2 * Copyright (C) 2006-2012 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2009 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
29 #include <utils/linked_list.h>
30 #include <utils/lexparser.h>
31 #include <processing/jobs/retransmit_job.h>
32 #include <processing/jobs/delete_ike_sa_job.h>
33 #include <processing/jobs/send_dpd_job.h>
34 #include <processing/jobs/send_keepalive_job.h>
35 #include <processing/jobs/rekey_ike_sa_job.h>
36 #include <processing/jobs/retry_initiate_job.h>
37 #include <sa/ikev2/tasks/ike_auth_lifetime.h>
40 #include <sa/ikev2/tasks/ike_me.h>
41 #include <processing/jobs/initiate_mediation_job.h>
44 ENUM(ike_sa_state_names
, IKE_CREATED
, IKE_DESTROYING
,
54 typedef struct private_ike_sa_t private_ike_sa_t
;
55 typedef struct attribute_entry_t attribute_entry_t
;
58 * Private data of an ike_sa_t object.
60 struct private_ike_sa_t
{
68 * Identifier for the current IKE_SA.
70 ike_sa_id_t
*ike_sa_id
;
73 * IKE version of this SA.
75 ike_version_t version
;
78 * unique numerical ID for this IKE_SA.
83 * Current state of the IKE_SA
88 * IKE configuration used to set up this IKE_SA
93 * Peer and authentication information to establish IKE_SA.
98 * currently used authentication ruleset, local (as auth_cfg_t)
103 * list of completed local authentication rounds
105 linked_list_t
*my_auths
;
108 * list of completed remote authentication rounds
110 linked_list_t
*other_auths
;
113 * currently used authentication constraints, remote (as auth_cfg_t)
115 auth_cfg_t
*other_auth
;
118 * Selected IKE proposal
120 proposal_t
*proposal
;
123 * Juggles tasks to process messages
125 task_manager_t
*task_manager
;
128 * Address of local host
133 * Address of remote host
139 * Are we mediation server
141 bool is_mediation_server
;
144 * Server reflexive host
146 host_t
*server_reflexive_host
;
155 * Identification used for us
157 identification_t
*my_id
;
160 * Identification used for other
162 identification_t
*other_id
;
165 * set of extensions the peer supports
167 ike_extension_t extensions
;
170 * set of condition flags currently enabled for this IKE_SA
172 ike_condition_t conditions
;
175 * Linked List containing the child sa's of the current IKE_SA.
177 linked_list_t
*child_sas
;
180 * keymat of this IKE_SA
185 * Virtual IPs on local host
187 linked_list_t
*my_vips
;
190 * Virtual IPs on remote host
192 linked_list_t
*other_vips
;
195 * List of configuration attributes (attribute_entry_t)
197 linked_list_t
*attributes
;
200 * list of peer's addresses, additional ones transmitted via MOBIKE
202 linked_list_t
*peer_addresses
;
205 * previously value of received DESTINATION_IP hash
207 chunk_t nat_detection_dest
;
210 * number pending UPDATE_SA_ADDRESS (MOBIKE)
212 u_int32_t pending_updates
;
215 * NAT keep alive interval
217 u_int32_t keepalive_interval
;
220 * interval for retries during initiation (e.g. if DNS resolution failed),
221 * 0 to disable (default)
223 u_int32_t retry_initiate_interval
;
226 * TRUE if a retry_initiate_job has been queued
228 bool retry_initiate_queued
;
231 * Timestamps for this IKE_SA
233 u_int32_t stats
[STAT_MAX
];
236 * how many times we have retried so far (keyingtries)
241 * local host address to be used for IKE, set via MIGRATE kernel message
246 * remote host address to be used for IKE, set via MIGRATE kernel message
251 * Flush auth configs once established?
257 * Entry to maintain install configuration attributes during IKE_SA lifetime
259 struct attribute_entry_t
{
260 /** handler used to install this attribute */
261 attribute_handler_t
*handler
;
262 /** attribute type */
263 configuration_attribute_type_t type
;
264 /** attribute data */
269 * get the time of the latest traffic processed by the kernel
271 static time_t get_use_time(private_ike_sa_t
* this, bool inbound
)
273 enumerator_t
*enumerator
;
274 child_sa_t
*child_sa
;
275 time_t use_time
, current
;
279 use_time
= this->stats
[STAT_INBOUND
];
283 use_time
= this->stats
[STAT_OUTBOUND
];
285 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
286 while (enumerator
->enumerate(enumerator
, &child_sa
))
288 child_sa
->get_usestats(child_sa
, inbound
, ¤t
, NULL
);
289 use_time
= max(use_time
, current
);
291 enumerator
->destroy(enumerator
);
296 METHOD(ike_sa_t
, get_unique_id
, u_int32_t
,
297 private_ike_sa_t
*this)
299 return this->unique_id
;
302 METHOD(ike_sa_t
, get_name
, char*,
303 private_ike_sa_t
*this)
307 return this->peer_cfg
->get_name(this->peer_cfg
);
312 METHOD(ike_sa_t
, get_statistic
, u_int32_t
,
313 private_ike_sa_t
*this, statistic_t kind
)
317 return this->stats
[kind
];
322 METHOD(ike_sa_t
, set_statistic
, void,
323 private_ike_sa_t
*this, statistic_t kind
, u_int32_t value
)
327 this->stats
[kind
] = value
;
331 METHOD(ike_sa_t
, get_my_host
, host_t
*,
332 private_ike_sa_t
*this)
334 return this->my_host
;
337 METHOD(ike_sa_t
, set_my_host
, void,
338 private_ike_sa_t
*this, host_t
*me
)
340 DESTROY_IF(this->my_host
);
344 METHOD(ike_sa_t
, get_other_host
, host_t
*,
345 private_ike_sa_t
*this)
347 return this->other_host
;
350 METHOD(ike_sa_t
, set_other_host
, void,
351 private_ike_sa_t
*this, host_t
*other
)
353 DESTROY_IF(this->other_host
);
354 this->other_host
= other
;
357 METHOD(ike_sa_t
, get_peer_cfg
, peer_cfg_t
*,
358 private_ike_sa_t
*this)
360 return this->peer_cfg
;
363 METHOD(ike_sa_t
, set_peer_cfg
, void,
364 private_ike_sa_t
*this, peer_cfg_t
*peer_cfg
)
366 peer_cfg
->get_ref(peer_cfg
);
367 DESTROY_IF(this->peer_cfg
);
368 this->peer_cfg
= peer_cfg
;
370 if (this->ike_cfg
== NULL
)
372 this->ike_cfg
= peer_cfg
->get_ike_cfg(peer_cfg
);
373 this->ike_cfg
->get_ref(this->ike_cfg
);
377 METHOD(ike_sa_t
, get_auth_cfg
, auth_cfg_t
*,
378 private_ike_sa_t
*this, bool local
)
382 return this->my_auth
;
384 return this->other_auth
;
387 METHOD(ike_sa_t
, add_auth_cfg
, void,
388 private_ike_sa_t
*this, bool local
, auth_cfg_t
*cfg
)
392 this->my_auths
->insert_last(this->my_auths
, cfg
);
396 this->other_auths
->insert_last(this->other_auths
, cfg
);
400 METHOD(ike_sa_t
, create_auth_cfg_enumerator
, enumerator_t
*,
401 private_ike_sa_t
*this, bool local
)
405 return this->my_auths
->create_enumerator(this->my_auths
);
407 return this->other_auths
->create_enumerator(this->other_auths
);
411 * Flush the stored authentication round information
413 static void flush_auth_cfgs(private_ike_sa_t
*this)
417 this->my_auth
->purge(this->my_auth
, FALSE
);
418 this->other_auth
->purge(this->other_auth
, FALSE
);
420 while (this->my_auths
->remove_last(this->my_auths
,
421 (void**)&cfg
) == SUCCESS
)
425 while (this->other_auths
->remove_last(this->other_auths
,
426 (void**)&cfg
) == SUCCESS
)
432 METHOD(ike_sa_t
, get_proposal
, proposal_t
*,
433 private_ike_sa_t
*this)
435 return this->proposal
;
438 METHOD(ike_sa_t
, set_proposal
, void,
439 private_ike_sa_t
*this, proposal_t
*proposal
)
441 DESTROY_IF(this->proposal
);
442 this->proposal
= proposal
->clone(proposal
);
445 METHOD(ike_sa_t
, set_message_id
, void,
446 private_ike_sa_t
*this, bool initiate
, u_int32_t mid
)
450 this->task_manager
