src/libcharon/sa/ikev1/task_manager_v1.c

   1 /*
   2  * Copyright (C) 2007-2015 Tobias Brunner
   3  * Copyright (C) 2007-2011 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include "task_manager_v1.h"
  18
  19 #include <math.h>
  20
  21 #include <daemon.h>
  22 #include <sa/ikev1/tasks/main_mode.h>
  23 #include <sa/ikev1/tasks/aggressive_mode.h>
  24 #include <sa/ikev1/tasks/quick_mode.h>
  25 #include <sa/ikev1/tasks/quick_delete.h>
  26 #include <sa/ikev1/tasks/xauth.h>
  27 #include <sa/ikev1/tasks/mode_config.h>
  28 #include <sa/ikev1/tasks/informational.h>
  29 #include <sa/ikev1/tasks/isakmp_natd.h>
  30 #include <sa/ikev1/tasks/isakmp_vendor.h>
  31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
  32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
  33 #include <sa/ikev1/tasks/isakmp_delete.h>
  34 #include <sa/ikev1/tasks/isakmp_dpd.h>
  35
  36 #include <processing/jobs/retransmit_job.h>
  37 #include <processing/jobs/delete_ike_sa_job.h>
  38 #include <processing/jobs/dpd_timeout_job.h>
  39 #include <processing/jobs/process_message_job.h>
  40
  41 #include <collections/array.h>
  42
  43 /**
  44  * Number of old messages hashes we keep for retransmission.
  45  *
  46  * In Main Mode, we must ignore messages from a previous message pair if
  47  * we already continued to the next. Otherwise a late retransmission
  48  * could be considered as a reply to the newer request.
  49  */
  50 #define MAX_OLD_HASHES 2
  51
  52 /**
  53  * First sequence number of responding packets.
  54  *
  55  * To distinguish retransmission jobs for initiating and responding packets,
  56  * we split up the sequence counter and use the upper half for responding.
  57  */
  58 #define RESPONDING_SEQ INT_MAX
  59
  60 typedef struct exchange_t exchange_t;
  61
  62 /**
  63  * An exchange in the air, used do detect and handle retransmission
  64  */
  65 struct exchange_t {
  66
  67         /**
  68          * Message ID used for this transaction
  69          */
  70         u_int32_t mid;
  71
  72         /**
  73          * generated packet for retransmission
  74          */
  75         packet_t *packet;
  76 };
  77
  78 typedef struct private_task_manager_t private_task_manager_t;
  79
  80 /**
  81  * private data of the task manager
  82  */
  83 struct private_task_manager_t {
  84
  85         /**
  86          * public functions
  87          */
  88         task_manager_v1_t public;
  89
  90         /**
  91          * associated IKE_SA we are serving
  92          */
  93         ike_sa_t *ike_sa;
  94
  95         /**
  96          * RNG to create message IDs
  97          */
  98         rng_t *rng;
  99
 100         /**
 101          * Exchange we are currently handling as responder
 102          */
 103         struct {
 104                 /**
 105                  * Message ID of the last response
 106                  */
 107                 u_int32_t mid;
 108
 109                 /**
 110                  * Hash of a previously received message
 111                  */
 112                 u_int32_t hash;
 113
 114                 /**
 115                  * packet(s) for retransmission
 116                  */
 117                 array_t *packets;
 118
 119                 /**
 120                  * Sequence number of the last sent message
 121                  */
 122                 u_int32_t seqnr;
 123
 124                 /**
 125                  * how many times we have retransmitted so far
 126                  */
 127                 u_int retransmitted;
 128
 129         } responding;
 130
 131         /**
 132          * Exchange we are currently handling as initiator
 133          */
 134         struct {
 135                 /**
 136                  * Message ID of the exchange
 137                  */
 138                 u_int32_t mid;
 139
 140                 /**
 141                  * Hashes of old responses we can ignore
 142                  */
 143                 u_int32_t old_hashes[MAX_OLD_HASHES];
 144
 145                 /**
 146                  * Position in old hash array
 147                  */
 148                 int old_hash_pos;
 149
 150                 /**
 151                  * Sequence number of the last sent message
 152                  */
 153                 u_int32_t seqnr;
 154
 155                 /**
 156                  * how many times we have retransmitted so far
 157                  */
 158                 u_int retransmitted;
 159
 160                 /**
 161                  * packet(s) for retransmission
 162                  */
 163                 array_t *packets;
 164
 165                 /**
 166                  * type of the initiated exchange
 167                  */
 168                 exchange_type_t type;
 169
 170         } initiating;
 171
 172         /**
 173          * Message we are currently defragmenting, if any (only one at a time)
 174          */
 175         message_t *defrag;
 176
 177         /**
 178          * List of queued tasks not yet in action
 179          */
 180         linked_list_t *queued_tasks;
 181
 182         /**
 183          * List of active tasks, initiated by ourselves
 184          */
 185         linked_list_t *active_tasks;
 186
 187         /**
 188          * List of tasks initiated by peer
 189          */
 190         linked_list_t *passive_tasks;
 191
 192         /**
 193          * Queued messages not yet ready to process
 194          */
 195         message_t *queued;
 196
 197         /**
 198          * Number of times we retransmit messages before giving up
 199          */
 200         u_int retransmit_tries;
 201
 202         /**
 203          * Retransmission timeout
 204          */
 205         double retransmit_timeout;
 206
 207         /**
 208          * Base to calculate retransmission timeout
 209          */
 210         double retransmit_base;
 211
 212         /**
 213          * Sequence number for sending DPD requests
 214          */
 215         u_int32_t dpd_send;
 216
 217         /**
 218          * Sequence number for received DPD requests
 219          */
 220         u_int32_t dpd_recv;
 221 };
 222
 223 /**
 224  * Reset retransmission packet list
 225  */
 226 static void clear_packets(array_t *array)
 227 {
 228         packet_t *packet;
 229
 230         while (array_remove(array, ARRAY_TAIL, &packet))
 231         {
 232                 packet->destroy(packet);
 233         }
 234 }
 235
 236 METHOD(task_manager_t, flush_queue, void,
 237         private_task_manager_t *this, task_queue_t queue)
 238 {
 239         linked_list_t *list;
 240         task_t *task;
 241
 242         if (this->queued)
 243         {
 244                 this->queued->destroy(this->queued);
 245                 this->queued = NULL;
 246         }
 247         switch (queue)
 248         {
 249                 case TASK_QUEUE_ACTIVE:
 250                         list = this->active_tasks;
 251                         /* cancel pending retransmits */
 252                         this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
 253                         clear_packets(this->initiating.packets);
 254                         break;
 255                 case TASK_QUEUE_PASSIVE:
 256                         list = this->passive_tasks;
 257                         break;
 258                 case TASK_QUEUE_QUEUED:
 259                         list = this->queued_tasks;
 260                         break;
 261                 default:
 262                         return;
 263         }
 264         while (list->remove_last(list, (void**)&task) == SUCCESS)
 265         {
 266                 task->destroy(task);
 267         }
 268 }
 269
 270 METHOD(task_manager_t, flush, void,
 271         private_task_manager_t *this)
 272 {
 273         flush_queue(this, TASK_QUEUE_QUEUED);
 274         flush_queue(this, TASK_QUEUE_PASSIVE);
 275         flush_queue(this, TASK_QUEUE_ACTIVE);
 276 }
 277
 278 /**
 279  * move a task of a specific type from the queue to the active list
 280  */
 281 static bool activate_task(private_task_manager_t *this, task_type_t type)
 282 {
 283         enumerator_t *enumerator;
 284         task_t *task;
 285         bool found = FALSE;
 286
 287         enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
 288         while (enumerator->enumerate(enumerator, (void**)&task))
 289         {
 290                 if (task->get_type(task) == type)
 291                 {
 292                         DBG2(DBG_IKE, "  activating %N task", task_type_names, type);
 293                         this->queued_tasks->remove_at(this->queued_tasks, enumerator);
 294                         this->active_tasks->insert_last(this->active_tasks, task);
 295                         found = TRUE;
 296                         break;
 297                 }
 298         }
 299         enumerator->destroy(enumerator);
 300         return found;
 301 }
 302
 303 /**
 304  * Send packets in the given array (they get cloned)
 305  */
 306 static void send_packets(private_task_manager_t *this, array_t *packets)
 307 {
 308         enumerator_t *enumerator;
 309         packet_t *packet;
 310
 311         enumerator = array_create_enumerator(packets);
 312         while (enumerator->enumerate(enumerator, &packet))
 313         {
 314                 charon->sender->send(charon->sender, packet->clone(packet));
 315         }
 316         enumerator->destroy(enumerator);
 317 }
 318
 319 /**
 320  * Generates the given message and stores packet(s) in the given array
 321  */
 322 static bool generate_message(private_task_manager_t *this, message_t *message,
 323                                                          array_t **packets)
 324 {
 325         enumerator_t *fragments;
 326         packet_t *fragment;
 327
 328         if (this->ike_sa->generate_message_fragmented(this->ike_sa, message,
 329                                                                                                   &fragments) != SUCCESS)
 330         {
 331                 return FALSE;
 332         }
 333         while (fragments->enumerate(fragments, &fragment))
 334         {
 335                 array_insert_create(packets, ARRAY_TAIL, fragment);
 336         }
 337         fragments->destroy(fragments);
 338         return TRUE;
 339 }
 340
 341 /**
 342  * Retransmit a packet (or its fragments)
 343  */
 344 static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
 345                                                         u_int mid, u_int retransmitted, array_t *packets)
 346 {
 347         packet_t *packet;
 348         u_int32_t t;
 349
 350         array_get(packets, 0, &packet);
