src/libcharon/sa/ike_sa.c

   1 /*
   2  * Copyright (C) 2006-2008 Tobias Brunner
   3  * Copyright (C) 2006 Daniel Roethlisberger
   4  * Copyright (C) 2005-2009 Martin Willi
   5  * Copyright (C) 2005 Jan Hutter
   6  * Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 #include <string.h>
  20 #include <sys/stat.h>
  21 #include <errno.h>
  22 #include <time.h>
  23
  24 #include "ike_sa.h"
  25
  26 #include <library.h>
  27 #include <hydra.h>
  28 #include <daemon.h>
  29 #include <utils/linked_list.h>
  30 #include <utils/lexparser.h>
  31 #include <sa/task_manager.h>
  32 #include <sa/tasks/ike_init.h>
  33 #include <sa/tasks/ike_natd.h>
  34 #include <sa/tasks/ike_mobike.h>
  35 #include <sa/tasks/ike_auth.h>
  36 #include <sa/tasks/ike_auth_lifetime.h>
  37 #include <sa/tasks/ike_config.h>
  38 #include <sa/tasks/ike_cert_pre.h>
  39 #include <sa/tasks/ike_cert_post.h>
  40 #include <sa/tasks/ike_rekey.h>
  41 #include <sa/tasks/ike_reauth.h>
  42 #include <sa/tasks/ike_delete.h>
  43 #include <sa/tasks/ike_dpd.h>
  44 #include <sa/tasks/ike_vendor.h>
  45 #include <sa/tasks/child_create.h>
  46 #include <sa/tasks/child_delete.h>
  47 #include <sa/tasks/child_rekey.h>
  48 #include <processing/jobs/retransmit_job.h>
  49 #include <processing/jobs/delete_ike_sa_job.h>
  50 #include <processing/jobs/send_dpd_job.h>
  51 #include <processing/jobs/send_keepalive_job.h>
  52 #include <processing/jobs/rekey_ike_sa_job.h>
  53
  54 #ifdef ME
  55 #include <sa/tasks/ike_me.h>
  56 #include <processing/jobs/initiate_mediation_job.h>
  57 #endif
  58
  59 ENUM(ike_sa_state_names, IKE_CREATED, IKE_DESTROYING,
  60         "CREATED",
  61         "CONNECTING",
  62         "ESTABLISHED",
  63         "PASSIVE",
  64         "REKEYING",
  65         "DELETING",
  66         "DESTROYING",
  67 );
  68
  69 typedef struct private_ike_sa_t private_ike_sa_t;
  70 typedef struct attribute_entry_t attribute_entry_t;
  71
  72 /**
  73  * Private data of an ike_sa_t object.
  74  */
  75 struct private_ike_sa_t {
  76
  77         /**
  78          * Public members
  79          */
  80         ike_sa_t public;
  81
  82         /**
  83          * Identifier for the current IKE_SA.
  84          */
  85         ike_sa_id_t *ike_sa_id;
  86
  87         /**
  88          * unique numerical ID for this IKE_SA.
  89          */
  90         u_int32_t unique_id;
  91
  92         /**
  93          * Current state of the IKE_SA
  94          */
  95         ike_sa_state_t state;
  96
  97         /**
  98          * IKE configuration used to set up this IKE_SA
  99          */
 100         ike_cfg_t *ike_cfg;
 101
 102         /**
 103          * Peer and authentication information to establish IKE_SA.
 104          */
 105         peer_cfg_t *peer_cfg;
 106
 107         /**
 108          * currently used authentication ruleset, local (as auth_cfg_t)
 109          */
 110         auth_cfg_t *my_auth;
 111
 112         /**
 113          * list of completed local authentication rounds
 114          */
 115         linked_list_t *my_auths;
 116
 117         /**
 118          * list of completed remote authentication rounds
 119          */
 120         linked_list_t *other_auths;
 121
 122         /**
 123          * currently used authentication constraints, remote (as auth_cfg_t)
 124          */
 125         auth_cfg_t *other_auth;
 126
 127         /**
 128          * Selected IKE proposal
 129          */
 130         proposal_t *proposal;
 131
 132         /**
 133          * Juggles tasks to process messages
 134          */
 135         task_manager_t *task_manager;
 136
 137         /**
 138          * Address of local host
 139          */
 140         host_t *my_host;
 141
 142         /**
 143          * Address of remote host
 144          */
 145         host_t *other_host;
 146
 147 #ifdef ME
 148         /**
 149          * Are we mediation server
 150          */
 151         bool is_mediation_server;
 152
 153         /**
 154          * Server reflexive host
 155          */
 156         host_t *server_reflexive_host;
 157
 158         /**
 159          * Connect ID
 160          */
 161         chunk_t connect_id;
 162 #endif /* ME */
 163
 164         /**
 165          * Identification used for us
 166          */
 167         identification_t *my_id;
 168
 169         /**
 170          * Identification used for other
 171          */
 172         identification_t *other_id;
 173
 174         /**
 175          * set of extensions the peer supports
 176          */
 177         ike_extension_t extensions;
 178
 179         /**
 180          * set of condition flags currently enabled for this IKE_SA
 181          */
 182         ike_condition_t conditions;
 183
 184         /**
 185          * Linked List containing the child sa's of the current IKE_SA.
 186          */
 187         linked_list_t *child_sas;
 188
 189         /**
 190          * keymat of this IKE_SA
 191          */
 192         keymat_t *keymat;
 193
 194         /**
 195          * Virtual IP on local host, if any
 196          */
 197         host_t *my_virtual_ip;
 198
 199         /**
 200          * Virtual IP on remote host, if any
 201          */
 202         host_t *other_virtual_ip;
 203
 204         /**
 205          * List of configuration attributes (attribute_entry_t)
 206          */
 207         linked_list_t *attributes;
 208
 209         /**
 210          * list of peers additional addresses, transmitted via MOBIKE
 211          */
 212         linked_list_t *additional_addresses;
 213
 214         /**
 215          * previously value of received DESTINATION_IP hash
 216          */
 217         chunk_t nat_detection_dest;
 218
 219         /**
 220          * number pending UPDATE_SA_ADDRESS (MOBIKE)
 221          */
 222         u_int32_t pending_updates;
 223
 224         /**
 225          * NAT keep alive interval
 226          */
 227         u_int32_t keepalive_interval;
 228
 229         /**
 230          * Timestamps for this IKE_SA
 231          */
 232         u_int32_t stats[STAT_MAX];
 233
 234         /**
 235          * how many times we have retried so far (keyingtries)
 236          */
 237         u_int32_t keyingtry;
 238
 239         /**
 240          * local host address to be used for IKE, set via MIGRATE kernel message
 241          */
 242         host_t *local_host;
 243
 244         /**
 245          * remote host address to be used for IKE, set via MIGRATE kernel message
 246          */
 247         host_t *remote_host;
 248 };
 249
 250 /**
 251  * Entry to maintain install configuration attributes during IKE_SA lifetime
 252  */
 253 struct attribute_entry_t {
 254         /** handler used to install this attribute */
 255         attribute_handler_t *handler;
 256         /** attribute type */
 257         configuration_attribute_type_t type;
 258         /** attribute data */
 259         chunk_t data;
 260 };
 261
 262 /**
 263  * get the time of the latest traffic processed by the kernel
 264  */
 265 static time_t get_use_time(private_ike_sa_t* this, bool inbound)
 266 {
 267         enumerator_t *enumerator;
 268         child_sa_t *child_sa;
 269         time_t use_time, current;
 270
 271         if (inbound)
 272         {
 273                 use_time = this->stats[STAT_INBOUND];
 274         }
 275         else
 276         {
 277                 use_time = this->stats[STAT_OUTBOUND];
 278         }
 279         enumerator = this->child_sas->create_enumerator(this->child_sas);
 280         while (enumerator->enumerate(enumerator, &child_sa))
 281         {
 282                 child_sa->get_usestats(child_sa, inbound, &current, NULL);
 283                 use_time = max(use_time, current);
 284         }
 285         enumerator->destroy(enumerator);
 286
 287         return use_time;
 288 }
 289
 290 METHOD(ike_sa_t, get_unique_id, u_int32_t,
 291         private_ike_sa_t *this)
 292 {
 293         return this->unique_id;
 294 }
 295
 296 METHOD(ike_sa_t, get_name, char*,
 297         private_ike_sa_t *this)
 298 {
 299         if (this->peer_cfg)
 300         {
 301                 return this->peer_cfg->get_name(this->peer_cfg);
 302         }
 303         return "(unnamed)";
 304 }
 305
 306 METHOD(ike_sa_t, get_statistic, u_int32_t,
 307         private_ike_sa_t *this, statistic_t kind)
 308 {
 309         if (kind < STAT_MAX)
 310         {
 311                 return this->stats[kind];
 312         }
 313         return 0;
 314 }
 315
 316 METHOD(ike_sa_t, get_my_host, host_t*,
 317         private_ike_sa_t *this)
 318 {
 319         return this->my_host;
 320 }
 321
 322 METHOD(ike_sa_t, set_my_host, void,
 323         private_ike_sa_t *this, host_t *me)
 324 {
 325         DESTROY_IF(this->my_host);
 326         this->my_host = me;
 327 }
 328
 329 METHOD(ike_sa_t, get_other_host, host_t*,
 330         private_ike_sa_t *this)
 331 {
 332         return this->other_host;
 333 }
 334
 335 METHOD(ike_sa_t, set_other_host, void,
 336         private_ike_sa_t *this, host_t *other)
 337 {
 338         DESTROY_IF(this->other_host);
 339         this->other_host = other;
 340 }
 341
 342 METHOD(ike_sa_t, get_peer_cfg, peer_cfg_t*,
 343         private_ike_sa_t *this)
 344 {
 345         return this->peer_cfg;
 346 }
 347
 348 METHOD(ike_sa_t, set_peer_cfg, void,
 349         private_ike_sa_t *this, peer_cfg_t *peer_cfg)
 350 {
 351         DESTROY_IF(this->peer_cfg);
 352         peer_cfg->get_ref(peer_cfg);
 353         this->peer_cfg = peer_cfg;
 354
 355         if (this->ike_cfg == NULL)
 356         {
 357                 this->ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
 358                 this->ike_cfg->get_ref(this->ike_cfg);
 359         }
 360 }
 361
 362 METHOD(ike_sa_t, get_auth_cfg, auth_cfg_t*,
 363         private_ike_sa_t *this, bool local)
 364 {
 365         if (local)
 366         {
 367                 return this->my_auth;
 368         }
 369         return this->other_auth;
 370 }
 371
 372 METHOD(ike_sa_t, add_auth_cfg, void,
 373         private_ike_sa_t *this, bool local, auth_cfg_t *cfg)
 374 {
 375         if (local)
 376         {
 377                 this->my_auths->insert_last(this->my_auths, cfg);
 378         }
 379         else
 380         {
 381                 this->other_auths->insert_last(this->other_auths, cfg);
 382         }
 383 }
 384
 385 METHOD(ike_sa_t, create_auth_cfg_enumerator, enumerator_t*,
 386         private_ike_sa_t *this, bool local)
 387 {
 388         if (local)
 389         {
 390                 return this->my_auths->create_enumerator(this->my_auths);
 391         }
 392         return this->other_auths->create_enumerator(this->other_auths);
 393 }
 394
 395 /**
 396  * Flush the stored authentication round information
 397  */
 398 static void flush_auth_cfgs(private_ike_sa_t *this)
 399 {
 400         auth_cfg_t *cfg;
 401
 402         while (this->my_auths->remove_last(this->my_auths,
