ikev1: Handle queued INFORMATIONAL message after receiving the last AM request
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2015 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/aggressive_mode.h>
24 #include <sa/ikev1/tasks/quick_mode.h>
25 #include <sa/ikev1/tasks/quick_delete.h>
26 #include <sa/ikev1/tasks/xauth.h>
27 #include <sa/ikev1/tasks/mode_config.h>
28 #include <sa/ikev1/tasks/informational.h>
29 #include <sa/ikev1/tasks/isakmp_natd.h>
30 #include <sa/ikev1/tasks/isakmp_vendor.h>
31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
33 #include <sa/ikev1/tasks/isakmp_delete.h>
34 #include <sa/ikev1/tasks/isakmp_dpd.h>
35
36 #include <processing/jobs/retransmit_job.h>
37 #include <processing/jobs/delete_ike_sa_job.h>
38 #include <processing/jobs/dpd_timeout_job.h>
39 #include <processing/jobs/process_message_job.h>
40
41 #include <collections/array.h>
42
43 /**
44 * Number of old messages hashes we keep for retransmission.
45 *
46 * In Main Mode, we must ignore messages from a previous message pair if
47 * we already continued to the next. Otherwise a late retransmission
48 * could be considered as a reply to the newer request.
49 */
50 #define MAX_OLD_HASHES 2
51
52 /**
53 * First sequence number of responding packets.
54 *
55 * To distinguish retransmission jobs for initiating and responding packets,
56 * we split up the sequence counter and use the upper half for responding.
57 */
58 #define RESPONDING_SEQ INT_MAX
59
60 typedef struct exchange_t exchange_t;
61
62 /**
63 * An exchange in the air, used do detect and handle retransmission
64 */
65 struct exchange_t {
66
67 /**
68 * Message ID used for this transaction
69 */
70 u_int32_t mid;
71
72 /**
73 * generated packet for retransmission
74 */
75 packet_t *packet;
76 };
77
78 typedef struct private_task_manager_t private_task_manager_t;
79
80 /**
81 * private data of the task manager
82 */
83 struct private_task_manager_t {
84
85 /**
86 * public functions
87 */
88 task_manager_v1_t public;
89
90 /**
91 * associated IKE_SA we are serving
92 */
93 ike_sa_t *ike_sa;
94
95 /**
96 * RNG to create message IDs
97 */
98 rng_t *rng;
99
100 /**
101 * Exchange we are currently handling as responder
102 */
103 struct {
104 /**
105 * Message ID of the last response
106 */
107 u_int32_t mid;
108
109 /**
110 * Hash of a previously received message
111 */
112 u_int32_t hash;
113
114 /**
115 * packet(s) for retransmission
116 */
117 array_t *packets;
118
119 /**
120 * Sequence number of the last sent message
121 */
122 u_int32_t seqnr;
123
124 /**
125 * how many times we have retransmitted so far
126 */
127 u_int retransmitted;
128
129 } responding;
130
131 /**
132 * Exchange we are currently handling as initiator
133 */
134 struct {
135 /**
136 * Message ID of the exchange
137 */
138 u_int32_t mid;
139
140 /**
141 * Hashes of old responses we can ignore
142 */
143 u_int32_t old_hashes[MAX_OLD_HASHES];
144
145 /**
146 * Position in old hash array
147 */
148 int old_hash_pos;
149
150 /**
151 * Sequence number of the last sent message
152 */
153 u_int32_t seqnr;
154
155 /**
156 * how many times we have retransmitted so far
157 */
158 u_int retransmitted;
159
160 /**
161 * packet(s) for retransmission
162 */
163 array_t *packets;
164
165 /**
166 * type of the initiated exchange
167 */
168 exchange_type_t type;
169
170 } initiating;
171
172 /**
173 * Message we are currently defragmenting, if any (only one at a time)
174 */
175 message_t *defrag;
176
177 /**
178 * List of queued tasks not yet in action
179 */
180 linked_list_t *queued_tasks;
181
182 /**
183 * List of active tasks, initiated by ourselves
184 */
185 linked_list_t *active_tasks;
186
187 /**
188 * List of tasks initiated by peer
189 */
190 linked_list_t *passive_tasks;
191
192 /**
193 * Queued messages not yet ready to process
194 */
195 message_t *queued;
196
197 /**
198 * Number of times we retransmit messages before giving up
199 */
200 u_int retransmit_tries;
201
202 /**
203 * Retransmission timeout
204 */
205 double retransmit_timeout;
206
207 /**
208 * Base to calculate retransmission timeout
209 */
210 double retransmit_base;
211
212 /**
213 * Sequence number for sending DPD requests
214 */
215 u_int32_t dpd_send;
216
217 /**
218 * Sequence number for received DPD requests
219 */
220 u_int32_t dpd_recv;
221 };
222
223 /**
224 * Reset retransmission packet list
225 */
226 static void clear_packets(array_t *array)
227 {
228 packet_t *packet;
229
230 while (array_remove(array, ARRAY_TAIL, &packet))
231 {
232 packet->destroy(packet);
233 }
234 }
235
236 METHOD(task_manager_t, flush_queue, void,
237 private_task_manager_t *this, task_queue_t queue)
238 {
239 linked_list_t *list;
240 task_t *task;
241
242 if (this->queued)
243 {
244 this->queued->destroy(this->queued);
245 this->queued = NULL;
246 }
247 switch (queue)
248 {
249 case TASK_QUEUE_ACTIVE:
250 list = this->active_tasks;
251 /* cancel pending retransmits */
252 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
253 clear_packets(this->initiating.packets);
254 break;
255 case TASK_QUEUE_PASSIVE:
256 list = this->passive_tasks;
257 break;
258 case TASK_QUEUE_QUEUED:
259 list = this->queued_tasks;
260 break;
261 default:
262 return;
263 }
264 while (list->remove_last(list, (void**)&task) == SUCCESS)
265 {
266 task->destroy(task);
267 }
268 }
269
270 METHOD(task_manager_t, flush, void,
271 private_task_manager_t *this)
272 {
273 flush_queue(this, TASK_QUEUE_QUEUED);
274 flush_queue(this, TASK_QUEUE_PASSIVE);
275 flush_queue(this, TASK_QUEUE_ACTIVE);
276 }
277
278 /**
279 * move a task of a specific type from the queue to the active list
280 */
281 static bool activate_task(private_task_manager_t *this, task_type_t type)
282 {
283 enumerator_t *enumerator;
284 task_t *task;
285 bool found = FALSE;
286
287 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
288 while (enumerator->enumerate(enumerator, (void**)&task))
289 {
290 if (task->get_type(task) == type)
291 {
292 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
293 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
294 this->active_tasks->insert_last(this->active_tasks, task);
295 found = TRUE;
296 break;
297 }
298 }
299 enumerator->destroy(enumerator);
300 return found;
301 }
302
303 /**
304 * Send packets in the given array (they get cloned)
305 */
306 static void send_packets(private_task_manager_t *this, array_t *packets)
307 {
308 enumerator_t *enumerator;
309 packet_t *packet;
310
311 enumerator = array_create_enumerator(packets);
312 while (enumerator->enumerate(enumerator, &packet))
313 {
314 charon->sender->send(charon->sender, packet->clone(packet));
315 }
316 enumerator->destroy(enumerator);
317 }
318
319 /**
320 * Generates the given message and stores packet(s) in the given array
321 */
322 static bool generate_message(private_task_manager_t *this, message_t *message,
323 array_t **packets)
324 {
325 enumerator_t *fragments;
326 packet_t *fragment;
327
328 if (this->ike_sa->generate_message_fragmented(this->ike_sa, message,
