2 * Copyright (C) 2006-2015 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2009 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * Copyright (c) 2014 Volker RĂ¼melin
22 * Permission is hereby granted, free of charge, to any person obtaining a copy
23 * of this software and associated documentation files (the "Software"), to deal
24 * in the Software without restriction, including without limitation the rights
25 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
26 * copies of the Software, and to permit persons to whom the Software is
27 * furnished to do so, subject to the following conditions:
29 * The above copyright notice and this permission notice shall be included in
30 * all copies or substantial portions of the Software.
32 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
33 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
34 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
35 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
36 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
37 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
50 #include <collections/array.h>
51 #include <utils/lexparser.h>
52 #include <processing/jobs/retransmit_job.h>
53 #include <processing/jobs/delete_ike_sa_job.h>
54 #include <processing/jobs/send_dpd_job.h>
55 #include <processing/jobs/send_keepalive_job.h>
56 #include <processing/jobs/rekey_ike_sa_job.h>
57 #include <processing/jobs/retry_initiate_job.h>
58 #include <sa/ikev2/tasks/ike_auth_lifetime.h>
61 #include <sa/ikev2/tasks/ike_me.h>
62 #include <processing/jobs/initiate_mediation_job.h>
65 ENUM(ike_sa_state_names
, IKE_CREATED
, IKE_DESTROYING
,
75 typedef struct private_ike_sa_t private_ike_sa_t
;
76 typedef struct attribute_entry_t attribute_entry_t
;
79 * Private data of an ike_sa_t object.
81 struct private_ike_sa_t
{
89 * Identifier for the current IKE_SA.
91 ike_sa_id_t
*ike_sa_id
;
94 * IKE version of this SA.
96 ike_version_t version
;
99 * unique numerical ID for this IKE_SA.
104 * Current state of the IKE_SA
106 ike_sa_state_t state
;
109 * IKE configuration used to set up this IKE_SA
114 * Peer and authentication information to establish IKE_SA.
116 peer_cfg_t
*peer_cfg
;
119 * currently used authentication ruleset, local
124 * currently used authentication constraints, remote
126 auth_cfg_t
*other_auth
;
129 * Array of completed local authentication rounds (as auth_cfg_t)
134 * Array of completed remote authentication rounds (as auth_cfg_t)
136 array_t
*other_auths
;
139 * Selected IKE proposal
141 proposal_t
*proposal
;
144 * Juggles tasks to process messages
146 task_manager_t
*task_manager
;
149 * Address of local host
154 * Address of remote host
160 * Are we mediation server
162 bool is_mediation_server
;
165 * Server reflexive host
167 host_t
*server_reflexive_host
;
176 * Identification used for us
178 identification_t
*my_id
;
181 * Identification used for other
183 identification_t
*other_id
;
186 * set of extensions the peer supports
188 ike_extension_t extensions
;
191 * set of condition flags currently enabled for this IKE_SA
193 ike_condition_t conditions
;
196 * Array containing the child sa's of the current IKE_SA.
201 * keymat of this IKE_SA
206 * Virtual IPs on local host
211 * Virtual IPs on remote host
216 * List of configuration attributes (attribute_entry_t)
221 * list of peer's addresses, additional ones transmitted via MOBIKE
223 array_t
*peer_addresses
;
226 * previously value of received DESTINATION_IP hash
228 chunk_t nat_detection_dest
;
231 * number pending UPDATE_SA_ADDRESS (MOBIKE)
233 u_int32_t pending_updates
;
236 * NAT keep alive interval
238 u_int32_t keepalive_interval
;
241 * The schedueld keep alive job, if any
243 send_keepalive_job_t
*keepalive_job
;
246 * interval for retries during initiation (e.g. if DNS resolution failed),
247 * 0 to disable (default)
249 u_int32_t retry_initiate_interval
;
252 * TRUE if a retry_initiate_job has been queued
254 bool retry_initiate_queued
;
257 * Timestamps for this IKE_SA
259 u_int32_t stats
[STAT_MAX
];
262 * how many times we have retried so far (keyingtries)
267 * local host address to be used for IKE, set via MIGRATE kernel message
272 * remote host address to be used for IKE, set via MIGRATE kernel message
277 * Flush auth configs once established?
282 * Maximum length of a single fragment, 0 for address-specific defaults
284 size_t fragment_size
;
288 * Entry to maintain install configuration attributes during IKE_SA lifetime
290 struct attribute_entry_t
{
291 /** handler used to install this attribute */
292 attribute_handler_t
*handler
;
293 /** attribute type */
294 configuration_attribute_type_t type
;
295 /** attribute data */
300 * get the time of the latest traffic processed by the kernel
302 static time_t get_use_time(private_ike_sa_t
* this, bool inbound
)
304 enumerator_t
*enumerator
;
305 child_sa_t
*child_sa
;
306 time_t use_time
, current
;
310 use_time
= this->stats
[STAT_INBOUND
];
314 use_time
= this->stats
[STAT_OUTBOUND
];
317 enumerator
= array_create_enumerator(this->child_sas
);
318 while (enumerator
->enumerate(enumerator
, &child_sa
))
320 child_sa
->get_usestats(child_sa
, inbound
, ¤t
, NULL
, NULL
);
321 use_time
= max(use_time
, current
);
323 enumerator
->destroy(enumerator
);
328 METHOD(ike_sa_t
, get_unique_id
, u_int32_t
,
329 private_ike_sa_t
*this)
331 return this->unique_id
;
334 METHOD(ike_sa_t
, get_name
, char*,
335 private_ike_sa_t
*this)
339 return this->peer_cfg
->get_name(this->peer_cfg
);
344 METHOD(ike_sa_t
, get_statistic
, u_int32_t
,
345 private_ike_sa_t
*this, statistic_t kind
)
349 return this->stats
[kind
];
354 METHOD(ike_sa_t
, set_statistic
, void,
355 private_ike_sa_t
*this, statistic_t kind
, u_int32_t value
)
359 this->stats
[kind
] = value
;
363 METHOD(ike_sa_t
, get_my_host
, host_t
*,
364 private_ike_sa_t
*this)
366 return this->my_host
;
369 METHOD(ike_sa_t
, set_my_host
, void,
370 private_ike_sa_t
*this, host_t
*me
)
372 DESTROY_IF(this->my_host
);
376 METHOD(ike_sa_t
, get_other_host
, host_t
*,
377 private_ike_sa_t
*this)
379 return this->other_host
;
382 METHOD(ike_sa_t
, set_other_host
, void,
383 private_ike_sa_t
*this, host_t
*other
)
385 DESTROY_IF(this->other_host
);
386 this->other_host
= other
;
389 METHOD(ike_sa_t
, get_peer_cfg
, peer_cfg_t
*,
390 private_ike_sa_t
*this)
392 return this->peer_cfg
;
395 METHOD(ike_sa_t
, set_peer_cfg
, void,
396 private_ike_sa_t
*this, peer_cfg_t
*peer_cfg
)
398 peer_cfg
->get_ref(peer_cfg
);
399 DESTROY_IF(this->peer_cfg
);
400 this->peer_cfg
= peer_cfg
;
402 if (this->ike_cfg
== NULL
)
404 this->ike_cfg
= peer_cfg
->get_ike_cfg(peer_cfg
);
405 this->ike_cfg
->get_ref(this->ike_cfg
);
409 METHOD(ike_sa_t
, get_auth_cfg
, auth_cfg_t
*,
410 private_ike_sa_t
*this, bool local
)
414 return this->my_auth
;
416 return this->other_auth
;
419 METHOD(ike_sa_t
, add_auth_cfg
, void,
420 private_ike_sa_t
*this, bool local
, auth_cfg_t
*cfg
)
424 array_insert(this->my_auths
, ARRAY_TAIL
, cfg
);
428 array_insert(this->other_auths
, ARRAY_TAIL
, cfg
);
432 METHOD(ike_sa_t
, create_auth_cfg_enumerator
, enumerator_t
*,
433 private_ike_sa_t
*this, bool local
)
437 return array_create_enumerator(this->my_auths
);
439 return array_create_enumerator(this->other_auths
);
443 * Flush the stored authentication round information
445 static void flush_auth_cfgs(private_ike_sa_t
*this)
449 this->my_auth
->purge(this->my_auth
, FALSE
);
450 this->other_auth
->purge(this->other_auth
, FALSE
);
452 while (array_remove(this->my_auths
, ARRAY_TAIL
, &cfg
))
456 while (array_remove(this->other_auths
, ARRAY_TAIL
, &cfg
))
462 METHOD(ike_sa_t
, get_proposal
, proposal_t
*,
463 private_ike_sa_t
*this)
465 return this->proposal
;
468 METHOD(ike_sa_t
, set_proposal
, void,
469 private_ike_sa_t
*this, proposal_t
*proposal
)
471 DESTROY_IF(this->proposal
);
472 this->proposal
= proposal
->clone(proposal
);
475 METHOD(ike_sa_t
, set_message_id
, void,
476 private_ike_sa_t