 351         if (retransmitted > this->retransmit_tries)
 352         {
 353                 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
 354                 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_TIMEOUT, packet);
 355                 return DESTROY_ME;
 356         }
 357         t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
 358                                         pow(this->retransmit_base, retransmitted));
 359         if (retransmitted)
 360         {
 361                 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
 362                          retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
 363                          mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
 364                 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND, packet);
 365         }
 366         send_packets(this, packets);
 367         lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
 368                         retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
 369         return NEED_MORE;
 370 }
 371
 372 METHOD(task_manager_t, retransmit, status_t,
 373         private_task_manager_t *this, u_int32_t seqnr)
 374 {
 375         status_t status = SUCCESS;
 376
 377         if (seqnr == this->initiating.seqnr &&
 378                 array_count(this->initiating.packets))
 379         {
 380                 status = retransmit_packet(this, seqnr, this->initiating.mid,
 381                                         this->initiating.retransmitted, this->initiating.packets);
 382                 if (status == NEED_MORE)
 383                 {
 384                         this->initiating.retransmitted++;
 385                         status = SUCCESS;
 386                 }
 387         }
 388         if (seqnr == this->responding.seqnr &&
 389                 array_count(this->responding.packets))
 390         {
 391                 status = retransmit_packet(this, seqnr, this->responding.mid,
 392                                         this->responding.retransmitted, this->responding.packets);
 393                 if (status == NEED_MORE)
 394                 {
 395                         this->responding.retransmitted++;
 396                         status = SUCCESS;
 397                 }
 398         }
 399         return status;
 400 }
 401
 402 /**
 403  * Check if we have to wait for a mode config before starting a quick mode
 404  */
 405 static bool mode_config_expected(private_task_manager_t *this)
 406 {
 407         enumerator_t *enumerator;
 408         peer_cfg_t *peer_cfg;
 409         char *pool;
 410         bool local;
 411         host_t *host;
 412
 413         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 414         if (peer_cfg)
 415         {
 416                 if (peer_cfg->use_pull_mode(peer_cfg))
 417                 {
 418                         enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
 419                         if (!enumerator->enumerate(enumerator, &pool))
 420                         {       /* no pool configured */
 421                                 enumerator->destroy(enumerator);
 422                                 return FALSE;
 423                         }
 424                         enumerator->destroy(enumerator);
 425
 426                         local = FALSE;
 427                 }
 428                 else
 429                 {
 430                         enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
 431                         if (!enumerator->enumerate(enumerator, &host))
 432                         {       /* not requesting a vip */
 433                                 enumerator->destroy(enumerator);
 434                                 return FALSE;
 435                         }
 436                         enumerator->destroy(enumerator);
 437
 438                         local = TRUE;
 439                 }
 440                 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
 441                                                                                                                                 local);
 442                 if (!enumerator->enumerate(enumerator, &host))
 443                 {       /* expecting a VIP exchange, but no VIP assigned yet */
 444                         enumerator->destroy(enumerator);
 445                         return TRUE;
 446                 }
 447                 enumerator->destroy(enumerator);
 448         }
 449         return FALSE;
 450 }
 451
 452 METHOD(task_manager_t, initiate, status_t,
 453         private_task_manager_t *this)
 454 {
 455         enumerator_t *enumerator;
 456         task_t *task;
 457         message_t *message;
 458         host_t *me, *other;
 459         exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
 460         bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
 461
 462         if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
 463                 this->initiating.type != INFORMATIONAL_V1)
 464         {
 465                 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
 466                                 exchange_type_names, this->initiating.type);
 467                 /* do not initiate if we already have a message in the air */
 468                 return SUCCESS;
 469         }
 470
 471         if (this->active_tasks->get_count(this->active_tasks) == 0)
 472         {
 473                 DBG2(DBG_IKE, "activating new tasks");
 474                 switch (this->ike_sa->get_state(this->ike_sa))
 475                 {
 476                         case IKE_CREATED:
 477                                 activate_task(this, TASK_ISAKMP_VENDOR);
 478                                 activate_task(this, TASK_ISAKMP_CERT_PRE);
 479                                 if (activate_task(this, TASK_MAIN_MODE))
 480                                 {
 481                                         exchange = ID_PROT;
 482                                 }
 483                                 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
 484                                 {
 485                                         exchange = AGGRESSIVE;
 486                                 }
 487                                 activate_task(this, TASK_ISAKMP_CERT_POST);
 488                                 activate_task(this, TASK_ISAKMP_NATD);
 489                                 break;
 490                         case IKE_CONNECTING:
 491                                 if (activate_task(this, TASK_ISAKMP_DELETE))
 492                                 {
 493                                         exchange = INFORMATIONAL_V1;
 494                                         new_mid = TRUE;
 495                                         break;
 496                                 }
 497                                 if (activate_task(this, TASK_XAUTH))
 498                                 {
 499                                         exchange = TRANSACTION;
 500                                         new_mid = TRUE;
 501                                         break;
 502                                 }
 503                                 if (activate_task(this, TASK_INFORMATIONAL))
 504                                 {
 505                                         exchange = INFORMATIONAL_V1;
 506                                         new_mid = TRUE;
 507                                         break;
 508                                 }
 509                                 break;
 510                         case IKE_ESTABLISHED:
 511                                 if (activate_task(this, TASK_MODE_CONFIG))
 512                                 {
 513                                         exchange = TRANSACTION;
 514                                         new_mid = TRUE;
 515                                         break;
 516                                 }
 517                                 if (!mode_config_expected(this) &&
 518                                         activate_task(this, TASK_QUICK_MODE))
 519                                 {
 520                                         exchange = QUICK_MODE;
 521                                         new_mid = TRUE;
 522                                         break;
 523                                 }
 524                                 if (activate_task(this, TASK_INFORMATIONAL))
 525                                 {
 526                                         exchange = INFORMATIONAL_V1;
 527                                         new_mid = TRUE;
 528                                         break;
 529                                 }
 530                                 if (activate_task(this, TASK_QUICK_DELETE))
 531                                 {
 532                                         exchange = INFORMATIONAL_V1;
 533                                         new_mid = TRUE;
 534                                         break;
 535                                 }
 536                                 if (activate_task(this, TASK_ISAKMP_DELETE))
 537                                 {
 538                                         exchange = INFORMATIONAL_V1;
 539                                         new_mid = TRUE;
 540                                         break;
 541                                 }
 542                                 if (activate_task(this, TASK_ISAKMP_DPD))
 543                                 {
 544                                         exchange = INFORMATIONAL_V1;
 545                                         new_mid = TRUE;
 546                                         break;
 547                                 }
 548                                 break;
 549                         default:
 550                                 break;
 551                 }
 552         }
 553         else
 554         {
 555                 DBG2(DBG_IKE, "reinitiating already active tasks");
 556                 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
 557                 while (enumerator->enumerate(enumerator, (void**)&task))
 558                 {
 559                         DBG2(DBG_IKE, "  %N task", task_type_names, task->get_type(task));
 560                         switch (task->get_type(task))
 561                         {
 562                                 case TASK_MAIN_MODE:
 563                                         exchange = ID_PROT;
 564                                         break;
 565                                 case TASK_AGGRESSIVE_MODE:
 566                                         exchange = AGGRESSIVE;
