2 * Copyright (C) 2006-2015 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2009 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * Copyright (c) 2014 Volker RĂ¼melin
22 * Permission is hereby granted, free of charge, to any person obtaining a copy
23 * of this software and associated documentation files (the "Software"), to deal
24 * in the Software without restriction, including without limitation the rights
25 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
26 * copies of the Software, and to permit persons to whom the Software is
27 * furnished to do so, subject to the following conditions:
29 * The above copyright notice and this permission notice shall be included in
30 * all copies or substantial portions of the Software.
32 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
33 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
34 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
35 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
36 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
37 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
50 #include <collections/array.h>
51 #include <utils/lexparser.h>
52 #include <processing/jobs/retransmit_job.h>
53 #include <processing/jobs/delete_ike_sa_job.h>
54 #include <processing/jobs/send_dpd_job.h>
55 #include <processing/jobs/send_keepalive_job.h>
56 #include <processing/jobs/rekey_ike_sa_job.h>
57 #include <processing/jobs/retry_initiate_job.h>
58 #include <sa/ikev2/tasks/ike_auth_lifetime.h>
61 #include <sa/ikev2/tasks/ike_me.h>
62 #include <processing/jobs/initiate_mediation_job.h>
65 ENUM(ike_sa_state_names
, IKE_CREATED
, IKE_DESTROYING
,
75 typedef struct private_ike_sa_t private_ike_sa_t
;
76 typedef struct attribute_entry_t attribute_entry_t
;
79 * Private data of an ike_sa_t object.
81 struct private_ike_sa_t
{
89 * Identifier for the current IKE_SA.
91 ike_sa_id_t
*ike_sa_id
;
94 * IKE version of this SA.
96 ike_version_t version
;
99 * unique numerical ID for this IKE_SA.
104 * Current state of the IKE_SA
106 ike_sa_state_t state
;
109 * IKE configuration used to set up this IKE_SA
114 * Peer and authentication information to establish IKE_SA.
116 peer_cfg_t
*peer_cfg
;
119 * currently used authentication ruleset, local
124 * currently used authentication constraints, remote
126 auth_cfg_t
*other_auth
;
129 * Array of completed local authentication rounds (as auth_cfg_t)
134 * Array of completed remote authentication rounds (as auth_cfg_t)
136 array_t
*other_auths
;
139 * Selected IKE proposal
141 proposal_t
*proposal
;
144 * Juggles tasks to process messages
146 task_manager_t
*task_manager
;
149 * Address of local host
154 * Address of remote host
160 * Are we mediation server
162 bool is_mediation_server
;
165 * Server reflexive host
167 host_t
*server_reflexive_host
;
176 * Identification used for us
178 identification_t
*my_id
;
181 * Identification used for other
183 identification_t
*other_id
;
186 * set of extensions the peer supports
188 ike_extension_t extensions
;
191 * set of condition flags currently enabled for this IKE_SA
193 ike_condition_t conditions
;
196 * Array containing the child sa's of the current IKE_SA.
201 * keymat of this IKE_SA
206 * Virtual IPs on local host
211 * Virtual IPs on remote host
216 * List of configuration attributes (attribute_entry_t)
221 * list of peer's addresses, additional ones transmitted via MOBIKE
223 array_t
*peer_addresses
;
226 * previously value of received DESTINATION_IP hash
228 chunk_t nat_detection_dest
;
231 * number pending UPDATE_SA_ADDRESS (MOBIKE)
233 u_int32_t pending_updates
;
236 * NAT keep alive interval
238 u_int32_t keepalive_interval
;
241 * The schedueld keep alive job, if any
243 send_keepalive_job_t
*keepalive_job
;
246 * interval for retries during initiation (e.g. if DNS resolution failed),
247 * 0 to disable (default)
249 u_int32_t retry_initiate_interval
;
252 * TRUE if a retry_initiate_job has been queued
254 bool retry_initiate_queued
;
257 * Timestamps for this IKE_SA
259 u_int32_t stats
[STAT_MAX
];
262 * how many times we have retried so far (keyingtries)
267 * local host address to be used for IKE, set via MIGRATE kernel message
272 * remote host address to be used for IKE, set via MIGRATE kernel message
277 * Flush auth configs once established?
282 * Maximum length of a single fragment, 0 for address-specific defaults
284 size_t fragment_size
;
287 * Whether to follow IKEv2 redirects
289 bool follow_redirects
;
293 * Entry to maintain install configuration attributes during IKE_SA lifetime
295 struct attribute_entry_t
{
296 /** handler used to install this attribute */
297 attribute_handler_t
*handler
;
298 /** attribute type */
299 configuration_attribute_type_t type
;
300 /** attribute data */
305 * get the time of the latest traffic processed by the kernel
307 static time_t get_use_time(private_ike_sa_t
* this, bool inbound
)
309 enumerator_t
*enumerator
;
310 child_sa_t
*child_sa
;
311 time_t use_time
, current
;
315 use_time
= this->stats
[STAT_INBOUND
];
319 use_time
= this->stats
[STAT_OUTBOUND
];
322 enumerator
= array_create_enumerator(this->child_sas
);
323 while (enumerator
->enumerate(enumerator
, &child_sa
))
325 child_sa
->get_usestats(child_sa
, inbound
, ¤t
, NULL
, NULL
);
326 use_time
= max(use_time
, current
);
328 enumerator
->destroy(enumerator
);
333 METHOD(ike_sa_t
, get_unique_id
, u_int32_t
,
334 private_ike_sa_t
*this)
336 return this->unique_id
;
339 METHOD(ike_sa_t
, get_name
, char*,
340 private_ike_sa_t
*this)
344 return this->peer_cfg
->get_name(this->peer_cfg
);
349 METHOD(ike_sa_t
, get_statistic
, u_int32_t
,
350 private_ike_sa_t
*this, statistic_t kind
)
354 return this->stats
[kind
];
359 METHOD(ike_sa_t
, set_statistic
, void,
360 private_ike_sa_t
*this, statistic_t kind
, u_int32_t value
)
364 this->stats
[kind
] = value
;
368 METHOD(ike_sa_t
, get_my_host
, host_t
*,
369 private_ike_sa_t
*this)
371 return this->my_host
;
374 METHOD(ike_sa_t
, set_my_host
, void,
375 private_ike_sa_t
*this, host_t
*me
)
377 DESTROY_IF(this->my_host
);
381 METHOD(ike_sa_t
, get_other_host
, host_t
*,
382 private_ike_sa_t
*this)
384 return this->other_host
;
387 METHOD(ike_sa_t
, set_other_host
, void,
388 private_ike_sa_t
*this, host_t
*other
)
390 DESTROY_IF(this->other_host
);
391 this->other_host
= other
;
394 METHOD(ike_sa_t
, get_peer_cfg
, peer_cfg_t
*,
395 private_ike_sa_t
*this)
397 return this->peer_cfg
;
400 METHOD(ike_sa_t
, set_peer_cfg
, void,
401 private_ike_sa_t
*this, peer_cfg_t
*peer_cfg
)
403 peer_cfg
->get_ref(peer_cfg
);
404 DESTROY_IF(this->peer_cfg
);
405 this->peer_cfg
= peer_cfg
;
407 if (this->ike_cfg
== NULL
)
409 this->ike_cfg
= peer_cfg
->get_ike_cfg(peer_cfg
);
410 this->ike_cfg
->get_ref(this->ike_cfg
);
414 METHOD(ike_sa_t
, get_auth_cfg
, auth_cfg_t
*,
415 private_ike_sa_t
*this, bool local
)
419 return this->my_auth
;
421 return this->other_auth
;
424 METHOD(ike_sa_t
, add_auth_cfg
, void,
425 private_ike_sa_t
*this, bool local
, auth_cfg_t
*cfg
)
429 array_insert(this->my_auths
, ARRAY_TAIL
, cfg
);
433 array_insert(this->other_auths
, ARRAY_TAIL
, cfg
);
437 METHOD(ike_sa_t
, create_auth_cfg_enumerator
, enumerator_t
*,
438 private_ike_sa_t
*this, bool local
)
442 return array_create_enumerator(this->my_auths
);
444 return array_create_enumerator(this->other_auths
);
448 * Flush the stored authentication round information
450 static void flush_auth_cfgs(private_ike_sa_t
*this)
454 this->my_auth
->purge(this->my_auth
, FALSE
);
455 this->other_auth
->purge(this->other_auth
, FALSE
);
457 while (array_remove(this->my_auths
, ARRAY_TAIL
, &cfg
))
461 while (array_remove(this->other_auths
, ARRAY_TAIL
, &cfg
))
467 METHOD(ike_sa_t
, get_proposal
, proposal_t
*,
468 private_ike_sa_t
*this)
470 return this->proposal
;
473 METHOD(ike_sa_t
, set_proposal
, void,
474 private_ike_sa_t
*this, proposal_t
*proposal
)
476 DESTROY_IF(this->proposal
);
477 this->proposal
= proposal
->clone(proposal
);
480 METHOD(ike_sa_t
