2 * Copyright (C) 2006-2015 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2009 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * Copyright (c) 2014 Volker RĂ¼melin
22 * Permission is hereby granted, free of charge, to any person obtaining a copy
23 * of this software and associated documentation files (the "Software"), to deal
24 * in the Software without restriction, including without limitation the rights
25 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
26 * copies of the Software, and to permit persons to whom the Software is
27 * furnished to do so, subject to the following conditions:
29 * The above copyright notice and this permission notice shall be included in
30 * all copies or substantial portions of the Software.
32 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
33 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
34 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
35 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
36 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
37 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
51 #include <collections/array.h>
52 #include <utils/lexparser.h>
53 #include <processing/jobs/retransmit_job.h>
54 #include <processing/jobs/delete_ike_sa_job.h>
55 #include <processing/jobs/send_dpd_job.h>
56 #include <processing/jobs/send_keepalive_job.h>
57 #include <processing/jobs/rekey_ike_sa_job.h>
58 #include <processing/jobs/retry_initiate_job.h>
59 #include <sa/ikev2/tasks/ike_auth_lifetime.h>
62 #include <sa/ikev2/tasks/ike_me.h>
63 #include <processing/jobs/initiate_mediation_job.h>
66 ENUM(ike_sa_state_names
, IKE_CREATED
, IKE_DESTROYING
,
76 typedef struct private_ike_sa_t private_ike_sa_t
;
77 typedef struct attribute_entry_t attribute_entry_t
;
80 * Private data of an ike_sa_t object.
82 struct private_ike_sa_t
{
90 * Identifier for the current IKE_SA.
92 ike_sa_id_t
*ike_sa_id
;
95 * IKE version of this SA.
97 ike_version_t version
;
100 * unique numerical ID for this IKE_SA.
105 * Current state of the IKE_SA
107 ike_sa_state_t state
;
110 * IKE configuration used to set up this IKE_SA
115 * Peer and authentication information to establish IKE_SA.
117 peer_cfg_t
*peer_cfg
;
120 * currently used authentication ruleset, local
125 * currently used authentication constraints, remote
127 auth_cfg_t
*other_auth
;
130 * Array of completed local authentication rounds (as auth_cfg_t)
135 * Array of completed remote authentication rounds (as auth_cfg_t)
137 array_t
*other_auths
;
140 * Selected IKE proposal
142 proposal_t
*proposal
;
145 * Juggles tasks to process messages
147 task_manager_t
*task_manager
;
150 * Address of local host
155 * Address of remote host
161 * Are we mediation server
163 bool is_mediation_server
;
166 * Server reflexive host
168 host_t
*server_reflexive_host
;
177 * Identification used for us
179 identification_t
*my_id
;
182 * Identification used for other
184 identification_t
*other_id
;
187 * set of extensions the peer supports
189 ike_extension_t extensions
;
192 * set of condition flags currently enabled for this IKE_SA
194 ike_condition_t conditions
;
197 * Array containing the child sa's of the current IKE_SA.
202 * keymat of this IKE_SA
207 * Virtual IPs on local host
212 * Virtual IPs on remote host
217 * List of configuration attributes (attribute_entry_t)
222 * list of peer's addresses, additional ones transmitted via MOBIKE
224 array_t
*peer_addresses
;
227 * previously value of received DESTINATION_IP hash
229 chunk_t nat_detection_dest
;
232 * number pending UPDATE_SA_ADDRESS (MOBIKE)
234 u_int32_t pending_updates
;
237 * NAT keep alive interval
239 u_int32_t keepalive_interval
;
242 * interval for retries during initiation (e.g. if DNS resolution failed),
243 * 0 to disable (default)
245 u_int32_t retry_initiate_interval
;
248 * TRUE if a retry_initiate_job has been queued
250 bool retry_initiate_queued
;
253 * Timestamps for this IKE_SA
255 u_int32_t stats
[STAT_MAX
];
258 * how many times we have retried so far (keyingtries)
263 * local host address to be used for IKE, set via MIGRATE kernel message
268 * remote host address to be used for IKE, set via MIGRATE kernel message
273 * Flush auth configs once established?
278 * Maximum length of a single fragment, 0 for address-specific defaults
280 size_t fragment_size
;
284 * Entry to maintain install configuration attributes during IKE_SA lifetime
286 struct attribute_entry_t
{
287 /** handler used to install this attribute */
288 attribute_handler_t
*handler
;
289 /** attribute type */
290 configuration_attribute_type_t type
;
291 /** attribute data */
296 * get the time of the latest traffic processed by the kernel
298 static time_t get_use_time(private_ike_sa_t
* this, bool inbound
)
300 enumerator_t
*enumerator
;
301 child_sa_t
*child_sa
;
302 time_t use_time
, current
;
306 use_time
= this->stats
[STAT_INBOUND
];
310 use_time
= this->stats
[STAT_OUTBOUND
];
313 enumerator
= array_create_enumerator(this->child_sas
);
314 while (enumerator
->enumerate(enumerator
, &child_sa
))
316 child_sa
->get_usestats(child_sa
, inbound
, ¤t
, NULL
, NULL
);
317 use_time
= max(use_time
, current
);
319 enumerator
->destroy(enumerator
);
324 METHOD(ike_sa_t
, get_unique_id
, u_int32_t
,
325 private_ike_sa_t
*this)
327 return this->unique_id
;
330 METHOD(ike_sa_t
, get_name
, char*,
331 private_ike_sa_t
*this)
335 return this->peer_cfg
->get_name(this->peer_cfg
);
340 METHOD(ike_sa_t
, get_statistic
, u_int32_t
,
341 private_ike_sa_t
*this, statistic_t kind
)
345 return this->stats
[kind
];
350 METHOD(ike_sa_t
, set_statistic
, void,
351 private_ike_sa_t
*this, statistic_t kind
, u_int32_t value
)
355 this->stats
[kind
] = value
;
359 METHOD(ike_sa_t
, get_my_host
, host_t
*,
360 private_ike_sa_t
*this)
362 return this->my_host
;
365 METHOD(ike_sa_t
, set_my_host
, void,
366 private_ike_sa_t
*this, host_t
*me
)
368 DESTROY_IF(this->my_host
);
372 METHOD(ike_sa_t
, get_other_host
, host_t
*,
373 private_ike_sa_t
*this)
375 return this->other_host
;
378 METHOD(ike_sa_t
, set_other_host
, void,
379 private_ike_sa_t
*this, host_t
*other
)
381 DESTROY_IF(this->other_host
);
382 this->other_host
= other
;
385 METHOD(ike_sa_t
, get_peer_cfg
, peer_cfg_t
*,
386 private_ike_sa_t
*this)
388 return this->peer_cfg
;
391 METHOD(ike_sa_t
, set_peer_cfg
, void,
392 private_ike_sa_t
*this, peer_cfg_t
*peer_cfg
)
394 peer_cfg
->get_ref(peer_cfg
);
395 DESTROY_IF(this->peer_cfg
);
396 this->peer_cfg
= peer_cfg
;
398 if (this->ike_cfg
== NULL
)
400 this->ike_cfg
= peer_cfg
->get_ike_cfg(peer_cfg
);
401 this->ike_cfg
->get_ref(this->ike_cfg
);
405 METHOD(ike_sa_t
, get_auth_cfg
, auth_cfg_t
*,
406 private_ike_sa_t
*this, bool local
)
410 return this->my_auth
;
412 return this->other_auth
;
415 METHOD(ike_sa_t
, add_auth_cfg
, void,
416 private_ike_sa_t
*this, bool local
, auth_cfg_t
*cfg
)
420 array_insert(this->my_auths
, ARRAY_TAIL
, cfg
);
424 array_insert(this->other_auths
, ARRAY_TAIL
, cfg
);
428 METHOD(ike_sa_t
, create_auth_cfg_enumerator
, enumerator_t
*,
429 private_ike_sa_t
*this, bool local
)
433 return array_create_enumerator(this->my_auths
);
435 return array_create_enumerator(this->other_auths
);
439 * Flush the stored authentication round information
441 static void flush_auth_cfgs(private_ike_sa_t
*this)
445 this->my_auth
->purge(this->my_auth
, FALSE
);
446 this->other_auth
->purge(this->other_auth
, FALSE
);
448 while (array_remove(this->my_auths
, ARRAY_TAIL
, &cfg
))
452 while (array_remove(this->other_auths
, ARRAY_TAIL
, &cfg
))
458 METHOD(ike_sa_t
, get_proposal
, proposal_t
*,
459 private_ike_sa_t
*this)
461 return this->proposal
;
464 METHOD(ike_sa_t
, set_proposal
, void,
465 private_ike_sa_t
*this, proposal_t
*proposal
)
467 DESTROY_IF(this->proposal
);
468 this->proposal
= proposal
->clone(proposal
);
471 METHOD(ike_sa_t
, set_message_id
, void,
472 private_ike_sa_t
*this, bool initiate