 567                                         break;
 568                                 case TASK_QUICK_MODE:
 569                                         exchange = QUICK_MODE;
 570                                         break;
 571                                 case TASK_XAUTH:
 572                                         exchange = TRANSACTION;
 573                                         new_mid = TRUE;
 574                                         break;
 575                                 default:
 576                                         continue;
 577                         }
 578                         break;
 579                 }
 580                 enumerator->destroy(enumerator);
 581         }
 582
 583         if (exchange == EXCHANGE_TYPE_UNDEFINED)
 584         {
 585                 DBG2(DBG_IKE, "nothing to initiate");
 586                 /* nothing to do yet... */
 587                 return SUCCESS;
 588         }
 589
 590         me = this->ike_sa->get_my_host(this->ike_sa);
 591         other = this->ike_sa->get_other_host(this->ike_sa);
 592
 593         if (new_mid)
 594         {
 595                 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
 596                                                                  (void*)&this->initiating.mid))
 597                 {
 598                         DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
 599                         flush(this);
 600                         return DESTROY_ME;
 601                 }
 602         }
 603         message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 604         message->set_message_id(message, this->initiating.mid);
 605         message->set_source(message, me->clone(me));
 606         message->set_destination(message, other->clone(other));
 607         message->set_exchange_type(message, exchange);
 608         this->initiating.type = exchange;
 609         this->initiating.retransmitted = 0;
 610
 611         enumerator = this->active_tasks->create_enumerator(this->active_tasks);
 612         while (enumerator->enumerate(enumerator, (void*)&task))
 613         {
 614                 switch (task->build(task, message))
 615                 {
 616                         case SUCCESS:
 617                                 /* task completed, remove it */
 618                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
 619                                 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
 620                                         task->get_type(task) == TASK_QUICK_MODE)
 621                                 {       /* last message of three message exchange */
 622                                         keep = TRUE;
 623                                 }
 624                                 task->destroy(task);
 625                                 continue;
 626                         case NEED_MORE:
 627                                 expect_response = TRUE;
 628                                 /* processed, but task needs another exchange */
 629                                 continue;
 630                         case ALREADY_DONE:
 631                                 cancelled = TRUE;
 632                                 break;
 633                         case FAILED:
 634                         default:
 635                                 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
 636                                 {
 637                                         charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 638                                 }
 639                                 /* FALL */
 640                         case DESTROY_ME:
 641                                 /* critical failure, destroy IKE_SA */
 642                                 enumerator->destroy(enumerator);
 643                                 message->destroy(message);
 644                                 flush(this);
 645                                 return DESTROY_ME;
 646                 }
 647                 break;
 648         }
 649         enumerator->destroy(enumerator);
 650
 651         if (this->active_tasks->get_count(this->active_tasks) == 0 &&
 652                 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
 653         {       /* tasks completed, no exchange active anymore */
 654                 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
 655         }
 656         if (cancelled)
 657         {
 658                 message->destroy(message);
 659                 return initiate(this);
 660         }
 661
 662         clear_packets(this->initiating.packets);
 663         if (!generate_message(this, message, &this->initiating.packets))
 664         {
 665                 /* message generation failed. There is nothing more to do than to
 666                  * close the SA */
 667                 message->destroy(message);
 668                 flush(this);
 669                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 670                 return DESTROY_ME;
 671         }
 672
 673         this->initiating.seqnr++;
 674         if (expect_response)
 675         {
 676                 message->destroy(message);
 677                 return retransmit(this, this->initiating.seqnr);
 678         }
 679         if (keep)
 680         {       /* keep the packet for retransmission, the responder might request it */
 681                 send_packets(this, this->initiating.packets);
 682         }
 683         else
 684         {
 685                 send_packets(this, this->initiating.packets);
 686                 clear_packets(this->initiating.packets);
 687         }
 688         message->destroy(message);
 689
 690         if (exchange == INFORMATIONAL_V1)
 691         {
 692                 switch (this->ike_sa->get_state(this->ike_sa))
 693                 {
 694                         case IKE_CONNECTING:
 695                                 /* close after sending an INFORMATIONAL when unestablished */
 696                                 return FAILED;
 697                         case IKE_DELETING:
 698                                 /* close after sending a DELETE */
 699                                 return DESTROY_ME;
 700                         default:
 701                                 break;
 702                 }
 703         }
 704         return initiate(this);
 705 }
 706
 707 /**
 708  * build a response depending on the "passive" task list
 709  */
 710 static status_t build_response(private_task_manager_t *this, message_t *request)
 711 {
 712         enumerator_t *enumerator;
 713         task_t *task;
 714         message_t *message;
 715         host_t *me, *other;
 716         bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
 717
 718         me = request->get_destination(request);
 719         other = request->get_source(request);
 720
 721         message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 722         message->set_exchange_type(message, request->get_exchange_type(request));
 723         /* send response along the path the request came in */
 724         message->set_source(message, me->clone(me));
 725         message->set_destination(message, other->clone(other));
 726         message->set_message_id(message, request->get_message_id(request));
 727         message->set_request(message, FALSE);
 728
 729         this->responding.mid = request->get_message_id(request);
 730         this->responding.retransmitted = 0;
 731         this->responding.seqnr++;
 732
 733         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
 734         while (enumerator->enumerate(enumerator, (void*)&task))
 735         {
 736                 switch (task->build(task, message))
 737                 {
 738                         case SUCCESS:
 739                                 /* task completed, remove it */
 740                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
 741                                 task->destroy(task);
 742                                 continue;
 743                         case NEED_MORE:
 744                                 /* processed, but task needs another exchange */
 745                                 if (task->get_type(task) == TASK_QUICK_MODE ||
 746                                         task->get_type(task) == TASK_AGGRESSIVE_MODE)
 747                                 {       /* we rely on initiator retransmission, except for
 748                                          * three-message exchanges */
 749                                         expect_request = TRUE;
 750                                 }
 751                                 continue;
 752                         case ALREADY_DONE:
 753                                 cancelled = TRUE;
 754                                 break;
 755                         case INVALID_ARG:
 756                                 if (task->get_type(task) == TASK_QUICK_MODE)
 757                                 {       /* not responsible for this exchange */
 758                                         continue;
 759                                 }
 760                                 /* FALL */
 761                         case FAILED:
 762                         default:
 763                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 764                                 /* FALL */
 765                         case DESTROY_ME:
 766                                 /* destroy IKE_SA, but SEND response first */
 767                                 delete = TRUE;
 768                                 break;
 769                 }
 770                 break;
 771         }
 772         enumerator->destroy(enumerator);
 773
 774         clear_packets(this->responding.packets);
 775         if (cancelled)
 776         {
 777                 message->destroy(message);
 778                 return initiate(this);
 779         }
 780         if (!generate_message(this, message, &this->responding.packets))
 781         {
 782                 message->destroy(message);
 783                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 784                 return DESTROY_ME;
 785         }
 786         message->destroy(message);
 787
 788         if (expect_request && !delete)
 789         {
 790                 return retransmit(this, this->responding.seqnr);
 791         }
 792         send_packets(this, this->responding.packets);
 793         if (delete)
 794         {
 795                 return DESTROY_ME;
 796         }
 797         return SUCCESS;
 798 }
 799
 800 /**
 801  * Send a notify in a separate INFORMATIONAL exchange back to the sender.
