3c84b5114f3177baa0716344c75c44f3993fa8e5
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/aggressive_mode.h>
24 #include <sa/ikev1/tasks/quick_mode.h>
25 #include <sa/ikev1/tasks/quick_delete.h>
26 #include <sa/ikev1/tasks/xauth.h>
27 #include <sa/ikev1/tasks/mode_config.h>
28 #include <sa/ikev1/tasks/informational.h>
29 #include <sa/ikev1/tasks/isakmp_natd.h>
30 #include <sa/ikev1/tasks/isakmp_vendor.h>
31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
33 #include <sa/ikev1/tasks/isakmp_delete.h>
34 #include <sa/ikev1/tasks/isakmp_dpd.h>
35
36 #include <processing/jobs/retransmit_job.h>
37 #include <processing/jobs/delete_ike_sa_job.h>
38 #include <processing/jobs/dpd_timeout_job.h>
39
40 /**
41 * Number of old messages hashes we keep for retransmission.
42 *
43 * In Main Mode, we must ignore messages from a previous message pair if
44 * we already continued to the next. Otherwise a late retransmission
45 * could be considered as a reply to the newer request.
46 */
47 #define MAX_OLD_HASHES 2
48
49 /**
50 * First sequence number of responding packets.
51 *
52 * To distinguish retransmission jobs for initiating and responding packets,
53 * we split up the sequence counter and use the upper half for responding.
54 */
55 #define RESPONDING_SEQ INT_MAX
56
57 typedef struct exchange_t exchange_t;
58
59 /**
60 * An exchange in the air, used do detect and handle retransmission
61 */
62 struct exchange_t {
63
64 /**
65 * Message ID used for this transaction
66 */
67 u_int32_t mid;
68
69 /**
70 * generated packet for retransmission
71 */
72 packet_t *packet;
73 };
74
75 typedef struct private_task_manager_t private_task_manager_t;
76
77 /**
78 * private data of the task manager
79 */
80 struct private_task_manager_t {
81
82 /**
83 * public functions
84 */
85 task_manager_v1_t public;
86
87 /**
88 * associated IKE_SA we are serving
89 */
90 ike_sa_t *ike_sa;
91
92 /**
93 * RNG to create message IDs
94 */
95 rng_t *rng;
96
97 /**
98 * Exchange we are currently handling as responder
99 */
100 struct {
101 /**
102 * Message ID of the last response
103 */
104 u_int32_t mid;
105
106 /**
107 * Hash of a previously received message
108 */
109 u_int32_t hash;
110
111 /**
112 * packet for retransmission
113 */
114 packet_t *packet;
115
116 /**
117 * Sequence number of the last sent message
118 */
119 u_int32_t seqnr;
120
121 /**
122 * how many times we have retransmitted so far
123 */
124 u_int retransmitted;
125
126 } responding;
127
128 /**
129 * Exchange we are currently handling as initiator
130 */
131 struct {
132 /**
133 * Message ID of the exchange
134 */
135 u_int32_t mid;
136
137 /**
138 * Hashes of old responses we can ignore
139 */
140 u_int32_t old_hashes[MAX_OLD_HASHES];
141
142 /**
143 * Position in old hash array
144 */
145 int old_hash_pos;
146
147 /**
148 * Sequence number of the last sent message
149 */
150 u_int32_t seqnr;
151
152 /**
153 * how many times we have retransmitted so far
154 */
155 u_int retransmitted;
156
157 /**
158 * packet for retransmission
159 */
160 packet_t *packet;
161
162 /**
163 * type of the initated exchange
164 */
165 exchange_type_t type;
166
167 } initiating;
168
169 /**
170 * List of queued tasks not yet in action
171 */
172 linked_list_t *queued_tasks;
173
174 /**
175 * List of active tasks, initiated by ourselve
176 */
177 linked_list_t *active_tasks;
178
179 /**
180 * List of tasks initiated by peer
181 */
182 linked_list_t *passive_tasks;
183
184 /**
185 * Queued messages not yet ready to process
186 */
187 message_t *queued;
188
189 /**
190 * Number of times we retransmit messages before giving up
191 */
192 u_int retransmit_tries;
193
194 /**
195 * Retransmission timeout
196 */
197 double retransmit_timeout;
198
199 /**
200 * Base to calculate retransmission timeout
201 */
202 double retransmit_base;
203
204 /**
205 * Sequence number for sending DPD requests
206 */
207 u_int32_t dpd_send;
208
209 /**
210 * Sequence number for received DPD requests
211 */
212 u_int32_t dpd_recv;
213 };
214
215 METHOD(task_manager_t, flush_queue, void,
216 private_task_manager_t *this, task_queue_t queue)
217 {
218 linked_list_t *list;
219 task_t *task;
220
221 if (this->queued)
222 {
223 this->queued->destroy(this->queued);
224 this->queued = NULL;
225 }
226 switch (queue)
227 {
228 case TASK_QUEUE_ACTIVE:
229 list = this->active_tasks;
230 /* cancel pending retransmits */
231 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
232 DESTROY_IF(this->initiating.packet);
233 this->initiating.packet = NULL;
234 break;
235 case TASK_QUEUE_PASSIVE:
236 list = this->passive_tasks;
237 break;
238 case TASK_QUEUE_QUEUED:
239 list = this->queued_tasks;
240 break;
241 default:
242 return;
243 }
244 while (list->remove_last(list, (void**)&task) == SUCCESS)
245 {
246 task->destroy(task);
247 }
248 }
249
250 /**
251 * flush all tasks in the task manager
252 */
253 static void flush(private_task_manager_t *this)
254 {
255 flush_queue(this, TASK_QUEUE_QUEUED);
256 flush_queue(this, TASK_QUEUE_PASSIVE);
257 flush_queue(this, TASK_QUEUE_ACTIVE);
258 }
259
260 /**
261 * move a task of a specific type from the queue to the active list
262 */
263 static bool activate_task(private_task_manager_t *this, task_type_t type)
264 {
265 enumerator_t *enumerator;
266 task_t *task;
267 bool found = FALSE;
268
269 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
270 while (enumerator->enumerate(enumerator, (void**)&task))
271 {
272 if (task->get_type(task) == type)
273 {
274 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
275 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
276 this->active_tasks->insert_last(this->active_tasks, task);
277 found = TRUE;
278 break;
279 }
280 }
281 enumerator->destroy(enumerator);
282 return found;
283 }
284
285 /**
286 * Retransmit a packet, either as initiator or as responder
287 */
