Merge branch 'multi-vip'
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/aggressive_mode.h>
24 #include <sa/ikev1/tasks/quick_mode.h>
25 #include <sa/ikev1/tasks/quick_delete.h>
26 #include <sa/ikev1/tasks/xauth.h>
27 #include <sa/ikev1/tasks/mode_config.h>
28 #include <sa/ikev1/tasks/informational.h>
29 #include <sa/ikev1/tasks/isakmp_natd.h>
30 #include <sa/ikev1/tasks/isakmp_vendor.h>
31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
33 #include <sa/ikev1/tasks/isakmp_delete.h>
34 #include <sa/ikev1/tasks/isakmp_dpd.h>
35
36 #include <processing/jobs/retransmit_job.h>
37 #include <processing/jobs/delete_ike_sa_job.h>
38 #include <processing/jobs/dpd_timeout_job.h>
39
40 /**
41 * Number of old messages hashes we keep for retransmission.
42 *
43 * In Main Mode, we must ignore messages from a previous message pair if
44 * we already continued to the next. Otherwise a late retransmission
45 * could be considered as a reply to the newer request.
46 */
47 #define MAX_OLD_HASHES 2
48
49 /**
50 * First sequence number of responding packets.
51 *
52 * To distinguish retransmission jobs for initiating and responding packets,
53 * we split up the sequence counter and use the upper half for responding.
54 */
55 #define RESPONDING_SEQ INT_MAX
56
57 typedef struct exchange_t exchange_t;
58
59 /**
60 * An exchange in the air, used do detect and handle retransmission
61 */
62 struct exchange_t {
63
64 /**
65 * Message ID used for this transaction
66 */
67 u_int32_t mid;
68
69 /**
70 * generated packet for retransmission
71 */
72 packet_t *packet;
73 };
74
75 typedef struct private_task_manager_t private_task_manager_t;
76
77 /**
78 * private data of the task manager
79 */
80 struct private_task_manager_t {
81
82 /**
83 * public functions
84 */
85 task_manager_v1_t public;
86
87 /**
88 * associated IKE_SA we are serving
89 */
90 ike_sa_t *ike_sa;
91
92 /**
93 * RNG to create message IDs
94 */
95 rng_t *rng;
96
97 /**
98 * Exchange we are currently handling as responder
99 */
100 struct {
101 /**
102 * Message ID of the last response
103 */
104 u_int32_t mid;
105
106 /**
107 * Hash of a previously received message
108 */
109 u_int32_t hash;
110
111 /**
112 * packet for retransmission
113 */
114 packet_t *packet;
115
116 /**
117 * Sequence number of the last sent message
118 */
119 u_int32_t seqnr;
120
121 /**
122 * how many times we have retransmitted so far
123 */
124 u_int retransmitted;
125
126 } responding;
127
128 /**
129 * Exchange we are currently handling as initiator
130 */
131 struct {
132 /**
133 * Message ID of the exchange
134 */
135 u_int32_t mid;
136
137 /**
138 * Hashes of old responses we can ignore
139 */
140 u_int32_t old_hashes[MAX_OLD_HASHES];
141
142 /**
143 * Position in old hash array
144 */
145 int old_hash_pos;
146
147 /**
148 * Sequence number of the last sent message
149 */
150 u_int32_t seqnr;
151
152 /**
153 * how many times we have retransmitted so far
154 */
155 u_int retransmitted;
156
157 /**
158 * packet for retransmission
159 */
160 packet_t *packet;
161
162 /**
163 * type of the initated exchange
164 */
165 exchange_type_t type;
166
167 } initiating;
168
169 /**
170 * List of queued tasks not yet in action
171 */
172 linked_list_t *queued_tasks;
173
174 /**
175 * List of active tasks, initiated by ourselve
176 */
177 linked_list_t *active_tasks;
178
179 /**
180 * List of tasks initiated by peer
181 */
182 linked_list_t *passive_tasks;
183
184 /**
185 * Queued messages not yet ready to process
186 */
187 message_t *queued;
188
189 /**
190 * Number of times we retransmit messages before giving up
191 */
192 u_int retransmit_tries;
193
194 /**
195 * Retransmission timeout
196 */
197 double retransmit_timeout;
198
199 /**
200 * Base to calculate retransmission timeout
201 */
202 double retransmit_base;
203
204 /**
205 * Sequence number for sending DPD requests
206 */
207 u_int32_t dpd_send;
208
209 /**
210 * Sequence number for received DPD requests
211 */
212 u_int32_t dpd_recv;
213 };
214
215 METHOD(task_manager_t, flush_queue, void,
216 private_task_manager_t *this, task_queue_t queue)
217 {
218 linked_list_t *list;
219 task_t *task;
220
221 if (this->queued)
222 {
223 this->queued->destroy(this->queued);
224 this->queued = NULL;
225 }
226 switch (queue)
227 {
228 case TASK_QUEUE_ACTIVE:
229 list = this->active_tasks;
230 /* cancel pending retransmits */
231 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
232 DESTROY_IF(this->initiating.packet);
233 this->initiating.packet = NULL;
234 break;
235 case TASK_QUEUE_PASSIVE:
236 list = this->passive_tasks;
237 break;
238 case TASK_QUEUE_QUEUED:
239 list = this->queued_tasks;
240 break;
241 default:
242 return;
243 }
244 while (list->remove_last(list, (void**)&task) == SUCCESS)
245 {
246 task->destroy(task);
247 }
248 }
249
250 /**
251 * flush all tasks in the task manager
252 */
253 static void flush(private_task_manager_t *this)
254 {
255 flush_queue(this, TASK_QUEUE_QUEUED);
256 flush_queue(this, TASK_QUEUE_PASSIVE);
257 flush_queue(this, TASK_QUEUE_ACTIVE);
258 }
259
260 /**
261 * move a task of a specific type from the queue to the active list
262 */
263 static bool activate_task(private_task_manager_t *this, task_type_t type)
264 {
265 enumerator_t *enumerator;
266 task_t *task;
267 bool found = FALSE;
268
269 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
270 while (enumerator->enumerate(enumerator, (void**)&task))
271 {
272 if (task->get_type(task) == type)
273 {
274 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
275 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
276 this->active_tasks->insert_last(this->active_tasks, task);
277 found = TRUE;
278 break;
279 }
280 }
281 enumerator->destroy(enumerator);
282 return found;
283 }
284
285 /**
286 * Retransmit a packet, either as initiator or as responder
287 */
288 static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
289 u_int mid, u_int retransmitted, packet_t *packet)
