1ee833ccea27a69931a1c4753e7becaad2643fd0
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/aggressive_mode.h>
24 #include <sa/ikev1/tasks/quick_mode.h>
25 #include <sa/ikev1/tasks/quick_delete.h>
26 #include <sa/ikev1/tasks/xauth.h>
27 #include <sa/ikev1/tasks/mode_config.h>
28 #include <sa/ikev1/tasks/informational.h>
29 #include <sa/ikev1/tasks/isakmp_natd.h>
30 #include <sa/ikev1/tasks/isakmp_vendor.h>
31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
33 #include <sa/ikev1/tasks/isakmp_delete.h>
34 #include <sa/ikev1/tasks/isakmp_dpd.h>
35
36 #include <processing/jobs/retransmit_job.h>
37 #include <processing/jobs/delete_ike_sa_job.h>
38 #include <processing/jobs/dpd_timeout_job.h>
39
40 /**
41 * Number of old messages hashes we keep for retransmission.
42 *
43 * In Main Mode, we must ignore messages from a previous message pair if
44 * we already continued to the next. Otherwise a late retransmission
45 * could be considered as a reply to the newer request.
46 */
47 #define MAX_OLD_HASHES 2
48
49 /**
50 * First sequence number of responding packets.
51 *
52 * To distinguish retransmission jobs for initiating and responding packets,
53 * we split up the sequence counter and use the upper half for responding.
54 */
55 #define RESPONDING_SEQ INT_MAX
56
57 typedef struct exchange_t exchange_t;
58
59 /**
60 * An exchange in the air, used do detect and handle retransmission
61 */
62 struct exchange_t {
63
64 /**
65 * Message ID used for this transaction
66 */
67 u_int32_t mid;
68
69 /**
70 * generated packet for retransmission
71 */
72 packet_t *packet;
73 };
74
75 typedef struct private_task_manager_t private_task_manager_t;
76
77 /**
78 * private data of the task manager
79 */
80 struct private_task_manager_t {
81
82 /**
83 * public functions
84 */
85 task_manager_v1_t public;
86
87 /**
88 * associated IKE_SA we are serving
89 */
90 ike_sa_t *ike_sa;
91
92 /**
93 * RNG to create message IDs
94 */
95 rng_t *rng;
96
97 /**
98 * Exchange we are currently handling as responder
99 */
100 struct {
101 /**
102 * Message ID of the last response
103 */
104 u_int32_t mid;
105
106 /**
107 * Hash of a previously received message
108 */
109 u_int32_t hash;
110
111 /**
112 * packet for retransmission
113 */
114 packet_t *packet;
115
116 /**
117 * Sequence number of the last sent message
118 */
119 u_int32_t seqnr;
120
121 /**
122 * how many times we have retransmitted so far
123 */
124 u_int retransmitted;
125
126 } responding;
127
128 /**
129 * Exchange we are currently handling as initiator
130 */
131 struct {
132 /**
133 * Message ID of the exchange
134 */
135 u_int32_t mid;
136
137 /**
138 * Hashes of old responses we can ignore
139 */
140 u_int32_t old_hashes[MAX_OLD_HASHES];
141
142 /**
143 * Position in old hash array
144 */
145 int old_hash_pos;
146
147 /**
148 * Sequence number of the last sent message
149 */
150 u_int32_t seqnr;
151
152 /**
153 * how many times we have retransmitted so far
154 */
155 u_int retransmitted;
156
157 /**
158 * packet for retransmission
159 */
160 packet_t *packet;
161
162 /**
163 * type of the initated exchange
164 */
165 exchange_type_t type;
166
167 } initiating;
168
169 /**
170 * List of queued tasks not yet in action
171 */
172 linked_list_t *queued_tasks;
173
174 /**
175 * List of active tasks, initiated by ourselve
176 */
177 linked_list_t *active_tasks;
178
179 /**
180 * List of tasks initiated by peer
181 */
182 linked_list_t *passive_tasks;
183
184 /**
185 * Queued messages not yet ready to process
186 */
187 message_t *queued;
188
189 /**
190 * Number of times we retransmit messages before giving up
191 */
192 u_int retransmit_tries;
193
194 /**
195 * Retransmission timeout
196 */
197 double retransmit_timeout;
198
199 /**
200 * Base to calculate retransmission timeout
201 */
202 double retransmit_base;
203
204 /**
205 * Sequence number for sending DPD requests
206 */
207 u_int32_t dpd_send;
208
209 /**
210 * Sequence number for received DPD requests
211 */
212 u_int32_t dpd_recv;
213 };
214
215 METHOD(task_manager_t, flush_queue, void,
216 private_task_manager_t *this, task_queue_t queue)
217 {
218 linked_list_t *list;
219 task_t *task;
220
221 if (this->queued)
222 {
223 this->queued->destroy(this->queued);
224 this->queued = NULL;
225 }
226 switch (queue)
227 {
228 case TASK_QUEUE_ACTIVE:
229 list = this->active_tasks;
230 /* cancel pending retransmits */
231 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
232 DESTROY_IF(this->initiating.packet);
233 this->initiating.packet = NULL;
234 break;
235 case TASK_QUEUE_PASSIVE:
236 list = this->passive_tasks;
237 break;
238 case TASK_QUEUE_QUEUED:
239 list = this->queued_tasks;
240 break;
241 default:
242 return;
243 }
244 while (list->remove_last(list, (void**)&task) == SUCCESS)
245 {
246 task->destroy(task);
247 }
248 }
249
250 /**
251 * flush all tasks in the task manager
252 */
253 static void flush(private_task_manager_t *this)
254 {
255 flush_queue(this, TASK_QUEUE_QUEUED);
256 flush_queue(this, TASK_QUEUE_PASSIVE);
257 flush_queue(this, TASK_QUEUE_ACTIVE);
258 }
259
260 /**
261 * move a task of a specific type from the queue to the active list
262 */
263 static bool activate_task(private_task_manager_t *this, task_type_t type)
264 {
265 enumerator_t *enumerator;
266 task_t *task;
267 bool found = FALSE;
268
269 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
270 while (enumerator->enumerate(enumerator, (void**)&task))
271 {
272 if (task->get_type(task) == type)
273 {
274 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
275 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
276 this->active_tasks->insert_last(this->active_tasks, task);
277 found = TRUE;
278 break;
279 }
280 }
281 enumerator->destroy(enumerator);
282 return found;
283 }
284
285 /**
286 * Retransmit a packet, either as initiator or as responder
287 */
288 static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
289 u_int mid, u_int retransmitted, packet_t *packet)