, set_message_id
, void,
481 private_ike_sa_t
*this, bool initiate
, u_int32_t mid
)
485 this->task_manager
->reset(this->task_manager
, mid
, UINT_MAX
);
489 this->task_manager
->reset(this->task_manager
, UINT_MAX
, mid
);
493 METHOD(ike_sa_t
, send_keepalive
, void,
494 private_ike_sa_t
*this, bool scheduled
)
496 time_t last_out
, now
, diff
;
500 this->keepalive_job
= NULL
;
502 if (!this->keepalive_interval
|| this->state
== IKE_PASSIVE
)
503 { /* keepalives disabled either by configuration or for passive IKE_SAs */
506 if (!(this->conditions
& COND_NAT_HERE
) || (this->conditions
& COND_STALE
))
507 { /* disable keepalives if we are not NATed anymore, or the SA is stale */
511 last_out
= get_use_time(this, FALSE
);
512 now
= time_monotonic(NULL
);
514 diff
= now
- last_out
;
516 if (diff
>= this->keepalive_interval
)
521 packet
= packet_create();
522 packet
->set_source(packet
, this->my_host
->clone(this->my_host
));
523 packet
->set_destination(packet
, this->other_host
->clone(this->other_host
));
524 data
.ptr
= malloc(1);
527 packet
->set_data(packet
, data
);
528 DBG1(DBG_IKE
, "sending keep alive to %#H", this->other_host
);
529 charon
->sender
->send_no_marker(charon
->sender
, packet
);
532 if (!this->keepalive_job
)
534 this->keepalive_job
= send_keepalive_job_create(this->ike_sa_id
);
535 lib
->scheduler
->schedule_job(lib
->scheduler
, (job_t
*)this->keepalive_job
,
536 this->keepalive_interval
- diff
);
540 METHOD(ike_sa_t
, get_ike_cfg
, ike_cfg_t
*,
541 private_ike_sa_t
*this)
543 return this->ike_cfg
;
546 METHOD(ike_sa_t
, set_ike_cfg
, void,
547 private_ike_sa_t
*this, ike_cfg_t
*ike_cfg
)
549 ike_cfg
->get_ref(ike_cfg
);
550 this->ike_cfg
= ike_cfg
;
553 METHOD(ike_sa_t
, enable_extension
, void,
554 private_ike_sa_t
*this, ike_extension_t extension
)
556 this->extensions
|= extension
;
559 METHOD(ike_sa_t
, supports_extension
, bool,
560 private_ike_sa_t
*this, ike_extension_t extension
)
562 return (this->extensions
& extension
) != FALSE
;
565 METHOD(ike_sa_t
, has_condition
, bool,
566 private_ike_sa_t
*this, ike_condition_t condition
)
568 return (this->conditions
& condition
) != FALSE
;
571 METHOD(ike_sa_t
, set_condition
, void,
572 private_ike_sa_t
*this, ike_condition_t condition
, bool enable
)
574 if (has_condition(this, condition
) != enable
)
578 this->conditions
|= condition
;
582 DBG1(DBG_IKE
, "local host is behind NAT, sending keep alives");
583 this->conditions
|= COND_NAT_ANY
;
584 send_keepalive(this, FALSE
);
587 DBG1(DBG_IKE
, "remote host is behind NAT");
588 this->conditions
|= COND_NAT_ANY
;
591 DBG1(DBG_IKE
, "faking NAT situation to enforce UDP encapsulation");
592 this->conditions
|= COND_NAT_ANY
;
600 this->conditions
&= ~condition
;
606 set_condition(this, COND_NAT_ANY
,
607 has_condition(this, COND_NAT_HERE
) ||
608 has_condition(this, COND_NAT_THERE
) ||
609 has_condition(this, COND_NAT_FAKE
));
612 send_keepalive(this, FALSE
);
621 METHOD(ike_sa_t
, send_dpd
, status_t
,
622 private_ike_sa_t
*this)
626 bool task_queued
= FALSE
;
628 if (this->state
== IKE_PASSIVE
)
630 return INVALID_STATE
;
632 delay
= this->peer_cfg
->get_dpd(this->peer_cfg
);
633 if (this->task_manager
->busy(this->task_manager
))
635 /* an exchange is in the air, no need to start a DPD check */
640 /* check if there was any inbound traffic */
642 last_in
= get_use_time(this, TRUE
);
643 now
= time_monotonic(NULL
);
644 diff
= now
- last_in
;
645 if (!delay
|| diff
>= delay
)
647 /* too long ago, initiate dead peer detection */
648 DBG1(DBG_IKE
, "sending DPD request");
649 this->task_manager
->queue_dpd(this->task_manager
);
654 /* recheck in "interval" seconds */
657 job
= (job_t
*)send_dpd_job_create(this->ike_sa_id
);
658 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, delay
- diff
);
662 return this->task_manager
->initiate(this->task_manager
);
667 METHOD(ike_sa_t
, get_state
, ike_sa_state_t
,
668 private_ike_sa_t
*this)
673 METHOD(ike_sa_t
, set_state
, void,
674 private_ike_sa_t
*this, ike_sa_state_t state
)
676 bool trigger_dpd
= FALSE
, keepalives
= FALSE
;
678 DBG2(DBG_IKE
, "IKE_SA %s[%d] state change: %N => %N",
679 get_name(this), this->unique_id
,
680 ike_sa_state_names
, this->state
,
681 ike_sa_state_names
, state
);
685 case IKE_ESTABLISHED
:
687 if (this->state
== IKE_CONNECTING
||
688 this->state
== IKE_PASSIVE
)
693 /* calculate rekey, reauth and lifetime */
694 this->stats
[STAT_ESTABLISHED
] = time_monotonic(NULL
);
696 /* schedule rekeying if we have a time which is smaller than
697 * an already scheduled rekeying */
698 t
= this->peer_cfg
->get_rekey_time(this->peer_cfg
, TRUE
);
699 if (t
&& (this->stats
[STAT_REKEY
] == 0 ||
700 (this->stats
[STAT_REKEY
] > t
+ this->stats
[STAT_ESTABLISHED
])))
702 this->stats
[STAT_REKEY
] = t
+ this->stats
[STAT_ESTABLISHED
];
703 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, FALSE
);
704 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
705 DBG1(DBG_IKE
, "scheduling rekeying in %ds", t
);
707 t
= this->peer_cfg
->get_reauth_time(this->peer_cfg
, TRUE
);
708 if (t
&& (this->stats
[STAT_REAUTH
] == 0 ||
709 (this->stats
[STAT_REAUTH
] > t
+ this->stats
[STAT_ESTABLISHED
])))
711 this->stats
[STAT_REAUTH
] = t
+ this->stats
[STAT_ESTABLISHED
];
712 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
);
713 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
714 DBG1(DBG_IKE
, "scheduling reauthentication in %ds", t
);
716 t
= this->peer_cfg
->get_over_time(this->peer_cfg
);
717 if (this->stats
[STAT_REKEY
] || this->stats
[STAT_REAUTH
])
719 if (this->stats
[STAT_REAUTH
] == 0)
721 this->stats
[STAT_DELETE
] = this->stats
[STAT_REKEY
];
723 else if (this->stats
[STAT_REKEY
] == 0)
725 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
];
729 this->stats
[STAT_DELETE
] = min(this->stats
[STAT_REKEY
],
730 this->stats
[STAT_REAUTH
]);
732 this->stats
[STAT_DELETE
] += t
;
733 t
= this->stats
[STAT_DELETE
] - this->stats
[STAT_ESTABLISHED
];
734 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
735 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
736 DBG1(DBG_IKE
, "maximum IKE_SA lifetime %ds", t
);
738 trigger_dpd
= this->peer_cfg
->get_dpd(this->peer_cfg
);
741 /* Some peers delay the DELETE after rekeying an IKE_SA.
742 * If this delay is longer than our DPD delay, we would
743 * send a DPD request here. The IKE_SA is not ready to do
744 * so yet, so prevent that. */
745 this->stats
[STAT_INBOUND
] = this->stats
[STAT_ESTABLISHED
];
747 if (this->state
== IKE_PASSIVE
)
757 charon
->bus
->ike_state_change(charon
->bus
, &this->public, state
);
762 if (supports_extension(this, EXT_DPD
))
768 DBG1(DBG_IKE
, "DPD not supported by peer, disabled");
773 send_keepalive(this, FALSE
);
777 METHOD(ike_sa_t
, reset
, void,
778 private_ike_sa_t
*this)
780 /* the responder ID is reset, as peer may choose another one */
781 if (this->ike_sa_id
->is_initiator(this->ike_sa_id
))
783 this->ike_sa_id
->set_responder_spi(this->ike_sa_id
, 0);
786 set_state(this, IKE_CREATED
);
788 flush_auth_cfgs(this);
790 this->keymat
->destroy(this->keymat
);
791 this->keymat
= keymat_create(this->version
,
792 this->ike_sa_id
->is_initiator(this->ike_sa_id
));
794 this->task_manager
->reset(this->task_manager
, 0, 0);
797 METHOD(ike_sa_t
, get_keymat
, keymat_t
*,
798 private_ike_sa_t
*this)
803 METHOD(ike_sa_t
, add_virtual_ip
, void,
804 private_ike_sa_t
*this, bool local
, host_t
*ip
)
810 if (charon
->kernel
->get_interface(charon
->kernel
, this->my_host
,
813 DBG1(DBG_IKE
, "installing new virtual IP %H", ip
);
814 if (charon
->kernel
->add_ip(charon
->kernel
, ip
, -1,
817 array_insert_create(&this->my_vips
, ARRAY_TAIL
, ip
->clone(ip
));
821 DBG1(DBG_IKE
, "installing virtual IP %H failed", ip
);
827 DBG1(DBG_IKE
, "looking up interface for virtual IP %H failed", ip
);
832 array_insert_create(&this->other_vips
, ARRAY_TAIL
, ip
->clone(ip
));
837 METHOD(ike_sa_t
, clear_virtual_ips
, void,
838 private_ike_sa_t
*this, bool local
)
843 vips
= local ?