290 {
291 u_int32_t t;
292
293 if (retransmitted > this->retransmit_tries)
294 {
295 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
296 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
297 {
298 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
299 }
300 return DESTROY_ME;
301 }
302 t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
303 pow(this->retransmit_base, retransmitted));
304 if (retransmitted)
305 {
306 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
307 retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
308 mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
309 }
310 charon->sender->send(charon->sender, packet->clone(packet));
311 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
312 retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
313 return NEED_MORE;
314 }
315
316 METHOD(task_manager_t, retransmit, status_t,
317 private_task_manager_t *this, u_int32_t seqnr)
318 {
319 status_t status = SUCCESS;
320
321 if (seqnr == this->initiating.seqnr && this->initiating.packet)
322 {
323 status = retransmit_packet(this, seqnr, this->initiating.mid,
324 this->initiating.retransmitted, this->initiating.packet);
325 if (status == NEED_MORE)
326 {
327 this->initiating.retransmitted++;
328 status = SUCCESS;
329 }
330 }
331 if (seqnr == this->responding.seqnr && this->responding.packet)
332 {
333 status = retransmit_packet(this, seqnr, this->responding.mid,
334 this->responding.retransmitted, this->responding.packet);
335 if (status == NEED_MORE)
336 {
337 this->responding.retransmitted++;
338 status = SUCCESS;
339 }
340 }
341 return status;
342 }
343
344 /**
345 * Check if we have to wait for a mode config before starting a quick mode
346 */
347 static bool mode_config_expected(private_task_manager_t *this)
348 {
349 enumerator_t *enumerator;
350 peer_cfg_t *peer_cfg;
351 char *pool;
352 host_t *host;
353
354 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
355 if (peer_cfg)
356 {
357 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
358 if (!enumerator->enumerate(enumerator, &pool))
359 { /* no pool configured */
360 enumerator->destroy(enumerator);
361 return FALSE;
362 }
363 enumerator->destroy(enumerator);
364
365 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
366 FALSE);
367 if (!enumerator->enumerate(enumerator, &host))
368 { /* have a pool, but no VIP assigned yet */
369 enumerator->destroy(enumerator);
370 return TRUE;
371 }
372 enumerator->destroy(enumerator);
373 }
374 return FALSE;
375 }
376
377 METHOD(task_manager_t, initiate, status_t,
378 private_task_manager_t *this)
379 {
380 enumerator_t *enumerator;
381 task_t *task;
382 message_t *message;
383 host_t *me, *other;
384 status_t status;
385 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
386 bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
387
388 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
389 this->initiating.type != INFORMATIONAL_V1)
390 {
391 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
392 exchange_type_names, this->initiating.type);
393 /* do not initiate if we already have a message in the air */
394 return SUCCESS;
395 }
396
397 if (this->active_tasks->get_count(this->active_tasks) == 0)
398 {
399 DBG2(DBG_IKE, "activating new tasks");
400 switch (this->ike_sa->get_state(this->ike_sa))
401 {
402 case IKE_CREATED:
403 activate_task(this, TASK_ISAKMP_VENDOR);
404 activate_task(this, TASK_ISAKMP_CERT_PRE);
405 if (activate_task(this, TASK_MAIN_MODE))
406 {
407 exchange = ID_PROT;
408 }
409 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
410 {
411 exchange = AGGRESSIVE;
412 }
413 activate_task(this, TASK_ISAKMP_CERT_POST);
414 activate_task(this, TASK_ISAKMP_NATD);
415 break;
416 case IKE_CONNECTING:
417 if (activate_task(this, TASK_ISAKMP_DELETE))
418 {
419 exchange = INFORMATIONAL_V1;
420 new_mid = TRUE;
421 break;
422 }
423 if (activate_task(this, TASK_XAUTH))
424 {
425 exchange = TRANSACTION;
426 new_mid = TRUE;
427 break;
428 }
429 if (activate_task(this, TASK_INFORMATIONAL))
430 {
431 exchange = INFORMATIONAL_V1;
432 new_mid = TRUE;
433 break;
434 }
435 break;
436 case IKE_ESTABLISHED:
437 if (activate_task(this, TASK_MODE_CONFIG))
438 {
439 exchange = TRANSACTION;
440 new_mid = TRUE;
441 break;
442 }
443 if (!mode_config_expected(this) &&
444 activate_task(this, TASK_QUICK_MODE))
445 {
446 exchange = QUICK_MODE;
447 new_mid = TRUE;
448 break;
449 }
450 if (activate_task(this, TASK_INFORMATIONAL))
451 {
452 exchange = INFORMATIONAL_V1;
453 new_mid = TRUE;
454 break;
455 }
456 if (activate_task(this, TASK_QUICK_DELETE))
457 {
458 exchange = INFORMATIONAL_V1;
459 new_mid = TRUE;
460 break;
461 }
462 if (activate_task(this, TASK_ISAKMP_DELETE))
463 {
464 exchange = INFORMATIONAL_V1;
465 new_mid = TRUE;
466 break;
467 }
468 if (activate_task(this, TASK_ISAKMP_DPD))
469 {
470 exchange = INFORMATIONAL_V1;
471 new_mid = TRUE;
472 break;
473 }
474 break;
475 default:
476 break;
477 }
478 }
479 else
480 {
481 DBG2(DBG_IKE, "reinitiating already active tasks");
482 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
483 while (enumerator->enumerate(enumerator, (void**)&task))
484 {
485 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
486 switch (task->get_type(task))
487 {
488 case TASK_MAIN_MODE:
489 exchange = ID_PROT;
490 break;
491 case TASK_AGGRESSIVE_MODE:
492 exchange = AGGRESSIVE;
493 break;
494 case TASK_QUICK_MODE:
495 exchange = QUICK_MODE;
496 break;
497 case TASK_XAUTH:
498 exchange = TRANSACTION;
499 new_mid = TRUE;
500 break;
501 default:
502 continue;
503 }
504 break;
505 }
506 enumerator->destroy(enumerator);
507 }
508
509 if (exchange == EXCHANGE_TYPE_UNDEFINED)
510 {
511 DBG2(DBG_IKE, "nothing to initiate");
512 /* nothing to do yet... */
513 return SUCCESS;
514 }
515
516 me = this->ike_sa->get_my_host(this->ike_sa);
517 other = this->ike_sa->get_other_host(this->ike_sa);
518
519 if (new_mid)
520 {
