Merge branch 'ikev1-fragmentation'
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2013 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/aggressive_mode.h>
24 #include <sa/ikev1/tasks/quick_mode.h>
25 #include <sa/ikev1/tasks/quick_delete.h>
26 #include <sa/ikev1/tasks/xauth.h>
27 #include <sa/ikev1/tasks/mode_config.h>
28 #include <sa/ikev1/tasks/informational.h>
29 #include <sa/ikev1/tasks/isakmp_natd.h>
30 #include <sa/ikev1/tasks/isakmp_vendor.h>
31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
33 #include <sa/ikev1/tasks/isakmp_delete.h>
34 #include <sa/ikev1/tasks/isakmp_dpd.h>
35
36 #include <processing/jobs/retransmit_job.h>
37 #include <processing/jobs/delete_ike_sa_job.h>
38 #include <processing/jobs/dpd_timeout_job.h>
39 #include <processing/jobs/process_message_job.h>
40
41 #include <encoding/payloads/fragment_payload.h>
42 #include <bio/bio_writer.h>
43
44 /**
45 * Number of old messages hashes we keep for retransmission.
46 *
47 * In Main Mode, we must ignore messages from a previous message pair if
48 * we already continued to the next. Otherwise a late retransmission
49 * could be considered as a reply to the newer request.
50 */
51 #define MAX_OLD_HASHES 2
52
53 /**
54 * Maximum packet size for fragmented packets (same as in sockets)
55 */
56 #define MAX_PACKET 10000
57
58 /**
59 * Maximum size of fragment data when sending packets (currently the same is
60 * used for IPv4 and IPv6, even though the latter has a higher minimum datagram
61 * size). 576 (= min. IPv4) - 20 (= IP header) - 8 (= UDP header) -
62 * - 28 (= IKE header) - 8 (= fragment header) = 512
63 * This is reduced by 4 in case of NAT-T (due to the non-ESP marker).
64 */
65 #define MAX_FRAGMENT_SIZE 512
66
67 /**
68 * First sequence number of responding packets.
69 *
70 * To distinguish retransmission jobs for initiating and responding packets,
71 * we split up the sequence counter and use the upper half for responding.
72 */
73 #define RESPONDING_SEQ INT_MAX
74
75 typedef struct exchange_t exchange_t;
76
77 /**
78 * An exchange in the air, used do detect and handle retransmission
79 */
80 struct exchange_t {
81
82 /**
83 * Message ID used for this transaction
84 */
85 u_int32_t mid;
86
87 /**
88 * generated packet for retransmission
89 */
90 packet_t *packet;
91 };
92
93 typedef struct private_task_manager_t private_task_manager_t;
94
95 /**
96 * private data of the task manager
97 */
98 struct private_task_manager_t {
99
100 /**
101 * public functions
102 */
103 task_manager_v1_t public;
104
105 /**
106 * associated IKE_SA we are serving
107 */
108 ike_sa_t *ike_sa;
109
110 /**
111 * RNG to create message IDs
112 */
113 rng_t *rng;
114
115 /**
116 * Exchange we are currently handling as responder
117 */
118 struct {
119 /**
120 * Message ID of the last response
121 */
122 u_int32_t mid;
123
124 /**
125 * Hash of a previously received message
126 */
127 u_int32_t hash;
128
129 /**
130 * packet for retransmission
131 */
132 packet_t *packet;
133
134 /**
135 * Sequence number of the last sent message
136 */
137 u_int32_t seqnr;
138
139 /**
140 * how many times we have retransmitted so far
141 */
142 u_int retransmitted;
143
144 } responding;
145
146 /**
147 * Exchange we are currently handling as initiator
148 */
149 struct {
150 /**
151 * Message ID of the exchange
152 */
153 u_int32_t mid;
154
155 /**
156 * Hashes of old responses we can ignore
157 */
158 u_int32_t old_hashes[MAX_OLD_HASHES];
159
160 /**
161 * Position in old hash array
162 */
163 int old_hash_pos;
164
165 /**
166 * Sequence number of the last sent message
167 */
168 u_int32_t seqnr;
169
170 /**
171 * how many times we have retransmitted so far
172 */
173 u_int retransmitted;
174
175 /**
176 * packet for retransmission
177 */
178 packet_t *packet;
179
180 /**
181 * type of the initiated exchange
182 */
183 exchange_type_t type;
184
185 } initiating;
186
187 /**
188 * Data used to reassemble a fragmented message
189 */
190 struct {
191
192 /**
193 * Fragment ID (currently only one is supported at a time)
194 */
195 u_int16_t id;
196
197 /**
198 * The number of the last fragment (in case we receive the fragments out