329 &fragments) != SUCCESS)
330 {
331 return FALSE;
332 }
333 while (fragments->enumerate(fragments, &fragment))
334 {
335 array_insert_create(packets, ARRAY_TAIL, fragment);
336 }
337 fragments->destroy(fragments);
338 return TRUE;
339 }
340
341 /**
342 * Retransmit a packet (or its fragments)
343 */
344 static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
345 u_int mid, u_int retransmitted, array_t *packets)
346 {
347 packet_t *packet;
348 u_int32_t t;
349
350 array_get(packets, 0, &packet);
351 if (retransmitted > this->retransmit_tries)
352 {
353 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
354 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_TIMEOUT, packet);
355 return DESTROY_ME;
356 }
357 t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
358 pow(this->retransmit_base, retransmitted));
359 if (retransmitted)
360 {
361 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
362 retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
363 mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
364 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND, packet);
365 }
366 send_packets(this, packets);
367 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
368 retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
369 return NEED_MORE;
370 }
371
372 METHOD(task_manager_t, retransmit, status_t,
373 private_task_manager_t *this, u_int32_t seqnr)
374 {
375 status_t status = SUCCESS;
376
377 if (seqnr == this->initiating.seqnr &&
378 array_count(this->initiating.packets))
379 {
380 status = retransmit_packet(this, seqnr, this->initiating.mid,
381 this->initiating.retransmitted, this->initiating.packets);
382 if (status == NEED_MORE)
383 {
384 this->initiating.retransmitted++;
385 status = SUCCESS;
386 }
387 }
388 if (seqnr == this->responding.seqnr &&
389 array_count(this->responding.packets))
390 {
391 status = retransmit_packet(this, seqnr, this->responding.mid,
392 this->responding.retransmitted, this->responding.packets);
393 if (status == NEED_MORE)
394 {
395 this->responding.retransmitted++;
396 status = SUCCESS;
397 }
398 }
399 return status;
400 }
401
402 /**
403 * Check if we have to wait for a mode config before starting a quick mode
404 */
405 static bool mode_config_expected(private_task_manager_t *this)
406 {
407 enumerator_t *enumerator;
408 peer_cfg_t *peer_cfg;
409 char *pool;
410 bool local;
411 host_t *host;
412
413 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
414 if (peer_cfg)
415 {
416 if (peer_cfg->use_pull_mode(peer_cfg))
417 {
418 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
419 if (!enumerator->enumerate(enumerator, &pool))
420 { /* no pool configured */
421 enumerator->destroy(enumerator);
422 return FALSE;
423 }
424 enumerator->destroy(enumerator);
425
426 local = FALSE;
427 }
428 else
429 {
430 enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
431 if (!enumerator->enumerate(enumerator, &host))
432 { /* not requesting a vip */
433 enumerator->destroy(enumerator);
434 return FALSE;
435 }
436 enumerator->destroy(enumerator);
437
438 local = TRUE;
439 }
440 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
441 local);
442 if (!enumerator->enumerate(enumerator, &host))
443 { /* expecting a VIP exchange, but no VIP assigned yet */
444 enumerator->destroy(enumerator);
445 return TRUE;
446 }
447 enumerator->destroy(enumerator);
448 }
449 return FALSE;
450 }
451
452 METHOD(task_manager_t, initiate, status_t,
453 private_task_manager_t *this)
454 {
455 enumerator_t *enumerator;
456 task_t *task;
457 message_t *message;
458 host_t *me, *other;
459 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
460 bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
461
462 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
463 this->initiating.type != INFORMATIONAL_V1)
464 {
465 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
466 exchange_type_names, this->initiating.type);
467 /* do not initiate if we already have a message in the air */
468 return SUCCESS;
469 }
470
471 if (this->active_tasks->get_count(this->active_tasks) == 0)
472 {
473 DBG2(DBG_IKE, "activating new tasks");
474 switch (this->ike_sa->get_state(this->ike_sa))
475 {
476 case IKE_CREATED:
477 activate_task(this, TASK_ISAKMP_VENDOR);
478 activate_task(this, TASK_ISAKMP_CERT_PRE);
479 if (activate_task(this, TASK_MAIN_MODE))
480 {
481 exchange = ID_PROT;
482 }
483 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
484 {
485 exchange = AGGRESSIVE;
486 }
487 activate_task(this, TASK_ISAKMP_CERT_POST);
488 activate_task(this, TASK_ISAKMP_NATD);
489 break;
490 case IKE_CONNECTING:
491 if (activate_task(this, TASK_ISAKMP_DELETE))
492 {
493 exchange = INFORMATIONAL_V1;
494 new_mid = TRUE;
495 break;
496 }
497 if (activate_task(this, TASK_XAUTH))
498 {
499 exchange = TRANSACTION;
500 new_mid = TRUE;
501 break;
502 }
503 if (activate_task(this, TASK_INFORMATIONAL))
504 {
505 exchange = INFORMATIONAL_V1;
506 new_mid = TRUE;
507 break;
508 }
509 break;
510 case IKE_ESTABLISHED:
511 if (activate_task(this, TASK_MODE_CONFIG))
512 {
513 exchange = TRANSACTION;
514 new_mid = TRUE;
515 break;
516 }
517 if (!mode_config_expected(this) &&
518 activate_task(this, TASK_QUICK_MODE))
519 {
520 exchange = QUICK_MODE;
521 new_mid = TRUE;
522 break;
523 }
524 if (activate_task(this, TASK_INFORMATIONAL))
525 {
526 exchange = INFORMATIONAL_V1;
527 new_mid = TRUE;
528 break;
529 }
530 if (activate_task(this, TASK_QUICK_DELETE))
531 {
532 exchange = INFORMATIONAL_V1;
533 new_mid = TRUE;
534 break;
535 }
536 if (activate_task(this, TASK_ISAKMP_DELETE))
537 {
538 exchange = INFORMATIONAL_V1;
539 new_mid = TRUE;
540 break;
541 }
542 if (activate_task(this, TASK_ISAKMP_DPD))
543 {
544 exchange = INFORMATIONAL_V1;
545 new_mid = TRUE;
546 break;
547 }
548 break;
549 default:
550 break;
551 }
552 }
553 else
554 {
555 DBG2(DBG_IKE, "reinitiating already active tasks");
556 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
557 while (enumerator->enumerate(enumerator, (void**)&task))
558 {
559 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
560 switch (task->get_type(task))
561 {
562 case TASK_MAIN_MODE:
563 exchange = ID_PROT;
564 break;
565 case TASK_AGGRESSIVE_MODE:
566 exchange = AGGRESSIVE;
567 break;
568 case TASK_QUICK_MODE:
569 exchange = QUICK_MODE;
570 break;
571 case TASK_XAUTH:
572 exchange = TRANSACTION;
573 new_mid = TRUE;
574 break;
575 default:
576 continue;
577 }
578 break;
579 }
580 enumerator->destroy(enumerator);
581 }
582
583 if (exchange == EXCHANGE_TYPE_UNDEFINED)
584 {
585 DBG2(DBG_IKE, "nothing to initiate");
586 /* nothing to do yet... */
587 return SUCCESS;
588 }
589
590 me = this->ike_sa->get_my_host(this->ike_sa);
591 other = this->ike_sa->get_other_host(this->ike_sa);
592
593 if (new_mid)
594 {
595 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
596 (void*)&this->initiating.mid))
597 {
598 DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
599 flush(this);
600 return DESTROY_ME;
