Moved CHILD_SA delete task creation to protocol specific task manager
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/quick_mode.h>
24 #include <sa/ikev1/tasks/quick_delete.h>
25 #include <sa/ikev1/tasks/xauth.h>
26 #include <sa/ikev1/tasks/mode_config.h>
27 #include <sa/ikev1/tasks/informational.h>
28 #include <sa/ikev1/tasks/isakmp_natd.h>
29 #include <sa/ikev1/tasks/isakmp_vendor.h>
30 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
31 #include <sa/ikev1/tasks/isakmp_cert_post.h>
32 #include <processing/jobs/retransmit_job.h>
33 #include <processing/jobs/delete_ike_sa_job.h>
34
35 /**
36 * Number of old messages hashes we keep for retransmission.
37 *
38 * In Main Mode, we must ignore messages from a previous message pair if
39 * we already continued to the next. Otherwise a late retransmission
40 * could be considered as a reply to the newer request.
41 */
42 #define MAX_OLD_HASHES 2
43
44 typedef struct exchange_t exchange_t;
45
46 /**
47 * An exchange in the air, used do detect and handle retransmission
48 */
49 struct exchange_t {
50
51 /**
52 * Message ID used for this transaction
53 */
54 u_int32_t mid;
55
56 /**
57 * generated packet for retransmission
58 */
59 packet_t *packet;
60 };
61
62 typedef struct private_task_manager_t private_task_manager_t;
63
64 /**
65 * private data of the task manager
66 */
67 struct private_task_manager_t {
68
69 /**
70 * public functions
71 */
72 task_manager_v1_t public;
73
74 /**
75 * associated IKE_SA we are serving
76 */
77 ike_sa_t *ike_sa;
78
79 /**
80 * RNG to create message IDs
81 */
82 rng_t *rng;
83
84 /**
85 * Exchange we are currently handling as responder
86 */
87 struct {
88 /**
89 * Hash of a previously received message
90 */
91 u_int32_t hash;
92
93 /**
94 * packet for retransmission
95 */
96 packet_t *packet;
97
98 } responding;
99
100 /**
101 * Exchange we are currently handling as initiator
102 */
103 struct {
104 /**
105 * Message ID of the exchange
106 */
107 u_int32_t mid;
108
109 /**
110 * Hashes of old responses we can ignore
111 */
112 u_int32_t old_hashes[MAX_OLD_HASHES];
113
114 /**
115 * Position in old hash array
116 */
117 int old_hash_pos;
118
119 /**
120 * Sequence number of the last sent message
121 */
122 u_int32_t seqnr;
123
124 /**
125 * how many times we have retransmitted so far
126 */
127 u_int retransmitted;
128
129 /**
130 * packet for retransmission
131 */
132 packet_t *packet;
133
134 /**
135 * type of the initated exchange
136 */
137 exchange_type_t type;
138
139 } initiating;
140
141 /**
142 * List of queued tasks not yet in action
143 */
144 linked_list_t *queued_tasks;
145
146 /**
147 * List of active tasks, initiated by ourselve
148 */
149 linked_list_t *active_tasks;
150
151 /**
152 * List of tasks initiated by peer
153 */
154 linked_list_t *passive_tasks;
155
156 /**
157 * Queued messages not yet ready to process
158 */
159 message_t *queued;
160
161 /**
162 * Number of times we retransmit messages before giving up
163 */
164 u_int retransmit_tries;
165
166 /**
167 * Retransmission timeout
168 */
169 double retransmit_timeout;
170
171 /**
172 * Base to calculate retransmission timeout
173 */
174 double retransmit_base;
175 };
176
177 /**
178 * Flush a single task queue
179 */
180 static void flush_queue(private_task_manager_t *this, linked_list_t *list)
181 {
182 task_t *task;
183
184 if (this->queued)
185 {
186 this->queued->destroy(this->queued);
187 this->queued = NULL;
188 }
189 while (list->remove_last(list, (void**)&task) == SUCCESS)
190 {
191 task->destroy(task);
192 }
193 }
194
195 /**
196 * flush all tasks in the task manager
197 */
198 static void flush(private_task_manager_t *this)
199 {
200 flush_queue(this, this->queued_tasks);
201 flush_queue(this, this->passive_tasks);
202 flush_queue(this, this->active_tasks);
203 }
204
205 /**
206 * move a task of a specific type from the queue to the active list
207 */
208 static bool activate_task(private_task_manager_t *this, task_type_t type)
