src/charon/sa/tasks/child_rekey.c

   1 /**
   2  * @file child_rekey.c
   3  *
   4  * @brief Implementation of the child_rekey task.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005-2007 Martin Willi
  10  * Copyright (C) 2005 Jan Hutter
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include "child_rekey.h"
  25
  26 #include <daemon.h>
  27 #include <encoding/payloads/notify_payload.h>
  28 #include <sa/tasks/child_create.h>
  29 #include <queues/jobs/rekey_child_sa_job.h>
  30
  31
  32 typedef struct private_child_rekey_t private_child_rekey_t;
  33
  34 /**
  35  * Private members of a child_rekey_t task.
  36  */
  37 struct private_child_rekey_t {
  38
  39         /**
  40          * Public methods and task_t interface.
  41          */
  42         child_rekey_t public;
  43
  44         /**
  45          * Assigned IKE_SA.
  46          */
  47         ike_sa_t *ike_sa;
  48
  49         /**
  50          * Are we the initiator?
  51          */
  52         bool initiator;
  53
  54         /**
  55          * the CHILD_CREATE task which is reused to simplify rekeying
  56          */
  57         child_create_t *child_create;
  58
  59         /**
  60          * CHILD_SA which gets rekeyed
  61          */
  62         child_sa_t *child_sa;
  63
  64         /**
  65          * colliding task, may be delete or rekey
  66          */
  67         task_t *collision;
  68 };
  69
  70 /**
  71  * find a child using the REKEY_SA notify
  72  */
  73 static void find_child(private_child_rekey_t *this, message_t *message)
  74 {
  75         iterator_t *iterator;
  76         payload_t *payload;
  77
  78         iterator = message->get_payload_iterator(message);
  79         while (iterator->iterate(iterator, (void**)&payload))
  80         {
  81                 notify_payload_t *notify;
  82                 u_int32_t spi;
  83                 protocol_id_t protocol;
  84
  85                 if (payload->get_type(payload) != NOTIFY)
  86                 {
  87                         continue;
  88                 }
  89
  90                 notify = (notify_payload_t*)payload;
  91                 protocol = notify->get_protocol_id(notify);
  92                 spi = notify->get_spi(notify);
  93
  94                 if (protocol != PROTO_ESP && protocol != PROTO_AH)
  95                 {
  96                         continue;
  97                 }
  98                 this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
  99                                                                                                         spi, FALSE);
 100                 break;
 101
 102         }
 103         iterator->destroy(iterator);
 104 }
 105
 106 /**
 107  * Implementation of task_t.build for initiator
 108  */
 109 static status_t build_i(private_child_rekey_t *this, message_t *message)
 110 {
 111         notify_payload_t *notify;
 112         protocol_id_t protocol;
 113         u_int32_t spi, reqid;
 114
 115         /* we just need the rekey notify ... */
 116         protocol = this->child_sa->get_protocol(this->child_sa);
 117         spi = this->child_sa->get_spi(this->child_sa, TRUE);
 118         notify = notify_payload_create_from_protocol_and_type(protocol, REKEY_SA);
 119         notify->set_spi(notify, spi);
 120         message->add_payload(message, (payload_t*)notify);
 121
 122         /* ... our CHILD_CREATE task does the hard work for us. */
 123         reqid = this->child_sa->get_reqid(this->child_sa);
 124         this->child_create->use_reqid(this->child_create, reqid);
 125         this->child_create->task.build(&this->child_create->task, message);
 126
 127         this->child_sa->set_state(this->child_sa, CHILD_REKEYING);
 128
 129         return NEED_MORE;
 130 }
 131
 132 /**
 133  * Implementation of task_t.process for initiator
 134  */
 135 static status_t process_r(private_child_rekey_t *this, message_t *message)
 136 {
 137         /* let the CHILD_CREATE task process the message */
 138         this->child_create->task.process(&this->child_create->task, message);
 139
 140         find_child(this, message);
 141
 142         return NEED_MORE;
 143 }
 144
 145 /**
 146  * Implementation of task_t.build for responder
 147  */
 148 static status_t build_r(private_child_rekey_t *this, message_t *message)
 149 {
 150         u_int32_t reqid;
 151
 152         if (this->child_sa == NULL ||
 153                 this->child_sa->get_state(this->child_sa) == CHILD_DELETING)
 154         {
 155                 DBG1(DBG_IKE, "unable to rekey, CHILD_SA not found");
 156                 message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
 157                 return SUCCESS;
 158         }
 159
 160         /* let the CHILD_CREATE task build the response */
 161         reqid = this->child_sa->get_reqid(this->child_sa);
 162         this->child_create->use_reqid(this->child_create, reqid);
 163         this->child_create->task.build(&this->child_create->task, message);
 164
 165         if (message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
 166         {
 167                 /* rekeying failed, reuse old child */
 168                 this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 169                 return SUCCESS;
 170         }
 171
 172         this->child_sa->set_state(this->child_sa, CHILD_REKEYING);
 173         return SUCCESS;
 174 }
 175
 176 /**
 177  * Implementation of task_t.process for initiator
 178  */
 179 static status_t process_i(private_child_rekey_t *this, message_t *message)
 180 {
 181         protocol_id_t protocol;
 182         u_int32_t spi;
 183         child_sa_t *to_delete;
 184
 185         this->child_create->task.process(&this->child_create->task, message);
