ike: Migrate queued CHILD_SA-creating tasks when reestablishing an IKE_SA
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2013 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/aggressive_mode.h>
24 #include <sa/ikev1/tasks/quick_mode.h>
25 #include <sa/ikev1/tasks/quick_delete.h>
26 #include <sa/ikev1/tasks/xauth.h>
27 #include <sa/ikev1/tasks/mode_config.h>
28 #include <sa/ikev1/tasks/informational.h>
29 #include <sa/ikev1/tasks/isakmp_natd.h>
30 #include <sa/ikev1/tasks/isakmp_vendor.h>
31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
33 #include <sa/ikev1/tasks/isakmp_delete.h>
34 #include <sa/ikev1/tasks/isakmp_dpd.h>
35
36 #include <processing/jobs/retransmit_job.h>
37 #include <processing/jobs/delete_ike_sa_job.h>
38 #include <processing/jobs/dpd_timeout_job.h>
39 #include <processing/jobs/process_message_job.h>
40
41 #include <encoding/payloads/fragment_payload.h>
42 #include <bio/bio_writer.h>
43
44 /**
45 * Number of old messages hashes we keep for retransmission.
46 *
47 * In Main Mode, we must ignore messages from a previous message pair if
48 * we already continued to the next. Otherwise a late retransmission
49 * could be considered as a reply to the newer request.
50 */
51 #define MAX_OLD_HASHES 2
52
53 /**
54 * Maximum packet size for fragmented packets (same as in sockets)
55 */
56 #define MAX_PACKET 10000
57
58 /**
59 * Maximum size of fragment data when sending packets (currently the same is
60 * used for IPv4 and IPv6, even though the latter has a higher minimum datagram
61 * size). 576 (= min. IPv4) - 20 (= IP header) - 8 (= UDP header) -
62 * - 28 (= IKE header) - 8 (= fragment header) = 512
63 * This is reduced by 4 in case of NAT-T (due to the non-ESP marker).
64 */
65 #define MAX_FRAGMENT_SIZE 512
66
67 /**
68 * First sequence number of responding packets.
69 *
70 * To distinguish retransmission jobs for initiating and responding packets,
71 * we split up the sequence counter and use the upper half for responding.
72 */
73 #define RESPONDING_SEQ INT_MAX
74
75 typedef struct exchange_t exchange_t;
76
77 /**
78 * An exchange in the air, used do detect and handle retransmission
79 */
80 struct exchange_t {
81
82 /**
83 * Message ID used for this transaction
84 */
85 u_int32_t mid;
86
87 /**
88 * generated packet for retransmission
89 */
90 packet_t *packet;
91 };
92
93 typedef struct private_task_manager_t private_task_manager_t;
94
95 /**
96 * private data of the task manager
97 */
98 struct private_task_manager_t {
99
100 /**
101 * public functions
102 */
103 task_manager_v1_t public;
104
105 /**
106 * associated IKE_SA we are serving
107 */
108 ike_sa_t *ike_sa;
109
110 /**
111 * RNG to create message IDs
112 */
113 rng_t *rng;
114
115 /**
116 * Exchange we are currently handling as responder
117 */
118 struct {
119 /**
120 * Message ID of the last response
121 */
122 u_int32_t mid;
123
124 /**
125 * Hash of a previously received message
126 */
127 u_int32_t hash;
128
129 /**
130 * packet for retransmission
131 */
132 packet_t *packet;
133
134 /**
135 * Sequence number of the last sent message
136 */
137 u_int32_t seqnr;
138
139 /**
140 * how many times we have retransmitted so far
141 */
142 u_int retransmitted;
143
144 } responding;
145
146 /**
147 * Exchange we are currently handling as initiator
148 */
149 struct {
150 /**
151 * Message ID of the exchange
152 */
153 u_int32_t mid;
154
155 /**
156 * Hashes of old responses we can ignore
157 */
158 u_int32_t old_hashes[MAX_OLD_HASHES];
159
160 /**
161 * Position in old hash array
162 */
163 int old_hash_pos;
164
165 /**
166 * Sequence number of the last sent message
167 */
168 u_int32_t seqnr;
169
170 /**
171 * how many times we have retransmitted so far
172 */
173 u_int retransmitted;
174
175 /**
176 * packet for retransmission
177 */
178 packet_t *packet;
179
180 /**
181 * type of the initiated exchange
182 */
183 exchange_type_t type;
184
185 } initiating;
186
187 /**
188 * Data used to reassemble a fragmented message
189 */
190 struct {
191
192 /**
193 * Fragment ID (currently only one is supported at a time)
194 */
195 u_int16_t id;
196
197 /**
198 * The number of the last fragment (in case we receive the fragments out
199 * of order), since the first starts with 1 this defines the number of
200 * fragments we expect
201 */
202 u_int8_t last;
203
204 /**
205 * List of fragments (fragment_t*)
206 */
207 linked_list_t *list;
208
209 /**
210 * Length of all currently received fragments
211 */
212 size_t len;
213
214 /**
215 * Maximum length of a fragmented packet
216 */
217 size_t max_packet;
218
219 /**
220 * Maximum length of a single fragment (when sending)
221 */
222 size_t size;
223
224 /**
225 * The exchange type we use for fragments. Always the initial type even
226 * for fragmented quick mode or transaction messages (i.e. either
227 * ID_PROT or AGGRESSIVE)
228 */
229 exchange_type_t exchange;
230
231 } frag;
232
233 /**
234 * List of queued tasks not yet in action
235 */
236 linked_list_t *queued_tasks;
237
238 /**
239 * List of active tasks, initiated by ourselves
240 */
241 linked_list_t *active_tasks;
242
243 /**
244 * List of tasks initiated by peer
245 */
246 linked_list_t *passive_tasks;
247
248 /**
249 * Queued messages not yet ready to process
250 */
251 message_t *queued;
252
253 /**
254 * Number of times we retransmit messages before giving up
255 */
256 u_int retransmit_tries;
257
258 /**
259 * Retransmission timeout
260 */
261 double retransmit_timeout;
262
263 /**
264 * Base to calculate retransmission timeout
265 */
266 double retransmit_base;
267
268 /**
269 * Sequence number for sending DPD requests
270 */
271 u_int32_t dpd_send;
272
273 /**
274 * Sequence number for received DPD requests
275 */
276 u_int32_t dpd_recv;
277 };
278
279 /**
280 * A single fragment within a fragmented message
281 */
282 typedef struct {
283
284 /** fragment number */
285 u_int8_t num;
286
287 /** fragment data */
288 chunk_t data;
289
290 } fragment_t;
291
292 static void fragment_destroy(fragment_t *this)
293 {
294 chunk_free(&this->data);
295 free(this);
296 }
297
298 static void clear_fragments(private_task_manager_t *this, u_int16_t id)
299 {
300 DESTROY_FUNCTION_IF(this->frag.list, (void*)fragment_destroy);
301 this->frag.list = NULL;
302 this->frag.last = 0;
303 this->frag.len = 0;
304 this->frag.id = id;
305 }
306
307 METHOD(task_manager_t, flush_queue, void,
308 private_task_manager_t *this, task_queue_t queue)
309 {
310 linked_list_t *list;
311 task_t *task;
312
313 if (this->queued)
314 {
315 this->queued->destroy(this->queued);
316 this->queued = NULL;
317 }
318 switch (queue)
319 {
320 case TASK_QUEUE_ACTIVE:
321 list = this->active_tasks;
322 /* cancel pending retransmits */
323 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
324 DESTROY_IF(this->initiating.packet);
325 this->initiating.packet = NULL;
326 break;
327 case TASK_QUEUE_PASSIVE:
328 list = this->passive_tasks;
329 break;
330 case TASK_QUEUE_QUEUED:
331 list = this->queued_tasks;
332 break;
333 default:
334 return;
335 }
336 while (list->remove_last(list, (void**)&task) == SUCCESS)
337 {
338 task->destroy(task);
339 }
340 }
341
342 /**
343 * flush all tasks in the task manager
344 */
