (status_t (*)(ike_sa_t*, message_t*)) process_message;
2012         this->public.initiate = (status_t (*)(ike_sa_t*,child_cfg_t*,u_int32_t,traffic_selector_t*,traffic_selector_t*)) initiate;
2013         this->public.get_ike_cfg = (ike_cfg_t* (*)(ike_sa_t*))get_ike_cfg;
2014         this->public.set_ike_cfg = (void (*)(ike_sa_t*,ike_cfg_t*))set_ike_cfg;
2015         this->public.get_peer_cfg = (peer_cfg_t* (*)(ike_sa_t*))get_peer_cfg;
2016         this->public.set_peer_cfg = (void (*)(ike_sa_t*,peer_cfg_t*))set_peer_cfg;
2017         this->public.get_auth_cfg = (auth_cfg_t*(*)(ike_sa_t*, bool local))get_auth_cfg;
2018         this->public.get_proposal = (proposal_t*(*)(ike_sa_t*))get_proposal;
2019         this->public.set_proposal = (void(*)(ike_sa_t*, proposal_t *proposal))set_proposal;
2020         this->public.get_id = (ike_sa_id_t* (*)(ike_sa_t*)) get_id;
2021         this->public.get_my_host = (host_t* (*)(ike_sa_t*)) get_my_host;
2022         this->public.set_my_host = (void (*)(ike_sa_t*,host_t*)) set_my_host;
2023         this->public.get_other_host = (host_t* (*)(ike_sa_t*)) get_other_host;
2024         this->public.set_other_host = (void (*)(ike_sa_t*,host_t*)) set_other_host;
2025         this->public.set_message_id = (void(*)(ike_sa_t*, bool inbound, u_int32_t mid))set_message_id;
2026         this->public.update_hosts = (void(*)(ike_sa_t*, host_t *me, host_t *other))update_hosts;
2027         this->public.get_my_id = (identification_t* (*)(ike_sa_t*)) get_my_id;
2028         this->public.set_my_id = (void (*)(ike_sa_t*,identification_t*)) set_my_id;
2029         this->public.get_other_id = (identification_t* (*)(ike_sa_t*)) get_other_id;
2030         this->public.set_other_id = (void (*)(ike_sa_t*,identification_t*)) set_other_id;
2031         this->public.enable_extension = (void(*)(ike_sa_t*, ike_extension_t extension))enable_extension;
2032         this->public.supports_extension = (bool(*)(ike_sa_t*, ike_extension_t extension))supports_extension;
2033         this->public.set_condition = (void (*)(ike_sa_t*, ike_condition_t,bool)) set_condition;
2034         this->public.has_condition = (bool (*)(ike_sa_t*,ike_condition_t)) has_condition;
2035         this->public.set_pending_updates = (void(*)(ike_sa_t*, u_int32_t updates))set_pending_updates;
2036         this->public.get_pending_updates = (u_int32_t(*)(ike_sa_t*))get_pending_updates;
2037         this->public.create_additional_address_iterator = (iterator_t*(*)(ike_sa_t*))create_additional_address_iterator;
2038         this->public.add_additional_address = (void(*)(ike_sa_t*, host_t *host))add_additional_address;
2039         this->public.has_mapping_changed = (bool(*)(ike_sa_t*, chunk_t hash))has_mapping_changed;
2040         this->public.retransmit = (status_t (*)(ike_sa_t *, u_int32_t)) retransmit;
2041         this->public.delete = (status_t (*)(ike_sa_t*))delete_;
2042         this->public.destroy = (void (*)(ike_sa_t*))destroy;
2043         this->public.send_dpd = (status_t (*)(ike_sa_t*)) send_dpd;
2044         this->public.send_keepalive = (void (*)(ike_sa_t*)) send_keepalive;
2045         this->public.get_keymat = (keymat_t*(*)(ike_sa_t*))get_keymat;
2046         this->public.add_child_sa = (void (*)(ike_sa_t*,child_sa_t*)) add_child_sa;
2047         this->public.get_child_sa = (child_sa_t* (*)(ike_sa_t*,protocol_id_t,u_int32_t,bool)) get_child_sa;
2048         this->public.create_child_sa_iterator = (iterator_t* (*)(ike_sa_t*)) create_child_sa_iterator;
2049         this->public.rekey_child_sa = (status_t (*)(ike_sa_t*,protocol_id_t,u_int32_t)) rekey_child_sa;
2050         this->public.delete_child_sa = (status_t (*)(ike_sa_t*,protocol_id_t,u_int32_t)) delete_child_sa;
2051         this->public.destroy_child_sa = (status_t (*)(ike_sa_t*,protocol_id_t,u_int32_t))destroy_child_sa;
2052         this->public.rekey = (status_t (*)(ike_sa_t*))rekey;
2053         this->public.reauth = (status_t (*)(ike_sa_t*))reauth;