290 {
291 u_int32_t t;
292
293 if (retransmitted > this->retransmit_tries)
294 {
295 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
296 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_TIMEOUT, packet);
297 return DESTROY_ME;
298 }
299 t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
300 pow(this->retransmit_base, retransmitted));
301 if (retransmitted)
302 {
303 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
304 retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
305 mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
306 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND, packet);
307 }
308 charon->sender->send(charon->sender, packet->clone(packet));
309 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
310 retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
311 return NEED_MORE;
312 }
313
314 METHOD(task_manager_t, retransmit, status_t,
315 private_task_manager_t *this, u_int32_t seqnr)
316 {
317 status_t status = SUCCESS;
318
319 if (seqnr == this->initiating.seqnr && this->initiating.packet)
320 {
321 status = retransmit_packet(this, seqnr, this->initiating.mid,
322 this->initiating.retransmitted, this->initiating.packet);
323 if (status == NEED_MORE)
324 {
325 this->initiating.retransmitted++;
326 status = SUCCESS;
327 }
328 }
329 if (seqnr == this->responding.seqnr && this->responding.packet)
330 {
331 status = retransmit_packet(this, seqnr, this->responding.mid,
332 this->responding.retransmitted, this->responding.packet);
333 if (status == NEED_MORE)
334 {
335 this->responding.retransmitted++;
336 status = SUCCESS;
337 }
338 }
339 return status;
340 }
341
342 /**
343 * Check if we have to wait for a mode config before starting a quick mode
344 */
345 static bool mode_config_expected(private_task_manager_t *this)
346 {
347 enumerator_t *enumerator;
348 peer_cfg_t *peer_cfg;
349 char *pool;
350 host_t *host;
351
352 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
353 if (peer_cfg)
354 {
355 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
356 if (!enumerator->enumerate(enumerator, &pool))
357 { /* no pool configured */
358 enumerator->destroy(enumerator);
359 return FALSE;
360 }
361 enumerator->destroy(enumerator);
362
363 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
364 FALSE);
365 if (!enumerator->enumerate(enumerator, &host))
366 { /* have a pool, but no VIP assigned yet */
367 enumerator->destroy(enumerator);
368 return TRUE;
369 }
370 enumerator->destroy(enumerator);
371 }
372 return FALSE;
373 }
374
375 METHOD(task_manager_t, initiate, status_t,
376 private_task_manager_t *this)
377 {
378 enumerator_t *enumerator;
379 task_t *task;
380 message_t *message;
381 host_t *me, *other;
382 status_t status;
383 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
384 bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
385
386 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
387 this->initiating.type != INFORMATIONAL_V1)
388 {
389 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
390 exchange_type_names, this->initiating.type);
391 /* do not initiate if we already have a message in the air */
392 return SUCCESS;
393 }
394
395 if (this->active_tasks->get_count(this->active_tasks) == 0)
396 {
397 DBG2(DBG_IKE, "activating new tasks");
398 switch (this->ike_sa->get_state(this->ike_sa))
399 {
400 case IKE_CREATED:
401 activate_task(this, TASK_ISAKMP_VENDOR);
402 activate_task(this, TASK_ISAKMP_CERT_PRE);
403 if (activate_task(this, TASK_MAIN_MODE))
404 {
405 exchange = ID_PROT;
406 }
407 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
408 {
409 exchange = AGGRESSIVE;
410 }
411 activate_task(this, TASK_ISAKMP_CERT_POST);
412 activate_task(this, TASK_ISAKMP_NATD);
413 break;
414 case IKE_CONNECTING:
415 if (activate_task(this, TASK_ISAKMP_DELETE))
416 {
417 exchange = INFORMATIONAL_V1;
418 new_mid = TRUE;
419 break;
420 }
421 if (activate_task(this, TASK_XAUTH))
422 {
423 exchange = TRANSACTION;
424 new_mid = TRUE;
425 break;
426 }
427 if (activate_task(this, TASK_INFORMATIONAL))
428 {
429 exchange = INFORMATIONAL_V1;
430 new_mid = TRUE;
431 break;
432 }
433 break;
434 case IKE_ESTABLISHED:
435 if (activate_task(this, TASK_MODE_CONFIG))
436 {
437 exchange = TRANSACTION;
438 new_mid = TRUE;
439 break;
440 }
441 if (!mode_config_expected(this) &&
442 activate_task(this, TASK_QUICK_MODE))
443 {
444 exchange = QUICK_MODE;
445 new_mid = TRUE;
446 break;
447 }
448 if (activate_task(this, TASK_INFORMATIONAL))
449 {
450 exchange = INFORMATIONAL_V1;
451 new_mid = TRUE;
452 break;
453 }
454 if (activate_task(this, TASK_QUICK_DELETE))
455 {
456 exchange = INFORMATIONAL_V1;
457 new_mid = TRUE;
458 break;
459 }
460 if (activate_task(this, TASK_ISAKMP_DELETE))
461 {
462 exchange = INFORMATIONAL_V1;
463 new_mid = TRUE;
464 break;
465 }
466 if (activate_task(this, TASK_ISAKMP_DPD))
467 {
468 exchange = INFORMATIONAL_V1;
469 new_mid = TRUE;
470 break;
471 }
472 break;
473 default:
474 break;
475 }
476 }
477 else
478 {
479 DBG2(DBG_IKE, "reinitiating already active tasks");
480 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
481 while (enumerator->enumerate(enumerator, (void**)&task))
482 {
483 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
484 switch (task->get_type(task))
485 {
486 case TASK_MAIN_MODE:
487 exchange = ID_PROT;
488 break;
489 case TASK_AGGRESSIVE_MODE:
490 exchange = AGGRESSIVE;
491 break;
492 case TASK_QUICK_MODE:
493 exchange = QUICK_MODE;
494 break;
495 case TASK_XAUTH:
496 exchange = TRANSACTION;
497 new_mid = TRUE;
498 break;
499 default:
500 continue;
501 }
502 break;
503 }
504 enumerator->destroy(enumerator);
505 }
506
507 if (exchange == EXCHANGE_TYPE_UNDEFINED)
508 {
509 DBG2(DBG_IKE, "nothing to initiate");
510 /* nothing to do yet... */
511 return SUCCESS;
512 }
513
514 me = this->ike_sa->get_my_host(this->ike_sa);
515 other = this->ike_sa->get_other_host(this->ike_sa);
516
517 if (new_mid)
518 {
519 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