199 * of order), since the first starts with 1 this defines the number of
200 * fragments we expect
201 */
202 u_int8_t last;
203
204 /**
205 * List of fragments (fragment_t*)
206 */
207 linked_list_t *list;
208
209 /**
210 * Length of all currently received fragments
211 */
212 size_t len;
213
214 /**
215 * Maximum length of a fragmented packet
216 */
217 size_t max_packet;
218
219 /**
220 * Maximum length of a single fragment (when sending)
221 */
222 size_t size;
223
224 /**
225 * The exchange type we use for fragments. Always the initial type even
226 * for fragmented quick mode or transaction messages (i.e. either
227 * ID_PROT or AGGRESSIVE)
228 */
229 exchange_type_t exchange;
230
231 } frag;
232
233 /**
234 * List of queued tasks not yet in action
235 */
236 linked_list_t *queued_tasks;
237
238 /**
239 * List of active tasks, initiated by ourselves
240 */
241 linked_list_t *active_tasks;
242
243 /**
244 * List of tasks initiated by peer
245 */
246 linked_list_t *passive_tasks;
247
248 /**
249 * Queued messages not yet ready to process
250 */
251 message_t *queued;
252
253 /**
254 * Number of times we retransmit messages before giving up
255 */
256 u_int retransmit_tries;
257
258 /**
259 * Retransmission timeout
260 */
261 double retransmit_timeout;
262
263 /**
264 * Base to calculate retransmission timeout
265 */
266 double retransmit_base;
267
268 /**
269 * Sequence number for sending DPD requests
270 */
271 u_int32_t dpd_send;
272
273 /**
274 * Sequence number for received DPD requests
275 */
276 u_int32_t dpd_recv;
277 };
278
279 /**
280 * A single fragment within a fragmented message
281 */
282 typedef struct {
283
284 /** fragment number */
285 u_int8_t num;
286
287 /** fragment data */
288 chunk_t data;
289
290 } fragment_t;
291
292 static void fragment_destroy(fragment_t *this)
293 {
294 chunk_free(&this->data);
295 free(this);
296 }
297
298 static void clear_fragments(private_task_manager_t *this, u_int16_t id)
299 {
300 DESTROY_FUNCTION_IF(this->frag.list, (void*)fragment_destroy);
301 this->frag.list = NULL;
302 this->frag.last = 0;
303 this->frag.len = 0;
304 this->frag.id = id;
305 }
306
307 METHOD(task_manager_t, flush_queue, void,
308 private_task_manager_t *this, task_queue_t queue)
309 {
310 linked_list_t *list;
311 task_t *task;
312
313 if (this->queued)
314 {
315 this->queued->destroy(this->queued);
316 this->queued = NULL;
317 }
318 switch (queue)
319 {
320 case TASK_QUEUE_ACTIVE:
321 list = this->active_tasks;
322 /* cancel pending retransmits */
323 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
324 DESTROY_IF(this->initiating.packet);
325 this->initiating.packet = NULL;
326 break;
327 case TASK_QUEUE_PASSIVE:
328 list = this->passive_tasks;
329 break;
330 case TASK_QUEUE_QUEUED:
331 list = this->queued_tasks;
332 break;
333 default:
334 return;
335 }
336 while (list->remove_last(list, (void**)&task) == SUCCESS)
337 {
338 task->destroy(task);
339 }
340 }
341
342 /**
343 * flush all tasks in the task manager
344 */
345 static void flush(private_task_manager_t *this)
346 {
347 flush_queue(this, TASK_QUEUE_QUEUED);
348 flush_queue(this, TASK_QUEUE_PASSIVE);
349 flush_queue(this, TASK_QUEUE_ACTIVE);
350 }
351
352 /**
353 * move a task of a specific type from the queue to the active list
354 */
355 static bool activate_task(private_task_manager_t *this, task_type_t type)
356 {
357 enumerator_t *enumerator;
358 task_t *task;
359 bool found = FALSE;
360
361 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
362 while (enumerator->enumerate(enumerator, (void**)&task))
363 {
364 if (task->get_type(task) == type)
365 {
366 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
367 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
368 this->active_tasks->insert_last(this->active_tasks, task);
369 found = TRUE;
370 break;
371 }
372 }
373 enumerator->destroy(enumerator);
374 return found;
375 }
376
377 /**
378 * Send a single fragment with the given data
379 */
380 static bool send_fragment(private_task_manager_t *this, bool request,
381 host_t *src, host_t *dst, fragment_payload_t *fragment)
