projects / strongswan.git / blob
? search:


5b7258fad02bca7c6e5af98d39e8822faf7213aa
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/aggressive_mode.h>
24 #include <sa/ikev1/tasks/quick_mode.h>
25 #include <sa/ikev1/tasks/quick_delete.h>
26 #include <sa/ikev1/tasks/xauth.h>
27 #include <sa/ikev1/tasks/mode_config.h>
28 #include <sa/ikev1/tasks/informational.h>
29 #include <sa/ikev1/tasks/isakmp_natd.h>
30 #include <sa/ikev1/tasks/isakmp_vendor.h>
31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
33 #include <sa/ikev1/tasks/isakmp_delete.h>
34 #include <sa/ikev1/tasks/isakmp_dpd.h>
35
36 #include <processing/jobs/retransmit_job.h>
37 #include <processing/jobs/delete_ike_sa_job.h>
38 #include <processing/jobs/dpd_timeout_job.h>
39
40 /**
41 * Number of old messages hashes we keep for retransmission.
42 *
43 * In Main Mode, we must ignore messages from a previous message pair if
44 * we already continued to the next. Otherwise a late retransmission
45 * could be considered as a reply to the newer request.
46 */
47 #define MAX_OLD_HASHES 2
48
49 /**
50 * First sequence number of responding packets.
51 *
52 * To distinguish retransmission jobs for initiating and responding packets,
53 * we split up the sequence counter and use the upper half for responding.
54 */
55 #define RESPONDING_SEQ INT_MAX
56
57 typedef struct exchange_t exchange_t;
58
59 /**
60 * An exchange in the air, used do detect and handle retransmission
61 */
62 struct exchange_t {
63
64 /**
65 * Message ID used for this transaction
66 */
67 u_int32_t mid;
68
69 /**
70 * generated packet for retransmission
71 */
72 packet_t *packet;
73 };
74
75 typedef struct private_task_manager_t private_task_manager_t;
76
77 /**
78 * private data of the task manager
79 */
80 struct private_task_manager_t {
81
82 /**
83 * public functions
84 */
85 task_manager_v1_t public;
86
87 /**
88 * associated IKE_SA we are serving
89 */
90 ike_sa_t *ike_sa;
91
92 /**
93 * RNG to create message IDs
94 */
95 rng_t *rng;
96
97 /**
98 * Exchange we are currently handling as responder
99 */
100 struct {
101 /**
102 * Message ID of the last response
103 */
104 u_int32_t mid;
105
106 /**
107 * Hash of a previously received message
108 */
109 u_int32_t hash;
110
111 /**
112 * packet for retransmission
113 */
114 packet_t *packet;
115
116 /**
117 * Sequence number of the last sent message
118 */
119 u_int32_t seqnr;
120
121 /**
122 * how many times we have retransmitted so far
123 */
124 u_int retransmitted;
125
126 } responding;
127
128 /**
129 * Exchange we are currently handling as initiator
130 */
131 struct {
132 /**
133 * Message ID of the exchange
134 */
135 u_int32_t mid;
136
137 /**
138 * Hashes of old responses we can ignore
139 */
140 u_int32_t old_hashes[MAX_OLD_HASHES];
141
142 /**
143 * Position in old hash array
144 */
145 int old_hash_pos;
146
147 /**
148 * Sequence number of the last sent message
149 */
150 u_int32_t seqnr;
151
152 /**
153 * how many times we have retransmitted so far
154 */
155 u_int retransmitted;
156
157 /**
158 * packet for retransmission
159 */
160 packet_t *packet;
161
162 /**
163 * type of the initated exchange
164 */
165 exchange_type_t type;
166
167 } initiating;
168
169 /**
170 * List of queued tasks not yet in action
171 */
172 linked_list_t *queued_tasks;
173
174 /**
175 * List of active tasks, initiated by ourselve
176 */
177 linked_list_t *active_tasks;
178
179 /**
180 * List of tasks initiated by peer
181 */
182 linked_list_t *passive_tasks;
183
184 /**
185 * Queued messages not yet ready to process
186 */
187 message_t *queued;
188
189 /**
190 * Number of times we retransmit messages before giving up
191 */
192 u_int retransmit_tries;
193
194 /**
195 * Retransmission timeout
196 */
197 double retransmit_timeout;
198
199 /**
200 * Base to calculate retransmission timeout
201 */
202 double retransmit_base;
203
204 /**
205 * Sequence number for sending DPD requests
206 */
207 u_int32_t dpd_send;
208
209 /**
210 * Sequence number for received DPD requests
211 */
212 u_int32_t dpd_recv;
213 };
214
215 METHOD(task_manager_t, flush_queue, void,
216 private_task_manager_t *this, task_queue_t queue)
217 {
218 linked_list_t *list;
219 task_t *task;
220
221 if (this->queued)
222 {
223 this->queued->destroy(this->queued);
224 this->queued = NULL;
225 }
226 switch (queue)
227 {
228 case TASK_QUEUE_ACTIVE:
229 list = this->active_tasks;
230 /* cancel pending retransmits */
231 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
232 DESTROY_IF(this->initiating.packet);
233 this->initiating.packet = NULL;
234 break;
235 case TASK_QUEUE_PASSIVE:
236 list = this->passive_tasks;
237 break;
238 case TASK_QUEUE_QUEUED:
239 list = this->queued_tasks;
240 break;
241 default:
242 return;
243 }
244 while (list->remove_last(list, (void**)&task) == SUCCESS)
245 {
246 task->destroy(task);
247 }
248 }
249
250 /**
251 * flush all tasks in the task manager
252 */
253 static void flush(private_task_manager_t *this)
254 {
255 flush_queue(this, TASK_QUEUE_QUEUED);
256 flush_queue(this, TASK_QUEUE_PASSIVE);
257 flush_queue(this, TASK_QUEUE_ACTIVE);
258 }
259
260 /**
261 * move a task of a specific type from the queue to the active list
262 */
263 static bool activate_task(private_task_manager_t *this, task_type_t type)
264 {
265 enumerator_t *enumerator;
266 task_t *task;
267 bool found = FALSE;
268
269 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
270 while (enumerator->enumerate(enumerator, (void**)&task))
271 {
272 if (task->get_type(task) == type)
273 {
274 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
275 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
276 this->active_tasks->insert_last(this->active_tasks, task);
277 found = TRUE;
278 break;
279 }
280 }
281 enumerator->destroy(enumerator);
282 return found;
283 }
284
285 /**
286 * Retransmit a packet, either as initiator or as responder
287 */
288 static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