288 static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
289 u_int mid, u_int retransmitted, packet_t *packet)
290 {
291 u_int32_t t;
292
293 if (retransmitted > this->retransmit_tries)
294 {
295 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
296 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
297 {
298 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
299 }
300 return DESTROY_ME;
301 }
302 t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
303 pow(this->retransmit_base, retransmitted));
304 if (retransmitted)
305 {
306 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
307 retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
308 mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
309 }
310 charon->sender->send(charon->sender, packet->clone(packet));
311 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
312 retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
313 return NEED_MORE;
314 }
315
316 METHOD(task_manager_t, retransmit, status_t,
317 private_task_manager_t *this, u_int32_t seqnr)
318 {
319 status_t status = SUCCESS;
320
321 if (seqnr == this->initiating.seqnr && this->initiating.packet)
322 {
323 status = retransmit_packet(this, seqnr, this->initiating.mid,
324 this->initiating.retransmitted, this->initiating.packet);
325 if (status == NEED_MORE)
326 {
327 this->initiating.retransmitted++;
328 status = SUCCESS;
329 }
330 }
331 if (seqnr == this->responding.seqnr && this->responding.packet)
332 {
333 status = retransmit_packet(this, seqnr, this->responding.mid,
334 this->responding.retransmitted, this->responding.packet);
335 if (status == NEED_MORE)
336 {
337 this->responding.retransmitted++;
338 status = SUCCESS;
339 }
340 }
341 return status;
342 }
343
344 /**
345 * Check if we have to wait for a mode config before starting a quick mode
346 */
347 static bool mode_config_expected(private_task_manager_t *this)
348 {
349 peer_cfg_t *peer_cfg;
350
351 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
352 if (peer_cfg && peer_cfg->get_pool(peer_cfg))
353 {
354 if (!this->ike_sa->get_virtual_ip(this->ike_sa, FALSE))
355 {
356 return TRUE;
357 }
358 }
359 return FALSE;
360 }
361
362 METHOD(task_manager_t, initiate, status_t,
363 private_task_manager_t *this)
364 {
365 enumerator_t *enumerator;
366 task_t *task;
367 message_t *message;
368 host_t *me, *other;
369 status_t status;
370 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
371 bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
372
373 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
374 this->initiating.type != INFORMATIONAL_V1)
375 {
376 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
377 exchange_type_names, this->initiating.type);
378 /* do not initiate if we already have a message in the air */
379 return SUCCESS;
380 }
381
382 if (this->active_tasks->get_count(this->active_tasks) == 0)
383 {
384 DBG2(DBG_IKE, "activating new tasks");
385 switch (this->ike_sa->get_state(this->ike_sa))
386 {
387 case IKE_CREATED:
388 activate_task(this, TASK_ISAKMP_VENDOR);
389 activate_task(this, TASK_ISAKMP_CERT_PRE);
390 if (activate_task(this, TASK_MAIN_MODE))
391 {
392 exchange = ID_PROT;
393 }
394 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
395 {
396 exchange = AGGRESSIVE;
397 }
398 activate_task(this, TASK_ISAKMP_CERT_POST);
399 activate_task(this, TASK_ISAKMP_NATD);
400 break;
401 case IKE_CONNECTING:
402 if (activate_task(this, TASK_ISAKMP_DELETE))
403 {
404 exchange = INFORMATIONAL_V1;
405 new_mid = TRUE;
406 break;
407 }
408 if (activate_task(this, TASK_XAUTH))
409 {
410 exchange = TRANSACTION;
411 new_mid = TRUE;
412 break;
413 }
414 if (activate_task(this, TASK_INFORMATIONAL))
415 {
416 exchange = INFORMATIONAL_V1;
417 new_mid = TRUE;
418 break;
419 }
420 break;
421 case IKE_ESTABLISHED:
422 if (activate_task(this, TASK_MODE_CONFIG))
423 {
424 exchange = TRANSACTION;
425 new_mid = TRUE;
426 break;
427 }
428 if (!mode_config_expected(this) &&
429 activate_task(this, TASK_QUICK_MODE))
430 {
431 exchange = QUICK_MODE;
432 new_mid = TRUE;
433 break;
434 }
435 if (activate_task(this, TASK_INFORMATIONAL))
436 {
437 exchange = INFORMATIONAL_V1;
438 new_mid = TRUE;
439 break;
440 }
441 if (activate_task(this, TASK_QUICK_DELETE))
442 {
443 exchange = INFORMATIONAL_V1;
444 new_mid = TRUE;
445 break;
446 }
447 if (activate_task(this, TASK_ISAKMP_DELETE))
448 {
449 exchange = INFORMATIONAL_V1;
450 new_mid = TRUE;
451 break;
452 }
453 if (activate_task(this, TASK_ISAKMP_DPD))
454 {
455 exchange = INFORMATIONAL_V1;
456 new_mid = TRUE;
457 break;
458 }
459 break;
460 default:
461 break;
462 }
463 }
464 else
465 {
466 DBG2(DBG_IKE, "reinitiating already active tasks");
467 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
468 while (enumerator->enumerate(enumerator, (void**)&task))
469 {
470 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
471 switch (task->get_type(task))
472 {
473 case TASK_MAIN_MODE:
474 exchange = ID_PROT;
475 break;
476 case TASK_AGGRESSIVE_MODE:
477 exchange = AGGRESSIVE;
478 break;
479 case TASK_QUICK_MODE:
480 exchange = QUICK_MODE;
481 break;
482 case TASK_XAUTH:
483 exchange = TRANSACTION;
484 new_mid = TRUE;
485 break;
486 default:
487 continue;
488 }
489 break;
490 }
491 enumerator->destroy(enumerator);
492 }
493
494 if (exchange == EXCHANGE_TYPE_UNDEFINED)
495 {
496 DBG2(DBG_IKE, "nothing to initiate");
497 /* nothing to do yet... */
498 return SUCCESS;
499 }
500
501 me = this->ike_sa->get_my_host(this->ike_sa);
502 other = this->ike_sa->get_other_host(this->ike_sa);
503
504 if (new_mid)
505 {
506 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
507 (void*)&this->initiating.mid))
508 {
509 DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
510 flush(this);
511 return DESTROY_ME;
512 }
513 }
514 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
515 message->set_message_id(message, this->initiating.mid);