520 (void*)&this->initiating.mid))
521 {
522 DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
523 flush(this);
524 return DESTROY_ME;
525 }
526 }
527 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
528 message->set_message_id(message, this->initiating.mid);
529 message->set_source(message, me->clone(me));
530 message->set_destination(message, other->clone(other));
531 message->set_exchange_type(message, exchange);
532 this->initiating.type = exchange;
533 this->initiating.retransmitted = 0;
534
535 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
536 while (enumerator->enumerate(enumerator, (void*)&task))
537 {
538 switch (task->build(task, message))
539 {
540 case SUCCESS:
541 /* task completed, remove it */
542 this->active_tasks->remove_at(this->active_tasks, enumerator);
543 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
544 task->get_type(task) == TASK_QUICK_MODE)
545 { /* last message of three message exchange */
546 keep = TRUE;
547 }
548 task->destroy(task);
549 continue;
550 case NEED_MORE:
551 expect_response = TRUE;
552 /* processed, but task needs another exchange */
553 continue;
554 case ALREADY_DONE:
555 cancelled = TRUE;
556 break;
557 case FAILED:
558 default:
559 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
560 {
561 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
562 }
563 /* FALL */
564 case DESTROY_ME:
565 /* critical failure, destroy IKE_SA */
566 enumerator->destroy(enumerator);
567 message->destroy(message);
568 flush(this);
569 return DESTROY_ME;
570 }
571 break;
572 }
573 enumerator->destroy(enumerator);
574
575 if (this->active_tasks->get_count(this->active_tasks) == 0 &&
576 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
577 { /* tasks completed, no exchange active anymore */
578 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
579 }
580 if (cancelled)
581 {
582 message->destroy(message);
583 return initiate(this);
584 }
585
586 DESTROY_IF(this->initiating.packet);
587 status = this->ike_sa->generate_message(this->ike_sa, message,
588 &this->initiating.packet);
589 if (status != SUCCESS)
590 {
591 /* message generation failed. There is nothing more to do than to
592 * close the SA */
593 message->destroy(message);
594 flush(this);
595 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
596 return DESTROY_ME;
597 }
598
599 this->initiating.seqnr++;
600 if (expect_response)
601 {
602 message->destroy(message);
603 return retransmit(this, this->initiating.seqnr);
604 }
605 if (keep)
606 { /* keep the packet for retransmission, the responder might request it */
607 charon->sender->send(charon->sender,
608 this->initiating.packet->clone(this->initiating.packet));
609 }
610 else
611 {
612 charon->sender->send(charon->sender, this->initiating.packet);
613 this->initiating.packet = NULL;
614 }
615 message->destroy(message);
616
617 if (exchange == INFORMATIONAL_V1)
618 {
619 switch (this->ike_sa->get_state(this->ike_sa))
620 {
621 case IKE_CONNECTING:
622 /* close after sending an INFORMATIONAL when unestablished */
623 return FAILED;
624 case IKE_DELETING:
625 /* close after sending a DELETE */
626 return DESTROY_ME;
627 default:
628 break;
629 }
630 }
631 return initiate(this);
632 }
633
634 /**
635 * build a response depending on the "passive" task list
636 */
637 static status_t build_response(private_task_manager_t *this, message_t *request)
638 {
639 enumerator_t *enumerator;
640 task_t *task;
641 message_t *message;
642 host_t *me, *other;
643 bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
644 status_t status;
645
646 me = request->get_destination(request);
647 other = request->get_source(request);
648
649 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
650 message->set_exchange_type(message, request->get_exchange_type(request));
651 /* send response along the path the request came in */
652 message->set_source(message, me->clone(me));
653 message->set_destination(message, other->clone(other));
654 message->set_message_id(message, request->get_message_id(request));
655 message->set_request(message, FALSE);
656
657 this->responding.mid = request->get_message_id(request);
658 this->responding.retransmitted = 0;
659 this->responding.seqnr++;
660
661 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
662 while (enumerator->enumerate(enumerator, (void*)&task))
663 {
664 switch (task->build(task, message))
665 {
666 case SUCCESS:
667 /* task completed, remove it */
668 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
669 task->destroy(task);
670 continue;
671 case NEED_MORE:
672 /* processed, but task needs another exchange */
673 if (task->get_type(task) == TASK_QUICK_MODE ||
674 task->get_type(task) == TASK_AGGRESSIVE_MODE)
675 { /* we rely on initiator retransmission, except for
676 * three-message exchanges */
677 expect_request = TRUE;
678 }
679 continue;
680 case ALREADY_DONE:
681 cancelled = TRUE;
682 break;
683 case FAILED:
684 default:
685 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
686 /* FALL */
687 case DESTROY_ME:
688 /* destroy IKE_SA, but SEND response first */
689 delete = TRUE;
690 break;
691 }
692 break;
693 }
694 enumerator->destroy(enumerator);
695
696 DESTROY_IF(this->responding.packet);
697 this->responding.packet = NULL;
698 if (cancelled)
699 {
700 message->destroy(message);
701 return initiate(this);
702 }
703 status = this->ike_sa->generate_message(this->ike_sa, message,
704 &this->responding.packet);
705 message->destroy(message);
706 if (status != SUCCESS)
707 {
708 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
709 return DESTROY_ME;
710 }
711
712 if (expect_request && !delete)
713 {
714 return retransmit(this, this->responding.seqnr);
715 }
716 charon->sender->send(charon->sender,
717 this->responding.packet->clone(this->responding.packet));
718 if (delete)
719 {
720 return DESTROY_ME;
721 }
722 return SUCCESS;
723 }
724
725 /**
726 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