this->my_vips
: this->other_vips
;
844 if (!local
&& array_count(vips
))
846 charon
->bus
->assign_vips(charon
->bus
, &this->public, FALSE
);
848 while (array_remove(vips
, ARRAY_HEAD
, &vip
))
852 charon
->kernel
->del_ip(charon
->kernel
, vip
, -1, TRUE
);
858 METHOD(ike_sa_t
, create_virtual_ip_enumerator
, enumerator_t
*,
859 private_ike_sa_t
*this, bool local
)
863 return array_create_enumerator(this->my_vips
);
865 return array_create_enumerator(this->other_vips
);
868 METHOD(ike_sa_t
, add_peer_address
, void,
869 private_ike_sa_t
*this, host_t
*host
)
871 array_insert_create(&this->peer_addresses
, ARRAY_TAIL
, host
);
874 METHOD(ike_sa_t
, create_peer_address_enumerator
, enumerator_t
*,
875 private_ike_sa_t
*this)
877 if (this->peer_addresses
)
879 return array_create_enumerator(this->peer_addresses
);
881 /* in case we don't have MOBIKE */
882 return enumerator_create_single(this->other_host
, NULL
);
885 METHOD(ike_sa_t
, clear_peer_addresses
, void,
886 private_ike_sa_t
*this)
888 array_destroy_offset(this->peer_addresses
, offsetof(host_t
, destroy
));
889 this->peer_addresses
= NULL
;
892 METHOD(ike_sa_t
, has_mapping_changed
, bool,
893 private_ike_sa_t
*this, chunk_t hash
)
895 if (this->nat_detection_dest
.ptr
== NULL
)
897 this->nat_detection_dest
= chunk_clone(hash
);
900 if (chunk_equals(hash
, this->nat_detection_dest
))
904 free(this->nat_detection_dest
.ptr
);
905 this->nat_detection_dest
= chunk_clone(hash
);
909 METHOD(ike_sa_t
, set_pending_updates
, void,
910 private_ike_sa_t
*this, u_int32_t updates
)
912 this->pending_updates
= updates
;
915 METHOD(ike_sa_t
, get_pending_updates
, u_int32_t
,
916 private_ike_sa_t
*this)
918 return this->pending_updates
;
921 METHOD(ike_sa_t
, float_ports
, void,
922 private_ike_sa_t
*this)
924 /* do not switch if we have a custom port from MOBIKE/NAT */
925 if (this->my_host
->get_port(this->my_host
) ==
926 charon
->socket
->get_port(charon
->socket
, FALSE
))
928 this->my_host
->set_port(this->my_host
,
929 charon
->socket
->get_port(charon
->socket
, TRUE
));
931 if (this->other_host
->get_port(this->other_host
) == IKEV2_UDP_PORT
)
933 this->other_host
->set_port(this->other_host
, IKEV2_NATT_PORT
);
937 METHOD(ike_sa_t
, update_hosts
, void,
938 private_ike_sa_t
*this, host_t
*me
, host_t
*other
, bool force
)
948 other
= this->other_host
;
951 /* apply hosts on first received message */
952 if (this->my_host
->is_anyaddr(this->my_host
) ||
953 this->other_host
->is_anyaddr(this->other_host
))
955 set_my_host(this, me
->clone(me
));
956 set_other_host(this, other
->clone(other
));
961 /* update our address in any case */
962 if (force
&& !me
->equals(me
, this->my_host
))
964 charon
->bus
->ike_update(charon
->bus
, &this->public, TRUE
, me
);
965 set_my_host(this, me
->clone(me
));
969 if (!other
->equals(other
, this->other_host
) &&
970 (force
|| has_condition(this, COND_NAT_THERE
)))
972 /* only update other's address if we are behind a static NAT,
973 * which we assume is the case if we are not initiator */
975 (!has_condition(this, COND_NAT_HERE
) ||
976 !has_condition(this, COND_ORIGINAL_INITIATOR
)))
978 charon
->bus
->ike_update(charon
->bus
, &this->public, FALSE
, other
);
979 set_other_host(this, other
->clone(other
));
985 /* update all associated CHILD_SAs, if required */
988 enumerator_t
*enumerator
;
989 child_sa_t
*child_sa
;
992 vips
= linked_list_create_from_enumerator(
993 array_create_enumerator(this->my_vips
));
995 enumerator
= array_create_enumerator(this->child_sas
);
996 while (enumerator
->enumerate(enumerator
, &child_sa
))
998 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, child_sa
);
999 charon
->child_sa_manager
->add(charon
->child_sa_manager
,
1000 child_sa
, &this->public);
1002 if (child_sa
->update(child_sa
, this->my_host
, this->other_host
,
1003 vips
, has_condition(this, COND_NAT_ANY
)) == NOT_SUPPORTED
)
1005 this->public.rekey_child_sa(&this->public,
1006 child_sa
->get_protocol(child_sa
),
1007 child_sa
->get_spi(child_sa
, TRUE
));
1011 enumerator
->destroy(enumerator
);
1013 vips
->destroy(vips
);
1018 * Set configured DSCP value on packet
1020 static void set_dscp(private_ike_sa_t
*this, packet_t
*packet
)
1024 /* prefer IKE config on peer_cfg, as its selection is more accurate
1025 * then the initial IKE config */
1028 ike_cfg
= this->peer_cfg
->get_ike_cfg(this->peer_cfg
);
1032 ike_cfg
= this->ike_cfg
;
1036 packet
->set_dscp(packet
, ike_cfg
->get_dscp(ike_cfg
));
1040 METHOD(ike_sa_t
, generate_message
, status_t
,
1041 private_ike_sa_t
*this, message_t
*message
, packet_t
**packet
)
1045 if (message
->is_encoded(message
))
1046 { /* already encoded in task, but set DSCP value */
1047 *packet
= message
->get_packet(message
);
1048 set_dscp(this, *packet
);
1051 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
1052 message
->set_ike_sa_id(message
, this->ike_sa_id
);
1053 charon
->bus
->message(charon
->bus
, message
, FALSE
, TRUE
);
1054 status
= message
->generate(message
, this->keymat
, packet
);
1055 if (status
== SUCCESS
)
1057 set_dscp(this, *packet
);
1058 charon
->bus
->message(charon
->bus
, message
, FALSE
, FALSE
);
1063 static bool filter_fragments(private_ike_sa_t
*this, packet_t
**fragment
,
1066 *packet
= (*fragment
)->clone(*fragment
);
1067 set_dscp(this, *packet
);
1071 METHOD(ike_sa_t
, generate_message_fragmented
, status_t
,
1072 private_ike_sa_t
*this, message_t
*message
, enumerator_t
**packets
)
1074 enumerator_t
*fragments
;
1077 bool use_frags
= FALSE
;
1081 switch (this->ike_cfg
->fragmentation(this->ike_cfg
))
1083 case FRAGMENTATION_FORCE
:
1086 case FRAGMENTATION_YES
:
1087 use_frags
= supports_extension(this, EXT_IKE_FRAGMENTATION
);
1088 if (use_frags
&& this->version
== IKEV1
&&
1089 supports_extension(this, EXT_MS_WINDOWS
))
1091 /* It seems Windows 7 and 8 peers only accept proprietary
1092 * fragmented messages if they expect certificates. */
1093 use_frags
= message
->get_payload(message
,
1094 PLV1_CERTIFICATE
) != NULL
;
1103 status
= generate_message(this, message
, &packet
);
1104 if (status
!= SUCCESS
)
1108 *packets
= enumerator_create_single(packet
, NULL
);
1112 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
1113 message
->set_ike_sa_id(message
, this->ike_sa_id
);
1114 charon
->bus
->message(charon
->bus
, message
, FALSE
, TRUE
);
1115 status
= message
->fragment(message
, this->keymat
, this->fragment_size
,
1117 if (status
== SUCCESS
)
1119 charon
->bus
->message(charon
->bus
, message
, FALSE
, FALSE
);
1120 *packets
= enumerator_create_filter(fragments
, (void*)filter_fragments
,
1126 METHOD(ike_sa_t
, set_kmaddress
, void,
1127 private_ike_sa_t
*this, host_t
*local
, host_t
*remote
)
1129 DESTROY_IF(this->local_host
);
1130 DESTROY_IF(this->remote_host
);
1131 this->local_host
= local
->clone(local
);
1132 this->remote_host
= remote
->clone(remote
);
1136 METHOD(ike_sa_t
, act_as_mediation_server
, void,
1137 private_ike_sa_t
*this)
1139 charon
->mediation_manager
->update_sa_id(charon
->mediation_manager
,
1140 this->other_id
, this->ike_sa_id
);
1141 this->is_mediation_server
= TRUE
;
1144 METHOD(ike_sa_t
, get_server_reflexive_host
, host_t
*,
1145 private_ike_sa_t
*this)
1147 return this->server_reflexive_host
;
1150 METHOD(ike_sa_t
, set_server_reflexive_host
, void,
1151 private_ike_sa_t
*this, host_t
*host
)
1153 DESTROY_IF(this->server_reflexive_host
);
1154 this->server_reflexive_host
= host
;
1157 METHOD(ike_sa_t
, get_connect_id
, chunk_t
,
1158 private_ike_sa_t
*this)
1160 return this->connect_id
;
1163 METHOD(ike_sa_t
, respond
, status_t
,
1164 private_ike_sa_t
*this, identification_t
*peer_id
, chunk_t connect_id
)
1166 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1167 task
->respond(task
, peer_id
, connect_id
);