209 {
210 enumerator_t *enumerator;
211 task_t *task;
212 bool found = FALSE;
213
214 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
215 while (enumerator->enumerate(enumerator, (void**)&task))
216 {
217 if (task->get_type(task) == type)
218 {
219 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
220 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
221 this->active_tasks->insert_last(this->active_tasks, task);
222 found = TRUE;
223 break;
224 }
225 }
226 enumerator->destroy(enumerator);
227 return found;
228 }
229
230 METHOD(task_manager_t, retransmit, status_t,
231 private_task_manager_t *this, u_int32_t message_seqnr)
232 {
233 /* this.initiating packet used as marker for received response */
234 if (message_seqnr == this->initiating.seqnr && this->initiating.packet )
235 {
236 u_int32_t timeout;
237 packet_t *packet;
238 job_t *job;
239
240 if (this->initiating.retransmitted <= this->retransmit_tries)
241 {
242 timeout = (u_int32_t)(this->retransmit_timeout * 1000.0 *
243 pow(this->retransmit_base, this->initiating.retransmitted));
244 }
245 else
246 {
247 DBG1(DBG_IKE, "giving up after %d retransmits",
248 this->initiating.retransmitted - 1);
249 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
250 {
251 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
252 }
253 return DESTROY_ME;
254 }
255
256 if (this->initiating.retransmitted)
257 {
258 DBG1(DBG_IKE, "retransmit %d of request with message ID %u seqnr (%d)",
259 this->initiating.retransmitted, this->initiating.mid, message_seqnr);
260 }
261 packet = this->initiating.packet->clone(this->initiating.packet);
262 charon->sender->send(charon->sender, packet);
263
264 this->initiating.retransmitted++;
265 job = (job_t*)retransmit_job_create(this->initiating.seqnr,
266 this->ike_sa->get_id(this->ike_sa));
267 lib->scheduler->schedule_job_ms(lib->scheduler, job, timeout);
268 }
269 return SUCCESS;
270 }
271
272 METHOD(task_manager_t, initiate, status_t,
273 private_task_manager_t *this)
274 {
275 enumerator_t *enumerator;
276 task_t *task;
277 message_t *message;
278 host_t *me, *other;
279 status_t status;
280 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
281 bool new_mid = FALSE, expect_response = FALSE, flushed = FALSE;
282
283 if (!this->rng)
284 {
285 DBG1(DBG_IKE, "no RNG supported");
286 return FAILED;
287 }
288
289 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED)
290 {
291 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
292 exchange_type_names, this->initiating.type);
293 /* do not initiate if we already have a message in the air */
294 return SUCCESS;
295 }
296
297 if (this->active_tasks->get_count(this->active_tasks) == 0)
298 {
299 DBG2(DBG_IKE, "activating new tasks");
300 switch (this->ike_sa->get_state(this->ike_sa))
301 {
302 case IKE_CREATED:
303 activate_task(this, TASK_ISAKMP_VENDOR);
304 activate_task(this, TASK_ISAKMP_CERT_PRE);
305 if (activate_task(this, TASK_MAIN_MODE))
306 {
307 exchange = ID_PROT;
308 activate_task(this, TASK_ISAKMP_CERT_POST);
309 activate_task(this, TASK_ISAKMP_NATD);
310 }
311 break;
312 case IKE_CONNECTING:
313 if (activate_task(this, TASK_ISAKMP_DELETE))
314 {
315 exchange = INFORMATIONAL_V1;
316 new_mid = TRUE;
317 break;
318 }
319 if (activate_task(this, TASK_XAUTH))
320 {
321 exchange = TRANSACTION;
322 new_mid = TRUE;
323 break;
324 }
325 if (activate_task(this, TASK_INFORMATIONAL))
326 {
327 exchange = INFORMATIONAL_V1;
328 new_mid = TRUE;
329 break;
330 }
331 break;
332 case IKE_ESTABLISHED:
333 if (activate_task(this, TASK_MODE_CONFIG))
334 {
335 exchange = TRANSACTION;
336 new_mid = TRUE;
337 break;
338 }
339 if (activate_task(this, TASK_QUICK_MODE))
340 {
341 exchange = QUICK_MODE;
342 new_mid = TRUE;
343 break;
344 }
345 if (activate_task(this, TASK_INFORMATIONAL))
346 {
347 exchange = INFORMATIONAL_V1;
348 new_mid = TRUE;
349 break;
350 }
351 if (activate_task(this, TASK_ISAKMP_DELETE))
352 {