345 static void flush(private_task_manager_t *this)
346 {
347 flush_queue(this, TASK_QUEUE_QUEUED);
348 flush_queue(this, TASK_QUEUE_PASSIVE);
349 flush_queue(this, TASK_QUEUE_ACTIVE);
350 }
351
352 /**
353 * move a task of a specific type from the queue to the active list
354 */
355 static bool activate_task(private_task_manager_t *this, task_type_t type)
356 {
357 enumerator_t *enumerator;
358 task_t *task;
359 bool found = FALSE;
360
361 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
362 while (enumerator->enumerate(enumerator, (void**)&task))
363 {
364 if (task->get_type(task) == type)
365 {
366 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
367 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
368 this->active_tasks->insert_last(this->active_tasks, task);
369 found = TRUE;
370 break;
371 }
372 }
373 enumerator->destroy(enumerator);
374 return found;
375 }
376
377 /**
378 * Send a single fragment with the given data
379 */
380 static bool send_fragment(private_task_manager_t *this, bool request,
381 host_t *src, host_t *dst, fragment_payload_t *fragment)
382 {
383 message_t *message;
384 packet_t *packet;
385 status_t status;
386
387 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
388 /* other implementations seem to just use 0 as message ID, so here we go */
389 message->set_message_id(message, 0);
390 message->set_request(message, request);
391 message->set_source(message, src->clone(src));
392 message->set_destination(message, dst->clone(dst));
393 message->set_exchange_type(message, this->frag.exchange);
394 message->add_payload(message, (payload_t*)fragment);
395
396 status = this->ike_sa->generate_message(this->ike_sa, message, &packet);
397 if (status != SUCCESS)
398 {
399 DBG1(DBG_IKE, "failed to generate IKE fragment");
400 message->destroy(message);
401 return FALSE;
402 }
403 charon->sender->send(charon->sender, packet);
404 message->destroy(message);
405 return TRUE;
406 }
407
408 /**
409 * Send a packet, if supported and required do so in fragments
410 */
411 static bool send_packet(private_task_manager_t *this, bool request,
412 packet_t *packet)
413 {
414 bool use_frags = FALSE;
415 ike_cfg_t *ike_cfg;
416 host_t *src, *dst;
417 chunk_t data;
418
419 ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
420 if (ike_cfg)
421 {
422 switch (ike_cfg->fragmentation(ike_cfg))
423 {
424 case FRAGMENTATION_FORCE:
425 use_frags = TRUE;
426 break;
427 case FRAGMENTATION_YES:
428 use_frags = this->ike_sa->supports_extension(this->ike_sa,
429 EXT_IKE_FRAGMENTATION);
430 break;
431 default:
432 break;
433 }
434 }
435 data = packet->get_data(packet);
436 if (data.len > this->frag.size && use_frags)
437 {
438 fragment_payload_t *fragment;
439 u_int8_t num, count;
440 size_t len, frag_size;
441 bool nat;
442
443 /* reduce size due to non-ESP marker */
444 nat = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
445 frag_size = this->frag.size - (nat ? 4 : 0);
446
447 src = packet->get_source(packet);
448 dst = packet->get_destination(packet);
449 count = (data.len / (frag_size + 1)) + 1;
450
451 DBG1(DBG_IKE, "sending IKE message with length of %zu bytes in "
452 "%hhu fragments", data.len, count);
453 for (num = 1; num <= count; num++)
454 {
455 len = min(data.len, frag_size);
456 fragment = fragment_payload_create_from_data(num, num == count,
457 chunk_create(data.ptr, len));
458 if (!send_fragment(this, request, src, dst, fragment))
459 {
460 packet->destroy(packet);
461 return FALSE;
462 }
463 data = chunk_skip(data, len);
464 }
465 packet->destroy(packet);
466 return TRUE;
467 }
468 charon->sender->send(charon->sender, packet);
469 return TRUE;
470 }
471
472 /**
473 * Retransmit a packet, either as initiator or as responder
474 */
475 static status_t retransmit_packet(private_task_manager_t *this, bool request,
476 u_int32_t seqnr, u_int mid, u_int retransmitted, packet_t *packet)
477 {
478 u_int32_t t;
479
480 if (retransmitted > this->retransmit_tries)
481 {
482 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
483 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_TIMEOUT, packet);
484 return DESTROY_ME;
485 }
486 t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
487 pow(this->retransmit_base, retransmitted));
488 if (retransmitted)
489 {
490 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
491 retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
492 mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
493 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND, packet);
494 }
495 if (!send_packet(this, request, packet->clone(packet)))
496 {
497 return DESTROY_ME;
498 }
499 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
500 retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
501 return NEED_MORE;
502 }
503
504 METHOD(task_manager_t, retransmit, status_t,
505 private_task_manager_t *this, u_int32_t seqnr)
506 {
507 status_t status = SUCCESS;
508
509 if (seqnr == this->initiating.seqnr && this->initiating.packet)
510 {
511 status = retransmit_packet(this, TRUE, seqnr, this->initiating.mid,
512 this->initiating.retransmitted, this->initiating.packet);
513 if (status == NEED_MORE)
514 {
515 this->initiating.retransmitted++;
516 status = SUCCESS;
517 }
518 }
519 if (seqnr == this->responding.seqnr && this->responding.packet)
520 {
521 status = retransmit_packet(this, FALSE, seqnr, this->responding.mid,
522 this->responding.retransmitted, this->responding.packet);
523 if (status == NEED_MORE)
524 {
525 this->responding.retransmitted++;
526 status = SUCCESS;
527 }
528 }
529 return status;
530 }
531
532 /**
533 * Check if we have to wait for a mode config before starting a quick mode
534 */
535 static bool mode_config_expected(private_task_manager_t *this)
536 {
537 enumerator_t *enumerator;
538 peer_cfg_t *peer_cfg;
539 char *pool;
540 host_t *host;
541
542 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
543 if (peer_cfg)
544 {
545 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
546 if (!enumerator->enumerate(enumerator, &pool))
547 { /* no pool configured */
548 enumerator->destroy(enumerator);
549 return FALSE;
550 }
551 enumerator->destroy(enumerator);
552
553 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
554 FALSE);
555 if (!enumerator->enumerate(enumerator, &host))
556 { /* have a pool, but no VIP assigned yet */
557 enumerator->destroy(enumerator);
558 return TRUE;
559 }
560 enumerator->destroy(enumerator);
561 }
562 return FALSE;
563 }
564
565 METHOD(task_manager_t, initiate, status_t,
566 private_task_manager_t *this)
567 {
568 enumerator_t *enumerator;
569 task_t *task;
570 message_t *message;
571 host_t *me, *other;
572 status_t status;
573 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
574 bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
575
576 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
577 this->initiating.type != INFORMATIONAL_V1)
578 {
579 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
580 exchange_type_names, this->initiating.type);
581 /* do not initiate if we already have a message in the air */
582 return SUCCESS;
583 }
584
585 if (this->active_tasks->get_count(this->active_tasks) == 0)
586 {
587 DBG2(DBG_IKE, "activating new tasks");