*this, bool initiate
, u_int32_t mid
)
480 this->task_manager
->reset(this->task_manager
, mid
, UINT_MAX
);
484 this->task_manager
->reset(this->task_manager
, UINT_MAX
, mid
);
488 METHOD(ike_sa_t
, send_keepalive
, void,
489 private_ike_sa_t
*this, bool scheduled
)
491 time_t last_out
, now
, diff
;
495 this->keepalive_job
= NULL
;
497 if (!this->keepalive_interval
|| this->state
== IKE_PASSIVE
)
498 { /* keepalives disabled either by configuration or for passive IKE_SAs */
501 if (!(this->conditions
& COND_NAT_HERE
) || (this->conditions
& COND_STALE
))
502 { /* disable keepalives if we are not NATed anymore, or the SA is stale */
506 last_out
= get_use_time(this, FALSE
);
507 now
= time_monotonic(NULL
);
509 diff
= now
- last_out
;
511 if (diff
>= this->keepalive_interval
)
516 packet
= packet_create();
517 packet
->set_source(packet
, this->my_host
->clone(this->my_host
));
518 packet
->set_destination(packet
, this->other_host
->clone(this->other_host
));
519 data
.ptr
= malloc(1);
522 packet
->set_data(packet
, data
);
523 DBG1(DBG_IKE
, "sending keep alive to %#H", this->other_host
);
524 charon
->sender
->send_no_marker(charon
->sender
, packet
);
527 if (!this->keepalive_job
)
529 this->keepalive_job
= send_keepalive_job_create(this->ike_sa_id
);
530 lib
->scheduler
->schedule_job(lib
->scheduler
, (job_t
*)this->keepalive_job
,
531 this->keepalive_interval
- diff
);
535 METHOD(ike_sa_t
, get_ike_cfg
, ike_cfg_t
*,
536 private_ike_sa_t
*this)
538 return this->ike_cfg
;
541 METHOD(ike_sa_t
, set_ike_cfg
, void,
542 private_ike_sa_t
*this, ike_cfg_t
*ike_cfg
)
544 ike_cfg
->get_ref(ike_cfg
);
545 this->ike_cfg
= ike_cfg
;
548 METHOD(ike_sa_t
, enable_extension
, void,
549 private_ike_sa_t
*this, ike_extension_t extension
)
551 this->extensions
|= extension
;
554 METHOD(ike_sa_t
, supports_extension
, bool,
555 private_ike_sa_t
*this, ike_extension_t extension
)
557 return (this->extensions
& extension
) != FALSE
;
560 METHOD(ike_sa_t
, has_condition
, bool,
561 private_ike_sa_t
*this, ike_condition_t condition
)
563 return (this->conditions
& condition
) != FALSE
;
566 METHOD(ike_sa_t
, set_condition
, void,
567 private_ike_sa_t
*this, ike_condition_t condition
, bool enable
)
569 if (has_condition(this, condition
) != enable
)
573 this->conditions
|= condition
;
577 DBG1(DBG_IKE
, "local host is behind NAT, sending keep alives");
578 this->conditions
|= COND_NAT_ANY
;
579 send_keepalive(this, FALSE
);
582 DBG1(DBG_IKE
, "remote host is behind NAT");
583 this->conditions
|= COND_NAT_ANY
;
586 DBG1(DBG_IKE
, "faking NAT situation to enforce UDP encapsulation");
587 this->conditions
|= COND_NAT_ANY
;
595 this->conditions
&= ~condition
;
601 set_condition(this, COND_NAT_ANY
,
602 has_condition(this, COND_NAT_HERE
) ||
603 has_condition(this, COND_NAT_THERE
) ||
604 has_condition(this, COND_NAT_FAKE
));
607 send_keepalive(this, FALSE
);
616 METHOD(ike_sa_t
, send_dpd
, status_t
,
617 private_ike_sa_t
*this)
621 bool task_queued
= FALSE
;
623 if (this->state
== IKE_PASSIVE
)
625 return INVALID_STATE
;
627 delay
= this->peer_cfg
->get_dpd(this->peer_cfg
);
628 if (this->task_manager
->busy(this->task_manager
))
630 /* an exchange is in the air, no need to start a DPD check */
635 /* check if there was any inbound traffic */
637 last_in
= get_use_time(this, TRUE
);
638 now
= time_monotonic(NULL
);
639 diff
= now
- last_in
;
640 if (!delay
|| diff
>= delay
)
642 /* too long ago, initiate dead peer detection */
643 DBG1(DBG_IKE
, "sending DPD request");
644 this->task_manager
->queue_dpd(this->task_manager
);
649 /* recheck in "interval" seconds */
652 job
= (job_t
*)send_dpd_job_create(this->ike_sa_id
);
653 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, delay
- diff
);
657 return this->task_manager
->initiate(this->task_manager
);
662 METHOD(ike_sa_t
, get_state
, ike_sa_state_t
,
663 private_ike_sa_t
*this)
668 METHOD(ike_sa_t
, set_state
, void,
669 private_ike_sa_t
*this, ike_sa_state_t state
)
671 bool trigger_dpd
= FALSE
, keepalives
= FALSE
;
673 DBG2(DBG_IKE
, "IKE_SA %s[%d] state change: %N => %N",
674 get_name(this), this->unique_id
,
675 ike_sa_state_names
, this->state
,
676 ike_sa_state_names
, state
);
680 case IKE_ESTABLISHED
:
682 if (this->state
== IKE_CONNECTING
||
683 this->state
== IKE_PASSIVE
)
688 /* calculate rekey, reauth and lifetime */
689 this->stats
[STAT_ESTABLISHED
] = time_monotonic(NULL
);
691 /* schedule rekeying if we have a time which is smaller than
692 * an already scheduled rekeying */
693 t
= this->peer_cfg
->get_rekey_time(this->peer_cfg
, TRUE
);
694 if (t
&& (this->stats
[STAT_REKEY
] == 0 ||
695 (this->stats
[STAT_REKEY
] > t
+ this->stats
[STAT_ESTABLISHED
])))
697 this->stats
[STAT_REKEY
] = t
+ this->stats
[STAT_ESTABLISHED
];
698 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, FALSE
);
699 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
700 DBG1(DBG_IKE
, "scheduling rekeying in %ds", t
);
702 t
= this->peer_cfg
->get_reauth_time(this->peer_cfg
, TRUE
);
703 if (t
&& (this->stats
[STAT_REAUTH
] == 0 ||
704 (this->stats
[STAT_REAUTH
] > t
+ this->stats
[STAT_ESTABLISHED
])))
706 this->stats
[STAT_REAUTH
] = t
+ this->stats
[STAT_ESTABLISHED
];
707 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
);
708 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
709 DBG1(DBG_IKE
, "scheduling reauthentication in %ds", t
);
711 t
= this->peer_cfg
->get_over_time(this->peer_cfg
);
712 if (this->stats
[STAT_REKEY
] || this->stats
[STAT_REAUTH
])
714 if (this->stats
[STAT_REAUTH
] == 0)
716 this->stats
[STAT_DELETE
] = this->stats
[STAT_REKEY
];
718 else if (this->stats
[STAT_REKEY
] == 0)
720 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
];
724 this->stats
[STAT_DELETE
] = min(this->stats
[STAT_REKEY
],
725 this->stats
[STAT_REAUTH
]);
727 this->stats
[STAT_DELETE
] += t
;
728 t
= this->stats
[STAT_DELETE
] - this->stats
[STAT_ESTABLISHED
];
729 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
730 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
731 DBG1(DBG_IKE
, "maximum IKE_SA lifetime %ds", t
);
733 trigger_dpd
= this->peer_cfg
->get_dpd(this->peer_cfg
);
736 /* Some peers delay the DELETE after rekeying an IKE_SA.
737 * If this delay is longer than our DPD delay, we would
738 * send a DPD request here. The IKE_SA is not ready to do
739 * so yet, so prevent that. */
740 this->stats
[STAT_INBOUND
] = this->stats
[STAT_ESTABLISHED
];
742 if (this->state
== IKE_PASSIVE
)
752 charon
->bus
->ike_state_change(charon
->bus
, &this->public, state
);
757 if (supports_extension(this, EXT_DPD
))
763 DBG1(DBG_IKE
, "DPD not supported by peer, disabled");
768 send_keepalive(this, FALSE
);
772 METHOD(ike_sa_t
, reset
, void,
773 private_ike_sa_t
*this)
775 /* the responder ID is reset, as peer may choose another one */
776 if (this->ike_sa_id
->is_initiator(this->ike_sa_id
))
778 this->ike_sa_id
->set_responder_spi(this->ike_sa_id
, 0);
781 set_state(this, IKE_CREATED
);
783 flush_auth_cfgs(this);
785 this->keymat
->destroy(this->keymat
);
786 this->keymat
= keymat_create(this->version
,
787 this->ike_sa_id
->is_initiator(this->ike_sa_id
));
789 this->task_manager
->reset(this->task_manager
, 0, 0);
792 METHOD(ike_sa_t
, get_keymat
, keymat_t
*,
793 private_ike_sa_t
*this)
798 METHOD(ike_sa_t
, add_virtual_ip
, void,
799 private_ike_sa_t
*this, bool local
, host_t
*ip
)
805 if (charon
->kernel
->get_interface(charon
->kernel
, this->my_host
,
808 DBG1(DBG_IKE
, "installing new virtual IP %H", ip
);
809 if (charon
->kernel
->add_ip(charon
->kernel
, ip
, -1,
812 array_insert_create(&this->my_vips
, ARRAY_TAIL
, ip
->clone(ip
));
816 DBG1(DBG_IKE
, "installing virtual IP %H failed", ip
);
822 DBG1(DBG_IKE
, "looking up interface for virtual IP %H failed", ip
);
827 array_insert_create(&this->other_vips
, ARRAY_TAIL
, ip
->clone(ip
));
832 METHOD(ike_sa_t
, clear_virtual_ips
, void,
833 private_ike_sa_t
*this, bool local
)
838 vips
= local ?