353 exchange = INFORMATIONAL_V1;
354 new_mid = TRUE;
355 break;
356 }
357 if (activate_task(this, TASK_QUICK_DELETE))
358 {
359 exchange = INFORMATIONAL_V1;
360 new_mid = TRUE;
361 break;
362 }
363 break;
364 default:
365 break;
366 }
367 }
368 else
369 {
370 DBG2(DBG_IKE, "reinitiating already active tasks");
371 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
372 while (enumerator->enumerate(enumerator, (void**)&task))
373 {
374 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
375 switch (task->get_type(task))
376 {
377 case TASK_MAIN_MODE:
378 exchange = ID_PROT;
379 break;
380 case TASK_QUICK_MODE:
381 exchange = QUICK_MODE;
382 break;
383 case TASK_XAUTH:
384 exchange = TRANSACTION;
385 new_mid = TRUE;
386 break;
387 default:
388 continue;
389 }
390 break;
391 }
392 enumerator->destroy(enumerator);
393 }
394
395 if (exchange == EXCHANGE_TYPE_UNDEFINED)
396 {
397 DBG2(DBG_IKE, "nothing to initiate");
398 /* nothing to do yet... */
399 return SUCCESS;
400 }
401
402 me = this->ike_sa->get_my_host(this->ike_sa);
403 other = this->ike_sa->get_other_host(this->ike_sa);
404
405 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
406 if (new_mid)
407 {
408 this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
409 (void*)&this->initiating.mid);
410 }
411 message->set_message_id(message, this->initiating.mid);
412 message->set_source(message, me->clone(me));
413 message->set_destination(message, other->clone(other));
414 message->set_exchange_type(message, exchange);
415 this->initiating.type = exchange;
416 this->initiating.retransmitted = 0;
417
418 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
419 while (enumerator->enumerate(enumerator, (void*)&task))
420 {
421 switch (task->build(task, message))
422 {
423 case SUCCESS:
424 /* task completed, remove it */
425 this->active_tasks->remove_at(this->active_tasks, enumerator);
426 task->destroy(task);
427 continue;
428 case NEED_MORE:
429 expect_response = TRUE;
430 /* processed, but task needs another exchange */
431 continue;
432 case ALREADY_DONE:
433 flush_queue(this, this->active_tasks);
434 flushed = TRUE;
435 break;
436 case FAILED:
437 default:
438 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
439 {
440 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
441 }
442 /* FALL */
443 case DESTROY_ME:
444 /* critical failure, destroy IKE_SA */
445 enumerator->destroy(enumerator);
446 message->destroy(message);
447 flush(this);
448 return DESTROY_ME;
449 }
450 break;
451 }
452 enumerator->destroy(enumerator);
453
454 if (this->active_tasks->get_count(this->active_tasks) == 0)
455 { /* tasks completed, no exchange active anymore */
456 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
457 }
458 if (flushed)
459 {
460 message->destroy(message);
461 return initiate(this);
462 }
463 this->initiating.seqnr++;
464
465 status = this->ike_sa->generate_message(this->ike_sa, message,
466 &this->initiating.packet);
467 if (status != SUCCESS)
468 {
469 /* message generation failed. There is nothing more to do than to
470 * close the SA */
471 message->destroy(message);
472 flush(this);
473 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
474 return DESTROY_ME;
475 }
476 message->destroy(message);
477
478 if (expect_response)
479 {
480 return retransmit(this, this->initiating.seqnr);
481 }
482 charon->sender->send(charon->sender,
483 this->initiating.packet->clone(this->initiating.packet));
484 this->initiating.packet->destroy(this->initiating.packet);
485 this->initiating.packet = NULL;
486
487 if (exchange == INFORMATIONAL_V1)
488 {
489 switch (this->ike_sa->get_state(this->ike_sa))
490 {
491 case IKE_CONNECTING:
492 /* close after sending an INFORMATIONAL when unestablished */
493 return FAILED;
494 case IKE_DELETING:
495 /* close after sending a DELETE */
496 return DESTROY_ME;
497 default:
498 break;
499 }
500 }
501 return SUCCESS;
502 }
503
504 /**
505 * handle exchange collisions
506 */
