Support multiple virtual IPs on peer_cfg and ike_sa classes
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/aggressive_mode.h>
24 #include <sa/ikev1/tasks/quick_mode.h>
25 #include <sa/ikev1/tasks/quick_delete.h>
26 #include <sa/ikev1/tasks/xauth.h>
27 #include <sa/ikev1/tasks/mode_config.h>
28 #include <sa/ikev1/tasks/informational.h>
29 #include <sa/ikev1/tasks/isakmp_natd.h>
30 #include <sa/ikev1/tasks/isakmp_vendor.h>
31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
33 #include <sa/ikev1/tasks/isakmp_delete.h>
34 #include <sa/ikev1/tasks/isakmp_dpd.h>
35
36 #include <processing/jobs/retransmit_job.h>
37 #include <processing/jobs/delete_ike_sa_job.h>
38 #include <processing/jobs/dpd_timeout_job.h>
39
40 /**
41 * Number of old messages hashes we keep for retransmission.
42 *
43 * In Main Mode, we must ignore messages from a previous message pair if
44 * we already continued to the next. Otherwise a late retransmission
45 * could be considered as a reply to the newer request.
46 */
47 #define MAX_OLD_HASHES 2
48
49 /**
50 * First sequence number of responding packets.
51 *
52 * To distinguish retransmission jobs for initiating and responding packets,
53 * we split up the sequence counter and use the upper half for responding.
54 */
55 #define RESPONDING_SEQ INT_MAX
56
57 typedef struct exchange_t exchange_t;
58
59 /**
60 * An exchange in the air, used do detect and handle retransmission
61 */
62 struct exchange_t {
63
64 /**
65 * Message ID used for this transaction
66 */
67 u_int32_t mid;
68
69 /**
70 * generated packet for retransmission
71 */
72 packet_t *packet;
73 };
74
75 typedef struct private_task_manager_t private_task_manager_t;
76
77 /**
78 * private data of the task manager
79 */
80 struct private_task_manager_t {
81
82 /**
83 * public functions
84 */
85 task_manager_v1_t public;
86
87 /**
88 * associated IKE_SA we are serving
89 */
90 ike_sa_t *ike_sa;
91
92 /**
93 * RNG to create message IDs
94 */
95 rng_t *rng;
96
97 /**
98 * Exchange we are currently handling as responder
99 */
100 struct {
101 /**
102 * Message ID of the last response
103 */
104 u_int32_t mid;
105
106 /**
107 * Hash of a previously received message
108 */
109 u_int32_t hash;
110
111 /**
112 * packet for retransmission
113 */
114 packet_t *packet;
115
116 /**
117 * Sequence number of the last sent message
118 */
119 u_int32_t seqnr;
120
121 /**
122 * how many times we have retransmitted so far
123 */
124 u_int retransmitted;
125
126 } responding;
127
128 /**
129 * Exchange we are currently handling as initiator
130 */
131 struct {
132 /**
133 * Message ID of the exchange
134 */
135 u_int32_t mid;
136
137 /**
138 * Hashes of old responses we can ignore
139 */
140 u_int32_t old_hashes[MAX_OLD_HASHES];
141
142 /**
143 * Position in old hash array
144 */
145 int old_hash_pos;
146
147 /**
148 * Sequence number of the last sent message
149 */
150 u_int32_t seqnr;
151
152 /**
153 * how many times we have retransmitted so far
154 */
155 u_int retransmitted;
156
157 /**
158 * packet for retransmission
159 */
160 packet_t *packet;
161
162 /**
163 * type of the initated exchange
164 */
165 exchange_type_t type;
166
167 } initiating;
168
169 /**
170 * List of queued tasks not yet in action
171 */
172 linked_list_t *queued_tasks;
173
174 /**
175 * List of active tasks, initiated by ourselve
176 */
177 linked_list_t *active_tasks;
178
179 /**
180 * List of tasks initiated by peer
181 */
182 linked_list_t *passive_tasks;
183
184 /**
185 * Queued messages not yet ready to process
186 */
187 message_t *queued;
188
189 /**
190 * Number of times we retransmit messages before giving up
191 */
192 u_int retransmit_tries;
193
194 /**
195 * Retransmission timeout
196 */
197 double retransmit_timeout;
198
199 /**
200 * Base to calculate retransmission timeout
201 */
202 double retransmit_base;
203
204 /**
205 * Sequence number for sending DPD requests
206 */
207 u_int32_t dpd_send;
208
209 /**
210 * Sequence number for received DPD requests
211 */
212 u_int32_t dpd_recv;
213 };
214
215 METHOD(task_manager_t, flush_queue, void,
216 private_task_manager_t *this, task_queue_t queue)
217 {
218 linked_list_t *list;
219 task_t *task;
220
221 if (this->queued)
222 {
223 this->queued->destroy(this->queued);
224 this->queued = NULL;
225 }
226 switch (queue)
227 {
228 case TASK_QUEUE_ACTIVE:
229 list = this->active_tasks;
230 /* cancel pending retransmits */
231 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
232 DESTROY_IF(this->initiating.packet);
233 this->initiating.packet = NULL;
234 break;
235 case TASK_QUEUE_PASSIVE:
236 list = this->passive_tasks;
237 break;
238 case TASK_QUEUE_QUEUED:
239 list = this->queued_tasks;
240 break;
241 default:
242 return;
243 }
244 while (list->remove_last(list, (void**)&task) == SUCCESS)
245 {
246 task->destroy(task);
247 }
248 }
249
250 /**
251 * flush all tasks in the task manager
252 */
253 static void flush(private_task_manager_t *this)
254 {
255 flush_queue(this, TASK_QUEUE_QUEUED);
256 flush_queue(this, TASK_QUEUE_PASSIVE);
257 flush_queue(this, TASK_QUEUE_ACTIVE);
258 }
259
260 /**
261 * move a task of a specific type from the queue to the active list
262 */
263 static bool activate_task(private_task_manager_t *this, task_type_t type)
264 {
265 enumerator_t *enumerator;
266 task_t *task;
267 bool found = FALSE;
268
269 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
270 while (enumerator->enumerate(enumerator, (void**)&task))
271 {
272 if (task->get_type(task) == type)
273 {
274 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
275 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
276 this->active_tasks->insert_last(this->active_tasks, task);
277 found = TRUE;
278 break;
279 }
280 }
281 enumerator->destroy(enumerator);
282 return found;
283 }
284
285 /**
286 * Retransmit a packet, either as initiator or as responder
287 */
288 static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