this->my_vips
: this->other_vips
;
839 if (!local
&& array_count(vips
))
841 charon
->bus
->assign_vips(charon
->bus
, &this->public, FALSE
);
843 while (array_remove(vips
, ARRAY_HEAD
, &vip
))
847 charon
->kernel
->del_ip(charon
->kernel
, vip
, -1, TRUE
);
853 METHOD(ike_sa_t
, create_virtual_ip_enumerator
, enumerator_t
*,
854 private_ike_sa_t
*this, bool local
)
858 return array_create_enumerator(this->my_vips
);
860 return array_create_enumerator(this->other_vips
);
863 METHOD(ike_sa_t
, add_peer_address
, void,
864 private_ike_sa_t
*this, host_t
*host
)
866 array_insert_create(&this->peer_addresses
, ARRAY_TAIL
, host
);
869 METHOD(ike_sa_t
, create_peer_address_enumerator
, enumerator_t
*,
870 private_ike_sa_t
*this)
872 if (this->peer_addresses
)
874 return array_create_enumerator(this->peer_addresses
);
876 /* in case we don't have MOBIKE */
877 return enumerator_create_single(this->other_host
, NULL
);
880 METHOD(ike_sa_t
, clear_peer_addresses
, void,
881 private_ike_sa_t
*this)
883 array_destroy_offset(this->peer_addresses
, offsetof(host_t
, destroy
));
884 this->peer_addresses
= NULL
;
887 METHOD(ike_sa_t
, has_mapping_changed
, bool,
888 private_ike_sa_t
*this, chunk_t hash
)
890 if (this->nat_detection_dest
.ptr
== NULL
)
892 this->nat_detection_dest
= chunk_clone(hash
);
895 if (chunk_equals(hash
, this->nat_detection_dest
))
899 free(this->nat_detection_dest
.ptr
);
900 this->nat_detection_dest
= chunk_clone(hash
);
904 METHOD(ike_sa_t
, set_pending_updates
, void,
905 private_ike_sa_t
*this, u_int32_t updates
)
907 this->pending_updates
= updates
;
910 METHOD(ike_sa_t
, get_pending_updates
, u_int32_t
,
911 private_ike_sa_t
*this)
913 return this->pending_updates
;
916 METHOD(ike_sa_t
, float_ports
, void,
917 private_ike_sa_t
*this)
919 /* do not switch if we have a custom port from MOBIKE/NAT */
920 if (this->my_host
->get_port(this->my_host
) ==
921 charon
->socket
->get_port(charon
->socket
, FALSE
))
923 this->my_host
->set_port(this->my_host
,
924 charon
->socket
->get_port(charon
->socket
, TRUE
));
926 if (this->other_host
->get_port(this->other_host
) == IKEV2_UDP_PORT
)
928 this->other_host
->set_port(this->other_host
, IKEV2_NATT_PORT
);
932 METHOD(ike_sa_t
, update_hosts
, void,
933 private_ike_sa_t
*this, host_t
*me
, host_t
*other
, bool force
)
943 other
= this->other_host
;
946 /* apply hosts on first received message */
947 if (this->my_host
->is_anyaddr(this->my_host
) ||
948 this->other_host
->is_anyaddr(this->other_host
))
950 set_my_host(this, me
->clone(me
));
951 set_other_host(this, other
->clone(other
));
956 /* update our address in any case */
957 if (force
&& !me
->equals(me
, this->my_host
))
959 charon
->bus
->ike_update(charon
->bus
, &this->public, TRUE
, me
);
960 set_my_host(this, me
->clone(me
));
964 if (!other
->equals(other
, this->other_host
) &&
965 (force
|| has_condition(this, COND_NAT_THERE
)))
967 /* only update other's address if we are behind a static NAT,
968 * which we assume is the case if we are not initiator */
970 (!has_condition(this, COND_NAT_HERE
) ||
971 !has_condition(this, COND_ORIGINAL_INITIATOR
)))
973 charon
->bus
->ike_update(charon
->bus
, &this->public, FALSE
, other
);
974 set_other_host(this, other
->clone(other
));
980 /* update all associated CHILD_SAs, if required */
983 enumerator_t
*enumerator
;
984 child_sa_t
*child_sa
;
987 vips
= linked_list_create_from_enumerator(
988 array_create_enumerator(this->my_vips
));
990 enumerator
= array_create_enumerator(this->child_sas
);
991 while (enumerator
->enumerate(enumerator
, &child_sa
))
993 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, child_sa
);
994 charon
->child_sa_manager
->add(charon
->child_sa_manager
,
995 child_sa
, &this->public);
997 if (child_sa
->update(child_sa
, this->my_host
, this->other_host
,
998 vips
, has_condition(this, COND_NAT_ANY
)) == NOT_SUPPORTED
)
1000 this->public.rekey_child_sa(&this->public,
1001 child_sa
->get_protocol(child_sa
),
1002 child_sa
->get_spi(child_sa
, TRUE
));
1006 enumerator
->destroy(enumerator
);
1008 vips
->destroy(vips
);
1013 * Set configured DSCP value on packet
1015 static void set_dscp(private_ike_sa_t
*this, packet_t
*packet
)
1019 /* prefer IKE config on peer_cfg, as its selection is more accurate
1020 * then the initial IKE config */
1023 ike_cfg
= this->peer_cfg
->get_ike_cfg(this->peer_cfg
);
1027 ike_cfg
= this->ike_cfg
;
1031 packet
->set_dscp(packet
, ike_cfg
->get_dscp(ike_cfg
));
1035 METHOD(ike_sa_t
, generate_message
, status_t
,
1036 private_ike_sa_t
*this, message_t
*message
, packet_t
**packet
)
1040 if (message
->is_encoded(message
))
1041 { /* already encoded in task, but set DSCP value */
1042 *packet
= message
->get_packet(message
);
1043 set_dscp(this, *packet
);
1046 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
1047 message
->set_ike_sa_id(message
, this->ike_sa_id
);
1048 charon
->bus
->message(charon
->bus
, message
, FALSE
, TRUE
);
1049 status
= message
->generate(message
, this->keymat
, packet
);
1050 if (status
== SUCCESS
)
1052 set_dscp(this, *packet
);
1053 charon
->bus
->message(charon
->bus
, message
, FALSE
, FALSE
);
1058 static bool filter_fragments(private_ike_sa_t
*this, packet_t
**fragment
,
1061 *packet
= (*fragment
)->clone(*fragment
);
1062 set_dscp(this, *packet
);
1066 METHOD(ike_sa_t
, generate_message_fragmented
, status_t
,
1067 private_ike_sa_t
*this, message_t
*message
, enumerator_t
**packets
)
1069 enumerator_t
*fragments
;
1072 bool use_frags
= FALSE
;
1076 switch (this->ike_cfg
->fragmentation(this->ike_cfg
))
1078 case FRAGMENTATION_FORCE
:
1081 case FRAGMENTATION_YES
:
1082 use_frags
= supports_extension(this, EXT_IKE_FRAGMENTATION
);
1083 if (use_frags
&& this->version
== IKEV1
&&
1084 supports_extension(this, EXT_MS_WINDOWS
))
1086 /* It seems Windows 7 and 8 peers only accept proprietary
1087 * fragmented messages if they expect certificates. */
1088 use_frags
= message
->get_payload(message
,
1089 PLV1_CERTIFICATE
) != NULL
;
1098 status
= generate_message(this, message
, &packet
);
1099 if (status
!= SUCCESS
)
1103 *packets
= enumerator_create_single(packet
, NULL
);
1107 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
1108 message
->set_ike_sa_id(message
, this->ike_sa_id
);
1109 charon
->bus
->message(charon
->bus
, message
, FALSE
, TRUE
);
1110 status
= message
->fragment(message
, this->keymat
, this->fragment_size
,
1112 if (status
== SUCCESS
)
1114 charon
->bus
->message(charon
->bus
, message
, FALSE
, FALSE
);
1115 *packets
= enumerator_create_filter(fragments
, (void*)filter_fragments
,
1121 METHOD(ike_sa_t
, set_kmaddress
, void,
1122 private_ike_sa_t
*this, host_t
*local
, host_t
*remote
)
1124 DESTROY_IF(this->local_host
);
1125 DESTROY_IF(this->remote_host
);
1126 this->local_host
= local
->clone(local
);
1127 this->remote_host
= remote
->clone(remote
);
1131 METHOD(ike_sa_t
, act_as_mediation_server
, void,
1132 private_ike_sa_t
*this)
1134 charon
->mediation_manager
->update_sa_id(charon
->mediation_manager
,
1135 this->other_id
, this->ike_sa_id
);
1136 this->is_mediation_server
= TRUE
;
1139 METHOD(ike_sa_t
, get_server_reflexive_host
, host_t
*,
1140 private_ike_sa_t
*this)
1142 return this->server_reflexive_host
;
1145 METHOD(ike_sa_t
, set_server_reflexive_host
, void,
1146 private_ike_sa_t
*this, host_t
*host
)
1148 DESTROY_IF(this->server_reflexive_host
);
1149 this->server_reflexive_host
= host
;
1152 METHOD(ike_sa_t
, get_connect_id
, chunk_t
,
1153 private_ike_sa_t
*this)
1155 return this->connect_id
;
1158 METHOD(ike_sa_t
, respond
, status_t
,
1159 private_ike_sa_t
*this, identification_t
*peer_id
, chunk_t connect_id
)
1161 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1162 task
->respond(task
, peer_id