, u_int32_t mid
)
476 this->task_manager
->reset(this->task_manager
, mid
, UINT_MAX
);
480 this->task_manager
->reset(this->task_manager
, UINT_MAX
, mid
);
484 METHOD(ike_sa_t
, send_keepalive
, void,
485 private_ike_sa_t
*this)
487 send_keepalive_job_t
*job
;
488 time_t last_out
, now
, diff
;
490 if (!this->keepalive_interval
|| this->state
== IKE_PASSIVE
)
491 { /* keepalives disabled either by configuration or for passive IKE_SAs */
494 if (!(this->conditions
& COND_NAT_HERE
) || (this->conditions
& COND_STALE
))
495 { /* disable keepalives if we are not NATed anymore, or the SA is stale */
499 last_out
= get_use_time(this, FALSE
);
500 now
= time_monotonic(NULL
);
502 diff
= now
- last_out
;
504 if (diff
>= this->keepalive_interval
)
509 packet
= packet_create();
510 packet
->set_source(packet
, this->my_host
->clone(this->my_host
));
511 packet
->set_destination(packet
, this->other_host
->clone(this->other_host
));
512 data
.ptr
= malloc(1);
515 packet
->set_data(packet
, data
);
516 DBG1(DBG_IKE
, "sending keep alive to %#H", this->other_host
);
517 charon
->sender
->send_no_marker(charon
->sender
, packet
);
520 job
= send_keepalive_job_create(this->ike_sa_id
);
521 lib
->scheduler
->schedule_job(lib
->scheduler
, (job_t
*)job
,
522 this->keepalive_interval
- diff
);
525 METHOD(ike_sa_t
, get_ike_cfg
, ike_cfg_t
*,
526 private_ike_sa_t
*this)
528 return this->ike_cfg
;
531 METHOD(ike_sa_t
, set_ike_cfg
, void,
532 private_ike_sa_t
*this, ike_cfg_t
*ike_cfg
)
534 ike_cfg
->get_ref(ike_cfg
);
535 this->ike_cfg
= ike_cfg
;
538 METHOD(ike_sa_t
, enable_extension
, void,
539 private_ike_sa_t
*this, ike_extension_t extension
)
541 this->extensions
|= extension
;
544 METHOD(ike_sa_t
, supports_extension
, bool,
545 private_ike_sa_t
*this, ike_extension_t extension
)
547 return (this->extensions
& extension
) != FALSE
;
550 METHOD(ike_sa_t
, has_condition
, bool,
551 private_ike_sa_t
*this, ike_condition_t condition
)
553 return (this->conditions
& condition
) != FALSE
;
556 METHOD(ike_sa_t
, set_condition
, void,
557 private_ike_sa_t
*this, ike_condition_t condition
, bool enable
)
559 if (has_condition(this, condition
) != enable
)
563 this->conditions
|= condition
;
567 DBG1(DBG_IKE
, "local host is behind NAT, sending keep alives");
568 this->conditions
|= COND_NAT_ANY
;
569 send_keepalive(this);
572 DBG1(DBG_IKE
, "remote host is behind NAT");
573 this->conditions
|= COND_NAT_ANY
;
576 DBG1(DBG_IKE
, "faking NAT situation to enforce UDP encapsulation");
577 this->conditions
|= COND_NAT_ANY
;
585 this->conditions
&= ~condition
;
591 set_condition(this, COND_NAT_ANY
,
592 has_condition(this, COND_NAT_HERE
) ||
593 has_condition(this, COND_NAT_THERE
) ||
594 has_condition(this, COND_NAT_FAKE
));
597 send_keepalive(this);
606 METHOD(ike_sa_t
, send_dpd
, status_t
,
607 private_ike_sa_t
*this)
611 bool task_queued
= FALSE
;
613 if (this->state
== IKE_PASSIVE
)
615 return INVALID_STATE
;
617 delay
= this->peer_cfg
->get_dpd(this->peer_cfg
);
618 if (this->task_manager
->busy(this->task_manager
))
620 /* an exchange is in the air, no need to start a DPD check */
625 /* check if there was any inbound traffic */
627 last_in
= get_use_time(this, TRUE
);
628 now
= time_monotonic(NULL
);
629 diff
= now
- last_in
;
630 if (!delay
|| diff
>= delay
)
632 /* too long ago, initiate dead peer detection */
633 DBG1(DBG_IKE
, "sending DPD request");
634 this->task_manager
->queue_dpd(this->task_manager
);
639 /* recheck in "interval" seconds */
642 job
= (job_t
*)send_dpd_job_create(this->ike_sa_id
);
643 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, delay
- diff
);
647 return this->task_manager
->initiate(this->task_manager
);
652 METHOD(ike_sa_t
, get_state
, ike_sa_state_t
,
653 private_ike_sa_t
*this)
658 METHOD(ike_sa_t
, set_state
, void,
659 private_ike_sa_t
*this, ike_sa_state_t state
)
661 bool trigger_dpd
= FALSE
, keepalives
= FALSE
;
663 DBG2(DBG_IKE
, "IKE_SA %s[%d] state change: %N => %N",
664 get_name(this), this->unique_id
,
665 ike_sa_state_names
, this->state
,
666 ike_sa_state_names
, state
);
670 case IKE_ESTABLISHED
:
672 if (this->state
== IKE_CONNECTING
||
673 this->state
== IKE_PASSIVE
)
678 /* calculate rekey, reauth and lifetime */
679 this->stats
[STAT_ESTABLISHED
] = time_monotonic(NULL
);
681 /* schedule rekeying if we have a time which is smaller than
682 * an already scheduled rekeying */
683 t
= this->peer_cfg
->get_rekey_time(this->peer_cfg
, TRUE
);
684 if (t
&& (this->stats
[STAT_REKEY
] == 0 ||
685 (this->stats
[STAT_REKEY
] > t
+ this->stats
[STAT_ESTABLISHED
])))
687 this->stats
[STAT_REKEY
] = t
+ this->stats
[STAT_ESTABLISHED
];
688 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, FALSE
);
689 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
690 DBG1(DBG_IKE
, "scheduling rekeying in %ds", t
);
692 t
= this->peer_cfg
->get_reauth_time(this->peer_cfg
, TRUE
);
693 if (t
&& (this->stats
[STAT_REAUTH
] == 0 ||
694 (this->stats
[STAT_REAUTH
] > t
+ this->stats
[STAT_ESTABLISHED
])))
696 this->stats
[STAT_REAUTH
] = t
+ this->stats
[STAT_ESTABLISHED
];
697 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
);
698 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
699 DBG1(DBG_IKE
, "scheduling reauthentication in %ds", t
);
701 t
= this->peer_cfg
->get_over_time(this->peer_cfg
);
702 if (this->stats
[STAT_REKEY
] || this->stats
[STAT_REAUTH
])
704 if (this->stats
[STAT_REAUTH
] == 0)
706 this->stats
[STAT_DELETE
] = this->stats
[STAT_REKEY
];
708 else if (this->stats
[STAT_REKEY
] == 0)
710 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
];
714 this->stats
[STAT_DELETE
] = min(this->stats
[STAT_REKEY
],
715 this->stats
[STAT_REAUTH
]);
717 this->stats
[STAT_DELETE
] += t
;
718 t
= this->stats
[STAT_DELETE
] - this->stats
[STAT_ESTABLISHED
];
719 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
720 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
721 DBG1(DBG_IKE
, "maximum IKE_SA lifetime %ds", t
);
723 trigger_dpd
= this->peer_cfg
->get_dpd(this->peer_cfg
);
726 /* Some peers delay the DELETE after rekeying an IKE_SA.
727 * If this delay is longer than our DPD delay, we would
728 * send a DPD request here. The IKE_SA is not ready to do
729 * so yet, so prevent that. */
730 this->stats
[STAT_INBOUND
] = this->stats
[STAT_ESTABLISHED
];
732 if (this->state
== IKE_PASSIVE
)
742 charon
->bus
->ike_state_change(charon
->bus
, &this->public, state
);
747 if (supports_extension(this, EXT_DPD
))
753 DBG1(DBG_IKE
, "DPD not supported by peer, disabled");
758 send_keepalive(this);
762 METHOD(ike_sa_t
, reset
, void,
763 private_ike_sa_t
*this)
765 /* the responder ID is reset, as peer may choose another one */
766 if (this->ike_sa_id
->is_initiator(this->ike_sa_id
))
768 this->ike_sa_id
->set_responder_spi(this->ike_sa_id
, 0);
771 set_state(this, IKE_CREATED
);
773 flush_auth_cfgs(this);
775 this->keymat
->destroy(this->keymat
);
776 this->keymat
= keymat_create(this->version
,
777 this->ike_sa_id
->is_initiator(this->ike_sa_id
));
779 this->task_manager
->reset(this->task_manager
, 0, 0);
782 METHOD(ike_sa_t
, get_keymat
, keymat_t
*,
783 private_ike_sa_t
*this)
788 METHOD(ike_sa_t
, add_virtual_ip
, void,
789 private_ike_sa_t
*this, bool local
, host_t
*ip
)
795 if (hydra
->kernel_interface
->get_interface(hydra
->kernel_interface
,
796 this->my_host
, &iface
))
798 DBG1(DBG_IKE
, "installing new virtual IP %H", ip
);
799 if (hydra
->kernel_interface
->add_ip(hydra
->kernel_interface
,
800 ip
, -1, iface
) == SUCCESS
)
802 array_insert_create(&this->my_vips
, ARRAY_TAIL
, ip
->clone(ip
));
806 DBG1(DBG_IKE
, "installing virtual IP %H failed", ip
);
812 DBG1(DBG_IKE
, "looking up interface for virtual IP %H failed", ip
);
817 array_insert_create(&this->other_vips
, ARRAY_TAIL
, ip
->clone(ip
));
822 METHOD(ike_sa_t
, clear_virtual_ips
, void,
823 private_ike_sa_t
*this, bool local
)
828 vips
= local ?