516 message->set_source(message, me->clone(me));
517 message->set_destination(message, other->clone(other));
518 message->set_exchange_type(message, exchange);
519 this->initiating.type = exchange;
520 this->initiating.retransmitted = 0;
521
522 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
523 while (enumerator->enumerate(enumerator, (void*)&task))
524 {
525 switch (task->build(task, message))
526 {
527 case SUCCESS:
528 /* task completed, remove it */
529 this->active_tasks->remove_at(this->active_tasks, enumerator);
530 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
531 task->get_type(task) == TASK_QUICK_MODE)
532 { /* last message of three message exchange */
533 keep = TRUE;
534 }
535 task->destroy(task);
536 continue;
537 case NEED_MORE:
538 expect_response = TRUE;
539 /* processed, but task needs another exchange */
540 continue;
541 case ALREADY_DONE:
542 cancelled = TRUE;
543 break;
544 case FAILED:
545 default:
546 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
547 {
548 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
549 }
550 /* FALL */
551 case DESTROY_ME:
552 /* critical failure, destroy IKE_SA */
553 enumerator->destroy(enumerator);
554 message->destroy(message);
555 flush(this);
556 return DESTROY_ME;
557 }
558 break;
559 }
560 enumerator->destroy(enumerator);
561
562 if (this->active_tasks->get_count(this->active_tasks) == 0 &&
563 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
564 { /* tasks completed, no exchange active anymore */
565 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
566 }
567 if (cancelled)
568 {
569 message->destroy(message);
570 return initiate(this);
571 }
572
573 DESTROY_IF(this->initiating.packet);
574 status = this->ike_sa->generate_message(this->ike_sa, message,
575 &this->initiating.packet);
576 if (status != SUCCESS)
577 {
578 /* message generation failed. There is nothing more to do than to
579 * close the SA */
580 message->destroy(message);
581 flush(this);
582 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
583 return DESTROY_ME;
584 }
585
586 this->initiating.seqnr++;
587 if (expect_response )
588 {
589 message->destroy(message);
590 return retransmit(this, this->initiating.seqnr);
591 }
592 if (keep)
593 { /* keep the packet for retransmission, the responder might request it */
594 charon->sender->send(charon->sender,
595 this->initiating.packet->clone(this->initiating.packet));
596 }
597 else
598 {
599 charon->sender->send(charon->sender, this->initiating.packet);
600 this->initiating.packet = NULL;
601 }
602 message->destroy(message);
603
604 if (exchange == INFORMATIONAL_V1)
605 {
606 switch (this->ike_sa->get_state(this->ike_sa))
607 {
608 case IKE_CONNECTING:
609 /* close after sending an INFORMATIONAL when unestablished */
610 return FAILED;
611 case IKE_DELETING:
612 /* close after sending a DELETE */
613 return DESTROY_ME;
614 default:
615 break;
616 }
617 }
618 return initiate(this);
619 }
620
621 /**
622 * build a response depending on the "passive" task list
623 */
624 static status_t build_response(private_task_manager_t *this, message_t *request)
625 {
626 enumerator_t *enumerator;
627 task_t *task;
628 message_t *message;
629 host_t *me, *other;
630 bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
631 status_t status;
632
633 me = request->get_destination(request);
634 other = request->get_source(request);
635
636 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
637 message->set_exchange_type(message, request->get_exchange_type(request));
638 /* send response along the path the request came in */
639 message->set_source(message, me->clone(me));
640 message->set_destination(message, other->clone(other));
641 message->set_message_id(message, request->get_message_id(request));
642 message->set_request(message, FALSE);
643
644 this->responding.mid = request->get_message_id(request);
645 this->responding.retransmitted = 0;
646 this->responding.seqnr++;
647
648 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
649 while (enumerator->enumerate(enumerator, (void*)&task))
650 {
651 switch (task->build(task, message))
652 {
653 case SUCCESS:
654 /* task completed, remove it */
655 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
656 task->destroy(task);
657 continue;
658 case NEED_MORE:
659 /* processed, but task needs another exchange */
660 if (task->get_type(task) == TASK_QUICK_MODE ||
661 task->get_type(task) == TASK_AGGRESSIVE_MODE)
662 { /* we rely on initiator retransmission, except for
663 * three-message exchanges */
664 expect_request = TRUE;
665 }
666 continue;
667 case ALREADY_DONE:
668 cancelled = TRUE;
669 break;
670 case FAILED:
671 default:
672 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
673 /* FALL */
674 case DESTROY_ME:
675 /* destroy IKE_SA, but SEND response first */
676 delete = TRUE;
677 break;
678 }
679 break;
680 }
681 enumerator->destroy(enumerator);
682
683 DESTROY_IF(this->responding.packet);
684 this->responding.packet = NULL;
685 if (cancelled)
686 {
687 message->destroy(message);
688 return initiate(this);
689 }
690 status = this->ike_sa->generate_message(this->ike_sa, message,
691 &this->responding.packet);
692 message->destroy(message);
693 if (status != SUCCESS)
694 {
695 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
696 return DESTROY_ME;
697 }
698
699 if (expect_request && !delete)
700 {
701 return retransmit(this, this->responding.seqnr);
702 }
703 charon->sender->send(charon->sender,
704 this->responding.packet->clone(this->responding.packet));
705 if (delete)
706 {
707 return DESTROY_ME;
708 }
709 return SUCCESS;
710 }
711
712 /**
713 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
714 * The notify protocol_id is set to ISAKMP
715 */
716 static void send_notify(private_task_manager_t *this, message_t *request,
717 notify_type_t type)
718 {
719 message_t *response;
720 packet_t *packet;