, connect_id
);
1163 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1164 return this->task_manager
->initiate(this->task_manager
);
1167 METHOD(ike_sa_t
, callback
, status_t
,
1168 private_ike_sa_t
*this, identification_t
*peer_id
)
1170 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1171 task
->callback(task
, peer_id
);
1172 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1173 return this->task_manager
->initiate(this->task_manager
);
1176 METHOD(ike_sa_t
, relay
, status_t
,
1177 private_ike_sa_t
*this, identification_t
*requester
, chunk_t connect_id
,
1178 chunk_t connect_key
, linked_list_t
*endpoints
, bool response
)
1180 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1181 task
->relay(task
, requester
, connect_id
, connect_key
, endpoints
, response
);
1182 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1183 return this->task_manager
->initiate(this->task_manager
);
1186 METHOD(ike_sa_t
, initiate_mediation
, status_t
,
1187 private_ike_sa_t
*this, peer_cfg_t
*mediated_cfg
)
1189 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1190 task
->connect(task
, mediated_cfg
->get_peer_id(mediated_cfg
));
1191 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1192 return this->task_manager
->initiate(this->task_manager
);
1195 METHOD(ike_sa_t
, initiate_mediated
, status_t
,
1196 private_ike_sa_t
*this, host_t
*me
, host_t
*other
, chunk_t connect_id
)
1198 set_my_host(this, me
->clone(me
));
1199 set_other_host(this, other
->clone(other
));
1200 chunk_free(&this->connect_id
);
1201 this->connect_id
= chunk_clone(connect_id
);
1202 return this->task_manager
->initiate(this->task_manager
);
1207 * Resolve DNS host in configuration
1209 static void resolve_hosts(private_ike_sa_t
*this)
1212 int family
= AF_UNSPEC
;
1214 switch (charon
->socket
->supported_families(charon
->socket
))
1216 case SOCKET_FAMILY_IPV4
:
1219 case SOCKET_FAMILY_IPV6
:
1222 case SOCKET_FAMILY_BOTH
:
1223 case SOCKET_FAMILY_NONE
:
1227 /* if an IP address is set locally, use the same family to resolve remote */
1228 if (family
== AF_UNSPEC
&& !this->remote_host
)
1230 if (this->local_host
)
1232 family
= this->local_host
->get_family(this->local_host
);
1236 family
= ike_cfg_get_family(this->ike_cfg
, TRUE
);
1240 if (this->remote_host
)
1242 host
= this->remote_host
->clone(this->remote_host
);
1243 host
->set_port(host
, IKEV2_UDP_PORT
);
1247 host
= this->ike_cfg
->resolve_other(this->ike_cfg
, family
);
1251 if (!host
->is_anyaddr(host
) ||
1252 this->other_host
->is_anyaddr(this->other_host
))
1253 { /* don't set to %any if we currently have an address, but the
1254 * address family might have changed */
1255 set_other_host(this, host
);
1258 { /* reuse the original port as some implementations might not like
1259 * initial IKE messages on other ports */
1260 this->other_host
->set_port(this->other_host
, host
->get_port(host
));
1261 host
->destroy(host
);
1265 if (this->local_host
)
1267 host
= this->local_host
->clone(this->local_host
);
1268 host
->set_port(host
, charon
->socket
->get_port(charon
->socket
, FALSE
));
1272 /* use same address family as for other */
1273 if (!this->other_host
->is_anyaddr(this->other_host
))
1275 family
= this->other_host
->get_family(this->other_host
);
1277 host
= this->ike_cfg
->resolve_me(this->ike_cfg
, family
);
1279 if (host
&& host
->is_anyaddr(host
) &&
1280 !this->other_host
->is_anyaddr(this->other_host
))
1282 host
->destroy(host
);
1283 host
= charon
->kernel
->get_source_addr(charon
->kernel
,
1284 this->other_host
, NULL
);
1287 host
->set_port(host
, this->ike_cfg
->get_my_port(this->ike_cfg
));
1290 { /* fallback to address family specific %any(6), if configured */
1291 host
= this->ike_cfg
->resolve_me(this->ike_cfg
, family
);
1297 set_my_host(this, host
);
1301 METHOD(ike_sa_t
, initiate
, status_t
,
1302 private_ike_sa_t
*this, child_cfg_t
*child_cfg
, u_int32_t reqid
,
1303 traffic_selector_t
*tsi
, traffic_selector_t
*tsr
)
1305 bool defer_initiate
= FALSE
;
1307 if (this->state
== IKE_CREATED
)
1309 if (this->my_host
->is_anyaddr(this->my_host
) ||
1310 this->other_host
->is_anyaddr(this->other_host
))
1312 resolve_hosts(this);
1315 if (this->other_host
->is_anyaddr(this->other_host
)
1317 && !this->peer_cfg
->get_mediated_by(this->peer_cfg
)
1323 addr
= this->ike_cfg
->get_other_addr(this->ike_cfg
);
1324 if (!this->retry_initiate_interval
)
1326 DBG1(DBG_IKE
, "unable to resolve %s, initiate aborted",
1328 DESTROY_IF(child_cfg
);
1329 charon
->bus
->alert(charon
->bus
, ALERT_PEER_ADDR_FAILED
);
1332 DBG1(DBG_IKE
, "unable to resolve %s, retrying in %ds",
1333 addr
, this->retry_initiate_interval
);
1334 defer_initiate
= TRUE
;
1337 set_condition(this, COND_ORIGINAL_INITIATOR
, TRUE
);
1338 this->task_manager
->queue_ike(this->task_manager
);
1342 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1344 if (this->state
== IKE_ESTABLISHED
)
1346 /* mediation connection is already established, retrigger state
1347 * change to notify bus listeners */
1348 DBG1(DBG_IKE
, "mediation connection is already up");
1349 set_state(this, IKE_ESTABLISHED
);
1351 DESTROY_IF(child_cfg
);
1357 /* normal IKE_SA with CHILD_SA */
1358 this->task_manager
->queue_child(this->task_manager
, child_cfg
, reqid
,
1361 if (this->peer_cfg
->get_mediated_by(this->peer_cfg
))
1363 /* mediated connection, initiate mediation process */
1364 job_t
*job
= (job_t
*)initiate_mediation_job_create(this->ike_sa_id
);
1365 lib
->processor
->queue_job(lib
->processor
, job
);
1373 if (!this->retry_initiate_queued
)
1375 job_t
*job
= (job_t
*)retry_initiate_job_create(this->ike_sa_id
);
1376 lib
->scheduler
->schedule_job(lib
->scheduler
, (job_t
*)job
,
1377 this->retry_initiate_interval
);
1378 this->retry_initiate_queued
= TRUE
;
1382 this->retry_initiate_queued
= FALSE
;
1383 return this->task_manager
->initiate(this->task_manager
);
1386 METHOD(ike_sa_t
, retry_initiate
, status_t
,
1387 private_ike_sa_t
*this)
1389 if (this->retry_initiate_queued
)
1391 this->retry_initiate_queued
= FALSE
;
1392 return initiate(this, NULL
, 0, NULL
, NULL
);
1397 METHOD(ike_sa_t
, process_message
, status_t
,
1398 private_ike_sa_t
*this, message_t
*message
)
1402 if (this->state
== IKE_PASSIVE
)
1403 { /* do not handle messages in passive state */
1406 if (message
->get_major_version(message
) != this->version
)
1408 DBG1(DBG_IKE
, "ignoring %N IKEv%u exchange on %N SA",
1409 exchange_type_names
, message
->get_exchange_type(message
),
1410 message
->get_major_version(message
),
1411 ike_version_names
, this->version
);
1412 /* TODO-IKEv1: fall back to IKEv1 if we receive an IKEv1
1413 * INVALID_MAJOR_VERSION on an IKEv2 SA. */
1416 status
= this->task_manager
->process_message(this->task_manager
, message
);
1417 if (this->flush_auth_cfg
&& this->state
== IKE_ESTABLISHED
)
1419 /* authentication completed */
1420 this->flush_auth_cfg
= FALSE
;
1421 flush_auth_cfgs(this);
1426 METHOD(ike_sa_t
, get_id
, ike_sa_id_t
*,
1427 private_ike_sa_t
*this)
1429 return this->ike_sa_id
;
1432 METHOD(ike_sa_t
, get_version
, ike_version_t
,
1433 private_ike_sa_t
*this)
1435 return this->version
;
1438 METHOD(ike_sa_t
, get_my_id
, identification_t
*,
1439 private_ike_sa_t
*this)
1444 METHOD(ike_sa_t
, set_my_id
, void,
1445 private_ike_sa_t
*this, identification_t
*me
)
1447 DESTROY_IF(this->my_id
);
1451 METHOD(ike_sa_t
, get_other_id
, identification_t
*,
1452 private_ike_sa_t
*this)
1454 return this->other_id
;
1457 METHOD(ike_sa_t
, get_other_eap_id
, identification_t
*,
1458 private_ike_sa_t
*this)
1460 identification_t
*id
= NULL
, *current
;
1461 enumerator_t
*enumerator
;
1464 enumerator
= array_create_enumerator(this->other_auths
);
1465 while (enumerator
->enumerate(enumerator
, &cfg
))