289 u_int mid, u_int retransmitted, packet_t *packet)
290 {
291 u_int32_t t;
292
293 if (retransmitted > this->retransmit_tries)
294 {
295 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
296 return DESTROY_ME;
297 }
298 t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
299 pow(this->retransmit_base, retransmitted));
300 if (retransmitted)
301 {
302 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
303 retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
304 mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
305 }
306 charon->sender->send(charon->sender, packet->clone(packet));
307 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
308 retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
309 return NEED_MORE;
310 }
311
312 METHOD(task_manager_t, retransmit, status_t,
313 private_task_manager_t *this, u_int32_t seqnr)
314 {
315 status_t status = SUCCESS;
316
317 if (seqnr == this->initiating.seqnr && this->initiating.packet)
318 {
319 status = retransmit_packet(this, seqnr, this->initiating.mid,
320 this->initiating.retransmitted, this->initiating.packet);
321 if (status == NEED_MORE)
322 {
323 this->initiating.retransmitted++;
324 status = SUCCESS;
325 }
326 }
327 if (seqnr == this->responding.seqnr && this->responding.packet)
328 {
329 status = retransmit_packet(this, seqnr, this->responding.mid,
330 this->responding.retransmitted, this->responding.packet);
331 if (status == NEED_MORE)
332 {
333 this->responding.retransmitted++;
334 status = SUCCESS;
335 }
336 }
337 return status;
338 }
339
340 /**
341 * Check if we have to wait for a mode config before starting a quick mode
342 */
343 static bool mode_config_expected(private_task_manager_t *this)
344 {
345 enumerator_t *enumerator;
346 peer_cfg_t *peer_cfg;
347 char *pool;
348 host_t *host;
349
350 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
351 if (peer_cfg)
352 {
353 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
354 if (!enumerator->enumerate(enumerator, &pool))
355 { /* no pool configured */
356 enumerator->destroy(enumerator);
357 return FALSE;
358 }
359 enumerator->destroy(enumerator);
360
361 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
362 FALSE);
363 if (!enumerator->enumerate(enumerator, &host))
364 { /* have a pool, but no VIP assigned yet */
365 enumerator->destroy(enumerator);
366 return TRUE;
367 }
368 enumerator->destroy(enumerator);
369 }
370 return FALSE;
371 }
372
373 METHOD(task_manager_t, initiate, status_t,
374 private_task_manager_t *this)
375 {
376 enumerator_t *enumerator;
377 task_t *task;
378 message_t *message;
379 host_t *me, *other;
380 status_t status;
381 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
382 bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
383
384 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
385 this->initiating.type != INFORMATIONAL_V1)
386 {
387 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
388 exchange_type_names, this->initiating.type);
389 /* do not initiate if we already have a message in the air */
390 return SUCCESS;
391 }
392
393 if (this->active_tasks->get_count(this->active_tasks) == 0)
394 {
395 DBG2(DBG_IKE, "activating new tasks");
396 switch (this->ike_sa->get_state(this->ike_sa))
397 {
398 case IKE_CREATED:
399 activate_task(this, TASK_ISAKMP_VENDOR);
400 activate_task(this, TASK_ISAKMP_CERT_PRE);
401 if (activate_task(this, TASK_MAIN_MODE))
402 {
403 exchange = ID_PROT;
404 }
405 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
406 {
407 exchange = AGGRESSIVE;
408 }
409 activate_task(this, TASK_ISAKMP_CERT_POST);
410 activate_task(this, TASK_ISAKMP_NATD);
411 break;
412 case IKE_CONNECTING:
413 if (activate_task(this, TASK_ISAKMP_DELETE))
414 {
415 exchange = INFORMATIONAL_V1;
416 new_mid = TRUE;
417 break;
418 }
419 if (activate_task(this, TASK_XAUTH))
420 {
421 exchange = TRANSACTION;
422 new_mid = TRUE;
423 break;
424 }
425 if (activate_task(this, TASK_INFORMATIONAL))
426 {
427 exchange = INFORMATIONAL_V1;
428 new_mid = TRUE;
429 break;
430 }
431 break;
432 case IKE_ESTABLISHED:
433 if (activate_task(this, TASK_MODE_CONFIG))
434 {
435 exchange = TRANSACTION;
436 new_mid = TRUE;
437 break;
438 }
439 if (!mode_config_expected(this) &&
440 activate_task(this, TASK_QUICK_MODE))
441 {
442 exchange = QUICK_MODE;
443 new_mid = TRUE;
444 break;
445 }
446 if (activate_task(this, TASK_INFORMATIONAL))
447 {
448 exchange = INFORMATIONAL_V1;
449 new_mid = TRUE;
450 break;
451 }
452 if (activate_task(this, TASK_QUICK_DELETE))
453 {
454 exchange = INFORMATIONAL_V1;
455 new_mid = TRUE;
456 break;
457 }
458 if (activate_task(this, TASK_ISAKMP_DELETE))
459 {
460 exchange = INFORMATIONAL_V1;
461 new_mid = TRUE;
462 break;
463 }
464 if (activate_task(this, TASK_ISAKMP_DPD))
465 {
466 exchange = INFORMATIONAL_V1;
467 new_mid = TRUE;
468 break;
469 }
470 break;
471 default:
472 break;
473 }
474 }
475 else
476 {
477 DBG2(DBG_IKE, "reinitiating already active tasks");
478 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
479 while (enumerator->enumerate(enumerator, (void**)&task))
480 {
481 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
482 switch (task->get_type(task))
483 {
484 case TASK_MAIN_MODE:
485 exchange = ID_PROT;
486 break;
487 case TASK_AGGRESSIVE_MODE:
488 exchange = AGGRESSIVE;
489 break;
490 case TASK_QUICK_MODE:
491 exchange = QUICK_MODE;
492 break;
493 case TASK_XAUTH:
494 exchange = TRANSACTION;
495 new_mid = TRUE;
496 break;
497 default:
498 continue;
499 }
500 break;
501 }
502 enumerator->destroy(enumerator);
503 }
504
505 if (exchange == EXCHANGE_TYPE_UNDEFINED)
506 {
507 DBG2(DBG_IKE, "nothing to initiate");
508 /* nothing to do yet... */
509 return SUCCESS;
510 }
511
512 me = this->ike_sa->get_my_host(this->ike_sa);
513 other = this->ike_sa->get_other_host(this->ike_sa);
514
515 if (new_mid)
516 {
517 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
518 (void*)&this->initiating.mid))