289 u_int mid, u_int retransmitted, packet_t *packet)
290 {
291 u_int32_t t;
292
293 if (retransmitted > this->retransmit_tries)
294 {
295 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
296 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
297 {
298 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
299 }
300 return DESTROY_ME;
301 }
302 t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
303 pow(this->retransmit_base, retransmitted));
304 if (retransmitted)
305 {
306 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
307 retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
308 mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
309 }
310 charon->sender->send(charon->sender, packet->clone(packet));
311 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
312 retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
313 return NEED_MORE;
314 }
315
316 METHOD(task_manager_t, retransmit, status_t,
317 private_task_manager_t *this, u_int32_t seqnr)
318 {
319 status_t status = SUCCESS;
320
321 if (seqnr == this->initiating.seqnr && this->initiating.packet)
322 {
323 status = retransmit_packet(this, seqnr, this->initiating.mid,
324 this->initiating.retransmitted, this->initiating.packet);
325 if (status == NEED_MORE)
326 {
327 this->initiating.retransmitted++;
328 status = SUCCESS;
329 }
330 }
331 if (seqnr == this->responding.seqnr && this->responding.packet)
332 {
333 status = retransmit_packet(this, seqnr, this->responding.mid,
334 this->responding.retransmitted, this->responding.packet);
335 if (status == NEED_MORE)
336 {
337 this->responding.retransmitted++;
338 status = SUCCESS;
339 }
340 }
341 return status;
342 }
343
344 /**
345 * Check if we have to wait for a mode config before starting a quick mode
346 */
347 static bool mode_config_expected(private_task_manager_t *this)
348 {
349 enumerator_t *enumerator;
350 peer_cfg_t *peer_cfg;
351 host_t *host;
352
353 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
354 if (peer_cfg && peer_cfg->get_pool(peer_cfg))
355 {
356 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
357 FALSE);
358 if (!enumerator->enumerate(enumerator, &host))
359 { /* have a pool, but no VIP assigned yet */
360 enumerator->destroy(enumerator);
361 return TRUE;
362 }
363 enumerator->destroy(enumerator);
364 }
365 return FALSE;
366 }
367
368 METHOD(task_manager_t, initiate, status_t,
369 private_task_manager_t *this)
370 {
371 enumerator_t *enumerator;
372 task_t *task;
373 message_t *message;
374 host_t *me, *other;
375 status_t status;
376 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
377 bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
378
379 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
380 this->initiating.type != INFORMATIONAL_V1)
381 {
382 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
383 exchange_type_names, this->initiating.type);
384 /* do not initiate if we already have a message in the air */
385 return SUCCESS;
386 }
387
388 if (this->active_tasks->get_count(this->active_tasks) == 0)
389 {
390 DBG2(DBG_IKE, "activating new tasks");
391 switch (this->ike_sa->get_state(this->ike_sa))
392 {
393 case IKE_CREATED:
394 activate_task(this, TASK_ISAKMP_VENDOR);
395 activate_task(this, TASK_ISAKMP_CERT_PRE);
396 if (activate_task(this, TASK_MAIN_MODE))
397 {
398 exchange = ID_PROT;
399 }
400 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
401 {
402 exchange = AGGRESSIVE;
403 }
404 activate_task(this, TASK_ISAKMP_CERT_POST);
405 activate_task(this, TASK_ISAKMP_NATD);
406 break;
407 case IKE_CONNECTING:
408 if (activate_task(this, TASK_ISAKMP_DELETE))
409 {
410 exchange = INFORMATIONAL_V1;
411 new_mid = TRUE;
412 break;
413 }
414 if (activate_task(this, TASK_XAUTH))
415 {
416 exchange = TRANSACTION;
417 new_mid = TRUE;
418 break;
419 }
420 if (activate_task(this, TASK_INFORMATIONAL))
421 {
422 exchange = INFORMATIONAL_V1;
423 new_mid = TRUE;
424 break;
425 }
426 break;
427 case IKE_ESTABLISHED:
428 if (activate_task(this, TASK_MODE_CONFIG))
429 {
430 exchange = TRANSACTION;
431 new_mid = TRUE;
432 break;
433 }
434 if (!mode_config_expected(this) &&
435 activate_task(this, TASK_QUICK_MODE))
436 {
437 exchange = QUICK_MODE;
438 new_mid = TRUE;
439 break;
440 }
441 if (activate_task(this, TASK_INFORMATIONAL))
442 {
443 exchange = INFORMATIONAL_V1;
444 new_mid = TRUE;
445 break;
446 }
447 if (activate_task(this, TASK_QUICK_DELETE))
448 {
449 exchange = INFORMATIONAL_V1;
450 new_mid = TRUE;
451 break;
452 }
453 if (activate_task(this, TASK_ISAKMP_DELETE))
454 {
455 exchange = INFORMATIONAL_V1;
456 new_mid = TRUE;
457 break;
458 }
459 if (activate_task(this, TASK_ISAKMP_DPD))
460 {
461 exchange = INFORMATIONAL_V1;
462 new_mid = TRUE;
463 break;
464 }
465 break;
466 default:
467 break;
468 }
469 }
470 else
471 {
472 DBG2(DBG_IKE, "reinitiating already active tasks");
473 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
474 while (enumerator->enumerate(enumerator, (void**)&task))
475 {
476 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
477 switch (task->get_type(task))
478 {
479 case TASK_MAIN_MODE:
480 exchange = ID_PROT;
481 break;
482 case TASK_AGGRESSIVE_MODE:
483 exchange = AGGRESSIVE;
484 break;
485 case TASK_QUICK_MODE:
486 exchange = QUICK_MODE;
487 break;
488 case TASK_XAUTH:
489 exchange = TRANSACTION;
490 new_mid = TRUE;
491 break;
492 default:
493 continue;
494 }
495 break;
496 }
497 enumerator->destroy(enumerator);
498 }
499
500 if (exchange == EXCHANGE_TYPE_UNDEFINED)
501 {
502 DBG2(DBG_IKE, "nothing to initiate");
503 /* nothing to do yet... */
504 return SUCCESS;
505 }
506
507 me = this->ike_sa->get_my_host(this->ike_sa);
508 other = this->ike_sa->get_other_host(this->ike_sa);
509
510 if (new_mid)
511 {
512 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
513 (void*)&this->initiating.mid))
514 {
515 DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
516 flush(this);