 403                                                                            (void**)&cfg) == SUCCESS)
 404         {
 405                 cfg->destroy(cfg);
 406         }
 407         while (this->other_auths->remove_last(this->other_auths,
 408                                                                                   (void**)&cfg) == SUCCESS)
 409         {
 410                 cfg->destroy(cfg);
 411         }
 412 }
 413
 414 METHOD(ike_sa_t, get_proposal, proposal_t*,
 415         private_ike_sa_t *this)
 416 {
 417         return this->proposal;
 418 }
 419
 420 METHOD(ike_sa_t, set_proposal, void,
 421         private_ike_sa_t *this, proposal_t *proposal)
 422 {
 423         DESTROY_IF(this->proposal);
 424         this->proposal = proposal->clone(proposal);
 425 }
 426
 427 METHOD(ike_sa_t, set_message_id, void,
 428         private_ike_sa_t *this, bool initiate, u_int32_t mid)
 429 {
 430         if (initiate)
 431         {
 432                 this->task_manager->reset(this->task_manager, mid, UINT_MAX);
 433         }
 434         else
 435         {
 436                 this->task_manager->reset(this->task_manager, UINT_MAX, mid);
 437         }
 438 }
 439
 440 METHOD(ike_sa_t, send_keepalive, void,
 441         private_ike_sa_t *this)
 442 {
 443         send_keepalive_job_t *job;
 444         time_t last_out, now, diff;
 445
 446         if (!(this->conditions & COND_NAT_HERE) || this->keepalive_interval == 0)
 447         {       /* disable keep alives if we are not NATed anymore */
 448                 return;
 449         }
 450
 451         last_out = get_use_time(this, FALSE);
 452         now = time_monotonic(NULL);
 453
 454         diff = now - last_out;
 455
 456         if (diff >= this->keepalive_interval)
 457         {
 458                 packet_t *packet;
 459                 chunk_t data;
 460
 461                 packet = packet_create();
 462                 packet->set_source(packet, this->my_host->clone(this->my_host));
 463                 packet->set_destination(packet, this->other_host->clone(this->other_host));
 464                 data.ptr = malloc(1);
 465                 data.ptr[0] = 0xFF;
 466                 data.len = 1;
 467                 packet->set_data(packet, data);
 468                 DBG1(DBG_IKE, "sending keep alive");
 469                 charon->sender->send(charon->sender, packet);
 470                 diff = 0;
 471         }
 472         job = send_keepalive_job_create(this->ike_sa_id);
 473         hydra->scheduler->schedule_job(hydra->scheduler, (job_t*)job,
 474                                                                         this->keepalive_interval - diff);
 475 }
 476
 477 METHOD(ike_sa_t, get_ike_cfg, ike_cfg_t*,
 478         private_ike_sa_t *this)
 479 {
 480         return this->ike_cfg;
 481 }
 482
 483 METHOD(ike_sa_t, set_ike_cfg, void,
 484         private_ike_sa_t *this, ike_cfg_t *ike_cfg)
 485 {
 486         ike_cfg->get_ref(ike_cfg);
 487         this->ike_cfg = ike_cfg;
 488 }
 489
 490 METHOD(ike_sa_t, enable_extension, void,
 491         private_ike_sa_t *this, ike_extension_t extension)
 492 {
 493         this->extensions |= extension;
 494 }
 495
 496 METHOD(ike_sa_t, supports_extension, bool,
 497         private_ike_sa_t *this, ike_extension_t extension)
 498 {
 499         return (this->extensions & extension) != FALSE;
 500 }
 501
 502 METHOD(ike_sa_t, has_condition, bool,
 503         private_ike_sa_t *this, ike_condition_t condition)
 504 {
 505         return (this->conditions & condition) != FALSE;
 506 }
 507
 508 METHOD(ike_sa_t, set_condition, void,
 509         private_ike_sa_t *this, ike_condition_t condition, bool enable)
 510 {
 511         if (has_condition(this, condition) != enable)
 512         {
 513                 if (enable)
 514                 {
 515                         this->conditions |= condition;
 516                         switch (condition)
 517                         {
 518                                 case COND_NAT_HERE:
 519                                         DBG1(DBG_IKE, "local host is behind NAT, sending keep alives");
 520                                         this->conditions |= COND_NAT_ANY;
 521                                         send_keepalive(this);
 522                                         break;
 523                                 case COND_NAT_THERE:
 524                                         DBG1(DBG_IKE, "remote host is behind NAT");
 525                                         this->conditions |= COND_NAT_ANY;
 526                                         break;
 527                                 case COND_NAT_FAKE:
 528                                         DBG1(DBG_IKE, "faking NAT situation to enforce UDP encapsulation");
 529                                         this->conditions |= COND_NAT_ANY;
 530                                         break;
 531                                 default:
 532                                         break;
 533                         }
 534                 }
 535                 else
 536                 {
 537                         this->conditions &= ~condition;
 538                         switch (condition)
 539                         {
 540                                 case COND_NAT_HERE:
 541                                 case COND_NAT_FAKE:
 542                                 case COND_NAT_THERE:
 543                                         set_condition(this, COND_NAT_ANY,
 544                                                                   has_condition(this, COND_NAT_HERE) ||
 545                                                                   has_condition(this, COND_NAT_THERE) ||
 546                                                                   has_condition(this, COND_NAT_FAKE));
 547                                         break;
 548                                 default:
 549                                         break;
 550                         }
 551                 }
 552         }
 553 }
 554
 555 METHOD(ike_sa_t, send_dpd, status_t,
 556         private_ike_sa_t *this)
 557 {
 558         job_t *job;
 559         time_t diff, delay;
 560
 561         delay = this->peer_cfg->get_dpd(this->peer_cfg);
 562
 563         if (delay == 0)
 564         {
 565                 /* DPD disabled */
 566                 return SUCCESS;
 567         }
 568
 569         if (this->task_manager->busy(this->task_manager))
 570         {
 571                 /* an exchange is in the air, no need to start a DPD check */
 572                 diff = 0;
 573         }
 574         else
 575         {
 576                 /* check if there was any inbound traffic */
 577                 time_t last_in, now;
 578                 last_in = get_use_time(this, TRUE);
 579                 now = time_monotonic(NULL);
 580                 diff = now - last_in;
 581                 if (diff >= delay)
 582                 {
 583                         /* to long ago, initiate dead peer detection */
 584                         task_t *task;
 585                         ike_mobike_t *mobike;
 586
 587                         if (supports_extension(this, EXT_MOBIKE) &&
 588                                 has_condition(this, COND_NAT_HERE))
 589                         {
 590                                 /* use mobike enabled DPD to detect NAT mapping changes */
 591                                 mobike = ike_mobike_create(&this->public, TRUE);
 592                                 mobike->dpd(mobike);
 593                                 task = &mobike->task;
 594                         }
 595                         else
 596                         {
 597                                 task = (task_t*)ike_dpd_create(TRUE);
 598                         }
 599                         diff = 0;
 600                         DBG1(DBG_IKE, "sending DPD request");
 601
 602                         this->task_manager->queue_task(this->task_manager, task);
 603                         this->task_manager->initiate(this->task_manager);
 604                 }
 605         }
 606         /* recheck in "interval" seconds */
 607         job = (job_t*)send_dpd_job_create(this->ike_sa_id);
 608         hydra->scheduler->schedule_job(hydra->scheduler, job, delay - diff);
 609         return SUCCESS;
 610 }
 611
 612 METHOD(ike_sa_t, get_state, ike_sa_state_t,
 613         private_ike_sa_t *this)
 614 {
 615         return this->state;
 616 }
 617
 618 METHOD(ike_sa_t, set_state, void,
 619         private_ike_sa_t *this, ike_sa_state_t state)
 620 {
 621         DBG2(DBG_IKE, "IKE_SA %s[%d] state change: %N => %N",
 622                  get_name(this), this->unique_id,
 623                  ike_sa_state_names, this->state,
 624                  ike_sa_state_names, state);
 625
 626         switch (state)
 627         {
 628                 case IKE_ESTABLISHED:
 629                 {
 630                         if (this->state == IKE_CONNECTING ||
 631                                 this->state == IKE_PASSIVE)
 632                         {
 633                                 job_t *job;
 634                                 u_int32_t t;
 635
 636                                 /* calculate rekey, reauth and lifetime */
 637                                 this->stats[STAT_ESTABLISHED] = time_monotonic(NULL);
 638
 639                                 /* schedule rekeying if we have a time which is smaller than
 640                                  * an already scheduled rekeying */
 641                                 t = this->peer_cfg->get_rekey_time(this->peer_cfg);
 642                                 if (t && (this->stats[STAT_REKEY] == 0 ||
 643                                         (this->stats[STAT_REKEY] > t + this->stats[STAT_ESTABLISHED])))
 644                                 {
 645                                         this->stats[STAT_REKEY] = t + this->stats[STAT_ESTABLISHED];
 646                                         job = (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, FALSE);
 647                                         hydra->scheduler->schedule_job(hydra->scheduler, job, t);
 648                                         DBG1(DBG_IKE, "scheduling rekeying in %ds", t);
 649                                 }
 650                                 t = this->peer_cfg->get_reauth_time(this->peer_cfg);
 651                                 if (t && (this->stats[STAT_REAUTH] == 0 ||
 652                                         (this->stats[STAT_REAUTH] > t + this->stats[STAT_ESTABLISHED])))
 653                                 {
 654                                         this->stats[STAT_REAUTH] = t + this->stats[STAT_ESTABLISHED];
 655                                         job = (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE);
 656                                         hydra->scheduler->schedule_job(hydra->scheduler, job, t);