601 }
602 }
603 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
604 message->set_message_id(message, this->initiating.mid);
605 message->set_source(message, me->clone(me));
606 message->set_destination(message, other->clone(other));
607 message->set_exchange_type(message, exchange);
608 this->initiating.type = exchange;
609 this->initiating.retransmitted = 0;
610
611 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
612 while (enumerator->enumerate(enumerator, (void*)&task))
613 {
614 switch (task->build(task, message))
615 {
616 case SUCCESS:
617 /* task completed, remove it */
618 this->active_tasks->remove_at(this->active_tasks, enumerator);
619 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
620 task->get_type(task) == TASK_QUICK_MODE)
621 { /* last message of three message exchange */
622 keep = TRUE;
623 }
624 task->destroy(task);
625 continue;
626 case NEED_MORE:
627 expect_response = TRUE;
628 /* processed, but task needs another exchange */
629 continue;
630 case ALREADY_DONE:
631 cancelled = TRUE;
632 break;
633 case FAILED:
634 default:
635 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
636 {
637 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
638 }
639 /* FALL */
640 case DESTROY_ME:
641 /* critical failure, destroy IKE_SA */
642 enumerator->destroy(enumerator);
643 message->destroy(message);
644 flush(this);
645 return DESTROY_ME;
646 }
647 break;
648 }
649 enumerator->destroy(enumerator);
650
651 if (this->active_tasks->get_count(this->active_tasks) == 0 &&
652 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
653 { /* tasks completed, no exchange active anymore */
654 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
655 }
656 if (cancelled)
657 {
658 message->destroy(message);
659 return initiate(this);
660 }
661
662 clear_packets(this->initiating.packets);
663 if (!generate_message(this, message, &this->initiating.packets))
664 {
665 /* message generation failed. There is nothing more to do than to
666 * close the SA */
667 message->destroy(message);
668 flush(this);
669 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
670 return DESTROY_ME;
671 }
672
673 this->initiating.seqnr++;
674 if (expect_response)
675 {
676 message->destroy(message);
677 return retransmit(this, this->initiating.seqnr);
678 }
679 if (keep)
680 { /* keep the packet for retransmission, the responder might request it */
681 send_packets(this, this->initiating.packets);
682 }
683 else
684 {
685 send_packets(this, this->initiating.packets);
686 clear_packets(this->initiating.packets);
687 }
688 message->destroy(message);
689
690 if (exchange == INFORMATIONAL_V1)
691 {
692 switch (this->ike_sa->get_state(this->ike_sa))
693 {
694 case IKE_CONNECTING:
695 /* close after sending an INFORMATIONAL when unestablished */
696 return FAILED;
697 case IKE_DELETING:
698 /* close after sending a DELETE */
699 return DESTROY_ME;
700 default:
701 break;
702 }
703 }
704 return initiate(this);
705 }
706
707 /**
708 * build a response depending on the "passive" task list
709 */
710 static status_t build_response(private_task_manager_t *this, message_t *request)
711 {
712 enumerator_t *enumerator;
713 task_t *task;
714 message_t *message;
715 host_t *me, *other;
716 bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
717
718 me = request->get_destination(request);
719 other = request->get_source(request);
720
721 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
722 message->set_exchange_type(message, request->get_exchange_type(request));
723 /* send response along the path the request came in */
724 message->set_source(message, me->clone(me));
725 message->set_destination(message, other->clone(other));
726 message->set_message_id(message, request->get_message_id(request));
727 message->set_request(message, FALSE);
728
729 this->responding.mid = request->get_message_id(request);
730 this->responding.retransmitted = 0;
731 this->responding.seqnr++;
732
733 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
734 while (enumerator->enumerate(enumerator, (void*)&task))
735 {
736 switch (task->build(task, message))
737 {
738 case SUCCESS:
739 /* task completed, remove it */
740 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
741 task->destroy(task);
742 continue;
743 case NEED_MORE:
744 /* processed, but task needs another exchange */
745 if (task->get_type(task) == TASK_QUICK_MODE ||
746 task->get_type(task) == TASK_AGGRESSIVE_MODE)
747 { /* we rely on initiator retransmission, except for
748 * three-message exchanges */
749 expect_request = TRUE;
750 }
751 continue;
752 case ALREADY_DONE:
753 cancelled = TRUE;
754 break;
755 case INVALID_ARG:
756 if (task->get_type(task) == TASK_QUICK_MODE)
757 { /* not responsible for this exchange */
758 continue;
759 }
760 /* FALL */
761 case FAILED:
762 default:
763 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
764 /* FALL */
765 case DESTROY_ME:
766 /* destroy IKE_SA, but SEND response first */
767 delete = TRUE;
768 break;
769 }
770 break;
771 }
772 enumerator->destroy(enumerator);
773
774 clear_packets(this->responding.packets);
775 if (cancelled)
776 {
777 message->destroy(message);
778 return initiate(this);
779 }
780 if (!generate_message(this, message, &this->responding.packets))
781 {
782 message->destroy(message);
783 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
784 return DESTROY_ME;
785 }
786 message->destroy(message);
787
788 if (expect_request && !delete)
789 {
790 return retransmit(this, this->responding.seqnr);
791 }
792 send_packets(this, this->responding.packets);
793 if (delete)
794 {
795 return DESTROY_ME;
796 }
797 return SUCCESS;
798 }
799
800 /**
801 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
802 * The notify protocol_id is set to ISAKMP
803 */
804 static void send_notify(private_task_manager_t *this, message_t *request,
805 notify_type_t type)
806 {
807 message_t *response;
808 array_t *packets = NULL;
809 host_t *me, *other;
810 u_int32_t mid;
811
812 if (request->get_exchange_type(request) == INFORMATIONAL_V1)
813 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
814 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
815 return;
816 }
817 if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
818 {
819 DBG1(DBG_IKE, "failed to allocate message ID");
820 return;
821 }
822 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
823 response->set_exchange_type(response, INFORMATIONAL_V1);
824 response->set_request(response, TRUE);
825 response->set_message_id(response, mid);
826 response->add_payload(response, (payload_t*)
827 notify_payload_create_from_protocol_and_type(PLV1_NOTIFY,
828 PROTO_IKE, type));
829
830 me = this->ike_sa->get_my_host(this->ike_sa);
831 if (me->is_anyaddr(me))
832 {
833 me = request->get_destination(request);
834 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
835 }
836 other = this->ike_sa->get_other_host(this->ike_sa);
837 if (other->is_anyaddr(other))
838 {
839 other = request->get_source(request);