this->my_vips
: this->other_vips
;
829 if (!local
&& array_count(vips
))
831 charon
->bus
->assign_vips(charon
->bus
, &this->public, FALSE
);
833 while (array_remove(vips
, ARRAY_HEAD
, &vip
))
837 hydra
->kernel_interface
->del_ip(hydra
->kernel_interface
,
844 METHOD(ike_sa_t
, create_virtual_ip_enumerator
, enumerator_t
*,
845 private_ike_sa_t
*this, bool local
)
849 return array_create_enumerator(this->my_vips
);
851 return array_create_enumerator(this->other_vips
);
854 METHOD(ike_sa_t
, add_peer_address
, void,
855 private_ike_sa_t
*this, host_t
*host
)
857 array_insert_create(&this->peer_addresses
, ARRAY_TAIL
, host
);
860 METHOD(ike_sa_t
, create_peer_address_enumerator
, enumerator_t
*,
861 private_ike_sa_t
*this)
863 if (this->peer_addresses
)
865 return array_create_enumerator(this->peer_addresses
);
867 /* in case we don't have MOBIKE */
868 return enumerator_create_single(this->other_host
, NULL
);
871 METHOD(ike_sa_t
, clear_peer_addresses
, void,
872 private_ike_sa_t
*this)
874 array_destroy_offset(this->peer_addresses
, offsetof(host_t
, destroy
));
875 this->peer_addresses
= NULL
;
878 METHOD(ike_sa_t
, has_mapping_changed
, bool,
879 private_ike_sa_t
*this, chunk_t hash
)
881 if (this->nat_detection_dest
.ptr
== NULL
)
883 this->nat_detection_dest
= chunk_clone(hash
);
886 if (chunk_equals(hash
, this->nat_detection_dest
))
890 free(this->nat_detection_dest
.ptr
);
891 this->nat_detection_dest
= chunk_clone(hash
);
895 METHOD(ike_sa_t
, set_pending_updates
, void,
896 private_ike_sa_t
*this, u_int32_t updates
)
898 this->pending_updates
= updates
;
901 METHOD(ike_sa_t
, get_pending_updates
, u_int32_t
,
902 private_ike_sa_t
*this)
904 return this->pending_updates
;
907 METHOD(ike_sa_t
, float_ports
, void,
908 private_ike_sa_t
*this)
910 /* do not switch if we have a custom port from MOBIKE/NAT */
911 if (this->my_host
->get_port(this->my_host
) ==
912 charon
->socket
->get_port(charon
->socket
, FALSE
))
914 this->my_host
->set_port(this->my_host
,
915 charon
->socket
->get_port(charon
->socket
, TRUE
));
917 if (this->other_host
->get_port(this->other_host
) == IKEV2_UDP_PORT
)
919 this->other_host
->set_port(this->other_host
, IKEV2_NATT_PORT
);
923 METHOD(ike_sa_t
, update_hosts
, void,
924 private_ike_sa_t
*this, host_t
*me
, host_t
*other
, bool force
)
934 other
= this->other_host
;
937 /* apply hosts on first received message */
938 if (this->my_host
->is_anyaddr(this->my_host
) ||
939 this->other_host
->is_anyaddr(this->other_host
))
941 set_my_host(this, me
->clone(me
));
942 set_other_host(this, other
->clone(other
));
947 /* update our address in any case */
948 if (force
&& !me
->equals(me
, this->my_host
))
950 charon
->bus
->ike_update(charon
->bus
, &this->public, TRUE
, me
);
951 set_my_host(this, me
->clone(me
));
955 if (!other
->equals(other
, this->other_host
) &&
956 (force
|| has_condition(this, COND_NAT_THERE
)))
958 /* only update other's address if we are behind a static NAT,
959 * which we assume is the case if we are not initiator */
961 (!has_condition(this, COND_NAT_HERE
) ||
962 !has_condition(this, COND_ORIGINAL_INITIATOR
)))
964 charon
->bus
->ike_update(charon
->bus
, &this->public, FALSE
, other
);
965 set_other_host(this, other
->clone(other
));
971 /* update all associated CHILD_SAs, if required */
974 enumerator_t
*enumerator
;
975 child_sa_t
*child_sa
;
978 vips
= linked_list_create_from_enumerator(
979 array_create_enumerator(this->my_vips
));
981 enumerator
= array_create_enumerator(this->child_sas
);
982 while (enumerator
->enumerate(enumerator
, &child_sa
))
984 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, child_sa
);
985 charon
->child_sa_manager
->add(charon
->child_sa_manager
,
986 child_sa
, &this->public);
988 if (child_sa
->update(child_sa
, this->my_host
, this->other_host
,
989 vips
, has_condition(this, COND_NAT_ANY
)) == NOT_SUPPORTED
)
991 this->public.rekey_child_sa(&this->public,
992 child_sa
->get_protocol(child_sa
),
993 child_sa
->get_spi(child_sa
, TRUE
));
997 enumerator
->destroy(enumerator
);
1004 * Set configured DSCP value on packet
1006 static void set_dscp(private_ike_sa_t
*this, packet_t
*packet
)
1010 /* prefer IKE config on peer_cfg, as its selection is more accurate
1011 * then the initial IKE config */
1014 ike_cfg
= this->peer_cfg
->get_ike_cfg(this->peer_cfg
);
1018 ike_cfg
= this->ike_cfg
;
1022 packet
->set_dscp(packet
, ike_cfg
->get_dscp(ike_cfg
));
1026 METHOD(ike_sa_t
, generate_message
, status_t
,
1027 private_ike_sa_t
*this, message_t
*message
, packet_t
**packet
)
1031 if (message
->is_encoded(message
))
1032 { /* already encoded in task, but set DSCP value */
1033 *packet
= message
->get_packet(message
);
1034 set_dscp(this, *packet
);
1037 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
1038 message
->set_ike_sa_id(message
, this->ike_sa_id
);
1039 charon
->bus
->message(charon
->bus
, message
, FALSE
, TRUE
);
1040 status
= message
->generate(message
, this->keymat
, packet
);
1041 if (status
== SUCCESS
)
1043 set_dscp(this, *packet
);
1044 charon
->bus
->message(charon
->bus
, message
, FALSE
, FALSE
);
1049 static bool filter_fragments(private_ike_sa_t
*this, packet_t
**fragment
,
1052 *packet
= (*fragment
)->clone(*fragment
);
1053 set_dscp(this, *packet
);
1057 METHOD(ike_sa_t
, generate_message_fragmented
, status_t
,
1058 private_ike_sa_t
*this, message_t
*message
, enumerator_t
**packets
)
1060 enumerator_t
*fragments
;
1063 bool use_frags
= FALSE
;
1067 switch (this->ike_cfg
->fragmentation(this->ike_cfg
))
1069 case FRAGMENTATION_FORCE
:
1072 case FRAGMENTATION_YES
:
1073 use_frags
= supports_extension(this, EXT_IKE_FRAGMENTATION
);
1074 if (use_frags
&& this->version
== IKEV1
&&
1075 supports_extension(this, EXT_MS_WINDOWS
))
1077 /* It seems Windows 7 and 8 peers only accept proprietary
1078 * fragmented messages if they expect certificates. */
1079 use_frags
= message
->get_payload(message
,
1080 PLV1_CERTIFICATE
) != NULL
;
1089 status
= generate_message(this, message
, &packet
);
1090 if (status
!= SUCCESS
)
1094 *packets
= enumerator_create_single(packet
, NULL
);
1098 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
1099 message
->set_ike_sa_id(message
, this->ike_sa_id
);
1100 charon
->bus
->message(charon
->bus
, message
, FALSE
, TRUE
);
1101 status
= message
->fragment(message
, this->keymat
, this->fragment_size
,
1103 if (status
== SUCCESS
)
1105 charon
->bus
->message(charon
->bus
, message
, FALSE
, FALSE
);
1106 *packets
= enumerator_create_filter(fragments
, (void*)filter_fragments
,
1112 METHOD(ike_sa_t
, set_kmaddress
, void,
1113 private_ike_sa_t
*this, host_t
*local
, host_t
*remote
)
1115 DESTROY_IF(this->local_host
);
1116 DESTROY_IF(this->remote_host
);
1117 this->local_host
= local
->clone(local
);
1118 this->remote_host
= remote
->clone(remote
);
1122 METHOD(ike_sa_t
, act_as_mediation_server
, void,
1123 private_ike_sa_t
*this)
1125 charon
->mediation_manager
->update_sa_id(charon
->mediation_manager
,
1126 this->other_id
, this->ike_sa_id
);
1127 this->is_mediation_server
= TRUE
;
1130 METHOD(ike_sa_t
, get_server_reflexive_host
, host_t
*,
1131 private_ike_sa_t
*this)
1133 return this->server_reflexive_host
;
1136 METHOD(ike_sa_t
, set_server_reflexive_host
, void,
1137 private_ike_sa_t
*this, host_t
*host
)
1139 DESTROY_IF(this->server_reflexive_host
);
1140 this->server_reflexive_host
= host
;
1143 METHOD(ike_sa_t
, get_connect_id
, chunk_t
,
1144 private_ike_sa_t
*this)
1146 return this->connect_id
;
1149 METHOD(ike_sa_t
, respond
, status_t
,
1150 private_ike_sa_t
*this, identification_t
*peer_id