1168 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1169 return this->task_manager
->initiate(this->task_manager
);
1172 METHOD(ike_sa_t
, callback
, status_t
,
1173 private_ike_sa_t
*this, identification_t
*peer_id
)
1175 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1176 task
->callback(task
, peer_id
);
1177 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1178 return this->task_manager
->initiate(this->task_manager
);
1181 METHOD(ike_sa_t
, relay
, status_t
,
1182 private_ike_sa_t
*this, identification_t
*requester
, chunk_t connect_id
,
1183 chunk_t connect_key
, linked_list_t
*endpoints
, bool response
)
1185 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1186 task
->relay(task
, requester
, connect_id
, connect_key
, endpoints
, response
);
1187 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1188 return this->task_manager
->initiate(this->task_manager
);
1191 METHOD(ike_sa_t
, initiate_mediation
, status_t
,
1192 private_ike_sa_t
*this, peer_cfg_t
*mediated_cfg
)
1194 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1195 task
->connect(task
, mediated_cfg
->get_peer_id(mediated_cfg
));
1196 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1197 return this->task_manager
->initiate(this->task_manager
);
1200 METHOD(ike_sa_t
, initiate_mediated
, status_t
,
1201 private_ike_sa_t
*this, host_t
*me
, host_t
*other
, chunk_t connect_id
)
1203 set_my_host(this, me
->clone(me
));
1204 set_other_host(this, other
->clone(other
));
1205 chunk_free(&this->connect_id
);
1206 this->connect_id
= chunk_clone(connect_id
);
1207 return this->task_manager
->initiate(this->task_manager
);
1212 * Resolve DNS host in configuration
1214 static void resolve_hosts(private_ike_sa_t
*this)
1217 int family
= AF_UNSPEC
;
1219 switch (charon
->socket
->supported_families(charon
->socket
))
1221 case SOCKET_FAMILY_IPV4
:
1224 case SOCKET_FAMILY_IPV6
:
1227 case SOCKET_FAMILY_BOTH
:
1228 case SOCKET_FAMILY_NONE
:
1232 /* if an IP address is set locally, use the same family to resolve remote */
1233 if (family
== AF_UNSPEC
&& !this->remote_host
)
1235 if (this->local_host
)
1237 family
= this->local_host
->get_family(this->local_host
);
1241 family
= ike_cfg_get_family(this->ike_cfg
, TRUE
);
1245 if (this->remote_host
)
1247 host
= this->remote_host
->clone(this->remote_host
);
1248 host
->set_port(host
, IKEV2_UDP_PORT
);
1252 host
= this->ike_cfg
->resolve_other(this->ike_cfg
, family
);
1256 if (!host
->is_anyaddr(host
) ||
1257 this->other_host
->is_anyaddr(this->other_host
))
1258 { /* don't set to %any if we currently have an address, but the
1259 * address family might have changed */
1260 set_other_host(this, host
);
1263 { /* reuse the original port as some implementations might not like
1264 * initial IKE messages on other ports */
1265 this->other_host
->set_port(this->other_host
, host
->get_port(host
));
1266 host
->destroy(host
);
1270 if (this->local_host
)
1272 host
= this->local_host
->clone(this->local_host
);
1273 host
->set_port(host
, charon
->socket
->get_port(charon
->socket
, FALSE
));
1277 /* use same address family as for other */
1278 if (!this->other_host
->is_anyaddr(this->other_host
))
1280 family
= this->other_host
->get_family(this->other_host
);
1282 host
= this->ike_cfg
->resolve_me(this->ike_cfg
, family
);
1284 if (host
&& host
->is_anyaddr(host
) &&
1285 !this->other_host
->is_anyaddr(this->other_host
))
1287 host
->destroy(host
);
1288 host
= charon
->kernel
->get_source_addr(charon
->kernel
,
1289 this->other_host
, NULL
);
1292 host
->set_port(host
, this->ike_cfg
->get_my_port(this->ike_cfg
));
1295 { /* fallback to address family specific %any(6), if configured */
1296 host
= this->ike_cfg
->resolve_me(this->ike_cfg
, family
);
1302 set_my_host(this, host
);
1306 METHOD(ike_sa_t
, initiate
, status_t
,
1307 private_ike_sa_t
*this, child_cfg_t
*child_cfg
, u_int32_t reqid
,
1308 traffic_selector_t
*tsi
, traffic_selector_t
*tsr
)
1310 bool defer_initiate
= FALSE
;
1312 if (this->state
== IKE_CREATED
)
1314 if (this->my_host
->is_anyaddr(this->my_host
) ||
1315 this->other_host
->is_anyaddr(this->other_host
))
1317 resolve_hosts(this);
1320 if (this->other_host
->is_anyaddr(this->other_host
)
1322 && !this->peer_cfg
->get_mediated_by(this->peer_cfg
)
1328 addr
= this->ike_cfg
->get_other_addr(this->ike_cfg
);
1329 if (!this->retry_initiate_interval
)
1331 DBG1(DBG_IKE
, "unable to resolve %s, initiate aborted",
1333 DESTROY_IF(child_cfg
);
1334 charon
->bus
->alert(charon
->bus
, ALERT_PEER_ADDR_FAILED
);
1337 DBG1(DBG_IKE
, "unable to resolve %s, retrying in %ds",
1338 addr
, this->retry_initiate_interval
);
1339 defer_initiate
= TRUE
;
1342 set_condition(this, COND_ORIGINAL_INITIATOR
, TRUE
);
1343 this->task_manager
->queue_ike(this->task_manager
);
1347 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1349 if (this->state
== IKE_ESTABLISHED
)
1351 /* mediation connection is already established, retrigger state
1352 * change to notify bus listeners */
1353 DBG1(DBG_IKE
, "mediation connection is already up");
1354 set_state(this, IKE_ESTABLISHED
);
1356 DESTROY_IF(child_cfg
);
1362 /* normal IKE_SA with CHILD_SA */
1363 this->task_manager
->queue_child(this->task_manager
, child_cfg
, reqid
,
1366 if (this->peer_cfg
->get_mediated_by(this->peer_cfg
))
1368 /* mediated connection, initiate mediation process */
1369 job_t
*job
= (job_t
*)initiate_mediation_job_create(this->ike_sa_id
);
1370 lib
->processor
->queue_job(lib
->processor
, job
);
1378 if (!this->retry_initiate_queued
)
1380 job_t
*job
= (job_t
*)retry_initiate_job_create(this->ike_sa_id
);
1381 lib
->scheduler
->schedule_job(lib
->scheduler
, (job_t
*)job
,
1382 this->retry_initiate_interval
);
1383 this->retry_initiate_queued
= TRUE
;
1387 this->retry_initiate_queued
= FALSE
;
1388 return this->task_manager
->initiate(this->task_manager
);
1391 METHOD(ike_sa_t
, retry_initiate
, status_t
,
1392 private_ike_sa_t
*this)
1394 if (this->retry_initiate_queued
)
1396 this->retry_initiate_queued
= FALSE
;
1397 return initiate(this, NULL
, 0, NULL
, NULL
);
1402 METHOD(ike_sa_t
, process_message
, status_t
,
1403 private_ike_sa_t
*this, message_t
*message
)
1407 if (this->state
== IKE_PASSIVE
)
1408 { /* do not handle messages in passive state */
1411 if (message
->get_major_version(message
) != this->version
)
1413 DBG1(DBG_IKE
, "ignoring %N IKEv%u exchange on %N SA",
1414 exchange_type_names
, message
->get_exchange_type(message
),
1415 message
->get_major_version(message
),
1416 ike_version_names
, this->version
);
1417 /* TODO-IKEv1: fall back to IKEv1 if we receive an IKEv1
1418 * INVALID_MAJOR_VERSION on an IKEv2 SA. */
1421 status
= this->task_manager
->process_message(this->task_manager
, message
);
1422 if (this->flush_auth_cfg
&& this->state
== IKE_ESTABLISHED
)
1424 /* authentication completed */
1425 this->flush_auth_cfg
= FALSE
;
1426 flush_auth_cfgs(this);
1431 METHOD(ike_sa_t
, get_id
, ike_sa_id_t
*,
1432 private_ike_sa_t
*this)
1434 return this->ike_sa_id
;
1437 METHOD(ike_sa_t
, get_version
, ike_version_t
,
1438 private_ike_sa_t
*this)
1440 return this->version
;
1443 METHOD(ike_sa_t
, get_my_id
, identification_t
*,
1444 private_ike_sa_t
*this)
1449 METHOD(ike_sa_t
, set_my_id
, void,
1450 private_ike_sa_t
*this, identification_t
*me
)
1452 DESTROY_IF(this->my_id
);
1456 METHOD(ike_sa_t
, get_other_id
, identification_t
*,
1457 private_ike_sa_t
*this)
1459 return this->other_id
;
1462 METHOD(ike_sa_t
, get_other_eap_id
, identification_t
*,
1463 private_ike_sa_t
*this)
1465 identification_t
*id
= NULL
, *current
;
1466 enumerator_t
*enumerator
;
1469 enumerator
= array_create_enumerator(this->other_auths
);
1470 while (enumerator
->enumerate(enumerator
, &cfg
))
1472 /* prefer EAP-Identity of last round */
1473 current