519 {
520 DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
521 flush(this);
522 return DESTROY_ME;
523 }
524 }
525 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
526 message->set_message_id(message, this->initiating.mid);
527 message->set_source(message, me->clone(me));
528 message->set_destination(message, other->clone(other));
529 message->set_exchange_type(message, exchange);
530 this->initiating.type = exchange;
531 this->initiating.retransmitted = 0;
532
533 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
534 while (enumerator->enumerate(enumerator, (void*)&task))
535 {
536 switch (task->build(task, message))
537 {
538 case SUCCESS:
539 /* task completed, remove it */
540 this->active_tasks->remove_at(this->active_tasks, enumerator);
541 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
542 task->get_type(task) == TASK_QUICK_MODE)
543 { /* last message of three message exchange */
544 keep = TRUE;
545 }
546 task->destroy(task);
547 continue;
548 case NEED_MORE:
549 expect_response = TRUE;
550 /* processed, but task needs another exchange */
551 continue;
552 case ALREADY_DONE:
553 cancelled = TRUE;
554 break;
555 case FAILED:
556 default:
557 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
558 {
559 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
560 }
561 /* FALL */
562 case DESTROY_ME:
563 /* critical failure, destroy IKE_SA */
564 enumerator->destroy(enumerator);
565 message->destroy(message);
566 flush(this);
567 return DESTROY_ME;
568 }
569 break;
570 }
571 enumerator->destroy(enumerator);
572
573 if (this->active_tasks->get_count(this->active_tasks) == 0 &&
574 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
575 { /* tasks completed, no exchange active anymore */
576 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
577 }
578 if (cancelled)
579 {
580 message->destroy(message);
581 return initiate(this);
582 }
583
584 DESTROY_IF(this->initiating.packet);
585 status = this->ike_sa->generate_message(this->ike_sa, message,
586 &this->initiating.packet);
587 if (status != SUCCESS)
588 {
589 /* message generation failed. There is nothing more to do than to
590 * close the SA */
591 message->destroy(message);
592 flush(this);
593 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
594 return DESTROY_ME;
595 }
596
597 this->initiating.seqnr++;
598 if (expect_response)
599 {
600 message->destroy(message);
601 return retransmit(this, this->initiating.seqnr);
602 }
603 if (keep)
604 { /* keep the packet for retransmission, the responder might request it */
605 charon->sender->send(charon->sender,
606 this->initiating.packet->clone(this->initiating.packet));
607 }
608 else
609 {
610 charon->sender->send(charon->sender, this->initiating.packet);
611 this->initiating.packet = NULL;
612 }
613 message->destroy(message);
614
615 if (exchange == INFORMATIONAL_V1)
616 {
617 switch (this->ike_sa->get_state(this->ike_sa))
618 {
619 case IKE_CONNECTING:
620 /* close after sending an INFORMATIONAL when unestablished */
621 return FAILED;
622 case IKE_DELETING:
623 /* close after sending a DELETE */
624 return DESTROY_ME;
625 default:
626 break;
627 }
628 }
629 return initiate(this);
630 }
631
632 /**
633 * build a response depending on the "passive" task list
634 */
635 static status_t build_response(private_task_manager_t *this, message_t *request)
636 {
637 enumerator_t *enumerator;
638 task_t *task;
639 message_t *message;
640 host_t *me, *other;
641 bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
642 status_t status;
643
644 me = request->get_destination(request);
645 other = request->get_source(request);
646
647 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
648 message->set_exchange_type(message, request->get_exchange_type(request));
649 /* send response along the path the request came in */
650 message->set_source(message, me->clone(me));
651 message->set_destination(message, other->clone(other));
652 message->set_message_id(message, request->get_message_id(request));
653 message->set_request(message, FALSE);
654
655 this->responding.mid = request->get_message_id(request);
656 this->responding.retransmitted = 0;
657 this->responding.seqnr++;
658
659 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
660 while (enumerator->enumerate(enumerator, (void*)&task))
661 {
662 switch (task->build(task, message))
663 {
664 case SUCCESS:
665 /* task completed, remove it */
666 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
667 task->destroy(task);
668 continue;
669 case NEED_MORE:
670 /* processed, but task needs another exchange */
671 if (task->get_type(task) == TASK_QUICK_MODE ||
672 task->get_type(task) == TASK_AGGRESSIVE_MODE)
673 { /* we rely on initiator retransmission, except for
674 * three-message exchanges */
675 expect_request = TRUE;
676 }
677 continue;
678 case ALREADY_DONE:
679 cancelled = TRUE;
680 break;
681 case FAILED:
682 default:
683 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
684 /* FALL */
685 case DESTROY_ME:
686 /* destroy IKE_SA, but SEND response first */
687 delete = TRUE;
688 break;
689 }
690 break;
691 }
692 enumerator->destroy(enumerator);
693
694 DESTROY_IF(this->responding.packet);
695 this->responding.packet = NULL;
696 if (cancelled)
697 {
698 message->destroy(message);
699 return initiate(this);
700 }
701 status = this->ike_sa->generate_message(this->ike_sa, message,
702 &this->responding.packet);
703 message->destroy(message);
704 if (status != SUCCESS)
705 {
706 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
707 return DESTROY_ME;
708 }
709
710 if (expect_request && !delete)
711 {
712 return retransmit(this, this->responding.seqnr);
713 }
714 charon->sender->send(charon->sender,
715 this->responding.packet->clone(this->responding.packet));
716 if (delete)
717 {
718 return DESTROY_ME;
719 }
720 return SUCCESS;
721 }
722
723 /**
724 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