, chunk_t connect_id
)
1152 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1153 task
->respond(task
, peer_id
, connect_id
);
1154 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1155 return this->task_manager
->initiate(this->task_manager
);
1158 METHOD(ike_sa_t
, callback
, status_t
,
1159 private_ike_sa_t
*this, identification_t
*peer_id
)
1161 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1162 task
->callback(task
, peer_id
);
1163 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1164 return this->task_manager
->initiate(this->task_manager
);
1167 METHOD(ike_sa_t
, relay
, status_t
,
1168 private_ike_sa_t
*this, identification_t
*requester
, chunk_t connect_id
,
1169 chunk_t connect_key
, linked_list_t
*endpoints
, bool response
)
1171 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1172 task
->relay(task
, requester
, connect_id
, connect_key
, endpoints
, response
);
1173 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1174 return this->task_manager
->initiate(this->task_manager
);
1177 METHOD(ike_sa_t
, initiate_mediation
, status_t
,
1178 private_ike_sa_t
*this, peer_cfg_t
*mediated_cfg
)
1180 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1181 task
->connect(task
, mediated_cfg
->get_peer_id(mediated_cfg
));
1182 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1183 return this->task_manager
->initiate(this->task_manager
);
1186 METHOD(ike_sa_t
, initiate_mediated
, status_t
,
1187 private_ike_sa_t
*this, host_t
*me
, host_t
*other
, chunk_t connect_id
)
1189 set_my_host(this, me
->clone(me
));
1190 set_other_host(this, other
->clone(other
));
1191 chunk_free(&this->connect_id
);
1192 this->connect_id
= chunk_clone(connect_id
);
1193 return this->task_manager
->initiate(this->task_manager
);
1198 * Resolve DNS host in configuration
1200 static void resolve_hosts(private_ike_sa_t
*this)
1203 int family
= AF_UNSPEC
;
1205 switch (charon
->socket
->supported_families(charon
->socket
))
1207 case SOCKET_FAMILY_IPV4
:
1210 case SOCKET_FAMILY_IPV6
:
1213 case SOCKET_FAMILY_BOTH
:
1214 case SOCKET_FAMILY_NONE
:
1218 /* if an IP address is set locally, use the same family to resolve remote */
1219 if (family
== AF_UNSPEC
&& !this->remote_host
)
1221 if (this->local_host
)
1223 family
= this->local_host
->get_family(this->local_host
);
1227 family
= ike_cfg_get_family(this->ike_cfg
, TRUE
);
1231 if (this->remote_host
)
1233 host
= this->remote_host
->clone(this->remote_host
);
1234 host
->set_port(host
, IKEV2_UDP_PORT
);
1238 host
= this->ike_cfg
->resolve_other(this->ike_cfg
, family
);
1242 if (!host
->is_anyaddr(host
) ||
1243 this->other_host
->is_anyaddr(this->other_host
))
1244 { /* don't set to %any if we currently have an address, but the
1245 * address family might have changed */
1246 set_other_host(this, host
);
1249 { /* reuse the original port as some implementations might not like
1250 * initial IKE messages on other ports */
1251 this->other_host
->set_port(this->other_host
, host
->get_port(host
));
1252 host
->destroy(host
);
1256 if (this->local_host
)
1258 host
= this->local_host
->clone(this->local_host
);
1259 host
->set_port(host
, charon
->socket
->get_port(charon
->socket
, FALSE
));
1263 /* use same address family as for other */
1264 if (!this->other_host
->is_anyaddr(this->other_host
))
1266 family
= this->other_host
->get_family(this->other_host
);
1268 host
= this->ike_cfg
->resolve_me(this->ike_cfg
, family
);
1270 if (host
&& host
->is_anyaddr(host
) &&
1271 !this->other_host
->is_anyaddr(this->other_host
))
1273 host
->destroy(host
);
1274 host
= hydra
->kernel_interface
->get_source_addr(
1275 hydra
->kernel_interface
, this->other_host
, NULL
);
1278 host
->set_port(host
, this->ike_cfg
->get_my_port(this->ike_cfg
));
1281 { /* fallback to address family specific %any(6), if configured */
1282 host
= this->ike_cfg
->resolve_me(this->ike_cfg
, family
);
1288 set_my_host(this, host
);
1292 METHOD(ike_sa_t
, initiate
, status_t
,
1293 private_ike_sa_t
*this, child_cfg_t
*child_cfg
, u_int32_t reqid
,
1294 traffic_selector_t
*tsi
, traffic_selector_t
*tsr
)
1296 bool defer_initiate
= FALSE
;
1298 if (this->state
== IKE_CREATED
)
1300 if (this->my_host
->is_anyaddr(this->my_host
) ||
1301 this->other_host
->is_anyaddr(this->other_host
))
1303 resolve_hosts(this);
1306 if (this->other_host
->is_anyaddr(this->other_host
)
1308 && !this->peer_cfg
->get_mediated_by(this->peer_cfg
)
1314 addr
= this->ike_cfg
->get_other_addr(this->ike_cfg
);
1315 if (!this->retry_initiate_interval
)
1317 DBG1(DBG_IKE
, "unable to resolve %s, initiate aborted",
1319 DESTROY_IF(child_cfg
);
1320 charon
->bus
->alert(charon
->bus
, ALERT_PEER_ADDR_FAILED
);
1323 DBG1(DBG_IKE
, "unable to resolve %s, retrying in %ds",
1324 addr
, this->retry_initiate_interval
);
1325 defer_initiate
= TRUE
;
1328 set_condition(this, COND_ORIGINAL_INITIATOR
, TRUE
);
1329 this->task_manager
->queue_ike(this->task_manager
);
1333 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1335 if (this->state
== IKE_ESTABLISHED
)
1337 /* mediation connection is already established, retrigger state
1338 * change to notify bus listeners */
1339 DBG1(DBG_IKE
, "mediation connection is already up");
1340 set_state(this, IKE_ESTABLISHED
);
1342 DESTROY_IF(child_cfg
);
1348 /* normal IKE_SA with CHILD_SA */
1349 this->task_manager
->queue_child(this->task_manager
, child_cfg
, reqid
,
1352 if (this->peer_cfg
->get_mediated_by(this->peer_cfg
))
1354 /* mediated connection, initiate mediation process */
1355 job_t
*job
= (job_t
*)initiate_mediation_job_create(this->ike_sa_id
);
1356 lib
->processor
->queue_job(lib
->processor
, job
);
1364 if (!this->retry_initiate_queued
)
1366 job_t
*job
= (job_t
*)retry_initiate_job_create(this->ike_sa_id
);
1367 lib
->scheduler
->schedule_job(lib
->scheduler
, (job_t
*)job
,
1368 this->retry_initiate_interval
);
1369 this->retry_initiate_queued
= TRUE
;
1373 this->retry_initiate_queued
= FALSE
;
1374 return this->task_manager
->initiate(this->task_manager
);
1377 METHOD(ike_sa_t
, retry_initiate
, status_t
,
1378 private_ike_sa_t
*this)
1380 if (this->retry_initiate_queued
)
1382 this->retry_initiate_queued
= FALSE
;
1383 return initiate(this, NULL
, 0, NULL
, NULL
);
1388 METHOD(ike_sa_t
, process_message
, status_t
,
1389 private_ike_sa_t
*this, message_t
*message
)
1393 if (this->state
== IKE_PASSIVE
)
1394 { /* do not handle messages in passive state */
1397 if (message
->get_major_version(message
) != this->version
)
1399 DBG1(DBG_IKE
, "ignoring %N IKEv%u exchange on %N SA",
1400 exchange_type_names
, message
->get_exchange_type(message
),
1401 message
->get_major_version(message
),
1402 ike_version_names
, this->version
);
1403 /* TODO-IKEv1: fall back to IKEv1 if we receive an IKEv1
1404 * INVALID_MAJOR_VERSION on an IKEv2 SA. */
1407 status
= this->task_manager
->process_message(this->task_manager
, message
);
1408 if (this->flush_auth_cfg
&& this->state
== IKE_ESTABLISHED
)
1410 /* authentication completed */
1411 this->flush_auth_cfg
= FALSE
;
1412 flush_auth_cfgs(this);
1417 METHOD(ike_sa_t
, get_id
, ike_sa_id_t
*,
1418 private_ike_sa_t
*this)
1420 return this->ike_sa_id
;
1423 METHOD(ike_sa_t
, get_version
, ike_version_t
,
1424 private_ike_sa_t
*this)
1426 return this->version
;
1429 METHOD(ike_sa_t
, get_my_id
, identification_t
*,
1430 private_ike_sa_t
*this)
1435 METHOD(ike_sa_t
, set_my_id
, void,
1436 private_ike_sa_t
*this, identification_t
*me
)
1438 DESTROY_IF(this->my_id
);
1442 METHOD(ike_sa_t
, get_other_id
, identification_t
*,
1443 private_ike_sa_t
*this)
1445 return this->other_id
;
1448 METHOD(ike_sa_t