2054         this->public.reestablish = (status_t (*)(ike_sa_t*))reestablish;
2055         this->public.set_auth_lifetime = (void(*)(ike_sa_t*, u_int32_t lifetime))set_auth_lifetime;
2056         this->public.roam = (status_t(*)(ike_sa_t*,bool))roam;
2057         this->public.inherit = (status_t (*)(ike_sa_t*,ike_sa_t*))inherit;
2058         this->public.generate_message = (status_t (*)(ike_sa_t*,message_t*,packet_t**))generate_message;
2059         this->public.reset = (void (*)(ike_sa_t*))reset;
2060         this->public.get_unique_id = (u_int32_t (*)(ike_sa_t*))get_unique_id;
2061         this->public.set_virtual_ip = (void (*)(ike_sa_t*,bool,host_t*))set_virtual_ip;
2062         this->public.get_virtual_ip = (host_t* (*)(ike_sa_t*,bool))get_virtual_ip;
2063         this->public.add_configuration_attribute = (void(*)(ike_sa_t*, attribute_handler_t *handler,configuration_attribute_type_t type, chunk_t data))add_configuration_attribute;
2064         this->public.set_kmaddress = (void (*)(ike_sa_t*,host_t*,host_t*))set_kmaddress;
2065 #ifdef ME
2066         this->public.act_as_mediation_server = (void (*)(ike_sa_t*)) act_as_mediation_server;
2067         this->public.get_server_reflexive_host = (host_t* (*)(ike_sa_t*)) get_server_reflexive_host;
2068         this->public.set_server_reflexive_host = (void (*)(ike_sa_t*,host_t*)) set_server_reflexive_host;
2069         this->public.get_connect_id = (chunk_t (*)(ike_sa_t*)) get_connect_id;
2070         this->public.initiate_mediation = (status_t (*)(ike_sa_t*,peer_cfg_t*)) initiate_mediation;
2071         this->public.initiate_mediated = (status_t (*)(ike_sa_t*,host_t*,host_t*,chunk_t)) initiate_mediated;
2072         this->public.relay = (status_t (*)(ike_sa_t*,identification_t*,chunk_t,chunk_t,linked_list_t*,bool)) relay;
2073         this->public.callback = (status_t (*)(ike_sa_t*,identification_t*)) callback;
2074         this->public.respond = (status_t (*)(ike_sa_t*,identification_t*,chunk_t)) respond;
2075 #endif /* ME */
2076
2077         /* initialize private fields */
2078         this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
2079         this->child_sas = linked_list_create();
2080         this->my_host = host_create_any(AF_INET);
2081         this->my_host->set_port(this->my_host, IKEV2_UDP_PORT);
2082         this->other_host = host_create_any(AF_INET);
2083         this->my_id = identification_create_from_encoding(ID_ANY, chunk_empty);
2084         this->other_id = identification_create_from_encoding(ID_ANY, chunk_empty);
2085         this->extensions = 0;
2086         this->conditions = 0;
2087         this->keymat = keymat_create(ike_sa_id->is_initiator(ike_sa_id));
2088         this->state = IKE_CREATED;
2089         this->keepalive_interval = lib->settings->get_time(lib->settings,
2090                                                                         "charon.keep_alive", KEEPALIVE_INTERVAL);
2091         memset(this->stats, 0, sizeof(this->stats));
2092         this->stats[STAT_INBOUND] = this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
2093         this->ike_cfg = NULL;
2094         this->peer_cfg = NULL;
2095         this->my_auth = auth_cfg_create();
2096         this->other_auth = auth_cfg_create();
2097         this->proposal = NULL;
2098         this->task_manager = task_manager_create(&this->public);
2099         this->unique_id = ++unique_id;
2100         this->my_virtual_ip = NULL;
2101         this->other_virtual_ip = NULL;
2102         this->additional_addresses = linked_list_create();
2103         this->attributes = linked_list_create();
2104         this->nat_detection_dest = chunk_empty;
2105         this->pending_updates = 0;
2106         this->keyingtry = 0;
2107         this->local_host = NULL;
2108         this->remote_host = NULL;
2109 #ifdef ME
2110         this->is_mediation_server = FALSE;
2111         this->server_reflexive_host = NULL;
2112         this->connect_id = chunk_empty;
2113 #endif /* ME */
2114
2115         return &this->public;
2116 }