588 switch (this->ike_sa->get_state(this->ike_sa))
589 {
590 case IKE_CREATED:
591 activate_task(this, TASK_ISAKMP_VENDOR);
592 activate_task(this, TASK_ISAKMP_CERT_PRE);
593 if (activate_task(this, TASK_MAIN_MODE))
594 {
595 exchange = ID_PROT;
596 }
597 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
598 {
599 exchange = AGGRESSIVE;
600 }
601 activate_task(this, TASK_ISAKMP_CERT_POST);
602 activate_task(this, TASK_ISAKMP_NATD);
603 break;
604 case IKE_CONNECTING:
605 if (activate_task(this, TASK_ISAKMP_DELETE))
606 {
607 exchange = INFORMATIONAL_V1;
608 new_mid = TRUE;
609 break;
610 }
611 if (activate_task(this, TASK_XAUTH))
612 {
613 exchange = TRANSACTION;
614 new_mid = TRUE;
615 break;
616 }
617 if (activate_task(this, TASK_INFORMATIONAL))
618 {
619 exchange = INFORMATIONAL_V1;
620 new_mid = TRUE;
621 break;
622 }
623 break;
624 case IKE_ESTABLISHED:
625 if (activate_task(this, TASK_MODE_CONFIG))
626 {
627 exchange = TRANSACTION;
628 new_mid = TRUE;
629 break;
630 }
631 if (!mode_config_expected(this) &&
632 activate_task(this, TASK_QUICK_MODE))
633 {
634 exchange = QUICK_MODE;
635 new_mid = TRUE;
636 break;
637 }
638 if (activate_task(this, TASK_INFORMATIONAL))
639 {
640 exchange = INFORMATIONAL_V1;
641 new_mid = TRUE;
642 break;
643 }
644 if (activate_task(this, TASK_QUICK_DELETE))
645 {
646 exchange = INFORMATIONAL_V1;
647 new_mid = TRUE;
648 break;
649 }
650 if (activate_task(this, TASK_ISAKMP_DELETE))
651 {
652 exchange = INFORMATIONAL_V1;
653 new_mid = TRUE;
654 break;
655 }
656 if (activate_task(this, TASK_ISAKMP_DPD))
657 {
658 exchange = INFORMATIONAL_V1;
659 new_mid = TRUE;
660 break;
661 }
662 break;
663 default:
664 break;
665 }
666 }
667 else
668 {
669 DBG2(DBG_IKE, "reinitiating already active tasks");
670 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
671 while (enumerator->enumerate(enumerator, (void**)&task))
672 {
673 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
674 switch (task->get_type(task))
675 {
676 case TASK_MAIN_MODE:
677 exchange = ID_PROT;
678 break;
679 case TASK_AGGRESSIVE_MODE:
680 exchange = AGGRESSIVE;
681 break;
682 case TASK_QUICK_MODE:
683 exchange = QUICK_MODE;
684 break;
685 case TASK_XAUTH:
686 exchange = TRANSACTION;
687 new_mid = TRUE;
688 break;
689 default:
690 continue;
691 }
692 break;
693 }
694 enumerator->destroy(enumerator);
695 }
696
697 if (exchange == EXCHANGE_TYPE_UNDEFINED)
698 {
699 DBG2(DBG_IKE, "nothing to initiate");
700 /* nothing to do yet... */
701 return SUCCESS;
702 }
703
704 me = this->ike_sa->get_my_host(this->ike_sa);
705 other = this->ike_sa->get_other_host(this->ike_sa);
706
707 if (new_mid)
708 {
709 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
710 (void*)&this->initiating.mid))
711 {
712 DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
713 flush(this);
714 return DESTROY_ME;
715 }
716 }
717 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
718 message->set_message_id(message, this->initiating.mid);
719 message->set_source(message, me->clone(me));
720 message->set_destination(message, other->clone(other));
721 message->set_exchange_type(message, exchange);
722 this->initiating.type = exchange;
723 this->initiating.retransmitted = 0;
724
725 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
726 while (enumerator->enumerate(enumerator, (void*)&task))
727 {
728 switch (task->build(task, message))
729 {
730 case SUCCESS:
731 /* task completed, remove it */
732 this->active_tasks->remove_at(this->active_tasks, enumerator);
733 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
734 task->get_type(task) == TASK_QUICK_MODE)
735 { /* last message of three message exchange */
736 keep = TRUE;
737 }
738 task->destroy(task);
739 continue;
740 case NEED_MORE:
741 expect_response = TRUE;
742 /* processed, but task needs another exchange */
743 continue;
744 case ALREADY_DONE:
745 cancelled = TRUE;
746 break;
747 case FAILED:
748 default:
749 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
750 {
751 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
752 }
753 /* FALL */
754 case DESTROY_ME:
755 /* critical failure, destroy IKE_SA */
756 enumerator->destroy(enumerator);
757 message->destroy(message);
758 flush(this);
759 return DESTROY_ME;
760 }
761 break;
762 }
763 enumerator->destroy(enumerator);
764
765 if (this->active_tasks->get_count(this->active_tasks) == 0 &&
766 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
767 { /* tasks completed, no exchange active anymore */
768 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
769 }
770 if (cancelled)
771 {
772 message->destroy(message);
773 return initiate(this);
774 }
775
776 DESTROY_IF(this->initiating.packet);
777 status = this->ike_sa->generate_message(this->ike_sa, message,
778 &this->initiating.packet);
779 if (status != SUCCESS)
780 {
781 /* message generation failed. There is nothing more to do than to
782 * close the SA */
783 message->destroy(message);
784 flush(this);
785 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
786 return DESTROY_ME;
787 }
788
789 this->initiating.seqnr++;
790 if (expect_response)
791 {
792 message->destroy(message);
793 return retransmit(this, this->initiating.seqnr);
794 }
795 if (keep)
796 { /* keep the packet for retransmission, the responder might request it */
797 send_packet(this, TRUE,
798 this->initiating.packet->clone(this->initiating.packet));
799 }
800 else
801 {
802 send_packet(this, TRUE, this->initiating.packet);
803 this->initiating.packet = NULL;
804 }
805 message->destroy(message);
806
807 if (exchange == INFORMATIONAL_V1)
808 {
809 switch (this->ike_sa->get_state(this->ike_sa))
810 {
811 case IKE_CONNECTING:
812 /* close after sending an INFORMATIONAL when unestablished */
813 return FAILED;
814 case IKE_DELETING:
815 /* close after sending a DELETE */
816 return DESTROY_ME;
817 default:
818 break;
819 }
820 }
821 return initiate(this);
822 }
823
824 /**
825 * build a response depending on the "passive" task list
826 */
827 static status_t build_response(private_task_manager_t *this, message_t *request)
828 {
829 enumerator_t *enumerator;
830 task_t *task;
831 message_t *message;
832 host_t *me, *other;
833 bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
834 status_t status;
835
836 me = request->get_destination(request);
837 other = request->get_source(request);
838
839 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
840 message->set_exchange_type(message, request->get_exchange_type(request));
841 /* send response along the path the request came in */
842 message->set_source(message, me->clone(me));
843 message->set_destination(message, other->clone(other));
844 message->set_message_id(message, request->get_message_id(request));
845 message->set_request(message, FALSE);
846
847 this->responding.mid = request->get_message_id(request);
848 this->responding.retransmitted = 0;
849 this->responding.seqnr++;
850
851 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
852 while (enumerator->enumerate(enumerator, (void*)&task))
853 {
854 switch (task->build(task, message))
855 {
856 case SUCCESS:
857 /* task completed, remove it */
858 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
859 task->destroy(task);
860 continue;