->reset(this->task_manager
, mid
, UINT_MAX
);
454 this->task_manager
->reset(this->task_manager
, UINT_MAX
, mid
);
458 METHOD(ike_sa_t
, send_keepalive
, void,
459 private_ike_sa_t
*this)
461 send_keepalive_job_t
*job
;
462 time_t last_out
, now
, diff
;
464 if (!(this->conditions
& COND_NAT_HERE
) || this->keepalive_interval
== 0)
465 { /* disable keep alives if we are not NATed anymore */
469 last_out
= get_use_time(this, FALSE
);
470 now
= time_monotonic(NULL
);
472 diff
= now
- last_out
;
474 if (diff
>= this->keepalive_interval
)
479 packet
= packet_create();
480 packet
->set_source(packet
, this->my_host
->clone(this->my_host
));
481 packet
->set_destination(packet
, this->other_host
->clone(this->other_host
));
482 data
.ptr
= malloc(1);
485 packet
->set_data(packet
, data
);
486 DBG1(DBG_IKE
, "sending keep alive to %#H", this->other_host
);
487 charon
->sender
->send_no_marker(charon
->sender
, packet
);
490 job
= send_keepalive_job_create(this->ike_sa_id
);
491 lib
->scheduler
->schedule_job(lib
->scheduler
, (job_t
*)job
,
492 this->keepalive_interval
- diff
);
495 METHOD(ike_sa_t
, get_ike_cfg
, ike_cfg_t
*,
496 private_ike_sa_t
*this)
498 return this->ike_cfg
;
501 METHOD(ike_sa_t
, set_ike_cfg
, void,
502 private_ike_sa_t
*this, ike_cfg_t
*ike_cfg
)
504 ike_cfg
->get_ref(ike_cfg
);
505 this->ike_cfg
= ike_cfg
;
508 METHOD(ike_sa_t
, enable_extension
, void,
509 private_ike_sa_t
*this, ike_extension_t extension
)
511 this->extensions
|= extension
;
514 METHOD(ike_sa_t
, supports_extension
, bool,
515 private_ike_sa_t
*this, ike_extension_t extension
)
517 return (this->extensions
& extension
) != FALSE
;
520 METHOD(ike_sa_t
, has_condition
, bool,
521 private_ike_sa_t
*this, ike_condition_t condition
)
523 return (this->conditions
& condition
) != FALSE
;
526 METHOD(ike_sa_t
, set_condition
, void,
527 private_ike_sa_t
*this, ike_condition_t condition
, bool enable
)
529 if (has_condition(this, condition
) != enable
)
533 this->conditions
|= condition
;
537 DBG1(DBG_IKE
, "local host is behind NAT, sending keep alives");
538 this->conditions
|= COND_NAT_ANY
;
539 send_keepalive(this);
542 DBG1(DBG_IKE
, "remote host is behind NAT");
543 this->conditions
|= COND_NAT_ANY
;
546 DBG1(DBG_IKE
, "faking NAT situation to enforce UDP encapsulation");
547 this->conditions
|= COND_NAT_ANY
;
555 this->conditions
&= ~condition
;
561 set_condition(this, COND_NAT_ANY
,
562 has_condition(this, COND_NAT_HERE
) ||
563 has_condition(this, COND_NAT_THERE
) ||
564 has_condition(this, COND_NAT_FAKE
));
573 METHOD(ike_sa_t
, send_dpd
, status_t
,
574 private_ike_sa_t
*this)
579 if (this->state
== IKE_PASSIVE
)
581 return INVALID_STATE
;
583 delay
= this->peer_cfg
->get_dpd(this->peer_cfg
);
584 if (this->task_manager
->busy(this->task_manager
))
586 /* an exchange is in the air, no need to start a DPD check */
591 /* check if there was any inbound traffic */
593 last_in
= get_use_time(this, TRUE
);
594 now
= time_monotonic(NULL
);
595 diff
= now
- last_in
;
596 if (!delay
|| diff
>= delay
)
598 /* to long ago, initiate dead peer detection */
599 DBG1(DBG_IKE
, "sending DPD request");
600 this->task_manager
->queue_dpd(this->task_manager
);
604 /* recheck in "interval" seconds */
607 job
= (job_t
*)send_dpd_job_create(this->ike_sa_id
);
608 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, delay
- diff
);
610 return this->task_manager
->initiate(this->task_manager
);
613 METHOD(ike_sa_t
, get_state
, ike_sa_state_t
,
614 private_ike_sa_t
*this)
619 METHOD(ike_sa_t
, set_state
, void,
620 private_ike_sa_t
*this, ike_sa_state_t state
)
622 bool trigger_dpd
= FALSE
;
624 DBG2(DBG_IKE
, "IKE_SA %s[%d] state change: %N => %N",
625 get_name(this), this->unique_id
,
626 ike_sa_state_names
, this->state
,
627 ike_sa_state_names
, state
);
631 case IKE_ESTABLISHED
:
633 if (this->state
== IKE_CONNECTING
||
634 this->state
== IKE_PASSIVE
)
639 /* calculate rekey, reauth and lifetime */
640 this->stats
[STAT_ESTABLISHED
] = time_monotonic(NULL
);
642 /* schedule rekeying if we have a time which is smaller than
643 * an already scheduled rekeying */
644 t
= this->peer_cfg
->get_rekey_time(this->peer_cfg
, TRUE
);
645 if (t
&& (this->stats
[STAT_REKEY
] == 0 ||
646 (this->stats
[STAT_REKEY
] > t
+ this->stats
[STAT_ESTABLISHED
])))
648 this->stats
[STAT_REKEY
] = t
+ this->stats
[STAT_ESTABLISHED
];
649 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, FALSE
);
650 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
651 DBG1(DBG_IKE
, "scheduling rekeying in %ds", t
);
653 t
= this->peer_cfg
->get_reauth_time(this->peer_cfg
, TRUE
);
654 if (t
&& (this->stats
[STAT_REAUTH
] == 0 ||
655 (this->stats
[STAT_REAUTH
] > t
+ this->stats
[STAT_ESTABLISHED
])))
657 this->stats
[STAT_REAUTH
] = t
+ this->stats
[STAT_ESTABLISHED
];
658 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
);
659 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
660 DBG1(DBG_IKE
, "scheduling reauthentication in %ds", t
);
662 t
= this->peer_cfg
->get_over_time(this->peer_cfg
);
663 if (this->stats
[STAT_REKEY
] || this->stats
[STAT_REAUTH
])
665 if (this->stats
[STAT_REAUTH
] == 0)
667 this->stats
[STAT_DELETE
] = this->stats
[STAT_REKEY
];
669 else if (this->stats
[STAT_REKEY
] == 0)
671 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
];
675 this->stats
[STAT_DELETE
] = min(this->stats
[STAT_REKEY
],
676 this->stats
[STAT_REAUTH
]);
678 this->stats
[STAT_DELETE
] += t
;
679 t
= this->stats
[STAT_DELETE
] - this->stats
[STAT_ESTABLISHED
];
680 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
681 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
682 DBG1(DBG_IKE
, "maximum IKE_SA lifetime %ds", t
);
684 trigger_dpd
= this->peer_cfg
->get_dpd(this->peer_cfg
);
691 charon
->bus
->ike_state_change(charon
->bus
, &this->public, state
);
696 if (supports_extension(this, EXT_DPD
))
702 DBG1(DBG_IKE
, "DPD not supported by peer, disabled");
707 METHOD(ike_sa_t
, reset
, void,
708 private_ike_sa_t
*this)
710 /* the responder ID is reset, as peer may choose another one */
711 if (this->ike_sa_id
->is_initiator(this->ike_sa_id
))
713 this->ike_sa_id
->set_responder_spi(this->ike_sa_id
, 0);
716 set_state(this, IKE_CREATED
);
718 flush_auth_cfgs(this);
720 this->keymat
->destroy(this->keymat
);
721 this->keymat
= keymat_create(this->version
,
722 this->ike_sa_id
->is_initiator(this->ike_sa_id
));
724 this->task_manager
->reset(this->task_manager
, 0, 0);
727 METHOD(ike_sa_t
, get_keymat
, keymat_t
*,
728 private_ike_sa_t
*this)
733 METHOD(ike_sa_t
, add_virtual_ip
, void,
734 private_ike_sa_t
*this, bool local
, host_t
*ip
)
738 DBG1(DBG_IKE
, "installing new virtual IP %H", ip
);
739 if (hydra
->kernel_interface
->add_ip(hydra
->kernel_interface
, ip
,
740 this->my_host
) == SUCCESS
)
742 this->my_vips
->insert_last(this->my_vips
, ip
->clone(ip
));
746 DBG1(DBG_IKE
, "installing virtual IP %H failed", ip
);
751 this->other_vips
->insert_last(this->other_vips
, ip
->clone(ip
));
756 METHOD(ike_sa_t
, clear_virtual_ips
, void,
757 private_ike_sa_t
*this, bool local
)
759 linked_list_t
*vips
= local ?