727 * The notify protocol_id is set to ISAKMP
728 */
729 static void send_notify(private_task_manager_t *this, message_t *request,
730 notify_type_t type)
731 {
732 message_t *response;
733 packet_t *packet;
734 host_t *me, *other;
735 u_int32_t mid;
736
737 if (request->get_exchange_type(request) == INFORMATIONAL_V1)
738 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
739 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
740 return;
741 }
742 if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
743 {
744 DBG1(DBG_IKE, "failed to allocate message ID");
745 return;
746 }
747 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
748 response->set_exchange_type(response, INFORMATIONAL_V1);
749 response->set_request(response, TRUE);
750 response->set_message_id(response, mid);
751 response->add_payload(response, (payload_t*)
752 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
753 PROTO_IKE, type));
754
755 me = this->ike_sa->get_my_host(this->ike_sa);
756 if (me->is_anyaddr(me))
757 {
758 me = request->get_destination(request);
759 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
760 }
761 other = this->ike_sa->get_other_host(this->ike_sa);
762 if (other->is_anyaddr(other))
763 {
764 other = request->get_source(request);
765 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
766 }
767 response->set_source(response, me->clone(me));
768 response->set_destination(response, other->clone(other));
769 if (this->ike_sa->generate_message(this->ike_sa, response,
770 &packet) == SUCCESS)
771 {
772 charon->sender->send(charon->sender, packet);
773 }
774 response->destroy(response);
775 }
776
777 /**
778 * Process a DPD request/response
779 */
780 static bool process_dpd(private_task_manager_t *this, message_t *message)
781 {
782 notify_payload_t *notify;
783 notify_type_t type;
784 u_int32_t seq;
785 chunk_t data;
786
787 type = DPD_R_U_THERE;
788 notify = message->get_notify(message, type);
789 if (!notify)
790 {
791 type = DPD_R_U_THERE_ACK;
792 notify = message->get_notify(message, type);
793 }
794 if (!notify)
795 {
796 return FALSE;
797 }
798 data = notify->get_notification_data(notify);
799 if (data.len != 4)
800 {
801 return FALSE;
802 }
803 seq = untoh32(data.ptr);
804
805 if (type == DPD_R_U_THERE)
806 {
807 if (this->dpd_recv == 0 || seq == this->dpd_recv)
808 { /* check sequence validity */
809 this->dpd_recv = seq + 1;
810 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
811 time_monotonic(NULL));
812 }
813 /* but respond anyway */
814 this->ike_sa->queue_task(this->ike_sa,
815 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
816 }
817 else /* DPD_R_U_THERE_ACK */
818 {
819 if (seq == this->dpd_send - 1)
820 {
821 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
822 time_monotonic(NULL));
823 }
824 else
825 {
826 DBG1(DBG_IKE, "received invalid DPD sequence number %u "
827 "(expected %u), ignored", seq, this->dpd_send - 1);
828 }
829 }
830 return TRUE;
831 }
832
833 /**
834 * handle an incoming request message
835 */
836 static status_t process_request(private_task_manager_t *this,
837 message_t *message)
838 {
839 enumerator_t *enumerator;
840 task_t *task = NULL;
841 bool send_response = FALSE, dpd = FALSE;
842
843 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
844 this->passive_tasks->get_count(this->passive_tasks) == 0)
845 { /* create tasks depending on request type, if not already some queued */
846 switch (message->get_exchange_type(message))
847 {
848 case ID_PROT:
849 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
850 this->passive_tasks->insert_last(this->passive_tasks, task);
851 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
852 this->passive_tasks->insert_last(this->passive_tasks, task);
853 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
854 this->passive_tasks->insert_last(this->passive_tasks, task);
855 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
856 this->passive_tasks->insert_last(this->passive_tasks, task);
857 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
858 this->passive_tasks->insert_last(this->passive_tasks, task);
859 break;
860 case AGGRESSIVE:
861 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
862 this->passive_tasks->insert_last(this->passive_tasks, task);
863 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
864 this->passive_tasks->insert_last(this->passive_tasks, task);
865 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
866 this->passive_tasks->insert_last(this->passive_tasks, task);
867 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
868 this->passive_tasks->insert_last(this->passive_tasks, task);
869 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
870 this->passive_tasks->insert_last(this->passive_tasks, task);
871 break;
872 case QUICK_MODE:
873 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
874 {
875 DBG1(DBG_IKE, "received quick mode request for "
876 "unestablished IKE_SA, ignored");
877 return FAILED;
878 }
879 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
880 NULL, NULL);
881 this->passive_tasks->insert_last(this->passive_tasks, task);
882 break;
883 case INFORMATIONAL_V1:
884 if (process_dpd(this, message))
885 {
886 dpd = TRUE;
887 }
888 else
889 {
890 task = (task_t *)informational_create(this->ike_sa, NULL);
891 this->passive_tasks->insert_first(this->passive_tasks, task);
892 }
893 break;
894 case TRANSACTION:
895 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
896 {
897 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
898 }
899 else
900 {
901 task = (task_t *)xauth_create(this->ike_sa, FALSE);
902 }
903 this->passive_tasks->insert_last(this->passive_tasks, task);
904 break;
905 default:
906 return FAILED;
907 }
908 }
909 if (dpd)
910 {
911 return initiate(this);
912 }
913 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
914
915 /* let the tasks process the message */
916 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
917 while (enumerator->enumerate(enumerator, (void*)&task))