861 case NEED_MORE:
862 /* processed, but task needs another exchange */
863 if (task->get_type(task) == TASK_QUICK_MODE ||
864 task->get_type(task) == TASK_AGGRESSIVE_MODE)
865 { /* we rely on initiator retransmission, except for
866 * three-message exchanges */
867 expect_request = TRUE;
868 }
869 continue;
870 case ALREADY_DONE:
871 cancelled = TRUE;
872 break;
873 case FAILED:
874 default:
875 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
876 /* FALL */
877 case DESTROY_ME:
878 /* destroy IKE_SA, but SEND response first */
879 delete = TRUE;
880 break;
881 }
882 break;
883 }
884 enumerator->destroy(enumerator);
885
886 DESTROY_IF(this->responding.packet);
887 this->responding.packet = NULL;
888 if (cancelled)
889 {
890 message->destroy(message);
891 return initiate(this);
892 }
893 status = this->ike_sa->generate_message(this->ike_sa, message,
894 &this->responding.packet);
895 message->destroy(message);
896 if (status != SUCCESS)
897 {
898 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
899 return DESTROY_ME;
900 }
901
902 if (expect_request && !delete)
903 {
904 return retransmit(this, this->responding.seqnr);
905 }
906 send_packet(this, FALSE,
907 this->responding.packet->clone(this->responding.packet));
908 if (delete)
909 {
910 return DESTROY_ME;
911 }
912 return SUCCESS;
913 }
914
915 /**
916 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
917 * The notify protocol_id is set to ISAKMP
918 */
919 static void send_notify(private_task_manager_t *this, message_t *request,
920 notify_type_t type)
921 {
922 message_t *response;
923 packet_t *packet;
924 host_t *me, *other;
925 u_int32_t mid;
926
927 if (request->get_exchange_type(request) == INFORMATIONAL_V1)
928 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
929 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
930 return;
931 }
932 if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
933 {
934 DBG1(DBG_IKE, "failed to allocate message ID");
935 return;
936 }
937 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
938 response->set_exchange_type(response, INFORMATIONAL_V1);
939 response->set_request(response, TRUE);
940 response->set_message_id(response, mid);
941 response->add_payload(response, (payload_t*)
942 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
943 PROTO_IKE, type));
944
945 me = this->ike_sa->get_my_host(this->ike_sa);
946 if (me->is_anyaddr(me))
947 {
948 me = request->get_destination(request);
949 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
950 }
951 other = this->ike_sa->get_other_host(this->ike_sa);
952 if (other->is_anyaddr(other))
953 {
954 other = request->get_source(request);
955 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
956 }
957 response->set_source(response, me->clone(me));
958 response->set_destination(response, other->clone(other));
959 if (this->ike_sa->generate_message(this->ike_sa, response,
960 &packet) == SUCCESS)
961 {
962 send_packet(this, TRUE, packet);
963 }
964 response->destroy(response);
965 }
966
967 /**
968 * Process a DPD request/response
969 */
970 static bool process_dpd(private_task_manager_t *this, message_t *message)
971 {
972 notify_payload_t *notify;
973 notify_type_t type;
974 u_int32_t seq;
975 chunk_t data;
976
977 type = DPD_R_U_THERE;
978 notify = message->get_notify(message, type);
979 if (!notify)
980 {
981 type = DPD_R_U_THERE_ACK;
982 notify = message->get_notify(message, type);
983 }
984 if (!notify)
985 {
986 return FALSE;
987 }
988 data = notify->get_notification_data(notify);
989 if (data.len != 4)
990 {
991 return FALSE;
992 }
993 seq = untoh32(data.ptr);
994
995 if (type == DPD_R_U_THERE)
996 {
997 if (this->dpd_recv == 0 || seq == this->dpd_recv)
998 { /* check sequence validity */
999 this->dpd_recv = seq + 1;
1000 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1001 time_monotonic(NULL));
1002 }
1003 /* but respond anyway */
1004 this->ike_sa->queue_task(this->ike_sa,
1005 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
1006 }
1007 else /* DPD_R_U_THERE_ACK */
1008 {
1009 if (seq == this->dpd_send - 1)
1010 {
1011 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1012 time_monotonic(NULL));
1013 }
1014 else
1015 {
1016 DBG1(DBG_IKE, "received invalid DPD sequence number %u "
1017 "(expected %u), ignored", seq, this->dpd_send - 1);
1018 }
1019 }
1020 return TRUE;
1021 }
1022
1023 /**
1024 * handle an incoming request message
1025 */
1026 static status_t process_request(private_task_manager_t *this,
1027 message_t *message)
1028 {
1029 enumerator_t *enumerator;
1030 task_t *task = NULL;
1031 bool send_response = FALSE, dpd = FALSE;
1032
1033 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
1034 this->passive_tasks->get_count(this->passive_tasks) == 0)
1035 { /* create tasks depending on request type, if not already some queued */
1036 switch (message->get_exchange_type(message))
1037 {
1038 case ID_PROT:
1039 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
1040 this->passive_tasks->insert_last(this->passive_tasks, task);
1041 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
1042 this->passive_tasks->insert_last(this->passive_tasks, task);
1043 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
1044 this->passive_tasks->insert_last(this->passive_tasks, task);
1045 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
1046 this->passive_tasks->insert_last(this->passive_tasks, task);
1047 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
1048 this->passive_tasks->insert_last(this->passive_tasks, task);
1049 break;
1050 case AGGRESSIVE:
1051 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
1052 this->passive_tasks->insert_last(this->passive_tasks, task);
1053 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
1054 this->passive_tasks->insert_last(this->passive_tasks, task);
1055 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
1056 this->passive_tasks->insert_last(this->passive_tasks, task);
1057 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
1058 this->passive_tasks->insert_last(this->passive_tasks, task);
1059 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
1060 this->passive_tasks->insert_last(this->passive_tasks, task);
1061 this->frag.exchange = AGGRESSIVE;
1062 break;
1063 case QUICK_MODE:
1064 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1065 {
1066 DBG1(DBG_IKE, "received quick mode request for "
1067 "unestablished IKE_SA, ignored");
1068 return FAILED;
1069 }
1070 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
1071 NULL, NULL);
1072 this->passive_tasks->insert_last(this->passive_tasks, task);
1073 break;
1074 case INFORMATIONAL_V1:
1075 if (process_dpd(this, message))
1076 {
1077 dpd = TRUE;
1078 }
1079 else
1080 {
1081 task = (task_t *)informational_create(this->ike_sa, NULL);
1082 this->passive_tasks->insert_first(this->passive_tasks, task);
1083 }
1084 break;
1085 case TRANSACTION:
1086 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
1087 {
1088 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
1089 }
1090 else
1091 {
1092 task = (task_t *)xauth_create(this->ike_sa, FALSE);
1093 }
1094 this->passive_tasks->insert_last(this->passive_tasks, task);
1095 break;
1096 default:
1097 return FAILED;
