8e4aa7496696df6004f5ad1866ccca9fbb3323dc
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/quick_mode.h>
24 #include <sa/ikev1/tasks/xauth.h>
25 #include <sa/ikev1/tasks/mode_config.h>
26 #include <sa/ikev1/tasks/informational.h>
27 #include <sa/ikev1/tasks/isakmp_natd.h>
28 #include <sa/ikev1/tasks/isakmp_vendor.h>
29 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
30 #include <sa/ikev1/tasks/isakmp_cert_post.h>
31 #include <processing/jobs/retransmit_job.h>
32 #include <processing/jobs/delete_ike_sa_job.h>
33
34 /**
35 * Number of old messages hashes we keep for retransmission.
36 *
37 * In Main Mode, we must ignore messages from a previous message pair if
38 * we already continued to the next. Otherwise a late retransmission
39 * could be considered as a reply to the newer request.
40 */
41 #define MAX_OLD_HASHES 2
42
43 typedef struct exchange_t exchange_t;
44
45 /**
46 * An exchange in the air, used do detect and handle retransmission
47 */
48 struct exchange_t {
49
50 /**
51 * Message ID used for this transaction
52 */
53 u_int32_t mid;
54
55 /**
56 * generated packet for retransmission
57 */
58 packet_t *packet;
59 };
60
61 typedef struct private_task_manager_t private_task_manager_t;
62
63 /**
64 * private data of the task manager
65 */
66 struct private_task_manager_t {
67
68 /**
69 * public functions
70 */
71 task_manager_v1_t public;
72
73 /**
74 * associated IKE_SA we are serving
75 */
76 ike_sa_t *ike_sa;
77
78 /**
79 * RNG to create message IDs
80 */
81 rng_t *rng;
82
83 /**
84 * Exchange we are currently handling as responder
85 */
86 struct {
87 /**
88 * Hash of a previously received message
89 */
90 u_int32_t hash;
91
92 /**
93 * packet for retransmission
94 */
95 packet_t *packet;
96
97 } responding;
98
99 /**
100 * Exchange we are currently handling as initiator
101 */
102 struct {
103 /**
104 * Message ID of the exchange
105 */
106 u_int32_t mid;
107
108 /**
109 * Hashes of old responses we can ignore
110 */
111 u_int32_t old_hashes[MAX_OLD_HASHES];
112
113 /**
114 * Position in old hash array
115 */
116 int old_hash_pos;
117
118 /**
119 * Sequence number of the last sent message
120 */
121 u_int32_t seqnr;
122
123 /**
124 * how many times we have retransmitted so far
125 */
126 u_int retransmitted;
127
128 /**
129 * packet for retransmission
130 */
131 packet_t *packet;
132
133 /**
134 * type of the initated exchange
135 */
136 exchange_type_t type;
137
138 } initiating;
139
140 /**
141 * List of queued tasks not yet in action
142 */
143 linked_list_t *queued_tasks;
144
145 /**
146 * List of active tasks, initiated by ourselve
147 */
148 linked_list_t *active_tasks;
149
150 /**
151 * List of tasks initiated by peer
152 */
153 linked_list_t *passive_tasks;
154
155 /**
156 * Queued messages not yet ready to process
157 */
158 message_t *queued;
159
160 /**
161 * Number of times we retransmit messages before giving up
162 */
163 u_int retransmit_tries;
164
165 /**
166 * Retransmission timeout
167 */
168 double retransmit_timeout;
169
170 /**
171 * Base to calculate retransmission timeout
172 */
173 double retransmit_base;
174 };
175
176 /**
177 * Flush a single task queue
178 */
179 static void flush_queue(private_task_manager_t *this, linked_list_t *list)
180 {
181 task_t *task;
182
183 if (this->queued)
184 {
185 this->queued->destroy(this->queued);
186 this->queued = NULL;
187 }
188 while (list->remove_last(list, (void**)&task) == SUCCESS)
189 {
190 task->destroy(task);
191 }
192 }
193
194 /**
195 * flush all tasks in the task manager
196 */
197 static void flush(private_task_manager_t *this)
198 {
199 flush_queue(this, this->queued_tasks);
200 flush_queue(this, this->passive_tasks);
201 flush_queue(this, this->active_tasks);
202 }
203
204 /**