517 return DESTROY_ME;
518 }
519 }
520 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
521 message->set_message_id(message, this->initiating.mid);
522 message->set_source(message, me->clone(me));
523 message->set_destination(message, other->clone(other));
524 message->set_exchange_type(message, exchange);
525 this->initiating.type = exchange;
526 this->initiating.retransmitted = 0;
527
528 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
529 while (enumerator->enumerate(enumerator, (void*)&task))
530 {
531 switch (task->build(task, message))
532 {
533 case SUCCESS:
534 /* task completed, remove it */
535 this->active_tasks->remove_at(this->active_tasks, enumerator);
536 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
537 task->get_type(task) == TASK_QUICK_MODE)
538 { /* last message of three message exchange */
539 keep = TRUE;
540 }
541 task->destroy(task);
542 continue;
543 case NEED_MORE:
544 expect_response = TRUE;
545 /* processed, but task needs another exchange */
546 continue;
547 case ALREADY_DONE:
548 cancelled = TRUE;
549 break;
550 case FAILED:
551 default:
552 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
553 {
554 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
555 }
556 /* FALL */
557 case DESTROY_ME:
558 /* critical failure, destroy IKE_SA */
559 enumerator->destroy(enumerator);
560 message->destroy(message);
561 flush(this);
562 return DESTROY_ME;
563 }
564 break;
565 }
566 enumerator->destroy(enumerator);
567
568 if (this->active_tasks->get_count(this->active_tasks) == 0 &&
569 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
570 { /* tasks completed, no exchange active anymore */
571 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
572 }
573 if (cancelled)
574 {
575 message->destroy(message);
576 return initiate(this);
577 }
578
579 DESTROY_IF(this->initiating.packet);
580 status = this->ike_sa->generate_message(this->ike_sa, message,
581 &this->initiating.packet);
582 if (status != SUCCESS)
583 {
584 /* message generation failed. There is nothing more to do than to
585 * close the SA */
586 message->destroy(message);
587 flush(this);
588 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
589 return DESTROY_ME;
590 }
591
592 this->initiating.seqnr++;
593 if (expect_response )
594 {
595 message->destroy(message);
596 return retransmit(this, this->initiating.seqnr);
597 }
598 if (keep)
599 { /* keep the packet for retransmission, the responder might request it */
600 charon->sender->send(charon->sender,
601 this->initiating.packet->clone(this->initiating.packet));
602 }
603 else
604 {
605 charon->sender->send(charon->sender, this->initiating.packet);
606 this->initiating.packet = NULL;
607 }
608 message->destroy(message);
609
610 if (exchange == INFORMATIONAL_V1)
611 {
612 switch (this->ike_sa->get_state(this->ike_sa))
613 {
614 case IKE_CONNECTING:
615 /* close after sending an INFORMATIONAL when unestablished */
616 return FAILED;
617 case IKE_DELETING:
618 /* close after sending a DELETE */
619 return DESTROY_ME;
620 default:
621 break;
622 }
623 }
624 return initiate(this);
625 }
626
627 /**
628 * build a response depending on the "passive" task list
629 */
630 static status_t build_response(private_task_manager_t *this, message_t *request)
631 {
632 enumerator_t *enumerator;
633 task_t *task;
634 message_t *message;
635 host_t *me, *other;
636 bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
637 status_t status;
638
639 me = request->get_destination(request);
640 other = request->get_source(request);
641
642 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
643 message->set_exchange_type(message, request->get_exchange_type(request));
644 /* send response along the path the request came in */
645 message->set_source(message, me->clone(me));
646 message->set_destination(message, other->clone(other));
647 message->set_message_id(message, request->get_message_id(request));
648 message->set_request(message, FALSE);
649
650 this->responding.mid = request->get_message_id(request);
651 this->responding.retransmitted = 0;
652 this->responding.seqnr++;
653
654 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
655 while (enumerator->enumerate(enumerator, (void*)&task))
656 {
657 switch (task->build(task, message))
658 {
659 case SUCCESS:
660 /* task completed, remove it */
661 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
662 task->destroy(task);
663 continue;
664 case NEED_MORE:
665 /* processed, but task needs another exchange */
666 if (task->get_type(task) == TASK_QUICK_MODE ||
667 task->get_type(task) == TASK_AGGRESSIVE_MODE)
668 { /* we rely on initiator retransmission, except for
669 * three-message exchanges */
670 expect_request = TRUE;
671 }
672 continue;
673 case ALREADY_DONE:
674 cancelled = TRUE;
675 break;
676 case FAILED:
677 default:
678 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
679 /* FALL */
680 case DESTROY_ME:
681 /* destroy IKE_SA, but SEND response first */
682 delete = TRUE;
683 break;
684 }
685 break;
686 }
687 enumerator->destroy(enumerator);
688
689 DESTROY_IF(this->responding.packet);
690 this->responding.packet = NULL;
691 if (cancelled)
692 {
693 message->destroy(message);
694 return initiate(this);
695 }
696 status = this->ike_sa->generate_message(this->ike_sa, message,
697 &this->responding.packet);
698 message->destroy(message);
699 if (status != SUCCESS)
700 {
701 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
702 return DESTROY_ME;
703 }
704
705 if (expect_request && !delete)
706 {
707 return retransmit(this, this->responding.seqnr);
708 }
709 charon->sender->send(charon->sender,
710 this->responding.packet->clone(this->responding.packet));
711 if (delete)
712 {
713 return DESTROY_ME;
714 }
715 return SUCCESS;
716 }
717
718 /**
719 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
720 * The notify protocol_id is set to ISAKMP
721 */