this->my_vips
: this->other_vips
;
762 while (vips
->remove_first(vips
, (void**)&vip
) == SUCCESS
)
766 hydra
->kernel_interface
->del_ip(hydra
->kernel_interface
, vip
);
772 METHOD(ike_sa_t
, create_virtual_ip_enumerator
, enumerator_t
*,
773 private_ike_sa_t
*this, bool local
)
777 return this->my_vips
->create_enumerator(this->my_vips
);
779 return this->other_vips
->create_enumerator(this->other_vips
);
782 METHOD(ike_sa_t
, add_peer_address
, void,
783 private_ike_sa_t
*this, host_t
*host
)
785 this->peer_addresses
->insert_last(this->peer_addresses
, host
);
788 METHOD(ike_sa_t
, create_peer_address_enumerator
, enumerator_t
*,
789 private_ike_sa_t
*this)
791 if (this->peer_addresses
->get_count(this->peer_addresses
))
793 return this->peer_addresses
->create_enumerator(this->peer_addresses
);
795 /* in case we don't have MOBIKE */
796 return enumerator_create_single(this->other_host
, NULL
);
799 METHOD(ike_sa_t
, clear_peer_addresses
, void,
800 private_ike_sa_t
*this)
802 enumerator_t
*enumerator
;
805 enumerator
= this->peer_addresses
->create_enumerator(this->peer_addresses
);
806 while (enumerator
->enumerate(enumerator
, (void**)&host
))
808 this->peer_addresses
->remove_at(this->peer_addresses
,
812 enumerator
->destroy(enumerator
);
815 METHOD(ike_sa_t
, has_mapping_changed
, bool,
816 private_ike_sa_t
*this, chunk_t hash
)
818 if (this->nat_detection_dest
.ptr
== NULL
)
820 this->nat_detection_dest
= chunk_clone(hash
);
823 if (chunk_equals(hash
, this->nat_detection_dest
))
827 free(this->nat_detection_dest
.ptr
);
828 this->nat_detection_dest
= chunk_clone(hash
);
832 METHOD(ike_sa_t
, set_pending_updates
, void,
833 private_ike_sa_t
*this, u_int32_t updates
)
835 this->pending_updates
= updates
;
838 METHOD(ike_sa_t
, get_pending_updates
, u_int32_t
,
839 private_ike_sa_t
*this)
841 return this->pending_updates
;
844 METHOD(ike_sa_t
, float_ports
, void,
845 private_ike_sa_t
*this)
847 /* do not switch if we have a custom port from MOBIKE/NAT */
848 if (this->my_host
->get_port(this->my_host
) ==
849 charon
->socket
->get_port(charon
->socket
, FALSE
))
851 this->my_host
->set_port(this->my_host
,
852 charon
->socket
->get_port(charon
->socket
, TRUE
));
854 if (this->other_host
->get_port(this->other_host
) == IKEV2_UDP_PORT
)
856 this->other_host
->set_port(this->other_host
, IKEV2_NATT_PORT
);
860 METHOD(ike_sa_t
, update_hosts
, void,
861 private_ike_sa_t
*this, host_t
*me
, host_t
*other
, bool force
)
871 other
= this->other_host
;
874 /* apply hosts on first received message */
875 if (this->my_host
->is_anyaddr(this->my_host
) ||
876 this->other_host
->is_anyaddr(this->other_host
))
878 set_my_host(this, me
->clone(me
));
879 set_other_host(this, other
->clone(other
));
884 /* update our address in any case */
885 if (!me
->equals(me
, this->my_host
))
887 set_my_host(this, me
->clone(me
));
891 if (!other
->equals(other
, this->other_host
))
893 /* update others address if we are NOT NATed */
894 if (force
|| !has_condition(this, COND_NAT_HERE
))
896 set_other_host(this, other
->clone(other
));
902 /* update all associated CHILD_SAs, if required */
905 enumerator_t
*enumerator
;
906 child_sa_t
*child_sa
;
908 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
909 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
911 if (child_sa
->update(child_sa
, this->my_host
,
912 this->other_host
, this->my_vips
,
913 has_condition(this, COND_NAT_ANY
)) == NOT_SUPPORTED
)
915 this->public.rekey_child_sa(&this->public,
916 child_sa
->get_protocol(child_sa
),
917 child_sa
->get_spi(child_sa
, TRUE
));
920 enumerator
->destroy(enumerator
);
924 METHOD(ike_sa_t
, generate_message
, status_t
,
925 private_ike_sa_t
*this, message_t
*message
, packet_t
**packet
)
929 if (message
->is_encoded(message
))
931 *packet
= message
->get_packet(message
);
934 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
935 message
->set_ike_sa_id(message
, this->ike_sa_id
);
936 charon
->bus
->message(charon
->bus
, message
, FALSE
, TRUE
);
937 status
= message
->generate(message
, this->keymat
, packet
);
938 if (status
== SUCCESS
)
940 charon
->bus
->message(charon
->bus
, message
, FALSE
, FALSE
);
945 METHOD(ike_sa_t
, set_kmaddress
, void,
946 private_ike_sa_t
*this, host_t
*local
, host_t
*remote
)
948 DESTROY_IF(this->local_host
);
949 DESTROY_IF(this->remote_host
);
950 this->local_host
= local
->clone(local
);
951 this->remote_host
= remote
->clone(remote
);
955 METHOD(ike_sa_t
, act_as_mediation_server
, void,
956 private_ike_sa_t
*this)
958 charon
->mediation_manager
->update_sa_id(charon
->mediation_manager
,
959 this->other_id
, this->ike_sa_id
);
960 this->is_mediation_server
= TRUE
;
963 METHOD(ike_sa_t
, get_server_reflexive_host
, host_t
*,
964 private_ike_sa_t
*this)
966 return this->server_reflexive_host
;
969 METHOD(ike_sa_t
, set_server_reflexive_host
, void,
970 private_ike_sa_t
*this, host_t
*host
)
972 DESTROY_IF(this->server_reflexive_host
);
973 this->server_reflexive_host
= host
;
976 METHOD(ike_sa_t
, get_connect_id
, chunk_t
,
977 private_ike_sa_t
*this)
979 return this->connect_id
;
982 METHOD(ike_sa_t
, respond
, status_t
,
983 private_ike_sa_t
*this, identification_t
*peer_id
, chunk_t connect_id
)
985 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
986 task
->respond(task
, peer_id
, connect_id
);
987 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
988 return this->task_manager
->initiate(this->task_manager
);
991 METHOD(ike_sa_t
, callback
, status_t
,
992 private_ike_sa_t
*this, identification_t
*peer_id
)
994 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
995 task
->callback(task
, peer_id
);
996 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
997 return this->task_manager
->initiate(this->task_manager
);
1000 METHOD(ike_sa_t
, relay
, status_t
,
1001 private_ike_sa_t
*this, identification_t
*requester
, chunk_t connect_id
,
1002 chunk_t connect_key
, linked_list_t
*endpoints
, bool response
)
1004 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1005 task
->relay(task
, requester
, connect_id
, connect_key
, endpoints
, response
);
1006 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1007 return this->task_manager
->initiate(this->task_manager
);
1010 METHOD(ike_sa_t