521 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
522 (void*)&this->initiating.mid))
523 {
524 DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
525 flush(this);
526 return DESTROY_ME;
527 }
528 }
529 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
530 message->set_message_id(message, this->initiating.mid);
531 message->set_source(message, me->clone(me));
532 message->set_destination(message, other->clone(other));
533 message->set_exchange_type(message, exchange);
534 this->initiating.type = exchange;
535 this->initiating.retransmitted = 0;
536
537 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
538 while (enumerator->enumerate(enumerator, (void*)&task))
539 {
540 switch (task->build(task, message))
541 {
542 case SUCCESS:
543 /* task completed, remove it */
544 this->active_tasks->remove_at(this->active_tasks, enumerator);
545 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
546 task->get_type(task) == TASK_QUICK_MODE)
547 { /* last message of three message exchange */
548 keep = TRUE;
549 }
550 task->destroy(task);
551 continue;
552 case NEED_MORE:
553 expect_response = TRUE;
554 /* processed, but task needs another exchange */
555 continue;
556 case ALREADY_DONE:
557 cancelled = TRUE;
558 break;
559 case FAILED:
560 default:
561 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
562 {
563 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
564 }
565 /* FALL */
566 case DESTROY_ME:
567 /* critical failure, destroy IKE_SA */
568 enumerator->destroy(enumerator);
569 message->destroy(message);
570 flush(this);
571 return DESTROY_ME;
572 }
573 break;
574 }
575 enumerator->destroy(enumerator);
576
577 if (this->active_tasks->get_count(this->active_tasks) == 0 &&
578 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
579 { /* tasks completed, no exchange active anymore */
580 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
581 }
582 if (cancelled)
583 {
584 message->destroy(message);
585 return initiate(this);
586 }
587
588 DESTROY_IF(this->initiating.packet);
589 status = this->ike_sa->generate_message(this->ike_sa, message,
590 &this->initiating.packet);
591 if (status != SUCCESS)
592 {
593 /* message generation failed. There is nothing more to do than to
594 * close the SA */
595 message->destroy(message);
596 flush(this);
597 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
598 return DESTROY_ME;
599 }
600
601 this->initiating.seqnr++;
602 if (expect_response )
603 {
604 message->destroy(message);
605 return retransmit(this, this->initiating.seqnr);
606 }
607 if (keep)
608 { /* keep the packet for retransmission, the responder might request it */
609 charon->sender->send(charon->sender,
610 this->initiating.packet->clone(this->initiating.packet));
611 }
612 else
613 {
614 charon->sender->send(charon->sender, this->initiating.packet);
615 this->initiating.packet = NULL;
616 }
617 message->destroy(message);
618
619 if (exchange == INFORMATIONAL_V1)
620 {
621 switch (this->ike_sa->get_state(this->ike_sa))
622 {
623 case IKE_CONNECTING:
624 /* close after sending an INFORMATIONAL when unestablished */
625 return FAILED;
626 case IKE_DELETING:
627 /* close after sending a DELETE */
628 return DESTROY_ME;
629 default:
630 break;
631 }
632 }
633 return initiate(this);
634 }
635
636 /**
637 * build a response depending on the "passive" task list
638 */
639 static status_t build_response(private_task_manager_t *this, message_t *request)
640 {
641 enumerator_t *enumerator;
642 task_t *task;
643 message_t *message;
644 host_t *me, *other;
645 bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
646 status_t status;
647
648 me = request->get_destination(request);
649 other = request->get_source(request);
650
651 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
652 message->set_exchange_type(message, request->get_exchange_type(request));
653 /* send response along the path the request came in */
654 message->set_source(message, me->clone(me));
655 message->set_destination(message, other->clone(other));
656 message->set_message_id(message, request->get_message_id(request));
657 message->set_request(message, FALSE);
658
659 this->responding.mid = request->get_message_id(request);
660 this->responding.retransmitted = 0;
661 this->responding.seqnr++;
662
663 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
664 while (enumerator->enumerate(enumerator, (void*)&task))
665 {
666 switch (task->build(task, message))
667 {
668 case SUCCESS:
669 /* task completed, remove it */
670 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
671 task->destroy(task);
672 continue;
673 case NEED_MORE:
674 /* processed, but task needs another exchange */
675 if (task->get_type(task) == TASK_QUICK_MODE ||
676 task->get_type(task) == TASK_AGGRESSIVE_MODE)
677 { /* we rely on initiator retransmission, except for
678 * three-message exchanges */
679 expect_request = TRUE;
680 }
681 continue;
682 case ALREADY_DONE:
683 cancelled = TRUE;
684 break;
685 case FAILED:
686 default:
687 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
688 /* FALL */
689 case DESTROY_ME:
690 /* destroy IKE_SA, but SEND response first */
691 delete = TRUE;
692 break;
693 }
694 break;
695 }
696 enumerator->destroy(enumerator);
697
698 DESTROY_IF(this->responding.packet);
699 this->responding.packet = NULL;
700 if (cancelled)
701 {
702 message->destroy(message);
703 return initiate(this);
704 }
705 status = this->ike_sa->generate_message(this->ike_sa, message,
706 &this->responding.packet);
707 message->destroy(message);
708 if (status != SUCCESS)
709 {
710 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
711 return DESTROY_ME;
712 }
713
714 if (expect_request && !delete)
715 {
716 return retransmit(this, this->responding.seqnr);
717 }
718 charon->sender->send(charon->sender,
719 this->responding.packet->clone(this->responding.packet));
720 if (delete)
721 {
722 return DESTROY_ME;
723 }
724 return SUCCESS;
725 }
726
727 /**
