b4f135a57fbdd85fbb0637dcf6ce926b2e222852
[strongswan.git] / src / libcharon / processing / jobs / adopt_children_job.c
1 /*
2 * Copyright (C) 2015 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
4 *
5 * Copyright (C) 2012 Martin Willi
6 * Copyright (C) 2012 revosec AG
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 #include "adopt_children_job.h"
20
21 #include <daemon.h>
22 #include <hydra.h>
23 #include <collections/array.h>
24 #include <processing/jobs/delete_ike_sa_job.h>
25
26 typedef struct private_adopt_children_job_t private_adopt_children_job_t;
27
28 /**
29 * Private data of an adopt_children_job_t object.
30 */
31 struct private_adopt_children_job_t {
32
33 /**
34 * Public adopt_children_job_t interface.
35 */
36 adopt_children_job_t public;
37
38 /**
39 * IKE_SA id to adopt children from
40 */
41 ike_sa_id_t *id;
42
43 /**
44 * Tasks queued for execution
45 */
46 array_t *tasks;
47 };
48
49 METHOD(job_t, destroy, void,
50 private_adopt_children_job_t *this)
51 {
52 array_destroy_offset(this->tasks, offsetof(task_t, destroy));
53 this->id->destroy(this->id);
54 free(this);
55 }
56
57 METHOD(job_t, execute, job_requeue_t,
58 private_adopt_children_job_t *this)
59 {
60 identification_t *my_id, *other_id, *xauth;
61 host_t *me, *other, *vip;
62 peer_cfg_t *cfg;
63 linked_list_t *children, *vips;
64 enumerator_t *enumerator, *subenum;
65 ike_sa_id_t *id;
66 ike_sa_t *ike_sa;
67 child_sa_t *child_sa;
68 u_int32_t unique;
69
70 ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager, this->id);
71 if (ike_sa)
72 {
73 /* get what we need from new SA */
74 unique = ike_sa->get_unique_id(ike_sa);
75 me = ike_sa->get_my_host(ike_sa);
76 me = me->clone(me);
77 other = ike_sa->get_other_host(ike_sa);
78 other = other->clone(other);
79 my_id = ike_sa->get_my_id(ike_sa);
80 my_id = my_id->clone(my_id);
81 other_id = ike_sa->get_other_id(ike_sa);
82 other_id = other_id->clone(other_id);
83 xauth = ike_sa->get_other_eap_id(ike_sa);
84 xauth = xauth->clone(xauth);
85 cfg = ike_sa->get_peer_cfg(ike_sa);
86 cfg->get_ref(cfg);
87
88 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
89
90 /* find old SA to adopt children and virtual IPs from */
91 vips = linked_list_create();
92 children = linked_list_create();
93 enumerator = charon->ike_sa_manager->create_id_enumerator(
94 charon->ike_sa_manager, my_id, xauth,
95 other->get_family(other));
96 while (enumerator->enumerate(enumerator, &id))
97 {
98 if (id->equals(id, this->id))
99 { /* not from self */
100 continue;
101 }
102 ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager, id);
103 if (ike_sa)
104 {
105 if ((ike_sa->get_state(ike_sa) == IKE_ESTABLISHED ||
106 ike_sa->get_state(ike_sa) == IKE_PASSIVE) &&
107 me->equals(me, ike_sa->get_my_host(ike_sa)) &&
108 other->equals(other, ike_sa->get_other_host(ike_sa)) &&
109 other_id->equals(other_id, ike_sa->get_other_id(ike_sa)) &&
110 cfg->equals(cfg, ike_sa->get_peer_cfg(ike_sa)))
111 {
112 charon->bus->children_migrate(charon->bus, this->id, unique);
113 subenum = ike_sa->create_child_sa_enumerator(ike_sa);
114 while (subenum->enumerate(subenum, &child_sa))
115 {
116 ike_sa->remove_child_sa(ike_sa, subenum);
117 children->insert_last(children, child_sa);
118 }
119 subenum->destroy(subenum);
120
121 subenum = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE);
122 while (subenum->enumerate(subenum, &vip))
123 {
124 vips->insert_last(vips, vip->clone(vip));
125 }
126 subenum->destroy(subenum);
127 /* this does not release the addresses, which is good, but
128 * it does trigger an assign_vips(FALSE) event, so we also
129 * trigger one below */
130 ike_sa->clear_virtual_ips(ike_sa, FALSE);