722 static void send_notify(private_task_manager_t *this, message_t *request,
723 notify_type_t type)
724 {
725 message_t *response;
726 packet_t *packet;
727 host_t *me, *other;
728 u_int32_t mid;
729
730 if (request && request->get_exchange_type(request) == INFORMATIONAL_V1)
731 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
732 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
733 return;
734 }
735 if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
736 {
737 DBG1(DBG_IKE, "failed to allocate message ID");
738 return;
739 }
740 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
741 response->set_exchange_type(response, INFORMATIONAL_V1);
742 response->set_request(response, TRUE);
743 response->set_message_id(response, mid);
744 response->add_payload(response, (payload_t*)
745 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
746 PROTO_IKE, type));
747
748 me = this->ike_sa->get_my_host(this->ike_sa);
749 if (me->is_anyaddr(me))
750 {
751 me = request->get_destination(request);
752 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
753 }
754 other = this->ike_sa->get_other_host(this->ike_sa);
755 if (other->is_anyaddr(other))
756 {
757 other = request->get_source(request);
758 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
759 }
760 response->set_source(response, me->clone(me));
761 response->set_destination(response, other->clone(other));
762 if (this->ike_sa->generate_message(this->ike_sa, response,
763 &packet) == SUCCESS)
764 {
765 charon->sender->send(charon->sender, packet);
766 }
767 response->destroy(response);
768 }
769
770 /**
771 * Process a DPD request/response
772 */
773 static bool process_dpd(private_task_manager_t *this, message_t *message)
774 {
775 notify_payload_t *notify;
776 notify_type_t type;
777 u_int32_t seq;
778 chunk_t data;
779
780 type = DPD_R_U_THERE;
781 notify = message->get_notify(message, type);
782 if (!notify)
783 {
784 type = DPD_R_U_THERE_ACK;
785 notify = message->get_notify(message, type);
786 }
787 if (!notify)
788 {
789 return FALSE;
790 }
791 data = notify->get_notification_data(notify);
792 if (data.len != 4)
793 {
794 return FALSE;
795 }
796 seq = untoh32(data.ptr);
797
798 if (type == DPD_R_U_THERE)
799 {
800 if (this->dpd_recv == 0 || seq == this->dpd_recv)
801 { /* check sequence validity */
802 this->dpd_recv = seq + 1;
803 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
804 time_monotonic(NULL));
805 }
806 /* but respond anyway */
807 this->ike_sa->queue_task(this->ike_sa,
808 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
809 }
810 else /* DPD_R_U_THERE_ACK */
811 {
812 if (seq == this->dpd_send - 1)
813 {
814 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
815 time_monotonic(NULL));
816 }
817 else
818 {
819 DBG1(DBG_IKE, "received invalid DPD sequence number %u "
820 "(expected %u), ignored", seq, this->dpd_send - 1);
821 }
822 }
823 return TRUE;
824 }
825
826 /**
827 * handle an incoming request message
828 */
829 static status_t process_request(private_task_manager_t *this,
830 message_t *message)
831 {
832 enumerator_t *enumerator;
833 task_t *task = NULL;
834 bool send_response = FALSE, dpd = FALSE;
835
836 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
837 this->passive_tasks->get_count(this->passive_tasks) == 0)
838 { /* create tasks depending on request type, if not already some queued */
839 switch (message->get_exchange_type(message))
840 {
841 case ID_PROT:
842 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
843 this->passive_tasks->insert_last(this->passive_tasks, task);
844 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
845 this->passive_tasks->insert_last(this->passive_tasks, task);
846 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
847 this->passive_tasks->insert_last(this->passive_tasks, task);
848 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
849 this->passive_tasks->insert_last(this->passive_tasks, task);
850 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
851 this->passive_tasks->insert_last(this->passive_tasks, task);
852 break;
853 case AGGRESSIVE:
854 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
855 this->passive_tasks->insert_last(this->passive_tasks, task);
856 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
857 this->passive_tasks->insert_last(this->passive_tasks, task);
858 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
859 this->passive_tasks->insert_last(this->passive_tasks, task);
860 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
861 this->passive_tasks->insert_last(this->passive_tasks, task);
862 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
863 this->passive_tasks->insert_last(this->passive_tasks, task);
864 break;
865 case QUICK_MODE:
866 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
867 {
868 DBG1(DBG_IKE, "received quick mode request for "
869 "unestablished IKE_SA, ignored");
870 return FAILED;
871 }
872 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
873 NULL, NULL);
874 this->passive_tasks->insert_last(this->passive_tasks, task);
875 break;
876 case INFORMATIONAL_V1:
877 if (process_dpd(this, message))
878 {
879 dpd = TRUE;
880 }
881 else
882 {
883 task = (task_t *)informational_create(this->ike_sa, NULL);
884 this->passive_tasks->insert_first(this->passive_tasks, task);
885 }
886 break;
887 case TRANSACTION:
888 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
889 {
890 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
891 }
892 else
893 {
894 task = (task_t *)xauth_create(this->ike_sa, FALSE);
895 }
896 this->passive_tasks->insert_last(this->passive_tasks, task);
897 break;
898 default:
899 return FAILED;
900 }
901 }
902 if (dpd)
903 {
904 return initiate(this);
905 }
906 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
907
908 /* let the tasks process the message */
909 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
910 while (enumerator->enumerate(enumerator, (void*)&task))