728 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
729 * The notify protocol_id is set to ISAKMP
730 */
731 static void send_notify(private_task_manager_t *this, message_t *request,
732 notify_type_t type)
733 {
734 message_t *response;
735 packet_t *packet;
736 host_t *me, *other;
737 u_int32_t mid;
738
739 if (request && request->get_exchange_type(request) == INFORMATIONAL_V1)
740 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
741 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
742 return;
743 }
744 if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
745 {
746 DBG1(DBG_IKE, "failed to allocate message ID");
747 return;
748 }
749 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
750 response->set_exchange_type(response, INFORMATIONAL_V1);
751 response->set_request(response, TRUE);
752 response->set_message_id(response, mid);
753 response->add_payload(response, (payload_t*)
754 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
755 PROTO_IKE, type));
756
757 me = this->ike_sa->get_my_host(this->ike_sa);
758 if (me->is_anyaddr(me))
759 {
760 me = request->get_destination(request);
761 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
762 }
763 other = this->ike_sa->get_other_host(this->ike_sa);
764 if (other->is_anyaddr(other))
765 {
766 other = request->get_source(request);
767 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
768 }
769 response->set_source(response, me->clone(me));
770 response->set_destination(response, other->clone(other));
771 if (this->ike_sa->generate_message(this->ike_sa, response,
772 &packet) == SUCCESS)
773 {
774 charon->sender->send(charon->sender, packet);
775 }
776 response->destroy(response);
777 }
778
779 /**
780 * Process a DPD request/response
781 */
782 static bool process_dpd(private_task_manager_t *this, message_t *message)
783 {
784 notify_payload_t *notify;
785 notify_type_t type;
786 u_int32_t seq;
787 chunk_t data;
788
789 type = DPD_R_U_THERE;
790 notify = message->get_notify(message, type);
791 if (!notify)
792 {
793 type = DPD_R_U_THERE_ACK;
794 notify = message->get_notify(message, type);
795 }
796 if (!notify)
797 {
798 return FALSE;
799 }
800 data = notify->get_notification_data(notify);
801 if (data.len != 4)
802 {
803 return FALSE;
804 }
805 seq = untoh32(data.ptr);
806
807 if (type == DPD_R_U_THERE)
808 {
809 if (this->dpd_recv == 0 || seq == this->dpd_recv)
810 { /* check sequence validity */
811 this->dpd_recv = seq + 1;
812 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
813 time_monotonic(NULL));
814 }
815 /* but respond anyway */
816 this->ike_sa->queue_task(this->ike_sa,
817 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
818 }
819 else /* DPD_R_U_THERE_ACK */
820 {
821 if (seq == this->dpd_send - 1)
822 {
823 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
824 time_monotonic(NULL));
825 }
826 else
827 {
828 DBG1(DBG_IKE, "received invalid DPD sequence number %u "
829 "(expected %u), ignored", seq, this->dpd_send - 1);
830 }
831 }
832 return TRUE;
833 }
834
835 /**
836 * handle an incoming request message
837 */
838 static status_t process_request(private_task_manager_t *this,
839 message_t *message)
840 {
841 enumerator_t *enumerator;
842 task_t *task = NULL;
843 bool send_response = FALSE, dpd = FALSE;
844
845 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
846 this->passive_tasks->get_count(this->passive_tasks) == 0)
847 { /* create tasks depending on request type, if not already some queued */
848 switch (message->get_exchange_type(message))
849 {
850 case ID_PROT:
851 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
852 this->passive_tasks->insert_last(this->passive_tasks, task);
853 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
854 this->passive_tasks->insert_last(this->passive_tasks, task);
855 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
856 this->passive_tasks->insert_last(this->passive_tasks, task);
857 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
858 this->passive_tasks->insert_last(this->passive_tasks, task);
859 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
860 this->passive_tasks->insert_last(this->passive_tasks, task);
861 break;
862 case AGGRESSIVE:
863 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
864 this->passive_tasks->insert_last(this->passive_tasks, task);
865 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
866 this->passive_tasks->insert_last(this->passive_tasks, task);
867 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
868 this->passive_tasks->insert_last(this->passive_tasks, task);
869 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
870 this->passive_tasks->insert_last(this->passive_tasks, task);
871 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
872 this->passive_tasks->insert_last(this->passive_tasks, task);
873 break;
874 case QUICK_MODE:
875 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
876 {
877 DBG1(DBG_IKE, "received quick mode request for "
878 "unestablished IKE_SA, ignored");
879 return FAILED;
880 }
881 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
882 NULL, NULL);
883 this->passive_tasks->insert_last(this->passive_tasks, task);
884 break;
885 case INFORMATIONAL_V1:
886 if (process_dpd(this, message))
887 {
888 dpd = TRUE;
889 }
890 else
891 {
892 task = (task_t *)informational_create(this->ike_sa, NULL);
893 this->passive_tasks->insert_first(this->passive_tasks, task);
894 }
895 break;
896 case TRANSACTION:
897 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
898 {
899 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
900 }
901 else
902 {
903 task = (task_t *)xauth_create(this->ike_sa, FALSE);
904 }
905 this->passive_tasks->insert_last(this->passive_tasks, task);
906 break;
907 default:
908 return FAILED;
909 }
910 }
911 if (dpd)
912 {
913 return initiate(this);
914 }
915 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
916
917 /* let the tasks process the message */