725 * The notify protocol_id is set to ISAKMP
726 */
727 static void send_notify(private_task_manager_t *this, message_t *request,
728 notify_type_t type)
729 {
730 message_t *response;
731 packet_t *packet;
732 host_t *me, *other;
733 u_int32_t mid;
734
735 if (request->get_exchange_type(request) == INFORMATIONAL_V1)
736 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
737 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
738 return;
739 }
740 if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
741 {
742 DBG1(DBG_IKE, "failed to allocate message ID");
743 return;
744 }
745 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
746 response->set_exchange_type(response, INFORMATIONAL_V1);
747 response->set_request(response, TRUE);
748 response->set_message_id(response, mid);
749 response->add_payload(response, (payload_t*)
750 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
751 PROTO_IKE, type));
752
753 me = this->ike_sa->get_my_host(this->ike_sa);
754 if (me->is_anyaddr(me))
755 {
756 me = request->get_destination(request);
757 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
758 }
759 other = this->ike_sa->get_other_host(this->ike_sa);
760 if (other->is_anyaddr(other))
761 {
762 other = request->get_source(request);
763 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
764 }
765 response->set_source(response, me->clone(me));
766 response->set_destination(response, other->clone(other));
767 if (this->ike_sa->generate_message(this->ike_sa, response,
768 &packet) == SUCCESS)
769 {
770 charon->sender->send(charon->sender, packet);
771 }
772 response->destroy(response);
773 }
774
775 /**
776 * Process a DPD request/response
777 */
778 static bool process_dpd(private_task_manager_t *this, message_t *message)
779 {
780 notify_payload_t *notify;
781 notify_type_t type;
782 u_int32_t seq;
783 chunk_t data;
784
785 type = DPD_R_U_THERE;
786 notify = message->get_notify(message, type);
787 if (!notify)
788 {
789 type = DPD_R_U_THERE_ACK;
790 notify = message->get_notify(message, type);
791 }
792 if (!notify)
793 {
794 return FALSE;
795 }
796 data = notify->get_notification_data(notify);
797 if (data.len != 4)
798 {
799 return FALSE;
800 }
801 seq = untoh32(data.ptr);
802
803 if (type == DPD_R_U_THERE)
804 {
805 if (this->dpd_recv == 0 || seq == this->dpd_recv)
806 { /* check sequence validity */
807 this->dpd_recv = seq + 1;
808 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
809 time_monotonic(NULL));
810 }
811 /* but respond anyway */
812 this->ike_sa->queue_task(this->ike_sa,
813 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
814 }
815 else /* DPD_R_U_THERE_ACK */
816 {
817 if (seq == this->dpd_send - 1)
818 {
819 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
820 time_monotonic(NULL));
821 }
822 else
823 {
824 DBG1(DBG_IKE, "received invalid DPD sequence number %u "
825 "(expected %u), ignored", seq, this->dpd_send - 1);
826 }
827 }
828 return TRUE;
829 }
830
831 /**
832 * handle an incoming request message
833 */
834 static status_t process_request(private_task_manager_t *this,
835 message_t *message)
836 {
837 enumerator_t *enumerator;
838 task_t *task = NULL;
839 bool send_response = FALSE, dpd = FALSE;
840
841 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
842 this->passive_tasks->get_count(this->passive_tasks) == 0)
843 { /* create tasks depending on request type, if not already some queued */
844 switch (message->get_exchange_type(message))
845 {
846 case ID_PROT:
847 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
848 this->passive_tasks->insert_last(this->passive_tasks, task);
849 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
850 this->passive_tasks->insert_last(this->passive_tasks, task);
851 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
852 this->passive_tasks->insert_last(this->passive_tasks, task);
853 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
854 this->passive_tasks->insert_last(this->passive_tasks, task);
855 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
856 this->passive_tasks->insert_last(this->passive_tasks, task);
857 break;
858 case AGGRESSIVE:
859 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
860 this->passive_tasks->insert_last(this->passive_tasks, task);
861 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
862 this->passive_tasks->insert_last(this->passive_tasks, task);
863 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
864 this->passive_tasks->insert_last(this->passive_tasks, task);
865 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
866 this->passive_tasks->insert_last(this->passive_tasks, task);
867 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
868 this->passive_tasks->insert_last(this->passive_tasks, task);
869 break;
870 case QUICK_MODE:
871 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
872 {
873 DBG1(DBG_IKE, "received quick mode request for "
874 "unestablished IKE_SA, ignored");
875 return FAILED;
876 }
877 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
878 NULL, NULL);
879 this->passive_tasks->insert_last(this->passive_tasks, task);
880 break;
881 case INFORMATIONAL_V1:
882 if (process_dpd(this, message))
883 {
884 dpd = TRUE;
885 }
886 else
887 {
888 task = (task_t *)informational_create(this->ike_sa, NULL);
889 this->passive_tasks->insert_first(this->passive_tasks, task);
890 }
891 break;
892 case TRANSACTION:
893 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
894 {
895 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
896 }
897 else
898 {
899 task = (task_t *)xauth_create(this->ike_sa, FALSE);
900 }
901 this->passive_tasks->insert_last(this->passive_tasks, task);
902 break;
903 default:
904 return FAILED;
905 }
906 }
907 if (dpd)
908 {
909 return initiate(this);
910 }
911 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
912
913 /* let the tasks process the message */
914 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