, get_other_eap_id
, identification_t
*,
1449 private_ike_sa_t
*this)
1451 identification_t
*id
= NULL
, *current
;
1452 enumerator_t
*enumerator
;
1455 enumerator
= array_create_enumerator(this->other_auths
);
1456 while (enumerator
->enumerate(enumerator
, &cfg
))
1458 /* prefer EAP-Identity of last round */
1459 current
= cfg
->get(cfg
, AUTH_RULE_EAP_IDENTITY
);
1460 if (!current
|| current
->get_type(current
) == ID_ANY
)
1462 current
= cfg
->get(cfg
, AUTH_RULE_XAUTH_IDENTITY
);
1464 if (!current
|| current
->get_type(current
) == ID_ANY
)
1466 current
= cfg
->get(cfg
, AUTH_RULE_IDENTITY
);
1468 if (current
&& current
->get_type(current
) != ID_ANY
)
1474 enumerator
->destroy(enumerator
);
1479 return this->other_id
;
1482 METHOD(ike_sa_t
, set_other_id
, void,
1483 private_ike_sa_t
*this, identification_t
*other
)
1485 DESTROY_IF(this->other_id
);
1486 this->other_id
= other
;
1489 METHOD(ike_sa_t
, add_child_sa
, void,
1490 private_ike_sa_t
*this, child_sa_t
*child_sa
)
1492 array_insert_create(&this->child_sas
, ARRAY_TAIL
, child_sa
);
1493 charon
->child_sa_manager
->add(charon
->child_sa_manager
,
1494 child_sa
, &this->public);
1497 METHOD(ike_sa_t
, get_child_sa
, child_sa_t
*,
1498 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
, bool inbound
)
1500 enumerator_t
*enumerator
;
1501 child_sa_t
*current
, *found
= NULL
;
1503 enumerator
= array_create_enumerator(this->child_sas
);
1504 while (enumerator
->enumerate(enumerator
, (void**)¤t
))
1506 if (current
->get_spi(current
, inbound
) == spi
&&
1507 current
->get_protocol(current
) == protocol
)
1512 enumerator
->destroy(enumerator
);
1516 METHOD(ike_sa_t
, get_child_count
, int,
1517 private_ike_sa_t
*this)
1519 return array_count(this->child_sas
);
1523 * Private data of a create_child_sa_enumerator()
1526 /** implements enumerator */
1527 enumerator_t
public;
1528 /** inner array enumerator */
1529 enumerator_t
*inner
;
1531 child_sa_t
*current
;
1532 } child_enumerator_t
;
1534 METHOD(enumerator_t
, child_enumerate
, bool,
1535 child_enumerator_t
*this, child_sa_t
**child_sa
)
1537 if (this->inner
->enumerate(this->inner
, &this->current
))
1539 *child_sa
= this->current
;
1545 METHOD(enumerator_t
, child_enumerator_destroy
, void,
1546 child_enumerator_t
*this)
1548 this->inner
->destroy(this->inner
);
1552 METHOD(ike_sa_t
, create_child_sa_enumerator
, enumerator_t
*,
1553 private_ike_sa_t
*this)
1555 child_enumerator_t
*enumerator
;
1559 .enumerate
= (void*)_child_enumerate
,
1560 .destroy
= _child_enumerator_destroy
,
1562 .inner
= array_create_enumerator(this->child_sas
),
1564 return &enumerator
->public;
1567 METHOD(ike_sa_t
, remove_child_sa
, void,
1568 private_ike_sa_t
*this, enumerator_t
*enumerator
)
1570 child_enumerator_t
*ce
= (child_enumerator_t
*)enumerator
;
1572 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, ce
->current
);
1573 array_remove_at(this->child_sas
, ce
->inner
);
1576 METHOD(ike_sa_t
, rekey_child_sa
, status_t
,
1577 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1579 if (this->state
== IKE_PASSIVE
)
1581 return INVALID_STATE
;
1583 this->task_manager
->queue_child_rekey(this->task_manager
, protocol
, spi
);
1584 return this->task_manager
->initiate(this->task_manager
);
1587 METHOD(ike_sa_t
, delete_child_sa
, status_t
,
1588 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
, bool expired
)
1590 if (this->state
== IKE_PASSIVE
)
1592 return INVALID_STATE
;
1594 this->task_manager
->queue_child_delete(this->task_manager
,
1595 protocol
, spi
, expired
);
1596 return this->task_manager
->initiate(this->task_manager
);
1599 METHOD(ike_sa_t
, destroy_child_sa
, status_t
,
1600 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1602 enumerator_t
*enumerator
;
1603 child_sa_t
*child_sa
;
1604 status_t status
= NOT_FOUND
;
1606 enumerator
= create_child_sa_enumerator(this);
1607 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1609 if (child_sa
->get_protocol(child_sa
) == protocol
&&
1610 child_sa
->get_spi(child_sa
, TRUE
) == spi
)
1612 remove_child_sa(this, enumerator
);
1613 child_sa
->destroy(child_sa
);
1618 enumerator
->destroy(enumerator
);
1622 METHOD(ike_sa_t
, delete_
, status_t
,
1623 private_ike_sa_t
*this)
1625 switch (this->state
)
1628 if (this->version
== IKEV1
)
1629 { /* SA has been reauthenticated, delete */
1630 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
1634 case IKE_ESTABLISHED
:
1635 if (time_monotonic(NULL
) >= this->stats
[STAT_DELETE
])
1636 { /* IKE_SA hard lifetime hit */
1637 charon
->bus
->alert(charon
->bus
, ALERT_IKE_SA_EXPIRED
);
1639 this->task_manager
->queue_ike_delete(this->task_manager
);
1640 return this->task_manager
->initiate(this->task_manager
);
1642 DBG1(DBG_IKE
, "deleting unestablished IKE_SA");
1647 DBG1(DBG_IKE
, "destroying IKE_SA in state %N "
1648 "without notification", ike_sa_state_names
, this->state
);
1649 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
1655 METHOD(ike_sa_t
, rekey
, status_t
,
1656 private_ike_sa_t
*this)
1658 if (this->state
== IKE_PASSIVE
)
1660 return INVALID_STATE
;
1662 this->task_manager
->queue_ike_rekey(this->task_manager
);
1663 return this->task_manager
->initiate(this->task_manager
);
1666 METHOD(ike_sa_t
, reauth
, status_t
,
1667 private_ike_sa_t
*this)
1669 if (this->state
== IKE_PASSIVE
)
1671 return INVALID_STATE
;
1673 if (this->state
== IKE_CONNECTING
)
1675 DBG0(DBG_IKE
, "reinitiating IKE_SA %s[%d]",
1676 get_name(this), this->unique_id
);
1678 this->task_manager
->queue_ike(this->task_manager
);
1679 return this->task_manager
->initiate(this->task_manager
);
1681 /* we can't reauthenticate as responder when we use EAP or virtual IPs.
1682 * If the peer does not support RFC4478, there is no way to keep the
1684 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
1686 DBG1(DBG_IKE
, "initiator did not reauthenticate as requested");
1687 if (array_count(this->other_vips
) != 0 ||
1688 has_condition(this, COND_XAUTH_AUTHENTICATED
) ||
1689 has_condition(this, COND_EAP_AUTHENTICATED
)
1691 /* as mediation server we too cannot reauth the IKE_SA */
1692 || this->is_mediation_server
1698 del
= this->stats
[STAT_DELETE
];
1699 now
= time_monotonic(NULL
);
1700 DBG1(DBG_IKE
, "IKE_SA %s[%d] will timeout in %V",
1701 get_name(this), this->unique_id
, &now
, &del
);
1706 DBG0(DBG_IKE
, "reauthenticating IKE_SA %s[%d] actively",
1707 get_name(this), this->unique_id
);
1712 DBG0(DBG_IKE
, "reauthenticating IKE_SA %s[%d]",
1713 get_name(this), this->unique_id
);
1715 set_condition(this, COND_REAUTHENTICATING
, TRUE
);
1716 this->task_manager
->queue_ike_reauth(this->task_manager
);
1717 return this->task_manager
->initiate(this->task_manager
);
1721 * Check if tasks to create CHILD_SAs are queued in the given queue
1723 static bool is_child_queued(private_ike_sa_t
*this, task_queue_t queue
)
1725 enumerator_t
*enumerator
;
1729 enumerator
= this->task_manager
->create_task_enumerator(this->task_manager
,
1731 while (enumerator
->enumerate(enumerator
, &task
))
1733 if (task
->get_type(task
) == TASK_CHILD_CREATE
||
1734 task
->get_type(task
) == TASK_QUICK_MODE
)
1740 enumerator
->destroy(enumerator
);
1744 METHOD(ike_sa_t
, reestablish
, status_t
,
1745 private_ike_sa_t
*this)
1750 enumerator_t
*enumerator
;
1751 child_sa_t
*child_sa
;
1752 child_cfg_t
*child_cfg
;
1753 bool restart
= FALSE
;
1754 status_t status
= FAILED
;
1756 if (has_condition(this, COND_REAUTHENTICATING
))
1757 { /* only reauthenticate if we have children */
1758 if (array_count(this->child_sas
) == 0
1760 /* allow reauth of mediation connections without CHILD_SAs */