1467 /* prefer EAP-Identity of last round */
1468 current
= cfg
->get(cfg
, AUTH_RULE_EAP_IDENTITY
);
1469 if (!current
|| current
->get_type(current
) == ID_ANY
)
1471 current
= cfg
->get(cfg
, AUTH_RULE_XAUTH_IDENTITY
);
1473 if (!current
|| current
->get_type(current
) == ID_ANY
)
1475 current
= cfg
->get(cfg
, AUTH_RULE_IDENTITY
);
1477 if (current
&& current
->get_type(current
) != ID_ANY
)
1483 enumerator
->destroy(enumerator
);
1488 return this->other_id
;
1491 METHOD(ike_sa_t
, set_other_id
, void,
1492 private_ike_sa_t
*this, identification_t
*other
)
1494 DESTROY_IF(this->other_id
);
1495 this->other_id
= other
;
1498 METHOD(ike_sa_t
, add_child_sa
, void,
1499 private_ike_sa_t
*this, child_sa_t
*child_sa
)
1501 array_insert_create(&this->child_sas
, ARRAY_TAIL
, child_sa
);
1502 charon
->child_sa_manager
->add(charon
->child_sa_manager
,
1503 child_sa
, &this->public);
1506 METHOD(ike_sa_t
, get_child_sa
, child_sa_t
*,
1507 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
, bool inbound
)
1509 enumerator_t
*enumerator
;
1510 child_sa_t
*current
, *found
= NULL
;
1512 enumerator
= array_create_enumerator(this->child_sas
);
1513 while (enumerator
->enumerate(enumerator
, (void**)¤t
))
1515 if (current
->get_spi(current
, inbound
) == spi
&&
1516 current
->get_protocol(current
) == protocol
)
1521 enumerator
->destroy(enumerator
);
1525 METHOD(ike_sa_t
, get_child_count
, int,
1526 private_ike_sa_t
*this)
1528 return array_count(this->child_sas
);
1532 * Private data of a create_child_sa_enumerator()
1535 /** implements enumerator */
1536 enumerator_t
public;
1537 /** inner array enumerator */
1538 enumerator_t
*inner
;
1540 child_sa_t
*current
;
1541 } child_enumerator_t
;
1543 METHOD(enumerator_t
, child_enumerate
, bool,
1544 child_enumerator_t
*this, child_sa_t
**child_sa
)
1546 if (this->inner
->enumerate(this->inner
, &this->current
))
1548 *child_sa
= this->current
;
1554 METHOD(enumerator_t
, child_enumerator_destroy
, void,
1555 child_enumerator_t
*this)
1557 this->inner
->destroy(this->inner
);
1561 METHOD(ike_sa_t
, create_child_sa_enumerator
, enumerator_t
*,
1562 private_ike_sa_t
*this)
1564 child_enumerator_t
*enumerator
;
1568 .enumerate
= (void*)_child_enumerate
,
1569 .destroy
= _child_enumerator_destroy
,
1571 .inner
= array_create_enumerator(this->child_sas
),
1573 return &enumerator
->public;
1576 METHOD(ike_sa_t
, remove_child_sa
, void,
1577 private_ike_sa_t
*this, enumerator_t
*enumerator
)
1579 child_enumerator_t
*ce
= (child_enumerator_t
*)enumerator
;
1581 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, ce
->current
);
1582 array_remove_at(this->child_sas
, ce
->inner
);
1585 METHOD(ike_sa_t
, rekey_child_sa
, status_t
,
1586 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1588 if (this->state
== IKE_PASSIVE
)
1590 return INVALID_STATE
;
1592 this->task_manager
->queue_child_rekey(this->task_manager
, protocol
, spi
);
1593 return this->task_manager
->initiate(this->task_manager
);
1596 METHOD(ike_sa_t
, delete_child_sa
, status_t
,
1597 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
, bool expired
)
1599 if (this->state
== IKE_PASSIVE
)
1601 return INVALID_STATE
;
1603 this->task_manager
->queue_child_delete(this->task_manager
,
1604 protocol
, spi
, expired
);
1605 return this->task_manager
->initiate(this->task_manager
);
1608 METHOD(ike_sa_t
, destroy_child_sa
, status_t
,
1609 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1611 enumerator_t
*enumerator
;
1612 child_sa_t
*child_sa
;
1613 status_t status
= NOT_FOUND
;
1615 enumerator
= create_child_sa_enumerator(this);
1616 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1618 if (child_sa
->get_protocol(child_sa
) == protocol
&&
1619 child_sa
->get_spi(child_sa
, TRUE
) == spi
)
1621 remove_child_sa(this, enumerator
);
1622 child_sa
->destroy(child_sa
);
1627 enumerator
->destroy(enumerator
);
1631 METHOD(ike_sa_t
, delete_
, status_t
,
1632 private_ike_sa_t
*this)
1634 switch (this->state
)
1637 if (this->version
== IKEV1
)
1638 { /* SA has been reauthenticated, delete */
1639 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
1643 case IKE_ESTABLISHED
:
1644 if (time_monotonic(NULL
) >= this->stats
[STAT_DELETE
])
1645 { /* IKE_SA hard lifetime hit */
1646 charon
->bus
->alert(charon
->bus
, ALERT_IKE_SA_EXPIRED
);
1648 this->task_manager
->queue_ike_delete(this->task_manager
);
1649 return this->task_manager
->initiate(this->task_manager
);
1651 DBG1(DBG_IKE
, "deleting unestablished IKE_SA");
1656 DBG1(DBG_IKE
, "destroying IKE_SA in state %N "
1657 "without notification", ike_sa_state_names
, this->state
);
1658 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
1664 METHOD(ike_sa_t
, rekey
, status_t
,
1665 private_ike_sa_t
*this)
1667 if (this->state
== IKE_PASSIVE
)
1669 return INVALID_STATE
;
1671 this->task_manager
->queue_ike_rekey(this->task_manager
);
1672 return this->task_manager
->initiate(this->task_manager
);
1675 METHOD(ike_sa_t
, reauth
, status_t
,
1676 private_ike_sa_t
*this)
1678 if (this->state
== IKE_PASSIVE
)
1680 return INVALID_STATE
;
1682 if (this->state
== IKE_CONNECTING
)
1684 DBG0(DBG_IKE
, "reinitiating IKE_SA %s[%d]",
1685 get_name(this), this->unique_id
);
1687 this->task_manager
->queue_ike(this->task_manager
);
1688 return this->task_manager
->initiate(this->task_manager
);
1690 /* we can't reauthenticate as responder when we use EAP or virtual IPs.
1691 * If the peer does not support RFC4478, there is no way to keep the
1693 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
1695 DBG1(DBG_IKE
, "initiator did not reauthenticate as requested");
1696 if (array_count(this->other_vips
) != 0 ||
1697 has_condition(this, COND_XAUTH_AUTHENTICATED
) ||
1698 has_condition(this, COND_EAP_AUTHENTICATED
)
1700 /* as mediation server we too cannot reauth the IKE_SA */
1701 || this->is_mediation_server
1707 del
= this->stats
[STAT_DELETE
];
1708 now
= time_monotonic(NULL
);
1709 DBG1(DBG_IKE
, "IKE_SA %s[%d] will timeout in %V",
1710 get_name(this), this->unique_id
, &now
, &del
);
1715 DBG0(DBG_IKE
, "reauthenticating IKE_SA %s[%d] actively",
1716 get_name(this), this->unique_id
);
1721 DBG0(DBG_IKE
, "reauthenticating IKE_SA %s[%d]",
1722 get_name(this), this->unique_id
);
1724 set_condition(this, COND_REAUTHENTICATING
, TRUE
);
1725 this->task_manager
->queue_ike_reauth(this->task_manager
);
1726 return this->task_manager
->initiate(this->task_manager
);
1730 * Check if tasks to create CHILD_SAs are queued in the given queue
1732 static bool is_child_queued(private_ike_sa_t
*this, task_queue_t queue
)
1734 enumerator_t
*enumerator
;
1738 enumerator
= this->task_manager
->create_task_enumerator(this->task_manager
,
1740 while (enumerator
->enumerate(enumerator
, &task
))
1742 if (task
->get_type(task
) == TASK_CHILD_CREATE
||
1743 task
->get_type(task
) == TASK_QUICK_MODE
)
1749 enumerator
->destroy(enumerator
);
1753 METHOD(ike_sa_t
, reestablish
, status_t
,
1754 private_ike_sa_t
*this)
1759 enumerator_t
*enumerator
;
1760 child_sa_t
*child_sa
;
1761 child_cfg_t
*child_cfg
;
1762 bool restart
= FALSE
;
1763 status_t status
= FAILED
;
1765 if (has_condition(this, COND_REAUTHENTICATING
))
1766 { /* only reauthenticate if we have children */
1767 if (array_count(this->child_sas
) == 0
1769 /* allow reauth of mediation connections without CHILD_SAs */
1770 && !this->peer_cfg
->is_mediation(this->peer_cfg
)
1774 DBG1(DBG_IKE
, "unable to reauthenticate IKE_SA, no CHILD_SA "
1783 { /* check if we have children to keep up at all */
1784 enumerator
= array_create_enumerator(this->child_sas
);
1785 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1787 if (this->state
== IKE_DELETING
)
1789 action
= child_sa
->get_close_action(child_sa
);
1793 action
= child_sa