915 while (enumerator->enumerate(enumerator, (void*)&task))
916 {
917 switch (task->process(task, message))
918 {
919 case SUCCESS:
920 /* task completed, remove it */
921 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
922 task->destroy(task);
923 continue;
924 case NEED_MORE:
925 /* processed, but task needs at least another call to build() */
926 send_response = TRUE;
927 continue;
928 case ALREADY_DONE:
929 send_response = FALSE;
930 break;
931 case FAILED:
932 default:
933 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
934 /* FALL */
935 case DESTROY_ME:
936 /* critical failure, destroy IKE_SA */
937 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
938 enumerator->destroy(enumerator);
939 task->destroy(task);
940 return DESTROY_ME;
941 }
942 break;
943 }
944 enumerator->destroy(enumerator);
945
946 if (send_response)
947 {
948 if (build_response(this, message) != SUCCESS)
949 {
950 return DESTROY_ME;
951 }
952 }
953 else
954 { /* We don't send a response, so don't retransmit one if we get
955 * the same message again. */
956 DESTROY_IF(this->responding.packet);
957 this->responding.packet = NULL;
958 }
959 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
960 this->queued_tasks->get_count(this->queued_tasks) > 0)
961 {
962 /* passive tasks completed, check if an active task has been queued,
963 * such as XAUTH or modeconfig push */
964 return initiate(this);
965 }
966 return SUCCESS;
967 }
968
969 /**
970 * handle an incoming response message
971 */
972 static status_t process_response(private_task_manager_t *this,
973 message_t *message)
974 {
975 enumerator_t *enumerator;
976 message_t *queued;
977 status_t status;
978 task_t *task;
979
980 if (message->get_exchange_type(message) != this->initiating.type)
981 {
982 DBG1(DBG_IKE, "received %N response, but expected %N",
983 exchange_type_names, message->get_exchange_type(message),
984 exchange_type_names, this->initiating.type);
985 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
986 return DESTROY_ME;
987 }
988
989 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
990 while (enumerator->enumerate(enumerator, (void*)&task))
991 {
992 switch (task->process(task, message))
993 {
994 case SUCCESS:
995 /* task completed, remove it */
996 this->active_tasks->remove_at(this->active_tasks, enumerator);
997 task->destroy(task);
998 continue;
999 case NEED_MORE:
1000 /* processed, but task needs another exchange */
1001 continue;
1002 case ALREADY_DONE:
1003 break;
1004 case FAILED:
1005 default:
1006 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1007 /* FALL */
1008 case DESTROY_ME:
1009 /* critical failure, destroy IKE_SA */
1010 this->active_tasks->remove_at(this->active_tasks, enumerator);
1011 enumerator->destroy(enumerator);
1012 task->destroy(task);
1013 return DESTROY_ME;
1014 }
1015 break;
1016 }
1017 enumerator->destroy(enumerator);
1018
1019 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1020 DESTROY_IF(this->initiating.packet);
1021 this->initiating.packet = NULL;
1022
1023 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
1024 {
1025 queued = this->queued;
1026 this->queued = NULL;
1027 status = this->public.task_manager.process_message(
1028 &this->public.task_manager, queued);
1029 queued->destroy(queued);
1030 if (status == DESTROY_ME)
1031 {
1032 return status;
1033 }
1034 }
1035
1036 return initiate(this);
1037 }
1038
1039 /**
1040 * Parse the given message and verify that it is valid.
1041 */
1042 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1043 {
1044 status_t status;
1045
1046 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1047
1048 if (status != SUCCESS)
1049 {
1050 switch (status)
1051 {
1052 case NOT_SUPPORTED:
1053 DBG1(DBG_IKE, "unsupported exchange type");
1054 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1055 break;
1056 case PARSE_ERROR:
1057 DBG1(DBG_IKE, "message parsing failed");
1058 send_notify(this, msg, PAYLOAD_MALFORMED);
1059 break;
1060 case VERIFY_ERROR:
1061 DBG1(DBG_IKE, "message verification failed");
1062 send_notify(this, msg, PAYLOAD_MALFORMED);
1063 break;
1064 case FAILED:
1065 DBG1(DBG_IKE, "integrity check failed");
1066 send_notify(this, msg, INVALID_HASH_INFORMATION);
1067 break;
1068 case INVALID_STATE:
1069 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1070 send_notify(this, msg, PAYLOAD_MALFORMED);
1071 default:
1072 break;
1073 }
1074 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1075 exchange_type_names, msg->get_exchange_type(msg),
1076 msg->get_request(msg) ? "request" : "response",
1077 msg->get_message_id(msg));
1078
1079 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1080 { /* invalid initiation attempt, close SA */
1081 return DESTROY_ME;
1082 }
1083 }
1084 return status;
1085 }
1086
1087 METHOD(task_manager_t, process_message, status_t,
1088 private_task_manager_t *this, message_t *msg)
1089 {
1090 u_int32_t hash, mid, i;
1091 host_t *me, *other;
1092 status_t status;
1093
1094 /* TODO-IKEv1: update hosts more selectively */
1095 me = msg->get_destination(msg);
1096 other = msg->get_source(msg);
1097 mid = msg->get_message_id(msg);
1098 hash = chunk_hash(msg->get_packet_data(msg));
1099 for (i = 0; i < MAX_OLD_HASHES; i++)
1100 {
1101 if (this->initiating.old_hashes[i] == hash)
1102 {
1103 if (this->initiating.packet &&
1104 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1105 (msg->get_exchange_type(msg) == QUICK_MODE ||
1106 msg->get_exchange_type(msg) == AGGRESSIVE))
1107 {
1108 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1109 "resending last request", mid);
1110 charon->sender->send(charon->sender,
1111 this->initiating.packet->clone(this->initiating.packet));
1112 return SUCCESS;
1113 }
1114 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1115 "but next request already sent", mid);
1116 return SUCCESS;
1117 }
1118 }
1119
1120 if ((mid && mid == this->initiating.mid) ||
1121 (this->initiating.mid == 0 &&