840 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
841 }
842 response->set_source(response, me->clone(me));
843 response->set_destination(response, other->clone(other));
844 if (generate_message(this, response, &packets))
845 {
846 send_packets(this, packets);
847 }
848 clear_packets(packets);
849 array_destroy(packets);
850 response->destroy(response);
851 }
852
853 /**
854 * Process a DPD request/response
855 */
856 static bool process_dpd(private_task_manager_t *this, message_t *message)
857 {
858 notify_payload_t *notify;
859 notify_type_t type;
860 u_int32_t seq;
861 chunk_t data;
862
863 type = DPD_R_U_THERE;
864 notify = message->get_notify(message, type);
865 if (!notify)
866 {
867 type = DPD_R_U_THERE_ACK;
868 notify = message->get_notify(message, type);
869 }
870 if (!notify)
871 {
872 return FALSE;
873 }
874 data = notify->get_notification_data(notify);
875 if (data.len != 4)
876 {
877 return FALSE;
878 }
879 seq = untoh32(data.ptr);
880
881 if (type == DPD_R_U_THERE)
882 {
883 if (this->dpd_recv == 0 || seq == this->dpd_recv)
884 { /* check sequence validity */
885 this->dpd_recv = seq + 1;
886 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
887 time_monotonic(NULL));
888 }
889 /* but respond anyway */
890 this->ike_sa->queue_task(this->ike_sa,
891 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
892 }
893 else /* DPD_R_U_THERE_ACK */
894 {
895 if (seq == this->dpd_send - 1)
896 {
897 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
898 time_monotonic(NULL));
899 }
900 else
901 {
902 DBG1(DBG_IKE, "received invalid DPD sequence number %u "
903 "(expected %u), ignored", seq, this->dpd_send - 1);
904 }
905 }
906 return TRUE;
907 }
908
909 /**
910 * Check if we already have a quick mode task queued for the exchange with the
911 * given message ID
912 */
913 static bool have_quick_mode_task(private_task_manager_t *this, u_int32_t mid)
914 {
915 enumerator_t *enumerator;
916 quick_mode_t *qm;
917 task_t *task;
918 bool found = FALSE;
919
920 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
921 while (enumerator->enumerate(enumerator, &task))
922 {
923 if (task->get_type(task) == TASK_QUICK_MODE)
924 {
925 qm = (quick_mode_t*)task;
926 if (qm->get_mid(qm) == mid)
927 {
928 found = TRUE;
929 break;
930 }
931 }
932 }
933 enumerator->destroy(enumerator);
934 return found;
935 }
936
937 /**
938 * Check if we still have an aggressive mode task queued
939 */
940 static bool have_aggressive_mode_task(private_task_manager_t *this)
941 {
942 enumerator_t *enumerator;
943 task_t *task;
944 bool found = FALSE;
945
946 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
947 while (enumerator->enumerate(enumerator, &task))
948 {
949 if (task->get_type(task) == TASK_AGGRESSIVE_MODE)
950 {
951 found = TRUE;
952 break;
953 }
954 }
955 enumerator->destroy(enumerator);
956 return found;
957 }
958
959 /**
960 * handle an incoming request message
961 */
962 static status_t process_request(private_task_manager_t *this,
963 message_t *message)
964 {
965 enumerator_t *enumerator;
966 task_t *task = NULL;
967 bool send_response = FALSE, dpd = FALSE;
968
969 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
970 message->get_exchange_type(message) == QUICK_MODE ||
971 this->passive_tasks->get_count(this->passive_tasks) == 0)
972 { /* create tasks depending on request type, if not already some queued */
973 switch (message->get_exchange_type(message))
974 {
975 case ID_PROT:
976 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
977 this->passive_tasks->insert_last(this->passive_tasks, task);
978 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
979 this->passive_tasks->insert_last(this->passive_tasks, task);
980 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
981 this->passive_tasks->insert_last(this->passive_tasks, task);
982 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
983 this->passive_tasks->insert_last(this->passive_tasks, task);
984 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
985 this->passive_tasks->insert_last(this->passive_tasks, task);
986 break;
987 case AGGRESSIVE:
988 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
989 this->passive_tasks->insert_last(this->passive_tasks, task);
990 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
991 this->passive_tasks->insert_last(this->passive_tasks, task);
992 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
993 this->passive_tasks->insert_last(this->passive_tasks, task);
994 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
995 this->passive_tasks->insert_last(this->passive_tasks, task);
996 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
997 this->passive_tasks->insert_last(this->passive_tasks, task);
998 break;
999 case QUICK_MODE:
1000 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1001 {
1002 DBG1(DBG_IKE, "received quick mode request for "
1003 "unestablished IKE_SA, ignored");
1004 return FAILED;
1005 }
1006 if (have_quick_mode_task(this, message->get_message_id(message)))
1007 {
1008 break;
1009 }
1010 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
1011 NULL, NULL);
1012 this->passive_tasks->insert_last(this->passive_tasks, task);
1013 break;
1014 case INFORMATIONAL_V1:
1015 if (process_dpd(this, message))
1016 {
1017 dpd = TRUE;
1018 }
1019 else
1020 {
1021 task = (task_t *)informational_create(this->ike_sa, NULL);
1022 this->passive_tasks->insert_first(this->passive_tasks, task);
1023 }
1024 break;
1025 case TRANSACTION:
1026 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
1027 {
1028 task = (task_t *)mode_config_create(this->ike_sa,
1029 FALSE, TRUE);
1030 }
1031 else
1032 {
1033 task = (task_t *)xauth_create(this->ike_sa, FALSE);
1034 }
1035 this->passive_tasks->insert_last(this->passive_tasks, task);
1036 break;
1037 default:
1038 return FAILED;
1039 }
1040 }
1041 if (dpd)
1042 {
1043 return initiate(this);
1044 }
1045 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
1046
1047 /* let the tasks process the message */
1048 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
1049 while (enumerator->enumerate(enumerator, (void*)&task))
1050 {
1051 switch (task->process(task, message))
1052 {
1053 case SUCCESS:
1054 /* task completed, remove it */
1055 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1056 task->destroy(task);
1057 continue;
1058 case NEED_MORE:
1059 /* processed, but task needs at least another call to build() */
1060 send_response = TRUE;
1061 continue;
1062 case ALREADY_DONE:
1063 send_response = FALSE;
1064 break;
1065 case INVALID_ARG:
1066 if (task->get_type(task) == TASK_QUICK_MODE)
1067 { /* not responsible for this exchange */
1068 continue;
1069 }
1070 /* FALL */
1071 case FAILED:
1072 default:
1073 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1074 /* FALL */
1075 case DESTROY_ME:
1076 /* critical failure, destroy IKE_SA */
1077 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1078 enumerator->destroy(enumerator);
1079 task->destroy(task);
1080 return DESTROY_ME;
1081 }
1082 break;