918 {
919 switch (task->process(task, message))
920 {
921 case SUCCESS:
922 /* task completed, remove it */
923 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
924 task->destroy(task);
925 continue;
926 case NEED_MORE:
927 /* processed, but task needs at least another call to build() */
928 send_response = TRUE;
929 continue;
930 case ALREADY_DONE:
931 send_response = FALSE;
932 break;
933 case FAILED:
934 default:
935 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
936 /* FALL */
937 case DESTROY_ME:
938 /* critical failure, destroy IKE_SA */
939 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
940 enumerator->destroy(enumerator);
941 task->destroy(task);
942 return DESTROY_ME;
943 }
944 break;
945 }
946 enumerator->destroy(enumerator);
947
948 if (send_response)
949 {
950 if (build_response(this, message) != SUCCESS)
951 {
952 return DESTROY_ME;
953 }
954 }
955 else
956 { /* We don't send a response, so don't retransmit one if we get
957 * the same message again. */
958 DESTROY_IF(this->responding.packet);
959 this->responding.packet = NULL;
960 }
961 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
962 this->queued_tasks->get_count(this->queued_tasks) > 0)
963 {
964 /* passive tasks completed, check if an active task has been queued,
965 * such as XAUTH or modeconfig push */
966 return initiate(this);
967 }
968 return SUCCESS;
969 }
970
971 /**
972 * handle an incoming response message
973 */
974 static status_t process_response(private_task_manager_t *this,
975 message_t *message)
976 {
977 enumerator_t *enumerator;
978 message_t *queued;
979 status_t status;
980 task_t *task;
981
982 if (message->get_exchange_type(message) != this->initiating.type)
983 {
984 DBG1(DBG_IKE, "received %N response, but expected %N",
985 exchange_type_names, message->get_exchange_type(message),
986 exchange_type_names, this->initiating.type);
987 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
988 return DESTROY_ME;
989 }
990
991 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
992 while (enumerator->enumerate(enumerator, (void*)&task))
993 {
994 switch (task->process(task, message))
995 {
996 case SUCCESS:
997 /* task completed, remove it */
998 this->active_tasks->remove_at(this->active_tasks, enumerator);
999 task->destroy(task);
1000 continue;
1001 case NEED_MORE:
1002 /* processed, but task needs another exchange */
1003 continue;
1004 case ALREADY_DONE:
1005 break;
1006 case FAILED:
1007 default:
1008 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1009 /* FALL */
1010 case DESTROY_ME:
1011 /* critical failure, destroy IKE_SA */
1012 this->active_tasks->remove_at(this->active_tasks, enumerator);
1013 enumerator->destroy(enumerator);
1014 task->destroy(task);
1015 return DESTROY_ME;
1016 }
1017 break;
1018 }
1019 enumerator->destroy(enumerator);
1020
1021 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1022 DESTROY_IF(this->initiating.packet);
1023 this->initiating.packet = NULL;
1024
1025 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
1026 {
1027 queued = this->queued;
1028 this->queued = NULL;
1029 status = this->public.task_manager.process_message(
1030 &this->public.task_manager, queued);
1031 queued->destroy(queued);
1032 if (status == DESTROY_ME)
1033 {
1034 return status;
1035 }
1036 }
1037
1038 return initiate(this);
1039 }
1040
1041 /**
1042 * Parse the given message and verify that it is valid.
1043 */
1044 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1045 {
1046 status_t status;
1047
1048 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1049
1050 if (status != SUCCESS)
1051 {
1052 switch (status)
1053 {
1054 case NOT_SUPPORTED:
1055 DBG1(DBG_IKE, "unsupported exchange type");
1056 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1057 break;
1058 case PARSE_ERROR:
1059 DBG1(DBG_IKE, "message parsing failed");
1060 send_notify(this, msg, PAYLOAD_MALFORMED);
1061 break;
1062 case VERIFY_ERROR:
1063 DBG1(DBG_IKE, "message verification failed");
1064 send_notify(this, msg, PAYLOAD_MALFORMED);
1065 break;
1066 case FAILED:
1067 DBG1(DBG_IKE, "integrity check failed");
1068 send_notify(this, msg, INVALID_HASH_INFORMATION);
1069 break;
1070 case INVALID_STATE:
1071 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1072 send_notify(this, msg, PAYLOAD_MALFORMED);
1073 default:
1074 break;
1075 }
1076 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1077 exchange_type_names, msg->get_exchange_type(msg),
1078 msg->get_request(msg) ? "request" : "response",
1079 msg->get_message_id(msg));
1080
1081 charon->bus->alert(charon->bus, ALERT_PARSE_ERROR_BODY, msg, status);
1082
1083 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1084 { /* invalid initiation attempt, close SA */
1085 return DESTROY_ME;
1086 }
1087 }
1088 return status;
1089 }
1090
1091 METHOD(task_manager_t, process_message, status_t,
1092 private_task_manager_t *this, message_t *msg)
1093 {
1094 u_int32_t hash, mid, i;
1095 host_t *me, *other;
1096 status_t status;
1097
1098 /* TODO-IKEv1: update hosts more selectively */
1099 me = msg->get_destination(msg);
1100 other = msg->get_source(msg);
1101 mid = msg->get_message_id(msg);
1102 hash = chunk_hash(msg->get_packet_data(msg));
1103 for (i = 0; i < MAX_OLD_HASHES; i++)
1104 {
1105 if (this->initiating.old_hashes[i] == hash)
1106 {
1107 if (this->initiating.packet &&
1108 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1109 (msg->get_exchange_type(msg) == QUICK_MODE ||
1110 msg->get_exchange_type(msg) == AGGRESSIVE))
1111 {
1112 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1113 "resending last request", mid);
1114 charon->sender->send(charon->sender,
1115 this->initiating.packet->clone(this->initiating.packet));
1116 return SUCCESS;
1117 }
1118 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1119 "but next request already sent", mid);
1120 return SUCCESS;
1121 }
1122 }
1123
1124 if ((mid && mid == this->initiating.mid) ||