507 static bool handle_collisions(private_task_manager_t *this, task_t *task)
508 {
509 return FALSE;
510 }
511
512 /**
513 * build a response depending on the "passive" task list
514 */
515 static status_t build_response(private_task_manager_t *this, message_t *request)
516 {
517 enumerator_t *enumerator;
518 task_t *task;
519 message_t *message;
520 host_t *me, *other;
521 bool delete = FALSE, flushed = FALSE;
522 status_t status;
523
524 me = request->get_destination(request);
525 other = request->get_source(request);
526
527 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
528 message->set_exchange_type(message, request->get_exchange_type(request));
529 /* send response along the path the request came in */
530 message->set_source(message, me->clone(me));
531 message->set_destination(message, other->clone(other));
532 message->set_message_id(message, request->get_message_id(request));
533 message->set_request(message, FALSE);
534
535 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
536 while (enumerator->enumerate(enumerator, (void*)&task))
537 {
538 switch (task->build(task, message))
539 {
540 case SUCCESS:
541 /* task completed, remove it */
542 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
543 if (!handle_collisions(this, task))
544 {
545 task->destroy(task);
546 }
547 continue;
548 case NEED_MORE:
549 /* processed, but task needs another exchange */
550 if (handle_collisions(this, task))
551 {
552 this->passive_tasks->remove_at(this->passive_tasks,
553 enumerator);
554 }
555 continue;
556 case ALREADY_DONE:
557 flush_queue(this, this->passive_tasks);
558 flushed = TRUE;
559 break;
560 case FAILED:
561 default:
562 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
563 /* FALL */
564 case DESTROY_ME:
565 /* destroy IKE_SA, but SEND response first */
566 delete = TRUE;
567 break;
568 }
569 break;
570 }
571 enumerator->destroy(enumerator);
572
573 DESTROY_IF(this->responding.packet);
574 this->responding.packet = NULL;
575 if (flushed)
576 {
577 message->destroy(message);
578 return initiate(this);
579 }
580 status = this->ike_sa->generate_message(this->ike_sa, message,
581 &this->responding.packet);
582 message->destroy(message);
583 if (status != SUCCESS)
584 {
585 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
586 return DESTROY_ME;
587 }
588
589 charon->sender->send(charon->sender,
590 this->responding.packet->clone(this->responding.packet));
591 if (delete)
592 {
593 return DESTROY_ME;
594 }
595 return SUCCESS;
596 }
597
598 /**
599 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
600 * The notify protocol_id is set to ISAKMP
601 */
602 static void send_notify(private_task_manager_t *this, message_t *request,
603 notify_type_t type)
604 {
605 message_t *response;
606 packet_t *packet;
607 host_t *me, *other;
608 u_int32_t mid;
609
610 if (request && request->get_exchange_type(request) == INFORMATIONAL_V1)
611 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
612 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
613 return;
614 }
615
616 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
617 response->set_exchange_type(response, INFORMATIONAL_V1);
618 response->set_request(response, TRUE);
619 this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid);
620 response->set_message_id(response, mid);
621 response->add_payload(response, (payload_t*)
622 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
623 PROTO_IKE, type));
624
625 me = this->ike_sa->get_my_host(this->ike_sa);
626 if (me->is_anyaddr(me))
627 {
628 me = request->get_destination(request);
629 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
630 }
631 other = this->ike_sa->get_other_host(this->ike_sa);
632 if (other->is_anyaddr(other))
633 {
634 other = request->get_source(request);
635 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
636 }
637 response->set_source(response, me->clone(me));
638 response->set_destination(response, other->clone(other));