 657                                         DBG1(DBG_IKE, "scheduling reauthentication in %ds", t);
 658                                 }
 659                                 t = this->peer_cfg->get_over_time(this->peer_cfg);
 660                                 if (this->stats[STAT_REKEY] || this->stats[STAT_REAUTH])
 661                                 {
 662                                         if (this->stats[STAT_REAUTH] == 0)
 663                                         {
 664                                                 this->stats[STAT_DELETE] = this->stats[STAT_REKEY];
 665                                         }
 666                                         else if (this->stats[STAT_REKEY] == 0)
 667                                         {
 668                                                 this->stats[STAT_DELETE] = this->stats[STAT_REAUTH];
 669                                         }
 670                                         else
 671                                         {
 672                                                 this->stats[STAT_DELETE] = min(this->stats[STAT_REKEY],
 673                                                                                                            this->stats[STAT_REAUTH]);
 674                                         }
 675                                         this->stats[STAT_DELETE] += t;
 676                                         t = this->stats[STAT_DELETE] - this->stats[STAT_ESTABLISHED];
 677                                         job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE);
 678                                         hydra->scheduler->schedule_job(hydra->scheduler, job, t);
 679                                         DBG1(DBG_IKE, "maximum IKE_SA lifetime %ds", t);
 680                                 }
 681
 682                                 /* start DPD checks */
 683                                 send_dpd(this);
 684                         }
 685                         break;
 686                 }
 687                 case IKE_DELETING:
 688                 {
 689                         /* delete may fail if a packet gets lost, so set a timeout */
 690                         job_t *job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE);
 691                         hydra->scheduler->schedule_job(hydra->scheduler, job,
 692                                                                                    HALF_OPEN_IKE_SA_TIMEOUT);
 693                         break;
 694                 }
 695                 default:
 696                         break;
 697         }
 698         charon->bus->ike_state_change(charon->bus, &this->public, state);
 699         this->state = state;
 700 }
 701
 702 METHOD(ike_sa_t, reset, void,
 703         private_ike_sa_t *this)
 704 {
 705         /*  the responder ID is reset, as peer may choose another one */
 706         if (this->ike_sa_id->is_initiator(this->ike_sa_id))
 707         {
 708                 this->ike_sa_id->set_responder_spi(this->ike_sa_id, 0);
 709         }
 710
 711         set_state(this, IKE_CREATED);
 712
 713         flush_auth_cfgs(this);
 714
 715         this->keymat->destroy(this->keymat);
 716         this->keymat = keymat_create(this->ike_sa_id->is_initiator(this->ike_sa_id));
 717
 718         this->task_manager->reset(this->task_manager, 0, 0);
 719 }
 720
 721 METHOD(ike_sa_t, get_keymat, keymat_t*,
 722         private_ike_sa_t *this)
 723 {
 724         return this->keymat;
 725 }
 726
 727 METHOD(ike_sa_t, set_virtual_ip, void,
 728         private_ike_sa_t *this, bool local, host_t *ip)
 729 {
 730         if (local)
 731         {
 732                 DBG1(DBG_IKE, "installing new virtual IP %H", ip);
 733                 if (charon->kernel_interface->add_ip(charon->kernel_interface, ip,
 734                                                                                          this->my_host) == SUCCESS)
 735                 {
 736                         if (this->my_virtual_ip)
 737                         {
 738                                 DBG1(DBG_IKE, "removing old virtual IP %H", this->my_virtual_ip);
 739                                 charon->kernel_interface->del_ip(charon->kernel_interface,
 740                                                                                                  this->my_virtual_ip);
 741                         }
 742                         DESTROY_IF(this->my_virtual_ip);
 743                         this->my_virtual_ip = ip->clone(ip);
 744                 }
 745                 else
 746                 {
 747                         DBG1(DBG_IKE, "installing virtual IP %H failed", ip);
 748                         this->my_virtual_ip = NULL;
 749                 }
 750         }
 751         else
 752         {
 753                 DESTROY_IF(this->other_virtual_ip);
 754                 this->other_virtual_ip = ip->clone(ip);
 755         }
 756 }
 757
 758 METHOD(ike_sa_t, get_virtual_ip, host_t*,
 759         private_ike_sa_t *this, bool local)
 760 {
 761         if (local)
 762         {
 763                 return this->my_virtual_ip;
 764         }
 765         else
 766         {
 767                 return this->other_virtual_ip;
 768         }
 769 }
 770
 771 METHOD(ike_sa_t, add_additional_address, void,
 772         private_ike_sa_t *this, host_t *host)
 773 {
 774         this->additional_addresses->insert_last(this->additional_addresses, host);
 775 }
 776
 777 METHOD(ike_sa_t, create_additional_address_iterator, iterator_t*,
 778         private_ike_sa_t *this)
 779 {
 780         return this->additional_addresses->create_iterator(
 781                                                                                         this->additional_addresses, TRUE);
 782 }
 783
 784 METHOD(ike_sa_t, has_mapping_changed, bool,
 785         private_ike_sa_t *this, chunk_t hash)
 786 {
 787         if (this->nat_detection_dest.ptr == NULL)
 788         {
 789                 this->nat_detection_dest = chunk_clone(hash);
 790                 return FALSE;
 791         }
 792         if (chunk_equals(hash, this->nat_detection_dest))
 793         {
 794                 return FALSE;
 795         }
 796         free(this->nat_detection_dest.ptr);
 797         this->nat_detection_dest = chunk_clone(hash);
 798         return TRUE;
 799 }
 800
 801 METHOD(ike_sa_t, set_pending_updates, void,
 802         private_ike_sa_t *this, u_int32_t updates)
 803 {
 804         this->pending_updates = updates;
 805 }
 806
 807 METHOD(ike_sa_t, get_pending_updates, u_int32_t,
 808         private_ike_sa_t *this)
 809 {
 810         return this->pending_updates;
 811 }
 812
 813 METHOD(ike_sa_t, float_ports, void,
 814            private_ike_sa_t *this)
 815 {
 816         /* do not switch if we have a custom port from MOBIKE/NAT */
 817         if (this->my_host->get_port(this->my_host) == IKEV2_UDP_PORT)
 818         {
 819                 this->my_host->set_port(this->my_host, IKEV2_NATT_PORT);
 820         }
 821         if (this->other_host->get_port(this->other_host) == IKEV2_UDP_PORT)
 822         {
 823                 this->other_host->set_port(this->other_host, IKEV2_NATT_PORT);
 824         }
 825 }
 826
 827 METHOD(ike_sa_t, update_hosts, void,
 828         private_ike_sa_t *this, host_t *me, host_t *other)
 829 {
 830         bool update = FALSE;
 831
 832         if (me == NULL)
 833         {
 834                 me = this->my_host;
 835         }
 836         if (other == NULL)
 837         {
 838                 other = this->other_host;
 839         }
 840
 841         /* apply hosts on first received message */
 842         if (this->my_host->is_anyaddr(this->my_host) ||
 843                 this->other_host->is_anyaddr(this->other_host))
 844         {
 845                 set_my_host(this, me->clone(me));
 846                 set_other_host(this, other->clone(other));
 847                 update = TRUE;
 848         }
 849         else
 850         {
 851                 /* update our address in any case */
 852                 if (!me->equals(me, this->my_host))
 853                 {
 854                         set_my_host(this, me->clone(me));
 855                         update = TRUE;
 856                 }
 857
 858                 if (!other->equals(other, this->other_host))
 859                 {
 860                         /* update others adress if we are NOT NATed,
 861                          * and allow port changes if we are NATed */
 862                         if (!has_condition(this, COND_NAT_HERE) ||
 863                                 other->ip_equals(other, this->other_host))
 864                         {
 865                                 set_other_host(this, other->clone(other));
 866                                 update = TRUE;
 867                         }
 868                 }
 869         }
 870
 871         /* update all associated CHILD_SAs, if required */
 872         if (update)
 873         {
 874                 iterator_t *iterator;
 875                 child_sa_t *child_sa;
 876
 877                 iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
 878                 while (iterator->iterate(iterator, (void**)&child_sa))
 879                 {
 880                         if (child_sa->update(child_sa, this->my_host,
 881                                                 this->other_host, this->my_virtual_ip,
 882                                                 has_condition(this, COND_NAT_ANY)) == NOT_SUPPORTED)
 883                         {
 884                                 this->public.rekey_child_sa(&this->public,
 885                                                 child_sa->get_protocol(child_sa),
 886                                                 child_sa->get_spi(child_sa, TRUE));
 887                         }
 888                 }
 889                 iterator->destroy(iterator);
 890         }
 891 }
 892
 893 METHOD(ike_sa_t, generate_message, status_t,
 894         private_ike_sa_t *this, message_t *message, packet_t **packet)
 895 {
 896         this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
 897         message->set_ike_sa_id(message, this->ike_sa_id);
 898         return message->generate(message,
 899                                 this->keymat->get_aead(this->keymat, FALSE), packet);
 900 }
 901
 902 /**
 903  * send a notify back to the sender
 904  */
 905 static void send_notify_response(private_ike_sa_t *this, message_t *request,
 906                                                                  notify_type_t type)
 907 {
 908         message_t *response;
 909         packet_t *packet;
 910
 911         response = message_create();
 912         response->set_exchange_type(response, request->get_exchange_type(request));
 913         response->set_request(response, FALSE);
 914         response->set_message_id(response, request->get_message_id(request));
 915         response->add_notify(response, FALSE, type, chunk_empty);