 802  * The notify protocol_id is set to ISAKMP
 803  */
 804 static void send_notify(private_task_manager_t *this, message_t *request,
 805                                                 notify_type_t type)
 806 {
 807         message_t *response;
 808         array_t *packets = NULL;
 809         host_t *me, *other;
 810         u_int32_t mid;
 811
 812         if (request->get_exchange_type(request) == INFORMATIONAL_V1)
 813         {       /* don't respond to INFORMATIONAL requests to avoid a notify war */
 814                 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
 815                 return;
 816         }
 817         if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
 818         {
 819                 DBG1(DBG_IKE, "failed to allocate message ID");
 820                 return;
 821         }
 822         response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 823         response->set_exchange_type(response, INFORMATIONAL_V1);
 824         response->set_request(response, TRUE);
 825         response->set_message_id(response, mid);
 826         response->add_payload(response, (payload_t*)
 827                                 notify_payload_create_from_protocol_and_type(PLV1_NOTIFY,
 828                                                                                                         PROTO_IKE, type));
 829
 830         me = this->ike_sa->get_my_host(this->ike_sa);
 831         if (me->is_anyaddr(me))
 832         {
 833                 me = request->get_destination(request);
 834                 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
 835         }
 836         other = this->ike_sa->get_other_host(this->ike_sa);
 837         if (other->is_anyaddr(other))
 838         {
 839                 other = request->get_source(request);
 840                 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
 841         }
 842         response->set_source(response, me->clone(me));
 843         response->set_destination(response, other->clone(other));
 844         if (generate_message(this, response, &packets))
 845         {
 846                 send_packets(this, packets);
 847         }
 848         clear_packets(packets);
 849         array_destroy(packets);
 850         response->destroy(response);
 851 }
 852
 853 /**
 854  * Process a DPD request/response
 855  */
 856 static bool process_dpd(private_task_manager_t *this, message_t *message)
 857 {
 858         notify_payload_t *notify;
 859         notify_type_t type;
 860         u_int32_t seq;
 861         chunk_t data;
 862
 863         type = DPD_R_U_THERE;
 864         notify = message->get_notify(message, type);
 865         if (!notify)
 866         {
 867                 type = DPD_R_U_THERE_ACK;
 868                 notify = message->get_notify(message, type);
 869         }
 870         if (!notify)
 871         {
 872                 return FALSE;
 873         }
 874         data = notify->get_notification_data(notify);
 875         if (data.len != 4)
 876         {
 877                 return FALSE;
 878         }
 879         seq = untoh32(data.ptr);
 880
 881         if (type == DPD_R_U_THERE)
 882         {
 883                 if (this->dpd_recv == 0 || seq == this->dpd_recv)
 884                 {       /* check sequence validity */
 885                         this->dpd_recv = seq + 1;
 886                         this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
 887                                                                                 time_monotonic(NULL));
 888                 }
 889                 /* but respond anyway */
 890                 this->ike_sa->queue_task(this->ike_sa,
 891                                 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
 892         }
 893         else /* DPD_R_U_THERE_ACK */
 894         {
 895                 if (seq == this->dpd_send - 1)
 896                 {
 897                         this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
 898                                                                                 time_monotonic(NULL));
 899                 }
 900                 else
 901                 {
 902                         DBG1(DBG_IKE, "received invalid DPD sequence number %u "
 903                                  "(expected %u), ignored", seq, this->dpd_send - 1);
 904                 }
 905         }
 906         return TRUE;
 907 }
 908
 909 /**
 910  * Check if we already have a quick mode task queued for the exchange with the
 911  * given message ID
 912  */
 913 static bool have_quick_mode_task(private_task_manager_t *this, u_int32_t mid)
 914 {
 915         enumerator_t *enumerator;
 916         quick_mode_t *qm;
 917         task_t *task;
 918         bool found = FALSE;
 919
 920         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
 921         while (enumerator->enumerate(enumerator, &task))
 922         {
 923                 if (task->get_type(task) == TASK_QUICK_MODE)
 924                 {
 925                         qm = (quick_mode_t*)task;
 926                         if (qm->get_mid(qm) == mid)
 927                         {
 928                                 found = TRUE;
 929                                 break;
 930                         }
 931                 }
 932         }
 933         enumerator->destroy(enumerator);
 934         return found;
 935 }
 936
 937 /**
 938  * Check if we still have an aggressive mode task queued
 939  */
 940 static bool have_aggressive_mode_task(private_task_manager_t *this)
 941 {
 942         enumerator_t *enumerator;
 943         task_t *task;
 944         bool found = FALSE;
 945
 946         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
 947         while (enumerator->enumerate(enumerator, &task))
 948         {
 949                 if (task->get_type(task) == TASK_AGGRESSIVE_MODE)
 950                 {
 951                         found = TRUE;
 952                         break;
 953                 }
 954         }
 955         enumerator->destroy(enumerator);
 956         return found;
 957 }
 958
 959 /**
 960  * handle an incoming request message
 961  */
 962 static status_t process_request(private_task_manager_t *this,
 963                                                                 message_t *message)
 964 {
 965         enumerator_t *enumerator;
 966         task_t *task = NULL;
 967         bool send_response = FALSE, dpd = FALSE;
 968
 969         if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
 970                 message->get_exchange_type(message) == QUICK_MODE ||
 971                 this->passive_tasks->get_count(this->passive_tasks) == 0)
 972         {       /* create tasks depending on request type, if not already some queued */
 973                 switch (message->get_exchange_type(message))
 974                 {
 975                         case ID_PROT:
 976                                 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
 977                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 978                                 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
 979                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 980                                 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
 981                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 982                                 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
 983                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 984                                 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
 985                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 986                                 break;
 987                         case AGGRESSIVE:
 988                                 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
 989                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 990                                 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
 991                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 992                                 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
 993                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 994                                 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
 995                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 996                                 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
 997                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 998                                 break;
 999                         case QUICK_MODE:
1000                                 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1001                                 {
1002                                         DBG1(DBG_IKE, "received quick mode request for "
1003                                                  "unestablished IKE_SA, ignored");
1004                                         return FAILED;
1005                                 }
1006                                 if (have_quick_mode_task(this, message->get_message_id(message)))
1007                                 {
1008                                         break;
1009                                 }
1010                                 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
1011                                                                                                    NULL, NULL);
1012                                 this->passive_tasks->insert_last(this->passive_tasks, task);
1013                                 break;
1014                         case INFORMATIONAL_V1:
1015                                 if (process_dpd(this, message))
1016                                 {