1122 msg->get_exchange_type(msg) == this->initiating.type &&
1123 this->active_tasks->get_count(this->active_tasks)))
1124 {
1125 msg->set_request(msg, FALSE);
1126 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1127 status = parse_message(this, msg);
1128 if (status != SUCCESS)
1129 {
1130 return status;
1131 }
1132 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1133 time_monotonic(NULL));
1134 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1135 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1136 if (process_response(this, msg) != SUCCESS)
1137 {
1138 flush(this);
1139 return DESTROY_ME;
1140 }
1141 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1142 MAX_OLD_HASHES] = hash;
1143 }
1144 else
1145 {
1146 if (hash == this->responding.hash)
1147 {
1148 if (this->responding.packet)
1149 {
1150 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1151 "retransmitting response", mid);
1152 charon->sender->send(charon->sender,
1153 this->responding.packet->clone(this->responding.packet));
1154 }
1155 else if (this->initiating.packet &&
1156 this->initiating.type == INFORMATIONAL_V1)
1157 {
1158 DBG1(DBG_IKE, "received retransmit of DPD request, "
1159 "retransmitting response");
1160 charon->sender->send(charon->sender,
1161 this->initiating.packet->clone(this->initiating.packet));
1162 }
1163 else
1164 {
1165 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1166 "but no response to retransmit", mid);
1167 }
1168 return SUCCESS;
1169 }
1170 if (msg->get_exchange_type(msg) == TRANSACTION &&
1171 this->active_tasks->get_count(this->active_tasks))
1172 { /* main mode not yet complete, queue XAuth/Mode config tasks */
1173 if (this->queued)
1174 {
1175 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
1176 exchange_type_names, TRANSACTION);
1177 return SUCCESS;
1178 }
1179 this->queued = message_create_from_packet(msg->get_packet(msg));
1180 if (this->queued->parse_header(this->queued) != SUCCESS)
1181 {
1182 this->queued->destroy(this->queued);
1183 this->queued = NULL;
1184 return FAILED;
1185 }
1186 DBG1(DBG_IKE, "queueing %N request as tasks still active",
1187 exchange_type_names, TRANSACTION);
1188 return SUCCESS;
1189 }
1190
1191 msg->set_request(msg, TRUE);
1192 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1193 status = parse_message(this, msg);
1194 if (status != SUCCESS)
1195 {
1196 return status;
1197 }
1198 /* if this IKE_SA is virgin, we check for a config */
1199 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1200 {
1201 ike_sa_id_t *ike_sa_id;
1202 ike_cfg_t *ike_cfg;
1203 job_t *job;
1204
1205 ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1206 me, other, IKEV1);
1207 if (ike_cfg == NULL)
1208 {
1209 /* no config found for these hosts, destroy */
1210 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1211 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1212 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1213 return DESTROY_ME;
1214 }
1215 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1216 ike_cfg->destroy(ike_cfg);
1217 /* add a timeout if peer does not establish it completely */
1218 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1219 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1220 lib->scheduler->schedule_job(lib->scheduler, job,
1221 lib->settings->get_int(lib->settings,
1222 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1223 charon->name));
1224 }
1225 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1226 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1227 if (process_request(this, msg) != SUCCESS)
1228 {
1229 flush(this);
1230 return DESTROY_ME;
1231 }
1232 this->responding.hash = hash;
1233 }
1234 return SUCCESS;
1235 }
1236
1237 METHOD(task_manager_t, queue_task, void,
1238 private_task_manager_t *this, task_t *task)
1239 {
1240 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1241 this->queued_tasks->insert_last(this->queued_tasks, task);
1242 }
1243
1244 /**
1245 * Check if a given task has been queued already
1246 */
1247 static bool has_queued(private_task_manager_t *this, task_type_t type)
1248 {
1249 enumerator_t *enumerator;
1250 bool found = FALSE;
1251 task_t *task;
1252
1253 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1254 while (enumerator->enumerate(enumerator, &task))
1255 {
1256 if (task->get_type(task) == type)
1257 {
1258 found = TRUE;
1259 break;
1260 }
1261 }
1262 enumerator->destroy(enumerator);
1263 return found;
1264 }
1265
1266 METHOD(task_manager_t, queue_ike, void,
1267 private_task_manager_t *this)
1268 {
1269 peer_cfg_t *peer_cfg;
1270
1271 if (!has_queued(this, TASK_ISAKMP_VENDOR))
1272 {
1273 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1274 }
1275 if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1276 {
1277 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1278 }
1279 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1280 if (peer_cfg->use_aggressive(peer_cfg))
1281 {
1282 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1283 {
1284 queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1285 }
1286 }
1287 else
1288 {
1289 if (!has_queued(this, TASK_MAIN_MODE))
1290 {
1291 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1292 }
1293 }
1294 if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1295 {
1296 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1297 }
1298 if (!has_queued(this, TASK_ISAKMP_NATD))
1299 {
1300 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1301 }
1302 }
1303
1304 METHOD(task_manager_t, queue_ike_reauth, void,
1305 private_task_manager_t *this)
1306 {
1307 enumerator_t *enumerator;
1308 child_sa_t *child_sa;
1309 ike_sa_t *new;
1310 host_t *host;
1311
1312 new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1313 this->ike_sa->get_version(this->ike_sa), TRUE);
1314 if (!new)
1315 { /* shouldn't happen */
1316 return;
1317 }
1318
1319 new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1320 host = this->ike_sa->get_other_host(this->ike_sa);