 916         if (this->my_host->is_anyaddr(this->my_host))
 917         {
 918                 this->my_host->destroy(this->my_host);
 919                 this->my_host = request->get_destination(request);
 920                 this->my_host = this->my_host->clone(this->my_host);
 921         }
 922         if (this->other_host->is_anyaddr(this->other_host))
 923         {
 924                 this->other_host->destroy(this->other_host);
 925                 this->other_host = request->get_source(request);
 926                 this->other_host = this->other_host->clone(this->other_host);
 927         }
 928         response->set_source(response, this->my_host->clone(this->my_host));
 929         response->set_destination(response, this->other_host->clone(this->other_host));
 930         if (generate_message(this, response, &packet) == SUCCESS)
 931         {
 932                 charon->sender->send(charon->sender, packet);
 933         }
 934         response->destroy(response);
 935 }
 936
 937 METHOD(ike_sa_t, set_kmaddress, void,
 938         private_ike_sa_t *this, host_t *local, host_t *remote)
 939 {
 940         DESTROY_IF(this->local_host);
 941         DESTROY_IF(this->remote_host);
 942         this->local_host = local->clone(local);
 943         this->remote_host = remote->clone(remote);
 944 }
 945
 946 #ifdef ME
 947 METHOD(ike_sa_t, act_as_mediation_server, void,
 948         private_ike_sa_t *this)
 949 {
 950         charon->mediation_manager->update_sa_id(charon->mediation_manager,
 951                         this->other_id, this->ike_sa_id);
 952         this->is_mediation_server = TRUE;
 953 }
 954
 955 METHOD(ike_sa_t, get_server_reflexive_host, host_t*,
 956         private_ike_sa_t *this)
 957 {
 958         return this->server_reflexive_host;
 959 }
 960
 961 METHOD(ike_sa_t, set_server_reflexive_host, void,
 962         private_ike_sa_t *this, host_t *host)
 963 {
 964         DESTROY_IF(this->server_reflexive_host);
 965         this->server_reflexive_host = host;
 966 }
 967
 968 METHOD(ike_sa_t, get_connect_id, chunk_t,
 969         private_ike_sa_t *this)
 970 {
 971         return this->connect_id;
 972 }
 973
 974 METHOD(ike_sa_t, respond, status_t,
 975         private_ike_sa_t *this, identification_t *peer_id, chunk_t connect_id)
 976 {
 977         ike_me_t *task = ike_me_create(&this->public, TRUE);
 978         task->respond(task, peer_id, connect_id);
 979         this->task_manager->queue_task(this->task_manager, (task_t*)task);
 980         return this->task_manager->initiate(this->task_manager);
 981 }
 982
 983 METHOD(ike_sa_t, callback, status_t,
 984         private_ike_sa_t *this, identification_t *peer_id)
 985 {
 986         ike_me_t *task = ike_me_create(&this->public, TRUE);
 987         task->callback(task, peer_id);
 988         this->task_manager->queue_task(this->task_manager, (task_t*)task);
 989         return this->task_manager->initiate(this->task_manager);
 990 }
 991
 992 METHOD(ike_sa_t, relay, status_t,
 993         private_ike_sa_t *this, identification_t *requester, chunk_t connect_id,
 994         chunk_t connect_key, linked_list_t *endpoints, bool response)
 995 {
 996         ike_me_t *task = ike_me_create(&this->public, TRUE);
 997         task->relay(task, requester, connect_id, connect_key, endpoints, response);
 998         this->task_manager->queue_task(this->task_manager, (task_t*)task);
 999         return this->task_manager->initiate(this->task_manager);
1000 }
1001
1002 METHOD(ike_sa_t, initiate_mediation, status_t,
1003         private_ike_sa_t *this, peer_cfg_t *mediated_cfg)
1004 {
1005         ike_me_t *task = ike_me_create(&this->public, TRUE);
1006         task->connect(task, mediated_cfg->get_peer_id(mediated_cfg));
1007         this->task_manager->queue_task(this->task_manager, (task_t*)task);
1008         return this->task_manager->initiate(this->task_manager);
1009 }
1010
1011 METHOD(ike_sa_t, initiate_mediated, status_t,
1012         private_ike_sa_t *this, host_t *me, host_t *other, chunk_t connect_id)
1013 {
1014         set_my_host(this, me->clone(me));
1015         set_other_host(this, other->clone(other));
1016         chunk_free(&this->connect_id);
1017         this->connect_id = chunk_clone(connect_id);
1018         return this->task_manager->initiate(this->task_manager);
1019 }
1020 #endif /* ME */
1021
1022 /**
1023  * Resolve DNS host in configuration
1024  */
1025 static void resolve_hosts(private_ike_sa_t *this)
1026 {
1027         host_t *host;
1028
1029         if (this->remote_host)
1030         {
1031                 host = this->remote_host->clone(this->remote_host);
1032                 host->set_port(host, IKEV2_UDP_PORT);
1033         }
1034         else
1035         {
1036                 host = host_create_from_dns(this->ike_cfg->get_other_addr(this->ike_cfg),
1037                                                                 0, this->ike_cfg->get_other_port(this->ike_cfg));
1038         }
1039         if (host)
1040         {
1041                 set_other_host(this, host);
1042         }
1043
1044         if (this->local_host)
1045         {
1046                 host = this->local_host->clone(this->local_host);
1047                 host->set_port(host, IKEV2_UDP_PORT);
1048         }
1049         else
1050         {
1051                 int family = 0;
1052
1053                 /* use same address family as for other */
1054                 if (!this->other_host->is_anyaddr(this->other_host))
1055                 {
1056                         family = this->other_host->get_family(this->other_host);
1057                 }
1058                 host = host_create_from_dns(this->ike_cfg->get_my_addr(this->ike_cfg),
1059                                                         family, this->ike_cfg->get_my_port(this->ike_cfg));
1060
1061                 if (host && host->is_anyaddr(host) &&
1062                         !this->other_host->is_anyaddr(this->other_host))
1063                 {
1064                         host->destroy(host);
1065                         host = charon->kernel_interface->get_source_addr(
1066                                                         charon->kernel_interface, this->other_host, NULL);
1067                         if (host)
1068                         {
1069                                 host->set_port(host, this->ike_cfg->get_my_port(this->ike_cfg));
1070                         }
1071                         else
1072                         {       /* fallback to address family specific %any(6), if configured */
1073                                 host = host_create_from_dns(
1074                                                                 this->ike_cfg->get_my_addr(this->ike_cfg),
1075                                                                 0, this->ike_cfg->get_my_port(this->ike_cfg));
1076                         }
1077                 }
1078         }
1079         if (host)
1080         {
1081                 set_my_host(this, host);
1082         }
1083 }
1084
1085 METHOD(ike_sa_t, initiate, status_t,
1086         private_ike_sa_t *this, child_cfg_t *child_cfg, u_int32_t reqid,
1087         traffic_selector_t *tsi, traffic_selector_t *tsr)
1088 {
1089         task_t *task;
1090
1091         if (this->state == IKE_CREATED)
1092         {
1093                 resolve_hosts(this);
1094
1095                 if (this->other_host->is_anyaddr(this->other_host)
1096 #ifdef ME
1097                         && !this->peer_cfg->get_mediated_by(this->peer_cfg)
1098 #endif /* ME */
1099                         )
1100                 {
1101                         child_cfg->destroy(child_cfg);
1102                         DBG1(DBG_IKE, "unable to initiate to %%any");
1103                         return DESTROY_ME;
1104                 }
1105
1106                 set_condition(this, COND_ORIGINAL_INITIATOR, TRUE);
1107
1108                 task = (task_t*)ike_vendor_create(&this->public, TRUE);
1109                 this->task_manager->queue_task(this->task_manager, task);
1110                 task = (task_t*)ike_init_create(&this->public, TRUE, NULL);
1111                 this->task_manager->queue_task(this->task_manager, task);
1112                 task = (task_t*)ike_natd_create(&this->public, TRUE);
1113                 this->task_manager->queue_task(this->task_manager, task);
1114                 task = (task_t*)ike_cert_pre_create(&this->public, TRUE);
1115                 this->task_manager->queue_task(this->task_manager, task);
1116                 task = (task_t*)ike_auth_create(&this->public, TRUE);
1117                 this->task_manager->queue_task(this->task_manager, task);
1118                 task = (task_t*)ike_cert_post_create(&this->public, TRUE);
1119                 this->task_manager->queue_task(this->task_manager, task);
1120                 task = (task_t*)ike_config_create(&this->public, TRUE);
1121                 this->task_manager->queue_task(this->task_manager, task);
1122                 task = (task_t*)ike_auth_lifetime_create(&this->public, TRUE);
1123                 this->task_manager->queue_task(this->task_manager, task);
1124                 if (this->peer_cfg->use_mobike(this->peer_cfg))
1125                 {
1126                         task = (task_t*)ike_mobike_create(&this->public, TRUE);
1127                         this->task_manager->queue_task(this->task_manager, task);
1128                 }
1129 #ifdef ME
1130                 task = (task_t*)ike_me_create(&this->public, TRUE);
1131                 this->task_manager->queue_task(this->task_manager, task);
1132 #endif /* ME */
1133         }
1134
1135 #ifdef ME
1136         if (this->peer_cfg->is_mediation(this->peer_cfg))
1137         {
1138                 if (this->state == IKE_ESTABLISHED)
1139                 {
1140                         /* mediation connection is already established, retrigger state
1141                          * change to notify bus listeners */
1142                         DBG1(DBG_IKE, "mediation connection is already up");
1143                         set_state(this, IKE_ESTABLISHED);
1144                 }
1145                 DESTROY_IF(child_cfg);
1146         }
1147         else
1148 #endif /* ME */
1149         {
1150                 /* normal IKE_SA with CHILD_SA */
1151                 task = (task_t*)child_create_create(&this->public, child_cfg, FALSE,
1152                                                                                         tsi, tsr);
1153                 child_cfg->destroy(child_cfg);
1154                 if (reqid)
1155                 {
1156                         child_create_t *child_create = (child_create_t*)task;
1157                         child_create->use_reqid(child_create, reqid);
1158                 }
1159                 this->task_manager->queue_task(this->task_manager, task);
1160
1161 #ifdef ME
1162                 if (this->peer_cfg->get_mediated_by(this->peer_cfg))
1163                 {