= cfg
->get(cfg
, AUTH_RULE_EAP_IDENTITY
);
1474 if (!current
|| current
->get_type(current
) == ID_ANY
)
1476 current
= cfg
->get(cfg
, AUTH_RULE_XAUTH_IDENTITY
);
1478 if (!current
|| current
->get_type(current
) == ID_ANY
)
1480 current
= cfg
->get(cfg
, AUTH_RULE_IDENTITY
);
1482 if (current
&& current
->get_type(current
) != ID_ANY
)
1488 enumerator
->destroy(enumerator
);
1493 return this->other_id
;
1496 METHOD(ike_sa_t
, set_other_id
, void,
1497 private_ike_sa_t
*this, identification_t
*other
)
1499 DESTROY_IF(this->other_id
);
1500 this->other_id
= other
;
1503 METHOD(ike_sa_t
, add_child_sa
, void,
1504 private_ike_sa_t
*this, child_sa_t
*child_sa
)
1506 array_insert_create(&this->child_sas
, ARRAY_TAIL
, child_sa
);
1507 charon
->child_sa_manager
->add(charon
->child_sa_manager
,
1508 child_sa
, &this->public);
1511 METHOD(ike_sa_t
, get_child_sa
, child_sa_t
*,
1512 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
, bool inbound
)
1514 enumerator_t
*enumerator
;
1515 child_sa_t
*current
, *found
= NULL
;
1517 enumerator
= array_create_enumerator(this->child_sas
);
1518 while (enumerator
->enumerate(enumerator
, (void**)¤t
))
1520 if (current
->get_spi(current
, inbound
) == spi
&&
1521 current
->get_protocol(current
) == protocol
)
1526 enumerator
->destroy(enumerator
);
1530 METHOD(ike_sa_t
, get_child_count
, int,
1531 private_ike_sa_t
*this)
1533 return array_count(this->child_sas
);
1537 * Private data of a create_child_sa_enumerator()
1540 /** implements enumerator */
1541 enumerator_t
public;
1542 /** inner array enumerator */
1543 enumerator_t
*inner
;
1545 child_sa_t
*current
;
1546 } child_enumerator_t
;
1548 METHOD(enumerator_t
, child_enumerate
, bool,
1549 child_enumerator_t
*this, child_sa_t
**child_sa
)
1551 if (this->inner
->enumerate(this->inner
, &this->current
))
1553 *child_sa
= this->current
;
1559 METHOD(enumerator_t
, child_enumerator_destroy
, void,
1560 child_enumerator_t
*this)
1562 this->inner
->destroy(this->inner
);
1566 METHOD(ike_sa_t
, create_child_sa_enumerator
, enumerator_t
*,
1567 private_ike_sa_t
*this)
1569 child_enumerator_t
*enumerator
;
1573 .enumerate
= (void*)_child_enumerate
,
1574 .destroy
= _child_enumerator_destroy
,
1576 .inner
= array_create_enumerator(this->child_sas
),
1578 return &enumerator
->public;
1581 METHOD(ike_sa_t
, remove_child_sa
, void,
1582 private_ike_sa_t
*this, enumerator_t
*enumerator
)
1584 child_enumerator_t
*ce
= (child_enumerator_t
*)enumerator
;
1586 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, ce
->current
);
1587 array_remove_at(this->child_sas
, ce
->inner
);
1590 METHOD(ike_sa_t
, rekey_child_sa
, status_t
,
1591 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1593 if (this->state
== IKE_PASSIVE
)
1595 return INVALID_STATE
;
1597 this->task_manager
->queue_child_rekey(this->task_manager
, protocol
, spi
);
1598 return this->task_manager
->initiate(this->task_manager
);
1601 METHOD(ike_sa_t
, delete_child_sa
, status_t
,
1602 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
, bool expired
)
1604 if (this->state
== IKE_PASSIVE
)
1606 return INVALID_STATE
;
1608 this->task_manager
->queue_child_delete(this->task_manager
,
1609 protocol
, spi
, expired
);
1610 return this->task_manager
->initiate(this->task_manager
);
1613 METHOD(ike_sa_t
, destroy_child_sa
, status_t
,
1614 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1616 enumerator_t
*enumerator
;
1617 child_sa_t
*child_sa
;
1618 status_t status
= NOT_FOUND
;
1620 enumerator
= create_child_sa_enumerator(this);
1621 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1623 if (child_sa
->get_protocol(child_sa
) == protocol
&&
1624 child_sa
->get_spi(child_sa
, TRUE
) == spi
)
1626 remove_child_sa(this, enumerator
);
1627 child_sa
->destroy(child_sa
);
1632 enumerator
->destroy(enumerator
);
1636 METHOD(ike_sa_t
, delete_
, status_t
,
1637 private_ike_sa_t
*this)
1639 switch (this->state
)
1642 if (this->version
== IKEV1
)
1643 { /* SA has been reauthenticated, delete */
1644 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
1648 case IKE_ESTABLISHED
:
1649 if (time_monotonic(NULL
) >= this->stats
[STAT_DELETE
])
1650 { /* IKE_SA hard lifetime hit */
1651 charon
->bus
->alert(charon
->bus
, ALERT_IKE_SA_EXPIRED
);
1653 this->task_manager
->queue_ike_delete(this->task_manager
);
1654 return this->task_manager
->initiate(this->task_manager
);
1656 DBG1(DBG_IKE
, "deleting unestablished IKE_SA");
1661 DBG1(DBG_IKE
, "destroying IKE_SA in state %N "
1662 "without notification", ike_sa_state_names
, this->state
);
1663 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
1669 METHOD(ike_sa_t
, rekey
, status_t
,
1670 private_ike_sa_t
*this)
1672 if (this->state
== IKE_PASSIVE
)
1674 return INVALID_STATE
;
1676 this->task_manager
->queue_ike_rekey(this->task_manager
);
1677 return this->task_manager
->initiate(this->task_manager
);
1680 METHOD(ike_sa_t
, reauth
, status_t
,
1681 private_ike_sa_t
*this)
1683 if (this->state
== IKE_PASSIVE
)
1685 return INVALID_STATE
;
1687 if (this->state
== IKE_CONNECTING
)
1689 DBG0(DBG_IKE
, "reinitiating IKE_SA %s[%d]",
1690 get_name(this), this->unique_id
);
1692 this->task_manager
->queue_ike(this->task_manager
);
1693 return this->task_manager
->initiate(this->task_manager
);
1695 /* we can't reauthenticate as responder when we use EAP or virtual IPs.
1696 * If the peer does not support RFC4478, there is no way to keep the
1698 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
1700 DBG1(DBG_IKE
, "initiator did not reauthenticate as requested");
1701 if (array_count(this->other_vips
) != 0 ||
1702 has_condition(this, COND_XAUTH_AUTHENTICATED
) ||
1703 has_condition(this, COND_EAP_AUTHENTICATED
)
1705 /* as mediation server we too cannot reauth the IKE_SA */
1706 || this->is_mediation_server
1712 del
= this->stats
[STAT_DELETE
];
1713 now
= time_monotonic(NULL
);
1714 DBG1(DBG_IKE
, "IKE_SA %s[%d] will timeout in %V",
1715 get_name(this), this->unique_id
, &now
, &del
);
1720 DBG0(DBG_IKE
, "reauthenticating IKE_SA %s[%d] actively",
1721 get_name(this), this->unique_id
);
1726 DBG0(DBG_IKE
, "reauthenticating IKE_SA %s[%d]",
1727 get_name(this), this->unique_id
);
1729 set_condition(this, COND_REAUTHENTICATING
, TRUE
);
1730 this->task_manager
->queue_ike_reauth(this->task_manager
);
1731 return this->task_manager
->initiate(this->task_manager
);
1735 * Check if tasks to create CHILD_SAs are queued in the given queue
1737 static bool is_child_queued(private_ike_sa_t
*this, task_queue_t queue
)
1739 enumerator_t
*enumerator
;
1743 enumerator
= this->task_manager
->create_task_enumerator(this->task_manager
,
1745 while (enumerator
->enumerate(enumerator
, &task
))
1747 if (task
->get_type(task
) == TASK_CHILD_CREATE
||
1748 task
->get_type(task
) == TASK_QUICK_MODE
)
1754 enumerator
->destroy(enumerator
);
1758 METHOD(ike_sa_t
, reestablish
, status_t
,
1759 private_ike_sa_t
*this)
1764 enumerator_t
*enumerator
;
1765 child_sa_t
*child_sa
;
1766 child_cfg_t
*child_cfg
;
1767 bool restart
= FALSE
;
1768 status_t status
= FAILED
;
1770 if (has_condition(this, COND_REAUTHENTICATING
))
1771 { /* only reauthenticate if we have children */
1772 if (array_count(this->child_sas
) == 0
1774 /* allow reauth of mediation connections without CHILD_SAs */
1775 && !this->peer_cfg
->is_mediation(this->peer_cfg
)
1779 DBG1(DBG_IKE
, "unable to reauthenticate IKE_SA, no CHILD_SA "
1788 { /* check if we have children to keep up at all */
1789 enumerator
= array_create_enumerator(this->child_sas
);
1790 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1792 if (this->state
== IKE_DELETING
)
1794 action
= child_sa
->get_close_action(child_sa
);
1798 action
= child_sa
->get_dpd_action(child_sa
);
1802 case ACTION_RESTART
:
1806 charon
->traps