1125 (this->initiating.mid == 0 &&
1126 msg->get_exchange_type(msg) == this->initiating.type &&
1127 this->active_tasks->get_count(this->active_tasks)))
1128 {
1129 msg->set_request(msg, FALSE);
1130 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1131 status = parse_message(this, msg);
1132 if (status != SUCCESS)
1133 {
1134 return status;
1135 }
1136 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1137 time_monotonic(NULL));
1138 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1139 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1140 if (process_response(this, msg) != SUCCESS)
1141 {
1142 flush(this);
1143 return DESTROY_ME;
1144 }
1145 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1146 MAX_OLD_HASHES] = hash;
1147 }
1148 else
1149 {
1150 if (hash == this->responding.hash)
1151 {
1152 if (this->responding.packet)
1153 {
1154 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1155 "retransmitting response", mid);
1156 charon->sender->send(charon->sender,
1157 this->responding.packet->clone(this->responding.packet));
1158 }
1159 else if (this->initiating.packet &&
1160 this->initiating.type == INFORMATIONAL_V1)
1161 {
1162 DBG1(DBG_IKE, "received retransmit of DPD request, "
1163 "retransmitting response");
1164 charon->sender->send(charon->sender,
1165 this->initiating.packet->clone(this->initiating.packet));
1166 }
1167 else
1168 {
1169 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1170 "but no response to retransmit", mid);
1171 }
1172 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_RECEIVE, msg);
1173 return SUCCESS;
1174 }
1175 if (msg->get_exchange_type(msg) == TRANSACTION &&
1176 this->active_tasks->get_count(this->active_tasks))
1177 { /* main mode not yet complete, queue XAuth/Mode config tasks */
1178 if (this->queued)
1179 {
1180 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
1181 exchange_type_names, TRANSACTION);
1182 return SUCCESS;
1183 }
1184 this->queued = message_create_from_packet(msg->get_packet(msg));
1185 if (this->queued->parse_header(this->queued) != SUCCESS)
1186 {
1187 this->queued->destroy(this->queued);
1188 this->queued = NULL;
1189 return FAILED;
1190 }
1191 DBG1(DBG_IKE, "queueing %N request as tasks still active",
1192 exchange_type_names, TRANSACTION);
1193 return SUCCESS;
1194 }
1195
1196 msg->set_request(msg, TRUE);
1197 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1198 status = parse_message(this, msg);
1199 if (status != SUCCESS)
1200 {
1201 return status;
1202 }
1203 /* if this IKE_SA is virgin, we check for a config */
1204 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1205 {
1206 ike_sa_id_t *ike_sa_id;
1207 ike_cfg_t *ike_cfg;
1208 job_t *job;
1209
1210 ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1211 me, other, IKEV1);
1212 if (ike_cfg == NULL)
1213 {
1214 /* no config found for these hosts, destroy */
1215 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1216 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1217 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1218 return DESTROY_ME;
1219 }
1220 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1221 ike_cfg->destroy(ike_cfg);
1222 /* add a timeout if peer does not establish it completely */
1223 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1224 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1225 lib->scheduler->schedule_job(lib->scheduler, job,
1226 lib->settings->get_int(lib->settings,
1227 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1228 charon->name));
1229 }
1230 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1231 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1232 if (process_request(this, msg) != SUCCESS)
1233 {
1234 flush(this);
1235 return DESTROY_ME;
1236 }
1237 this->responding.hash = hash;
1238 }
1239 return SUCCESS;
1240 }
1241
1242 METHOD(task_manager_t, queue_task, void,
1243 private_task_manager_t *this, task_t *task)
1244 {
1245 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1246 this->queued_tasks->insert_last(this->queued_tasks, task);
1247 }
1248
1249 /**
1250 * Check if a given task has been queued already
1251 */
1252 static bool has_queued(private_task_manager_t *this, task_type_t type)
1253 {
1254 enumerator_t *enumerator;
1255 bool found = FALSE;
1256 task_t *task;
1257
1258 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1259 while (enumerator->enumerate(enumerator, &task))
1260 {
1261 if (task->get_type(task) == type)
1262 {
1263 found = TRUE;
1264 break;
1265 }
1266 }
1267 enumerator->destroy(enumerator);
1268 return found;
1269 }
1270
1271 METHOD(task_manager_t, queue_ike, void,
1272 private_task_manager_t *this)
1273 {
1274 peer_cfg_t *peer_cfg;
1275
1276 if (!has_queued(this, TASK_ISAKMP_VENDOR))
1277 {
1278 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1279 }
1280 if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1281 {
1282 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1283 }
1284 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1285 if (peer_cfg->use_aggressive(peer_cfg))
1286 {
1287 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1288 {
1289 queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1290 }
1291 }
1292 else
1293 {
1294 if (!has_queued(this, TASK_MAIN_MODE))
1295 {
1296 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1297 }
1298 }
1299 if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1300 {
1301 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1302 }
1303 if (!has_queued(this, TASK_ISAKMP_NATD))
1304 {
1305 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1306 }
1307 }
1308
1309 METHOD(task_manager_t, queue_ike_reauth, void,
1310 private_task_manager_t *this)
1311 {
1312 enumerator_t *enumerator;
1313 child_sa_t *child_sa;
1314 ike_sa_t *new;
1315 host_t *host;
1316
1317 new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1318 this->ike_sa->get_version(this->ike_sa), TRUE);
1319 if (!new)
1320 { /* shouldn't happen */
1321 return;
1322 }