1164                         /* mediated connection, initiate mediation process */
1165                         job_t *job = (job_t*)initiate_mediation_job_create(this->ike_sa_id);
1166                         hydra->processor->queue_job(hydra->processor, job);
1167                         return SUCCESS;
1168                 }
1169 #endif /* ME */
1170         }
1171
1172         return this->task_manager->initiate(this->task_manager);
1173 }
1174
1175 METHOD(ike_sa_t, process_message, status_t,
1176         private_ike_sa_t *this, message_t *message)
1177 {
1178         status_t status;
1179         bool is_request;
1180
1181         if (this->state == IKE_PASSIVE)
1182         {       /* do not handle messages in passive state */
1183                 return FAILED;
1184         }
1185
1186         is_request = message->get_request(message);
1187
1188         status = message->parse_body(message,
1189                                                                  this->keymat->get_aead(this->keymat, TRUE));
1190         if (status != SUCCESS)
1191         {
1192
1193                 if (is_request)
1194                 {
1195                         switch (status)
1196                         {
1197                                 case NOT_SUPPORTED:
1198                                         DBG1(DBG_IKE, "critical unknown payloads found");
1199                                         if (is_request)
1200                                         {
1201                                                 send_notify_response(this, message, UNSUPPORTED_CRITICAL_PAYLOAD);
1202                                         }
1203                                         break;
1204                                 case PARSE_ERROR:
1205                                         DBG1(DBG_IKE, "message parsing failed");
1206                                         if (is_request)
1207                                         {
1208                                                 send_notify_response(this, message, INVALID_SYNTAX);
1209                                         }
1210                                         break;
1211                                 case VERIFY_ERROR:
1212                                         DBG1(DBG_IKE, "message verification failed");
1213                                         if (is_request)
1214                                         {
1215                                                 send_notify_response(this, message, INVALID_SYNTAX);
1216                                         }
1217                                         break;
1218                                 case FAILED:
1219                                         DBG1(DBG_IKE, "integrity check failed");
1220                                         /* ignored */
1221                                         break;
1222                                 case INVALID_STATE:
1223                                         DBG1(DBG_IKE, "found encrypted message, but no keys available");
1224                                         if (is_request)
1225                                         {
1226                                                 send_notify_response(this, message, INVALID_SYNTAX);
1227                                         }
1228                                 default:
1229                                         break;
1230                         }
1231                 }
1232                 DBG1(DBG_IKE, "%N %s with message ID %d processing failed",
1233                          exchange_type_names, message->get_exchange_type(message),
1234                          message->get_request(message) ? "request" : "response",
1235                          message->get_message_id(message));
1236
1237                 if (this->state == IKE_CREATED)
1238                 {       /* invalid initiation attempt, close SA */
1239                         return DESTROY_ME;
1240                 }
1241         }
1242         else
1243         {
1244                 host_t *me, *other;
1245
1246                 me = message->get_destination(message);
1247                 other = message->get_source(message);
1248
1249                 /* if this IKE_SA is virgin, we check for a config */
1250                 if (this->ike_cfg == NULL)
1251                 {
1252                         job_t *job;
1253                         this->ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1254                                                                                                                   me, other);
1255                         if (this->ike_cfg == NULL)
1256                         {
1257                                 /* no config found for these hosts, destroy */
1258                                 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1259                                          me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1260                                 send_notify_response(this, message, NO_PROPOSAL_CHOSEN);
1261                                 return DESTROY_ME;
1262                         }
1263                         /* add a timeout if peer does not establish it completely */
1264                         job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, FALSE);
1265                         hydra->scheduler->schedule_job(hydra->scheduler, job,
1266                                                                                    HALF_OPEN_IKE_SA_TIMEOUT);
1267                 }
1268                 this->stats[STAT_INBOUND] = time_monotonic(NULL);
1269                 /* check if message is trustworthy, and update host information */
1270                 if (this->state == IKE_CREATED || this->state == IKE_CONNECTING ||
1271                         message->get_exchange_type(message) != IKE_SA_INIT)
1272                 {
1273                         if (!supports_extension(this, EXT_MOBIKE))
1274                         {       /* with MOBIKE, we do no implicit updates */
1275                                 update_hosts(this, me, other);
1276                         }
1277                 }
1278                 status = this->task_manager->process_message(this->task_manager, message);
1279                 if (message->get_exchange_type(message) == IKE_AUTH &&
1280                         this->state == IKE_ESTABLISHED &&
1281                         lib->settings->get_bool(lib->settings,
1282                                                                         "charon.flush_auth_cfg", FALSE))
1283                 {       /* authentication completed */
1284                         flush_auth_cfgs(this);
1285                 }
1286         }
1287         return status;
1288 }
1289
1290 METHOD(ike_sa_t, get_id, ike_sa_id_t*,
1291         private_ike_sa_t *this)
1292 {
1293         return this->ike_sa_id;
1294 }
1295
1296 METHOD(ike_sa_t, get_my_id, identification_t*,
1297         private_ike_sa_t *this)
1298 {
1299         return this->my_id;
1300 }
1301
1302 METHOD(ike_sa_t, set_my_id, void,
1303         private_ike_sa_t *this, identification_t *me)
1304 {
1305         DESTROY_IF(this->my_id);
1306         this->my_id = me;
1307 }
1308
1309 METHOD(ike_sa_t, get_other_id, identification_t*,
1310         private_ike_sa_t *this)
1311 {
1312         return this->other_id;
1313 }
1314
1315 METHOD(ike_sa_t, get_other_eap_id, identification_t*,
1316         private_ike_sa_t *this)
1317 {
1318         identification_t *id = NULL, *current;
1319         enumerator_t *enumerator;
1320         auth_cfg_t *cfg;
1321
1322         enumerator = this->other_auths->create_enumerator(this->other_auths);
1323         while (enumerator->enumerate(enumerator, &cfg))
1324         {
1325                 /* prefer EAP-Identity of last round */
1326                 current = cfg->get(cfg, AUTH_RULE_EAP_IDENTITY);
1327                 if (!current || current->get_type(current) == ID_ANY)
1328                 {
1329                         current = cfg->get(cfg, AUTH_RULE_IDENTITY);
1330                 }
1331                 if (current && current->get_type(current) != ID_ANY)
1332                 {
1333                         id = current;
1334                         continue;
1335                 }
1336         }
1337         enumerator->destroy(enumerator);
1338         if (id)
1339         {
1340                 return id;
1341         }
1342         return this->other_id;
1343 }
1344
1345 METHOD(ike_sa_t, set_other_id, void,
1346         private_ike_sa_t *this, identification_t *other)
1347 {
1348         DESTROY_IF(this->other_id);
1349         this->other_id = other;
1350 }
1351
1352 METHOD(ike_sa_t, add_child_sa, void,
1353         private_ike_sa_t *this, child_sa_t *child_sa)
1354 {
1355         this->child_sas->insert_last(this->child_sas, child_sa);
1356 }
1357
1358 METHOD(ike_sa_t, get_child_sa, child_sa_t*,
1359         private_ike_sa_t *this, protocol_id_t protocol, u_int32_t spi, bool inbound)
1360 {
1361         iterator_t *iterator;
1362         child_sa_t *current, *found = NULL;
1363
1364         iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1365         while (iterator->iterate(iterator, (void**)&current))
1366         {
1367                 if (current->get_spi(current, inbound) == spi &&
1368                         current->get_protocol(current) == protocol)
1369                 {
1370                         found = current;
1371                 }
1372         }
1373         iterator->destroy(iterator);
1374         return found;
1375 }
1376
1377 METHOD(ike_sa_t, create_child_sa_iterator, iterator_t*,
1378         private_ike_sa_t *this)
1379 {
1380         return this->child_sas->create_iterator(this->child_sas, TRUE);
1381 }
1382
1383 METHOD(ike_sa_t, rekey_child_sa, status_t,
1384         private_ike_sa_t *this, protocol_id_t protocol, u_int32_t spi)
1385 {
1386         child_rekey_t *child_rekey;
1387
1388         child_rekey = child_rekey_create(&this->public, protocol, spi);
1389         this->task_manager->queue_task(this->task_manager, &child_rekey->task);
1390         return this->task_manager->initiate(this->task_manager);
1391 }
1392
1393 METHOD(ike_sa_t, delete_child_sa, status_t,
1394         private_ike_sa_t *this, protocol_id_t protocol, u_int32_t spi)
1395 {
1396         child_delete_t *child_delete;
1397
1398         child_delete = child_delete_create(&this->public, protocol, spi);
1399         this->task_manager->queue_task(this->task_manager, &child_delete->task);
1400         return this->task_manager->initiate(this->task_manager);
1401 }
1402
1403 METHOD(ike_sa_t, destroy_child_sa, status_t,
1404         private_ike_sa_t *this, protocol_id_t protocol, u_int32_t spi)
1405 {
1406         iterator_t *iterator;
1407         child_sa_t *child_sa;
1408         status_t status = NOT_FOUND;
1409
1410         iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
1411         while (iterator->iterate(iterator, (void**)&child_sa))
1412         {