->install(charon
->traps
, this->peer_cfg
,
1807 child_sa
->get_config(child_sa
),
1808 child_sa
->get_reqid(child_sa
));
1814 enumerator
->destroy(enumerator
);
1815 /* check if we have tasks that recreate children */
1818 restart
= is_child_queued(this, TASK_QUEUE_ACTIVE
) ||
1819 is_child_queued(this, TASK_QUEUE_QUEUED
);
1822 /* mediation connections have no children, keep them up anyway */
1823 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1834 /* check if we are able to reestablish this IKE_SA */
1835 if (!has_condition(this, COND_ORIGINAL_INITIATOR
) &&
1836 (array_count(this->other_vips
) != 0 ||
1837 has_condition(this, COND_EAP_AUTHENTICATED
)
1839 || this->is_mediation_server
1843 DBG1(DBG_IKE
, "unable to reestablish IKE_SA due to asymmetric setup");
1847 new = charon
->ike_sa_manager
->checkout_new(charon
->ike_sa_manager
,
1848 this->version
, TRUE
);
1853 new->set_peer_cfg(new, this->peer_cfg
);
1854 host
= this->other_host
;
1855 new->set_other_host(new, host
->clone(host
));
1856 host
= this->my_host
;
1857 new->set_my_host(new, host
->clone(host
));
1858 charon
->bus
->ike_reestablish_pre(charon
->bus
, &this->public, new);
1859 /* resolve hosts but use the old addresses above as fallback */
1860 resolve_hosts((private_ike_sa_t
*)new);
1861 /* if we already have a virtual IP, we reuse it */
1862 enumerator
= array_create_enumerator(this->my_vips
);
1863 while (enumerator
->enumerate(enumerator
, &host
))
1865 new->add_virtual_ip(new, TRUE
, host
);
1867 enumerator
->destroy(enumerator
);
1870 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1872 status
= new->initiate(new, NULL
, 0, NULL
, NULL
);
1877 /* handle existing CHILD_SAs */
1878 enumerator
= create_child_sa_enumerator(this);
1879 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1881 if (has_condition(this, COND_REAUTHENTICATING
))
1883 switch (child_sa
->get_state(child_sa
))
1886 { /* move routed child directly */
1887 remove_child_sa(this, enumerator
);
1888 new->add_child_sa(new, child_sa
);
1889 action
= ACTION_NONE
;
1893 { /* initiate/queue all other CHILD_SAs */
1894 action
= ACTION_RESTART
;
1900 { /* only restart CHILD_SAs that are configured accordingly */
1901 if (this->state
== IKE_DELETING
)
1903 action
= child_sa
->get_close_action(child_sa
);
1907 action
= child_sa
->get_dpd_action(child_sa
);
1912 case ACTION_RESTART
:
1913 child_cfg
= child_sa
->get_config(child_sa
);
1914 DBG1(DBG_IKE
, "restarting CHILD_SA %s",
1915 child_cfg
->get_name(child_cfg
));
1916 child_cfg
->get_ref(child_cfg
);
1917 status
= new->initiate(new, child_cfg
,
1918 child_sa
->get_reqid(child_sa
), NULL
, NULL
);
1923 if (status
== DESTROY_ME
)
1928 enumerator
->destroy(enumerator
);
1929 /* adopt any active or queued CHILD-creating tasks */
1930 if (status
!= DESTROY_ME
)
1932 task_manager_t
*other_tasks
= ((private_ike_sa_t
*)new)->task_manager
;
1933 other_tasks
->adopt_child_tasks(other_tasks
, this->task_manager
);
1934 if (new->get_state(new) == IKE_CREATED
)
1936 status
= new->initiate(new, NULL
, 0, NULL
, NULL
);
1941 if (status
== DESTROY_ME
)
1943 charon
->bus
->ike_reestablish_post(charon
->bus
, &this->public, new,
1945 charon
->ike_sa_manager
->checkin_and_destroy(charon
->ike_sa_manager
, new);
1950 charon
->bus
->ike_reestablish_post(charon
->bus
, &this->public, new,
1952 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, new);
1955 charon
->bus
->set_sa(charon
->bus
, &this->public);
1959 METHOD(ike_sa_t
, handle_redirect
, bool,
1960 private_ike_sa_t
*this, identification_t
*gateway
)
1965 DBG1(DBG_IKE
, "redirected to %Y", gateway
);
1966 if (!this->follow_redirects
)
1968 DBG1(DBG_IKE
, "server sent REDIRECT even though we disabled it");
1972 snprintf(gw
, sizeof(gw
), "%Y", gateway
);
1973 gw
[sizeof(gw
)-1] = '\0';
1974 other
= host_create_from_dns(gw
, AF_UNSPEC
, IKEV2_UDP_PORT
);
1977 DBG1(DBG_IKE
, "unable to resolve gateway ID '%Y', redirect failed",
1981 switch (this->state
)
1983 case IKE_CONNECTING
:
1985 set_other_host(this, other
);
1988 DBG1(DBG_IKE
, "unable to handle redirect for IKE_SA in state %N",
1989 ike_sa_state_names
, this->state
);
1990 other
->destroy(other
);
1995 METHOD(ike_sa_t
, retransmit
, status_t
,
1996 private_ike_sa_t
*this, u_int32_t message_id
)
1998 if (this->state
== IKE_PASSIVE
)
2000 return INVALID_STATE
;
2002 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
2003 if (this->task_manager
->retransmit(this->task_manager
, message_id
) != SUCCESS
)
2005 /* send a proper signal to brief interested bus listeners */
2006 switch (this->state
)
2008 case IKE_CONNECTING
:
2010 /* retry IKE_SA_INIT/Main Mode if we have multiple keyingtries */
2011 u_int32_t tries
= this->peer_cfg
->get_keyingtries(this->peer_cfg
);
2012 charon
->bus
->alert(charon
->bus
, ALERT_PEER_INIT_UNREACHABLE
,
2015 if (tries
== 0 || tries
> this->keyingtry
)
2017 DBG1(DBG_IKE
, "peer not responding, trying again (%d/%d)",
2018 this->keyingtry
+ 1, tries
);
2020 resolve_hosts(this);
2021 this->task_manager
->queue_ike(this->task_manager
);
2022 return this->task_manager
->initiate(this->task_manager
);
2024 DBG1(DBG_IKE
, "establishing IKE_SA failed, peer not responding");
2028 DBG1(DBG_IKE
, "proper IKE_SA delete failed, peer not responding");
2029 if (has_condition(this, COND_REAUTHENTICATING
))
2031 DBG1(DBG_IKE
, "delete during reauthentication failed, "
2032 "trying to reestablish IKE_SA anyway");
2037 DBG1(DBG_IKE
, "rekeying IKE_SA failed, peer not responding");
2043 if (this->state
!= IKE_CONNECTING
)
2045 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
2052 METHOD(ike_sa_t
, set_auth_lifetime
, status_t
,
2053 private_ike_sa_t
*this, u_int32_t lifetime
)
2055 u_int32_t diff
, hard
, soft
, now
;
2058 diff
= this->peer_cfg
->get_over_time(this->peer_cfg
);
2059 now
= time_monotonic(NULL
);
2060 hard
= now
+ lifetime
;
2063 /* check if we have to send an AUTH_LIFETIME to enforce the new lifetime.
2064 * We send the notify in IKE_AUTH if not yet ESTABLISHED. */
2065 send_update
= this->state
== IKE_ESTABLISHED
&& this->version
== IKEV2
&&
2066 !has_condition(this, COND_ORIGINAL_INITIATOR
) &&
2067 (array_count(this->other_vips
) != 0 ||
2068 has_condition(this, COND_EAP_AUTHENTICATED
));
2070 if (lifetime
< diff
)
2072 this->stats
[STAT_REAUTH
] = now
;
2076 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, "
2077 "starting reauthentication", lifetime
);
2078 lib
->processor
->queue_job(lib
->processor
,
2079 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
));
2082 else if (this->stats
[STAT_REAUTH
] == 0 ||
2083 this->stats
[STAT_REAUTH
] > soft
)
2085 this->stats
[STAT_REAUTH
] = soft
;
2088 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, scheduling "
2089 "reauthentication in %ds", lifetime
, lifetime
- diff
);
2090 lib
->scheduler
->schedule_job(lib
->scheduler
,
2091 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
),
2097 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, "
2098 "reauthentication already scheduled in %ds", lifetime
,
2099 this->stats
[STAT_REAUTH
] - time_monotonic(NULL
));
2100 send_update
= FALSE
;
2102 /* give at least some seconds to reauthenticate */
2103 this->stats
[STAT_DELETE
] = max(hard
, now
+ 10);
2108 ike_auth_lifetime_t
*task
;
2110 task
= ike_auth_lifetime_create(&this->public, TRUE
);
2111 this->task_manager
->queue_task(this->task_manager
, &task
->task
);
2112 return this->task_manager
->initiate(this->task_manager
);
2119 * Check if the current combination of source and destination address is still
2122 static bool is_current_path_valid(private_ike_sa_t
*this)
2126 src
= charon
->kernel
->get_source_addr(charon
->kernel
, this->other_host
,
2130 if (src
->ip_equals(src
, this->my_host
))
2140 * Check if we have any path avialable for this IKE SA.