1098 }
1099 }
1100 if (dpd)
1101 {
1102 return initiate(this);
1103 }
1104 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
1105
1106 /* let the tasks process the message */
1107 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
1108 while (enumerator->enumerate(enumerator, (void*)&task))
1109 {
1110 switch (task->process(task, message))
1111 {
1112 case SUCCESS:
1113 /* task completed, remove it */
1114 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1115 task->destroy(task);
1116 continue;
1117 case NEED_MORE:
1118 /* processed, but task needs at least another call to build() */
1119 send_response = TRUE;
1120 continue;
1121 case ALREADY_DONE:
1122 send_response = FALSE;
1123 break;
1124 case FAILED:
1125 default:
1126 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1127 /* FALL */
1128 case DESTROY_ME:
1129 /* critical failure, destroy IKE_SA */
1130 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1131 enumerator->destroy(enumerator);
1132 task->destroy(task);
1133 return DESTROY_ME;
1134 }
1135 break;
1136 }
1137 enumerator->destroy(enumerator);
1138
1139 if (send_response)
1140 {
1141 if (build_response(this, message) != SUCCESS)
1142 {
1143 return DESTROY_ME;
1144 }
1145 }
1146 else
1147 { /* We don't send a response, so don't retransmit one if we get
1148 * the same message again. */
1149 DESTROY_IF(this->responding.packet);
1150 this->responding.packet = NULL;
1151 }
1152 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
1153 this->queued_tasks->get_count(this->queued_tasks) > 0)
1154 {
1155 /* passive tasks completed, check if an active task has been queued,
1156 * such as XAUTH or modeconfig push */
1157 return initiate(this);
1158 }
1159 return SUCCESS;
1160 }
1161
1162 /**
1163 * handle an incoming response message
1164 */
1165 static status_t process_response(private_task_manager_t *this,
1166 message_t *message)
1167 {
1168 enumerator_t *enumerator;
1169 message_t *queued;
1170 status_t status;
1171 task_t *task;
1172
1173 if (message->get_exchange_type(message) != this->initiating.type)
1174 {
1175 /* Windows server sends a fourth quick mode message having an initial
1176 * contact notify. Ignore this message for compatibility. */
1177 if (this->initiating.type == EXCHANGE_TYPE_UNDEFINED &&
1178 message->get_exchange_type(message) == QUICK_MODE &&
1179 message->get_notify(message, INITIAL_CONTACT))
1180 {
1181 DBG1(DBG_IKE, "ignoring fourth Quick Mode message");
1182 return SUCCESS;
1183 }
1184 DBG1(DBG_IKE, "received %N response, but expected %N",
1185 exchange_type_names, message->get_exchange_type(message),
1186 exchange_type_names, this->initiating.type);
1187 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1188 return DESTROY_ME;
1189 }
1190
1191 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
1192 while (enumerator->enumerate(enumerator, (void*)&task))
1193 {
1194 switch (task->process(task, message))
1195 {
1196 case SUCCESS:
1197 /* task completed, remove it */
1198 this->active_tasks->remove_at(this->active_tasks, enumerator);
1199 task->destroy(task);
1200 continue;
1201 case NEED_MORE:
1202 /* processed, but task needs another exchange */
1203 continue;
1204 case ALREADY_DONE:
1205 break;
1206 case FAILED:
1207 default:
1208 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1209 /* FALL */
1210 case DESTROY_ME:
1211 /* critical failure, destroy IKE_SA */
1212 this->active_tasks->remove_at(this->active_tasks, enumerator);
1213 enumerator->destroy(enumerator);
1214 task->destroy(task);
1215 return DESTROY_ME;
1216 }
1217 break;
1218 }
1219 enumerator->destroy(enumerator);
1220
1221 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1222 DESTROY_IF(this->initiating.packet);
1223 this->initiating.packet = NULL;
1224
1225 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
1226 {
1227 queued = this->queued;
1228 this->queued = NULL;
1229 status = this->public.task_manager.process_message(
1230 &this->public.task_manager, queued);
1231 queued->destroy(queued);
1232 if (status == DESTROY_ME)
1233 {
1234 return status;
1235 }
1236 }
1237
1238 return initiate(this);
1239 }
1240
1241 static status_t handle_fragment(private_task_manager_t *this, message_t *msg)
1242 {
1243 fragment_payload_t *payload;
1244 enumerator_t *enumerator;
1245 fragment_t *fragment;
1246 status_t status = SUCCESS;
1247 chunk_t data;
1248 u_int8_t num;
1249
1250 payload = (fragment_payload_t*)msg->get_payload(msg, FRAGMENT_V1);
1251 if (!payload)
1252 {
1253 return FAILED;
1254 }
1255
1256 if (this->frag.id != payload->get_id(payload))
1257 {
1258 clear_fragments(this, payload->get_id(payload));
1259 this->frag.list = linked_list_create();
1260 }
1261
1262 num = payload->get_number(payload);
1263 if (!this->frag.last && payload->is_last(payload))
1264 {
1265 this->frag.last = num;
1266 }
1267
1268 enumerator = this->frag.list->create_enumerator(this->frag.list);
1269 while (enumerator->enumerate(enumerator, &fragment))
1270 {
1271 if (fragment->num == num)
1272 { /* ignore a duplicate fragment */
1273 DBG1(DBG_IKE, "received duplicate fragment #%hhu", num);
1274 enumerator->destroy(enumerator);
1275 return NEED_MORE;
1276 }
1277 if (fragment->num > num)
1278 {
1279 break;
1280 }
1281 }
1282
1283 data = payload->get_data(payload);
1284 this->frag.len += data.len;
1285 if (this->frag.len > this->frag.max_packet)
1286 {
1287 DBG1(DBG_IKE, "fragmented IKE message is too large");
1288 enumerator->destroy(enumerator);
1289 clear_fragments(this, 0);
1290 return FAILED;
1291 }
1292
1293 INIT(fragment,
1294 .num = num,
1295 .data = chunk_clone(data),
1296 );
1297
1298 this->frag.list->insert_before(this->frag.list, enumerator, fragment);
1299 enumerator->destroy(enumerator);
1300
1301 if (this->frag.list->get_count(this->frag.list) == this->frag.last)
1302 {
1303 message_t *message;
1304 packet_t *pkt;
1305 host_t *src, *dst;
1306 bio_writer_t *writer;
1307
1308 writer = bio_writer_create(this->frag.len);
1309 DBG1(DBG_IKE, "received fragment #%hhu, reassembling fragmented IKE "
1310 "message", num);
1311 enumerator = this->frag.list->create_enumerator(this->frag.list);
1312 while (enumerator->enumerate(enumerator, &fragment))
1313 {
1314 writer->write_data(writer, fragment->data);
1315 }
1316 enumerator->destroy(enumerator);
1317
1318 src = msg->get_source(msg);
1319 dst = msg->get_destination(msg);
1320 pkt = packet_create_from_data(src->clone(src), dst->clone(dst),
1321 writer->extract_buf(writer));
1322 writer->destroy(writer);
1323
1324 message = message_create_from_packet(pkt);
1325 if (message->parse_header(message) != SUCCESS)
1326 {
1327 DBG1(DBG_IKE, "failed to parse header of reassembled IKE message");
1328 message->destroy(message);
1329 status = FAILED;
1330 }
1331 else
1332 {
1333 lib->processor->queue_job(lib->processor,
1334 (job_t*)process_message_job_create(message));
1335 status = NEED_MORE;
1336
1337 }
1338 clear_fragments(this, 0);
1339 }
1340 else
1341 { /* there are some fragments missing */
1342 DBG1(DBG_IKE, "received fragment #%hhu, waiting for complete IKE "
1343 "message", num);
1344 status = NEED_MORE;
1345 }
1346 return status;
1347 }
1348
1349 /**
1350 * Parse the given message and verify that it is valid.