639 if (this->ike_sa->generate_message(this->ike_sa, response,
640 &packet) == SUCCESS)
641 {
642 charon->sender->send(charon->sender, packet);
643 }
644 response->destroy(response);
645 }
646
647 /**
648 * handle an incoming request message
649 */
650 static status_t process_request(private_task_manager_t *this,
651 message_t *message)
652 {
653 enumerator_t *enumerator;
654 task_t *task = NULL;
655 bool send_response = FALSE;
656
657 if (this->passive_tasks->get_count(this->passive_tasks) == 0)
658 { /* create tasks depending on request type, if not already some queued */
659 switch (message->get_exchange_type(message))
660 {
661 case ID_PROT:
662 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
663 this->passive_tasks->insert_last(this->passive_tasks, task);
664 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
665 this->passive_tasks->insert_last(this->passive_tasks, task);
666 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
667 this->passive_tasks->insert_last(this->passive_tasks, task);
668 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
669 this->passive_tasks->insert_last(this->passive_tasks, task);
670 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
671 this->passive_tasks->insert_last(this->passive_tasks, task);
672 break;
673 case AGGRESSIVE:
674 /* TODO-IKEv1: agressive mode */
675 return FAILED;
676 case QUICK_MODE:
677 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
678 {
679 DBG1(DBG_IKE, "received quick mode request for "
680 "unestablished IKE_SA, ignored");
681 return FAILED;
682 }
683 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
684 NULL, NULL);
685 this->passive_tasks->insert_last(this->passive_tasks, task);
686 break;
687 case INFORMATIONAL_V1:
688 task = (task_t *)informational_create(this->ike_sa, NULL);
689 this->passive_tasks->insert_last(this->passive_tasks, task);
690 break;
691 case TRANSACTION:
692 if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
693 {
694 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
695 }
696 else
697 {
698 task = (task_t *)xauth_create(this->ike_sa, FALSE);
699 }
700 this->passive_tasks->insert_last(this->passive_tasks, task);
701 break;
702 default:
703 return FAILED;
704 }
705 }
706 /* let the tasks process the message */
707 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
708 while (enumerator->enumerate(enumerator, (void*)&task))
709 {
710 switch (task->process(task, message))
711 {
712 case SUCCESS:
713 /* task completed, remove it */
714 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
715 task->destroy(task);
716 continue;
717 case NEED_MORE:
718 /* processed, but task needs at least another call to build() */
719 send_response = TRUE;
720 continue;
721 case ALREADY_DONE:
722 send_response = FALSE;
723 flush_queue(this, this->passive_tasks);
724 break;
725 case FAILED:
726 default:
727 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
728 /* FALL */
729 case DESTROY_ME:
730 /* critical failure, destroy IKE_SA */
731 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
732 enumerator->destroy(enumerator);
733 task->destroy(task);
734 return DESTROY_ME;
735 }
736 break;
737 }
738 enumerator->destroy(enumerator);
739
740 if (send_response)
741 {
742 if (build_response(this, message) != SUCCESS)
743 {
744 return DESTROY_ME;
745 }
746 }
747 else
748 { /* We don't send a response, so don't retransmit one if we get
749 * the same message again. */
750 DESTROY_IF(this->responding.packet);
751 this->responding.packet = NULL;
752 }
753 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
754 this->queued_tasks->get_count(this->queued_tasks) > 0)
755 {
756 /* passive tasks completed, check if an active task has been queued,
757 * such as XAUTH or modeconfig push */
758 return initiate(this);
759 }
760 return SUCCESS;
761 }
762
763 /**
764 * handle an incoming response message
765 */
766 static status_t process_response(private_task_manager_t *this,
767 message_t *message)