1323
1324 new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1325 host = this->ike_sa->get_other_host(this->ike_sa);
1326 new->set_other_host(new, host->clone(host));
1327 host = this->ike_sa->get_my_host(this->ike_sa);
1328 new->set_my_host(new, host->clone(host));
1329 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1330 while (enumerator->enumerate(enumerator, &host))
1331 {
1332 new->add_virtual_ip(new, TRUE, host);
1333 }
1334 enumerator->destroy(enumerator);
1335
1336 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1337 while (enumerator->enumerate(enumerator, &child_sa))
1338 {
1339 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1340 new->add_child_sa(new, child_sa);
1341 }
1342 enumerator->destroy(enumerator);
1343
1344 if (!new->get_child_count(new))
1345 { /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1346 task_t *task;
1347
1348 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1349 while (enumerator->enumerate(enumerator, &task))
1350 {
1351 if (task->get_type(task) == TASK_QUICK_MODE)
1352 {
1353 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1354 task->migrate(task, new);
1355 new->queue_task(new, task);
1356 }
1357 }
1358 enumerator->destroy(enumerator);
1359 }
1360
1361 if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1362 {
1363 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1364 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1365 }
1366 else
1367 {
1368 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1369 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1370 }
1371 charon->bus->set_sa(charon->bus, this->ike_sa);
1372 }
1373
1374 METHOD(task_manager_t, queue_ike_rekey, void,
1375 private_task_manager_t *this)
1376 {
1377 queue_ike_reauth(this);
1378 }
1379
1380 METHOD(task_manager_t, queue_ike_delete, void,
1381 private_task_manager_t *this)
1382 {
1383 enumerator_t *enumerator;
1384 child_sa_t *child_sa;
1385
1386 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1387 while (enumerator->enumerate(enumerator, &child_sa))
1388 {
1389 queue_task(this, (task_t*)
1390 quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1391 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1392 }
1393 enumerator->destroy(enumerator);
1394
1395 queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1396 }
1397
1398 METHOD(task_manager_t, queue_mobike, void,
1399 private_task_manager_t *this, bool roam, bool address)
1400 {
1401 /* Not supported in IKEv1 */
1402 }
1403
1404 METHOD(task_manager_t, queue_child, void,
1405 private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1406 traffic_selector_t *tsi, traffic_selector_t *tsr)
1407 {
1408 quick_mode_t *task;
1409
1410 task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1411 task->use_reqid(task, reqid);
1412
1413 queue_task(this, &task->task);
1414 }
1415
1416 /**
1417 * Check if two CHILD_SAs have the same traffic selector
1418 */
1419 static bool have_equal_ts(child_sa_t *a, child_sa_t *b, bool local)
1420 {
1421 linked_list_t *list;
1422 traffic_selector_t *ts_a, *ts_b;
1423
1424 list = a->get_traffic_selectors(a, local);
1425 if (list->get_first(list, (void**)&ts_a) == SUCCESS)
1426 {
1427 list = b->get_traffic_selectors(b, local);
1428 if (list->get_first(list, (void**)&ts_b) == SUCCESS)
1429 {
1430 return ts_a->equals(ts_a, ts_b);
1431 }
1432 }
1433 return FALSE;
1434 }
1435
1436 /**
1437 * Check if a CHILD_SA is redundant and we should delete instead of rekey
1438 */
1439 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1440 {
1441 enumerator_t *enumerator;
1442 child_sa_t *current;
1443 bool redundant = FALSE;
1444
1445 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1446 while (enumerator->enumerate(enumerator, &current))
1447 {
1448 if (current->get_state(current) == CHILD_INSTALLED &&
1449 streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1450 have_equal_ts(current, child_sa, TRUE) &&
1451 have_equal_ts(current, child_sa, FALSE) &&
1452 current->get_lifetime(current, FALSE) >
1453 child_sa->get_lifetime(child_sa, FALSE))
1454 {
1455 DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1456 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
1457 redundant = TRUE;
1458 break;
1459 }
1460 }
1461 enumerator->destroy(enumerator);
1462
1463 return redundant;
1464 }
1465
1466 /**
1467 * Get the first traffic selector of a CHILD_SA, local or remote
1468 */
1469 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1470 {
1471 traffic_selector_t *ts = NULL;
1472 linked_list_t *list;
1473
1474 list = child_sa->get_traffic_selectors(child_sa, local);
1475 if (list->get_first(list, (void**)&ts) == SUCCESS)
1476 {
1477 return ts;
1478 }
1479 return NULL;
1480 }
1481
1482 METHOD(task_manager_t, queue_child_rekey, void,
1483 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1484 {
1485 child_sa_t *child_sa;
1486 child_cfg_t *cfg;
1487 quick_mode_t *task;
1488
1489 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1490 if (!child_sa)
1491 {
1492 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1493 }
1494 if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1495 {
1496 if (is_redundant(this, child_sa))
1497 {
1498 queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1499 protocol, spi, FALSE, FALSE));
1500 }
1501 else
1502 {
1503 child_sa->set_state(child_sa, CHILD_REKEYING);
1504 cfg = child_sa->get_config(child_sa);
1505 task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1506 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1507 task->use_reqid(task, child_sa->get_reqid(child_sa));
1508 task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1509
1510 queue_task(this, &task->task);
1511 }
1512 }
1513 }
1514
1515 METHOD(task_manager_t, queue_child_delete, void,
1516 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1517 bool expired)
1518 {
1519 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1520 spi, FALSE, expired));
1521 }
1522
1523 METHOD(task_manager_t, queue_dpd, void,