1351 */
1352 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1353 {
1354 status_t status;
1355
1356 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1357
1358 if (status != SUCCESS)
1359 {
1360 switch (status)
1361 {
1362 case NOT_SUPPORTED:
1363 DBG1(DBG_IKE, "unsupported exchange type");
1364 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1365 break;
1366 case PARSE_ERROR:
1367 DBG1(DBG_IKE, "message parsing failed");
1368 send_notify(this, msg, PAYLOAD_MALFORMED);
1369 break;
1370 case VERIFY_ERROR:
1371 DBG1(DBG_IKE, "message verification failed");
1372 send_notify(this, msg, PAYLOAD_MALFORMED);
1373 break;
1374 case FAILED:
1375 DBG1(DBG_IKE, "integrity check failed");
1376 send_notify(this, msg, INVALID_HASH_INFORMATION);
1377 break;
1378 case INVALID_STATE:
1379 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1380 send_notify(this, msg, PAYLOAD_MALFORMED);
1381 default:
1382 break;
1383 }
1384 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1385 exchange_type_names, msg->get_exchange_type(msg),
1386 msg->get_request(msg) ? "request" : "response",
1387 msg->get_message_id(msg));
1388
1389 charon->bus->alert(charon->bus, ALERT_PARSE_ERROR_BODY, msg, status);
1390
1391 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1392 { /* invalid initiation attempt, close SA */
1393 return DESTROY_ME;
1394 }
1395 }
1396
1397 if (msg->get_first_payload_type(msg) == FRAGMENT_V1)
1398 {
1399 return handle_fragment(this, msg);
1400 }
1401 return status;
1402 }
1403
1404 METHOD(task_manager_t, process_message, status_t,
1405 private_task_manager_t *this, message_t *msg)
1406 {
1407 u_int32_t hash, mid, i;
1408 host_t *me, *other;
1409 status_t status;
1410
1411 /* TODO-IKEv1: update hosts more selectively */
1412 me = msg->get_destination(msg);
1413 other = msg->get_source(msg);
1414 mid = msg->get_message_id(msg);
1415 hash = chunk_hash(msg->get_packet_data(msg));
1416 for (i = 0; i < MAX_OLD_HASHES; i++)
1417 {
1418 if (this->initiating.old_hashes[i] == hash)
1419 {
1420 if (this->initiating.packet &&
1421 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1422 (msg->get_exchange_type(msg) == QUICK_MODE ||
1423 msg->get_exchange_type(msg) == AGGRESSIVE))
1424 {
1425 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1426 "resending last request", mid);
1427 send_packet(this, TRUE,
1428 this->initiating.packet->clone(this->initiating.packet));
1429 return SUCCESS;
1430 }
1431 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1432 "but next request already sent", mid);
1433 return SUCCESS;
1434 }
1435 }
1436
1437 if ((mid && mid == this->initiating.mid) ||
1438 (this->initiating.mid == 0 &&
1439 msg->get_exchange_type(msg) == this->initiating.type &&
1440 this->active_tasks->get_count(this->active_tasks)))
1441 {
1442 msg->set_request(msg, FALSE);
1443 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1444 status = parse_message(this, msg);
1445 if (status == NEED_MORE)
1446 {
1447 return SUCCESS;
1448 }
1449 if (status != SUCCESS)
1450 {
1451 return status;
1452 }
1453 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1454 time_monotonic(NULL));
1455 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1456 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1457 if (process_response(this, msg) != SUCCESS)
1458 {
1459 flush(this);
1460 return DESTROY_ME;
1461 }
1462 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1463 MAX_OLD_HASHES] = hash;
1464 }
1465 else
1466 {
1467 if (hash == this->responding.hash)
1468 {
1469 if (this->responding.packet)
1470 {
1471 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1472 "retransmitting response", mid);
1473 send_packet(this, FALSE,
1474 this->responding.packet->clone(this->responding.packet));
1475 }
1476 else if (this->initiating.packet &&
1477 this->initiating.type == INFORMATIONAL_V1)
1478 {
1479 DBG1(DBG_IKE, "received retransmit of DPD request, "
1480 "retransmitting response");
1481 send_packet(this, TRUE,
1482 this->initiating.packet->clone(this->initiating.packet));
1483 }
1484 else
1485 {
1486 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1487 "but no response to retransmit", mid);
1488 }
1489 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_RECEIVE, msg);
1490 return SUCCESS;
1491 }
1492
1493 /* reject Main/Aggressive Modes once established */
1494 if (msg->get_exchange_type(msg) == ID_PROT ||
1495 msg->get_exchange_type(msg) == AGGRESSIVE)
1496 {
1497 if (this->ike_sa->get_state(this->ike_sa) != IKE_CREATED &&
1498 this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING &&
1499 msg->get_first_payload_type(msg) != FRAGMENT_V1)
1500 {
1501 DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
1502 exchange_type_names, msg->get_exchange_type(msg));
1503 return FAILED;
1504 }
1505 }
1506
1507 if (msg->get_exchange_type(msg) == TRANSACTION &&
1508 this->active_tasks->get_count(this->active_tasks))
1509 { /* main mode not yet complete, queue XAuth/Mode config tasks */
1510 if (this->queued)
1511 {
1512 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
1513 exchange_type_names, TRANSACTION);
1514 return SUCCESS;
1515 }
1516 this->queued = message_create_from_packet(msg->get_packet(msg));
1517 if (this->queued->parse_header(this->queued) != SUCCESS)
1518 {
1519 this->queued->destroy(this->queued);
1520 this->queued = NULL;
1521 return FAILED;
1522 }
1523 DBG1(DBG_IKE, "queueing %N request as tasks still active",
1524 exchange_type_names, TRANSACTION);
1525 return SUCCESS;
1526 }
1527
1528 msg->set_request(msg, TRUE);
1529 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1530 status = parse_message(this, msg);
1531 if (status == NEED_MORE)
1532 {
1533 return SUCCESS;
1534 }
1535 if (status != SUCCESS)
1536 {
1537 return status;
1538 }
1539 /* if this IKE_SA is virgin, we check for a config */
1540 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1541 {
1542 ike_sa_id_t *ike_sa_id;
1543 ike_cfg_t *ike_cfg;
1544 job_t *job;
1545
1546 ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1547 me, other, IKEV1);
1548 if (ike_cfg == NULL)
1549 {
1550 /* no config found for these hosts, destroy */
1551 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1552 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1553 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1554 return DESTROY_ME;
1555 }
1556 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1557 ike_cfg->destroy(ike_cfg);
1558 /* add a timeout if peer does not establish it completely */
1559 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1560 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1561 lib->scheduler->schedule_job(lib->scheduler, job,
1562 lib->settings->get_int(lib->settings,
1563 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1564 charon->name));
1565 }
1566 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1567 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1568 if (process_request(this, msg) != SUCCESS)
1569 {
1570 flush(this);
1571 return DESTROY_ME;
1572 }
1573 this->responding.hash = hash;
1574 }
1575 return SUCCESS;
1576 }
1577
1578 METHOD(task_manager_t, queue_task, void,
1579 private_task_manager_t *this, task_t *task)
1580 {
1581 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1582 this->queued_tasks->insert_last(this->queued_tasks, task);
1583 }
1584
1585 /**
1586 * Check if a given task has been queued already
1587 */
1588 static bool has_queued(private_task_manager_t *this, task_type_t type)
1589 {
1590 enumerator_t *enumerator;
1591 bool found = FALSE;
1592 task_t *task;
1593