->get_dpd_action(child_sa
);
1797 case ACTION_RESTART
:
1801 charon
->traps
->install(charon
->traps
, this->peer_cfg
,
1802 child_sa
->get_config(child_sa
),
1803 child_sa
->get_reqid(child_sa
));
1809 enumerator
->destroy(enumerator
);
1810 /* check if we have tasks that recreate children */
1813 restart
= is_child_queued(this, TASK_QUEUE_ACTIVE
) ||
1814 is_child_queued(this, TASK_QUEUE_QUEUED
);
1817 /* mediation connections have no children, keep them up anyway */
1818 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1829 /* check if we are able to reestablish this IKE_SA */
1830 if (!has_condition(this, COND_ORIGINAL_INITIATOR
) &&
1831 (array_count(this->other_vips
) != 0 ||
1832 has_condition(this, COND_EAP_AUTHENTICATED
)
1834 || this->is_mediation_server
1838 DBG1(DBG_IKE
, "unable to reestablish IKE_SA due to asymmetric setup");
1842 new = charon
->ike_sa_manager
->checkout_new(charon
->ike_sa_manager
,
1843 this->version
, TRUE
);
1848 new->set_peer_cfg(new, this->peer_cfg
);
1849 host
= this->other_host
;
1850 new->set_other_host(new, host
->clone(host
));
1851 host
= this->my_host
;
1852 new->set_my_host(new, host
->clone(host
));
1853 charon
->bus
->ike_reestablish_pre(charon
->bus
, &this->public, new);
1854 /* resolve hosts but use the old addresses above as fallback */
1855 resolve_hosts((private_ike_sa_t
*)new);
1856 /* if we already have a virtual IP, we reuse it */
1857 enumerator
= array_create_enumerator(this->my_vips
);
1858 while (enumerator
->enumerate(enumerator
, &host
))
1860 new->add_virtual_ip(new, TRUE
, host
);
1862 enumerator
->destroy(enumerator
);
1865 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1867 status
= new->initiate(new, NULL
, 0, NULL
, NULL
);
1872 /* handle existing CHILD_SAs */
1873 enumerator
= create_child_sa_enumerator(this);
1874 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1876 if (has_condition(this, COND_REAUTHENTICATING
))
1878 switch (child_sa
->get_state(child_sa
))
1881 { /* move routed child directly */
1882 remove_child_sa(this, enumerator
);
1883 new->add_child_sa(new, child_sa
);
1884 action
= ACTION_NONE
;
1888 { /* initiate/queue all other CHILD_SAs */
1889 action
= ACTION_RESTART
;
1895 { /* only restart CHILD_SAs that are configured accordingly */
1896 if (this->state
== IKE_DELETING
)
1898 action
= child_sa
->get_close_action(child_sa
);
1902 action
= child_sa
->get_dpd_action(child_sa
);
1907 case ACTION_RESTART
:
1908 child_cfg
= child_sa
->get_config(child_sa
);
1909 DBG1(DBG_IKE
, "restarting CHILD_SA %s",
1910 child_cfg
->get_name(child_cfg
));
1911 child_cfg
->get_ref(child_cfg
);
1912 status
= new->initiate(new, child_cfg
,
1913 child_sa
->get_reqid(child_sa
), NULL
, NULL
);
1918 if (status
== DESTROY_ME
)
1923 enumerator
->destroy(enumerator
);
1924 /* adopt any active or queued CHILD-creating tasks */
1925 if (status
!= DESTROY_ME
)
1927 task_manager_t
*other_tasks
= ((private_ike_sa_t
*)new)->task_manager
;
1928 other_tasks
->adopt_child_tasks(other_tasks
, this->task_manager
);
1929 if (new->get_state(new) == IKE_CREATED
)
1931 status
= new->initiate(new, NULL
, 0, NULL
, NULL
);
1936 if (status
== DESTROY_ME
)
1938 charon
->bus
->ike_reestablish_post(charon
->bus
, &this->public, new,
1940 charon
->ike_sa_manager
->checkin_and_destroy(charon
->ike_sa_manager
, new);
1945 charon
->bus
->ike_reestablish_post(charon
->bus
, &this->public, new,
1947 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, new);
1950 charon
->bus
->set_sa(charon
->bus
, &this->public);
1954 METHOD(ike_sa_t
, handle_redirect
, bool,
1955 private_ike_sa_t
*this, identification_t
*gateway
)
1960 DBG1(DBG_IKE
, "redirected to %Y", gateway
);
1962 snprintf(gw
, sizeof(gw
), "%Y", gateway
);
1963 gw
[sizeof(gw
)-1] = '\0';
1964 other
= host_create_from_dns(gw
, AF_UNSPEC
, IKEV2_UDP_PORT
);
1967 DBG1(DBG_IKE
, "unable to resolve gateway ID '%Y', redirect failed",
1971 switch (this->state
)
1973 case IKE_CONNECTING
:
1975 set_other_host(this, other
);
1978 DBG1(DBG_IKE
, "unable to handle redirect for IKE_SA in state %N",
1979 ike_sa_state_names
, this->state
);
1980 other
->destroy(other
);
1985 METHOD(ike_sa_t
, retransmit
, status_t
,
1986 private_ike_sa_t
*this, u_int32_t message_id
)
1988 if (this->state
== IKE_PASSIVE
)
1990 return INVALID_STATE
;
1992 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
1993 if (this->task_manager
->retransmit(this->task_manager
, message_id
) != SUCCESS
)
1995 /* send a proper signal to brief interested bus listeners */
1996 switch (this->state
)
1998 case IKE_CONNECTING
:
2000 /* retry IKE_SA_INIT/Main Mode if we have multiple keyingtries */
2001 u_int32_t tries
= this->peer_cfg
->get_keyingtries(this->peer_cfg
);
2002 charon
->bus
->alert(charon
->bus
, ALERT_PEER_INIT_UNREACHABLE
,
2005 if (tries
== 0 || tries
> this->keyingtry
)
2007 DBG1(DBG_IKE
, "peer not responding, trying again (%d/%d)",
2008 this->keyingtry
+ 1, tries
);
2010 resolve_hosts(this);
2011 this->task_manager
->queue_ike(this->task_manager
);
2012 return this->task_manager
->initiate(this->task_manager
);
2014 DBG1(DBG_IKE
, "establishing IKE_SA failed, peer not responding");
2018 DBG1(DBG_IKE
, "proper IKE_SA delete failed, peer not responding");
2019 if (has_condition(this, COND_REAUTHENTICATING
))
2021 DBG1(DBG_IKE
, "delete during reauthentication failed, "
2022 "trying to reestablish IKE_SA anyway");
2027 DBG1(DBG_IKE
, "rekeying IKE_SA failed, peer not responding");
2033 if (this->state
!= IKE_CONNECTING
)
2035 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
2042 METHOD(ike_sa_t
, set_auth_lifetime
, status_t
,
2043 private_ike_sa_t
*this, u_int32_t lifetime
)
2045 u_int32_t diff
, hard
, soft
, now
;
2048 diff
= this->peer_cfg
->get_over_time(this->peer_cfg
);
2049 now
= time_monotonic(NULL
);
2050 hard
= now
+ lifetime
;
2053 /* check if we have to send an AUTH_LIFETIME to enforce the new lifetime.
2054 * We send the notify in IKE_AUTH if not yet ESTABLISHED. */
2055 send_update
= this->state
== IKE_ESTABLISHED
&& this->version
== IKEV2
&&
2056 !has_condition(this, COND_ORIGINAL_INITIATOR
) &&
2057 (array_count(this->other_vips
) != 0 ||
2058 has_condition(this, COND_EAP_AUTHENTICATED
));
2060 if (lifetime
< diff
)
2062 this->stats
[STAT_REAUTH
] = now
;
2066 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, "
2067 "starting reauthentication", lifetime
);
2068 lib
->processor
->queue_job(lib
->processor
,
2069 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
));
2072 else if (this->stats
[STAT_REAUTH
] == 0 ||
2073 this->stats
[STAT_REAUTH
] > soft
)
2075 this->stats
[STAT_REAUTH
] = soft
;
2078 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, scheduling "
2079 "reauthentication in %ds", lifetime
, lifetime
- diff
);
2080 lib
->scheduler
->schedule_job(lib
->scheduler
,
2081 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
),
2087 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, "
2088 "reauthentication already scheduled in %ds", lifetime
,
2089 this->stats
[STAT_REAUTH
] - time_monotonic(NULL
));
2090 send_update
= FALSE
;
2092 /* give at least some seconds to reauthenticate */
2093 this->stats
[STAT_DELETE
] = max(hard
, now
+ 10);
2098 ike_auth_lifetime_t
*task
;
2100 task
= ike_auth_lifetime_create(&this->public, TRUE
);
2101 this->task_manager
->queue_task(this->task_manager
, &task
->task
);
2102 return this->task_manager
->initiate(this->task_manager
);
2109 * Check if the current combination of source and destination address is still
2112 static bool is_current_path_valid(private_ike_sa_t
*this)
2116 src
= charon
->kernel
->get_source_addr(charon
->kernel
, this->other_host
,
2120 if (src
->ip_equals(src
, this->my_host
))
2130 * Check if we have any path avialable for this IKE SA.