205 * move a task of a specific type from the queue to the active list
206 */
207 static bool activate_task(private_task_manager_t *this, task_type_t type)
208 {
209 enumerator_t *enumerator;
210 task_t *task;
211 bool found = FALSE;
212
213 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
214 while (enumerator->enumerate(enumerator, (void**)&task))
215 {
216 if (task->get_type(task) == type)
217 {
218 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
219 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
220 this->active_tasks->insert_last(this->active_tasks, task);
221 found = TRUE;
222 break;
223 }
224 }
225 enumerator->destroy(enumerator);
226 return found;
227 }
228
229 METHOD(task_manager_t, retransmit, status_t,
230 private_task_manager_t *this, u_int32_t message_seqnr)
231 {
232 /* this.initiating packet used as marker for received response */
233 if (message_seqnr == this->initiating.seqnr && this->initiating.packet )
234 {
235 u_int32_t timeout;
236 packet_t *packet;
237 job_t *job;
238
239 if (this->initiating.retransmitted <= this->retransmit_tries)
240 {
241 timeout = (u_int32_t)(this->retransmit_timeout * 1000.0 *
242 pow(this->retransmit_base, this->initiating.retransmitted));
243 }
244 else
245 {
246 DBG1(DBG_IKE, "giving up after %d retransmits",
247 this->initiating.retransmitted - 1);
248 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
249 {
250 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
251 }
252 return DESTROY_ME;
253 }
254
255 if (this->initiating.retransmitted)
256 {
257 DBG1(DBG_IKE, "retransmit %d of request with message ID %u seqnr (%d)",
258 this->initiating.retransmitted, this->initiating.mid, message_seqnr);
259 }
260 packet = this->initiating.packet->clone(this->initiating.packet);
261 charon->sender->send(charon->sender, packet);
262
263 this->initiating.retransmitted++;
264 job = (job_t*)retransmit_job_create(this->initiating.seqnr,
265 this->ike_sa->get_id(this->ike_sa));
266 lib->scheduler->schedule_job_ms(lib->scheduler, job, timeout);
267 }
268 return SUCCESS;
269 }
270
271 METHOD(task_manager_t, initiate, status_t,
272 private_task_manager_t *this)
273 {
274 enumerator_t *enumerator;
275 task_t *task;
276 message_t *message;
277 host_t *me, *other;
278 status_t status;
279 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
280 bool new_mid = FALSE, expect_response = FALSE, flushed = FALSE;
281
282 if (!this->rng)
283 {
284 DBG1(DBG_IKE, "no RNG supported");
285 return FAILED;
286 }
287
288 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED)
289 {
290 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
291 exchange_type_names, this->initiating.type);
292 /* do not initiate if we already have a message in the air */
293 return SUCCESS;
294 }
295
296 if (this->active_tasks->get_count(this->active_tasks) == 0)
297 {
298 DBG2(DBG_IKE, "activating new tasks");
299 switch (this->ike_sa->get_state(this->ike_sa))
300 {
301 case IKE_CREATED:
302 activate_task(this, TASK_ISAKMP_VENDOR);
303 activate_task(this, TASK_ISAKMP_CERT_PRE);
304 if (activate_task(this, TASK_MAIN_MODE))
305 {
306 exchange = ID_PROT;
307 activate_task(this, TASK_ISAKMP_CERT_POST);
308 activate_task(this, TASK_ISAKMP_NATD);
309 }
310 break;
311 case IKE_CONNECTING:
312 if (activate_task(this, TASK_ISAKMP_DELETE))
313 {
314 exchange = INFORMATIONAL_V1;
315 new_mid = TRUE;
316 break;
317 }
318 if (activate_task(this, TASK_XAUTH))
319 {
320 exchange = TRANSACTION;
321 new_mid = TRUE;
322 break;
323 }
324 if (activate_task(this, TASK_INFORMATIONAL))
325 {
326 exchange = INFORMATIONAL_V1;
327 new_mid = TRUE;
328 break;
329 }
330 break;
331 case IKE_ESTABLISHED:
332 if (activate_task(this, TASK_MODE_CONFIG))
333 {
334 exchange = TRANSACTION;
335 new_mid = TRUE;
336 break;
337 }