721 host_t *me, *other;
722 u_int32_t mid;
723
724 if (request && request->get_exchange_type(request) == INFORMATIONAL_V1)
725 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
726 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
727 return;
728 }
729 if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
730 {
731 DBG1(DBG_IKE, "failed to allocate message ID");
732 return;
733 }
734 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
735 response->set_exchange_type(response, INFORMATIONAL_V1);
736 response->set_request(response, TRUE);
737 response->set_message_id(response, mid);
738 response->add_payload(response, (payload_t*)
739 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
740 PROTO_IKE, type));
741
742 me = this->ike_sa->get_my_host(this->ike_sa);
743 if (me->is_anyaddr(me))
744 {
745 me = request->get_destination(request);
746 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
747 }
748 other = this->ike_sa->get_other_host(this->ike_sa);
749 if (other->is_anyaddr(other))
750 {
751 other = request->get_source(request);
752 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
753 }
754 response->set_source(response, me->clone(me));
755 response->set_destination(response, other->clone(other));
756 if (this->ike_sa->generate_message(this->ike_sa, response,
757 &packet) == SUCCESS)
758 {
759 charon->sender->send(charon->sender, packet);
760 }
761 response->destroy(response);
762 }
763
764 /**
765 * Process a DPD request/response
766 */
767 static bool process_dpd(private_task_manager_t *this, message_t *message)
768 {
769 notify_payload_t *notify;
770 notify_type_t type;
771 u_int32_t seq;
772 chunk_t data;
773
774 type = DPD_R_U_THERE;
775 notify = message->get_notify(message, type);
776 if (!notify)
777 {
778 type = DPD_R_U_THERE_ACK;
779 notify = message->get_notify(message, type);
780 }
781 if (!notify)
782 {
783 return FALSE;
784 }
785 data = notify->get_notification_data(notify);
786 if (data.len != 4)
787 {
788 return FALSE;
789 }
790 seq = untoh32(data.ptr);
791
792 if (type == DPD_R_U_THERE)
793 {
794 if (this->dpd_recv == 0 || seq == this->dpd_recv)
795 { /* check sequence validity */
796 this->dpd_recv = seq + 1;
797 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
798 time_monotonic(NULL));
799 }
800 /* but respond anyway */
801 this->ike_sa->queue_task(this->ike_sa,
802 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
803 }
804 else /* DPD_R_U_THERE_ACK */
805 {
806 if (seq == this->dpd_send - 1)
807 {
808 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
809 time_monotonic(NULL));
810 }
811 else
812 {
813 DBG1(DBG_IKE, "received invalid DPD sequence number %u "
814 "(expected %u), ignored", seq, this->dpd_send - 1);
815 }
816 }
817 return TRUE;
818 }
819
820 /**
821 * handle an incoming request message
822 */
823 static status_t process_request(private_task_manager_t *this,
824 message_t *message)
825 {
826 enumerator_t *enumerator;
827 task_t *task = NULL;
828 bool send_response = FALSE, dpd = FALSE;
829
830 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
831 this->passive_tasks->get_count(this->passive_tasks) == 0)
832 { /* create tasks depending on request type, if not already some queued */
833 switch (message->get_exchange_type(message))
834 {
835 case ID_PROT:
836 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
837 this->passive_tasks->insert_last(this->passive_tasks, task);
838 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
839 this->passive_tasks->insert_last(this->passive_tasks, task);
840 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
841 this->passive_tasks->insert_last(this->passive_tasks, task);
842 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
843 this->passive_tasks->insert_last(this->passive_tasks, task);
844 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
845 this->passive_tasks->insert_last(this->passive_tasks, task);
846 break;
847 case AGGRESSIVE:
848 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
849 this->passive_tasks->insert_last(this->passive_tasks, task);
850 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
851 this->passive_tasks->insert_last(this->passive_tasks, task);
852 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
853 this->passive_tasks->insert_last(this->passive_tasks, task);
854 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
855 this->passive_tasks->insert_last(this->passive_tasks, task);
856 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
857 this->passive_tasks->insert_last(this->passive_tasks, task);
858 break;
859 case QUICK_MODE:
860 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
861 {
862 DBG1(DBG_IKE, "received quick mode request for "
863 "unestablished IKE_SA, ignored");
864 return FAILED;
865 }
866 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
867 NULL, NULL);
868 this->passive_tasks->insert_last(this->passive_tasks, task);
869 break;
870 case INFORMATIONAL_V1:
871 if (process_dpd(this, message))
872 {
873 dpd = TRUE;
874 }
875 else
876 {
877 task = (task_t *)informational_create(this->ike_sa, NULL);
878 this->passive_tasks->insert_first(this->passive_tasks, task);
879 }
880 break;
881 case TRANSACTION:
882 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
883 {
884 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
885 }
886 else
887 {
888 task = (task_t *)xauth_create(this->ike_sa, FALSE);
889 }
890 this->passive_tasks->insert_last(this->passive_tasks, task);
891 break;
892 default:
893 return FAILED;
894 }
895 }
896 if (dpd)
897 {
898 return initiate(this);
899 }
900 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
901
902 /* let the tasks process the message */
903 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
904 while (enumerator->enumerate(enumerator, (void*)&task))
905 {
906 switch (task->process(task, message))
907 {
908 case SUCCESS:
909 /* task completed, remove it */
910 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
911 task->destroy(task);
912 continue;
913 case NEED_MORE:
914 /* processed, but task needs at least another call to build() */
915 send_response = TRUE;
916 continue;
917 case ALREADY_DONE:
918 send_response = FALSE;
919 break;
920 case FAILED:
921 default:
922 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
923 /* FALL */
924 case DESTROY_ME:
925 /* critical failure, destroy IKE_SA */
926 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
927 enumerator->destroy(enumerator);
928 task->destroy(task);
929 return DESTROY_ME;
930 }
931 break;
932 }
933 enumerator->destroy(enumerator);
934
935 if (send_response)
936 {
937 if (build_response(this, message) != SUCCESS)
938 {
939 return DESTROY_ME;
940 }
941 }
942 else
943 { /* We don't send a response, so don't retransmit one if we get
944 * the same message again. */
945 DESTROY_IF(this->responding.packet);
946 this->responding.packet = NULL;
947 }
948 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
949 this->queued_tasks->get_count(this->queued_tasks) > 0)
950 {
951 /* passive tasks completed, check if an active task has been queued,
952 * such as XAUTH or modeconfig push */
953 return initiate(this);
954 }
955 return SUCCESS;
956 }
957
958 /**
959 * handle an incoming response message
960 */
961 static status_t process_response(private_task_manager_t *this,
962 message_t *message)
963 {
964 enumerator_t *enumerator;
965 message_t *queued;
966 status_t status;
967 task_t *task;
968
969 if (message->get_exchange_type(message) != this->initiating.type)
970 {
971 DBG1(DBG_IKE, "received %N response, but expected %N",
972 exchange_type_names, message->get_exchange_type(message),
973 exchange_type_names, this->initiating.type);
974 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
975 return DESTROY_ME;
976 }
977
978 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
979 while (enumerator->enumerate(enumerator, (void*)&task))
980 {
981 switch (task->process(task, message))
982 {
983 case SUCCESS:
984 /* task completed, remove it */
985 this->active_tasks->remove_at(this->active_tasks, enumerator);
986 task->destroy(task);
987 continue;
988 case NEED_MORE:
989 /* processed, but task needs another exchange */
990 continue;
991 case ALREADY_DONE:
992 break;
993 case FAILED:
994 default:
995 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
996 /* FALL */
997 case DESTROY_ME:
998 /* critical failure, destroy IKE_SA */
999 this->active_tasks->remove_at(this->active_tasks, enumerator);
1000 enumerator->destroy(enumerator);
1001 task->destroy(task);
1002 return DESTROY_ME;
1003 }
1004 break;
1005 }
1006 enumerator->destroy(enumerator);
1007
1008 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1009 DESTROY_IF(this->initiating.packet);
1010 this->initiating.packet = NULL;
1011
1012 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
1013 {
1014 queued = this->queued;
1015 this->queued = NULL;
1016 status = this->public.task_manager.process_message(
1017 &this->public.task_manager, queued);
1018 queued->destroy(queued);
1019 if (status == DESTROY_ME)
1020 {
1021 return status;
1022 }
1023 }
1024
1025 return initiate(this);
1026 }
1027
1028 /**
1029 * Parse the given message and verify that it is valid.
1030 */
1031 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1032 {
1033 status_t status;
1034
1035 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1036
1037 if (status != SUCCESS)
1038 {
1039 switch (status)
1040 {
1041 case NOT_SUPPORTED:
1042 DBG1(DBG_IKE, "unsupported exchange type");
1043 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1044 break;
1045 case PARSE_ERROR:
1046 DBG1(DBG_IKE, "message parsing failed");
1047 send_notify(this, msg, PAYLOAD_MALFORMED);
1048 break;
1049 case VERIFY_ERROR:
1050 DBG1(DBG_IKE, "message verification failed");
1051 send_notify(this, msg, PAYLOAD_MALFORMED);
1052 break;
1053 case FAILED:
1054 DBG1(DBG_IKE, "integrity check failed");
1055 send_notify(this, msg, INVALID_HASH_INFORMATION);
1056 break;
1057 case INVALID_STATE:
1058 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1059 send_notify(this, msg, PAYLOAD_MALFORMED);
1060 default:
1061 break;
1062 }
1063 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1064 exchange_type_names, msg->get_exchange_type(msg),
1065 msg->get_request(msg) ? "request" : "response",
1066 msg->get_message_id(msg));
1067
1068 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1069 { /* invalid initiation attempt, close SA */
1070 return DESTROY_ME;
1071 }
1072 }
1073 return status;
1074 }
1075
1076 METHOD(task_manager_t, process_message, status_t,
1077 private_task_manager_t *this, message_t *msg)
1078 {
1079 u_int32_t hash, mid, i;
1080 host_t *me, *other;
1081 status_t status;
1082
1083 /* TODO-IKEv1: update hosts more selectively */
1084 me = msg->get_destination(msg);
1085 other = msg->get_source(msg);
1086 mid = msg->get_message_id(msg);
1087 hash = chunk_hash(msg->get_packet_data(msg));
1088 for (i = 0; i < MAX_OLD_HASHES; i++)
1089 {
1090 if (this->initiating.old_hashes[i] == hash)
1091 {
1092 if (this->initiating.packet &&
1093 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1094 (msg->get_exchange_type(msg) == QUICK_MODE ||
1095 msg->get_exchange_type(msg) == AGGRESSIVE))
1096 {
1097 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1098 "resending last request", mid);
1099 charon->sender->send(charon->sender,
1100 this->initiating.packet->clone(this->initiating.packet));
1101 return SUCCESS;
1102 }
1103 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1104 "but next request already sent", mid);
1105 return SUCCESS;
1106 }
1107 }
1108
1109 if ((mid && mid == this->initiating.mid) ||
1110 (this->initiating.mid == 0 &&
1111 msg->get_exchange_type(msg) == this->initiating.type &&