1761 && !this->peer_cfg
->is_mediation(this->peer_cfg
)
1765 DBG1(DBG_IKE
, "unable to reauthenticate IKE_SA, no CHILD_SA "
1774 { /* check if we have children to keep up at all */
1775 enumerator
= array_create_enumerator(this->child_sas
);
1776 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1778 if (this->state
== IKE_DELETING
)
1780 action
= child_sa
->get_close_action(child_sa
);
1784 action
= child_sa
->get_dpd_action(child_sa
);
1788 case ACTION_RESTART
:
1792 charon
->traps
->install(charon
->traps
, this->peer_cfg
,
1793 child_sa
->get_config(child_sa
),
1794 child_sa
->get_reqid(child_sa
));
1800 enumerator
->destroy(enumerator
);
1801 /* check if we have tasks that recreate children */
1804 restart
= is_child_queued(this, TASK_QUEUE_ACTIVE
) ||
1805 is_child_queued(this, TASK_QUEUE_QUEUED
);
1808 /* mediation connections have no children, keep them up anyway */
1809 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1820 /* check if we are able to reestablish this IKE_SA */
1821 if (!has_condition(this, COND_ORIGINAL_INITIATOR
) &&
1822 (array_count(this->other_vips
) != 0 ||
1823 has_condition(this, COND_EAP_AUTHENTICATED
)
1825 || this->is_mediation_server
1829 DBG1(DBG_IKE
, "unable to reestablish IKE_SA due to asymmetric setup");
1833 new = charon
->ike_sa_manager
->checkout_new(charon
->ike_sa_manager
,
1834 this->version
, TRUE
);
1839 new->set_peer_cfg(new, this->peer_cfg
);
1840 host
= this->other_host
;
1841 new->set_other_host(new, host
->clone(host
));
1842 host
= this->my_host
;
1843 new->set_my_host(new, host
->clone(host
));
1844 charon
->bus
->ike_reestablish_pre(charon
->bus
, &this->public, new);
1845 /* resolve hosts but use the old addresses above as fallback */
1846 resolve_hosts((private_ike_sa_t
*)new);
1847 /* if we already have a virtual IP, we reuse it */
1848 enumerator
= array_create_enumerator(this->my_vips
);
1849 while (enumerator
->enumerate(enumerator
, &host
))
1851 new->add_virtual_ip(new, TRUE
, host
);
1853 enumerator
->destroy(enumerator
);
1856 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1858 status
= new->initiate(new, NULL
, 0, NULL
, NULL
);
1863 /* handle existing CHILD_SAs */
1864 enumerator
= create_child_sa_enumerator(this);
1865 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1867 if (has_condition(this, COND_REAUTHENTICATING
))
1869 switch (child_sa
->get_state(child_sa
))
1872 { /* move routed child directly */
1873 remove_child_sa(this, enumerator
);
1874 new->add_child_sa(new, child_sa
);
1875 action
= ACTION_NONE
;
1879 { /* initiate/queue all other CHILD_SAs */
1880 action
= ACTION_RESTART
;
1886 { /* only restart CHILD_SAs that are configured accordingly */
1887 if (this->state
== IKE_DELETING
)
1889 action
= child_sa
->get_close_action(child_sa
);
1893 action
= child_sa
->get_dpd_action(child_sa
);
1898 case ACTION_RESTART
:
1899 child_cfg
= child_sa
->get_config(child_sa
);
1900 DBG1(DBG_IKE
, "restarting CHILD_SA %s",
1901 child_cfg
->get_name(child_cfg
));
1902 child_cfg
->get_ref(child_cfg
);
1903 status
= new->initiate(new, child_cfg
,
1904 child_sa
->get_reqid(child_sa
), NULL
, NULL
);
1909 if (status
== DESTROY_ME
)
1914 enumerator
->destroy(enumerator
);
1915 /* adopt any active or queued CHILD-creating tasks */
1916 if (status
!= DESTROY_ME
)
1918 task_manager_t
*other_tasks
= ((private_ike_sa_t
*)new)->task_manager
;
1919 other_tasks
->adopt_child_tasks(other_tasks
, this->task_manager
);
1920 if (new->get_state(new) == IKE_CREATED
)
1922 status
= new->initiate(new, NULL
, 0, NULL
, NULL
);
1927 if (status
== DESTROY_ME
)
1929 charon
->bus
->ike_reestablish_post(charon
->bus
, &this->public, new,
1931 charon
->ike_sa_manager
->checkin_and_destroy(charon
->ike_sa_manager
, new);
1936 charon
->bus
->ike_reestablish_post(charon
->bus
, &this->public, new,
1938 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, new);
1941 charon
->bus
->set_sa(charon
->bus
, &this->public);
1945 METHOD(ike_sa_t
, retransmit
, status_t
,
1946 private_ike_sa_t
*this, u_int32_t message_id
)
1948 if (this->state
== IKE_PASSIVE
)
1950 return INVALID_STATE
;
1952 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
1953 if (this->task_manager
->retransmit(this->task_manager
, message_id
) != SUCCESS
)
1955 /* send a proper signal to brief interested bus listeners */
1956 switch (this->state
)
1958 case IKE_CONNECTING
:
1960 /* retry IKE_SA_INIT/Main Mode if we have multiple keyingtries */
1961 u_int32_t tries
= this->peer_cfg
->get_keyingtries(this->peer_cfg
);
1962 charon
->bus
->alert(charon
->bus
, ALERT_PEER_INIT_UNREACHABLE
,
1965 if (tries
== 0 || tries
> this->keyingtry
)
1967 DBG1(DBG_IKE
, "peer not responding, trying again (%d/%d)",
1968 this->keyingtry
+ 1, tries
);
1970 resolve_hosts(this);
1971 this->task_manager
->queue_ike(this->task_manager
);
1972 return this->task_manager
->initiate(this->task_manager
);
1974 DBG1(DBG_IKE
, "establishing IKE_SA failed, peer not responding");
1978 DBG1(DBG_IKE
, "proper IKE_SA delete failed, peer not responding");
1979 if (has_condition(this, COND_REAUTHENTICATING
))
1981 DBG1(DBG_IKE
, "delete during reauthentication failed, "
1982 "trying to reestablish IKE_SA anyway");
1987 DBG1(DBG_IKE
, "rekeying IKE_SA failed, peer not responding");
1993 if (this->state
!= IKE_CONNECTING
)
1995 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
2002 METHOD(ike_sa_t
, set_auth_lifetime
, status_t
,
2003 private_ike_sa_t
*this, u_int32_t lifetime
)
2005 u_int32_t diff
, hard
, soft
, now
;
2008 diff
= this->peer_cfg
->get_over_time(this->peer_cfg
);
2009 now
= time_monotonic(NULL
);
2010 hard
= now
+ lifetime
;
2013 /* check if we have to send an AUTH_LIFETIME to enforce the new lifetime.
2014 * We send the notify in IKE_AUTH if not yet ESTABLISHED. */
2015 send_update
= this->state
== IKE_ESTABLISHED
&& this->version
== IKEV2
&&
2016 !has_condition(this, COND_ORIGINAL_INITIATOR
) &&
2017 (array_count(this->other_vips
) != 0 ||
2018 has_condition(this, COND_EAP_AUTHENTICATED
));
2020 if (lifetime
< diff
)
2022 this->stats
[STAT_REAUTH
] = now
;
2026 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, "
2027 "starting reauthentication", lifetime
);
2028 lib
->processor
->queue_job(lib
->processor
,
2029 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
));
2032 else if (this->stats
[STAT_REAUTH
] == 0 ||
2033 this->stats
[STAT_REAUTH
] > soft
)
2035 this->stats
[STAT_REAUTH
] = soft
;
2038 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, scheduling "
2039 "reauthentication in %ds", lifetime
, lifetime
- diff
);
2040 lib
->scheduler
->schedule_job(lib
->scheduler
,
2041 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
),
2047 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, "
2048 "reauthentication already scheduled in %ds", lifetime
,
2049 this->stats
[STAT_REAUTH
] - time_monotonic(NULL
));
2050 send_update
= FALSE
;
2052 /* give at least some seconds to reauthenticate */
2053 this->stats
[STAT_DELETE
] = max(hard
, now
+ 10);
2058 ike_auth_lifetime_t
*task
;
2060 task
= ike_auth_lifetime_create(&this->public, TRUE
);
2061 this->task_manager
->queue_task(this->task_manager
, &task
->task
);
2062 return this->task_manager
->initiate(this->task_manager
);
2069 * Check if the current combination of source and destination address is still
2072 static bool is_current_path_valid(private_ike_sa_t
*this)
2076 src
= hydra
->kernel_interface
->get_source_addr(hydra
->kernel_interface
,
2077 this->other_host
, this->my_host
);
2080 if (src
->ip_equals(src
, this->my_host
))
2090 * Check if we have any path avialable for this IKE SA.