1017                                         dpd = TRUE;
1018                                 }
1019                                 else
1020                                 {
1021                                         task = (task_t *)informational_create(this->ike_sa, NULL);
1022                                         this->passive_tasks->insert_first(this->passive_tasks, task);
1023                                 }
1024                                 break;
1025                         case TRANSACTION:
1026                                 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
1027                                 {
1028                                         task = (task_t *)mode_config_create(this->ike_sa,
1029                                                                                                                 FALSE, TRUE);
1030                                 }
1031                                 else
1032                                 {
1033                                         task = (task_t *)xauth_create(this->ike_sa, FALSE);
1034                                 }
1035                                 this->passive_tasks->insert_last(this->passive_tasks, task);
1036                                 break;
1037                         default:
1038                                 return FAILED;
1039                 }
1040         }
1041         if (dpd)
1042         {
1043                 return initiate(this);
1044         }
1045         this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
1046
1047         /* let the tasks process the message */
1048         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
1049         while (enumerator->enumerate(enumerator, (void*)&task))
1050         {
1051                 switch (task->process(task, message))
1052                 {
1053                         case SUCCESS:
1054                                 /* task completed, remove it */
1055                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1056                                 task->destroy(task);
1057                                 continue;
1058                         case NEED_MORE:
1059                                 /* processed, but task needs at least another call to build() */
1060                                 send_response = TRUE;
1061                                 continue;
1062                         case ALREADY_DONE:
1063                                 send_response = FALSE;
1064                                 break;
1065                         case INVALID_ARG:
1066                                 if (task->get_type(task) == TASK_QUICK_MODE)
1067                                 {       /* not responsible for this exchange */
1068                                         continue;
1069                                 }
1070                                 /* FALL */
1071                         case FAILED:
1072                         default:
1073                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1074                                 /* FALL */
1075                         case DESTROY_ME:
1076                                 /* critical failure, destroy IKE_SA */
1077                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1078                                 enumerator->destroy(enumerator);
1079                                 task->destroy(task);
1080                                 return DESTROY_ME;
1081                 }
1082                 break;
1083         }
1084         enumerator->destroy(enumerator);
1085
1086         if (send_response)
1087         {
1088                 if (build_response(this, message) != SUCCESS)
1089                 {
1090                         return DESTROY_ME;
1091                 }
1092         }
1093         else
1094         {       /* We don't send a response, so don't retransmit one if we get
1095                  * the same message again. */
1096                 clear_packets(this->responding.packets);
1097         }
1098         if (this->queued &&
1099                 this->queued->get_exchange_type(this->queued) == INFORMATIONAL_V1)
1100         {
1101                 message_t *queued;
1102                 status_t status;
1103
1104                 queued = this->queued;
1105                 this->queued = NULL;
1106                 status = this->public.task_manager.process_message(
1107                                                                                         &this->public.task_manager, queued);
1108                 queued->destroy(queued);
1109                 if (status == DESTROY_ME)
1110                 {
1111                         return status;
1112                 }
1113         }
1114         if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
1115                 this->queued_tasks->get_count(this->queued_tasks) > 0)
1116         {
1117                 /* passive tasks completed, check if an active task has been queued,
1118                  * such as XAUTH or modeconfig push */
1119                 return initiate(this);
1120         }
1121         return SUCCESS;
1122 }
1123
1124 /**
1125  * handle an incoming response message
1126  */
1127 static status_t process_response(private_task_manager_t *this,
1128                                                                  message_t *message)
1129 {
1130         enumerator_t *enumerator;
1131         message_t *queued;
1132         status_t status;
1133         task_t *task;
1134
1135         if (message->get_exchange_type(message) != this->initiating.type)
1136         {
1137                 /* Windows server sends a fourth quick mode message having an initial
1138                  * contact notify. Ignore this message for compatibility. */
1139                 if (this->initiating.type == EXCHANGE_TYPE_UNDEFINED &&
1140                         message->get_exchange_type(message) == QUICK_MODE &&
1141                         message->get_notify(message, INITIAL_CONTACT))
1142                 {
1143                         DBG1(DBG_IKE, "ignoring fourth Quick Mode message");
1144                         return SUCCESS;
1145                 }
1146                 DBG1(DBG_IKE, "received %N response, but expected %N",
1147                          exchange_type_names, message->get_exchange_type(message),
1148                          exchange_type_names, this->initiating.type);
1149                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1150                 return DESTROY_ME;
1151         }
1152
1153         enumerator = this->active_tasks->create_enumerator(this->active_tasks);
1154         while (enumerator->enumerate(enumerator, (void*)&task))
1155         {
1156                 switch (task->process(task, message))
1157                 {
1158                         case SUCCESS:
1159                                 /* task completed, remove it */
1160                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
1161                                 task->destroy(task);
1162                                 continue;
1163                         case NEED_MORE:
1164                                 /* processed, but task needs another exchange */
1165                                 continue;
1166                         case ALREADY_DONE:
1167                                 break;
1168                         case FAILED:
1169                         default:
1170                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1171                                 /* FALL */
1172                         case DESTROY_ME:
1173                                 /* critical failure, destroy IKE_SA */
1174                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
1175                                 enumerator->destroy(enumerator);
1176                                 task->destroy(task);
1177                                 return DESTROY_ME;
1178                 }
1179                 break;
1180         }
1181         enumerator->destroy(enumerator);
1182
1183         this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1184         clear_packets(this->initiating.packets);
1185
1186         if (this->queued && !this->active_tasks->get_count(this->active_tasks) &&
1187                 this->queued->get_exchange_type(this->queued) == TRANSACTION)
1188         {
1189                 queued = this->queued;
1190                 this->queued = NULL;
1191                 status = this->public.task_manager.process_message(
1192                                                                                         &this->public.task_manager, queued);
1193                 queued->destroy(queued);
1194                 if (status == DESTROY_ME)
1195                 {
1196                         return status;
1197                 }
1198         }
1199
1200         return initiate(this);
1201 }
1202
1203 static status_t handle_fragment(private_task_manager_t *this, message_t *msg)
1204 {
1205         status_t status;
1206
1207         if (!this->defrag)
1208         {
1209                 this->defrag = message_create_defrag(msg);
1210                 if (!this->defrag)
1211                 {
1212                         return FAILED;
1213                 }
1214         }
1215         status = this->defrag->add_fragment(this->defrag, msg);
1216         if (status == SUCCESS)
1217         {
1218                 lib->processor->queue_job(lib->processor,
1219                                                         (job_t*)process_message_job_create(this->defrag));
1220                 this->defrag = NULL;
1221                 /* do not process the last fragment */
1222                 status = NEED_MORE;
1223         }
1224         return status;
1225 }
1226
1227 /**
1228  * Parse the given message and verify that it is valid.