2142 static bool is_any_path_valid(private_ike_sa_t
*this)
2145 enumerator_t
*enumerator
;
2146 host_t
*src
= NULL
, *addr
;
2147 int family
= AF_UNSPEC
;
2149 switch (charon
->socket
->supported_families(charon
->socket
))
2151 case SOCKET_FAMILY_IPV4
:
2154 case SOCKET_FAMILY_IPV6
:
2157 case SOCKET_FAMILY_BOTH
:
2158 case SOCKET_FAMILY_NONE
:
2162 DBG1(DBG_IKE
, "old path is not available anymore, try to find another");
2163 enumerator
= create_peer_address_enumerator(this);
2164 while (enumerator
->enumerate(enumerator
, &addr
))
2166 if (family
!= AF_UNSPEC
&& addr
->get_family(addr
) != family
)
2170 DBG1(DBG_IKE
, "looking for a route to %H ...", addr
);
2171 src
= charon
->kernel
->get_source_addr(charon
->kernel
, addr
, NULL
);
2177 enumerator
->destroy(enumerator
);
2186 METHOD(ike_sa_t
, roam
, status_t
,
2187 private_ike_sa_t
*this, bool address
)
2189 switch (this->state
)
2193 case IKE_DESTROYING
:
2200 /* keep existing path if possible */
2201 if (is_current_path_valid(this))
2203 DBG2(DBG_IKE
, "keeping connection path %H - %H",
2204 this->my_host
, this->other_host
);
2205 set_condition(this, COND_STALE
, FALSE
);
2207 if (supports_extension(this, EXT_MOBIKE
) && address
)
2208 { /* if any addresses changed, send an updated list */
2209 DBG1(DBG_IKE
, "sending address list update using MOBIKE");
2210 this->task_manager
->queue_mobike(this->task_manager
, FALSE
, TRUE
);
2211 return this->task_manager
->initiate(this->task_manager
);
2216 if (!is_any_path_valid(this))
2218 DBG1(DBG_IKE
, "no route found to reach %H, MOBIKE update deferred",
2220 set_condition(this, COND_STALE
, TRUE
);
2223 set_condition(this, COND_STALE
, FALSE
);
2225 /* update addresses with mobike, if supported ... */
2226 if (supports_extension(this, EXT_MOBIKE
))
2228 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
2229 { /* responder updates the peer about changed address config */
2230 DBG1(DBG_IKE
, "sending address list update using MOBIKE, "
2231 "implicitly requesting an address change");
2236 DBG1(DBG_IKE
, "requesting address change using MOBIKE");
2238 this->task_manager
->queue_mobike(this->task_manager
, TRUE
, address
);
2239 return this->task_manager
->initiate(this->task_manager
);
2242 /* ... reauth if not */
2243 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
2244 { /* responder does not reauthenticate */
2245 set_condition(this, COND_STALE
, TRUE
);
2248 DBG1(DBG_IKE
, "reauthenticating IKE_SA due to address change");
2249 /* since our previous path is not valid anymore, try and find a new one */
2250 resolve_hosts(this);
2251 return reauth(this);
2254 METHOD(ike_sa_t
, add_configuration_attribute
, void,
2255 private_ike_sa_t
*this, attribute_handler_t
*handler
,
2256 configuration_attribute_type_t type
, chunk_t data
)
2258 attribute_entry_t entry
= {
2261 .data
= chunk_clone(data
),
2263 array_insert(this->attributes
, ARRAY_TAIL
, &entry
);
2267 * Enumerator filter for attributes
2269 static bool filter_attribute(void *null
, attribute_entry_t
**in
,
2270 configuration_attribute_type_t
*type
, void *in2
,
2271 chunk_t
*data
, void *in3
, bool *handled
)
2273 *type
= (*in
)->type
;
2274 *data
= (*in
)->data
;
2275 *handled
= (*in
)->handler
!= NULL
;
2279 METHOD(ike_sa_t
, create_attribute_enumerator
, enumerator_t
*,
2280 private_ike_sa_t
*this)
2282 return enumerator_create_filter(array_create_enumerator(this->attributes
),
2283 (void*)filter_attribute
, NULL
, NULL
);
2286 METHOD(ike_sa_t
, create_task_enumerator
, enumerator_t
*,
2287 private_ike_sa_t
*this, task_queue_t queue
)
2289 return this->task_manager
->create_task_enumerator(this->task_manager
, queue
);
2292 METHOD(ike_sa_t
, flush_queue
, void,
2293 private_ike_sa_t
*this, task_queue_t queue
)
2295 this->task_manager
->flush_queue(this->task_manager
, queue
);
2298 METHOD(ike_sa_t
, queue_task
, void,
2299 private_ike_sa_t
*this, task_t
*task
)
2301 this->task_manager
->queue_task(this->task_manager
, task
);
2304 METHOD(ike_sa_t
, inherit_pre
, void,
2305 private_ike_sa_t
*this, ike_sa_t
*other_public
)
2307 private_ike_sa_t
*other
= (private_ike_sa_t
*)other_public
;
2309 /* apply config and hosts */
2310 set_peer_cfg(this, other
->peer_cfg
);
2311 set_my_host(this, other
->my_host
->clone(other
->my_host
));
2312 set_other_host(this, other
->other_host
->clone(other
->other_host
));
2314 /* apply extensions and conditions with a few exceptions */
2315 this->extensions
= other
->extensions
;
2316 this->conditions
= other
->conditions
;
2317 this->conditions
&= ~COND_STALE
;
2318 this->conditions
&= ~COND_REAUTHENTICATING
;
2321 METHOD(ike_sa_t
, inherit_post
, void,
2322 private_ike_sa_t
*this, ike_sa_t
*other_public
)
2324 private_ike_sa_t
*other
= (private_ike_sa_t
*)other_public
;
2325 child_sa_t
*child_sa
;
2326 enumerator_t
*enumerator
;
2327 attribute_entry_t entry
;
2331 /* apply hosts and ids */
2332 this->my_host
->destroy(this->my_host
);
2333 this->other_host
->destroy(this->other_host
);
2334 this->my_id
->destroy(this->my_id
);
2335 this->other_id
->destroy(this->other_id
);
2336 this->my_host
= other
->my_host
->clone(other
->my_host
);
2337 this->other_host
= other
->other_host
->clone(other
->other_host
);
2338 this->my_id
= other
->my_id
->clone(other
->my_id
);
2339 this->other_id
= other
->other_id
->clone(other
->other_id
);
2341 /* apply assigned virtual IPs... */
2342 while (array_remove(other
->my_vips
, ARRAY_HEAD
, &vip
))
2344 array_insert_create(&this->my_vips
, ARRAY_TAIL
, vip
);
2346 while (array_remove(other
->other_vips
, ARRAY_HEAD
, &vip
))
2348 array_insert_create(&this->other_vips
, ARRAY_TAIL
, vip
);
2351 /* MOBIKE additional addresses */
2352 while (array_remove(other
->peer_addresses
, ARRAY_HEAD
, &vip
))
2354 array_insert_create(&this->peer_addresses
, ARRAY_TAIL
, vip
);
2357 /* authentication information */
2358 enumerator
= array_create_enumerator(other
->my_auths
);
2359 while (enumerator
->enumerate(enumerator
, &cfg
))
2361 array_insert(this->my_auths
, ARRAY_TAIL
, cfg
->clone(cfg
));
2363 enumerator
->destroy(enumerator
);
2364 enumerator
= array_create_enumerator(other
->other_auths
);
2365 while (enumerator
->enumerate(enumerator
, &cfg
))
2367 array_insert(this->other_auths
, ARRAY_TAIL
, cfg
->clone(cfg
));
2369 enumerator
->destroy(enumerator
);
2371 /* ... and configuration attributes */
2372 while (array_remove(other
->attributes
, ARRAY_HEAD
, &entry
))
2374 array_insert(this->attributes
, ARRAY_TAIL
, &entry
);
2377 /* inherit all conditions */
2378 this->conditions
= other
->conditions
;
2379 if (this->conditions
& COND_NAT_HERE
)
2381 send_keepalive(this, FALSE
);
2385 if (other
->is_mediation_server
)
2387 act_as_mediation_server(this);
2389 else if (other
->server_reflexive_host
)
2391 this->server_reflexive_host
= other
->server_reflexive_host
->clone(
2392 other
->server_reflexive_host
);
2396 /* adopt all children */
2397 while (array_remove(other
->child_sas
, ARRAY_HEAD
, &child_sa
))
2399 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, child_sa
);
2400 add_child_sa(this, child_sa
);
2403 /* move pending tasks to the new IKE_SA */
2404 this->task_manager
->adopt_tasks(this->task_manager
, other
->task_manager
);
2406 /* reauthentication timeout survives a rekeying */
2407 if (other
->stats
[STAT_REAUTH
])
2409 time_t reauth
, delete, now
= time_monotonic(NULL
);
2411 this->stats
[STAT_REAUTH
] = other
->stats
[STAT_REAUTH
];
2412 reauth
= this->stats
[STAT_REAUTH
] - now
;
2413 delete = reauth
+ this->peer_cfg
->get_over_time(this->peer_cfg
);
2414 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
] + delete;
2415 DBG1(DBG_IKE
, "rescheduling reauthentication in %ds after rekeying, "
2416 "lifetime reduced to %ds", reauth
, delete);
2417 lib
->scheduler
->schedule_job(lib
->scheduler
,
2418 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
), reauth
);
2419 lib
->scheduler
->schedule_job(lib
->scheduler
,
2420 (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
), delete);
2424 METHOD(ike_sa_t
, destroy
, void,
2425 private_ike_sa_t
*this)
2427 attribute_entry_t entry
;
2428 child_sa_t
*child_sa
;
2431 charon
->bus
->set_sa(charon
->bus
, &this->public);
2433 set_state(this, IKE_DESTROYING
);
2434 if (this->task_manager
)
2436 this->task_manager
->flush(this->task_manager
);
2439 /* remove attributes first, as we pass the IKE_SA to the handler */
2440 charon
->bus
->handle_vips(charon
->bus
, &this->public, FALSE
);
2441 while (array_remove(this->attributes
, ARRAY_TAIL
, &entry
))
2445 charon
->attributes
->release(charon
->attributes
, entry
.handler
,
2446 &this->public, entry
.type
, entry
.data
);
2448 free(entry
.data
.ptr
);
2450 /* uninstall CHILD_SAs before virtual IPs, otherwise we might kill
2451 * routes that the CHILD_SA tries to uninstall. */
2452 while (array_remove(this->child_sas
, ARRAY_TAIL
, &child_sa
))
2454 charon
->child_sa_manager
->remove(charon
->child_sa_manager
, child_sa
);
2455 child_sa
->destroy(child_sa
);
2457 while (array_remove(this->my_vips
, ARRAY_TAIL
, &vip
))
2459 charon
->kernel
->del_ip(charon
->kernel
, vip
, -1, TRUE
);
2462 if (array_count(this->other_vips
))
2464 charon
->bus
->assign_vips(charon
->bus
, &this->public, FALSE
);
2466 while (array_remove(this->other_vips
, ARRAY_TAIL
, &vip
))
2470 linked_list_t
*pools
;
2472 pools
= linked_list_create_from_enumerator(
2473 this->peer_cfg
->create_pool_enumerator(this->peer_cfg
));
2474 charon
->attributes
->release_address(charon
->attributes
,
2475 pools
, vip
, &this->public);
2476 pools
->destroy(pools
);
2481 /* unset SA after here to avoid usage by the listeners */
2482 charon
->bus
->set_sa(charon
->bus
, NULL
);
2484 array_destroy(this->child_sas
);
2485 DESTROY_IF(this->task_manager
);
2486 DESTROY_IF(this->keymat
);
2487 array_destroy(this->attributes
);
2488 array_destroy(this->my_vips
);
2489 array_destroy(this->other_vips
);
2490 array_destroy_offset(this->peer_addresses
, offsetof(host_t
, destroy
));
2492 if (this->is_mediation_server
)
2494 charon
->mediation_manager
->remove(charon
->mediation_manager
,
2497 DESTROY_IF(this->server_reflexive_host
);
2498 chunk_free(&this->connect_id
);
2500 free(this->nat_detection_dest
.ptr
);
2502 DESTROY_IF(this->my_host
);
2503 DESTROY_IF(this->other_host
);
2504 DESTROY_IF(this->my_id
);
2505 DESTROY_IF(this->other_id
);
2506 DESTROY_IF(this->local_host
);
2507 DESTROY_IF(this->remote_host
);
2509 DESTROY_IF(this->ike_cfg
);
2510 DESTROY_IF(this->peer_cfg
);
2511 DESTROY_IF(this->proposal
);
2512 this->my_auth
->destroy(this->my_auth
);
2513 this->other_auth
->destroy(this->other_auth
);
2514 array_destroy_offset(this->my_auths
, offsetof(auth_cfg_t
, destroy
));
2515 array_destroy_offset(this->other_auths
, offsetof(auth_cfg_t
, destroy
));
2517 this->ike_sa_id
->destroy(this->ike_sa_id
);
2522 * Described in header.