1112 this->active_tasks->get_count(this->active_tasks)))
1113 {
1114 msg->set_request(msg, FALSE);
1115 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1116 status = parse_message(this, msg);
1117 if (status != SUCCESS)
1118 {
1119 return status;
1120 }
1121 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1122 time_monotonic(NULL));
1123 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1124 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1125 if (process_response(this, msg) != SUCCESS)
1126 {
1127 flush(this);
1128 return DESTROY_ME;
1129 }
1130 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1131 MAX_OLD_HASHES] = hash;
1132 }
1133 else
1134 {
1135 if (hash == this->responding.hash)
1136 {
1137 if (this->responding.packet)
1138 {
1139 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1140 "retransmitting response", mid);
1141 charon->sender->send(charon->sender,
1142 this->responding.packet->clone(this->responding.packet));
1143 }
1144 else if (this->initiating.packet &&
1145 this->initiating.type == INFORMATIONAL_V1)
1146 {
1147 DBG1(DBG_IKE, "received retransmit of DPD request, "
1148 "retransmitting response");
1149 charon->sender->send(charon->sender,
1150 this->initiating.packet->clone(this->initiating.packet));
1151 }
1152 else
1153 {
1154 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1155 "but no response to retransmit", mid);
1156 }
1157 return SUCCESS;
1158 }
1159 if (msg->get_exchange_type(msg) == TRANSACTION &&
1160 this->active_tasks->get_count(this->active_tasks))
1161 { /* main mode not yet complete, queue XAuth/Mode config tasks */
1162 if (this->queued)
1163 {
1164 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
1165 exchange_type_names, TRANSACTION);
1166 return SUCCESS;
1167 }
1168 this->queued = message_create_from_packet(msg->get_packet(msg));
1169 if (this->queued->parse_header(this->queued) != SUCCESS)
1170 {
1171 this->queued->destroy(this->queued);
1172 this->queued = NULL;
1173 return FAILED;
1174 }
1175 DBG1(DBG_IKE, "queueing %N request as tasks still active",
1176 exchange_type_names, TRANSACTION);
1177 return SUCCESS;
1178 }
1179
1180 msg->set_request(msg, TRUE);
1181 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1182 status = parse_message(this, msg);
1183 if (status != SUCCESS)
1184 {
1185 return status;
1186 }
1187 /* if this IKE_SA is virgin, we check for a config */
1188 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1189 {
1190 ike_sa_id_t *ike_sa_id;
1191 ike_cfg_t *ike_cfg;
1192 job_t *job;
1193
1194 ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
1195 if (ike_cfg == NULL)
1196 {
1197 /* no config found for these hosts, destroy */
1198 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1199 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1200 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1201 return DESTROY_ME;
1202 }
1203 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1204 ike_cfg->destroy(ike_cfg);
1205 /* add a timeout if peer does not establish it completely */
1206 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1207 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1208 lib->scheduler->schedule_job(lib->scheduler, job,
1209 lib->settings->get_int(lib->settings,
1210 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1211 charon->name));
1212 }
1213 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1214 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1215 if (process_request(this, msg) != SUCCESS)
1216 {
1217 flush(this);
1218 return DESTROY_ME;
1219 }
1220 this->responding.hash = hash;
1221 }
1222 return SUCCESS;
1223 }
1224
1225 METHOD(task_manager_t, queue_task, void,
1226 private_task_manager_t *this, task_t *task)
1227 {
1228 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1229 this->queued_tasks->insert_last(this->queued_tasks, task);
1230 }
1231
1232 /**
1233 * Check if a given task has been queued already
1234 */
1235 static bool has_queued(private_task_manager_t *this, task_type_t type)
1236 {
1237 enumerator_t *enumerator;
1238 bool found = FALSE;
1239 task_t *task;
1240
1241 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1242 while (enumerator->enumerate(enumerator, &task))
1243 {
1244 if (task->get_type(task) == type)
1245 {
1246 found = TRUE;
1247 break;
1248 }
1249 }
1250 enumerator->destroy(enumerator);
1251 return found;
1252 }
1253
1254 METHOD(task_manager_t, queue_ike, void,
1255 private_task_manager_t *this)
1256 {
1257 peer_cfg_t *peer_cfg;
1258
1259 if (!has_queued(this, TASK_ISAKMP_VENDOR))
1260 {
1261 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1262 }
1263 if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1264 {
1265 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1266 }
1267 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1268 if (peer_cfg->use_aggressive(peer_cfg))
1269 {
1270 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1271 {
1272 queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1273 }
1274 }
1275 else
1276 {
1277 if (!has_queued(this, TASK_MAIN_MODE))
1278 {
1279 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1280 }
1281 }
1282 if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1283 {
1284 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1285 }
1286 if (!has_queued(this, TASK_ISAKMP_NATD))
1287 {
1288 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1289 }
1290 }
1291
1292 METHOD(task_manager_t, queue_ike_reauth, void,
1293 private_task_manager_t *this)
1294 {
1295 enumerator_t *enumerator;
1296 child_sa_t *child_sa;
1297 ike_sa_t *new;
1298 host_t *host;
1299
1300 new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1301 this->ike_sa->get_version(this->ike_sa), TRUE);
1302 if (!new)
1303 { /* shouldn't happen */
1304 return;
1305 }
1306
1307 new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1308 host = this->ike_sa->get_other_host(this->ike_sa);