338 if (activate_task(this, TASK_QUICK_MODE))
339 {
340 exchange = QUICK_MODE;
341 new_mid = TRUE;
342 break;
343 }
344 if (activate_task(this, TASK_INFORMATIONAL))
345 {
346 exchange = INFORMATIONAL_V1;
347 new_mid = TRUE;
348 break;
349 }
350 if (activate_task(this, TASK_ISAKMP_DELETE))
351 {
352 exchange = INFORMATIONAL_V1;
353 new_mid = TRUE;
354 break;
355 }
356 if (activate_task(this, TASK_QUICK_DELETE))
357 {
358 exchange = INFORMATIONAL_V1;
359 new_mid = TRUE;
360 break;
361 }
362 break;
363 default:
364 break;
365 }
366 }
367 else
368 {
369 DBG2(DBG_IKE, "reinitiating already active tasks");
370 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
371 while (enumerator->enumerate(enumerator, (void**)&task))
372 {
373 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
374 switch (task->get_type(task))
375 {
376 case TASK_MAIN_MODE:
377 exchange = ID_PROT;
378 break;
379 case TASK_QUICK_MODE:
380 exchange = QUICK_MODE;
381 break;
382 case TASK_XAUTH:
383 exchange = TRANSACTION;
384 new_mid = TRUE;
385 break;
386 default:
387 continue;
388 }
389 break;
390 }
391 enumerator->destroy(enumerator);
392 }
393
394 if (exchange == EXCHANGE_TYPE_UNDEFINED)
395 {
396 DBG2(DBG_IKE, "nothing to initiate");
397 /* nothing to do yet... */
398 return SUCCESS;
399 }
400
401 me = this->ike_sa->get_my_host(this->ike_sa);
402 other = this->ike_sa->get_other_host(this->ike_sa);
403
404 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
405 if (new_mid)
406 {
407 this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
408 (void*)&this->initiating.mid);
409 }
410 message->set_message_id(message, this->initiating.mid);
411 message->set_source(message, me->clone(me));
412 message->set_destination(message, other->clone(other));
413 message->set_exchange_type(message, exchange);
414 this->initiating.type = exchange;
415 this->initiating.retransmitted = 0;
416
417 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
418 while (enumerator->enumerate(enumerator, (void*)&task))
419 {
420 switch (task->build(task, message))
421 {
422 case SUCCESS:
423 /* task completed, remove it */
424 this->active_tasks->remove_at(this->active_tasks, enumerator);
425 task->destroy(task);
426 continue;
427 case NEED_MORE:
428 expect_response = TRUE;
429 /* processed, but task needs another exchange */
430 continue;
431 case ALREADY_DONE:
432 flush_queue(this, this->active_tasks);
433 flushed = TRUE;
434 break;
435 case FAILED:
436 default:
437 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
438 {
439 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
440 }
441 /* FALL */
442 case DESTROY_ME:
443 /* critical failure, destroy IKE_SA */
444 enumerator->destroy(enumerator);
445 message->destroy(message);
446 flush(this);
447 return DESTROY_ME;
448 }
449 break;
450 }
451 enumerator->destroy(enumerator);
452
453 if (this->active_tasks->get_count(this->active_tasks) == 0)
454 { /* tasks completed, no exchange active anymore */
455 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
456 }
457 if (flushed)
458 {
459 message->destroy(message);
460 return initiate(this);
461 }
462 this->initiating.seqnr++;
463
464 status = this->ike_sa->generate_message(this->ike_sa, message,
465 &this->initiating.packet);
466 if (status != SUCCESS)
467 {
468 /* message generation failed. There is nothing more to do than to
469 * close the SA */
470 message->destroy(message);
471 flush(this);
472 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
473 return DESTROY_ME;
474 }
475 message->destroy(message);
476
477 if (expect_response)
478 {
479 return retransmit(this, this->initiating.seqnr);
480 }
481 charon->sender->send(charon->sender,
482 this->initiating.packet->clone(this->initiating.packet));
483 this->initiating.packet->destroy(this->initiating.packet);