1321 new->set_other_host(new, host->clone(host));
1322 host = this->ike_sa->get_my_host(this->ike_sa);
1323 new->set_my_host(new, host->clone(host));
1324 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1325 while (enumerator->enumerate(enumerator, &host))
1326 {
1327 new->add_virtual_ip(new, TRUE, host);
1328 }
1329 enumerator->destroy(enumerator);
1330
1331 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1332 while (enumerator->enumerate(enumerator, &child_sa))
1333 {
1334 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1335 new->add_child_sa(new, child_sa);
1336 }
1337 enumerator->destroy(enumerator);
1338
1339 if (!new->get_child_count(new))
1340 { /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1341 task_t *task;
1342
1343 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1344 while (enumerator->enumerate(enumerator, &task))
1345 {
1346 if (task->get_type(task) == TASK_QUICK_MODE)
1347 {
1348 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1349 task->migrate(task, new);
1350 new->queue_task(new, task);
1351 }
1352 }
1353 enumerator->destroy(enumerator);
1354 }
1355
1356 if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1357 {
1358 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1359 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1360 }
1361 else
1362 {
1363 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1364 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1365 }
1366 charon->bus->set_sa(charon->bus, this->ike_sa);
1367 }
1368
1369 METHOD(task_manager_t, queue_ike_rekey, void,
1370 private_task_manager_t *this)
1371 {
1372 queue_ike_reauth(this);
1373 }
1374
1375 METHOD(task_manager_t, queue_ike_delete, void,
1376 private_task_manager_t *this)
1377 {
1378 enumerator_t *enumerator;
1379 child_sa_t *child_sa;
1380
1381 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1382 while (enumerator->enumerate(enumerator, &child_sa))
1383 {
1384 queue_task(this, (task_t*)
1385 quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1386 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1387 }
1388 enumerator->destroy(enumerator);
1389
1390 queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1391 }
1392
1393 METHOD(task_manager_t, queue_mobike, void,
1394 private_task_manager_t *this, bool roam, bool address)
1395 {
1396 /* Not supported in IKEv1 */
1397 }
1398
1399 METHOD(task_manager_t, queue_child, void,
1400 private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1401 traffic_selector_t *tsi, traffic_selector_t *tsr)
1402 {
1403 quick_mode_t *task;
1404
1405 task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1406 task->use_reqid(task, reqid);
1407
1408 queue_task(this, &task->task);
1409 }
1410
1411 /**
1412 * Check if two CHILD_SAs have the same traffic selector
1413 */
1414 static bool have_equal_ts(child_sa_t *a, child_sa_t *b, bool local)
1415 {
1416 linked_list_t *list;
1417 traffic_selector_t *ts_a, *ts_b;
1418
1419 list = a->get_traffic_selectors(a, local);
1420 if (list->get_first(list, (void**)&ts_a) == SUCCESS)
1421 {
1422 list = b->get_traffic_selectors(b, local);
1423 if (list->get_first(list, (void**)&ts_b) == SUCCESS)
1424 {
1425 return ts_a->equals(ts_a, ts_b);
1426 }
1427 }
1428 return FALSE;
1429 }
1430
1431 /**
1432 * Check if a CHILD_SA is redundant and we should delete instead of rekey
1433 */
1434 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1435 {
1436 enumerator_t *enumerator;
1437 child_sa_t *current;
1438 bool redundant = FALSE;
1439
1440 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1441 while (enumerator->enumerate(enumerator, &current))
1442 {
1443 if (current->get_state(current) == CHILD_INSTALLED &&
1444 streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1445 have_equal_ts(current, child_sa, TRUE) &&
1446 have_equal_ts(current, child_sa, FALSE) &&
1447 current->get_lifetime(current, FALSE) >
1448 child_sa->get_lifetime(child_sa, FALSE))
1449 {
1450 DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1451 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
1452 redundant = TRUE;
1453 break;
1454 }
1455 }
1456 enumerator->destroy(enumerator);
1457
1458 return redundant;
1459 }
1460
1461 /**
1462 * Get the first traffic selector of a CHILD_SA, local or remote
1463 */
1464 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1465 {
1466 traffic_selector_t *ts = NULL;
1467 linked_list_t *list;
1468
1469 list = child_sa->get_traffic_selectors(child_sa, local);
1470 if (list->get_first(list, (void**)&ts) == SUCCESS)
1471 {
1472 return ts;
1473 }
1474 return NULL;
1475 }
1476
1477 METHOD(task_manager_t, queue_child_rekey, void,
1478 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1479 {
1480 child_sa_t *child_sa;
1481 child_cfg_t *cfg;
1482 quick_mode_t *task;
1483
1484 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1485 if (!child_sa)
1486 {
1487 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1488 }
1489 if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1490 {
1491 if (is_redundant(this, child_sa))
1492 {
1493 queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1494 protocol, spi, FALSE, FALSE));
1495 }
1496 else
1497 {
1498 child_sa->set_state(child_sa, CHILD_REKEYING);
1499 cfg = child_sa->get_config(child_sa);
1500 task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1501 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1502 task->use_reqid(task, child_sa->get_reqid(child_sa));
1503 task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1504
1505 queue_task(this, &task->task);
1506 }
1507 }
1508 }
1509
1510 METHOD(task_manager_t, queue_child_delete, void,
1511 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1512 bool expired)
1513 {
1514 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1515 spi, FALSE, expired));
1516 }
1517
1518 METHOD(task_manager_t, queue_dpd, void,
1519 private_task_manager_t *this)
1520 {