1309 new->set_other_host(new, host->clone(host));
1310 host = this->ike_sa->get_my_host(this->ike_sa);
1311 new->set_my_host(new, host->clone(host));
1312 host = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
1313 if (host)
1314 {
1315 new->set_virtual_ip(new, TRUE, host);
1316 }
1317
1318 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1319 while (enumerator->enumerate(enumerator, &child_sa))
1320 {
1321 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1322 new->add_child_sa(new, child_sa);
1323 }
1324 enumerator->destroy(enumerator);
1325
1326 if (!new->get_child_count(new))
1327 { /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1328 task_t *task;
1329
1330 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1331 while (enumerator->enumerate(enumerator, &task))
1332 {
1333 if (task->get_type(task) == TASK_QUICK_MODE)
1334 {
1335 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1336 task->migrate(task, new);
1337 new->queue_task(new, task);
1338 }
1339 }
1340 enumerator->destroy(enumerator);
1341 }
1342
1343 if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1344 {
1345 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1346 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1347 }
1348 else
1349 {
1350 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1351 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1352 }
1353 charon->bus->set_sa(charon->bus, this->ike_sa);
1354 }
1355
1356 METHOD(task_manager_t, queue_ike_rekey, void,
1357 private_task_manager_t *this)
1358 {
1359 queue_ike_reauth(this);
1360 }
1361
1362 METHOD(task_manager_t, queue_ike_delete, void,
1363 private_task_manager_t *this)
1364 {
1365 enumerator_t *enumerator;
1366 child_sa_t *child_sa;
1367
1368 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1369 while (enumerator->enumerate(enumerator, &child_sa))
1370 {
1371 queue_task(this, (task_t*)
1372 quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1373 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1374 }
1375 enumerator->destroy(enumerator);
1376
1377 queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1378 }
1379
1380 METHOD(task_manager_t, queue_mobike, void,
1381 private_task_manager_t *this, bool roam, bool address)
1382 {
1383 /* Not supported in IKEv1 */
1384 }
1385
1386 METHOD(task_manager_t, queue_child, void,
1387 private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1388 traffic_selector_t *tsi, traffic_selector_t *tsr)
1389 {
1390 quick_mode_t *task;
1391
1392 task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1393 task->use_reqid(task, reqid);
1394
1395 queue_task(this, &task->task);
1396 }
1397
1398 /**
1399 * Check if two CHILD_SAs have the same traffic selector
1400 */
1401 static bool have_equal_ts(child_sa_t *a, child_sa_t *b, bool local)
1402 {
1403 linked_list_t *list;
1404 traffic_selector_t *ts_a, *ts_b;
1405
1406 list = a->get_traffic_selectors(a, local);
1407 if (list->get_first(list, (void**)&ts_a) == SUCCESS)
1408 {
1409 list = b->get_traffic_selectors(b, local);
1410 if (list->get_first(list, (void**)&ts_b) == SUCCESS)
1411 {
1412 return ts_a->equals(ts_a, ts_b);
1413 }
1414 }
1415 return FALSE;
1416 }
1417
1418 /**
1419 * Check if a CHILD_SA is redundant and we should delete instead of rekey
1420 */
1421 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1422 {
1423 enumerator_t *enumerator;
1424 child_sa_t *current;
1425 bool redundant = FALSE;
1426
1427 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1428 while (enumerator->enumerate(enumerator, &current))
1429 {
1430 if (current->get_state(current) == CHILD_INSTALLED &&
1431 streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1432 have_equal_ts(current, child_sa, TRUE) &&
1433 have_equal_ts(current, child_sa, FALSE) &&
1434 current->get_lifetime(current, FALSE) >
1435 child_sa->get_lifetime(child_sa, FALSE))
1436 {
1437 DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1438 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
1439 redundant = TRUE;
1440 break;
1441 }
1442 }
1443 enumerator->destroy(enumerator);
1444
1445 return redundant;
1446 }
1447
1448 /**
1449 * Get the first traffic selector of a CHILD_SA, local or remote
1450 */
1451 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1452 {
1453 traffic_selector_t *ts = NULL;
1454 linked_list_t *list;
1455
1456 list = child_sa->get_traffic_selectors(child_sa, local);
1457 if (list->get_first(list, (void**)&ts) == SUCCESS)
1458 {
1459 return ts;
1460 }
1461 return NULL;
1462 }
1463
1464 METHOD(task_manager_t, queue_child_rekey, void,
1465 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1466 {
1467 child_sa_t *child_sa;
1468 child_cfg_t *cfg;
1469 quick_mode_t *task;
1470
1471 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1472 if (!child_sa)
1473 {
1474 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1475 }
1476 if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1477 {
1478 if (is_redundant(this, child_sa))
1479 {
1480 queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1481 protocol, spi, FALSE, FALSE));
1482 }
1483 else
1484 {
1485 child_sa->set_state(child_sa, CHILD_REKEYING);
1486 cfg = child_sa->get_config(child_sa);
1487 task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1488 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1489 task->use_reqid(task, child_sa->get_reqid(child_sa));
1490 task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1491
1492 queue_task(this, &task->task);
1493 }
1494 }
1495 }
1496
1497 METHOD(task_manager_t, queue_child_delete, void,
1498 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1499 bool expired)
1500 {
1501 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1502 spi, FALSE, expired));
1503 }
1504
1505 METHOD(task_manager_t, queue_dpd, void,
1506 private_task_manager_t *this)
1507 {
1508 peer_cfg_t *peer_cfg;