918 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
919 while (enumerator->enumerate(enumerator, (void*)&task))
920 {
921 switch (task->process(task, message))
922 {
923 case SUCCESS:
924 /* task completed, remove it */
925 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
926 task->destroy(task);
927 continue;
928 case NEED_MORE:
929 /* processed, but task needs at least another call to build() */
930 send_response = TRUE;
931 continue;
932 case ALREADY_DONE:
933 send_response = FALSE;
934 break;
935 case FAILED:
936 default:
937 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
938 /* FALL */
939 case DESTROY_ME:
940 /* critical failure, destroy IKE_SA */
941 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
942 enumerator->destroy(enumerator);
943 task->destroy(task);
944 return DESTROY_ME;
945 }
946 break;
947 }
948 enumerator->destroy(enumerator);
949
950 if (send_response)
951 {
952 if (build_response(this, message) != SUCCESS)
953 {
954 return DESTROY_ME;
955 }
956 }
957 else
958 { /* We don't send a response, so don't retransmit one if we get
959 * the same message again. */
960 DESTROY_IF(this->responding.packet);
961 this->responding.packet = NULL;
962 }
963 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
964 this->queued_tasks->get_count(this->queued_tasks) > 0)
965 {
966 /* passive tasks completed, check if an active task has been queued,
967 * such as XAUTH or modeconfig push */
968 return initiate(this);
969 }
970 return SUCCESS;
971 }
972
973 /**
974 * handle an incoming response message
975 */
976 static status_t process_response(private_task_manager_t *this,
977 message_t *message)
978 {
979 enumerator_t *enumerator;
980 message_t *queued;
981 status_t status;
982 task_t *task;
983
984 if (message->get_exchange_type(message) != this->initiating.type)
985 {
986 DBG1(DBG_IKE, "received %N response, but expected %N",
987 exchange_type_names, message->get_exchange_type(message),
988 exchange_type_names, this->initiating.type);
989 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
990 return DESTROY_ME;
991 }
992
993 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
994 while (enumerator->enumerate(enumerator, (void*)&task))
995 {
996 switch (task->process(task, message))
997 {
998 case SUCCESS:
999 /* task completed, remove it */
1000 this->active_tasks->remove_at(this->active_tasks, enumerator);
1001 task->destroy(task);
1002 continue;
1003 case NEED_MORE:
1004 /* processed, but task needs another exchange */
1005 continue;
1006 case ALREADY_DONE:
1007 break;
1008 case FAILED:
1009 default:
1010 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1011 /* FALL */
1012 case DESTROY_ME:
1013 /* critical failure, destroy IKE_SA */
1014 this->active_tasks->remove_at(this->active_tasks, enumerator);
1015 enumerator->destroy(enumerator);
1016 task->destroy(task);
1017 return DESTROY_ME;
1018 }
1019 break;
1020 }
1021 enumerator->destroy(enumerator);
1022
1023 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1024 DESTROY_IF(this->initiating.packet);
1025 this->initiating.packet = NULL;
1026
1027 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
1028 {
1029 queued = this->queued;
1030 this->queued = NULL;
1031 status = this->public.task_manager.process_message(
1032 &this->public.task_manager, queued);
1033 queued->destroy(queued);
1034 if (status == DESTROY_ME)
1035 {
1036 return status;
1037 }
1038 }
1039
1040 return initiate(this);
1041 }
1042
1043 /**
1044 * Parse the given message and verify that it is valid.
1045 */
1046 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1047 {
1048 status_t status;
1049
1050 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1051
1052 if (status != SUCCESS)
1053 {
1054 switch (status)
1055 {
1056 case NOT_SUPPORTED:
1057 DBG1(DBG_IKE, "unsupported exchange type");
1058 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1059 break;
1060 case PARSE_ERROR:
1061 DBG1(DBG_IKE, "message parsing failed");
1062 send_notify(this, msg, PAYLOAD_MALFORMED);
1063 break;
1064 case VERIFY_ERROR:
1065 DBG1(DBG_IKE, "message verification failed");
1066 send_notify(this, msg, PAYLOAD_MALFORMED);
1067 break;
1068 case FAILED:
1069 DBG1(DBG_IKE, "integrity check failed");
1070 send_notify(this, msg, INVALID_HASH_INFORMATION);
1071 break;
1072 case INVALID_STATE:
1073 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1074 send_notify(this, msg, PAYLOAD_MALFORMED);
1075 default:
1076 break;
1077 }
1078 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1079 exchange_type_names, msg->get_exchange_type(msg),
1080 msg->get_request(msg) ? "request" : "response",
1081 msg->get_message_id(msg));
1082
1083 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1084 { /* invalid initiation attempt, close SA */
1085 return DESTROY_ME;
1086 }
1087 }
1088 return status;
1089 }
1090
1091 METHOD(task_manager_t, process_message, status_t,
1092 private_task_manager_t *this, message_t *msg)
1093 {
1094 u_int32_t hash, mid, i;
1095 host_t *me, *other;
1096 status_t status;
1097
1098 /* TODO-IKEv1: update hosts more selectively */
1099 me = msg->get_destination(msg);
1100 other = msg->get_source(msg);
1101 mid = msg->get_message_id(msg);
1102 hash = chunk_hash(msg->get_packet_data(msg));
1103 for (i = 0; i < MAX_OLD_HASHES; i++)
1104 {
1105 if (this->initiating.old_hashes[i] == hash)
1106 {
1107 if (this->initiating.packet &&
1108 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1109 (msg->get_exchange_type(msg) == QUICK_MODE ||
1110 msg->get_exchange_type(msg) == AGGRESSIVE))
1111 {
1112 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1113 "resending last request", mid);
1114 charon->sender->send(charon->sender,
1115 this->initiating.packet->clone(this->initiating.packet));
1116 return SUCCESS;
1117 }
1118 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1119 "but next request already sent", mid);
1120 return SUCCESS;
1121 }
1122 }
1123
1124 if ((mid && mid == this->initiating.mid) ||