768 {
769 enumerator_t *enumerator;
770 status_t status;
771 task_t *task;
772
773 if (message->get_exchange_type(message) != this->initiating.type)
774 {
775 DBG1(DBG_IKE, "received %N response, but expected %N",
776 exchange_type_names, message->get_exchange_type(message),
777 exchange_type_names, this->initiating.type);
778 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
779 return DESTROY_ME;
780 }
781
782 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
783 while (enumerator->enumerate(enumerator, (void*)&task))
784 {
785 switch (task->process(task, message))
786 {
787 case SUCCESS:
788 /* task completed, remove it */
789 this->active_tasks->remove_at(this->active_tasks, enumerator);
790 task->destroy(task);
791 continue;
792 case NEED_MORE:
793 /* processed, but task needs another exchange */
794 continue;
795 case ALREADY_DONE:
796 flush_queue(this, this->active_tasks);
797 break;
798 case FAILED:
799 default:
800 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
801 /* FALL */
802 case DESTROY_ME:
803 /* critical failure, destroy IKE_SA */
804 this->active_tasks->remove_at(this->active_tasks, enumerator);
805 enumerator->destroy(enumerator);
806 task->destroy(task);
807 return DESTROY_ME;
808 }
809 break;
810 }
811 enumerator->destroy(enumerator);
812
813 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
814 this->initiating.packet->destroy(this->initiating.packet);
815 this->initiating.packet = NULL;
816
817 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
818 {
819 status = this->public.task_manager.process_message(
820 &this->public.task_manager, this->queued);
821 this->queued->destroy(this->queued);
822 this->queued = NULL;
823 if (status == DESTROY_ME)
824 {
825 return status;
826 }
827 }
828
829 return initiate(this);
830 }
831
832 /**
833 * Parse the given message and verify that it is valid.
834 */
835 static status_t parse_message(private_task_manager_t *this, message_t *msg)
836 {
837 status_t status;
838
839 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
840
841 if (status != SUCCESS)
842 {
843 switch (status)
844 {
845 case NOT_SUPPORTED:
846 DBG1(DBG_IKE, "unsupported exchange type");
847 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
848 break;
849 case PARSE_ERROR:
850 DBG1(DBG_IKE, "message parsing failed");
851 send_notify(this, msg, PAYLOAD_MALFORMED);
852 break;
853 case VERIFY_ERROR:
854 DBG1(DBG_IKE, "message verification failed");
855 send_notify(this, msg, PAYLOAD_MALFORMED);
856 break;
857 case FAILED:
858 DBG1(DBG_IKE, "integrity check failed");
859 send_notify(this, msg, INVALID_HASH_INFORMATION);
860 break;
861 case INVALID_STATE:
862 DBG1(DBG_IKE, "found encrypted message, but no keys available");
863 send_notify(this, msg, PAYLOAD_MALFORMED);
864 default:
865 break;
866 }
867 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
868 exchange_type_names, msg->get_exchange_type(msg),
869 msg->get_request(msg) ? "request" : "response",
870 msg->get_message_id(msg));
871
872 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
873 { /* invalid initiation attempt, close SA */
874 return DESTROY_ME;
875 }
876 }
877 return status;
878 }
879
880 METHOD(task_manager_t, process_message, status_t,
881 private_task_manager_t *this, message_t *msg)
882 {
883 u_int32_t hash, mid, i;
884 host_t *me, *other;
885 status_t status;
886
887 /* TODO-IKEv1: update hosts more selectively */
888 me = msg->get_destination(msg);
889 other = msg->get_source(msg);
890 mid = msg->get_message_id(msg);
891 hash = chunk_hash(msg->get_packet_data(msg));
892 for (i = 0; i < MAX_OLD_HASHES; i++)
893 {
894 if (this->initiating.old_hashes[i] == hash)
895 {
896 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
897 "but next request already sent", mid);
898 return SUCCESS;
899 }
900 }
901
902 if ((mid && mid == this->initiating.mid) ||
903 (this->initiating.mid == 0 &&
904 msg->get_exchange_type(msg) == this->initiating.type &&