484 this->initiating.packet = NULL;
485
486 if (exchange == INFORMATIONAL_V1)
487 {
488 switch (this->ike_sa->get_state(this->ike_sa))
489 {
490 case IKE_CONNECTING:
491 /* close after sending an INFORMATIONAL when unestablished */
492 return FAILED;
493 case IKE_DELETING:
494 /* close after sending a DELETE */
495 return DESTROY_ME;
496 default:
497 break;
498 }
499 }
500 return SUCCESS;
501 }
502
503 /**
504 * handle exchange collisions
505 */
506 static bool handle_collisions(private_task_manager_t *this, task_t *task)
507 {
508 return FALSE;
509 }
510
511 /**
512 * build a response depending on the "passive" task list
513 */
514 static status_t build_response(private_task_manager_t *this, message_t *request)
515 {
516 enumerator_t *enumerator;
517 task_t *task;
518 message_t *message;
519 host_t *me, *other;
520 bool delete = FALSE, flushed = FALSE;
521 status_t status;
522
523 me = request->get_destination(request);
524 other = request->get_source(request);
525
526 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
527 message->set_exchange_type(message, request->get_exchange_type(request));
528 /* send response along the path the request came in */
529 message->set_source(message, me->clone(me));
530 message->set_destination(message, other->clone(other));
531 message->set_message_id(message, request->get_message_id(request));
532 message->set_request(message, FALSE);
533
534 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
535 while (enumerator->enumerate(enumerator, (void*)&task))
536 {
537 switch (task->build(task, message))
538 {
539 case SUCCESS:
540 /* task completed, remove it */
541 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
542 if (!handle_collisions(this, task))
543 {
544 task->destroy(task);
545 }
546 continue;
547 case NEED_MORE:
548 /* processed, but task needs another exchange */
549 if (handle_collisions(this, task))
550 {
551 this->passive_tasks->remove_at(this->passive_tasks,
552 enumerator);
553 }
554 continue;
555 case ALREADY_DONE:
556 flush_queue(this, this->passive_tasks);
557 flushed = TRUE;
558 break;
559 case FAILED:
560 default:
561 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
562 /* FALL */
563 case DESTROY_ME:
564 /* destroy IKE_SA, but SEND response first */
565 delete = TRUE;
566 break;
567 }
568 break;
569 }
570 enumerator->destroy(enumerator);
571
572 DESTROY_IF(this->responding.packet);
573 this->responding.packet = NULL;
574 if (flushed)
575 {
576 message->destroy(message);
577 return initiate(this);
578 }
579 status = this->ike_sa->generate_message(this->ike_sa, message,
580 &this->responding.packet);
581 message->destroy(message);
582 if (status != SUCCESS)
583 {
584 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
585 return DESTROY_ME;
586 }
587
588 charon->sender->send(charon->sender,
589 this->responding.packet->clone(this->responding.packet));
590 if (delete)
591 {
592 return DESTROY_ME;
593 }
594 return SUCCESS;
595 }
596
597 /**
598 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
599 * The notify protocol_id is set to ISAKMP
600 */
601 static void send_notify(private_task_manager_t *this, message_t *request,
602 notify_type_t type)
603 {
604 message_t *response;
605 packet_t *packet;
606 host_t *me, *other;
607 u_int32_t mid;
608
609 if (request && request->get_exchange_type(request) == INFORMATIONAL_V1)
610 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
611 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
612 return;
613 }
614
615 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
616 response->set_exchange_type(response, INFORMATIONAL_V1);
617 response->set_request(response, TRUE);
618 this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid);
619 response->set_message_id(response, mid);