, initiate_mediation
, status_t
,
1011 private_ike_sa_t
*this, peer_cfg_t
*mediated_cfg
)
1013 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1014 task
->connect(task
, mediated_cfg
->get_peer_id(mediated_cfg
));
1015 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1016 return this->task_manager
->initiate(this->task_manager
);
1019 METHOD(ike_sa_t
, initiate_mediated
, status_t
,
1020 private_ike_sa_t
*this, host_t
*me
, host_t
*other
, chunk_t connect_id
)
1022 set_my_host(this, me
->clone(me
));
1023 set_other_host(this, other
->clone(other
));
1024 chunk_free(&this->connect_id
);
1025 this->connect_id
= chunk_clone(connect_id
);
1026 return this->task_manager
->initiate(this->task_manager
);
1031 * Resolve DNS host in configuration
1033 static void resolve_hosts(private_ike_sa_t
*this)
1037 if (this->remote_host
)
1039 host
= this->remote_host
->clone(this->remote_host
);
1040 host
->set_port(host
, IKEV2_UDP_PORT
);
1045 u_int16_t other_port
;
1047 other_addr
= this->ike_cfg
->get_other_addr(this->ike_cfg
, NULL
);
1048 other_port
= this->ike_cfg
->get_other_port(this->ike_cfg
);
1049 host
= host_create_from_dns(other_addr
, 0, other_port
);
1053 set_other_host(this, host
);
1056 if (this->local_host
)
1058 host
= this->local_host
->clone(this->local_host
);
1059 host
->set_port(host
, charon
->socket
->get_port(charon
->socket
, FALSE
));
1067 /* use same address family as for other */
1068 if (!this->other_host
->is_anyaddr(this->other_host
))
1070 family
= this->other_host
->get_family(this->other_host
);
1072 my_addr
= this->ike_cfg
->get_my_addr(this->ike_cfg
, NULL
);
1073 my_port
= this->ike_cfg
->get_my_port(this->ike_cfg
);
1074 host
= host_create_from_dns(my_addr
, family
, my_port
);
1076 if (host
&& host
->is_anyaddr(host
) &&
1077 !this->other_host
->is_anyaddr(this->other_host
))
1079 host
->destroy(host
);
1080 host
= hydra
->kernel_interface
->get_source_addr(
1081 hydra
->kernel_interface
, this->other_host
, NULL
);
1084 host
->set_port(host
, this->ike_cfg
->get_my_port(this->ike_cfg
));
1087 { /* fallback to address family specific %any(6), if configured */
1088 host
= host_create_from_dns(my_addr
, 0, my_port
);
1094 set_my_host(this, host
);
1098 METHOD(ike_sa_t
, initiate
, status_t
,
1099 private_ike_sa_t
*this, child_cfg_t
*child_cfg
, u_int32_t reqid
,
1100 traffic_selector_t
*tsi
, traffic_selector_t
*tsr
)
1102 bool defer_initiate
= FALSE
;
1104 if (this->state
== IKE_CREATED
)
1106 if (this->my_host
->is_anyaddr(this->my_host
) ||
1107 this->other_host
->is_anyaddr(this->other_host
))
1109 resolve_hosts(this);
1112 if (this->other_host
->is_anyaddr(this->other_host
)
1114 && !this->peer_cfg
->get_mediated_by(this->peer_cfg
)
1118 char *addr
= this->ike_cfg
->get_other_addr(this->ike_cfg
, NULL
);
1119 bool is_anyaddr
= streq(addr
, "%any") || streq(addr
, "%any6");
1121 if (is_anyaddr
|| !this->retry_initiate_interval
)
1125 DBG1(DBG_IKE
, "unable to initiate to %s", addr
);
1129 DBG1(DBG_IKE
, "unable to resolve %s, initiate aborted",
1132 DESTROY_IF(child_cfg
);
1133 charon
->bus
->alert(charon
->bus
, ALERT_PEER_ADDR_FAILED
);
1136 DBG1(DBG_IKE
, "unable to resolve %s, retrying in %ds",
1137 addr
, this->retry_initiate_interval
);
1138 defer_initiate
= TRUE
;
1141 set_condition(this, COND_ORIGINAL_INITIATOR
, TRUE
);
1142 this->task_manager
->queue_ike(this->task_manager
);
1146 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1148 if (this->state
== IKE_ESTABLISHED
)
1150 /* mediation connection is already established, retrigger state
1151 * change to notify bus listeners */
1152 DBG1(DBG_IKE
, "mediation connection is already up");
1153 set_state(this, IKE_ESTABLISHED
);
1155 DESTROY_IF(child_cfg
);
1161 /* normal IKE_SA with CHILD_SA */
1162 this->task_manager
->queue_child(this->task_manager
, child_cfg
, reqid
,
1165 if (this->peer_cfg
->get_mediated_by(this->peer_cfg
))
1167 /* mediated connection, initiate mediation process */
1168 job_t
*job
= (job_t
*)initiate_mediation_job_create(this->ike_sa_id
);
1169 lib
->processor
->queue_job(lib
->processor
, job
);
1177 if (!this->retry_initiate_queued
)
1179 job_t
*job
= (job_t
*)retry_initiate_job_create(this->ike_sa_id
);
1180 lib
->scheduler
->schedule_job(lib
->scheduler
, (job_t
*)job
,
1181 this->retry_initiate_interval
);
1182 this->retry_initiate_queued
= TRUE
;
1186 this->retry_initiate_queued
= FALSE
;
1187 return this->task_manager
->initiate(this->task_manager
);
1190 METHOD(ike_sa_t
, retry_initiate
, status_t
,
1191 private_ike_sa_t
*this)
1193 if (this->retry_initiate_queued
)
1195 this->retry_initiate_queued
= FALSE
;
1196 return initiate(this, NULL
, 0, NULL
, NULL
);
1201 METHOD(ike_sa_t
, process_message
, status_t
,
1202 private_ike_sa_t
*this, message_t
*message
)
1206 if (this->state
== IKE_PASSIVE
)
1207 { /* do not handle messages in passive state */
1210 switch (message
->get_exchange_type(message
))
1216 if (this->state
!= IKE_CREATED
&&
1217 this->state
!= IKE_CONNECTING
)
1219 DBG1(DBG_IKE
, "ignoring %N in established IKE_SA state",
1220 exchange_type_names
, message
->get_exchange_type(message
));
1227 if (message
->get_major_version(message
) != this->version
)
1229 DBG1(DBG_IKE
, "ignoring %N IKEv%u exchange on %N SA",
1230 exchange_type_names
, message
->get_exchange_type(message
),
1231 message
->get_major_version(message
),
1232 ike_version_names
, this->version
);
1233 /* TODO-IKEv1: fall back to IKEv1 if we receive an IKEv1
1234 * INVALID_MAJOR_VERSION on an IKEv2 SA. */
1237 status
= this->task_manager
->process_message(this->task_manager
, message
);
1238 if (this->flush_auth_cfg
&& this->state
== IKE_ESTABLISHED
)
1240 /* authentication completed */
1241 this->flush_auth_cfg
= FALSE
;
1242 flush_auth_cfgs(this);
1247 METHOD(ike_sa_t
, get_id
, ike_sa_id_t
*,
1248 private_ike_sa_t
*this)
1250 return this->ike_sa_id
;
1253 METHOD(ike_sa_t
, get_version
, ike_version_t
,
1254 private_ike_sa_t
*this)
1256 return this->version
;
1259 METHOD(ike_sa_t
, get_my_id
, identification_t
*,
1260 private_ike_sa_t
*this)
1265 METHOD(ike_sa_t
, set_my_id
, void,
1266 private_ike_sa_t
*this, identification_t
*me
)
1268 DESTROY_IF(this->my_id
);
1272 METHOD(ike_sa_t
, get_other_id
, identification_t
*,
1273 private_ike_sa_t
*this)