1521 peer_cfg_t *peer_cfg;
1522 u_int32_t t, retransmit;
1523
1524 queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1525 this->dpd_send++));
1526 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1527
1528 /* compute timeout in milliseconds */
1529 t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1530 if (t == 0)
1531 {
1532 /* use the same timeout as a retransmitting IKE message would have */
1533 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1534 {
1535 t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1536 pow(this->retransmit_base, retransmit));
1537 }
1538 }
1539
1540 /* schedule DPD timeout job */
1541 lib->scheduler->schedule_job_ms(lib->scheduler,
1542 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1543 }
1544
1545 METHOD(task_manager_t, adopt_tasks, void,
1546 private_task_manager_t *this, task_manager_t *other_public)
1547 {
1548 private_task_manager_t *other = (private_task_manager_t*)other_public;
1549 task_t *task;
1550
1551 /* move queued tasks from other to this */
1552 while (other->queued_tasks->remove_last(other->queued_tasks,
1553 (void**)&task) == SUCCESS)
1554 {
1555 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1556 task->migrate(task, this->ike_sa);
1557 this->queued_tasks->insert_first(this->queued_tasks, task);
1558 }
1559 }
1560
1561 METHOD(task_manager_t, busy, bool,
1562 private_task_manager_t *this)
1563 {
1564 return (this->active_tasks->get_count(this->active_tasks) > 0);
1565 }
1566
1567 METHOD(task_manager_t, incr_mid, void,
1568 private_task_manager_t *this, bool initiate)
1569 {
1570 }
1571
1572 METHOD(task_manager_t, reset, void,
1573 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1574 {
1575 enumerator_t *enumerator;
1576 task_t *task;
1577
1578 /* reset message counters and retransmit packets */
1579 DESTROY_IF(this->responding.packet);
1580 DESTROY_IF(this->initiating.packet);
1581 this->responding.packet = NULL;
1582 this->responding.seqnr = RESPONDING_SEQ;
1583 this->responding.retransmitted = 0;
1584 this->initiating.packet = NULL;
1585 this->initiating.mid = 0;
1586 this->initiating.seqnr = 0;
1587 this->initiating.retransmitted = 0;
1588 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1589 if (initiate != UINT_MAX)
1590 {
1591 this->dpd_send = initiate;
1592 }
1593 if (respond != UINT_MAX)
1594 {
1595 this->dpd_recv = respond;
1596 }
1597
1598 /* reset queued tasks */
1599 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1600 while (enumerator->enumerate(enumerator, &task))
1601 {
1602 task->migrate(task, this->ike_sa);
1603 }
1604 enumerator->destroy(enumerator);
1605
1606 /* reset active tasks */
1607 while (this->active_tasks->remove_last(this->active_tasks,
1608 (void**)&task) == SUCCESS)
1609 {
1610 task->migrate(task, this->ike_sa);
1611 this->queued_tasks->insert_first(this->queued_tasks, task);
1612 }
1613 }
1614
1615 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1616 private_task_manager_t *this, task_queue_t queue)
1617 {
1618 switch (queue)
1619 {
1620 case TASK_QUEUE_ACTIVE:
1621 return this->active_tasks->create_enumerator(this->active_tasks);
1622 case TASK_QUEUE_PASSIVE:
1623 return this->passive_tasks->create_enumerator(this->passive_tasks);
1624 case TASK_QUEUE_QUEUED:
1625 return this->queued_tasks->create_enumerator(this->queued_tasks);
1626 default:
1627 return enumerator_create_empty();
1628 }
1629 }
1630
1631 METHOD(task_manager_t, destroy, void,
1632 private_task_manager_t *this)
1633 {
1634 flush(this);
1635
1636 this->active_tasks->destroy(this->active_tasks);
1637 this->queued_tasks->destroy(this->queued_tasks);
1638 this->passive_tasks->destroy(this->passive_tasks);
1639
1640 DESTROY_IF(this->queued);
1641 DESTROY_IF(this->responding.packet);
1642 DESTROY_IF(this->initiating.packet);
1643 DESTROY_IF(this->rng);
1644 free(this);
1645 }
1646
1647 /*
1648 * see header file
1649 */
1650 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1651 {
1652 private_task_manager_t *this;
1653
1654 INIT(this,
1655 .public = {
1656 .task_manager = {
1657 .process_message = _process_message,
1658 .queue_task = _queue_task,
1659 .queue_ike = _queue_ike,
1660 .queue_ike_rekey = _queue_ike_rekey,
1661 .queue_ike_reauth = _queue_ike_reauth,
1662 .queue_ike_delete = _queue_ike_delete,
1663 .queue_mobike = _queue_mobike,
1664 .queue_child = _queue_child,
1665 .queue_child_rekey = _queue_child_rekey,
1666 .queue_child_delete = _queue_child_delete,
1667 .queue_dpd = _queue_dpd,
1668 .initiate = _initiate,
1669 .retransmit = _retransmit,
1670 .incr_mid = _incr_mid,
1671 .reset = _reset,
1672 .adopt_tasks = _adopt_tasks,
1673 .busy = _busy,
1674 .create_task_enumerator = _create_task_enumerator,
1675 .flush_queue = _flush_queue,
1676 .destroy = _destroy,
1677 },
1678 },
1679 .initiating = {
1680 .type = EXCHANGE_TYPE_UNDEFINED,
1681 },
1682 .responding = {
1683 .seqnr = RESPONDING_SEQ,
1684 },
1685 .ike_sa = ike_sa,
1686 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1687 .queued_tasks = linked_list_create(),
1688 .active_tasks = linked_list_create(),
1689 .passive_tasks = linked_list_create(),
1690 .retransmit_tries = lib->settings->get_int(lib->settings,
1691 "%s.retransmit_tries", RETRANSMIT_TRIES, charon->name),
1692 .retransmit_timeout = lib->settings->get_double(lib->settings,
1693 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name),
1694 .retransmit_base = lib->settings->get_double(lib->settings,
1695 "%s.retransmit_base", RETRANSMIT_BASE, charon->name),
1696 );
1697
1698 if (!this->rng)
1699 {
1700 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
1701 destroy(this);
1702 return NULL;
1703 }
1704 if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
1705 (void*)&this->dpd_send))
1706 {
1707 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
1708 destroy(this);
1709 return NULL;
1710 }
1711 this->dpd_send &= 0x7FFFFFFF;
1712
1713 return &this->public;
1714 }
1715
strongSwan - IPsec VPN