1229  */
1230 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1231 {
1232         status_t status;
1233
1234         status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1235
1236         if (status != SUCCESS)
1237         {
1238                 switch (status)
1239                 {
1240                         case NOT_SUPPORTED:
1241                                 DBG1(DBG_IKE, "unsupported exchange type");
1242                                 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1243                                 break;
1244                         case PARSE_ERROR:
1245                                 DBG1(DBG_IKE, "message parsing failed");
1246                                 send_notify(this, msg, PAYLOAD_MALFORMED);
1247                                 break;
1248                         case VERIFY_ERROR:
1249                                 DBG1(DBG_IKE, "message verification failed");
1250                                 send_notify(this, msg, PAYLOAD_MALFORMED);
1251                                 break;
1252                         case FAILED:
1253                                 DBG1(DBG_IKE, "integrity check failed");
1254                                 send_notify(this, msg, INVALID_HASH_INFORMATION);
1255                                 break;
1256                         case INVALID_STATE:
1257                                 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1258                                 send_notify(this, msg, PAYLOAD_MALFORMED);
1259                         default:
1260                                 break;
1261                 }
1262                 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1263                          exchange_type_names, msg->get_exchange_type(msg),
1264                          msg->get_request(msg) ? "request" : "response",
1265                          msg->get_message_id(msg));
1266
1267                 charon->bus->alert(charon->bus, ALERT_PARSE_ERROR_BODY, msg, status);
1268
1269                 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1270                 {       /* invalid initiation attempt, close SA */
1271                         return DESTROY_ME;
1272                 }
1273         }
1274
1275         if (msg->get_first_payload_type(msg) == PLV1_FRAGMENT)
1276         {
1277                 return handle_fragment(this, msg);
1278         }
1279         return status;
1280 }
1281
1282 /**
1283  * Queue the given message if possible
1284  */
1285 static status_t queue_message(private_task_manager_t *this, message_t *msg)
1286 {
1287         if (this->queued)
1288         {
1289                 DBG1(DBG_IKE, "ignoring %N request, queue full",
1290                          exchange_type_names, msg->get_exchange_type(msg));
1291                 return FAILED;
1292         }
1293         this->queued = message_create_from_packet(msg->get_packet(msg));
1294         if (this->queued->parse_header(this->queued) != SUCCESS)
1295         {
1296                 this->queued->destroy(this->queued);
1297                 this->queued = NULL;
1298                 return FAILED;
1299         }
1300         DBG1(DBG_IKE, "queueing %N request as tasks still active",
1301                  exchange_type_names, msg->get_exchange_type(msg));
1302         return SUCCESS;
1303 }
1304
1305 METHOD(task_manager_t, process_message, status_t,
1306         private_task_manager_t *this, message_t *msg)
1307 {
1308         u_int32_t hash, mid, i;
1309         host_t *me, *other;
1310         status_t status;
1311
1312         /* TODO-IKEv1: update hosts more selectively */
1313         me = msg->get_destination(msg);
1314         other = msg->get_source(msg);
1315         mid = msg->get_message_id(msg);
1316         hash = chunk_hash(msg->get_packet_data(msg));
1317         for (i = 0; i < MAX_OLD_HASHES; i++)
1318         {
1319                 if (this->initiating.old_hashes[i] == hash)
1320                 {
1321                         if (array_count(this->initiating.packets) &&
1322                                 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1323                                 (msg->get_exchange_type(msg) == QUICK_MODE ||
1324                                  msg->get_exchange_type(msg) == AGGRESSIVE))
1325                         {
1326                                 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1327                                          "resending last request", mid);
1328                                 send_packets(this, this->initiating.packets);
1329                                 return SUCCESS;
1330                         }
1331                         DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1332                                  "but next request already sent", mid);
1333                         return SUCCESS;
1334                 }
1335         }
1336
1337         if ((mid && mid == this->initiating.mid) ||
1338                 (this->initiating.mid == 0 &&
1339                  msg->get_exchange_type(msg) == this->initiating.type &&
1340                  this->active_tasks->get_count(this->active_tasks)))
1341         {
1342                 msg->set_request(msg, FALSE);
1343                 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1344                 status = parse_message(this, msg);
1345                 if (status == NEED_MORE)
1346                 {
1347                         return SUCCESS;
1348                 }
1349                 if (status != SUCCESS)
1350                 {
1351                         return status;
1352                 }
1353                 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1354                                                                         time_monotonic(NULL));
1355                 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1356                 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1357                 if (process_response(this, msg) != SUCCESS)
1358                 {
1359                         flush(this);
1360                         return DESTROY_ME;
1361                 }
1362                 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1363                                                                         MAX_OLD_HASHES] = hash;
1364         }
1365         else
1366         {
1367                 if (hash == this->responding.hash)
1368                 {
1369                         if (array_count(this->responding.packets))
1370                         {
1371                                 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1372                                          "retransmitting response", mid);
1373                                 send_packets(this, this->responding.packets);
1374                         }
1375                         else if (array_count(this->initiating.packets) &&
1376                                          this->initiating.type == INFORMATIONAL_V1)
1377                         {
1378                                 DBG1(DBG_IKE, "received retransmit of DPD request, "
1379                                          "retransmitting response");
1380                                 send_packets(this, this->initiating.packets);
1381                         }
1382                         else
1383                         {
1384                                 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1385                                          "but no response to retransmit", mid);
1386                         }
1387                         charon->bus->alert(charon->bus, ALERT_RETRANSMIT_RECEIVE, msg);
1388                         return SUCCESS;
1389                 }
1390
1391                 /* reject Main/Aggressive Modes once established */
1392                 if (msg->get_exchange_type(msg) == ID_PROT ||
1393                         msg->get_exchange_type(msg) == AGGRESSIVE)
1394                 {
1395                         if (this->ike_sa->get_state(this->ike_sa) != IKE_CREATED &&
1396                                 this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING &&
1397                                 msg->get_first_payload_type(msg) != PLV1_FRAGMENT)
1398                         {
1399                                 DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
1400                                          exchange_type_names, msg->get_exchange_type(msg));
1401                                 return FAILED;
1402                         }
1403                 }
1404
1405                 /* drop XAuth/Mode Config/Quick Mode messages until we received the last
1406                  * Aggressive Mode message.  since Informational messages are not
1407                  * retransmitted we queue them. */
1408                 if (have_aggressive_mode_task(this))
1409                 {
1410                         if (msg->get_exchange_type(msg) == INFORMATIONAL_V1)
1411                         {
1412                                 return queue_message(this, msg);
1413                         }
1414                         else if (msg->get_exchange_type(msg) != AGGRESSIVE)
1415                         {
1416                                 DBG1(DBG_IKE, "ignoring %N request while phase 1 is incomplete",
1417                                          exchange_type_names, msg->get_exchange_type(msg));
1418                                 return FAILED;
1419                         }
1420                 }
1421
1422                 /* queue XAuth/Mode Config messages unless the Main Mode exchange we
1423                  * initiated is complete */
1424                 if (msg->get_exchange_type(msg) == TRANSACTION &&
1425                         this->active_tasks->get_count(this->active_tasks))
1426                 {
1427                         return queue_message(this, msg);
1428                 }
1429
1430                 msg->set_request(msg, TRUE);
1431                 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1432                 status = parse_message(this, msg);
1433                 if (status == NEED_MORE)
1434                 {
1435                         return SUCCESS;
1436                 }
1437                 if (status != SUCCESS)
1438                 {
1439                         return status;
1440                 }
1441                 /* if this IKE_SA is virgin, we check for a config */
1442                 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1443                 {
1444                         ike_sa_id_t *ike_sa_id;
1445                         ike_cfg_t *ike_cfg;
1446                         job_t *job;
1447
1448                         ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1449                                                                                                         me, other, IKEV1);
1450                         if (ike_cfg == NULL)
1451                         {
1452                                 /* no config found for these hosts, destroy */
1453                                 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1454                                          me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1455                                 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1456                                 return DESTROY_ME;
1457                         }
1458                         this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1459                         ike_cfg->destroy(ike_cfg);