1275 return this->other_id
;
1278 METHOD(ike_sa_t
, get_other_eap_id
, identification_t
*,
1279 private_ike_sa_t
*this)
1281 identification_t
*id
= NULL
, *current
;
1282 enumerator_t
*enumerator
;
1285 enumerator
= this->other_auths
->create_enumerator(this->other_auths
);
1286 while (enumerator
->enumerate(enumerator
, &cfg
))
1288 /* prefer EAP-Identity of last round */
1289 current
= cfg
->get(cfg
, AUTH_RULE_EAP_IDENTITY
);
1290 if (!current
|| current
->get_type(current
) == ID_ANY
)
1292 current
= cfg
->get(cfg
, AUTH_RULE_XAUTH_IDENTITY
);
1294 if (!current
|| current
->get_type(current
) == ID_ANY
)
1296 current
= cfg
->get(cfg
, AUTH_RULE_IDENTITY
);
1298 if (current
&& current
->get_type(current
) != ID_ANY
)
1304 enumerator
->destroy(enumerator
);
1309 return this->other_id
;
1312 METHOD(ike_sa_t
, set_other_id
, void,
1313 private_ike_sa_t
*this, identification_t
*other
)
1315 DESTROY_IF(this->other_id
);
1316 this->other_id
= other
;
1319 METHOD(ike_sa_t
, add_child_sa
, void,
1320 private_ike_sa_t
*this, child_sa_t
*child_sa
)
1322 this->child_sas
->insert_last(this->child_sas
, child_sa
);
1325 METHOD(ike_sa_t
, get_child_sa
, child_sa_t
*,
1326 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
, bool inbound
)
1328 enumerator_t
*enumerator
;
1329 child_sa_t
*current
, *found
= NULL
;
1331 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
1332 while (enumerator
->enumerate(enumerator
, (void**)¤t
))
1334 if (current
->get_spi(current
, inbound
) == spi
&&
1335 current
->get_protocol(current
) == protocol
)
1340 enumerator
->destroy(enumerator
);
1344 METHOD(ike_sa_t
, get_child_count
, int,
1345 private_ike_sa_t
*this)
1347 return this->child_sas
->get_count(this->child_sas
);
1350 METHOD(ike_sa_t
, create_child_sa_enumerator
, enumerator_t
*,
1351 private_ike_sa_t
*this)
1353 return this->child_sas
->create_enumerator(this->child_sas
);
1356 METHOD(ike_sa_t
, remove_child_sa
, void,
1357 private_ike_sa_t
*this, enumerator_t
*enumerator
)
1359 this->child_sas
->remove_at(this->child_sas
, enumerator
);
1362 METHOD(ike_sa_t
, rekey_child_sa
, status_t
,
1363 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1365 if (this->state
== IKE_PASSIVE
)
1367 return INVALID_STATE
;
1369 this->task_manager
->queue_child_rekey(this->task_manager
, protocol
, spi
);
1370 return this->task_manager
->initiate(this->task_manager
);
1373 METHOD(ike_sa_t
, delete_child_sa
, status_t
,
1374 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
, bool expired
)
1376 if (this->state
== IKE_PASSIVE
)
1378 return INVALID_STATE
;
1380 this->task_manager
->queue_child_delete(this->task_manager
,
1381 protocol
, spi
, expired
);
1382 return this->task_manager
->initiate(this->task_manager
);
1385 METHOD(ike_sa_t
, destroy_child_sa
, status_t
,
1386 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1388 enumerator_t
*enumerator
;
1389 child_sa_t
*child_sa
;
1390 status_t status
= NOT_FOUND
;
1392 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
1393 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1395 if (child_sa
->get_protocol(child_sa
) == protocol
&&
1396 child_sa
->get_spi(child_sa
, TRUE
) == spi
)
1398 this->child_sas
->remove_at(this->child_sas
, enumerator
);
1399 child_sa
->destroy(child_sa
);
1404 enumerator
->destroy(enumerator
);
1408 METHOD(ike_sa_t
, delete_
, status_t
,
1409 private_ike_sa_t
*this)
1411 switch (this->state
)
1414 if (this->version
== IKEV1
)
1415 { /* SA has been reauthenticated, delete */
1416 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
1420 case IKE_ESTABLISHED
:
1421 this->task_manager
->queue_ike_delete(this->task_manager
);
1422 return this->task_manager
->initiate(this->task_manager
);
1424 DBG1(DBG_IKE
, "deleting unestablished IKE_SA");
1429 DBG1(DBG_IKE
, "destroying IKE_SA in state %N "
1430 "without notification", ike_sa_state_names
, this->state
);
1431 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
1437 METHOD(ike_sa_t
, rekey
, status_t
,
1438 private_ike_sa_t
*this)
1440 if (this->state
== IKE_PASSIVE
)
1442 return INVALID_STATE
;
1444 this->task_manager
->queue_ike_rekey(this->task_manager
);
1445 return this->task_manager
->initiate(this->task_manager
);
1448 METHOD(ike_sa_t
, reauth
, status_t
,
1449 private_ike_sa_t
*this)
1451 if (this->state
== IKE_PASSIVE
)
1453 return INVALID_STATE
;
1455 /* we can't reauthenticate as responder when we use EAP or virtual IPs.
1456 * If the peer does not support RFC4478, there is no way to keep the
1458 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
1460 DBG1(DBG_IKE
, "initiator did not reauthenticate as requested");
1461 if (this->other_vips
->get_count(this->other_vips
) != 0 ||
1462 has_condition(this, COND_XAUTH_AUTHENTICATED
) ||
1463 has_condition(this, COND_EAP_AUTHENTICATED
)
1465 /* as mediation server we too cannot reauth the IKE_SA */
1466 || this->is_mediation_server
1472 del
= this->stats
[STAT_DELETE
];
1473 now
= time_monotonic(NULL
);
1474 DBG1(DBG_IKE
, "IKE_SA %s[%d] will timeout in %V",
1475 get_name(this), this->unique_id
, &now
, &del
);
1480 DBG0(DBG_IKE
, "reauthenticating IKE_SA %s[%d] actively",
1481 get_name(this), this->unique_id
);
1486 DBG0(DBG_IKE
, "reauthenticating IKE_SA %s[%d]",
1487 get_name(this), this->unique_id
);
1489 set_condition(this, COND_REAUTHENTICATING
, TRUE
);
1490 this->task_manager
->queue_ike_reauth(this->task_manager
);
1491 return this->task_manager
->initiate(this->task_manager
);
1494 METHOD(ike_sa_t
, reestablish
, status_t
,
1495 private_ike_sa_t
*this)
1500 enumerator_t
*enumerator
;
1501 child_sa_t
*child_sa
;
1502 child_cfg_t
*child_cfg
;
1503 bool restart
= FALSE
;
1504 status_t status
= FAILED
;
1506 if (has_condition(this, COND_REAUTHENTICATING
))
1507 { /* only reauthenticate if we have children */
1508 if (this->child_sas
->get_count(this->child_sas
) == 0
1510 /* allow reauth of mediation connections without CHILD_SAs */
1511 && !this->peer_cfg
->is_mediation(this->peer_cfg
)
1515 DBG1(DBG_IKE
, "unable to reauthenticate IKE_SA, no CHILD_SA "
1524 { /* check if we have children to keep up at all */
1525 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
1526 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1528 if (this->state
== IKE_DELETING
)
1530 action