620 response->add_payload(response, (payload_t*)
621 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
622 PROTO_IKE, type));
623
624 me = this->ike_sa->get_my_host(this->ike_sa);
625 if (me->is_anyaddr(me))
626 {
627 me = request->get_destination(request);
628 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
629 }
630 other = this->ike_sa->get_other_host(this->ike_sa);
631 if (other->is_anyaddr(other))
632 {
633 other = request->get_source(request);
634 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
635 }
636 response->set_source(response, me->clone(me));
637 response->set_destination(response, other->clone(other));
638 if (this->ike_sa->generate_message(this->ike_sa, response,
639 &packet) == SUCCESS)
640 {
641 charon->sender->send(charon->sender, packet);
642 }
643 response->destroy(response);
644 }
645
646 /**
647 * handle an incoming request message
648 */
649 static status_t process_request(private_task_manager_t *this,
650 message_t *message)
651 {
652 enumerator_t *enumerator;
653 task_t *task = NULL;
654 bool send_response = FALSE;
655
656 if (this->passive_tasks->get_count(this->passive_tasks) == 0)
657 { /* create tasks depending on request type, if not already some queued */
658 switch (message->get_exchange_type(message))
659 {
660 case ID_PROT:
661 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
662 this->passive_tasks->insert_last(this->passive_tasks, task);
663 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
664 this->passive_tasks->insert_last(this->passive_tasks, task);
665 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
666 this->passive_tasks->insert_last(this->passive_tasks, task);
667 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
668 this->passive_tasks->insert_last(this->passive_tasks, task);
669 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
670 this->passive_tasks->insert_last(this->passive_tasks, task);
671 break;
672 case AGGRESSIVE:
673 /* TODO-IKEv1: agressive mode */
674 return FAILED;
675 case QUICK_MODE:
676 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
677 {
678 DBG1(DBG_IKE, "received quick mode request for "
679 "unestablished IKE_SA, ignored");
680 return FAILED;
681 }
682 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
683 NULL, NULL);
684 this->passive_tasks->insert_last(this->passive_tasks, task);
685 break;
686 case INFORMATIONAL_V1:
687 task = (task_t *)informational_create(this->ike_sa, NULL);
688 this->passive_tasks->insert_last(this->passive_tasks, task);
689 break;
690 case TRANSACTION:
691 if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
692 {
693 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
694 }
695 else
696 {
697 task = (task_t *)xauth_create(this->ike_sa, FALSE);
698 }
699 this->passive_tasks->insert_last(this->passive_tasks, task);
700 break;
701 default:
702 return FAILED;
703 }
704 }
705 /* let the tasks process the message */
706 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
707 while (enumerator->enumerate(enumerator, (void*)&task))
708 {
709 switch (task->process(task, message))
710 {
711 case SUCCESS:
712 /* task completed, remove it */
713 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
714 task->destroy(task);
715 continue;
716 case NEED_MORE:
717 /* processed, but task needs at least another call to build() */
718 send_response = TRUE;
719 continue;
720 case ALREADY_DONE:
721 send_response = FALSE;
722 flush_queue(this, this->passive_tasks);
723 break;
724 case FAILED:
725 default:
726 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
727 /* FALL */
728 case DESTROY_ME:
729 /* critical failure, destroy IKE_SA */
730 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
731 enumerator->destroy(enumerator);
732 task->destroy(task);
733 return DESTROY_ME;
734 }