1083 }
1084 enumerator->destroy(enumerator);
1085
1086 if (send_response)
1087 {
1088 if (build_response(this, message) != SUCCESS)
1089 {
1090 return DESTROY_ME;
1091 }
1092 }
1093 else
1094 { /* We don't send a response, so don't retransmit one if we get
1095 * the same message again. */
1096 clear_packets(this->responding.packets);
1097 }
1098 if (this->queued &&
1099 this->queued->get_exchange_type(this->queued) == INFORMATIONAL_V1)
1100 {
1101 message_t *queued;
1102 status_t status;
1103
1104 queued = this->queued;
1105 this->queued = NULL;
1106 status = this->public.task_manager.process_message(
1107 &this->public.task_manager, queued);
1108 queued->destroy(queued);
1109 if (status == DESTROY_ME)
1110 {
1111 return status;
1112 }
1113 }
1114 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
1115 this->queued_tasks->get_count(this->queued_tasks) > 0)
1116 {
1117 /* passive tasks completed, check if an active task has been queued,
1118 * such as XAUTH or modeconfig push */
1119 return initiate(this);
1120 }
1121 return SUCCESS;
1122 }
1123
1124 /**
1125 * handle an incoming response message
1126 */
1127 static status_t process_response(private_task_manager_t *this,
1128 message_t *message)
1129 {
1130 enumerator_t *enumerator;
1131 message_t *queued;
1132 status_t status;
1133 task_t *task;
1134
1135 if (message->get_exchange_type(message) != this->initiating.type)
1136 {
1137 /* Windows server sends a fourth quick mode message having an initial
1138 * contact notify. Ignore this message for compatibility. */
1139 if (this->initiating.type == EXCHANGE_TYPE_UNDEFINED &&
1140 message->get_exchange_type(message) == QUICK_MODE &&
1141 message->get_notify(message, INITIAL_CONTACT))
1142 {
1143 DBG1(DBG_IKE, "ignoring fourth Quick Mode message");
1144 return SUCCESS;
1145 }
1146 DBG1(DBG_IKE, "received %N response, but expected %N",
1147 exchange_type_names, message->get_exchange_type(message),
1148 exchange_type_names, this->initiating.type);
1149 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1150 return DESTROY_ME;
1151 }
1152
1153 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
1154 while (enumerator->enumerate(enumerator, (void*)&task))
1155 {
1156 switch (task->process(task, message))
1157 {
1158 case SUCCESS:
1159 /* task completed, remove it */
1160 this->active_tasks->remove_at(this->active_tasks, enumerator);
1161 task->destroy(task);
1162 continue;
1163 case NEED_MORE:
1164 /* processed, but task needs another exchange */
1165 continue;
1166 case ALREADY_DONE:
1167 break;
1168 case FAILED:
1169 default:
1170 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1171 /* FALL */
1172 case DESTROY_ME:
1173 /* critical failure, destroy IKE_SA */
1174 this->active_tasks->remove_at(this->active_tasks, enumerator);
1175 enumerator->destroy(enumerator);
1176 task->destroy(task);
1177 return DESTROY_ME;
1178 }
1179 break;
1180 }
1181 enumerator->destroy(enumerator);
1182
1183 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1184 clear_packets(this->initiating.packets);
1185
1186 if (this->queued && !this->active_tasks->get_count(this->active_tasks) &&
1187 this->queued->get_exchange_type(this->queued) == TRANSACTION)
1188 {
1189 queued = this->queued;
1190 this->queued = NULL;
1191 status = this->public.task_manager.process_message(
1192 &this->public.task_manager, queued);
1193 queued->destroy(queued);
1194 if (status == DESTROY_ME)
1195 {
1196 return status;
1197 }
1198 }
1199
1200 return initiate(this);
1201 }
1202
1203 static status_t handle_fragment(private_task_manager_t *this, message_t *msg)
1204 {
1205 status_t status;
1206
1207 if (!this->defrag)
1208 {
1209 this->defrag = message_create_defrag(msg);
1210 if (!this->defrag)
1211 {
1212 return FAILED;
1213 }
1214 }
1215 status = this->defrag->add_fragment(this->defrag, msg);
1216 if (status == SUCCESS)
1217 {
1218 lib->processor->queue_job(lib->processor,
1219 (job_t*)process_message_job_create(this->defrag));
1220 this->defrag = NULL;
1221 /* do not process the last fragment */
1222 status = NEED_MORE;
1223 }
1224 return status;
1225 }
1226
1227 /**
1228 * Parse the given message and verify that it is valid.
1229 */
1230 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1231 {
1232 status_t status;
1233
1234 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1235
1236 if (status != SUCCESS)
1237 {
1238 switch (status)
1239 {
1240 case NOT_SUPPORTED:
1241 DBG1(DBG_IKE, "unsupported exchange type");
1242 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1243 break;
1244 case PARSE_ERROR:
1245 DBG1(DBG_IKE, "message parsing failed");
1246 send_notify(this, msg, PAYLOAD_MALFORMED);
1247 break;
1248 case VERIFY_ERROR:
1249 DBG1(DBG_IKE, "message verification failed");
1250 send_notify(this, msg, PAYLOAD_MALFORMED);
1251 break;
1252 case FAILED:
1253 DBG1(DBG_IKE, "integrity check failed");
1254 send_notify(this, msg, INVALID_HASH_INFORMATION);
1255 break;
1256 case INVALID_STATE:
1257 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1258 send_notify(this, msg, PAYLOAD_MALFORMED);
1259 default:
1260 break;
1261 }
1262 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1263 exchange_type_names, msg->get_exchange_type(msg),
1264 msg->get_request(msg) ? "request" : "response",
1265 msg->get_message_id(msg));
1266
1267 charon->bus->alert(charon->bus, ALERT_PARSE_ERROR_BODY, msg, status);
1268
1269 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1270 { /* invalid initiation attempt, close SA */
1271 return DESTROY_ME;
1272 }
1273 }
1274
1275 if (msg->get_first_payload_type(msg) == PLV1_FRAGMENT)
1276 {
1277 return handle_fragment(this, msg);
1278 }
1279 return status;
1280 }
1281
1282 /**
1283 * Queue the given message if possible
1284 */
1285 static status_t queue_message(private_task_manager_t *this, message_t *msg)
1286 {
1287 if (this->queued)
1288 {
1289 DBG1(DBG_IKE, "ignoring %N request, queue full",
1290 exchange_type_names, msg->get_exchange_type(msg));
1291 return FAILED;
1292 }
1293 this->queued = message_create_from_packet(msg->get_packet(msg));
1294 if (this->queued->parse_header(this->queued) != SUCCESS)
1295 {
1296 this->queued->destroy(this->queued);
1297 this->queued = NULL;
1298 return FAILED;
1299 }
1300 DBG1(DBG_IKE, "queueing %N request as tasks still active",
1301 exchange_type_names, msg->get_exchange_type(msg));
1302 return SUCCESS;
1303 }
1304
1305 METHOD(task_manager_t, process_message, status_t,
1306 private_task_manager_t *this, message_t *msg)
1307 {
1308 u_int32_t hash, mid, i;
1309 host_t *me, *other;
1310 status_t status;
1311
1312 /* TODO-IKEv1: update hosts more selectively */
1313 me = msg->get_destination(msg);
1314 other = msg->get_source(msg);
1315 mid = msg->get_message_id(msg);
1316 hash = chunk_hash(msg->get_packet_data(msg));
1317 for (i = 0; i < MAX_OLD_HASHES; i++)
1318 {
1319 if (this->initiating.old_hashes[i] == hash)
1320 {
1321 if (array_count(this->initiating.packets) &&