1460                         /* add a timeout if peer does not establish it completely */
1461                         ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1462                         job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1463                         lib->scheduler->schedule_job(lib->scheduler, job,
1464                                         lib->settings->get_int(lib->settings,
1465                                                         "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1466                                                         lib->ns));
1467                 }
1468                 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1469                 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1470                 if (process_request(this, msg) != SUCCESS)
1471                 {
1472                         flush(this);
1473                         return DESTROY_ME;
1474                 }
1475                 this->responding.hash = hash;
1476         }
1477         return SUCCESS;
1478 }
1479
1480 /**
1481  * Check if a given task has been queued already
1482  */
1483 static bool has_queued(private_task_manager_t *this, task_type_t type)
1484 {
1485         enumerator_t *enumerator;
1486         bool found = FALSE;
1487         task_t *task;
1488
1489         enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1490         while (enumerator->enumerate(enumerator, &task))
1491         {
1492                 if (task->get_type(task) == type)
1493                 {
1494                         found = TRUE;
1495                         break;
1496                 }
1497         }
1498         enumerator->destroy(enumerator);
1499         return found;
1500 }
1501
1502 METHOD(task_manager_t, queue_task, void,
1503         private_task_manager_t *this, task_t *task)
1504 {
1505         task_type_t type = task->get_type(task);
1506
1507         switch (type)
1508         {
1509                 case TASK_MODE_CONFIG:
1510                 case TASK_XAUTH:
1511                         if (has_queued(this, type))
1512                         {
1513                                 task->destroy(task);
1514                                 return;
1515                         }
1516                         break;
1517                 default:
1518                         break;
1519         }
1520         DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1521         this->queued_tasks->insert_last(this->queued_tasks, task);
1522 }
1523
1524 METHOD(task_manager_t, queue_ike, void,
1525         private_task_manager_t *this)
1526 {
1527         peer_cfg_t *peer_cfg;
1528
1529         if (!has_queued(this, TASK_ISAKMP_VENDOR))
1530         {
1531                 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1532         }
1533         if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1534         {
1535                 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1536         }
1537         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1538         if (peer_cfg->use_aggressive(peer_cfg))
1539         {
1540                 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1541                 {
1542                         queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1543                 }
1544         }
1545         else
1546         {
1547                 if (!has_queued(this, TASK_MAIN_MODE))
1548                 {
1549                         queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1550                 }
1551         }
1552         if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1553         {
1554                 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1555         }
1556         if (!has_queued(this, TASK_ISAKMP_NATD))
1557         {
1558                 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1559         }
1560 }
1561
1562 METHOD(task_manager_t, queue_ike_reauth, void,
1563         private_task_manager_t *this)
1564 {
1565         enumerator_t *enumerator;
1566         child_sa_t *child_sa;
1567         ike_sa_t *new;
1568         host_t *host;
1569
1570         new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1571                                                                 this->ike_sa->get_version(this->ike_sa), TRUE);
1572         if (!new)
1573         {       /* shouldn't happen */
1574                 return;
1575         }
1576
1577         new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1578         host = this->ike_sa->get_other_host(this->ike_sa);
1579         new->set_other_host(new, host->clone(host));
1580         host = this->ike_sa->get_my_host(this->ike_sa);
1581         new->set_my_host(new, host->clone(host));
1582         enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1583         while (enumerator->enumerate(enumerator, &host))
1584         {
1585                 new->add_virtual_ip(new, TRUE, host);
1586         }
1587         enumerator->destroy(enumerator);
1588
1589         charon->bus->children_migrate(charon->bus, new->get_id(new),
1590                                                                   new->get_unique_id(new));
1591         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1592         while (enumerator->enumerate(enumerator, &child_sa))
1593         {
1594                 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1595                 new->add_child_sa(new, child_sa);
1596         }
1597         enumerator->destroy(enumerator);
1598         charon->bus->set_sa(charon->bus, new);
1599         charon->bus->children_migrate(charon->bus, NULL, 0);
1600         charon->bus->set_sa(charon->bus, this->ike_sa);
1601
1602         if (!new->get_child_count(new))
1603         {       /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1604                 task_t *task;
1605
1606                 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1607                 while (enumerator->enumerate(enumerator, &task))
1608                 {
1609                         if (task->get_type(task) == TASK_QUICK_MODE)
1610                         {
1611                                 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1612                                 task->migrate(task, new);
1613                                 new->queue_task(new, task);
1614                         }
1615                 }
1616                 enumerator->destroy(enumerator);
1617         }
1618
1619         if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1620         {
1621                 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1622                 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1623         }
1624         else
1625         {
1626                 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1627                 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1628         }
1629         charon->bus->set_sa(charon->bus, this->ike_sa);
1630 }
1631
1632 METHOD(task_manager_t, queue_ike_rekey, void,
1633         private_task_manager_t *this)
1634 {
1635         queue_ike_reauth(this);
1636 }
1637
1638 METHOD(task_manager_t, queue_ike_delete, void,
1639         private_task_manager_t *this)
1640 {
1641         enumerator_t *enumerator;
1642         child_sa_t *child_sa;
1643
1644         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1645         while (enumerator->enumerate(enumerator, &child_sa))
1646         {
1647                 queue_task(this, (task_t*)
1648                         quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1649                                                                 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1650         }
1651         enumerator->destroy(enumerator);
1652
1653         queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1654 }
1655
1656 METHOD(task_manager_t, queue_mobike, void,
1657         private_task_manager_t *this, bool roam, bool address)
1658 {
1659         /* Not supported in IKEv1 */
1660 }
1661
1662 METHOD(task_manager_t, queue_child, void,
1663         private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1664         traffic_selector_t *tsi, traffic_selector_t *tsr)
1665 {
1666         quick_mode_t *task;
1667
1668         task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1669         task->use_reqid(task, reqid);
1670
1671         queue_task(this, &task->task);
1672 }
1673
1674 /**
1675  * Check if two CHILD_SAs have the same traffic selector
1676  */
1677 static bool have_equal_ts(child_sa_t *child1, child_sa_t *child2, bool local)
1678 {
1679         enumerator_t *e1, *e2;
1680         traffic_selector_t *ts1, *ts2;
1681         bool equal = FALSE;
1682
1683         e1 = child1->create_ts_enumerator(child1, local);
1684         e2 = child2->create_ts_enumerator(child2, local);
1685         if (e1->enumerate(e1, &ts1) && e2->enumerate(e2, &ts2))
1686         {
1687                 equal = ts1->equals(ts1, ts2);
1688         }
1689         e2->destroy(e2);
1690         e1->destroy(e1);
1691
1692         return equal;
1693 }
1694
1695 /**
1696  * Check if a CHILD_SA is redundant and we should delete instead of rekey
1697  */
1698 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1699 {
1700         enumerator_t *enumerator;
1701         child_sa_t *current;
1702         bool redundant = FALSE;
1703
1704         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1705         while (enumerator->enumerate(enumerator, &current))
1706         {
1707                 if (current->get_state(current) == CHILD_INSTALLED &&
1708                         streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1709                         have_equal_ts(current, child_sa, TRUE) &&
1710                         have_equal_ts(current, child_sa, FALSE) &&
1711                         current->get_lifetime(current, FALSE) >
1712                                 child_sa->get_lifetime(child_sa, FALSE))
1713                 {
1714                         DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1715                                  child_sa->get_name(child_sa),
1716                                  child_sa->get_unique_id(child_sa));
1717                         redundant = TRUE;
1718                         break;
1719                 }
1720         }
1721         enumerator->destroy(enumerator);
1722
1723         return redundant;
1724 }
1725
1726 /**
1727  * Get the first traffic selector of a CHILD_SA, local or remote
1728  */
1729 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1730 {
1731         traffic_selector_t *ts = NULL;
1732         enumerator_t *enumerator;
1733
1734         enumerator = child_sa->create_ts_enumerator(child_sa, local);
1735         enumerator->enumerate(enumerator, &ts);
1736         enumerator->destroy(enumerator);
1737
1738         return ts;
1739 }
1740
1741 METHOD(task_manager_t, queue_child_rekey, void,
1742         private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1743 {
1744         child_sa_t *child_sa;
1745         child_cfg_t *cfg;
1746         quick_mode_t *task;
1747
1748         child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1749         if (!child_sa)
1750         {
1751                 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1752         }
1753         if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1754         {
1755                 if (is_redundant(this, child_sa))
1756                 {