1413                 if (child_sa->get_protocol(child_sa) == protocol &&
1414                         child_sa->get_spi(child_sa, TRUE) == spi)
1415                 {
1416                         child_sa->destroy(child_sa);
1417                         iterator->remove(iterator);
1418                         status = SUCCESS;
1419                         break;
1420                 }
1421         }
1422         iterator->destroy(iterator);
1423         return status;
1424 }
1425
1426 METHOD(ike_sa_t, delete_, status_t,
1427         private_ike_sa_t *this)
1428 {
1429         ike_delete_t *ike_delete;
1430
1431         switch (this->state)
1432         {
1433                 case IKE_ESTABLISHED:
1434                 case IKE_REKEYING:
1435                         ike_delete = ike_delete_create(&this->public, TRUE);
1436                         this->task_manager->queue_task(this->task_manager, &ike_delete->task);
1437                         return this->task_manager->initiate(this->task_manager);
1438                 case IKE_CREATED:
1439                         DBG1(DBG_IKE, "deleting unestablished IKE_SA");
1440                         break;
1441                 case IKE_PASSIVE:
1442                         break;
1443                 default:
1444                         DBG1(DBG_IKE, "destroying IKE_SA in state %N "
1445                                 "without notification", ike_sa_state_names, this->state);
1446                         charon->bus->ike_updown(charon->bus, &this->public, FALSE);
1447                         break;
1448         }
1449         return DESTROY_ME;
1450 }
1451
1452 METHOD(ike_sa_t, rekey, status_t,
1453         private_ike_sa_t *this)
1454 {
1455         ike_rekey_t *ike_rekey;
1456
1457         ike_rekey = ike_rekey_create(&this->public, TRUE);
1458
1459         this->task_manager->queue_task(this->task_manager, &ike_rekey->task);
1460         return this->task_manager->initiate(this->task_manager);
1461 }
1462
1463 METHOD(ike_sa_t, reauth, status_t,
1464         private_ike_sa_t *this)
1465 {
1466         task_t *task;
1467
1468         /* we can't reauthenticate as responder when we use EAP or virtual IPs.
1469          * If the peer does not support RFC4478, there is no way to keep the
1470          * IKE_SA up. */
1471         if (!has_condition(this, COND_ORIGINAL_INITIATOR))
1472         {
1473                 DBG1(DBG_IKE, "initiator did not reauthenticate as requested");
1474                 if (this->other_virtual_ip != NULL ||
1475                         has_condition(this, COND_EAP_AUTHENTICATED)
1476 #ifdef ME
1477                         /* as mediation server we too cannot reauth the IKE_SA */
1478                         || this->is_mediation_server
1479 #endif /* ME */
1480                         )
1481                 {
1482                         time_t now = time_monotonic(NULL);
1483
1484                         DBG1(DBG_IKE, "IKE_SA will timeout in %V",
1485                                  &now, &this->stats[STAT_DELETE]);
1486                         return FAILED;
1487                 }
1488                 else
1489                 {
1490                         DBG1(DBG_IKE, "reauthenticating actively");
1491                 }
1492         }
1493         task = (task_t*)ike_reauth_create(&this->public);
1494         this->task_manager->queue_task(this->task_manager, task);
1495
1496         return this->task_manager->initiate(this->task_manager);
1497 }
1498
1499 METHOD(ike_sa_t, reestablish, status_t,
1500         private_ike_sa_t *this)
1501 {
1502         ike_sa_t *new;
1503         host_t *host;
1504         action_t action;
1505         iterator_t *iterator;
1506         child_sa_t *child_sa;
1507         child_cfg_t *child_cfg;
1508         bool restart = FALSE;
1509         status_t status = FAILED;
1510
1511         /* check if we have children to keep up at all */
1512         iterator = create_child_sa_iterator(this);
1513         while (iterator->iterate(iterator, (void**)&child_sa))
1514         {
1515                 if (this->state == IKE_DELETING)
1516                 {
1517                         action = child_sa->get_close_action(child_sa);
1518                 }
1519                 else
1520                 {
1521                         action = child_sa->get_dpd_action(child_sa);
1522                 }
1523                 switch (action)
1524                 {
1525                         case ACTION_RESTART:
1526                                 restart = TRUE;
1527                                 break;
1528                         case ACTION_ROUTE:
1529                                 charon->traps->install(charon->traps, this->peer_cfg,
1530                                                                            child_sa->get_config(child_sa));
1531                                 break;
1532                         default:
1533                                 break;
1534                 }
1535         }
1536         iterator->destroy(iterator);
1537 #ifdef ME
1538         /* mediation connections have no children, keep them up anyway */
1539         if (this->peer_cfg->is_mediation(this->peer_cfg))
1540         {
1541                 restart = TRUE;
1542         }
1543 #endif /* ME */
1544         if (!restart)
1545         {
1546                 return FAILED;
1547         }
1548
1549         /* check if we are able to reestablish this IKE_SA */
1550         if (!has_condition(this, COND_ORIGINAL_INITIATOR) &&
1551                 (this->other_virtual_ip != NULL ||
1552                  has_condition(this, COND_EAP_AUTHENTICATED)
1553 #ifdef ME
1554                  || this->is_mediation_server
1555 #endif /* ME */
1556                 ))
1557         {
1558                 DBG1(DBG_IKE, "unable to reestablish IKE_SA due asymetric setup");
1559                 return FAILED;
1560         }
1561
1562         new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager, TRUE);
1563         new->set_peer_cfg(new, this->peer_cfg);
1564         host = this->other_host;
1565         new->set_other_host(new, host->clone(host));
1566         host = this->my_host;
1567         new->set_my_host(new, host->clone(host));
1568         /* if we already have a virtual IP, we reuse it */
1569         host = this->my_virtual_ip;
1570         if (host)
1571         {
1572                 new->set_virtual_ip(new, TRUE, host);
1573         }
1574
1575 #ifdef ME
1576         if (this->peer_cfg->is_mediation(this->peer_cfg))
1577         {
1578                 status = new->initiate(new, NULL, 0, NULL, NULL);
1579         }
1580         else
1581 #endif /* ME */
1582         {
1583                 iterator = create_child_sa_iterator(this);
1584                 while (iterator->iterate(iterator, (void**)&child_sa))
1585                 {
1586                         if (this->state == IKE_DELETING)
1587                         {
1588                                 action = child_sa->get_close_action(child_sa);
1589                         }
1590                         else
1591                         {
1592                                 action = child_sa->get_dpd_action(child_sa);
1593                         }
1594                         switch (action)
1595                         {
1596                                 case ACTION_RESTART:
1597                                         child_cfg = child_sa->get_config(child_sa);
1598                                         DBG1(DBG_IKE, "restarting CHILD_SA %s",
1599                                                  child_cfg->get_name(child_cfg));
1600                                         child_cfg->get_ref(child_cfg);
1601                                         status = new->initiate(new, child_cfg, 0, NULL, NULL);
1602                                         break;
1603                                 default:
1604                                         continue;
1605                         }
1606                         if (status == DESTROY_ME)
1607                         {
1608                                 break;
1609                         }
1610                 }
1611                 iterator->destroy(iterator);
1612         }
1613
1614         if (status == DESTROY_ME)
1615         {
1616                 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1617                 status = FAILED;
1618         }
1619         else
1620         {
1621                 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1622                 status = SUCCESS;
1623         }
1624         charon->bus->set_sa(charon->bus, &this->public);
1625         return status;
1626 }
1627
1628 /**
1629  * Requeue the IKE_SA_INIT tasks for initiation, if required
1630  */
1631 static void requeue_init_tasks(private_ike_sa_t *this)
1632 {
1633         enumerator_t *enumerator;
1634         bool has_init = FALSE;
1635         task_t *task;
1636
1637         /* if we have advanced to IKE_AUTH, the IKE_INIT and related tasks
1638          * have already completed. Recreate them if necessary. */
1639         enumerator = this->task_manager->create_task_enumerator(
1640                                                                                 this->task_manager, TASK_QUEUE_QUEUED);
1641         while (enumerator->enumerate(enumerator, &task))
1642         {
1643                 if (task->get_type(task) == IKE_INIT)
1644                 {
1645                         has_init = TRUE;
1646                         break;
1647                 }
1648         }
1649         enumerator->destroy(enumerator);
1650
1651         if (!has_init)
1652         {
1653                 task = (task_t*)ike_vendor_create(&this->public, TRUE);
1654                 this->task_manager->queue_task(this->task_manager, task);
1655                 task = (task_t*)ike_natd_create(&this->public, TRUE);
1656                 this->task_manager->queue_task(this->task_manager, task);
1657                 task = (task_t*)ike_init_create(&this->public, TRUE, NULL);
1658                 this->task_manager->queue_task(this->task_manager, task);
1659         }
1660 }
1661
1662 METHOD(ike_sa_t, retransmit, status_t,
1663         private_ike_sa_t *this, u_int32_t message_id)
1664 {
1665         this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
1666         if (this->task_manager->retransmit(this->task_manager, message_id) != SUCCESS)
1667         {
1668                 /* send a proper signal to brief interested bus listeners */
1669                 switch (this->state)
1670                 {
1671                         case IKE_CONNECTING:
1672                         {
1673                                 /* retry IKE_SA_INIT if we have multiple keyingtries */
1674                                 u_int32_t tries = this->peer_cfg->get_keyingtries(this->peer_cfg);
1675                                 this->keyingtry++;
1676                                 if (tries == 0 || tries > this->keyingtry)