911 {
912 switch (task->process(task, message))
913 {
914 case SUCCESS:
915 /* task completed, remove it */
916 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
917 task->destroy(task);
918 continue;
919 case NEED_MORE:
920 /* processed, but task needs at least another call to build() */
921 send_response = TRUE;
922 continue;
923 case ALREADY_DONE:
924 send_response = FALSE;
925 break;
926 case FAILED:
927 default:
928 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
929 /* FALL */
930 case DESTROY_ME:
931 /* critical failure, destroy IKE_SA */
932 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
933 enumerator->destroy(enumerator);
934 task->destroy(task);
935 return DESTROY_ME;
936 }
937 break;
938 }
939 enumerator->destroy(enumerator);
940
941 if (send_response)
942 {
943 if (build_response(this, message) != SUCCESS)
944 {
945 return DESTROY_ME;
946 }
947 }
948 else
949 { /* We don't send a response, so don't retransmit one if we get
950 * the same message again. */
951 DESTROY_IF(this->responding.packet);
952 this->responding.packet = NULL;
953 }
954 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
955 this->queued_tasks->get_count(this->queued_tasks) > 0)
956 {
957 /* passive tasks completed, check if an active task has been queued,
958 * such as XAUTH or modeconfig push */
959 return initiate(this);
960 }
961 return SUCCESS;
962 }
963
964 /**
965 * handle an incoming response message
966 */
967 static status_t process_response(private_task_manager_t *this,
968 message_t *message)
969 {
970 enumerator_t *enumerator;
971 message_t *queued;
972 status_t status;
973 task_t *task;
974
975 if (message->get_exchange_type(message) != this->initiating.type)
976 {
977 DBG1(DBG_IKE, "received %N response, but expected %N",
978 exchange_type_names, message->get_exchange_type(message),
979 exchange_type_names, this->initiating.type);
980 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
981 return DESTROY_ME;
982 }
983
984 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
985 while (enumerator->enumerate(enumerator, (void*)&task))
986 {
987 switch (task->process(task, message))
988 {
989 case SUCCESS:
990 /* task completed, remove it */
991 this->active_tasks->remove_at(this->active_tasks, enumerator);
992 task->destroy(task);
993 continue;
994 case NEED_MORE:
995 /* processed, but task needs another exchange */
996 continue;
997 case ALREADY_DONE:
998 break;
999 case FAILED:
1000 default:
1001 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1002 /* FALL */
1003 case DESTROY_ME:
1004 /* critical failure, destroy IKE_SA */
1005 this->active_tasks->remove_at(this->active_tasks, enumerator);
1006 enumerator->destroy(enumerator);
1007 task->destroy(task);
1008 return DESTROY_ME;
1009 }
1010 break;
1011 }
1012 enumerator->destroy(enumerator);
1013
1014 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1015 DESTROY_IF(this->initiating.packet);
1016 this->initiating.packet = NULL;
1017
1018 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
1019 {
1020 queued = this->queued;
1021 this->queued = NULL;
1022 status = this->public.task_manager.process_message(
1023 &this->public.task_manager, queued);
1024 queued->destroy(queued);
1025 if (status == DESTROY_ME)
1026 {
1027 return status;
1028 }
1029 }
1030
1031 return initiate(this);
1032 }
1033
1034 /**
1035 * Parse the given message and verify that it is valid.
1036 */
1037 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1038 {
1039 status_t status;
1040
1041 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1042
1043 if (status != SUCCESS)
1044 {
1045 switch (status)
1046 {
1047 case NOT_SUPPORTED:
1048 DBG1(DBG_IKE, "unsupported exchange type");
1049 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1050 break;
1051 case PARSE_ERROR:
1052 DBG1(DBG_IKE, "message parsing failed");
1053 send_notify(this, msg, PAYLOAD_MALFORMED);
1054 break;
1055 case VERIFY_ERROR:
1056 DBG1(DBG_IKE, "message verification failed");
1057 send_notify(this, msg, PAYLOAD_MALFORMED);
1058 break;
1059 case FAILED:
1060 DBG1(DBG_IKE, "integrity check failed");
1061 send_notify(this, msg, INVALID_HASH_INFORMATION);
1062 break;
1063 case INVALID_STATE:
1064 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1065 send_notify(this, msg, PAYLOAD_MALFORMED);
1066 default:
1067 break;
1068 }
1069 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1070 exchange_type_names, msg->get_exchange_type(msg),
1071 msg->get_request(msg) ? "request" : "response",
1072 msg->get_message_id(msg));
1073
1074 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1075 { /* invalid initiation attempt, close SA */
1076 return DESTROY_ME;
1077 }
1078 }
1079 return status;
1080 }
1081
1082 METHOD(task_manager_t, process_message, status_t,
1083 private_task_manager_t *this, message_t *msg)
1084 {
1085 u_int32_t hash, mid, i;
1086 host_t *me, *other;
1087 status_t status;
1088
1089 /* TODO-IKEv1: update hosts more selectively */
1090 me = msg->get_destination(msg);
1091 other = msg->get_source(msg);
1092 mid = msg->get_message_id(msg);
1093 hash = chunk_hash(msg->get_packet_data(msg));
1094 for (i = 0; i < MAX_OLD_HASHES; i++)
1095 {
1096 if (this->initiating.old_hashes[i] == hash)
1097 {
1098 if (this->initiating.packet &&
1099 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1100 (msg->get_exchange_type(msg) == QUICK_MODE ||
1101 msg->get_exchange_type(msg) == AGGRESSIVE))
1102 {
1103 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1104 "resending last request", mid);
1105 charon->sender->send(charon->sender,
1106 this->initiating.packet->clone(this->initiating.packet));
1107 return SUCCESS;
1108 }
1109 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1110 "but next request already sent", mid);
1111 return SUCCESS;
1112 }
1113 }
1114
1115 if ((mid && mid == this->initiating.mid) ||
1116 (this->initiating.mid == 0 &&