1757                         queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1758                                                                                                 protocol, spi, FALSE, FALSE));
1759                 }
1760                 else
1761                 {
1762                         child_sa->set_state(child_sa, CHILD_REKEYING);
1763                         cfg = child_sa->get_config(child_sa);
1764                         task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1765                                 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1766                         task->use_reqid(task, child_sa->get_reqid(child_sa));
1767                         task->use_marks(task, child_sa->get_mark(child_sa, TRUE).value,
1768                                                         child_sa->get_mark(child_sa, FALSE).value);
1769                         task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1770
1771                         queue_task(this, &task->task);
1772                 }
1773         }
1774 }
1775
1776 METHOD(task_manager_t, queue_child_delete, void,
1777         private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1778         bool expired)
1779 {
1780         queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1781                                                                                                   spi, FALSE, expired));
1782 }
1783
1784 METHOD(task_manager_t, queue_dpd, void,
1785         private_task_manager_t *this)
1786 {
1787         peer_cfg_t *peer_cfg;
1788         u_int32_t t, retransmit;
1789
1790         queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1791                                                                                                 this->dpd_send++));
1792         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1793
1794         /* compute timeout in milliseconds */
1795         t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1796         if (t == 0)
1797         {
1798                 /* use the same timeout as a retransmitting IKE message would have */
1799                 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1800                 {
1801                         t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1802                                                         pow(this->retransmit_base, retransmit));
1803                 }
1804         }
1805
1806         /* schedule DPD timeout job */
1807         lib->scheduler->schedule_job_ms(lib->scheduler,
1808                 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1809 }
1810
1811 METHOD(task_manager_t, adopt_tasks, void,
1812         private_task_manager_t *this, task_manager_t *other_public)
1813 {
1814         private_task_manager_t *other = (private_task_manager_t*)other_public;
1815         task_t *task;
1816
1817         /* move queued tasks from other to this */
1818         while (other->queued_tasks->remove_last(other->queued_tasks,
1819                                                                                                 (void**)&task) == SUCCESS)
1820         {
1821                 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1822                 task->migrate(task, this->ike_sa);
1823                 this->queued_tasks->insert_first(this->queued_tasks, task);
1824         }
1825 }
1826
1827 /**
1828  * Migrates child-creating tasks from src to dst
1829  */
1830 static void migrate_child_tasks(private_task_manager_t *this,
1831                                                                 linked_list_t *src, linked_list_t *dst)
1832 {
1833         enumerator_t *enumerator;
1834         task_t *task;
1835
1836         enumerator = src->create_enumerator(src);
1837         while (enumerator->enumerate(enumerator, &task))
1838         {
1839                 if (task->get_type(task) == TASK_QUICK_MODE)
1840                 {
1841                         src->remove_at(src, enumerator);
1842                         task->migrate(task, this->ike_sa);
1843                         dst->insert_last(dst, task);
1844                 }
1845         }
1846         enumerator->destroy(enumerator);
1847 }
1848
1849 METHOD(task_manager_t, adopt_child_tasks, void,
1850         private_task_manager_t *this, task_manager_t *other_public)
1851 {
1852         private_task_manager_t *other = (private_task_manager_t*)other_public;
1853
1854         /* move active child tasks from other to this */
1855         migrate_child_tasks(this, other->active_tasks, this->queued_tasks);
1856         /* do the same for queued tasks */
1857         migrate_child_tasks(this, other->queued_tasks, this->queued_tasks);
1858 }
1859
1860 METHOD(task_manager_t, busy, bool,
1861         private_task_manager_t *this)
1862 {
1863         return (this->active_tasks->get_count(this->active_tasks) > 0);
1864 }
1865
1866 METHOD(task_manager_t, incr_mid, void,
1867         private_task_manager_t *this, bool initiate)
1868 {
1869 }
1870
1871 METHOD(task_manager_t, reset, void,
1872         private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1873 {
1874         enumerator_t *enumerator;
1875         task_t *task;
1876
1877         /* reset message counters and retransmit packets */
1878         clear_packets(this->responding.packets);
1879         clear_packets(this->initiating.packets);
1880         this->responding.seqnr = RESPONDING_SEQ;
1881         this->responding.retransmitted = 0;
1882         this->initiating.mid = 0;
1883         this->initiating.seqnr = 0;
1884         this->initiating.retransmitted = 0;
1885         this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1886         DESTROY_IF(this->defrag);
1887         this->defrag = NULL;
1888         if (initiate != UINT_MAX)
1889         {
1890                 this->dpd_send = initiate;
1891         }
1892         if (respond != UINT_MAX)
1893         {
1894                 this->dpd_recv = respond;
1895         }
1896
1897         /* reset queued tasks */
1898         enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1899         while (enumerator->enumerate(enumerator, &task))
1900         {
1901                 task->migrate(task, this->ike_sa);
1902         }
1903         enumerator->destroy(enumerator);
1904
1905         /* reset active tasks */
1906         while (this->active_tasks->remove_last(this->active_tasks,
1907                                                                                    (void**)&task) == SUCCESS)
1908         {
1909                 task->migrate(task, this->ike_sa);
1910                 this->queued_tasks->insert_first(this->queued_tasks, task);
1911         }
1912 }
1913
1914 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1915         private_task_manager_t *this, task_queue_t queue)
1916 {
1917         switch (queue)
1918         {
1919                 case TASK_QUEUE_ACTIVE:
1920                         return this->active_tasks->create_enumerator(this->active_tasks);
1921                 case TASK_QUEUE_PASSIVE:
1922                         return this->passive_tasks->create_enumerator(this->passive_tasks);
1923                 case TASK_QUEUE_QUEUED:
1924                         return this->queued_tasks->create_enumerator(this->queued_tasks);
1925                 default:
1926                         return enumerator_create_empty();
1927         }
1928 }
1929
1930 METHOD(task_manager_t, destroy, void,
1931         private_task_manager_t *this)
1932 {
1933         flush(this);
1934
1935         this->active_tasks->destroy(this->active_tasks);
1936         this->queued_tasks->destroy(this->queued_tasks);
1937         this->passive_tasks->destroy(this->passive_tasks);
1938         DESTROY_IF(this->defrag);
1939
1940         DESTROY_IF(this->queued);
1941         clear_packets(this->responding.packets);
1942         array_destroy(this->responding.packets);
1943         clear_packets(this->initiating.packets);
1944         array_destroy(this->initiating.packets);
1945         DESTROY_IF(this->rng);
1946         free(this);
1947 }
1948
1949 /*
1950  * see header file
1951  */
1952 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1953 {
1954         private_task_manager_t *this;
1955
1956         INIT(this,
1957                 .public = {
1958                         .task_manager = {
1959                                 .process_message = _process_message,
1960                                 .queue_task = _queue_task,
1961                                 .queue_ike = _queue_ike,
1962                                 .queue_ike_rekey = _queue_ike_rekey,
1963                                 .queue_ike_reauth = _queue_ike_reauth,
1964                                 .queue_ike_delete = _queue_ike_delete,
1965                                 .queue_mobike = _queue_mobike,
1966                                 .queue_child = _queue_child,
1967                                 .queue_child_rekey = _queue_child_rekey,
1968                                 .queue_child_delete = _queue_child_delete,
1969                                 .queue_dpd = _queue_dpd,
1970                                 .initiate = _initiate,
1971                                 .retransmit = _retransmit,
1972                                 .incr_mid = _incr_mid,
1973                                 .reset = _reset,
1974                                 .adopt_tasks = _adopt_tasks,
1975                                 .adopt_child_tasks = _adopt_child_tasks,
1976                                 .busy = _busy,
1977                                 .create_task_enumerator = _create_task_enumerator,
1978                                 .flush = _flush,
1979                                 .flush_queue = _flush_queue,
1980                                 .destroy = _destroy,
1981                         },
1982                 },
1983                 .initiating = {
1984                         .type = EXCHANGE_TYPE_UNDEFINED,
1985                 },
1986                 .responding = {
1987                         .seqnr = RESPONDING_SEQ,
1988                 },
1989                 .ike_sa = ike_sa,
1990                 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1991                 .queued_tasks = linked_list_create(),
1992                 .active_tasks = linked_list_create(),
1993                 .passive_tasks = linked_list_create(),
1994                 .retransmit_tries = lib->settings->get_int(lib->settings,
1995                                                 "%s.retransmit_tries", RETRANSMIT_TRIES, lib->ns),
1996                 .retransmit_timeout = lib->settings->get_double(lib->settings,
1997                                                 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, lib->ns),
1998                 .retransmit_base = lib->settings->get_double(lib->settings,
1999                                                 "%s.retransmit_base", RETRANSMIT_BASE, lib->ns),
2000         );
2001
2002         if (!this->rng)
2003         {
2004                 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
2005                 destroy(this);
2006                 return NULL;
2007         }
2008         if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
2009                                                           (void*)&this->dpd_send))
2010         {
2011                 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
2012                 destroy(this);
2013                 return NULL;
2014         }
2015         this->dpd_send &= 0x7FFFFFFF;
2016
2017         return &this->public;
2018 }