735 break;
736 }
737 enumerator->destroy(enumerator);
738
739 if (send_response)
740 {
741 if (build_response(this, message) != SUCCESS)
742 {
743 return DESTROY_ME;
744 }
745 }
746 else
747 { /* We don't send a response, so don't retransmit one if we get
748 * the same message again. */
749 DESTROY_IF(this->responding.packet);
750 this->responding.packet = NULL;
751 }
752 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
753 this->queued_tasks->get_count(this->queued_tasks) > 0)
754 {
755 /* passive tasks completed, check if an active task has been queued,
756 * such as XAUTH or modeconfig push */
757 return initiate(this);
758 }
759 return SUCCESS;
760 }
761
762 /**
763 * handle an incoming response message
764 */
765 static status_t process_response(private_task_manager_t *this,
766 message_t *message)
767 {
768 enumerator_t *enumerator;
769 status_t status;
770 task_t *task;
771
772 if (message->get_exchange_type(message) != this->initiating.type)
773 {
774 DBG1(DBG_IKE, "received %N response, but expected %N",
775 exchange_type_names, message->get_exchange_type(message),
776 exchange_type_names, this->initiating.type);
777 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
778 return DESTROY_ME;
779 }
780
781 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
782 while (enumerator->enumerate(enumerator, (void*)&task))
783 {
784 switch (task->process(task, message))
785 {
786 case SUCCESS:
787 /* task completed, remove it */
788 this->active_tasks->remove_at(this->active_tasks, enumerator);
789 task->destroy(task);
790 continue;
791 case NEED_MORE:
792 /* processed, but task needs another exchange */
793 continue;
794 case ALREADY_DONE:
795 flush_queue(this, this->active_tasks);
796 break;
797 case FAILED:
798 default:
799 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
800 /* FALL */
801 case DESTROY_ME:
802 /* critical failure, destroy IKE_SA */
803 this->active_tasks->remove_at(this->active_tasks, enumerator);
804 enumerator->destroy(enumerator);
805 task->destroy(task);
806 return DESTROY_ME;
807 }
808 break;
809 }
810 enumerator->destroy(enumerator);
811
812 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
813 this->initiating.packet->destroy(this->initiating.packet);
814 this->initiating.packet = NULL;
815
816 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
817 {
818 status = this->public.task_manager.process_message(
819 &this->public.task_manager, this->queued);
820 this->queued->destroy(this->queued);
821 this->queued = NULL;
822 if (status == DESTROY_ME)
823 {
824 return status;
825 }
826 }
827
828 return initiate(this);
829 }
830
831 /**
832 * Parse the given message and verify that it is valid.
833 */
834 static status_t parse_message(private_task_manager_t *this, message_t *msg)
835 {
836 status_t status;
837
838 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
839
840 if (status != SUCCESS)
841 {
842 switch (status)
843 {
844 case NOT_SUPPORTED:
845 DBG1(DBG_IKE, "unsupported exchange type");
846 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
847 break;
848 case PARSE_ERROR:
849 DBG1(DBG_IKE, "message parsing failed");
850 send_notify(this, msg, PAYLOAD_MALFORMED);
851 break;
852 case VERIFY_ERROR:
853 DBG1(DBG_IKE, "message verification failed");
854 send_notify(this, msg, PAYLOAD_MALFORMED);
855 break;
856 case FAILED:
857 DBG1(DBG_IKE, "integrity check failed");
858 send_notify(this, msg, INVALID_HASH_INFORMATION);
859 break;
860 case INVALID_STATE:
861 DBG1(DBG_IKE, "found encrypted message, but no keys available");
862 send_notify(this, msg, PAYLOAD_MALFORMED);
863 default:
864 break;
865 }
866 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
867 exchange_type_names, msg->get_exchange_type(msg),
868 msg->get_request(msg) ? "request" : "response",