= child_sa
->get_close_action(child_sa
);
1534 action
= child_sa
->get_dpd_action(child_sa
);
1538 case ACTION_RESTART
:
1542 charon
->traps
->install(charon
->traps
, this->peer_cfg
,
1543 child_sa
->get_config(child_sa
));
1549 enumerator
->destroy(enumerator
);
1551 /* mediation connections have no children, keep them up anyway */
1552 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1563 /* check if we are able to reestablish this IKE_SA */
1564 if (!has_condition(this, COND_ORIGINAL_INITIATOR
) &&
1565 (this->other_vips
->get_count(this->other_vips
) != 0 ||
1566 has_condition(this, COND_EAP_AUTHENTICATED
)
1568 || this->is_mediation_server
1572 DBG1(DBG_IKE
, "unable to reestablish IKE_SA due to asymmetric setup");
1576 new = charon
->ike_sa_manager
->checkout_new(charon
->ike_sa_manager
,
1577 this->version
, TRUE
);
1582 new->set_peer_cfg(new, this->peer_cfg
);
1583 host
= this->other_host
;
1584 new->set_other_host(new, host
->clone(host
));
1585 host
= this->my_host
;
1586 new->set_my_host(new, host
->clone(host
));
1587 /* if we already have a virtual IP, we reuse it */
1588 enumerator
= this->my_vips
->create_enumerator(this->my_vips
);
1589 while (enumerator
->enumerate(enumerator
, &host
))
1591 new->add_virtual_ip(new, TRUE
, host
);
1593 enumerator
->destroy(enumerator
);
1596 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1598 status
= new->initiate(new, NULL
, 0, NULL
, NULL
);
1603 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
1604 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1606 if (has_condition(this, COND_REAUTHENTICATING
))
1608 switch (child_sa
->get_state(child_sa
))
1611 { /* move routed child directly */
1612 this->child_sas
->remove_at(this->child_sas
, enumerator
);
1613 new->add_child_sa(new, child_sa
);
1614 action
= ACTION_NONE
;
1618 { /* initiate/queue all other CHILD_SAs */
1619 action
= ACTION_RESTART
;
1625 { /* only restart CHILD_SAs that are configured accordingly */
1626 if (this->state
== IKE_DELETING
)
1628 action
= child_sa
->get_close_action(child_sa
);
1632 action
= child_sa
->get_dpd_action(child_sa
);
1637 case ACTION_RESTART
:
1638 child_cfg
= child_sa
->get_config(child_sa
);
1639 DBG1(DBG_IKE
, "restarting CHILD_SA %s",
1640 child_cfg
->get_name(child_cfg
));
1641 child_cfg
->get_ref(child_cfg
);
1642 status
= new->initiate(new, child_cfg
, 0, NULL
, NULL
);
1647 if (status
== DESTROY_ME
)
1652 enumerator
->destroy(enumerator
);
1655 if (status
== DESTROY_ME
)
1657 charon
->ike_sa_manager
->checkin_and_destroy(charon
->ike_sa_manager
, new);
1662 charon
->bus
->ike_reestablish(charon
->bus
, &this->public, new);
1663 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, new);
1666 charon
->bus
->set_sa(charon
->bus
, &this->public);
1670 METHOD(ike_sa_t
, retransmit
, status_t
,
1671 private_ike_sa_t
*this, u_int32_t message_id
)
1673 if (this->state
== IKE_PASSIVE
)
1675 return INVALID_STATE
;
1677 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
1678 if (this->task_manager
->retransmit(this->task_manager
, message_id
) != SUCCESS
)
1680 /* send a proper signal to brief interested bus listeners */
1681 switch (this->state
)
1683 case IKE_CONNECTING
:
1685 /* retry IKE_SA_INIT/Main Mode if we have multiple keyingtries */
1686 u_int32_t tries
= this->peer_cfg
->get_keyingtries(this->peer_cfg
);
1688 if (tries
== 0 || tries
> this->keyingtry
)
1690 DBG1(DBG_IKE
, "peer not responding, trying again (%d/%d)",
1691 this->keyingtry
+ 1, tries
);
1693 resolve_hosts(this);
1694 this->task_manager
->queue_ike(this->task_manager
);
1695 return this->task_manager
->initiate(this->task_manager
);
1697 DBG1(DBG_IKE
, "establishing IKE_SA failed, peer not responding");
1701 DBG1(DBG_IKE
, "proper IKE_SA delete failed, peer not responding");
1702 if (has_condition(this, COND_REAUTHENTICATING
))
1704 DBG1(DBG_IKE
, "delete during reauthentication failed, "
1705 "trying to reestablish IKE_SA anyway");
1710 DBG1(DBG_IKE
, "rekeying IKE_SA failed, peer not responding");
1721 METHOD(ike_sa_t
, set_auth_lifetime
, status_t
,
1722 private_ike_sa_t
*this, u_int32_t lifetime
)
1724 u_int32_t diff
, hard
, soft
, now
;
1725 ike_auth_lifetime_t
*task
;
1728 diff
= this->peer_cfg
->get_over_time(this->peer_cfg
);
1729 now
= time_monotonic(NULL
);
1730 hard
= now
+ lifetime
;
1733 /* check if we have to send an AUTH_LIFETIME to enforce the new lifetime.
1734 * We send the notify in IKE_AUTH if not yet ESTABLISHED. */
1735 send_update
= this->state
== IKE_ESTABLISHED
&& this->version
== IKEV2
&&
1736 !has_condition(this, COND_ORIGINAL_INITIATOR
) &&
1737 (this->other_vips
->get_count(this->other_vips
) != 0 ||
1738 has_condition(this, COND_EAP_AUTHENTICATED
));
1740 if (lifetime
< diff
)
1742 this->stats
[STAT_REAUTH
] = now
;
1746 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, "
1747 "starting reauthentication", lifetime
);
1748 lib
->processor
->queue_job(lib
->processor
,
1749 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
));
1752 else if (this->stats
[STAT_REAUTH
] == 0 ||
1753 this->stats
[STAT_REAUTH
] > soft
)
1755 this->stats
[STAT_REAUTH
] = soft
;
1758 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, scheduling "
1759 "reauthentication in %ds", lifetime
, lifetime
- diff
);
1760 lib
->scheduler
->schedule_job(lib
->scheduler
,
1761 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
),
1767 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, "
1768 "reauthentication already scheduled in %ds", lifetime
,
1769 this->stats
[STAT_REAUTH
] - time_monotonic(NULL
));
1770 send_update
= FALSE
;
1772 /* give at least some seconds to reauthenticate */
1773 this->stats
[STAT_DELETE
] = max(hard
, now
+ 10);
1777 task
= ike_auth_lifetime_create(&this->public, TRUE
);
1778 this->task_manager
->queue_task(this->task_manager
, &task
->task
);
1779 return this->task_manager
->initiate(this->task_manager
);
1785 * Check if the current combination of source and destination address is still
1788 static bool is_current_path_valid(private_ike_sa_t
*this)
1792 src
= hydra
->kernel_interface
->get_source_addr(hydra
->kernel_interface
,
1793 this->other_host
, this->my_host
);
1796 if (src
->ip_equals(src
, this->my_host
))
1806 * Check if we have any path avialable for this IKE SA.