2092 static bool is_any_path_valid(private_ike_sa_t
*this)
2095 enumerator_t
*enumerator
;
2096 host_t
*src
= NULL
, *addr
;
2097 int family
= AF_UNSPEC
;
2099 switch (charon
->socket
->supported_families(charon
->socket
))
2101 case SOCKET_FAMILY_IPV4
:
2104 case SOCKET_FAMILY_IPV6
:
2107 case SOCKET_FAMILY_BOTH
:
2108 case SOCKET_FAMILY_NONE
:
2112 DBG1(DBG_IKE
, "old path is not available anymore, try to find another");
2113 enumerator
= create_peer_address_enumerator(this);
2114 while (enumerator
->enumerate(enumerator
, &addr
))
2116 if (family
!= AF_UNSPEC
&& addr
->get_family(addr
) != family
)
2120 DBG1(DBG_IKE
, "looking for a route to %H ...", addr
);
2121 src
= hydra
->kernel_interface
->get_source_addr(
2122 hydra
->kernel_interface
, addr
, NULL
);
2128 enumerator
->destroy(enumerator
);
2137 METHOD(ike_sa_t
, roam
, status_t
,
2138 private_ike_sa_t
*this, bool address
)
2140 switch (this->state
)
2144 case IKE_DESTROYING
:
2151 /* keep existing path if possible */
2152 if (is_current_path_valid(this))
2154 DBG2(DBG_IKE
, "keeping connection path %H - %H",
2155 this->my_host
, this->other_host
);
2156 set_condition(this, COND_STALE
, FALSE
);
2158 if (supports_extension(this, EXT_MOBIKE
) && address
)
2159 { /* if any addresses changed, send an updated list */
2160 DBG1(DBG_IKE
, "sending address list update using MOBIKE");
2161 this->task_manager
->queue_mobike(this->task_manager
, FALSE
, TRUE
);
2162 return this->task_manager
->initiate(this->task_manager
);
2167 if (!is_any_path_valid(this))
2169 DBG1(DBG_IKE
, "no route found to reach %H, MOBIKE update deferred",
2171 set_condition(this, COND_STALE
, TRUE
);
2174 set_condition(this, COND_STALE
, FALSE
);
2176 /* update addresses with mobike, if supported ... */
2177 if (supports_extension(this, EXT_MOBIKE
))
2179 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
2180 { /* responder updates the peer about changed address config */
2181 DBG1(DBG_IKE
, "sending address list update using MOBIKE, "
2182 "implicitly requesting an address change");
2187 DBG1(DBG_IKE
, "requesting address change using MOBIKE");
2189 this->task_manager
->queue_mobike(this->task_manager
, TRUE
, address
);
2190 return this->task_manager
->initiate(this->task_manager
);
2193 /* ... reauth if not */
2194 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
2195 { /* responder does not reauthenticate */
2196 set_condition(this, COND_STALE
, TRUE
);
2199 DBG1(DBG_IKE
, "reauthenticating IKE_SA due to address change");
2200 /* since our previous path is not valid anymore, try and find a new one */
2201 resolve_hosts(this);
2202 return reauth(this);
2205 METHOD(ike_sa_t
, add_configuration_attribute
, void,
2206 private_ike_sa_t
*this, attribute_handler_t
*handler
,
2207 configuration_attribute_type_t type
, chunk_t data
)
2209 attribute_entry_t entry
= {
2212 .data
= chunk_clone(data
),
2214 array_insert(this->attributes
, ARRAY_TAIL
, &entry
);
2218 * Enumerator filter for attributes
2220 static bool filter_attribute(void *null
, attribute_entry_t
**in
,
2221 configuration_attribute_type_t
*type
, void *in2
,
2222 chunk_t
*data
, void *in3
, bool *handled
)
2224 *type
= (*in
)->type
;
2225 *data
= (*in
)->data
;
2226 *handled
= (*in
)->handler
!= NULL
;
2230 METHOD(ike_sa_t
, create_attribute_enumerator
, enumerator_t
*,
2231 private_ike_sa_t
*this)
2233 return enumerator_create_filter(array_create_enumerator(this->attributes
),
2234 (void*)filter_attribute
, NULL
, NULL
);
2237 METHOD(ike_sa_t
, create_task_enumerator
, enumerator_t
*,
2238 private_ike_sa_t
*this, task_queue_t queue
)
2240 return this->task_manager
->create_task_enumerator(this->task_manager
, queue
);
2243 METHOD(ike_sa_t
, flush_queue
, void,
2244 private_ike_sa_t
*this, task_queue_t queue
)
2246 this->task_manager
->flush_queue(this->task_manager
, queue
);
2249 METHOD(ike_sa_t
, queue_task
, void,
2250 private_ike_sa_t
*this, task_t
*task
)
2252 this->task_manager
->queue_task(this->task_manager
, task
);
2255 METHOD(ike_sa_t
, inherit_pre
, void,
2256 private_ike_sa_t
*this, ike_sa_t
*other_public
)
2258 private_ike_sa_t
*other
= (private_ike_sa_t
*)other_public
;
2260 /* apply config and hosts */
2261 set_peer_cfg(this, other
->peer_cfg
);
2262 set_my_host(this, other
->my_host
->clone(other
->my_host
));
2263 set_other_host(this, other
->other_host
->clone(other
->other_host
));
2265 /* apply extensions and conditions with a few exceptions */
2266 this->extensions
= other
->extensions
;
2267 this->conditions
= other
->conditions
;
2268 this->conditions
&= ~COND_STALE
;
2269 this->conditions
&= ~COND_REAUTHENTICATING
;
2272 METHOD(ike_sa_t
, inherit_post
, void,
2273 private_ike_sa_t
*this, ike_sa_t
*other_public
)
2275 private_ike_sa_t
*other
= (private_ike_sa_t
*)other_public
;
2276 child_sa_t
*child_sa
;
2277 enumerator_t
*enumerator
;
2278 attribute_entry_t entry
;
2282 /* apply hosts and ids */
2283 this->my_host
->destroy(this->my_host
);
2284 this->other_host
->destroy(this->other_host
);
2285 this->my_id
->destroy(this->my_id
);
2286 this->other_id
->destroy(this->other_id
);
2287 this->my_host
= other
->my_host
->clone(other
->my_host
);
2288 this->other_host
= other
->other_host
->clone(other
->other_host
);
2289 this->my_id
= other
->my_id
->clone(other
->my_id
);
2290 this->other_id
= other
->other_id
->clone(other
->other_id
);
2292 /* apply assigned virtual IPs... */
2293 while (array_remove(other
->my_vips
, ARRAY_HEAD
, &vip
))
2295 array_insert_create(&this->my_vips
, ARRAY_TAIL
, vip
);
2297 while (array_remove(other
->other_vips
, ARRAY_HEAD
, &vip
))
2299 array_insert_create(&this->other_vips
, ARRAY_TAIL
, vip
);
2302 /* MOBIKE additional addresses */
2303 while (array_remove(other
->peer_addresses
, ARRAY_HEAD
, &vip
))
2305 array_insert_create(&this->peer_addresses
, ARRAY_TAIL
, vip
);
2308 /* authentication information */
2309 enumerator
= array_create_enumerator(other
->my_auths
);
2310 while (enumerator
->enumerate(enumerator
, &cfg
))
2312 array_insert(this->my_auths
, ARRAY_TAIL
, cfg
->clone(cfg
));
2314 enumerator
->destroy(enumerator
);
2315 enumerator
= array_create_enumerator(other
->other_auths
);
2316 while (enumerator
->enumerate(enumerator
, &cfg
))
2318 array_insert(this->other_auths
, ARRAY_TAIL
, cfg
->clone(cfg
));
2320 enumerator
->destroy(enumerator
);
2322 /* ... and configuration attributes */
2323 while (array_remove(other
->attributes
, ARRAY_HEAD
, &entry
))
2325 array_insert(this->attributes
, ARRAY_TAIL
, &entry
);
2328 /* inherit all conditions */
2329 this->conditions
= other
->conditions
;
2330 if (this->conditions
& COND_NAT_HERE
)
2332 send_keepalive(this);
2336 if (other
->is_mediation_server
)
2338 act_as_mediation_server(this);
2340 else if (other
->server_reflexive_host
)
2342 this->server_reflexive_host
= other
->server_reflexive_host
->clone(
2343 other
->server_reflexive_host
);
2347 /* adopt all children */
2348 while (array_remove(other
->child_sas
, ARRAY_HEAD
, &child_sa
))
2350 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, child_sa
);
2351 add_child_sa(this, child_sa
);
2354 /* move pending tasks to the new IKE_SA */
2355 this->task_manager
->adopt_tasks(this->task_manager
, other
->task_manager
);
2357 /* reauthentication timeout survives a rekeying */
2358 if (other
->stats
[STAT_REAUTH
])
2360 time_t reauth
, delete, now
= time_monotonic(NULL
);
2362 this->stats
[STAT_REAUTH
] = other
->stats
[STAT_REAUTH
];
2363 reauth
= this->stats
[STAT_REAUTH
] - now
;
2364 delete = reauth
+ this->peer_cfg
->get_over_time(this->peer_cfg
);
2365 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
] + delete;
2366 DBG1(DBG_IKE
, "rescheduling reauthentication in %ds after rekeying, "
2367 "lifetime reduced to %ds", reauth
, delete);
2368 lib
->scheduler
->schedule_job(lib
->scheduler
,
2369 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
), reauth
);
2370 lib
->scheduler
->schedule_job(lib
->scheduler
,
2371 (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
), delete);
2375 METHOD(ike_sa_t
, destroy
, void,
2376 private_ike_sa_t
*this)
2378 attribute_entry_t entry
;
2379 child_sa_t
*child_sa
;
2382 charon
->bus
->set_sa(charon
->bus
, &this->public);
2384 set_state(this, IKE_DESTROYING
);
2385 if (this->task_manager
)
2387 this->task_manager
->flush(this->task_manager
);
2390 /* remove attributes first, as we pass the IKE_SA to the handler */
2391 charon
->bus
->handle_vips(charon
->bus
, &this->public, FALSE
);
2392 while (array_remove(this->attributes
, ARRAY_TAIL
, &entry
))
2396 charon
->attributes
->release(charon
->attributes
, entry
.handler
,
2397 &this->public, entry
.type
, entry
.data
);
2399 free(entry
.data
.ptr
);
2401 /* uninstall CHILD_SAs before virtual IPs, otherwise we might kill
2402 * routes that the CHILD_SA tries to uninstall. */
2403 while (array_remove(this->child_sas
, ARRAY_TAIL
, &child_sa
))
2405 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, child_sa
);
2406 child_sa
->destroy(child_sa
);
2408 while (array_remove(this->my_vips
, ARRAY_TAIL
, &vip
))
2410 hydra
->kernel_interface
->del_ip(hydra
->kernel_interface
, vip
, -1, TRUE
);
2413 if (array_count(this->other_vips
))
2415 charon
->bus
->assign_vips(charon
->bus
, &this->public, FALSE
);
2417 while (array_remove(this->other_vips
, ARRAY_TAIL
, &vip
))
2421 linked_list_t
*pools
;
2423 pools
= linked_list_create_from_enumerator(
2424 this->peer_cfg
->create_pool_enumerator(this->peer_cfg
));
2425 charon
->attributes
->release_address(charon
->attributes
,
2426 pools
, vip
, &this->public);
2427 pools
->destroy(pools
);
2432 /* unset SA after here to avoid usage by the listeners */
2433 charon
->bus
->set_sa(charon
->bus
, NULL
);
2435 array_destroy(this->child_sas
);
2436 DESTROY_IF(this->task_manager
);
2437 DESTROY_IF(this->keymat
);
2438 array_destroy(this->attributes
);
2439 array_destroy(this->my_vips
);
2440 array_destroy(this->other_vips
);
2441 array_destroy_offset(this->peer_addresses
, offsetof(host_t
, destroy
));
2443 if (this->is_mediation_server
)
2445 charon
->mediation_manager
->remove(charon
->mediation_manager
,
2448 DESTROY_IF(this->server_reflexive_host
);
2449 chunk_free(&this->connect_id
);
2451 free(this->nat_detection_dest
.ptr
);
2453 DESTROY_IF(this->my_host
);
2454 DESTROY_IF(this->other_host
);
2455 DESTROY_IF(this->my_id
);
2456 DESTROY_IF(this->other_id
);
2457 DESTROY_IF(this->local_host
);
2458 DESTROY_IF(this->remote_host
);
2460 DESTROY_IF(this->ike_cfg
);
2461 DESTROY_IF(this->peer_cfg
);
2462 DESTROY_IF(this->proposal
);
2463 this->my_auth
->destroy(this->my_auth
);
2464 this->other_auth
->destroy(this->other_auth
);
2465 array_destroy_offset(this->my_auths
, offsetof(auth_cfg_t
, destroy
));
2466 array_destroy_offset(this->other_auths
, offsetof(auth_cfg_t
, destroy
));
2468 this->ike_sa_id
->destroy(this->ike_sa_id
);
2473 * Described in header.