1117 msg->get_exchange_type(msg) == this->initiating.type &&
1118 this->active_tasks->get_count(this->active_tasks)))
1119 {
1120 msg->set_request(msg, FALSE);
1121 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1122 status = parse_message(this, msg);
1123 if (status != SUCCESS)
1124 {
1125 return status;
1126 }
1127 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1128 time_monotonic(NULL));
1129 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1130 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1131 if (process_response(this, msg) != SUCCESS)
1132 {
1133 flush(this);
1134 return DESTROY_ME;
1135 }
1136 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1137 MAX_OLD_HASHES] = hash;
1138 }
1139 else
1140 {
1141 if (hash == this->responding.hash)
1142 {
1143 if (this->responding.packet)
1144 {
1145 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1146 "retransmitting response", mid);
1147 charon->sender->send(charon->sender,
1148 this->responding.packet->clone(this->responding.packet));
1149 }
1150 else if (this->initiating.packet &&
1151 this->initiating.type == INFORMATIONAL_V1)
1152 {
1153 DBG1(DBG_IKE, "received retransmit of DPD request, "
1154 "retransmitting response");
1155 charon->sender->send(charon->sender,
1156 this->initiating.packet->clone(this->initiating.packet));
1157 }
1158 else
1159 {
1160 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1161 "but no response to retransmit", mid);
1162 }
1163 return SUCCESS;
1164 }
1165 if (msg->get_exchange_type(msg) == TRANSACTION &&
1166 this->active_tasks->get_count(this->active_tasks))
1167 { /* main mode not yet complete, queue XAuth/Mode config tasks */
1168 if (this->queued)
1169 {
1170 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
1171 exchange_type_names, TRANSACTION);
1172 return SUCCESS;
1173 }
1174 this->queued = message_create_from_packet(msg->get_packet(msg));
1175 if (this->queued->parse_header(this->queued) != SUCCESS)
1176 {
1177 this->queued->destroy(this->queued);
1178 this->queued = NULL;
1179 return FAILED;
1180 }
1181 DBG1(DBG_IKE, "queueing %N request as tasks still active",
1182 exchange_type_names, TRANSACTION);
1183 return SUCCESS;
1184 }
1185
1186 msg->set_request(msg, TRUE);
1187 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1188 status = parse_message(this, msg);
1189 if (status != SUCCESS)
1190 {
1191 return status;
1192 }
1193 /* if this IKE_SA is virgin, we check for a config */
1194 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1195 {
1196 ike_sa_id_t *ike_sa_id;
1197 ike_cfg_t *ike_cfg;
1198 job_t *job;
1199
1200 ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
1201 if (ike_cfg == NULL)
1202 {
1203 /* no config found for these hosts, destroy */
1204 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1205 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1206 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1207 return DESTROY_ME;
1208 }
1209 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1210 ike_cfg->destroy(ike_cfg);
1211 /* add a timeout if peer does not establish it completely */
1212 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1213 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1214 lib->scheduler->schedule_job(lib->scheduler, job,
1215 lib->settings->get_int(lib->settings,
1216 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1217 charon->name));
1218 }
1219 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1220 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1221 if (process_request(this, msg) != SUCCESS)
1222 {
1223 flush(this);
1224 return DESTROY_ME;
1225 }
1226 this->responding.hash = hash;
1227 }
1228 return SUCCESS;
1229 }
1230
1231 METHOD(task_manager_t, queue_task, void,
1232 private_task_manager_t *this, task_t *task)
1233 {
1234 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1235 this->queued_tasks->insert_last(this->queued_tasks, task);
1236 }
1237
1238 /**
1239 * Check if a given task has been queued already
1240 */
1241 static bool has_queued(private_task_manager_t *this, task_type_t type)
1242 {
1243 enumerator_t *enumerator;
1244 bool found = FALSE;
1245 task_t *task;
1246
1247 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1248 while (enumerator->enumerate(enumerator, &task))
1249 {
1250 if (task->get_type(task) == type)
1251 {
1252 found = TRUE;
1253 break;
1254 }
1255 }
1256 enumerator->destroy(enumerator);
1257 return found;
1258 }
1259
1260 METHOD(task_manager_t, queue_ike, void,
1261 private_task_manager_t *this)
1262 {
1263 peer_cfg_t *peer_cfg;
1264
1265 if (!has_queued(this, TASK_ISAKMP_VENDOR))
1266 {
1267 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1268 }
1269 if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1270 {
1271 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1272 }
1273 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1274 if (peer_cfg->use_aggressive(peer_cfg))
1275 {
1276 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1277 {
1278 queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1279 }
1280 }
1281 else
1282 {
1283 if (!has_queued(this, TASK_MAIN_MODE))
1284 {
1285 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1286 }
1287 }
1288 if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1289 {
1290 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1291 }
1292 if (!has_queued(this, TASK_ISAKMP_NATD))
1293 {
1294 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1295 }
1296 }
1297
1298 METHOD(task_manager_t, queue_ike_reauth, void,
1299 private_task_manager_t *this)
1300 {
1301 enumerator_t *enumerator;
1302 child_sa_t *child_sa;
1303 ike_sa_t *new;
1304 host_t *host;
1305
1306 new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1307 this->ike_sa->get_version(this->ike_sa), TRUE);
1308 if (!new)
1309 { /* shouldn't happen */
1310 return;
1311 }
1312
1313 new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1314 host = this->ike_sa->get_other_host(this->ike_sa);