131 if (children->get_count(children) || vips->get_count(vips))
132 {
133 DBG1(DBG_IKE, "detected reauth of existing IKE_SA, "
134 "adopting %d children and %d virtual IPs",
135 children->get_count(children), vips->get_count(vips));
136 }
137 if (ike_sa->get_state(ike_sa) == IKE_PASSIVE)
138 {
139 charon->ike_sa_manager->checkin_and_destroy(
140 charon->ike_sa_manager, ike_sa);
141 }
142 else
143 {
144 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
145 delete_ike_sa_job_create(ike_sa->get_id(ike_sa),
146 TRUE), 10);
147 charon->ike_sa_manager->checkin(
148 charon->ike_sa_manager, ike_sa);
149 }
150 }
151 else
152 {
153 charon->ike_sa_manager->checkin(
154 charon->ike_sa_manager, ike_sa);
155 }
156 if (children->get_count(children) || vips->get_count(vips))
157 {
158 break;
159 }
160 }
161 }
162 enumerator->destroy(enumerator);
163
164 me->destroy(me);
165 other->destroy(other);
166 my_id->destroy(my_id);
167 other_id->destroy(other_id);
168 xauth->destroy(xauth);
169 cfg->destroy(cfg);
170
171 if (children->get_count(children) || vips->get_count(vips))
172 {
173 /* adopt children by new SA */
174 ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
175 this->id);
176 if (ike_sa)
177 {
178 while (children->remove_last(children,
179 (void**)&child_sa) == SUCCESS)
180 {
181 ike_sa->add_child_sa(ike_sa, child_sa);
182 }
183 if (vips->get_count(vips))
184 {
185 while (vips->remove_first(vips, (void**)&vip) == SUCCESS)
186 {
187 ike_sa->add_virtual_ip(ike_sa, FALSE, vip);
188 vip->destroy(vip);
189 }
190 charon->bus->assign_vips(charon->bus, ike_sa, TRUE);
191 }
192 charon->bus->children_migrate(charon->bus, NULL, 0);
193 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
194 }
195 }
196 children->destroy_offset(children, offsetof(child_sa_t, destroy));
197 /* FIXME: If we still have addresses here it means we weren't able to
198 * find the new SA anymore (while not very likely during a proper
199 * reauthentication, this theoretically could happen because the SA is
200 * not locked while we search for the old one). So the addresses here
201 * should be released properly to avoid leaking these leases. This is
202 * currently not possible, though, due to the changed interface of
203 * release_address(), which now takes a complete IKE_SA object. */
204 vips->destroy_offset(vips, offsetof(host_t, destroy));
205
206 if (array_count(this->tasks))
207 {
208 ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
209 this->id);
210 if (ike_sa)
211 {
212 task_t *task;
213
214 while (array_remove(this->tasks, ARRAY_HEAD, &task))
215 {
216 task->migrate(task, ike_sa);
217 ike_sa->queue_task(ike_sa, task);
218 }
219 if (ike_sa->initiate(ike_sa, NULL, 0, NULL, NULL) == DESTROY_ME)
220 {
221 charon->ike_sa_manager->checkin_and_destroy(
222 charon->ike_sa_manager, ike_sa);
223 }
224 else
225 {
226 charon->ike_sa_manager->checkin(charon->ike_sa_manager,
227 ike_sa);
228 }
229 }
230 }
231 }
232 return JOB_REQUEUE_NONE;
233 }
234
235 METHOD(job_t, get_priority, job_priority_t,
236 private_adopt_children_job_t *this)
237 {
238 return JOB_PRIO_HIGH;
239 }
240
241 METHOD(adopt_children_job_t, queue_task, void,
242 private_adopt_children_job_t *this, task_t *task)
243 {
244 array_insert_create(&this->tasks, ARRAY_TAIL, task);
245 }
246
247 /**
248 * See header
249 */
250 adopt_children_job_t *adopt_children_job_create(ike_sa_id_t *id)
251 {
252 private_adopt_children_job_t *this;
253
254 INIT(this,
255 .public = {
256 .job_interface = {
257 .execute = _execute,
258 .get_priority = _get_priority,
259 .destroy = _destroy,
260 },
261 .queue_task = _queue_task,
262 },
263 .id = id->clone(id),
264 );
265
266 return &this->public;
267 }