1524 private_task_manager_t *this)
1525 {
1526 peer_cfg_t *peer_cfg;
1527 u_int32_t t, retransmit;
1528
1529 queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1530 this->dpd_send++));
1531 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1532
1533 /* compute timeout in milliseconds */
1534 t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1535 if (t == 0)
1536 {
1537 /* use the same timeout as a retransmitting IKE message would have */
1538 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1539 {
1540 t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1541 pow(this->retransmit_base, retransmit));
1542 }
1543 }
1544
1545 /* schedule DPD timeout job */
1546 lib->scheduler->schedule_job_ms(lib->scheduler,
1547 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1548 }
1549
1550 METHOD(task_manager_t, adopt_tasks, void,
1551 private_task_manager_t *this, task_manager_t *other_public)
1552 {
1553 private_task_manager_t *other = (private_task_manager_t*)other_public;
1554 task_t *task;
1555
1556 /* move queued tasks from other to this */
1557 while (other->queued_tasks->remove_last(other->queued_tasks,
1558 (void**)&task) == SUCCESS)
1559 {
1560 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1561 task->migrate(task, this->ike_sa);
1562 this->queued_tasks->insert_first(this->queued_tasks, task);
1563 }
1564 }
1565
1566 METHOD(task_manager_t, busy, bool,
1567 private_task_manager_t *this)
1568 {
1569 return (this->active_tasks->get_count(this->active_tasks) > 0);
1570 }
1571
1572 METHOD(task_manager_t, incr_mid, void,
1573 private_task_manager_t *this, bool initiate)
1574 {
1575 }
1576
1577 METHOD(task_manager_t, reset, void,
1578 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1579 {
1580 enumerator_t *enumerator;
1581 task_t *task;
1582
1583 /* reset message counters and retransmit packets */
1584 DESTROY_IF(this->responding.packet);
1585 DESTROY_IF(this->initiating.packet);
1586 this->responding.packet = NULL;
1587 this->responding.seqnr = RESPONDING_SEQ;
1588 this->responding.retransmitted = 0;
1589 this->initiating.packet = NULL;
1590 this->initiating.mid = 0;
1591 this->initiating.seqnr = 0;
1592 this->initiating.retransmitted = 0;
1593 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1594 if (initiate != UINT_MAX)
1595 {
1596 this->dpd_send = initiate;
1597 }
1598 if (respond != UINT_MAX)
1599 {
1600 this->dpd_recv = respond;
1601 }
1602
1603 /* reset queued tasks */
1604 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1605 while (enumerator->enumerate(enumerator, &task))
1606 {
1607 task->migrate(task, this->ike_sa);
1608 }
1609 enumerator->destroy(enumerator);
1610
1611 /* reset active tasks */
1612 while (this->active_tasks->remove_last(this->active_tasks,
1613 (void**)&task) == SUCCESS)
1614 {
1615 task->migrate(task, this->ike_sa);
1616 this->queued_tasks->insert_first(this->queued_tasks, task);
1617 }
1618 }
1619
1620 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1621 private_task_manager_t *this, task_queue_t queue)
1622 {
1623 switch (queue)
1624 {
1625 case TASK_QUEUE_ACTIVE:
1626 return this->active_tasks->create_enumerator(this->active_tasks);
1627 case TASK_QUEUE_PASSIVE:
1628 return this->passive_tasks->create_enumerator(this->passive_tasks);
1629 case TASK_QUEUE_QUEUED:
1630 return this->queued_tasks->create_enumerator(this->queued_tasks);
1631 default:
1632 return enumerator_create_empty();
1633 }
1634 }
1635
1636 METHOD(task_manager_t, destroy, void,
1637 private_task_manager_t *this)
1638 {
1639 flush(this);
1640
1641 this->active_tasks->destroy(this->active_tasks);
1642 this->queued_tasks->destroy(this->queued_tasks);
1643 this->passive_tasks->destroy(this->passive_tasks);
1644
1645 DESTROY_IF(this->queued);
1646 DESTROY_IF(this->responding.packet);
1647 DESTROY_IF(this->initiating.packet);
1648 DESTROY_IF(this->rng);
1649 free(this);
1650 }
1651
1652 /*
1653 * see header file
1654 */
1655 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1656 {
1657 private_task_manager_t *this;
1658
1659 INIT(this,
1660 .public = {
1661 .task_manager = {
1662 .process_message = _process_message,
1663 .queue_task = _queue_task,
1664 .queue_ike = _queue_ike,
1665 .queue_ike_rekey = _queue_ike_rekey,
1666 .queue_ike_reauth = _queue_ike_reauth,
1667 .queue_ike_delete = _queue_ike_delete,
1668 .queue_mobike = _queue_mobike,
1669 .queue_child = _queue_child,
1670 .queue_child_rekey = _queue_child_rekey,
1671 .queue_child_delete = _queue_child_delete,
1672 .queue_dpd = _queue_dpd,
1673 .initiate = _initiate,
1674 .retransmit = _retransmit,
1675 .incr_mid = _incr_mid,
1676 .reset = _reset,
1677 .adopt_tasks = _adopt_tasks,
1678 .busy = _busy,
1679 .create_task_enumerator = _create_task_enumerator,
1680 .flush_queue = _flush_queue,
1681 .destroy = _destroy,
1682 },
1683 },
1684 .initiating = {
1685 .type = EXCHANGE_TYPE_UNDEFINED,
1686 },
1687 .responding = {
1688 .seqnr = RESPONDING_SEQ,
1689 },
1690 .ike_sa = ike_sa,
1691 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1692 .queued_tasks = linked_list_create(),
1693 .active_tasks = linked_list_create(),
1694 .passive_tasks = linked_list_create(),
1695 .retransmit_tries = lib->settings->get_int(lib->settings,
1696 "%s.retransmit_tries", RETRANSMIT_TRIES, charon->name),
1697 .retransmit_timeout = lib->settings->get_double(lib->settings,
1698 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name),
1699 .retransmit_base = lib->settings->get_double(lib->settings,
1700 "%s.retransmit_base", RETRANSMIT_BASE, charon->name),
1701 );
1702
1703 if (!this->rng)
1704 {
1705 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
1706 destroy(this);
1707 return NULL;
1708 }
1709 if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
1710 (void*)&this->dpd_send))
1711 {
1712 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
1713 destroy(this);
1714 return NULL;
1715 }
1716 this->dpd_send &= 0x7FFFFFFF;
1717
1718 return &this->public;
1719 }
1720