2132 static bool is_any_path_valid(private_ike_sa_t
*this)
2135 enumerator_t
*enumerator
;
2136 host_t
*src
= NULL
, *addr
;
2137 int family
= AF_UNSPEC
;
2139 switch (charon
->socket
->supported_families(charon
->socket
))
2141 case SOCKET_FAMILY_IPV4
:
2144 case SOCKET_FAMILY_IPV6
:
2147 case SOCKET_FAMILY_BOTH
:
2148 case SOCKET_FAMILY_NONE
:
2152 DBG1(DBG_IKE
, "old path is not available anymore, try to find another");
2153 enumerator
= create_peer_address_enumerator(this);
2154 while (enumerator
->enumerate(enumerator
, &addr
))
2156 if (family
!= AF_UNSPEC
&& addr
->get_family(addr
) != family
)
2160 DBG1(DBG_IKE
, "looking for a route to %H ...", addr
);
2161 src
= charon
->kernel
->get_source_addr(charon
->kernel
, addr
, NULL
);
2167 enumerator
->destroy(enumerator
);
2176 METHOD(ike_sa_t
, roam
, status_t
,
2177 private_ike_sa_t
*this, bool address
)
2179 switch (this->state
)
2183 case IKE_DESTROYING
:
2190 /* keep existing path if possible */
2191 if (is_current_path_valid(this))
2193 DBG2(DBG_IKE
, "keeping connection path %H - %H",
2194 this->my_host
, this->other_host
);
2195 set_condition(this, COND_STALE
, FALSE
);
2197 if (supports_extension(this, EXT_MOBIKE
) && address
)
2198 { /* if any addresses changed, send an updated list */
2199 DBG1(DBG_IKE
, "sending address list update using MOBIKE");
2200 this->task_manager
->queue_mobike(this->task_manager
, FALSE
, TRUE
);
2201 return this->task_manager
->initiate(this->task_manager
);
2206 if (!is_any_path_valid(this))
2208 DBG1(DBG_IKE
, "no route found to reach %H, MOBIKE update deferred",
2210 set_condition(this, COND_STALE
, TRUE
);
2213 set_condition(this, COND_STALE
, FALSE
);
2215 /* update addresses with mobike, if supported ... */
2216 if (supports_extension(this, EXT_MOBIKE
))
2218 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
2219 { /* responder updates the peer about changed address config */
2220 DBG1(DBG_IKE
, "sending address list update using MOBIKE, "
2221 "implicitly requesting an address change");
2226 DBG1(DBG_IKE
, "requesting address change using MOBIKE");
2228 this->task_manager
->queue_mobike(this->task_manager
, TRUE
, address
);
2229 return this->task_manager
->initiate(this->task_manager
);
2232 /* ... reauth if not */
2233 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
2234 { /* responder does not reauthenticate */
2235 set_condition(this, COND_STALE
, TRUE
);
2238 DBG1(DBG_IKE
, "reauthenticating IKE_SA due to address change");
2239 /* since our previous path is not valid anymore, try and find a new one */
2240 resolve_hosts(this);
2241 return reauth(this);
2244 METHOD(ike_sa_t
, add_configuration_attribute
, void,
2245 private_ike_sa_t
*this, attribute_handler_t
*handler
,
2246 configuration_attribute_type_t type
, chunk_t data
)
2248 attribute_entry_t entry
= {
2251 .data
= chunk_clone(data
),
2253 array_insert(this->attributes
, ARRAY_TAIL
, &entry
);
2257 * Enumerator filter for attributes
2259 static bool filter_attribute(void *null
, attribute_entry_t
**in
,
2260 configuration_attribute_type_t
*type
, void *in2
,
2261 chunk_t
*data
, void *in3
, bool *handled
)
2263 *type
= (*in
)->type
;
2264 *data
= (*in
)->data
;
2265 *handled
= (*in
)->handler
!= NULL
;
2269 METHOD(ike_sa_t
, create_attribute_enumerator
, enumerator_t
*,
2270 private_ike_sa_t
*this)
2272 return enumerator_create_filter(array_create_enumerator(this->attributes
),
2273 (void*)filter_attribute
, NULL
, NULL
);
2276 METHOD(ike_sa_t
, create_task_enumerator
, enumerator_t
*,
2277 private_ike_sa_t
*this, task_queue_t queue
)
2279 return this->task_manager
->create_task_enumerator(this->task_manager
, queue
);
2282 METHOD(ike_sa_t
, flush_queue
, void,
2283 private_ike_sa_t
*this, task_queue_t queue
)
2285 this->task_manager
->flush_queue(this->task_manager
, queue
);
2288 METHOD(ike_sa_t
, queue_task
, void,
2289 private_ike_sa_t
*this, task_t
*task
)
2291 this->task_manager
->queue_task(this->task_manager
, task
);
2294 METHOD(ike_sa_t
, inherit_pre
, void,
2295 private_ike_sa_t
*this, ike_sa_t
*other_public
)
2297 private_ike_sa_t
*other
= (private_ike_sa_t
*)other_public
;
2299 /* apply config and hosts */
2300 set_peer_cfg(this, other
->peer_cfg
);
2301 set_my_host(this, other
->my_host
->clone(other
->my_host
));
2302 set_other_host(this, other
->other_host
->clone(other
->other_host
));
2304 /* apply extensions and conditions with a few exceptions */
2305 this->extensions
= other
->extensions
;
2306 this->conditions
= other
->conditions
;
2307 this->conditions
&= ~COND_STALE
;
2308 this->conditions
&= ~COND_REAUTHENTICATING
;
2311 METHOD(ike_sa_t
, inherit_post
, void,
2312 private_ike_sa_t
*this, ike_sa_t
*other_public
)
2314 private_ike_sa_t
*other
= (private_ike_sa_t
*)other_public
;
2315 child_sa_t
*child_sa
;
2316 enumerator_t
*enumerator
;
2317 attribute_entry_t entry
;
2321 /* apply hosts and ids */
2322 this->my_host
->destroy(this->my_host
);
2323 this->other_host
->destroy(this->other_host
);
2324 this->my_id
->destroy(this->my_id
);
2325 this->other_id
->destroy(this->other_id
);
2326 this->my_host
= other
->my_host
->clone(other
->my_host
);
2327 this->other_host
= other
->other_host
->clone(other
->other_host
);
2328 this->my_id
= other
->my_id
->clone(other
->my_id
);
2329 this->other_id
= other
->other_id
->clone(other
->other_id
);
2331 /* apply assigned virtual IPs... */
2332 while (array_remove(other
->my_vips
, ARRAY_HEAD
, &vip
))
2334 array_insert_create(&this->my_vips
, ARRAY_TAIL
, vip
);
2336 while (array_remove(other
->other_vips
, ARRAY_HEAD
, &vip
))
2338 array_insert_create(&this->other_vips
, ARRAY_TAIL
, vip
);
2341 /* MOBIKE additional addresses */
2342 while (array_remove(other
->peer_addresses
, ARRAY_HEAD
, &vip
))
2344 array_insert_create(&this->peer_addresses
, ARRAY_TAIL
, vip
);
2347 /* authentication information */
2348 enumerator
= array_create_enumerator(other
->my_auths
);
2349 while (enumerator
->enumerate(enumerator
, &cfg
))
2351 array_insert(this->my_auths
, ARRAY_TAIL
, cfg
->clone(cfg
));
2353 enumerator
->destroy(enumerator
);
2354 enumerator
= array_create_enumerator(other
->other_auths
);
2355 while (enumerator
->enumerate(enumerator
, &cfg
))
2357 array_insert(this->other_auths
, ARRAY_TAIL
, cfg
->clone(cfg
));
2359 enumerator
->destroy(enumerator
);
2361 /* ... and configuration attributes */
2362 while (array_remove(other
->attributes
, ARRAY_HEAD
, &entry
))
2364 array_insert(this->attributes
, ARRAY_TAIL
, &entry
);
2367 /* inherit all conditions */
2368 this->conditions
= other
->conditions
;
2369 if (this->conditions
& COND_NAT_HERE
)
2371 send_keepalive(this, FALSE
);
2375 if (other
->is_mediation_server
)
2377 act_as_mediation_server(this);
2379 else if (other
->server_reflexive_host
)
2381 this->server_reflexive_host
= other
->server_reflexive_host
->clone(
2382 other
->server_reflexive_host
);
2386 /* adopt all children */
2387 while (array_remove(other
->child_sas
, ARRAY_HEAD
, &child_sa
))
2389 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, child_sa
);
2390 add_child_sa(this, child_sa
);
2393 /* move pending tasks to the new IKE_SA */
2394 this->task_manager
->adopt_tasks(this->task_manager
, other
->task_manager
);
2396 /* reauthentication timeout survives a rekeying */
2397 if (other
->stats
[STAT_REAUTH
])
2399 time_t reauth
, delete, now
= time_monotonic(NULL
);
2401 this->stats
[STAT_REAUTH
] = other
->stats
[STAT_REAUTH
];
2402 reauth
= this->stats
[STAT_REAUTH
] - now
;
2403 delete = reauth
+ this->peer_cfg
->get_over_time(this->peer_cfg
);
2404 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
] + delete;
2405 DBG1(DBG_IKE
, "rescheduling reauthentication in %ds after rekeying, "
2406 "lifetime reduced to %ds", reauth
, delete);
2407 lib
->scheduler
->schedule_job(lib
->scheduler
,
2408 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
), reauth
);
2409 lib
->scheduler
->schedule_job(lib
->scheduler
,
2410 (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
), delete);
2414 METHOD(ike_sa_t
, destroy
, void,
2415 private_ike_sa_t
*this)
2417 attribute_entry_t entry
;
2418 child_sa_t
*child_sa
;
2421 charon
->bus
->set_sa(charon
->bus
, &this->public);
2423 set_state(this, IKE_DESTROYING
);
2424 if (this->task_manager
)
2426 this->task_manager
->flush(this->task_manager
);
2429 /* remove attributes first, as we pass the IKE_SA to the handler */
2430 charon
->bus
->handle_vips(charon
->bus
, &this->public, FALSE
);
2431 while (array_remove(this->attributes
, ARRAY_TAIL
, &entry
))
2435 charon
->attributes
->release(charon
->attributes
, entry
.handler
,
2436 &this->public, entry
.type
, entry
.data
);
2438 free(entry
.data
.ptr
);
2440 /* uninstall CHILD_SAs before virtual IPs, otherwise we might kill
2441 * routes that the CHILD_SA tries to uninstall. */
2442 while (array_remove(this->child_sas
, ARRAY_TAIL
, &child_sa
))
2444 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, child_sa
);
2445 child_sa
->destroy(child_sa
);
2447 while (array_remove(this->my_vips
, ARRAY_TAIL
, &vip
))
2449 charon
->kernel
->del_ip(charon
->kernel
, vip
, -1, TRUE
);
2452 if (array_count(this->other_vips
))
2454 charon
->bus
->assign_vips(charon
->bus
, &this->public, FALSE
);
2456 while (array_remove(this->other_vips
, ARRAY_TAIL
, &vip
))
2460 linked_list_t
*pools
;
2462 pools
= linked_list_create_from_enumerator(
2463 this->peer_cfg
->create_pool_enumerator(this->peer_cfg
));
2464 charon
->attributes
->release_address(charon
->attributes
,
2465 pools
, vip
, &this->public);
2466 pools
->destroy(pools
);
2471 /* unset SA after here to avoid usage by the listeners */
2472 charon
->bus
->set_sa(charon
->bus
, NULL
);
2474 array_destroy(this->child_sas
);
2475 DESTROY_IF(this->task_manager
);
2476 DESTROY_IF(this->keymat
);
2477 array_destroy(this->attributes
);
2478 array_destroy(this->my_vips
);
2479 array_destroy(this->other_vips
);
2480 array_destroy_offset(this->peer_addresses
, offsetof(host_t
, destroy
));
2482 if (this->is_mediation_server
)
2484 charon
->mediation_manager
->remove(charon
->mediation_manager
,
2487 DESTROY_IF(this->server_reflexive_host
);
2488 chunk_free(&this->connect_id
);
2490 free(this->nat_detection_dest
.ptr
);
2492 DESTROY_IF(this->my_host
);
2493 DESTROY_IF(this->other_host
);
2494 DESTROY_IF(this->my_id
);
2495 DESTROY_IF(this->other_id
);
2496 DESTROY_IF(this->local_host
);
2497 DESTROY_IF(this->remote_host
);
2499 DESTROY_IF(this->ike_cfg
);
2500 DESTROY_IF(this->peer_cfg
);
2501 DESTROY_IF(this->proposal
);
2502 this->my_auth
->destroy(this->my_auth
);
2503 this->other_auth
->destroy(this->other_auth
);
2504 array_destroy_offset(this->my_auths
, offsetof(auth_cfg_t
, destroy
));
2505 array_destroy_offset(this->other_auths
, offsetof(auth_cfg_t
, destroy
));
2507 this->ike_sa_id
->destroy(this->ike_sa_id
);
2512 * Described in header.