905 this->active_tasks->get_count(this->active_tasks)))
906 {
907 msg->set_request(msg, FALSE);
908 status = parse_message(this, msg);
909 if (status != SUCCESS)
910 {
911 return status;
912 }
913 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
914 time_monotonic(NULL));
915 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
916 charon->bus->message(charon->bus, msg, FALSE);
917 if (process_response(this, msg) != SUCCESS)
918 {
919 flush(this);
920 return DESTROY_ME;
921 }
922 this->initiating.old_hashes[(this->initiating.old_hash_pos++) %
923 MAX_OLD_HASHES] = hash;
924 }
925 else
926 {
927 if (hash == this->responding.hash)
928 {
929 if (this->responding.packet)
930 {
931 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
932 "retransmitting response", mid);
933 charon->sender->send(charon->sender,
934 this->responding.packet->clone(this->responding.packet));
935 }
936 else
937 {
938 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
939 "but no response to retransmit", mid);
940 }
941 return SUCCESS;
942 }
943 if (msg->get_exchange_type(msg) == TRANSACTION &&
944 this->active_tasks->get_count(this->active_tasks))
945 { /* main mode not yet complete, queue XAuth/Mode config tasks */
946 if (this->queued)
947 {
948 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
949 exchange_type_names, TRANSACTION);
950 return SUCCESS;
951 }
952 this->queued = message_create_from_packet(msg->get_packet(msg));
953 if (this->queued->parse_header(this->queued) != SUCCESS)
954 {
955 this->queued->destroy(this->queued);
956 this->queued = NULL;
957 return FAILED;
958 }
959 DBG1(DBG_IKE, "queueing %N request as tasks still active",
960 exchange_type_names, TRANSACTION);
961 return SUCCESS;
962 }
963
964 msg->set_request(msg, TRUE);
965 status = parse_message(this, msg);
966 if (status != SUCCESS)
967 {
968 return status;
969 }
970 /* if this IKE_SA is virgin, we check for a config */
971 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
972 {
973 ike_sa_id_t *ike_sa_id;
974 ike_cfg_t *ike_cfg;
975 job_t *job;
976 ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
977 if (ike_cfg == NULL)
978 {
979 /* no config found for these hosts, destroy */
980 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
981 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
982 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
983 return DESTROY_ME;
984 }
985 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
986 ike_cfg->destroy(ike_cfg);
987 /* add a timeout if peer does not establish it completely */
988 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
989 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
990 lib->scheduler->schedule_job(lib->scheduler, job,
991 lib->settings->get_int(lib->settings,
992 "charon.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT));
993 }
994 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
995 time_monotonic(NULL));
996 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
997 charon->bus->message(charon->bus, msg, TRUE);
998 if (process_request(this, msg) != SUCCESS)
999 {
1000 flush(this);
1001 return DESTROY_ME;
1002 }
1003 this->responding.hash = hash;
1004 }
1005 return SUCCESS;
1006 }
1007
1008 METHOD(task_manager_t, queue_task, void,
1009 private_task_manager_t *this, task_t *task)
1010 {
1011 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1012 this->queued_tasks->insert_last(this->queued_tasks, task);
1013 }
1014
1015 METHOD(task_manager_t, queue_ike, void,
1016 private_task_manager_t *this)
1017 {
1018 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1019 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1020 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1021 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1022 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1023 }
1024
1025 METHOD(task_manager_t, queue_child, void,
1026 private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1027 traffic_selector_t *tsi, traffic_selector_t *tsr)