1322 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1323 (msg->get_exchange_type(msg) == QUICK_MODE ||
1324 msg->get_exchange_type(msg) == AGGRESSIVE))
1325 {
1326 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1327 "resending last request", mid);
1328 send_packets(this, this->initiating.packets);
1329 return SUCCESS;
1330 }
1331 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1332 "but next request already sent", mid);
1333 return SUCCESS;
1334 }
1335 }
1336
1337 if ((mid && mid == this->initiating.mid) ||
1338 (this->initiating.mid == 0 &&
1339 msg->get_exchange_type(msg) == this->initiating.type &&
1340 this->active_tasks->get_count(this->active_tasks)))
1341 {
1342 msg->set_request(msg, FALSE);
1343 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1344 status = parse_message(this, msg);
1345 if (status == NEED_MORE)
1346 {
1347 return SUCCESS;
1348 }
1349 if (status != SUCCESS)
1350 {
1351 return status;
1352 }
1353 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1354 time_monotonic(NULL));
1355 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1356 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1357 if (process_response(this, msg) != SUCCESS)
1358 {
1359 flush(this);
1360 return DESTROY_ME;
1361 }
1362 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1363 MAX_OLD_HASHES] = hash;
1364 }
1365 else
1366 {
1367 if (hash == this->responding.hash)
1368 {
1369 if (array_count(this->responding.packets))
1370 {
1371 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1372 "retransmitting response", mid);
1373 send_packets(this, this->responding.packets);
1374 }
1375 else if (array_count(this->initiating.packets) &&
1376 this->initiating.type == INFORMATIONAL_V1)
1377 {
1378 DBG1(DBG_IKE, "received retransmit of DPD request, "
1379 "retransmitting response");
1380 send_packets(this, this->initiating.packets);
1381 }
1382 else
1383 {
1384 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1385 "but no response to retransmit", mid);
1386 }
1387 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_RECEIVE, msg);
1388 return SUCCESS;
1389 }
1390
1391 /* reject Main/Aggressive Modes once established */
1392 if (msg->get_exchange_type(msg) == ID_PROT ||
1393 msg->get_exchange_type(msg) == AGGRESSIVE)
1394 {
1395 if (this->ike_sa->get_state(this->ike_sa) != IKE_CREATED &&
1396 this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING &&
1397 msg->get_first_payload_type(msg) != PLV1_FRAGMENT)
1398 {
1399 DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
1400 exchange_type_names, msg->get_exchange_type(msg));
1401 return FAILED;
1402 }
1403 }
1404
1405 /* drop XAuth/Mode Config/Quick Mode messages until we received the last
1406 * Aggressive Mode message. since Informational messages are not
1407 * retransmitted we queue them. */
1408 if (have_aggressive_mode_task(this))
1409 {
1410 if (msg->get_exchange_type(msg) == INFORMATIONAL_V1)
1411 {
1412 return queue_message(this, msg);
1413 }
1414 else if (msg->get_exchange_type(msg) != AGGRESSIVE)
1415 {
1416 DBG1(DBG_IKE, "ignoring %N request while phase 1 is incomplete",
1417 exchange_type_names, msg->get_exchange_type(msg));
1418 return FAILED;
1419 }
1420 }
1421
1422 /* queue XAuth/Mode Config messages unless the Main Mode exchange we
1423 * initiated is complete */
1424 if (msg->get_exchange_type(msg) == TRANSACTION &&
1425 this->active_tasks->get_count(this->active_tasks))
1426 {
1427 return queue_message(this, msg);
1428 }
1429
1430 msg->set_request(msg, TRUE);
1431 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1432 status = parse_message(this, msg);
1433 if (status == NEED_MORE)
1434 {
1435 return SUCCESS;
1436 }
1437 if (status != SUCCESS)
1438 {
1439 return status;
1440 }
1441 /* if this IKE_SA is virgin, we check for a config */
1442 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1443 {
1444 ike_sa_id_t *ike_sa_id;
1445 ike_cfg_t *ike_cfg;
1446 job_t *job;
1447
1448 ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1449 me, other, IKEV1);
1450 if (ike_cfg == NULL)
1451 {
1452 /* no config found for these hosts, destroy */
1453 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1454 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1455 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1456 return DESTROY_ME;
1457 }
1458 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1459 ike_cfg->destroy(ike_cfg);
1460 /* add a timeout if peer does not establish it completely */
1461 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1462 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1463 lib->scheduler->schedule_job(lib->scheduler, job,
1464 lib->settings->get_int(lib->settings,
1465 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1466 lib->ns));
1467 }
1468 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1469 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1470 if (process_request(this, msg) != SUCCESS)
1471 {
1472 flush(this);
1473 return DESTROY_ME;
1474 }
1475 this->responding.hash = hash;
1476 }
1477 return SUCCESS;
1478 }
1479
1480 /**
1481 * Check if a given task has been queued already
1482 */
1483 static bool has_queued(private_task_manager_t *this, task_type_t type)
1484 {
1485 enumerator_t *enumerator;
1486 bool found = FALSE;
1487 task_t *task;
1488
1489 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1490 while (enumerator->enumerate(enumerator, &task))
1491 {
1492 if (task->get_type(task) == type)
1493 {
1494 found = TRUE;
1495 break;
1496 }
1497 }
1498 enumerator->destroy(enumerator);
1499 return found;
1500 }
1501
1502 METHOD(task_manager_t, queue_task, void,
1503 private_task_manager_t *this, task_t *task)
1504 {
1505 task_type_t type = task->get_type(task);
1506
1507 switch (type)
1508 {
1509 case TASK_MODE_CONFIG:
1510 case TASK_XAUTH:
1511 if (has_queued(this, type))
1512 {
1513 task->destroy(task);
1514 return;
1515 }
1516 break;
1517 default:
1518 break;
1519 }
1520 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1521 this->queued_tasks->insert_last(this->queued_tasks, task);
1522 }
1523
1524 METHOD(task_manager_t, queue_ike, void,
1525 private_task_manager_t *this)
1526 {
1527 peer_cfg_t *peer_cfg;
1528
1529 if (!has_queued(this, TASK_ISAKMP_VENDOR))
1530 {
1531 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1532 }
1533 if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1534 {
1535 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1536 }
1537 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1538 if (peer_cfg->use_aggressive(peer_cfg))
1539 {
1540 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1541 {
1542 queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1543 }
1544 }
1545 else
1546 {
1547 if (!has_queued(this, TASK_MAIN_MODE))
1548 {
1549 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1550 }
1551 }
1552 if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1553 {
1554 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1555 }
1556 if (!has_queued(this, TASK_ISAKMP_NATD))
1557 {