1808 static bool is_any_path_valid(private_ike_sa_t
*this)
1811 enumerator_t
*enumerator
;
1812 host_t
*src
= NULL
, *addr
;
1814 DBG1(DBG_IKE
, "old path is not available anymore, try to find another");
1815 enumerator
= create_peer_address_enumerator(this);
1816 while (enumerator
->enumerate(enumerator
, &addr
))
1818 DBG1(DBG_IKE
, "looking for a route to %H ...", addr
);
1819 src
= hydra
->kernel_interface
->get_source_addr(
1820 hydra
->kernel_interface
, addr
, NULL
);
1826 enumerator
->destroy(enumerator
);
1835 METHOD(ike_sa_t
, roam
, status_t
,
1836 private_ike_sa_t
*this, bool address
)
1838 switch (this->state
)
1842 case IKE_DESTROYING
:
1849 /* keep existing path if possible */
1850 if (is_current_path_valid(this))
1852 DBG2(DBG_IKE
, "keeping connection path %H - %H",
1853 this->my_host
, this->other_host
);
1854 set_condition(this, COND_STALE
, FALSE
);
1856 if (supports_extension(this, EXT_MOBIKE
) && address
)
1857 { /* if any addresses changed, send an updated list */
1858 DBG1(DBG_IKE
, "sending address list update using MOBIKE");
1859 this->task_manager
->queue_mobike(this->task_manager
, FALSE
, TRUE
);
1860 return this->task_manager
->initiate(this->task_manager
);
1865 if (!is_any_path_valid(this))
1867 DBG1(DBG_IKE
, "no route found to reach %H, MOBIKE update deferred",
1869 set_condition(this, COND_STALE
, TRUE
);
1872 set_condition(this, COND_STALE
, FALSE
);
1874 /* update addresses with mobike, if supported ... */
1875 if (supports_extension(this, EXT_MOBIKE
))
1877 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
1878 { /* responder updates the peer about changed address config */
1879 DBG1(DBG_IKE
, "sending address list update using MOBIKE, "
1880 "implicitly requesting an address change");
1885 DBG1(DBG_IKE
, "requesting address change using MOBIKE");
1887 this->task_manager
->queue_mobike(this->task_manager
, TRUE
, address
);
1888 return this->task_manager
->initiate(this->task_manager
);
1891 /* ... reauth if not */
1892 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
1893 { /* responder does not reauthenticate */
1894 set_condition(this, COND_STALE
, TRUE
);
1897 DBG1(DBG_IKE
, "reauthenticating IKE_SA due to address change");
1898 /* since our previous path is not valid anymore, try and find a new one */
1899 resolve_hosts(this);
1900 return reauth(this);
1903 METHOD(ike_sa_t
, add_configuration_attribute
, void,
1904 private_ike_sa_t
*this, attribute_handler_t
*handler
,
1905 configuration_attribute_type_t type
, chunk_t data
)
1907 attribute_entry_t
*entry
= malloc_thing(attribute_entry_t
);
1909 entry
->handler
= handler
;
1911 entry
->data
= chunk_clone(data
);
1913 this->attributes
->insert_last(this->attributes
, entry
);
1916 METHOD(ike_sa_t
, create_task_enumerator
, enumerator_t
*,
1917 private_ike_sa_t
*this, task_queue_t queue
)
1919 return this->task_manager
->create_task_enumerator(this->task_manager
, queue
);
1922 METHOD(ike_sa_t
, flush_queue
, void,
1923 private_ike_sa_t
*this, task_queue_t queue
)
1925 this->task_manager
->flush_queue(this->task_manager
, queue
);
1928 METHOD(ike_sa_t
, queue_task
, void,
1929 private_ike_sa_t
*this, task_t
*task
)
1931 this->task_manager
->queue_task(this->task_manager
, task
);
1934 METHOD(ike_sa_t
, inherit
, void,
1935 private_ike_sa_t
*this, ike_sa_t
*other_public
)
1937 private_ike_sa_t
*other
= (private_ike_sa_t
*)other_public
;
1938 child_sa_t
*child_sa
;
1939 attribute_entry_t
*entry
;
1940 enumerator_t
*enumerator
;
1944 /* apply hosts and ids */
1945 this->my_host
->destroy(this->my_host
);
1946 this->other_host
->destroy(this->other_host
);
1947 this->my_id
->destroy(this->my_id
);
1948 this->other_id
->destroy(this->other_id
);
1949 this->my_host
= other
->my_host
->clone(other
->my_host
);
1950 this->other_host
= other
->other_host
->clone(other
->other_host
);
1951 this->my_id
= other
->my_id
->clone(other
->my_id
);
1952 this->other_id
= other
->other_id
->clone(other
->other_id
);
1954 /* apply assigned virtual IPs... */
1955 while (this->my_vips
->remove_last(this->my_vips
, (void**)&vip
) == SUCCESS
)
1957 other
->my_vips
->insert_first(other
->my_vips
, vip
);
1959 while (this->other_vips
->remove_last(this->other_vips
,
1960 (void**)&vip
) == SUCCESS
)
1962 other
->other_vips
->insert_first(other
->other_vips
, vip
);
1965 /* authentication information */
1966 enumerator
= other
->my_auths
->create_enumerator(other
->my_auths
);
1967 while (enumerator
->enumerate(enumerator
, &cfg
))
1969 this->my_auths
->insert_last(this->my_auths
, cfg
->clone(cfg
));
1971 enumerator
->destroy(enumerator
);
1972 enumerator
= other
->other_auths
->create_enumerator(other
->other_auths
);
1973 while (enumerator
->enumerate(enumerator
, &cfg
))
1975 this->other_auths
->insert_last(this->other_auths
, cfg
->clone(cfg
));
1977 enumerator
->destroy(enumerator
);
1979 /* ... and configuration attributes */
1980 while (other
->attributes
->remove_last(other
->attributes
,
1981 (void**)&entry
) == SUCCESS
)
1983 this->attributes
->insert_first(this->attributes
, entry
);
1986 /* inherit all conditions */
1987 this->conditions
= other
->conditions
;
1988 if (this->conditions
& COND_NAT_HERE
)
1990 send_keepalive(this);
1994 if (other
->is_mediation_server
)
1996 act_as_mediation_server(this);
1998 else if (other
->server_reflexive_host
)
2000 this->server_reflexive_host
= other
->server_reflexive_host
->clone(
2001 other
->server_reflexive_host
);
2005 /* adopt all children */
2006 while (other
->child_sas
->remove_last(other
->child_sas
,
2007 (void**)&child_sa
) == SUCCESS
)
2009 this->child_sas
->insert_first(this->child_sas
, (void*)child_sa
);
2012 /* move pending tasks to the new IKE_SA */
2013 this->task_manager
->adopt_tasks(this->task_manager
, other
->task_manager
);
2015 /* reauthentication timeout survives a rekeying */
2016 if (other
->stats
[STAT_REAUTH
])
2018 time_t reauth
, delete, now
= time_monotonic(NULL
);
2020 this->stats
[STAT_REAUTH
] = other
->stats
[STAT_REAUTH
];
2021 reauth
= this->stats
[STAT_REAUTH
] - now
;
2022 delete = reauth
+ this->peer_cfg
->get_over_time(this->peer_cfg
);
2023 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
] + delete;
2024 DBG1(DBG_IKE
, "rescheduling reauthentication in %ds after rekeying, "
2025 "lifetime reduced to %ds", reauth
, delete);
2026 lib
->scheduler
->schedule_job(lib
->scheduler
,
2027 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
), reauth
);
2028 lib
->scheduler
->schedule_job(lib
->scheduler
,
2029 (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
), delete);
2033 METHOD(ike_sa_t
, destroy
, void,
2034 private_ike_sa_t
*this)
2036 attribute_entry_t
*entry
;
2039 charon
->bus
->set_sa(charon
->bus
, &this->public);
2041 set_state(this, IKE_DESTROYING
);
2042 DESTROY_IF(this->task_manager
);
2044 /* remove attributes first, as we pass the IKE_SA to the handler */
2045 while (this->attributes
->remove_last(this->attributes
,
2046 (void**)&entry
) == SUCCESS
)
2048 hydra
->attributes
->release(hydra
->attributes
, entry
->handler
,
2049 this->other_id
, entry
->type
, entry
->data
);
2050 free(entry
->data
.ptr
);
2053 this->attributes
->destroy(this->attributes
);
2055 this->child_sas
->destroy_offset(this->child_sas
, offsetof(child_sa_t
, destroy
));
2057 /* unset SA after here to avoid usage by the listeners */
2058 charon
->bus
->set_sa(charon
->bus
, NULL
);
2060 DESTROY_IF(this->keymat
);
2062 while (this->my_vips
->remove_last(this->my_vips
, (void**)&vip
) == SUCCESS
)
2064 hydra
->kernel_interface
->del_ip(hydra
->kernel_interface
, vip
);
2067 this->my_vips
->destroy(this->my_vips
);
2068 while (this->other_vips
->remove_last(this->other_vips
,
2069 (void**)&vip
) == SUCCESS
)
2073 enumerator_t
*enumerator
;
2076 enumerator
= this->peer_cfg
->create_pool_enumerator(this->peer_cfg
);
2077 while (enumerator
->enumerate(enumerator
, &pool
))
2079 if (hydra
->attributes
->release_address(hydra
->attributes
, pool
,
2080 vip
, get_other_eap_id(this)))
2085 enumerator
->destroy(enumerator
);
2089 this->other_vips
->destroy(this->other_vips
);
2090 this->peer_addresses
->destroy_offset(this->peer_addresses
,
2091 offsetof(host_t
, destroy
));
2093 if (this->is_mediation_server
)
2095 charon
->mediation_manager
->remove(charon
->mediation_manager
,
2098 DESTROY_IF(this->server_reflexive_host
);
2099 chunk_free(&this->connect_id
);
2101 free(this->nat_detection_dest
.ptr
);
2103 DESTROY_IF(this->my_host
);
2104 DESTROY_IF(this->other_host
);
2105 DESTROY_IF(this->my_id
);
2106 DESTROY_IF(this->other_id
);
2107 DESTROY_IF(this->local_host
);
2108 DESTROY_IF(this->remote_host
);
2110 DESTROY_IF(this->ike_cfg
);
2111 DESTROY_IF(this->peer_cfg
);
2112 DESTROY_IF(this->proposal
);
2113 this->my_auth
->destroy(this->my_auth
);
2114 this->other_auth
->destroy(this->other_auth
);
2115 this->my_auths
->destroy_offset(this->my_auths
,
2116 offsetof(auth_cfg_t
, destroy
));
2117 this->other_auths
->destroy_offset(this->other_auths
,
2118 offsetof(auth_cfg_t
, destroy
));
2120 this->ike_sa_id
->destroy(this->ike_sa_id
);
2125 * Described in header.