869 msg->get_message_id(msg));
870
871 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
872 { /* invalid initiation attempt, close SA */
873 return DESTROY_ME;
874 }
875 }
876 return status;
877 }
878
879 METHOD(task_manager_t, process_message, status_t,
880 private_task_manager_t *this, message_t *msg)
881 {
882 u_int32_t hash, mid, i;
883 host_t *me, *other;
884 status_t status;
885
886 /* TODO-IKEv1: update hosts more selectively */
887 me = msg->get_destination(msg);
888 other = msg->get_source(msg);
889 mid = msg->get_message_id(msg);
890 hash = chunk_hash(msg->get_packet_data(msg));
891 for (i = 0; i < MAX_OLD_HASHES; i++)
892 {
893 if (this->initiating.old_hashes[i] == hash)
894 {
895 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
896 "but next request already sent", mid);
897 return SUCCESS;
898 }
899 }
900
901 if ((mid && mid == this->initiating.mid) ||
902 (this->initiating.mid == 0 &&
903 msg->get_exchange_type(msg) == this->initiating.type &&
904 this->active_tasks->get_count(this->active_tasks)))
905 {
906 msg->set_request(msg, FALSE);
907 status = parse_message(this, msg);
908 if (status != SUCCESS)
909 {
910 return status;
911 }
912 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
913 time_monotonic(NULL));
914 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
915 charon->bus->message(charon->bus, msg, FALSE);
916 if (process_response(this, msg) != SUCCESS)
917 {
918 flush(this);
919 return DESTROY_ME;
920 }
921 this->initiating.old_hashes[(this->initiating.old_hash_pos++) %
922 MAX_OLD_HASHES] = hash;
923 }
924 else
925 {
926 if (hash == this->responding.hash)
927 {
928 if (this->responding.packet)
929 {
930 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
931 "retransmitting response", mid);
932 charon->sender->send(charon->sender,
933 this->responding.packet->clone(this->responding.packet));
934 }
935 else
936 {
937 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
938 "but no response to retransmit", mid);
939 }
940 return SUCCESS;
941 }
942 if (msg->get_exchange_type(msg) == TRANSACTION &&
943 this->active_tasks->get_count(this->active_tasks))
944 { /* main mode not yet complete, queue XAuth/Mode config tasks */
945 if (this->queued)
946 {
947 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
948 exchange_type_names, TRANSACTION);
949 return SUCCESS;
950 }
951 this->queued = message_create_from_packet(msg->get_packet(msg));
952 if (this->queued->parse_header(this->queued) != SUCCESS)
953 {
954 this->queued->destroy(this->queued);
955 this->queued = NULL;
956 return FAILED;
957 }
958 DBG1(DBG_IKE, "queueing %N request as tasks still active",
959 exchange_type_names, TRANSACTION);
960 return SUCCESS;
961 }
962
963 msg->set_request(msg, TRUE);
964 status = parse_message(this, msg);
965 if (status != SUCCESS)
966 {
967 return status;
968 }
969 /* if this IKE_SA is virgin, we check for a config */
970 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
971 {
972 ike_sa_id_t *ike_sa_id;
973 ike_cfg_t *ike_cfg;
974 job_t *job;
975 ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
976 if (ike_cfg == NULL)
977 {
978 /* no config found for these hosts, destroy */
979 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
980 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
981 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
982 return DESTROY_ME;
983 }
984 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
985 ike_cfg->destroy(ike_cfg);
986 /* add a timeout if peer does not establish it completely */
987 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
988 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
989 lib->scheduler->schedule_job(lib->scheduler, job,
990 lib->settings->get_int(lib->settings,