1677                                 {
1678                                         DBG1(DBG_IKE, "peer not responding, trying again (%d/%d)",
1679                                                  this->keyingtry + 1, tries);
1680                                         reset(this);
1681                                         requeue_init_tasks(this);
1682                                         return this->task_manager->initiate(this->task_manager);
1683                                 }
1684                                 DBG1(DBG_IKE, "establishing IKE_SA failed, peer not responding");
1685                                 break;
1686                         }
1687                         case IKE_DELETING:
1688                                 DBG1(DBG_IKE, "proper IKE_SA delete failed, peer not responding");
1689                                 break;
1690                         case IKE_REKEYING:
1691                                 DBG1(DBG_IKE, "rekeying IKE_SA failed, peer not responding");
1692                                 /* FALL */
1693                         default:
1694                                 reestablish(this);
1695                                 break;
1696                 }
1697                 return DESTROY_ME;
1698         }
1699         return SUCCESS;
1700 }
1701
1702 METHOD(ike_sa_t, set_auth_lifetime, void,
1703         private_ike_sa_t *this, u_int32_t lifetime)
1704 {
1705         u_int32_t reduction = this->peer_cfg->get_over_time(this->peer_cfg);
1706         u_int32_t reauth_time = time_monotonic(NULL) + lifetime - reduction;
1707
1708         if (lifetime < reduction)
1709         {
1710                 DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, starting reauthentication",
1711                          lifetime);
1712                 hydra->processor->queue_job(hydra->processor,
1713                                         (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE));
1714         }
1715         else if (this->stats[STAT_REAUTH] == 0 ||
1716                          this->stats[STAT_REAUTH] > reauth_time)
1717         {
1718                 this->stats[STAT_REAUTH] = reauth_time;
1719                 DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, scheduling reauthentication"
1720                          " in %ds", lifetime, lifetime - reduction);
1721                 hydra->scheduler->schedule_job(hydra->scheduler,
1722                                                 (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE),
1723                                                 lifetime - reduction);
1724         }
1725         else
1726         {
1727                 DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, "
1728                          "reauthentication already scheduled in %ds", lifetime,
1729                          this->stats[STAT_REAUTH] - time_monotonic(NULL));
1730         }
1731 }
1732
1733 METHOD(ike_sa_t, roam, status_t,
1734         private_ike_sa_t *this, bool address)
1735 {
1736         host_t *src;
1737         ike_mobike_t *mobike;
1738
1739         switch (this->state)
1740         {
1741                 case IKE_CREATED:
1742                 case IKE_DELETING:
1743                 case IKE_DESTROYING:
1744                 case IKE_PASSIVE:
1745                         return SUCCESS;
1746                 default:
1747                         break;
1748         }
1749         /* responder just updates the peer about changed address config */
1750         if (!this->ike_sa_id->is_initiator(this->ike_sa_id))
1751         {
1752                 if (supports_extension(this, EXT_MOBIKE) && address)
1753                 {
1754                         DBG1(DBG_IKE, "sending address list update using MOBIKE");
1755                         mobike = ike_mobike_create(&this->public, TRUE);
1756                         this->task_manager->queue_task(this->task_manager, (task_t*)mobike);
1757                         return this->task_manager->initiate(this->task_manager);
1758                 }
1759                 return SUCCESS;
1760         }
1761
1762         /* keep existing path if possible */
1763         src = charon->kernel_interface->get_source_addr(charon->kernel_interface,
1764                                                                                         this->other_host, this->my_host);
1765         if (src)
1766         {
1767                 if (src->ip_equals(src, this->my_host))
1768                 {
1769                         DBG2(DBG_IKE, "keeping connection path %H - %H",
1770                                  src, this->other_host);
1771                         src->destroy(src);
1772                         set_condition(this, COND_STALE, FALSE);
1773                         return SUCCESS;
1774                 }
1775                 src->destroy(src);
1776
1777         }
1778         else
1779         {
1780                 /* check if we find a route at all */
1781                 enumerator_t *enumerator;
1782                 host_t *addr;
1783
1784                 src = charon->kernel_interface->get_source_addr(charon->kernel_interface,
1785                                                                                                                 this->other_host, NULL);
1786                 if (!src)
1787                 {
1788                         enumerator = this->additional_addresses->create_enumerator(
1789                                                                                                         this->additional_addresses);
1790                         while (enumerator->enumerate(enumerator, &addr))
1791                         {
1792                                 DBG1(DBG_IKE, "looking for a route to %H ...", addr);
1793                                 src = charon->kernel_interface->get_source_addr(
1794                                                                                 charon->kernel_interface, addr, NULL);
1795                                 if (src)
1796                                 {
1797                                         break;
1798                                 }
1799                         }
1800                         enumerator->destroy(enumerator);
1801                 }
1802                 if (!src)
1803                 {
1804                         DBG1(DBG_IKE, "no route found to reach %H, MOBIKE update deferred",
1805                                  this->other_host);
1806                         set_condition(this, COND_STALE, TRUE);
1807                         return SUCCESS;
1808                 }
1809                 src->destroy(src);
1810         }
1811         set_condition(this, COND_STALE, FALSE);
1812
1813         /* update addresses with mobike, if supported ... */
1814         if (supports_extension(this, EXT_MOBIKE))
1815         {
1816                 DBG1(DBG_IKE, "requesting address change using MOBIKE");
1817                 mobike = ike_mobike_create(&this->public, TRUE);
1818                 mobike->roam(mobike, address);
1819                 this->task_manager->queue_task(this->task_manager, (task_t*)mobike);
1820                 return this->task_manager->initiate(this->task_manager);
1821         }
1822         DBG1(DBG_IKE, "reauthenticating IKE_SA due to address change");
1823         /* ... reauth if not */
1824         return reauth(this);
1825 }
1826
1827 METHOD(ike_sa_t, add_configuration_attribute, void,
1828         private_ike_sa_t *this, attribute_handler_t *handler,
1829         configuration_attribute_type_t type, chunk_t data)
1830 {
1831         attribute_entry_t *entry = malloc_thing(attribute_entry_t);
1832
1833         entry->handler = handler;
1834         entry->type = type;
1835         entry->data = chunk_clone(data);
1836
1837         this->attributes->insert_last(this->attributes, entry);
1838 }
1839
1840 METHOD(ike_sa_t, create_task_enumerator, enumerator_t*,
1841         private_ike_sa_t *this, task_queue_t queue)
1842 {
1843         return this->task_manager->create_task_enumerator(this->task_manager, queue);
1844 }
1845
1846 METHOD(ike_sa_t, inherit, status_t,
1847         private_ike_sa_t *this, ike_sa_t *other_public)
1848 {
1849         private_ike_sa_t *other = (private_ike_sa_t*)other_public;
1850         child_sa_t *child_sa;
1851         attribute_entry_t *entry;
1852
1853         /* apply hosts and ids */
1854         this->my_host->destroy(this->my_host);
1855         this->other_host->destroy(this->other_host);
1856         this->my_id->destroy(this->my_id);
1857         this->other_id->destroy(this->other_id);
1858         this->my_host = other->my_host->clone(other->my_host);
1859         this->other_host = other->other_host->clone(other->other_host);
1860         this->my_id = other->my_id->clone(other->my_id);
1861         this->other_id = other->other_id->clone(other->other_id);
1862
1863         /* apply virtual assigned IPs... */
1864         if (other->my_virtual_ip)
1865         {
1866                 this->my_virtual_ip = other->my_virtual_ip;
1867                 other->my_virtual_ip = NULL;
1868         }
1869         if (other->other_virtual_ip)
1870         {
1871                 this->other_virtual_ip = other->other_virtual_ip;
1872                 other->other_virtual_ip = NULL;
1873         }
1874
1875         /* ... and configuration attributes */
1876         while (other->attributes->remove_last(other->attributes,
1877                                                                                   (void**)&entry) == SUCCESS)
1878         {
1879                 this->attributes->insert_first(this->attributes, entry);
1880         }
1881
1882         /* inherit all conditions */
1883         this->conditions = other->conditions;
1884         if (this->conditions & COND_NAT_HERE)
1885         {
1886                 send_keepalive(this);
1887         }
1888
1889 #ifdef ME
1890         if (other->is_mediation_server)
1891         {
1892                 act_as_mediation_server(this);
1893         }
1894         else if (other->server_reflexive_host)
1895         {
1896                 this->server_reflexive_host = other->server_reflexive_host->clone(
1897                                 other->server_reflexive_host);
1898         }
1899 #endif /* ME */
1900
1901         /* adopt all children */
1902         while (other->child_sas->remove_last(other->child_sas,
1903                                                                                  (void**)&child_sa) == SUCCESS)
1904         {
1905                 this->child_sas->insert_first(this->child_sas, (void*)child_sa);
1906         }
1907
1908         /* move pending tasks to the new IKE_SA */
1909         this->task_manager->adopt_tasks(this->task_manager, other->task_manager);
1910
1911         /* reauthentication timeout survives a rekeying */
1912         if (other->stats[STAT_REAUTH])
1913         {
1914                 time_t reauth, delete, now = time_monotonic(NULL);
1915