1558 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1559 }
1560 }
1561
1562 METHOD(task_manager_t, queue_ike_reauth, void,
1563 private_task_manager_t *this)
1564 {
1565 enumerator_t *enumerator;
1566 child_sa_t *child_sa;
1567 ike_sa_t *new;
1568 host_t *host;
1569
1570 new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1571 this->ike_sa->get_version(this->ike_sa), TRUE);
1572 if (!new)
1573 { /* shouldn't happen */
1574 return;
1575 }
1576
1577 new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1578 host = this->ike_sa->get_other_host(this->ike_sa);
1579 new->set_other_host(new, host->clone(host));
1580 host = this->ike_sa->get_my_host(this->ike_sa);
1581 new->set_my_host(new, host->clone(host));
1582 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1583 while (enumerator->enumerate(enumerator, &host))
1584 {
1585 new->add_virtual_ip(new, TRUE, host);
1586 }
1587 enumerator->destroy(enumerator);
1588
1589 charon->bus->children_migrate(charon->bus, new->get_id(new),
1590 new->get_unique_id(new));
1591 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1592 while (enumerator->enumerate(enumerator, &child_sa))
1593 {
1594 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1595 new->add_child_sa(new, child_sa);
1596 }
1597 enumerator->destroy(enumerator);
1598 charon->bus->set_sa(charon->bus, new);
1599 charon->bus->children_migrate(charon->bus, NULL, 0);
1600 charon->bus->set_sa(charon->bus, this->ike_sa);
1601
1602 if (!new->get_child_count(new))
1603 { /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1604 task_t *task;
1605
1606 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1607 while (enumerator->enumerate(enumerator, &task))
1608 {
1609 if (task->get_type(task) == TASK_QUICK_MODE)
1610 {
1611 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1612 task->migrate(task, new);
1613 new->queue_task(new, task);
1614 }
1615 }
1616 enumerator->destroy(enumerator);
1617 }
1618
1619 if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1620 {
1621 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1622 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1623 }
1624 else
1625 {
1626 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1627 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1628 }
1629 charon->bus->set_sa(charon->bus, this->ike_sa);
1630 }
1631
1632 METHOD(task_manager_t, queue_ike_rekey, void,
1633 private_task_manager_t *this)
1634 {
1635 queue_ike_reauth(this);
1636 }
1637
1638 METHOD(task_manager_t, queue_ike_delete, void,
1639 private_task_manager_t *this)
1640 {
1641 enumerator_t *enumerator;
1642 child_sa_t *child_sa;
1643
1644 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1645 while (enumerator->enumerate(enumerator, &child_sa))
1646 {
1647 queue_task(this, (task_t*)
1648 quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1649 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1650 }
1651 enumerator->destroy(enumerator);
1652
1653 queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1654 }
1655
1656 METHOD(task_manager_t, queue_mobike, void,
1657 private_task_manager_t *this, bool roam, bool address)
1658 {
1659 /* Not supported in IKEv1 */
1660 }
1661
1662 METHOD(task_manager_t, queue_child, void,
1663 private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1664 traffic_selector_t *tsi, traffic_selector_t *tsr)
1665 {
1666 quick_mode_t *task;
1667
1668 task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1669 task->use_reqid(task, reqid);
1670
1671 queue_task(this, &task->task);
1672 }
1673
1674 /**
1675 * Check if two CHILD_SAs have the same traffic selector
1676 */
1677 static bool have_equal_ts(child_sa_t *child1, child_sa_t *child2, bool local)
1678 {
1679 enumerator_t *e1, *e2;
1680 traffic_selector_t *ts1, *ts2;
1681 bool equal = FALSE;
1682
1683 e1 = child1->create_ts_enumerator(child1, local);
1684 e2 = child2->create_ts_enumerator(child2, local);
1685 if (e1->enumerate(e1, &ts1) && e2->enumerate(e2, &ts2))
1686 {
1687 equal = ts1->equals(ts1, ts2);
1688 }
1689 e2->destroy(e2);
1690 e1->destroy(e1);
1691
1692 return equal;
1693 }
1694
1695 /**
1696 * Check if a CHILD_SA is redundant and we should delete instead of rekey
1697 */
1698 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1699 {
1700 enumerator_t *enumerator;
1701 child_sa_t *current;
1702 bool redundant = FALSE;
1703
1704 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1705 while (enumerator->enumerate(enumerator, &current))
1706 {
1707 if (current->get_state(current) == CHILD_INSTALLED &&
1708 streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1709 have_equal_ts(current, child_sa, TRUE) &&
1710 have_equal_ts(current, child_sa, FALSE) &&
1711 current->get_lifetime(current, FALSE) >
1712 child_sa->get_lifetime(child_sa, FALSE))
1713 {
1714 DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1715 child_sa->get_name(child_sa),
1716 child_sa->get_unique_id(child_sa));
1717 redundant = TRUE;
1718 break;
1719 }
1720 }
1721 enumerator->destroy(enumerator);
1722
1723 return redundant;
1724 }
1725
1726 /**
1727 * Get the first traffic selector of a CHILD_SA, local or remote
1728 */
1729 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1730 {
1731 traffic_selector_t *ts = NULL;
1732 enumerator_t *enumerator;
1733
1734 enumerator = child_sa->create_ts_enumerator(child_sa, local);
1735 enumerator->enumerate(enumerator, &ts);
1736 enumerator->destroy(enumerator);
1737
1738 return ts;
1739 }
1740
1741 METHOD(task_manager_t, queue_child_rekey, void,
1742 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1743 {
1744 child_sa_t *child_sa;
1745 child_cfg_t *cfg;
1746 quick_mode_t *task;
1747
1748 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1749 if (!child_sa)
1750 {
1751 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1752 }
1753 if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1754 {
1755 if (is_redundant(this, child_sa))
1756 {
1757 queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1758 protocol, spi, FALSE, FALSE));
1759 }
1760 else
1761 {
1762 child_sa->set_state(child_sa, CHILD_REKEYING);
1763 cfg = child_sa->get_config(child_sa);
1764 task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1765 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1766 task->use_reqid(task, child_sa->get_reqid(child_sa));
1767 task->use_marks(task, child_sa->get_mark(child_sa, TRUE).value,
1768 child_sa->get_mark(child_sa, FALSE).value);
1769 task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1770
1771 queue_task(this, &task->task);
1772 }
1773 }
1774 }
1775
1776 METHOD(task_manager_t, queue_child_delete, void,
1777 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1778 bool expired)
1779 {
1780 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1781 spi, FALSE, expired));
1782 }
1783
1784 METHOD(task_manager_t, queue_dpd, void,
1785 private_task_manager_t *this)
1786 {
1787 peer_cfg_t *peer_cfg;
1788 u_int32_t t, retransmit;
1789
1790 queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1791 this->dpd_send++));