991 "charon.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT));
992 }
993 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
994 time_monotonic(NULL));
995 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
996 charon->bus->message(charon->bus, msg, TRUE);
997 if (process_request(this, msg) != SUCCESS)
998 {
999 flush(this);
1000 return DESTROY_ME;
1001 }
1002 this->responding.hash = hash;
1003 }
1004 return SUCCESS;
1005 }
1006
1007 METHOD(task_manager_t, queue_task, void,
1008 private_task_manager_t *this, task_t *task)
1009 {
1010 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1011 this->queued_tasks->insert_last(this->queued_tasks, task);
1012 }
1013
1014 METHOD(task_manager_t, adopt_tasks, void,
1015 private_task_manager_t *this, task_manager_t *other_public)
1016 {
1017 private_task_manager_t *other = (private_task_manager_t*)other_public;
1018 task_t *task;
1019
1020 /* move queued tasks from other to this */
1021 while (other->queued_tasks->remove_last(other->queued_tasks,
1022 (void**)&task) == SUCCESS)
1023 {
1024 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1025 task->migrate(task, this->ike_sa);
1026 this->queued_tasks->insert_first(this->queued_tasks, task);
1027 }
1028 }
1029
1030 METHOD(task_manager_t, busy, bool,
1031 private_task_manager_t *this)
1032 {
1033 return (this->active_tasks->get_count(this->active_tasks) > 0);
1034 }
1035
1036 METHOD(task_manager_t, incr_mid, void,
1037 private_task_manager_t *this, bool initiate)
1038 {
1039 }
1040
1041 METHOD(task_manager_t, reset, void,
1042 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1043 {
1044 }
1045
1046 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1047 private_task_manager_t *this, task_queue_t queue)
1048 {
1049 switch (queue)
1050 {
1051 case TASK_QUEUE_ACTIVE:
1052 return this->active_tasks->create_enumerator(this->active_tasks);
1053 case TASK_QUEUE_PASSIVE:
1054 return this->passive_tasks->create_enumerator(this->passive_tasks);
1055 case TASK_QUEUE_QUEUED:
1056 return this->queued_tasks->create_enumerator(this->queued_tasks);
1057 default:
1058 return enumerator_create_empty();
1059 }
1060 }
1061
1062 METHOD(task_manager_t, destroy, void,
1063 private_task_manager_t *this)
1064 {
1065 flush(this);
1066
1067 this->active_tasks->destroy(this->active_tasks);
1068 this->queued_tasks->destroy(this->queued_tasks);
1069 this->passive_tasks->destroy(this->passive_tasks);
1070
1071 DESTROY_IF(this->queued);
1072 DESTROY_IF(this->responding.packet);
1073 DESTROY_IF(this->initiating.packet);
1074 DESTROY_IF(this->rng);
1075 free(this);
1076 }
1077
1078 /*
1079 * see header file
1080 */
1081 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1082 {
1083 private_task_manager_t *this;
1084
1085 INIT(this,
1086 .public = {
1087 .task_manager = {
1088 .process_message = _process_message,
1089 .queue_task = _queue_task,
1090 .initiate = _initiate,
1091 .retransmit = _retransmit,
1092 .incr_mid = _incr_mid,
1093 .reset = _reset,
1094 .adopt_tasks = _adopt_tasks,
1095 .busy = _busy,
1096 .create_task_enumerator = _create_task_enumerator,
1097 .destroy = _destroy,
1098 },
1099 },
1100 .ike_sa = ike_sa,
1101 .initiating.type = EXCHANGE_TYPE_UNDEFINED,
1102 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1103 .queued_tasks = linked_list_create(),
1104 .active_tasks = linked_list_create(),
1105 .passive_tasks = linked_list_create(),
1106 .retransmit_tries = lib->settings->get_int(lib->settings,
1107 "charon.retransmit_tries", RETRANSMIT_TRIES),
1108 .retransmit_timeout = lib->settings->get_double(lib->settings,
1109 "charon.retransmit_timeout", RETRANSMIT_TIMEOUT),
1110 .retransmit_base = lib->settings->get_double(lib->settings,
1111 "charon.retransmit_base", RETRANSMIT_BASE),
1112 );
1113
1114 return &this->public;
1115 }