2524 ike_sa_t
* ike_sa_create(ike_sa_id_t
*ike_sa_id
, bool initiator
,
2525 ike_version_t version
)
2527 private_ike_sa_t
*this;
2528 static refcount_t unique_id
= 0;
2530 if (version
== IKE_ANY
)
2531 { /* prefer IKEv2 if protocol not specified */
2541 .get_version
= _get_version
,
2542 .get_state
= _get_state
,
2543 .set_state
= _set_state
,
2544 .get_name
= _get_name
,
2545 .get_statistic
= _get_statistic
,
2546 .set_statistic
= _set_statistic
,
2547 .process_message
= _process_message
,
2548 .initiate
= _initiate
,
2549 .retry_initiate
= _retry_initiate
,
2550 .get_ike_cfg
= _get_ike_cfg
,
2551 .set_ike_cfg
= _set_ike_cfg
,
2552 .get_peer_cfg
= _get_peer_cfg
,
2553 .set_peer_cfg
= _set_peer_cfg
,
2554 .get_auth_cfg
= _get_auth_cfg
,
2555 .create_auth_cfg_enumerator
= _create_auth_cfg_enumerator
,
2556 .add_auth_cfg
= _add_auth_cfg
,
2557 .get_proposal
= _get_proposal
,
2558 .set_proposal
= _set_proposal
,
2560 .get_my_host
= _get_my_host
,
2561 .set_my_host
= _set_my_host
,
2562 .get_other_host
= _get_other_host
,
2563 .set_other_host
= _set_other_host
,
2564 .set_message_id
= _set_message_id
,
2565 .float_ports
= _float_ports
,
2566 .update_hosts
= _update_hosts
,
2567 .get_my_id
= _get_my_id
,
2568 .set_my_id
= _set_my_id
,
2569 .get_other_id
= _get_other_id
,
2570 .set_other_id
= _set_other_id
,
2571 .get_other_eap_id
= _get_other_eap_id
,
2572 .enable_extension
= _enable_extension
,
2573 .supports_extension
= _supports_extension
,
2574 .set_condition
= _set_condition
,
2575 .has_condition
= _has_condition
,
2576 .set_pending_updates
= _set_pending_updates
,
2577 .get_pending_updates
= _get_pending_updates
,
2578 .create_peer_address_enumerator
= _create_peer_address_enumerator
,
2579 .add_peer_address
= _add_peer_address
,
2580 .clear_peer_addresses
= _clear_peer_addresses
,
2581 .has_mapping_changed
= _has_mapping_changed
,
2582 .retransmit
= _retransmit
,
2584 .destroy
= _destroy
,
2585 .send_dpd
= _send_dpd
,
2586 .send_keepalive
= _send_keepalive
,
2587 .handle_redirect
= _handle_redirect
,
2588 .get_keymat
= _get_keymat
,
2589 .add_child_sa
= _add_child_sa
,
2590 .get_child_sa
= _get_child_sa
,
2591 .get_child_count
= _get_child_count
,
2592 .create_child_sa_enumerator
= _create_child_sa_enumerator
,
2593 .remove_child_sa
= _remove_child_sa
,
2594 .rekey_child_sa
= _rekey_child_sa
,
2595 .delete_child_sa
= _delete_child_sa
,
2596 .destroy_child_sa
= _destroy_child_sa
,
2599 .reestablish
= _reestablish
,
2600 .set_auth_lifetime
= _set_auth_lifetime
,
2602 .inherit_pre
= _inherit_pre
,
2603 .inherit_post
= _inherit_post
,
2604 .generate_message
= _generate_message
,
2605 .generate_message_fragmented
= _generate_message_fragmented
,
2607 .get_unique_id
= _get_unique_id
,
2608 .add_virtual_ip
= _add_virtual_ip
,
2609 .clear_virtual_ips
= _clear_virtual_ips
,
2610 .create_virtual_ip_enumerator
= _create_virtual_ip_enumerator
,
2611 .add_configuration_attribute
= _add_configuration_attribute
,
2612 .create_attribute_enumerator
= _create_attribute_enumerator
,
2613 .set_kmaddress
= _set_kmaddress
,
2614 .create_task_enumerator
= _create_task_enumerator
,
2615 .flush_queue
= _flush_queue
,
2616 .queue_task
= _queue_task
,
2618 .act_as_mediation_server
= _act_as_mediation_server
,
2619 .get_server_reflexive_host
= _get_server_reflexive_host
,
2620 .set_server_reflexive_host
= _set_server_reflexive_host
,
2621 .get_connect_id
= _get_connect_id
,
2622 .initiate_mediation
= _initiate_mediation
,
2623 .initiate_mediated
= _initiate_mediated
,
2625 .callback
= _callback
,
2626 .respond
= _respond
,
2629 .ike_sa_id
= ike_sa_id
->clone(ike_sa_id
),
2631 .my_host
= host_create_any(AF_INET
),
2632 .other_host
= host_create_any(AF_INET
),
2633 .my_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
),
2634 .other_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
),
2635 .keymat
= keymat_create(version
, initiator
),
2636 .state
= IKE_CREATED
,
2637 .stats
[STAT_INBOUND
] = time_monotonic(NULL
),
2638 .stats
[STAT_OUTBOUND
] = time_monotonic(NULL
),
2639 .my_auth
= auth_cfg_create(),
2640 .other_auth
= auth_cfg_create(),
2641 .my_auths
= array_create(0, 0),
2642 .other_auths
= array_create(0, 0),
2643 .attributes
= array_create(sizeof(attribute_entry_t
), 0),
2644 .unique_id
= ref_get(&unique_id
),
2645 .keepalive_interval
= lib
->settings
->get_time(lib
->settings
,
2646 "%s.keep_alive", KEEPALIVE_INTERVAL
, lib
->ns
),
2647 .retry_initiate_interval
= lib
->settings
->get_time(lib
->settings
,
2648 "%s.retry_initiate_interval", 0, lib
->ns
),
2649 .flush_auth_cfg
= lib
->settings
->get_bool(lib
->settings
,
2650 "%s.flush_auth_cfg", FALSE
, lib
->ns
),
2651 .fragment_size
= lib
->settings
->get_int(lib
->settings
,
2652 "%s.fragment_size", 0, lib
->ns
),
2653 .follow_redirects
= lib
->settings
->get_bool(lib
->settings
,
2654 "%s.follow_redirects", TRUE
, lib
->ns
),
2657 if (version
== IKEV2
)
2658 { /* always supported with IKEv2 */
2659 enable_extension(this, EXT_DPD
);
2662 this->task_manager
= task_manager_create(&this->public);
2663 this->my_host
->set_port(this->my_host
,
2664 charon
->socket
->get_port(charon
->socket
, FALSE
));
2666 if (!this->task_manager
|| !this->keymat
)
2668 DBG1(DBG_IKE
, "IKE version %d not supported", this->version
);
2672 return &this->public;