1792 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1793
1794 /* compute timeout in milliseconds */
1795 t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1796 if (t == 0)
1797 {
1798 /* use the same timeout as a retransmitting IKE message would have */
1799 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1800 {
1801 t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1802 pow(this->retransmit_base, retransmit));
1803 }
1804 }
1805
1806 /* schedule DPD timeout job */
1807 lib->scheduler->schedule_job_ms(lib->scheduler,
1808 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1809 }
1810
1811 METHOD(task_manager_t, adopt_tasks, void,
1812 private_task_manager_t *this, task_manager_t *other_public)
1813 {
1814 private_task_manager_t *other = (private_task_manager_t*)other_public;
1815 task_t *task;
1816
1817 /* move queued tasks from other to this */
1818 while (other->queued_tasks->remove_last(other->queued_tasks,
1819 (void**)&task) == SUCCESS)
1820 {
1821 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1822 task->migrate(task, this->ike_sa);
1823 this->queued_tasks->insert_first(this->queued_tasks, task);
1824 }
1825 }
1826
1827 /**
1828 * Migrates child-creating tasks from src to dst
1829 */
1830 static void migrate_child_tasks(private_task_manager_t *this,
1831 linked_list_t *src, linked_list_t *dst)
1832 {
1833 enumerator_t *enumerator;
1834 task_t *task;
1835
1836 enumerator = src->create_enumerator(src);
1837 while (enumerator->enumerate(enumerator, &task))
1838 {
1839 if (task->get_type(task) == TASK_QUICK_MODE)
1840 {
1841 src->remove_at(src, enumerator);
1842 task->migrate(task, this->ike_sa);
1843 dst->insert_last(dst, task);
1844 }
1845 }
1846 enumerator->destroy(enumerator);
1847 }
1848
1849 METHOD(task_manager_t, adopt_child_tasks, void,
1850 private_task_manager_t *this, task_manager_t *other_public)
1851 {
1852 private_task_manager_t *other = (private_task_manager_t*)other_public;
1853
1854 /* move active child tasks from other to this */
1855 migrate_child_tasks(this, other->active_tasks, this->queued_tasks);
1856 /* do the same for queued tasks */
1857 migrate_child_tasks(this, other->queued_tasks, this->queued_tasks);
1858 }
1859
1860 METHOD(task_manager_t, busy, bool,
1861 private_task_manager_t *this)
1862 {
1863 return (this->active_tasks->get_count(this->active_tasks) > 0);
1864 }
1865
1866 METHOD(task_manager_t, incr_mid, void,
1867 private_task_manager_t *this, bool initiate)
1868 {
1869 }
1870
1871 METHOD(task_manager_t, reset, void,
1872 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1873 {
1874 enumerator_t *enumerator;
1875 task_t *task;
1876
1877 /* reset message counters and retransmit packets */
1878 clear_packets(this->responding.packets);
1879 clear_packets(this->initiating.packets);
1880 this->responding.seqnr = RESPONDING_SEQ;
1881 this->responding.retransmitted = 0;
1882 this->initiating.mid = 0;
1883 this->initiating.seqnr = 0;
1884 this->initiating.retransmitted = 0;
1885 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1886 DESTROY_IF(this->defrag);
1887 this->defrag = NULL;
1888 if (initiate != UINT_MAX)
1889 {
1890 this->dpd_send = initiate;
1891 }
1892 if (respond != UINT_MAX)
1893 {
1894 this->dpd_recv = respond;
1895 }
1896
1897 /* reset queued tasks */
1898 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1899 while (enumerator->enumerate(enumerator, &task))
1900 {
1901 task->migrate(task, this->ike_sa);
1902 }
1903 enumerator->destroy(enumerator);
1904
1905 /* reset active tasks */
1906 while (this->active_tasks->remove_last(this->active_tasks,
1907 (void**)&task) == SUCCESS)
1908 {
1909 task->migrate(task, this->ike_sa);
1910 this->queued_tasks->insert_first(this->queued_tasks, task);
1911 }
1912 }
1913
1914 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1915 private_task_manager_t *this, task_queue_t queue)
1916 {
1917 switch (queue)
1918 {
1919 case TASK_QUEUE_ACTIVE:
1920 return this->active_tasks->create_enumerator(this->active_tasks);
1921 case TASK_QUEUE_PASSIVE:
1922 return this->passive_tasks->create_enumerator(this->passive_tasks);
1923 case TASK_QUEUE_QUEUED:
1924 return this->queued_tasks->create_enumerator(this->queued_tasks);
1925 default:
1926 return enumerator_create_empty();
1927 }
1928 }
1929
1930 METHOD(task_manager_t, destroy, void,
1931 private_task_manager_t *this)
1932 {
1933 flush(this);
1934
1935 this->active_tasks->destroy(this->active_tasks);
1936 this->queued_tasks->destroy(this->queued_tasks);
1937 this->passive_tasks->destroy(this->passive_tasks);
1938 DESTROY_IF(this->defrag);
1939
1940 DESTROY_IF(this->queued);
1941 clear_packets(this->responding.packets);
1942 array_destroy(this->responding.packets);
1943 clear_packets(this->initiating.packets);
1944 array_destroy(this->initiating.packets);
1945 DESTROY_IF(this->rng);
1946 free(this);
1947 }
1948
1949 /*
1950 * see header file
1951 */
1952 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1953 {
1954 private_task_manager_t *this;
1955
1956 INIT(this,
1957 .public = {
1958 .task_manager = {
1959 .process_message = _process_message,
1960 .queue_task = _queue_task,
1961 .queue_ike = _queue_ike,
1962 .queue_ike_rekey = _queue_ike_rekey,
1963 .queue_ike_reauth = _queue_ike_reauth,
1964 .queue_ike_delete = _queue_ike_delete,
1965 .queue_mobike = _queue_mobike,
1966 .queue_child = _queue_child,
1967 .queue_child_rekey = _queue_child_rekey,
1968 .queue_child_delete = _queue_child_delete,
1969 .queue_dpd = _queue_dpd,
1970 .initiate = _initiate,
1971 .retransmit = _retransmit,
1972 .incr_mid = _incr_mid,
1973 .reset = _reset,
1974 .adopt_tasks = _adopt_tasks,
1975 .adopt_child_tasks = _adopt_child_tasks,
1976 .busy = _busy,
1977 .create_task_enumerator = _create_task_enumerator,
1978 .flush = _flush,
1979 .flush_queue = _flush_queue,
1980 .destroy = _destroy,
1981 },
1982 },
1983 .initiating = {
1984 .type = EXCHANGE_TYPE_UNDEFINED,
1985 },
1986 .responding = {
1987 .seqnr = RESPONDING_SEQ,
1988 },
1989 .ike_sa = ike_sa,
1990 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1991 .queued_tasks = linked_list_create(),
1992 .active_tasks = linked_list_create(),
1993 .passive_tasks = linked_list_create(),
1994 .retransmit_tries = lib->settings->get_int(lib->settings,
1995 "%s.retransmit_tries", RETRANSMIT_TRIES, lib->ns),
1996 .retransmit_timeout = lib->settings->get_double(lib->settings,
1997 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, lib->ns),
1998 .retransmit_base = lib->settings->get_double(lib->settings,
1999 "%s.retransmit_base", RETRANSMIT_BASE, lib->ns),
2000 );
2001
2002 if (!this->rng)
2003 {
2004 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
2005 destroy(this);
2006 return NULL;
2007 }
2008 if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
2009 (void*)&this->dpd_send))
2010 {
2011 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
2012 destroy(this);
2013 return NULL;
2014 }
2015 this->dpd_send &= 0x7FFFFFFF;
2016
2017 return &this->public;
2018 }