1125 (this->initiating.mid == 0 &&
1126 msg->get_exchange_type(msg) == this->initiating.type &&
1127 this->active_tasks->get_count(this->active_tasks)))
1128 {
1129 msg->set_request(msg, FALSE);
1130 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1131 status = parse_message(this, msg);
1132 if (status != SUCCESS)
1133 {
1134 return status;
1135 }
1136 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1137 time_monotonic(NULL));
1138 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1139 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1140 if (process_response(this, msg) != SUCCESS)
1141 {
1142 flush(this);
1143 return DESTROY_ME;
1144 }
1145 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1146 MAX_OLD_HASHES] = hash;
1147 }
1148 else
1149 {
1150 if (hash == this->responding.hash)
1151 {
1152 if (this->responding.packet)
1153 {
1154 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1155 "retransmitting response", mid);
1156 charon->sender->send(charon->sender,
1157 this->responding.packet->clone(this->responding.packet));
1158 }
1159 else if (this->initiating.packet &&
1160 this->initiating.type == INFORMATIONAL_V1)
1161 {
1162 DBG1(DBG_IKE, "received retransmit of DPD request, "
1163 "retransmitting response");
1164 charon->sender->send(charon->sender,
1165 this->initiating.packet->clone(this->initiating.packet));
1166 }
1167 else
1168 {
1169 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1170 "but no response to retransmit", mid);
1171 }
1172 return SUCCESS;
1173 }
1174 if (msg->get_exchange_type(msg) == TRANSACTION &&
1175 this->active_tasks->get_count(this->active_tasks))
1176 { /* main mode not yet complete, queue XAuth/Mode config tasks */
1177 if (this->queued)
1178 {
1179 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
1180 exchange_type_names, TRANSACTION);
1181 return SUCCESS;
1182 }
1183 this->queued = message_create_from_packet(msg->get_packet(msg));
1184 if (this->queued->parse_header(this->queued) != SUCCESS)
1185 {
1186 this->queued->destroy(this->queued);
1187 this->queued = NULL;
1188 return FAILED;
1189 }
1190 DBG1(DBG_IKE, "queueing %N request as tasks still active",
1191 exchange_type_names, TRANSACTION);
1192 return SUCCESS;
1193 }
1194
1195 msg->set_request(msg, TRUE);
1196 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1197 status = parse_message(this, msg);
1198 if (status != SUCCESS)
1199 {
1200 return status;
1201 }
1202 /* if this IKE_SA is virgin, we check for a config */
1203 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1204 {
1205 ike_sa_id_t *ike_sa_id;
1206 ike_cfg_t *ike_cfg;
1207 job_t *job;
1208
1209 ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
1210 if (ike_cfg == NULL)
1211 {
1212 /* no config found for these hosts, destroy */
1213 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1214 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1215 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1216 return DESTROY_ME;
1217 }
1218 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1219 ike_cfg->destroy(ike_cfg);
1220 /* add a timeout if peer does not establish it completely */
1221 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1222 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1223 lib->scheduler->schedule_job(lib->scheduler, job,
1224 lib->settings->get_int(lib->settings,
1225 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1226 charon->name));
1227 }
1228 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1229 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1230 if (process_request(this, msg) != SUCCESS)
1231 {
1232 flush(this);
1233 return DESTROY_ME;
1234 }
1235 this->responding.hash = hash;
1236 }
1237 return SUCCESS;
1238 }
1239
1240 METHOD(task_manager_t, queue_task, void,
1241 private_task_manager_t *this, task_t *task)
1242 {
1243 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1244 this->queued_tasks->insert_last(this->queued_tasks, task);
1245 }
1246
1247 /**
1248 * Check if a given task has been queued already
1249 */
1250 static bool has_queued(private_task_manager_t *this, task_type_t type)
1251 {
1252 enumerator_t *enumerator;
1253 bool found = FALSE;
1254 task_t *task;
1255
1256 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1257 while (enumerator->enumerate(enumerator, &task))
1258 {
1259 if (task->get_type(task) == type)
1260 {
1261 found = TRUE;
1262 break;
1263 }
1264 }
1265 enumerator->destroy(enumerator);
1266 return found;
1267 }
1268
1269 METHOD(task_manager_t, queue_ike, void,
1270 private_task_manager_t *this)
1271 {
1272 peer_cfg_t *peer_cfg;
1273
1274 if (!has_queued(this, TASK_ISAKMP_VENDOR))
1275 {
1276 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1277 }
1278 if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1279 {
1280 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1281 }
1282 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1283 if (peer_cfg->use_aggressive(peer_cfg))
1284 {
1285 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1286 {
1287 queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1288 }
1289 }
1290 else
1291 {
1292 if (!has_queued(this, TASK_MAIN_MODE))
1293 {
1294 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1295 }
1296 }
1297 if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1298 {
1299 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1300 }
1301 if (!has_queued(this, TASK_ISAKMP_NATD))
1302 {
1303 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1304 }
1305 }
1306
1307 METHOD(task_manager_t, queue_ike_reauth, void,
1308 private_task_manager_t *this)
1309 {
1310 enumerator_t *enumerator;
1311 child_sa_t *child_sa;
1312 ike_sa_t *new;
1313 host_t *host;
1314
1315 new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1316 this->ike_sa->get_version(this->ike_sa), TRUE);
1317 if (!new)
1318 { /* shouldn't happen */
1319 return;
1320 }
1321