1594 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1595 while (enumerator->enumerate(enumerator, &task))
1596 {
1597 if (task->get_type(task) == type)
1598 {
1599 found = TRUE;
1600 break;
1601 }
1602 }
1603 enumerator->destroy(enumerator);
1604 return found;
1605 }
1606
1607 METHOD(task_manager_t, queue_ike, void,
1608 private_task_manager_t *this)
1609 {
1610 peer_cfg_t *peer_cfg;
1611
1612 if (!has_queued(this, TASK_ISAKMP_VENDOR))
1613 {
1614 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1615 }
1616 if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1617 {
1618 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1619 }
1620 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1621 if (peer_cfg->use_aggressive(peer_cfg))
1622 {
1623 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1624 {
1625 queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1626 }
1627 this->frag.exchange = AGGRESSIVE;
1628 }
1629 else
1630 {
1631 if (!has_queued(this, TASK_MAIN_MODE))
1632 {
1633 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1634 }
1635 }
1636 if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1637 {
1638 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1639 }
1640 if (!has_queued(this, TASK_ISAKMP_NATD))
1641 {
1642 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1643 }
1644 }
1645
1646 METHOD(task_manager_t, queue_ike_reauth, void,
1647 private_task_manager_t *this)
1648 {
1649 enumerator_t *enumerator;
1650 child_sa_t *child_sa;
1651 ike_sa_t *new;
1652 host_t *host;
1653
1654 new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1655 this->ike_sa->get_version(this->ike_sa), TRUE);
1656 if (!new)
1657 { /* shouldn't happen */
1658 return;
1659 }
1660
1661 new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1662 host = this->ike_sa->get_other_host(this->ike_sa);
1663 new->set_other_host(new, host->clone(host));
1664 host = this->ike_sa->get_my_host(this->ike_sa);
1665 new->set_my_host(new, host->clone(host));
1666 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1667 while (enumerator->enumerate(enumerator, &host))
1668 {
1669 new->add_virtual_ip(new, TRUE, host);
1670 }
1671 enumerator->destroy(enumerator);
1672
1673 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1674 while (enumerator->enumerate(enumerator, &child_sa))
1675 {
1676 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1677 new->add_child_sa(new, child_sa);
1678 }
1679 enumerator->destroy(enumerator);
1680
1681 if (!new->get_child_count(new))
1682 { /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1683 task_t *task;
1684
1685 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1686 while (enumerator->enumerate(enumerator, &task))
1687 {
1688 if (task->get_type(task) == TASK_QUICK_MODE)
1689 {
1690 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1691 task->migrate(task, new);
1692 new->queue_task(new, task);
1693 }
1694 }
1695 enumerator->destroy(enumerator);
1696 }
1697
1698 if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1699 {
1700 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1701 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1702 }
1703 else
1704 {
1705 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1706 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1707 }
1708 charon->bus->set_sa(charon->bus, this->ike_sa);
1709 }
1710
1711 METHOD(task_manager_t, queue_ike_rekey, void,
1712 private_task_manager_t *this)
1713 {
1714 queue_ike_reauth(this);
1715 }
1716
1717 METHOD(task_manager_t, queue_ike_delete, void,
1718 private_task_manager_t *this)
1719 {
1720 enumerator_t *enumerator;
1721 child_sa_t *child_sa;
1722
1723 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1724 while (enumerator->enumerate(enumerator, &child_sa))
1725 {
1726 queue_task(this, (task_t*)
1727 quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1728 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1729 }
1730 enumerator->destroy(enumerator);
1731
1732 queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1733 }
1734
1735 METHOD(task_manager_t, queue_mobike, void,
1736 private_task_manager_t *this, bool roam, bool address)
1737 {
1738 /* Not supported in IKEv1 */
1739 }
1740
1741 METHOD(task_manager_t, queue_child, void,
1742 private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1743 traffic_selector_t *tsi, traffic_selector_t *tsr)
1744 {
1745 quick_mode_t *task;
1746
1747 task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1748 task->use_reqid(task, reqid);
1749
1750 queue_task(this, &task->task);
1751 }
1752
1753 /**
1754 * Check if two CHILD_SAs have the same traffic selector
1755 */
1756 static bool have_equal_ts(child_sa_t *child1, child_sa_t *child2, bool local)
1757 {
1758 enumerator_t *e1, *e2;
1759 traffic_selector_t *ts1, *ts2;
1760 bool equal = FALSE;
1761
1762 e1 = child1->create_ts_enumerator(child1, local);
1763 e2 = child2->create_ts_enumerator(child2, local);
1764 if (e1->enumerate(e1, &ts1) && e2->enumerate(e2, &ts2))
1765 {
1766 equal = ts1->equals(ts1, ts2);
1767 }
1768 e1->destroy(e1);
1769 e1->destroy(e1);
1770
1771 return equal;
1772 }
1773
1774 /**
1775 * Check if a CHILD_SA is redundant and we should delete instead of rekey
1776 */
1777 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1778 {
1779 enumerator_t *enumerator;
1780 child_sa_t *current;
1781 bool redundant = FALSE;
1782
1783 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1784 while (enumerator->enumerate(enumerator, &current))
1785 {
1786 if (current->get_state(current) == CHILD_INSTALLED &&
1787 streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1788 have_equal_ts(current, child_sa, TRUE) &&
1789 have_equal_ts(current, child_sa, FALSE) &&
1790 current->get_lifetime(current, FALSE) >
1791 child_sa->get_lifetime(child_sa, FALSE))
1792 {
1793 DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1794 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
1795 redundant = TRUE;
1796 break;
1797 }
1798 }
1799 enumerator->destroy(enumerator);
1800
1801 return redundant;
1802 }
1803
1804 /**
1805 * Get the first traffic selector of a CHILD_SA, local or remote
1806 */
1807 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1808 {
1809 traffic_selector_t *ts = NULL;
1810 enumerator_t *enumerator;
1811
1812 enumerator = child_sa->create_ts_enumerator(child_sa, local);
1813 enumerator->enumerate(enumerator, &ts);
1814 enumerator->destroy(enumerator);
1815
1816 return ts;
1817 }
1818
1819 METHOD(task_manager_t, queue_child_rekey, void,
1820 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1821 {
1822 child_sa_t *child_sa;
1823 child_cfg_t *cfg;
1824 quick_mode_t *task;
1825
1826 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1827 if (!child_sa)
1828 {
1829 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1830 }
1831 if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1832 {
1833 if (is_redundant(this, child_sa))
1834 {
1835 queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1836 protocol, spi, FALSE, FALSE));
1837 }
1838 else
1839 {
1840 child_sa->set_state(child_sa, CHILD_REKEYING);
1841 cfg = child_sa->get_config(child_sa);
1842 task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1843 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1844 task->use_reqid(task, child_sa->get_reqid(child_sa));
1845 task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1846
1847 queue_task(this, &task->task);
1848 }
1849 }
1850 }
1851
1852 METHOD(task_manager_t, queue_child_delete, void,
1853 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1854 bool expired)