1916                 this->stats[STAT_REAUTH] = other->stats[STAT_REAUTH];
1917                 reauth = this->stats[STAT_REAUTH] - now;
1918                 delete = reauth + this->peer_cfg->get_over_time(this->peer_cfg);
1919                 this->stats[STAT_DELETE] = this->stats[STAT_REAUTH] + delete;
1920                 DBG1(DBG_IKE, "rescheduling reauthentication in %ds after rekeying, "
1921                          "lifetime reduced to %ds", reauth, delete);
1922                 hydra->scheduler->schedule_job(hydra->scheduler,
1923                                 (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE), reauth);
1924                 hydra->scheduler->schedule_job(hydra->scheduler,
1925                                 (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE), delete);
1926         }
1927         /* we have to initate here, there may be new tasks to handle */
1928         return this->task_manager->initiate(this->task_manager);
1929 }
1930
1931 METHOD(ike_sa_t, destroy, void,
1932         private_ike_sa_t *this)
1933 {
1934         attribute_entry_t *entry;
1935
1936         charon->bus->set_sa(charon->bus, &this->public);
1937
1938         set_state(this, IKE_DESTROYING);
1939
1940         /* remove attributes first, as we pass the IKE_SA to the handler */
1941         while (this->attributes->remove_last(this->attributes,
1942                                                                                  (void**)&entry) == SUCCESS)
1943         {
1944                 hydra->attributes->release(hydra->attributes, entry->handler,
1945                                                                    this->other_id, entry->type, entry->data);
1946                 free(entry->data.ptr);
1947                 free(entry);
1948         }
1949         this->attributes->destroy(this->attributes);
1950
1951         this->child_sas->destroy_offset(this->child_sas, offsetof(child_sa_t, destroy));
1952
1953         /* unset SA after here to avoid usage by the listeners */
1954         charon->bus->set_sa(charon->bus, NULL);
1955
1956         this->task_manager->destroy(this->task_manager);
1957         this->keymat->destroy(this->keymat);
1958
1959         if (this->my_virtual_ip)
1960         {
1961                 charon->kernel_interface->del_ip(charon->kernel_interface,
1962                                                                                  this->my_virtual_ip);
1963                 this->my_virtual_ip->destroy(this->my_virtual_ip);
1964         }
1965         if (this->other_virtual_ip)
1966         {
1967                 if (this->peer_cfg && this->peer_cfg->get_pool(this->peer_cfg))
1968                 {
1969                         hydra->attributes->release_address(hydra->attributes,
1970                                                         this->peer_cfg->get_pool(this->peer_cfg),
1971                                                         this->other_virtual_ip, get_other_eap_id(this));
1972                 }
1973                 this->other_virtual_ip->destroy(this->other_virtual_ip);
1974         }
1975         this->additional_addresses->destroy_offset(this->additional_addresses,
1976                                                                                                         offsetof(host_t, destroy));
1977 #ifdef ME
1978         if (this->is_mediation_server)
1979         {
1980                 charon->mediation_manager->remove(charon->mediation_manager,
1981                                                                                   this->ike_sa_id);
1982         }
1983         DESTROY_IF(this->server_reflexive_host);
1984         chunk_free(&this->connect_id);
1985 #endif /* ME */
1986         free(this->nat_detection_dest.ptr);
1987
1988         DESTROY_IF(this->my_host);
1989         DESTROY_IF(this->other_host);
1990         DESTROY_IF(this->my_id);
1991         DESTROY_IF(this->other_id);
1992         DESTROY_IF(this->local_host);
1993         DESTROY_IF(this->remote_host);
1994
1995         DESTROY_IF(this->ike_cfg);
1996         DESTROY_IF(this->peer_cfg);
1997         DESTROY_IF(this->proposal);
1998         this->my_auth->destroy(this->my_auth);
1999         this->other_auth->destroy(this->other_auth);
2000         this->my_auths->destroy_offset(this->my_auths,
2001                                                                    offsetof(auth_cfg_t, destroy));
2002         this->other_auths->destroy_offset(this->other_auths,
2003                                                                           offsetof(auth_cfg_t, destroy));
2004
2005         this->ike_sa_id->destroy(this->ike_sa_id);
2006         free(this);
2007 }
2008
2009 /*
2010  * Described in header.
2011  */
2012 ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
2013 {
2014         private_ike_sa_t *this;
2015         static u_int32_t unique_id = 0;
2016
2017         INIT(this,
2018                 .public = {
2019                         .get_state = _get_state,
2020                         .set_state = _set_state,
2021                         .get_name = _get_name,
2022                         .get_statistic = _get_statistic,
2023                         .process_message = _process_message,
2024                         .initiate = _initiate,
2025                         .get_ike_cfg = _get_ike_cfg,
2026                         .set_ike_cfg = _set_ike_cfg,
2027                         .get_peer_cfg = _get_peer_cfg,
2028                         .set_peer_cfg = _set_peer_cfg,
2029                         .get_auth_cfg = _get_auth_cfg,
2030                         .create_auth_cfg_enumerator = _create_auth_cfg_enumerator,
2031                         .add_auth_cfg = _add_auth_cfg,
2032                         .get_proposal = _get_proposal,
2033                         .set_proposal = _set_proposal,
2034                         .get_id = _get_id,
2035                         .get_my_host = _get_my_host,
2036                         .set_my_host = _set_my_host,
2037                         .get_other_host = _get_other_host,
2038                         .set_other_host = _set_other_host,
2039                         .set_message_id = _set_message_id,
2040                         .float_ports = _float_ports,
2041                         .update_hosts = _update_hosts,
2042                         .get_my_id = _get_my_id,
2043                         .set_my_id = _set_my_id,
2044                         .get_other_id = _get_other_id,
2045                         .set_other_id = _set_other_id,
2046                         .get_other_eap_id = _get_other_eap_id,
2047                         .enable_extension = _enable_extension,
2048                         .supports_extension = _supports_extension,
2049                         .set_condition = _set_condition,
2050                         .has_condition = _has_condition,
2051                         .set_pending_updates = _set_pending_updates,
2052                         .get_pending_updates = _get_pending_updates,
2053                         .create_additional_address_iterator = _create_additional_address_iterator,
2054                         .add_additional_address = _add_additional_address,
2055                         .has_mapping_changed = _has_mapping_changed,
2056                         .retransmit = _retransmit,
2057                         .delete = _delete_,
2058                         .destroy = _destroy,
2059                         .send_dpd = _send_dpd,
2060                         .send_keepalive = _send_keepalive,
2061                         .get_keymat = _get_keymat,
2062                         .add_child_sa = _add_child_sa,
2063                         .get_child_sa = _get_child_sa,
2064                         .create_child_sa_iterator = _create_child_sa_iterator,
2065                         .rekey_child_sa = _rekey_child_sa,
2066                         .delete_child_sa = _delete_child_sa,
2067                         .destroy_child_sa = _destroy_child_sa,
2068                         .rekey = _rekey,
2069                         .reauth = _reauth,
2070                         .reestablish = _reestablish,
2071                         .set_auth_lifetime = _set_auth_lifetime,
2072                         .roam = _roam,
2073                         .inherit = _inherit,
2074                         .generate_message = _generate_message,
2075                         .reset = _reset,
2076                         .get_unique_id = _get_unique_id,
2077                         .set_virtual_ip = _set_virtual_ip,
2078                         .get_virtual_ip = _get_virtual_ip,
2079                         .add_configuration_attribute = _add_configuration_attribute,
2080                         .set_kmaddress = _set_kmaddress,
2081                         .create_task_enumerator = _create_task_enumerator,
2082 #ifdef ME
2083                         .act_as_mediation_server = _act_as_mediation_server,
2084                         .get_server_reflexive_host = _get_server_reflexive_host,
2085                         .set_server_reflexive_host = _set_server_reflexive_host,
2086                         .get_connect_id = _get_connect_id,
2087                         .initiate_mediation = _initiate_mediation,
2088                         .initiate_mediated = _initiate_mediated,
2089                         .relay = _relay,
2090                         .callback = _callback,
2091                         .respond = _respond,
2092 #endif /* ME */
2093                 },
2094                 .ike_sa_id = ike_sa_id->clone(ike_sa_id),
2095                 .child_sas = linked_list_create(),
2096                 .my_host = host_create_any(AF_INET),
2097                 .other_host = host_create_any(AF_INET),
2098                 .my_id = identification_create_from_encoding(ID_ANY, chunk_empty),
2099                 .other_id = identification_create_from_encoding(ID_ANY, chunk_empty),
2100                 .keymat = keymat_create(ike_sa_id->is_initiator(ike_sa_id)),
2101                 .state = IKE_CREATED,
2102                 .stats[STAT_INBOUND] = time_monotonic(NULL),
2103                 .stats[STAT_OUTBOUND] = time_monotonic(NULL),
2104                 .my_auth = auth_cfg_create(),
2105                 .other_auth = auth_cfg_create(),
2106                 .my_auths = linked_list_create(),
2107                 .other_auths = linked_list_create(),
2108                 .task_manager = task_manager_create(&this->public),
2109                 .unique_id = ++unique_id,
2110                 .additional_addresses = linked_list_create(),
2111                 .attributes = linked_list_create(),
2112                 .keepalive_interval = lib->settings->get_time(lib->settings,
2113                                                                         "charon.keep_alive", KEEPALIVE_INTERVAL),
2114         );
2115         this->my_host->set_port(this->my_host, IKEV2_UDP_PORT);
2116
2117         return &this->public;
2118 }