1322 new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1323 host = this->ike_sa->get_other_host(this->ike_sa);
1324 new->set_other_host(new, host->clone(host));
1325 host = this->ike_sa->get_my_host(this->ike_sa);
1326 new->set_my_host(new, host->clone(host));
1327 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1328 while (enumerator->enumerate(enumerator, &host))
1329 {
1330 new->add_virtual_ip(new, TRUE, host);
1331 }
1332 enumerator->destroy(enumerator);
1333
1334 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1335 while (enumerator->enumerate(enumerator, &child_sa))
1336 {
1337 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1338 new->add_child_sa(new, child_sa);
1339 }
1340 enumerator->destroy(enumerator);
1341
1342 if (!new->get_child_count(new))
1343 { /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1344 task_t *task;
1345
1346 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1347 while (enumerator->enumerate(enumerator, &task))
1348 {
1349 if (task->get_type(task) == TASK_QUICK_MODE)
1350 {
1351 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1352 task->migrate(task, new);
1353 new->queue_task(new, task);
1354 }
1355 }
1356 enumerator->destroy(enumerator);
1357 }
1358
1359 if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1360 {
1361 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1362 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1363 }
1364 else
1365 {
1366 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1367 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1368 }
1369 charon->bus->set_sa(charon->bus, this->ike_sa);
1370 }
1371
1372 METHOD(task_manager_t, queue_ike_rekey, void,
1373 private_task_manager_t *this)
1374 {
1375 queue_ike_reauth(this);
1376 }
1377
1378 METHOD(task_manager_t, queue_ike_delete, void,
1379 private_task_manager_t *this)
1380 {
1381 enumerator_t *enumerator;
1382 child_sa_t *child_sa;
1383
1384 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1385 while (enumerator->enumerate(enumerator, &child_sa))
1386 {
1387 queue_task(this, (task_t*)
1388 quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1389 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1390 }
1391 enumerator->destroy(enumerator);
1392
1393 queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1394 }
1395
1396 METHOD(task_manager_t, queue_mobike, void,
1397 private_task_manager_t *this, bool roam, bool address)
1398 {
1399 /* Not supported in IKEv1 */
1400 }
1401
1402 METHOD(task_manager_t, queue_child, void,
1403 private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1404 traffic_selector_t *tsi, traffic_selector_t *tsr)
1405 {
1406 quick_mode_t *task;
1407
1408 task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1409 task->use_reqid(task, reqid);
1410
1411 queue_task(this, &task->task);
1412 }
1413
1414 /**
1415 * Check if two CHILD_SAs have the same traffic selector
1416 */
1417 static bool have_equal_ts(child_sa_t *a, child_sa_t *b, bool local)
1418 {
1419 linked_list_t *list;
1420 traffic_selector_t *ts_a, *ts_b;
1421
1422 list = a->get_traffic_selectors(a, local);
1423 if (list->get_first(list, (void**)&ts_a) == SUCCESS)
1424 {
1425 list = b->get_traffic_selectors(b, local);
1426 if (list->get_first(list, (void**)&ts_b) == SUCCESS)
1427 {
1428 return ts_a->equals(ts_a, ts_b);
1429 }
1430 }
1431 return FALSE;
1432 }
1433
1434 /**
1435 * Check if a CHILD_SA is redundant and we should delete instead of rekey
1436 */
1437 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1438 {
1439 enumerator_t *enumerator;
1440 child_sa_t *current;
1441 bool redundant = FALSE;
1442
1443 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1444 while (enumerator->enumerate(enumerator, &current))
1445 {
1446 if (current->get_state(current) == CHILD_INSTALLED &&
1447 streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1448 have_equal_ts(current, child_sa, TRUE) &&
1449 have_equal_ts(current, child_sa, FALSE) &&
1450 current->get_lifetime(current, FALSE) >
1451 child_sa->get_lifetime(child_sa, FALSE))
1452 {
1453 DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1454 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
1455 redundant = TRUE;
1456 break;
1457 }
1458 }
1459 enumerator->destroy(enumerator);
1460
1461 return redundant;
1462 }
1463
1464 /**
1465 * Get the first traffic selector of a CHILD_SA, local or remote
1466 */
1467 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1468 {
1469 traffic_selector_t *ts = NULL;
1470 linked_list_t *list;
1471
1472 list = child_sa->get_traffic_selectors(child_sa, local);
1473 if (list->get_first(list, (void**)&ts) == SUCCESS)
1474 {
1475 return ts;
1476 }
1477 return NULL;
1478 }
1479
1480 METHOD(task_manager_t, queue_child_rekey, void,
1481 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1482 {
1483 child_sa_t *child_sa;
1484 child_cfg_t *cfg;
1485 quick_mode_t *task;
1486
1487 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1488 if (!child_sa)
1489 {
1490 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1491 }
1492 if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1493 {
1494 if (is_redundant(this, child_sa))
1495 {
1496 queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1497 protocol, spi, FALSE, FALSE));
1498 }
1499 else
1500 {
1501 child_sa->set_state(child_sa, CHILD_REKEYING);
1502 cfg = child_sa->get_config(child_sa);
1503 task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1504 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1505 task->use_reqid(task, child_sa->get_reqid(child_sa));
1506 task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1507
1508 queue_task(this, &task->task);
1509 }
1510 }
1511 }
1512
1513 METHOD(task_manager_t, queue_child_delete, void,
1514 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1515 bool expired)
1516 {
1517 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1518 spi, FALSE, expired));
1519 }
1520
1521 METHOD(task_manager_t, queue_dpd, void,