1855 {
1856 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1857 spi, FALSE, expired));
1858 }
1859
1860 METHOD(task_manager_t, queue_dpd, void,
1861 private_task_manager_t *this)
1862 {
1863 peer_cfg_t *peer_cfg;
1864 u_int32_t t, retransmit;
1865
1866 queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1867 this->dpd_send++));
1868 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1869
1870 /* compute timeout in milliseconds */
1871 t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1872 if (t == 0)
1873 {
1874 /* use the same timeout as a retransmitting IKE message would have */
1875 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1876 {
1877 t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1878 pow(this->retransmit_base, retransmit));
1879 }
1880 }
1881
1882 /* schedule DPD timeout job */
1883 lib->scheduler->schedule_job_ms(lib->scheduler,
1884 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1885 }
1886
1887 METHOD(task_manager_t, adopt_tasks, void,
1888 private_task_manager_t *this, task_manager_t *other_public)
1889 {
1890 private_task_manager_t *other = (private_task_manager_t*)other_public;
1891 task_t *task;
1892
1893 /* move queued tasks from other to this */
1894 while (other->queued_tasks->remove_last(other->queued_tasks,
1895 (void**)&task) == SUCCESS)
1896 {
1897 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1898 task->migrate(task, this->ike_sa);
1899 this->queued_tasks->insert_first(this->queued_tasks, task);
1900 }
1901 }
1902
1903 /**
1904 * Migrates child-creating tasks from src to dst
1905 */
1906 static void migrate_child_tasks(private_task_manager_t *this,
1907 linked_list_t *src, linked_list_t *dst)
1908 {
1909 enumerator_t *enumerator;
1910 task_t *task;
1911
1912 enumerator = src->create_enumerator(src);
1913 while (enumerator->enumerate(enumerator, &task))
1914 {
1915 if (task->get_type(task) == TASK_QUICK_MODE)
1916 {
1917 src->remove_at(src, enumerator);
1918 task->migrate(task, this->ike_sa);
1919 dst->insert_last(dst, task);
1920 }
1921 }
1922 enumerator->destroy(enumerator);
1923 }
1924
1925 METHOD(task_manager_t, adopt_child_tasks, void,
1926 private_task_manager_t *this, task_manager_t *other_public)
1927 {
1928 private_task_manager_t *other = (private_task_manager_t*)other_public;
1929
1930 /* move active child tasks from other to this */
1931 migrate_child_tasks(this, other->active_tasks, this->queued_tasks);
1932 /* do the same for queued tasks */
1933 migrate_child_tasks(this, other->queued_tasks, this->queued_tasks);
1934 }
1935
1936 METHOD(task_manager_t, busy, bool,
1937 private_task_manager_t *this)
1938 {
1939 return (this->active_tasks->get_count(this->active_tasks) > 0);
1940 }
1941
1942 METHOD(task_manager_t, incr_mid, void,
1943 private_task_manager_t *this, bool initiate)
1944 {
1945 }
1946
1947 METHOD(task_manager_t, reset, void,
1948 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1949 {
1950 enumerator_t *enumerator;
1951 task_t *task;
1952
1953 /* reset message counters and retransmit packets */
1954 DESTROY_IF(this->responding.packet);
1955 DESTROY_IF(this->initiating.packet);
1956 this->responding.packet = NULL;
1957 this->responding.seqnr = RESPONDING_SEQ;
1958 this->responding.retransmitted = 0;
1959 this->initiating.packet = NULL;
1960 this->initiating.mid = 0;
1961 this->initiating.seqnr = 0;
1962 this->initiating.retransmitted = 0;
1963 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1964 clear_fragments(this, 0);
1965 if (initiate != UINT_MAX)
1966 {
1967 this->dpd_send = initiate;
1968 }
1969 if (respond != UINT_MAX)
1970 {
1971 this->dpd_recv = respond;
1972 }
1973
1974 /* reset queued tasks */
1975 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1976 while (enumerator->enumerate(enumerator, &task))
1977 {
1978 task->migrate(task, this->ike_sa);
1979 }
1980 enumerator->destroy(enumerator);
1981
1982 /* reset active tasks */
1983 while (this->active_tasks->remove_last(this->active_tasks,
1984 (void**)&task) == SUCCESS)
1985 {
1986 task->migrate(task, this->ike_sa);
1987 this->queued_tasks->insert_first(this->queued_tasks, task);
1988 }
1989 }
1990
1991 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1992 private_task_manager_t *this, task_queue_t queue)
1993 {
1994 switch (queue)
1995 {
1996 case TASK_QUEUE_ACTIVE:
1997 return this->active_tasks->create_enumerator(this->active_tasks);
1998 case TASK_QUEUE_PASSIVE:
1999 return this->passive_tasks->create_enumerator(this->passive_tasks);
2000 case TASK_QUEUE_QUEUED:
2001 return this->queued_tasks->create_enumerator(this->queued_tasks);
2002 default:
2003 return enumerator_create_empty();
2004 }
2005 }
2006
2007 METHOD(task_manager_t, destroy, void,
2008 private_task_manager_t *this)
2009 {
2010 flush(this);
2011
2012 this->active_tasks->destroy(this->active_tasks);
2013 this->queued_tasks->destroy(this->queued_tasks);
2014 this->passive_tasks->destroy(this->passive_tasks);
2015 clear_fragments(this, 0);
2016
2017 DESTROY_IF(this->queued);
2018 DESTROY_IF(this->responding.packet);
2019 DESTROY_IF(this->initiating.packet);
2020 DESTROY_IF(this->rng);
2021 free(this);
2022 }
2023
2024 /*
2025 * see header file
2026 */
2027 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
2028 {
2029 private_task_manager_t *this;
2030
2031 INIT(this,
2032 .public = {
2033 .task_manager = {
2034 .process_message = _process_message,
2035 .queue_task = _queue_task,
2036 .queue_ike = _queue_ike,
2037 .queue_ike_rekey = _queue_ike_rekey,
2038 .queue_ike_reauth = _queue_ike_reauth,
2039 .queue_ike_delete = _queue_ike_delete,
2040 .queue_mobike = _queue_mobike,
2041 .queue_child = _queue_child,
2042 .queue_child_rekey = _queue_child_rekey,
2043 .queue_child_delete = _queue_child_delete,
2044 .queue_dpd = _queue_dpd,
2045 .initiate = _initiate,
2046 .retransmit = _retransmit,
2047 .incr_mid = _incr_mid,
2048 .reset = _reset,
2049 .adopt_tasks = _adopt_tasks,
2050 .adopt_child_tasks = _adopt_child_tasks,
2051 .busy = _busy,
2052 .create_task_enumerator = _create_task_enumerator,
2053 .flush_queue = _flush_queue,
2054 .destroy = _destroy,
2055 },
2056 },
2057 .initiating = {
2058 .type = EXCHANGE_TYPE_UNDEFINED,
2059 },
2060 .responding = {
2061 .seqnr = RESPONDING_SEQ,
2062 },
2063 .frag = {
2064 .exchange = ID_PROT,
2065 .max_packet = lib->settings->get_int(lib->settings,
2066 "%s.max_packet", MAX_PACKET, charon->name),
2067 .size = lib->settings->get_int(lib->settings,
2068 "%s.fragment_size", MAX_FRAGMENT_SIZE, charon->name),
2069 },
2070 .ike_sa = ike_sa,
2071 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
2072 .queued_tasks = linked_list_create(),
2073 .active_tasks = linked_list_create(),
2074 .passive_tasks = linked_list_create(),
2075 .retransmit_tries = lib->settings->get_int(lib->settings,
2076 "%s.retransmit_tries", RETRANSMIT_TRIES, charon->name),
2077 .retransmit_timeout = lib->settings->get_double(lib->settings,
2078 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name),
2079 .retransmit_base = lib->settings->get_double(lib->settings,
2080 "%s.retransmit_base", RETRANSMIT_BASE, charon->name),
2081 );
2082
2083 if (!this->rng)
2084 {
2085 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
2086 destroy(this);
2087 return NULL;
2088 }
2089 if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
2090 (void*)&this->dpd_send))
2091 {
2092 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
2093 destroy(this);
2094 return NULL;
2095 }
2096 this->dpd_send &= 0x7FFFFFFF;
2097
2098 return &this->public;
2099 }