2475 ike_sa_t
* ike_sa_create(ike_sa_id_t
*ike_sa_id
, bool initiator
,
2476 ike_version_t version
)
2478 private_ike_sa_t
*this;
2479 static refcount_t unique_id
= 0;
2481 if (version
== IKE_ANY
)
2482 { /* prefer IKEv2 if protocol not specified */
2492 .get_version
= _get_version
,
2493 .get_state
= _get_state
,
2494 .set_state
= _set_state
,
2495 .get_name
= _get_name
,
2496 .get_statistic
= _get_statistic
,
2497 .set_statistic
= _set_statistic
,
2498 .process_message
= _process_message
,
2499 .initiate
= _initiate
,
2500 .retry_initiate
= _retry_initiate
,
2501 .get_ike_cfg
= _get_ike_cfg
,
2502 .set_ike_cfg
= _set_ike_cfg
,
2503 .get_peer_cfg
= _get_peer_cfg
,
2504 .set_peer_cfg
= _set_peer_cfg
,
2505 .get_auth_cfg
= _get_auth_cfg
,
2506 .create_auth_cfg_enumerator
= _create_auth_cfg_enumerator
,
2507 .add_auth_cfg
= _add_auth_cfg
,
2508 .get_proposal
= _get_proposal
,
2509 .set_proposal
= _set_proposal
,
2511 .get_my_host
= _get_my_host
,
2512 .set_my_host
= _set_my_host
,
2513 .get_other_host
= _get_other_host
,
2514 .set_other_host
= _set_other_host
,
2515 .set_message_id
= _set_message_id
,
2516 .float_ports
= _float_ports
,
2517 .update_hosts
= _update_hosts
,
2518 .get_my_id
= _get_my_id
,
2519 .set_my_id
= _set_my_id
,
2520 .get_other_id
= _get_other_id
,
2521 .set_other_id
= _set_other_id
,
2522 .get_other_eap_id
= _get_other_eap_id
,
2523 .enable_extension
= _enable_extension
,
2524 .supports_extension
= _supports_extension
,
2525 .set_condition
= _set_condition
,
2526 .has_condition
= _has_condition
,
2527 .set_pending_updates
= _set_pending_updates
,
2528 .get_pending_updates
= _get_pending_updates
,
2529 .create_peer_address_enumerator
= _create_peer_address_enumerator
,
2530 .add_peer_address
= _add_peer_address
,
2531 .clear_peer_addresses
= _clear_peer_addresses
,
2532 .has_mapping_changed
= _has_mapping_changed
,
2533 .retransmit
= _retransmit
,
2535 .destroy
= _destroy
,
2536 .send_dpd
= _send_dpd
,
2537 .send_keepalive
= _send_keepalive
,
2538 .get_keymat
= _get_keymat
,
2539 .add_child_sa
= _add_child_sa
,
2540 .get_child_sa
= _get_child_sa
,
2541 .get_child_count
= _get_child_count
,
2542 .create_child_sa_enumerator
= _create_child_sa_enumerator
,
2543 .remove_child_sa
= _remove_child_sa
,
2544 .rekey_child_sa
= _rekey_child_sa
,
2545 .delete_child_sa
= _delete_child_sa
,
2546 .destroy_child_sa
= _destroy_child_sa
,
2549 .reestablish
= _reestablish
,
2550 .set_auth_lifetime
= _set_auth_lifetime
,
2552 .inherit_pre
= _inherit_pre
,
2553 .inherit_post
= _inherit_post
,
2554 .generate_message
= _generate_message
,
2555 .generate_message_fragmented
= _generate_message_fragmented
,
2557 .get_unique_id
= _get_unique_id
,
2558 .add_virtual_ip
= _add_virtual_ip
,
2559 .clear_virtual_ips
= _clear_virtual_ips
,
2560 .create_virtual_ip_enumerator
= _create_virtual_ip_enumerator
,
2561 .add_configuration_attribute
= _add_configuration_attribute
,
2562 .create_attribute_enumerator
= _create_attribute_enumerator
,
2563 .set_kmaddress
= _set_kmaddress
,
2564 .create_task_enumerator
= _create_task_enumerator
,
2565 .flush_queue
= _flush_queue
,
2566 .queue_task
= _queue_task
,
2568 .act_as_mediation_server
= _act_as_mediation_server
,
2569 .get_server_reflexive_host
= _get_server_reflexive_host
,
2570 .set_server_reflexive_host
= _set_server_reflexive_host
,
2571 .get_connect_id
= _get_connect_id
,
2572 .initiate_mediation
= _initiate_mediation
,
2573 .initiate_mediated
= _initiate_mediated
,
2575 .callback
= _callback
,
2576 .respond
= _respond
,
2579 .ike_sa_id
= ike_sa_id
->clone(ike_sa_id
),
2581 .my_host
= host_create_any(AF_INET
),
2582 .other_host
= host_create_any(AF_INET
),
2583 .my_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
),
2584 .other_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
),
2585 .keymat
= keymat_create(version
, initiator
),
2586 .state
= IKE_CREATED
,
2587 .stats
[STAT_INBOUND
] = time_monotonic(NULL
),
2588 .stats
[STAT_OUTBOUND
] = time_monotonic(NULL
),
2589 .my_auth
= auth_cfg_create(),
2590 .other_auth
= auth_cfg_create(),
2591 .my_auths
= array_create(0, 0),
2592 .other_auths
= array_create(0, 0),
2593 .attributes
= array_create(sizeof(attribute_entry_t
), 0),
2594 .unique_id
= ref_get(&unique_id
),
2595 .keepalive_interval
= lib
->settings
->get_time(lib
->settings
,
2596 "%s.keep_alive", KEEPALIVE_INTERVAL
, lib
->ns
),
2597 .retry_initiate_interval
= lib
->settings
->get_time(lib
->settings
,
2598 "%s.retry_initiate_interval", 0, lib
->ns
),
2599 .flush_auth_cfg
= lib
->settings
->get_bool(lib
->settings
,
2600 "%s.flush_auth_cfg", FALSE
, lib
->ns
),
2601 .fragment_size
= lib
->settings
->get_int(lib
->settings
,
2602 "%s.fragment_size", 0, lib
->ns
),
2605 if (version
== IKEV2
)
2606 { /* always supported with IKEv2 */
2607 enable_extension(this, EXT_DPD
);
2610 this->task_manager
= task_manager_create(&this->public);
2611 this->my_host
->set_port(this->my_host
,
2612 charon
->socket
->get_port(charon
->socket
, FALSE
));
2614 if (!this->task_manager
|| !this->keymat
)
2616 DBG1(DBG_IKE
, "IKE version %d not supported", this->version
);
2620 return &this->public;