 186         if (message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
 187         {
 188                 /* establishing new child failed, reuse old. but not when we
 189                  * recieved a delete in the meantime */
 190                 if (!(this->collision &&
 191                           this->collision->get_type(this->collision) == CHILD_DELETE))
 192                 {
 193                         job_t *job;
 194                         u_int32_t retry = charon->configuration->get_retry_interval(
 195                                                                 charon->configuration);
 196                         job = (job_t*)rekey_child_sa_job_create(
 197                                                                 this->child_sa->get_reqid(this->child_sa),
 198                                                                 this->child_sa->get_protocol(this->child_sa),
 199                                                                 this->child_sa->get_spi(this->child_sa, TRUE));
 200                         DBG1(DBG_IKE, "CHILD_SA rekeying failed, "
 201                                                                 "trying again in %d seconds", retry);
 202                         this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 203                         charon->event_queue->add_relative(charon->event_queue, job, retry * 1000);
 204                 }
 205                 return SUCCESS;
 206         }
 207
 208         to_delete = this->child_sa;
 209
 210         /* check for rekey collisions */
 211         if (this->collision &&
 212                 this->collision->get_type(this->collision) == CHILD_REKEY)
 213         {
 214                 chunk_t this_nonce, other_nonce;
 215                 private_child_rekey_t *other = (private_child_rekey_t*)this->collision;
 216
 217                 this_nonce = this->child_create->get_lower_nonce(this->child_create);
 218                 other_nonce = other->child_create->get_lower_nonce(other->child_create);
 219
 220                 /* if we have the lower nonce, delete rekeyed SA. If not, delete
 221                  * the redundant. */
 222                 if (memcmp(this_nonce.ptr, other_nonce.ptr,
 223                                    min(this_nonce.len, other_nonce.len)) < 0)
 224                 {
 225                         DBG1(DBG_IKE, "CHILD_SA rekey collision won, deleting rekeyed child");
 226                 }
 227                 else
 228                 {
 229                         DBG1(DBG_IKE, "CHILD_SA rekey collision lost, deleting redundant child");
 230                         to_delete = this->child_create->get_child(this->child_create);
 231                         if (to_delete == NULL)
 232                         {
 233                                 /* ooops, should not happen, fallback */
 234                                 to_delete = this->child_sa;
 235                         }
 236                 }
 237         }
 238
 239         spi = to_delete->get_spi(to_delete, TRUE);
 240         protocol = to_delete->get_protocol(to_delete);
 241         if (this->ike_sa->delete_child_sa(this->ike_sa, protocol, spi) != SUCCESS)
 242         {
 243                 return FAILED;
 244         }
 245         return SUCCESS;
 246 }
 247
 248 /**
 249  * Implementation of task_t.get_type
 250  */
 251 static task_type_t get_type(private_child_rekey_t *this)
 252 {
 253         return CHILD_REKEY;
 254 }
 255
 256 /**
 257  * Implementation of child_rekey_t.collide
 258  */
 259 static void collide(private_child_rekey_t *this, task_t *other)
 260 {
 261         DESTROY_IF(this->collision);
 262         this->collision = other;
 263 }
 264
 265 /**
 266  * Implementation of task_t.migrate
 267  */
 268 static void migrate(private_child_rekey_t *this, ike_sa_t *ike_sa)
 269 {
 270         this->child_create->task.migrate(&this->child_create->task, ike_sa);
 271         DESTROY_IF(this->collision);
 272
 273         this->ike_sa = ike_sa;
 274         this->collision = NULL;
 275 }
 276
 277 /**
 278  * Implementation of task_t.destroy
 279  */
 280 static void destroy(private_child_rekey_t *this)
 281 {
 282         this->child_create->task.destroy(&this->child_create->task);
 283         DESTROY_IF(this->collision);
 284         free(this);
 285 }
 286
 287 /*
 288  * Described in header.
 289  */
 290 child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, child_sa_t *child_sa)
 291 {
 292         private_child_rekey_t *this = malloc_thing(private_child_rekey_t);
 293         policy_t *policy;
 294
 295         this->public.collide = (void (*)(child_rekey_t*,task_t*))collide;
 296         this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 297         this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 298         this->public.task.destroy = (void(*)(task_t*))destroy;
 299         if (child_sa != NULL)
 300         {
 301                 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
 302                 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
 303                 this->initiator = TRUE;
 304                 policy = child_sa->get_policy(child_sa);
 305                 this->child_create = child_create_create(ike_sa, policy);
 306         }
 307         else
 308         {
 309                 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 310                 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 311                 this->initiator = FALSE;
 312                 this->child_create = child_create_create(ike_sa, NULL);
 313         }
 314
 315         this->ike_sa = ike_sa;
 316         this->child_sa = child_sa;
 317         this->collision = NULL;
 318
 319         return &this->public;
 320 }