1509 u_int32_t t, retransmit;
1510
1511 queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1512 this->dpd_send++));
1513 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1514
1515 /* compute timeout in milliseconds */
1516 t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1517 if (t == 0)
1518 {
1519 /* use the same timeout as a retransmitting IKE message would have */
1520 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1521 {
1522 t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1523 pow(this->retransmit_base, retransmit));
1524 }
1525 }
1526
1527 /* schedule DPD timeout job */
1528 lib->scheduler->schedule_job_ms(lib->scheduler,
1529 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1530 }
1531
1532 METHOD(task_manager_t, adopt_tasks, void,
1533 private_task_manager_t *this, task_manager_t *other_public)
1534 {
1535 private_task_manager_t *other = (private_task_manager_t*)other_public;
1536 task_t *task;
1537
1538 /* move queued tasks from other to this */
1539 while (other->queued_tasks->remove_last(other->queued_tasks,
1540 (void**)&task) == SUCCESS)
1541 {
1542 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1543 task->migrate(task, this->ike_sa);
1544 this->queued_tasks->insert_first(this->queued_tasks, task);
1545 }
1546 }
1547
1548 METHOD(task_manager_t, busy, bool,
1549 private_task_manager_t *this)
1550 {
1551 return (this->active_tasks->get_count(this->active_tasks) > 0);
1552 }
1553
1554 METHOD(task_manager_t, incr_mid, void,
1555 private_task_manager_t *this, bool initiate)
1556 {
1557 }
1558
1559 METHOD(task_manager_t, reset, void,
1560 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1561 {
1562 enumerator_t *enumerator;
1563 task_t *task;
1564
1565 /* reset message counters and retransmit packets */
1566 DESTROY_IF(this->responding.packet);
1567 DESTROY_IF(this->initiating.packet);
1568 this->responding.packet = NULL;
1569 this->responding.seqnr = RESPONDING_SEQ;
1570 this->responding.retransmitted = 0;
1571 this->initiating.packet = NULL;
1572 this->initiating.mid = 0;
1573 this->initiating.seqnr = 0;
1574 this->initiating.retransmitted = 0;
1575 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1576 if (initiate != UINT_MAX)
1577 {
1578 this->dpd_send = initiate;
1579 }
1580 if (respond != UINT_MAX)
1581 {
1582 this->dpd_recv = respond;
1583 }
1584
1585 /* reset queued tasks */
1586 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1587 while (enumerator->enumerate(enumerator, &task))
1588 {
1589 task->migrate(task, this->ike_sa);
1590 }
1591 enumerator->destroy(enumerator);
1592
1593 /* reset active tasks */
1594 while (this->active_tasks->remove_last(this->active_tasks,
1595 (void**)&task) == SUCCESS)
1596 {
1597 task->migrate(task, this->ike_sa);
1598 this->queued_tasks->insert_first(this->queued_tasks, task);
1599 }
1600 }
1601
1602 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1603 private_task_manager_t *this, task_queue_t queue)
1604 {
1605 switch (queue)
1606 {
1607 case TASK_QUEUE_ACTIVE:
1608 return this->active_tasks->create_enumerator(this->active_tasks);
1609 case TASK_QUEUE_PASSIVE:
1610 return this->passive_tasks->create_enumerator(this->passive_tasks);
1611 case TASK_QUEUE_QUEUED:
1612 return this->queued_tasks->create_enumerator(this->queued_tasks);
1613 default:
1614 return enumerator_create_empty();
1615 }
1616 }
1617
1618 METHOD(task_manager_t, destroy, void,
1619 private_task_manager_t *this)
1620 {
1621 flush(this);
1622
1623 this->active_tasks->destroy(this->active_tasks);
1624 this->queued_tasks->destroy(this->queued_tasks);
1625 this->passive_tasks->destroy(this->passive_tasks);
1626
1627 DESTROY_IF(this->queued);
1628 DESTROY_IF(this->responding.packet);
1629 DESTROY_IF(this->initiating.packet);
1630 DESTROY_IF(this->rng);
1631 free(this);
1632 }
1633
1634 /*
1635 * see header file
1636 */
1637 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1638 {
1639 private_task_manager_t *this;
1640
1641 INIT(this,
1642 .public = {
1643 .task_manager = {
1644 .process_message = _process_message,
1645 .queue_task = _queue_task,
1646 .queue_ike = _queue_ike,
1647 .queue_ike_rekey = _queue_ike_rekey,
1648 .queue_ike_reauth = _queue_ike_reauth,
1649 .queue_ike_delete = _queue_ike_delete,
1650 .queue_mobike = _queue_mobike,
1651 .queue_child = _queue_child,
1652 .queue_child_rekey = _queue_child_rekey,
1653 .queue_child_delete = _queue_child_delete,
1654 .queue_dpd = _queue_dpd,
1655 .initiate = _initiate,
1656 .retransmit = _retransmit,
1657 .incr_mid = _incr_mid,
1658 .reset = _reset,
1659 .adopt_tasks = _adopt_tasks,
1660 .busy = _busy,
1661 .create_task_enumerator = _create_task_enumerator,
1662 .flush_queue = _flush_queue,
1663 .destroy = _destroy,
1664 },
1665 },
1666 .initiating = {
1667 .type = EXCHANGE_TYPE_UNDEFINED,
1668 },
1669 .responding = {
1670 .seqnr = RESPONDING_SEQ,
1671 },
1672 .ike_sa = ike_sa,
1673 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1674 .queued_tasks = linked_list_create(),
1675 .active_tasks = linked_list_create(),
1676 .passive_tasks = linked_list_create(),
1677 .retransmit_tries = lib->settings->get_int(lib->settings,
1678 "%s.retransmit_tries", RETRANSMIT_TRIES, charon->name),
1679 .retransmit_timeout = lib->settings->get_double(lib->settings,
1680 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name),
1681 .retransmit_base = lib->settings->get_double(lib->settings,
1682 "%s.retransmit_base", RETRANSMIT_BASE, charon->name),
1683 );
1684
1685 if (!this->rng)
1686 {
1687 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
1688 destroy(this);
1689 return NULL;
1690 }
1691 if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
1692 (void*)&this->dpd_send))
1693 {
1694 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
1695 destroy(this);
1696 return NULL;
1697 }
1698 this->dpd_send &= 0x7FFFFFFF;
1699
1700 return &this->public;
1701 }
1702