1315 new->set_other_host(new, host->clone(host));
1316 host = this->ike_sa->get_my_host(this->ike_sa);
1317 new->set_my_host(new, host->clone(host));
1318 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1319 while (enumerator->enumerate(enumerator, &host))
1320 {
1321 new->add_virtual_ip(new, TRUE, host);
1322 }
1323 enumerator->destroy(enumerator);
1324
1325 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1326 while (enumerator->enumerate(enumerator, &child_sa))
1327 {
1328 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1329 new->add_child_sa(new, child_sa);
1330 }
1331 enumerator->destroy(enumerator);
1332
1333 if (!new->get_child_count(new))
1334 { /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1335 task_t *task;
1336
1337 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1338 while (enumerator->enumerate(enumerator, &task))
1339 {
1340 if (task->get_type(task) == TASK_QUICK_MODE)
1341 {
1342 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1343 task->migrate(task, new);
1344 new->queue_task(new, task);
1345 }
1346 }
1347 enumerator->destroy(enumerator);
1348 }
1349
1350 if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1351 {
1352 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1353 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1354 }
1355 else
1356 {
1357 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1358 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1359 }
1360 charon->bus->set_sa(charon->bus, this->ike_sa);
1361 }
1362
1363 METHOD(task_manager_t, queue_ike_rekey, void,
1364 private_task_manager_t *this)
1365 {
1366 queue_ike_reauth(this);
1367 }
1368
1369 METHOD(task_manager_t, queue_ike_delete, void,
1370 private_task_manager_t *this)
1371 {
1372 enumerator_t *enumerator;
1373 child_sa_t *child_sa;
1374
1375 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1376 while (enumerator->enumerate(enumerator, &child_sa))
1377 {
1378 queue_task(this, (task_t*)
1379 quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1380 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1381 }
1382 enumerator->destroy(enumerator);
1383
1384 queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1385 }
1386
1387 METHOD(task_manager_t, queue_mobike, void,
1388 private_task_manager_t *this, bool roam, bool address)
1389 {
1390 /* Not supported in IKEv1 */
1391 }
1392
1393 METHOD(task_manager_t, queue_child, void,
1394 private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1395 traffic_selector_t *tsi, traffic_selector_t *tsr)
1396 {
1397 quick_mode_t *task;
1398
1399 task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1400 task->use_reqid(task, reqid);
1401
1402 queue_task(this, &task->task);
1403 }
1404
1405 /**
1406 * Check if two CHILD_SAs have the same traffic selector
1407 */
1408 static bool have_equal_ts(child_sa_t *a, child_sa_t *b, bool local)
1409 {
1410 linked_list_t *list;
1411 traffic_selector_t *ts_a, *ts_b;
1412
1413 list = a->get_traffic_selectors(a, local);
1414 if (list->get_first(list, (void**)&ts_a) == SUCCESS)
1415 {
1416 list = b->get_traffic_selectors(b, local);
1417 if (list->get_first(list, (void**)&ts_b) == SUCCESS)
1418 {
1419 return ts_a->equals(ts_a, ts_b);
1420 }
1421 }
1422 return FALSE;
1423 }
1424
1425 /**
1426 * Check if a CHILD_SA is redundant and we should delete instead of rekey
1427 */
1428 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1429 {
1430 enumerator_t *enumerator;
1431 child_sa_t *current;
1432 bool redundant = FALSE;
1433
1434 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1435 while (enumerator->enumerate(enumerator, &current))
1436 {
1437 if (current->get_state(current) == CHILD_INSTALLED &&
1438 streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1439 have_equal_ts(current, child_sa, TRUE) &&
1440 have_equal_ts(current, child_sa, FALSE) &&
1441 current->get_lifetime(current, FALSE) >
1442 child_sa->get_lifetime(child_sa, FALSE))
1443 {
1444 DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1445 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
1446 redundant = TRUE;
1447 break;
1448 }
1449 }
1450 enumerator->destroy(enumerator);
1451
1452 return redundant;
1453 }
1454
1455 /**
1456 * Get the first traffic selector of a CHILD_SA, local or remote
1457 */
1458 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1459 {
1460 traffic_selector_t *ts = NULL;
1461 linked_list_t *list;
1462
1463 list = child_sa->get_traffic_selectors(child_sa, local);
1464 if (list->get_first(list, (void**)&ts) == SUCCESS)
1465 {
1466 return ts;
1467 }
1468 return NULL;
1469 }
1470
1471 METHOD(task_manager_t, queue_child_rekey, void,
1472 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1473 {
1474 child_sa_t *child_sa;
1475 child_cfg_t *cfg;
1476 quick_mode_t *task;
1477
1478 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1479 if (!child_sa)
1480 {
1481 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1482 }
1483 if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1484 {
1485 if (is_redundant(this, child_sa))
1486 {
1487 queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1488 protocol, spi, FALSE, FALSE));
1489 }
1490 else
1491 {
1492 child_sa->set_state(child_sa, CHILD_REKEYING);
1493 cfg = child_sa->get_config(child_sa);
1494 task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1495 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1496 task->use_reqid(task, child_sa->get_reqid(child_sa));
1497 task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1498
1499 queue_task(this, &task->task);
1500 }
1501 }
1502 }
1503
1504 METHOD(task_manager_t, queue_child_delete, void,
1505 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1506 bool expired)
1507 {
1508 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1509 spi, FALSE, expired));
1510 }
1511
1512 METHOD(task_manager_t, queue_dpd, void,
1513 private_task_manager_t *this)
1514 {