1522 private_task_manager_t *this)
1523 {
1524 peer_cfg_t *peer_cfg;
1525 u_int32_t t, retransmit;
1526
1527 queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1528 this->dpd_send++));
1529 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1530
1531 /* compute timeout in milliseconds */
1532 t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1533 if (t == 0)
1534 {
1535 /* use the same timeout as a retransmitting IKE message would have */
1536 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1537 {
1538 t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1539 pow(this->retransmit_base, retransmit));
1540 }
1541 }
1542
1543 /* schedule DPD timeout job */
1544 lib->scheduler->schedule_job_ms(lib->scheduler,
1545 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1546 }
1547
1548 METHOD(task_manager_t, adopt_tasks, void,
1549 private_task_manager_t *this, task_manager_t *other_public)
1550 {
1551 private_task_manager_t *other = (private_task_manager_t*)other_public;
1552 task_t *task;
1553
1554 /* move queued tasks from other to this */
1555 while (other->queued_tasks->remove_last(other->queued_tasks,
1556 (void**)&task) == SUCCESS)
1557 {
1558 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1559 task->migrate(task, this->ike_sa);
1560 this->queued_tasks->insert_first(this->queued_tasks, task);
1561 }
1562 }
1563
1564 METHOD(task_manager_t, busy, bool,
1565 private_task_manager_t *this)
1566 {
1567 return (this->active_tasks->get_count(this->active_tasks) > 0);
1568 }
1569
1570 METHOD(task_manager_t, incr_mid, void,
1571 private_task_manager_t *this, bool initiate)
1572 {
1573 }
1574
1575 METHOD(task_manager_t, reset, void,
1576 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1577 {
1578 enumerator_t *enumerator;
1579 task_t *task;
1580
1581 /* reset message counters and retransmit packets */
1582 DESTROY_IF(this->responding.packet);
1583 DESTROY_IF(this->initiating.packet);
1584 this->responding.packet = NULL;
1585 this->responding.seqnr = RESPONDING_SEQ;
1586 this->responding.retransmitted = 0;
1587 this->initiating.packet = NULL;
1588 this->initiating.mid = 0;
1589 this->initiating.seqnr = 0;
1590 this->initiating.retransmitted = 0;
1591 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1592 if (initiate != UINT_MAX)
1593 {
1594 this->dpd_send = initiate;
1595 }
1596 if (respond != UINT_MAX)
1597 {
1598 this->dpd_recv = respond;
1599 }
1600
1601 /* reset queued tasks */
1602 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1603 while (enumerator->enumerate(enumerator, &task))
1604 {
1605 task->migrate(task, this->ike_sa);
1606 }
1607 enumerator->destroy(enumerator);
1608
1609 /* reset active tasks */
1610 while (this->active_tasks->remove_last(this->active_tasks,
1611 (void**)&task) == SUCCESS)
1612 {
1613 task->migrate(task, this->ike_sa);
1614 this->queued_tasks->insert_first(this->queued_tasks, task);
1615 }
1616 }
1617
1618 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1619 private_task_manager_t *this, task_queue_t queue)
1620 {
1621 switch (queue)
1622 {
1623 case TASK_QUEUE_ACTIVE:
1624 return this->active_tasks->create_enumerator(this->active_tasks);
1625 case TASK_QUEUE_PASSIVE:
1626 return this->passive_tasks->create_enumerator(this->passive_tasks);
1627 case TASK_QUEUE_QUEUED:
1628 return this->queued_tasks->create_enumerator(this->queued_tasks);
1629 default:
1630 return enumerator_create_empty();
1631 }
1632 }
1633
1634 METHOD(task_manager_t, destroy, void,
1635 private_task_manager_t *this)
1636 {
1637 flush(this);
1638
1639 this->active_tasks->destroy(this->active_tasks);
1640 this->queued_tasks->destroy(this->queued_tasks);
1641 this->passive_tasks->destroy(this->passive_tasks);
1642
1643 DESTROY_IF(this->queued);
1644 DESTROY_IF(this->responding.packet);
1645 DESTROY_IF(this->initiating.packet);
1646 DESTROY_IF(this->rng);
1647 free(this);
1648 }
1649
1650 /*
1651 * see header file
1652 */
1653 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1654 {
1655 private_task_manager_t *this;
1656
1657 INIT(this,
1658 .public = {
1659 .task_manager = {
1660 .process_message = _process_message,
1661 .queue_task = _queue_task,
1662 .queue_ike = _queue_ike,
1663 .queue_ike_rekey = _queue_ike_rekey,
1664 .queue_ike_reauth = _queue_ike_reauth,
1665 .queue_ike_delete = _queue_ike_delete,
1666 .queue_mobike = _queue_mobike,
1667 .queue_child = _queue_child,
1668 .queue_child_rekey = _queue_child_rekey,
1669 .queue_child_delete = _queue_child_delete,
1670 .queue_dpd = _queue_dpd,
1671 .initiate = _initiate,
1672 .retransmit = _retransmit,
1673 .incr_mid = _incr_mid,
1674 .reset = _reset,
1675 .adopt_tasks = _adopt_tasks,
1676 .busy = _busy,
1677 .create_task_enumerator = _create_task_enumerator,
1678 .flush_queue = _flush_queue,
1679 .destroy = _destroy,
1680 },
1681 },
1682 .initiating = {
1683 .type = EXCHANGE_TYPE_UNDEFINED,
1684 },
1685 .responding = {
1686 .seqnr = RESPONDING_SEQ,
1687 },
1688 .ike_sa = ike_sa,
1689 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1690 .queued_tasks = linked_list_create(),
1691 .active_tasks = linked_list_create(),
1692 .passive_tasks = linked_list_create(),
1693 .retransmit_tries = lib->settings->get_int(lib->settings,
1694 "%s.retransmit_tries", RETRANSMIT_TRIES, charon->name),
1695 .retransmit_timeout = lib->settings->get_double(lib->settings,
1696 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name),
1697 .retransmit_base = lib->settings->get_double(lib->settings,
1698 "%s.retransmit_base", RETRANSMIT_BASE, charon->name),
1699 );
1700
1701 if (!this->rng)
1702 {
1703 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
1704 destroy(this);
1705 return NULL;
1706 }
1707 if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
1708 (void*)&this->dpd_send))
1709 {
1710 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
1711 destroy(this);
1712 return NULL;
1713 }
1714 this->dpd_send &= 0x7FFFFFFF;
1715
1716 return &this->public;
1717 }
1718