2127 ike_sa_t
* ike_sa_create(ike_sa_id_t
*ike_sa_id
, bool initiator
,
2128 ike_version_t version
)
2130 private_ike_sa_t
*this;
2131 static u_int32_t unique_id
= 0;
2133 if (version
== IKE_ANY
)
2134 { /* prefer IKEv2 if protocol not specified */
2144 .get_version
= _get_version
,
2145 .get_state
= _get_state
,
2146 .set_state
= _set_state
,
2147 .get_name
= _get_name
,
2148 .get_statistic
= _get_statistic
,
2149 .set_statistic
= _set_statistic
,
2150 .process_message
= _process_message
,
2151 .initiate
= _initiate
,
2152 .retry_initiate
= _retry_initiate
,
2153 .get_ike_cfg
= _get_ike_cfg
,
2154 .set_ike_cfg
= _set_ike_cfg
,
2155 .get_peer_cfg
= _get_peer_cfg
,
2156 .set_peer_cfg
= _set_peer_cfg
,
2157 .get_auth_cfg
= _get_auth_cfg
,
2158 .create_auth_cfg_enumerator
= _create_auth_cfg_enumerator
,
2159 .add_auth_cfg
= _add_auth_cfg
,
2160 .get_proposal
= _get_proposal
,
2161 .set_proposal
= _set_proposal
,
2163 .get_my_host
= _get_my_host
,
2164 .set_my_host
= _set_my_host
,
2165 .get_other_host
= _get_other_host
,
2166 .set_other_host
= _set_other_host
,
2167 .set_message_id
= _set_message_id
,
2168 .float_ports
= _float_ports
,
2169 .update_hosts
= _update_hosts
,
2170 .get_my_id
= _get_my_id
,
2171 .set_my_id
= _set_my_id
,
2172 .get_other_id
= _get_other_id
,
2173 .set_other_id
= _set_other_id
,
2174 .get_other_eap_id
= _get_other_eap_id
,
2175 .enable_extension
= _enable_extension
,
2176 .supports_extension
= _supports_extension
,
2177 .set_condition
= _set_condition
,
2178 .has_condition
= _has_condition
,
2179 .set_pending_updates
= _set_pending_updates
,
2180 .get_pending_updates
= _get_pending_updates
,
2181 .create_peer_address_enumerator
= _create_peer_address_enumerator
,
2182 .add_peer_address
= _add_peer_address
,
2183 .clear_peer_addresses
= _clear_peer_addresses
,
2184 .has_mapping_changed
= _has_mapping_changed
,
2185 .retransmit
= _retransmit
,
2187 .destroy
= _destroy
,
2188 .send_dpd
= _send_dpd
,
2189 .send_keepalive
= _send_keepalive
,
2190 .get_keymat
= _get_keymat
,
2191 .add_child_sa
= _add_child_sa
,
2192 .get_child_sa
= _get_child_sa
,
2193 .get_child_count
= _get_child_count
,
2194 .create_child_sa_enumerator
= _create_child_sa_enumerator
,
2195 .remove_child_sa
= _remove_child_sa
,
2196 .rekey_child_sa
= _rekey_child_sa
,
2197 .delete_child_sa
= _delete_child_sa
,
2198 .destroy_child_sa
= _destroy_child_sa
,
2201 .reestablish
= _reestablish
,
2202 .set_auth_lifetime
= _set_auth_lifetime
,
2204 .inherit
= _inherit
,
2205 .generate_message
= _generate_message
,
2207 .get_unique_id
= _get_unique_id
,
2208 .add_virtual_ip
= _add_virtual_ip
,
2209 .clear_virtual_ips
= _clear_virtual_ips
,
2210 .create_virtual_ip_enumerator
= _create_virtual_ip_enumerator
,
2211 .add_configuration_attribute
= _add_configuration_attribute
,
2212 .set_kmaddress
= _set_kmaddress
,
2213 .create_task_enumerator
= _create_task_enumerator
,
2214 .flush_queue
= _flush_queue
,
2215 .queue_task
= _queue_task
,
2217 .act_as_mediation_server
= _act_as_mediation_server
,
2218 .get_server_reflexive_host
= _get_server_reflexive_host
,
2219 .set_server_reflexive_host
= _set_server_reflexive_host
,
2220 .get_connect_id
= _get_connect_id
,
2221 .initiate_mediation
= _initiate_mediation
,
2222 .initiate_mediated
= _initiate_mediated
,
2224 .callback
= _callback
,
2225 .respond
= _respond
,
2228 .ike_sa_id
= ike_sa_id
->clone(ike_sa_id
),
2230 .child_sas
= linked_list_create(),
2231 .my_host
= host_create_any(AF_INET
),
2232 .other_host
= host_create_any(AF_INET
),
2233 .my_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
),
2234 .other_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
),
2235 .keymat
= keymat_create(version
, initiator
),
2236 .state
= IKE_CREATED
,
2237 .stats
[STAT_INBOUND
] = time_monotonic(NULL
),
2238 .stats
[STAT_OUTBOUND
] = time_monotonic(NULL
),
2239 .my_auth
= auth_cfg_create(),
2240 .other_auth
= auth_cfg_create(),
2241 .my_auths
= linked_list_create(),
2242 .other_auths
= linked_list_create(),
2243 .unique_id
= ++unique_id
,
2244 .peer_addresses
= linked_list_create(),
2245 .my_vips
= linked_list_create(),
2246 .other_vips
= linked_list_create(),
2247 .attributes
= linked_list_create(),
2248 .keepalive_interval
= lib
->settings
->get_time(lib
->settings
,
2249 "%s.keep_alive", KEEPALIVE_INTERVAL
, charon
->name
),
2250 .retry_initiate_interval
= lib
->settings
->get_time(lib
->settings
,
2251 "%s.retry_initiate_interval", 0, charon
->name
),
2252 .flush_auth_cfg
= lib
->settings
->get_bool(lib
->settings
,
2253 "%s.flush_auth_cfg", FALSE
, charon
->name
),
2256 if (version
== IKEV2
)
2257 { /* always supported with IKEv2 */
2258 enable_extension(this, EXT_DPD
);
2261 this->task_manager
= task_manager_create(&this->public);
2262 this->my_host
->set_port(this->my_host
,
2263 charon
->socket
->get_port(charon
->socket
, FALSE
));
2265 if (!this->task_manager
|| !this->keymat
)
2267 DBG1(DBG_IKE
, "IKE version %d not supported", this->version
);
2271 return &this->public;