1515 peer_cfg_t *peer_cfg;
1516 u_int32_t t, retransmit;
1517
1518 queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1519 this->dpd_send++));
1520 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1521
1522 /* compute timeout in milliseconds */
1523 t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1524 if (t == 0)
1525 {
1526 /* use the same timeout as a retransmitting IKE message would have */
1527 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1528 {
1529 t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1530 pow(this->retransmit_base, retransmit));
1531 }
1532 }
1533
1534 /* schedule DPD timeout job */
1535 lib->scheduler->schedule_job_ms(lib->scheduler,
1536 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1537 }
1538
1539 METHOD(task_manager_t, adopt_tasks, void,
1540 private_task_manager_t *this, task_manager_t *other_public)
1541 {
1542 private_task_manager_t *other = (private_task_manager_t*)other_public;
1543 task_t *task;
1544
1545 /* move queued tasks from other to this */
1546 while (other->queued_tasks->remove_last(other->queued_tasks,
1547 (void**)&task) == SUCCESS)
1548 {
1549 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1550 task->migrate(task, this->ike_sa);
1551 this->queued_tasks->insert_first(this->queued_tasks, task);
1552 }
1553 }
1554
1555 METHOD(task_manager_t, busy, bool,
1556 private_task_manager_t *this)
1557 {
1558 return (this->active_tasks->get_count(this->active_tasks) > 0);
1559 }
1560
1561 METHOD(task_manager_t, incr_mid, void,
1562 private_task_manager_t *this, bool initiate)
1563 {
1564 }
1565
1566 METHOD(task_manager_t, reset, void,
1567 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1568 {
1569 enumerator_t *enumerator;
1570 task_t *task;
1571
1572 /* reset message counters and retransmit packets */
1573 DESTROY_IF(this->responding.packet);
1574 DESTROY_IF(this->initiating.packet);
1575 this->responding.packet = NULL;
1576 this->responding.seqnr = RESPONDING_SEQ;
1577 this->responding.retransmitted = 0;
1578 this->initiating.packet = NULL;
1579 this->initiating.mid = 0;
1580 this->initiating.seqnr = 0;
1581 this->initiating.retransmitted = 0;
1582 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1583 if (initiate != UINT_MAX)
1584 {
1585 this->dpd_send = initiate;
1586 }
1587 if (respond != UINT_MAX)
1588 {
1589 this->dpd_recv = respond;
1590 }
1591
1592 /* reset queued tasks */
1593 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1594 while (enumerator->enumerate(enumerator, &task))
1595 {
1596 task->migrate(task, this->ike_sa);
1597 }
1598 enumerator->destroy(enumerator);
1599
1600 /* reset active tasks */
1601 while (this->active_tasks->remove_last(this->active_tasks,
1602 (void**)&task) == SUCCESS)
1603 {
1604 task->migrate(task, this->ike_sa);
1605 this->queued_tasks->insert_first(this->queued_tasks, task);
1606 }
1607 }
1608
1609 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1610 private_task_manager_t *this, task_queue_t queue)
1611 {
1612 switch (queue)
1613 {
1614 case TASK_QUEUE_ACTIVE:
1615 return this->active_tasks->create_enumerator(this->active_tasks);
1616 case TASK_QUEUE_PASSIVE:
1617 return this->passive_tasks->create_enumerator(this->passive_tasks);
1618 case TASK_QUEUE_QUEUED:
1619 return this->queued_tasks->create_enumerator(this->queued_tasks);
1620 default:
1621 return enumerator_create_empty();
1622 }
1623 }
1624
1625 METHOD(task_manager_t, destroy, void,
1626 private_task_manager_t *this)
1627 {
1628 flush(this);
1629
1630 this->active_tasks->destroy(this->active_tasks);
1631 this->queued_tasks->destroy(this->queued_tasks);
1632 this->passive_tasks->destroy(this->passive_tasks);
1633
1634 DESTROY_IF(this->queued);
1635 DESTROY_IF(this->responding.packet);
1636 DESTROY_IF(this->initiating.packet);
1637 DESTROY_IF(this->rng);
1638 free(this);
1639 }
1640
1641 /*
1642 * see header file
1643 */
1644 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1645 {
1646 private_task_manager_t *this;
1647
1648 INIT(this,
1649 .public = {
1650 .task_manager = {
1651 .process_message = _process_message,
1652 .queue_task = _queue_task,
1653 .queue_ike = _queue_ike,
1654 .queue_ike_rekey = _queue_ike_rekey,
1655 .queue_ike_reauth = _queue_ike_reauth,
1656 .queue_ike_delete = _queue_ike_delete,
1657 .queue_mobike = _queue_mobike,
1658 .queue_child = _queue_child,
1659 .queue_child_rekey = _queue_child_rekey,
1660 .queue_child_delete = _queue_child_delete,
1661 .queue_dpd = _queue_dpd,
1662 .initiate = _initiate,
1663 .retransmit = _retransmit,
1664 .incr_mid = _incr_mid,
1665 .reset = _reset,
1666 .adopt_tasks = _adopt_tasks,
1667 .busy = _busy,
1668 .create_task_enumerator = _create_task_enumerator,
1669 .flush_queue = _flush_queue,
1670 .destroy = _destroy,
1671 },
1672 },
1673 .initiating = {
1674 .type = EXCHANGE_TYPE_UNDEFINED,
1675 },
1676 .responding = {
1677 .seqnr = RESPONDING_SEQ,
1678 },
1679 .ike_sa = ike_sa,
1680 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1681 .queued_tasks = linked_list_create(),
1682 .active_tasks = linked_list_create(),
1683 .passive_tasks = linked_list_create(),
1684 .retransmit_tries = lib->settings->get_int(lib->settings,
1685 "%s.retransmit_tries", RETRANSMIT_TRIES, charon->name),
1686 .retransmit_timeout = lib->settings->get_double(lib->settings,
1687 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name),
1688 .retransmit_base = lib->settings->get_double(lib->settings,
1689 "%s.retransmit_base", RETRANSMIT_BASE, charon->name),
1690 );
1691
1692 if (!this->rng)
1693 {
1694 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
1695 destroy(this);
1696 return NULL;
1697 }
1698 if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
1699 (void*)&this->dpd_send))
1700 {
1701 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
1702 destroy(this);
1703 return NULL;
1704 }
1705 this->dpd_send &= 0x7FFFFFFF;
1706
1707 return &this->public;
1708 }
1709