1028 {
1029 queue_task(this, (task_t*)quick_mode_create(this->ike_sa, cfg, tsi, tsr));
1030 }
1031
1032 METHOD(task_manager_t, queue_child_rekey, void,
1033 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1034 {
1035 /* TODO-IKEv1: CHILD rekeying */
1036 }
1037
1038 METHOD(task_manager_t, queue_child_delete, void,
1039 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1040 {
1041 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1042 spi, FALSE));
1043 }
1044
1045 METHOD(task_manager_t, queue_dpd, void,
1046 private_task_manager_t *this)
1047 {
1048 /* TODO-IKEv1: DPD checking */
1049 }
1050
1051 METHOD(task_manager_t, adopt_tasks, void,
1052 private_task_manager_t *this, task_manager_t *other_public)
1053 {
1054 private_task_manager_t *other = (private_task_manager_t*)other_public;
1055 task_t *task;
1056
1057 /* move queued tasks from other to this */
1058 while (other->queued_tasks->remove_last(other->queued_tasks,
1059 (void**)&task) == SUCCESS)
1060 {
1061 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1062 task->migrate(task, this->ike_sa);
1063 this->queued_tasks->insert_first(this->queued_tasks, task);
1064 }
1065 }
1066
1067 METHOD(task_manager_t, busy, bool,
1068 private_task_manager_t *this)
1069 {
1070 return (this->active_tasks->get_count(this->active_tasks) > 0);
1071 }
1072
1073 METHOD(task_manager_t, incr_mid, void,
1074 private_task_manager_t *this, bool initiate)
1075 {
1076 }
1077
1078 METHOD(task_manager_t, reset, void,
1079 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1080 {
1081 }
1082
1083 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1084 private_task_manager_t *this, task_queue_t queue)
1085 {
1086 switch (queue)
1087 {
1088 case TASK_QUEUE_ACTIVE:
1089 return this->active_tasks->create_enumerator(this->active_tasks);
1090 case TASK_QUEUE_PASSIVE:
1091 return this->passive_tasks->create_enumerator(this->passive_tasks);
1092 case TASK_QUEUE_QUEUED:
1093 return this->queued_tasks->create_enumerator(this->queued_tasks);
1094 default:
1095 return enumerator_create_empty();
1096 }
1097 }
1098
1099 METHOD(task_manager_t, destroy, void,
1100 private_task_manager_t *this)
1101 {
1102 flush(this);
1103
1104 this->active_tasks->destroy(this->active_tasks);
1105 this->queued_tasks->destroy(this->queued_tasks);
1106 this->passive_tasks->destroy(this->passive_tasks);
1107
1108 DESTROY_IF(this->queued);
1109 DESTROY_IF(this->responding.packet);
1110 DESTROY_IF(this->initiating.packet);
1111 DESTROY_IF(this->rng);
1112 free(this);
1113 }
1114
1115 /*
1116 * see header file
1117 */
1118 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1119 {
1120 private_task_manager_t *this;
1121
1122 INIT(this,
1123 .public = {
1124 .task_manager = {
1125 .process_message = _process_message,
1126 .queue_task = _queue_task,
1127 .queue_ike = _queue_ike,
1128 .queue_child = _queue_child,
1129 .queue_child_rekey = _queue_child_rekey,
1130 .queue_child_delete = _queue_child_delete,
1131 .queue_dpd = _queue_dpd,
1132 .initiate = _initiate,
1133 .retransmit = _retransmit,
1134 .incr_mid = _incr_mid,
1135 .reset = _reset,
1136 .adopt_tasks = _adopt_tasks,
1137 .busy = _busy,
1138 .create_task_enumerator = _create_task_enumerator,
1139 .destroy = _destroy,
1140 },
1141 },
1142 .ike_sa = ike_sa,
1143 .initiating.type = EXCHANGE_TYPE_UNDEFINED,
1144 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1145 .queued_tasks = linked_list_create(),
1146 .active_tasks = linked_list_create(),
1147 .passive_tasks = linked_list_create(),
1148 .retransmit_tries = lib->settings->get_int(lib->settings,
1149 "charon.retransmit_tries", RETRANSMIT_TRIES),
1150 .retransmit_timeout = lib->settings->get_double(lib->settings,
1151 "charon.retransmit_timeout", RETRANSMIT_TIMEOUT),
1152 .retransmit_base = lib->settings->get_double(lib->settings,
1153 "charon.retransmit_base", RETRANSMIT_BASE),
1154 );
1155
1156 return &this->public;
1157 }