2514 ike_sa_t
* ike_sa_create(ike_sa_id_t
*ike_sa_id
, bool initiator
,
2515 ike_version_t version
)
2517 private_ike_sa_t
*this;
2518 static refcount_t unique_id
= 0;
2520 if (version
== IKE_ANY
)
2521 { /* prefer IKEv2 if protocol not specified */
2531 .get_version
= _get_version
,
2532 .get_state
= _get_state
,
2533 .set_state
= _set_state
,
2534 .get_name
= _get_name
,
2535 .get_statistic
= _get_statistic
,
2536 .set_statistic
= _set_statistic
,
2537 .process_message
= _process_message
,
2538 .initiate
= _initiate
,
2539 .retry_initiate
= _retry_initiate
,
2540 .get_ike_cfg
= _get_ike_cfg
,
2541 .set_ike_cfg
= _set_ike_cfg
,
2542 .get_peer_cfg
= _get_peer_cfg
,
2543 .set_peer_cfg
= _set_peer_cfg
,
2544 .get_auth_cfg
= _get_auth_cfg
,
2545 .create_auth_cfg_enumerator
= _create_auth_cfg_enumerator
,
2546 .add_auth_cfg
= _add_auth_cfg
,
2547 .get_proposal
= _get_proposal
,
2548 .set_proposal
= _set_proposal
,
2550 .get_my_host
= _get_my_host
,
2551 .set_my_host
= _set_my_host
,
2552 .get_other_host
= _get_other_host
,
2553 .set_other_host
= _set_other_host
,
2554 .set_message_id
= _set_message_id
,
2555 .float_ports
= _float_ports
,
2556 .update_hosts
= _update_hosts
,
2557 .get_my_id
= _get_my_id
,
2558 .set_my_id
= _set_my_id
,
2559 .get_other_id
= _get_other_id
,
2560 .set_other_id
= _set_other_id
,
2561 .get_other_eap_id
= _get_other_eap_id
,
2562 .enable_extension
= _enable_extension
,
2563 .supports_extension
= _supports_extension
,
2564 .set_condition
= _set_condition
,
2565 .has_condition
= _has_condition
,
2566 .set_pending_updates
= _set_pending_updates
,
2567 .get_pending_updates
= _get_pending_updates
,
2568 .create_peer_address_enumerator
= _create_peer_address_enumerator
,
2569 .add_peer_address
= _add_peer_address
,
2570 .clear_peer_addresses
= _clear_peer_addresses
,
2571 .has_mapping_changed
= _has_mapping_changed
,
2572 .retransmit
= _retransmit
,
2574 .destroy
= _destroy
,
2575 .send_dpd
= _send_dpd
,
2576 .send_keepalive
= _send_keepalive
,
2577 .handle_redirect
= _handle_redirect
,
2578 .get_keymat
= _get_keymat
,
2579 .add_child_sa
= _add_child_sa
,
2580 .get_child_sa
= _get_child_sa
,
2581 .get_child_count
= _get_child_count
,
2582 .create_child_sa_enumerator
= _create_child_sa_enumerator
,
2583 .remove_child_sa
= _remove_child_sa
,
2584 .rekey_child_sa
= _rekey_child_sa
,
2585 .delete_child_sa
= _delete_child_sa
,
2586 .destroy_child_sa
= _destroy_child_sa
,
2589 .reestablish
= _reestablish
,
2590 .set_auth_lifetime
= _set_auth_lifetime
,
2592 .inherit_pre
= _inherit_pre
,
2593 .inherit_post
= _inherit_post
,
2594 .generate_message
= _generate_message
,
2595 .generate_message_fragmented
= _generate_message_fragmented
,
2597 .get_unique_id
= _get_unique_id
,
2598 .add_virtual_ip
= _add_virtual_ip
,
2599 .clear_virtual_ips
= _clear_virtual_ips
,
2600 .create_virtual_ip_enumerator
= _create_virtual_ip_enumerator
,
2601 .add_configuration_attribute
= _add_configuration_attribute
,
2602 .create_attribute_enumerator
= _create_attribute_enumerator
,
2603 .set_kmaddress
= _set_kmaddress
,
2604 .create_task_enumerator
= _create_task_enumerator
,
2605 .flush_queue
= _flush_queue
,
2606 .queue_task
= _queue_task
,
2608 .act_as_mediation_server
= _act_as_mediation_server
,
2609 .get_server_reflexive_host
= _get_server_reflexive_host
,
2610 .set_server_reflexive_host
= _set_server_reflexive_host
,
2611 .get_connect_id
= _get_connect_id
,
2612 .initiate_mediation
= _initiate_mediation
,
2613 .initiate_mediated
= _initiate_mediated
,
2615 .callback
= _callback
,
2616 .respond
= _respond
,
2619 .ike_sa_id
= ike_sa_id
->clone(ike_sa_id
),
2621 .my_host
= host_create_any(AF_INET
),
2622 .other_host
= host_create_any(AF_INET
),
2623 .my_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
),
2624 .other_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
),
2625 .keymat
= keymat_create(version
, initiator
),
2626 .state
= IKE_CREATED
,
2627 .stats
[STAT_INBOUND
] = time_monotonic(NULL
),
2628 .stats
[STAT_OUTBOUND
] = time_monotonic(NULL
),
2629 .my_auth
= auth_cfg_create(),
2630 .other_auth
= auth_cfg_create(),
2631 .my_auths
= array_create(0, 0),
2632 .other_auths
= array_create(0, 0),
2633 .attributes
= array_create(sizeof(attribute_entry_t
), 0),
2634 .unique_id
= ref_get(&unique_id
),
2635 .keepalive_interval
= lib
->settings
->get_time(lib
->settings
,
2636 "%s.keep_alive", KEEPALIVE_INTERVAL
, lib
->ns
),
2637 .retry_initiate_interval
= lib
->settings
->get_time(lib
->settings
,
2638 "%s.retry_initiate_interval", 0, lib
->ns
),
2639 .flush_auth_cfg
= lib
->settings
->get_bool(lib
->settings
,
2640 "%s.flush_auth_cfg", FALSE
, lib
->ns
),
2641 .fragment_size
= lib
->settings
->get_int(lib
->settings
,
2642 "%s.fragment_size", 0, lib
->ns
),
2645 if (version
== IKEV2
)
2646 { /* always supported with IKEv2 */
2647 enable_extension(this, EXT_DPD
);
2650 this->task_manager
= task_manager_create(&this->public);
2651 this->my_host
->set_port(this->my_host
,
2652 charon
->socket
->get_port(charon
->socket
, FALSE
));
2654 if (!this->task_manager
|| !this->keymat
)
2656 DBG1(DBG_IKE
, "IKE version %d not supported", this->version
);
2660 return &this->public;