382 {
383 message_t *message;
384 packet_t *packet;
385 status_t status;
386
387 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
388 /* other implementations seem to just use 0 as message ID, so here we go */
389 message->set_message_id(message, 0);
390 message->set_request(message, request);
391 message->set_source(message, src->clone(src));
392 message->set_destination(message, dst->clone(dst));
393 message->set_exchange_type(message, this->frag.exchange);
394 message->add_payload(message, (payload_t*)fragment);
395
396 status = this->ike_sa->generate_message(this->ike_sa, message, &packet);
397 if (status != SUCCESS)
398 {
399 DBG1(DBG_IKE, "failed to generate IKE fragment");
400 message->destroy(message);
401 return FALSE;
402 }
403 charon->sender->send(charon->sender, packet);
404 message->destroy(message);
405 return TRUE;
406 }
407
408 /**
409 * Send a packet, if supported and required do so in fragments
410 */
411 static bool send_packet(private_task_manager_t *this, bool request,
412 packet_t *packet)
413 {
414 fragmentation_t fragmentation;
415 ike_cfg_t *ike_cfg;
416 host_t *src, *dst;
417 chunk_t data;
418
419 ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
420 fragmentation = ike_cfg->fragmentation(ike_cfg);
421 data = packet->get_data(packet);
422 if (data.len > this->frag.size && (fragmentation == FRAGMENTATION_FORCE ||
423 (this->ike_sa->supports_extension(this->ike_sa, EXT_IKE_FRAGMENTATION) &&
424 fragmentation == FRAGMENTATION_YES)))
425 {
426 fragment_payload_t *fragment;
427 u_int8_t num, count;
428 size_t len, frag_size;
429 bool nat;
430
431 /* reduce size due to non-ESP marker */
432 nat = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
433 frag_size = this->frag.size - (nat ? 4 : 0);
434
435 src = packet->get_source(packet);
436 dst = packet->get_destination(packet);
437 count = (data.len / (frag_size + 1)) + 1;
438
439 DBG1(DBG_IKE, "sending IKE message with length of %zu bytes in "
440 "%hhu fragments", data.len, count);
441 for (num = 1; num <= count; num++)
442 {
443 len = min(data.len, frag_size);
444 fragment = fragment_payload_create_from_data(num, num == count,
445 chunk_create(data.ptr, len));
446 if (!send_fragment(this, request, src, dst, fragment))
447 {
448 packet->destroy(packet);
449 return FALSE;
450 }
451 data = chunk_skip(data, len);
452 }
453 packet->destroy(packet);
454 return TRUE;
455 }
456 charon->sender->send(charon->sender, packet);
457 return TRUE;
458 }
459
460 /**
461 * Retransmit a packet, either as initiator or as responder
462 */
463 static status_t retransmit_packet(private_task_manager_t *this, bool request,
464 u_int32_t seqnr, u_int mid, u_int retransmitted, packet_t *packet)
465 {
466 u_int32_t t;
467
468 if (retransmitted > this->retransmit_tries)
469 {
470 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
471 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_TIMEOUT, packet);
472 return DESTROY_ME;
473 }
474 t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
475 pow(this->retransmit_base, retransmitted));
476 if (retransmitted)
477 {
478 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
479 retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
480 mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
481 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND, packet);
482 }
483 if (!send_packet(this, request, packet->clone(packet)))
484 {
485 return DESTROY_ME;
486 }
487 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
488 retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
489 return NEED_MORE;
490 }
491
492 METHOD(task_manager_t, retransmit, status_t,
493 private_task_manager_t *this, u_int32_t seqnr)
494 {
495 status_t status = SUCCESS;
496
497 if (seqnr == this->initiating.seqnr && this->initiating.packet)
498 {
499 status = retransmit_packet(this, TRUE, seqnr, this->initiating.mid,
500 this->initiating.retransmitted, this->initiating.packet);
501 if (status == NEED_MORE)
502 {
503 this->initiating.retransmitted++;
504 status = SUCCESS;
505 }
506 }
507 if (seqnr == this->responding.seqnr && this->responding.packet)
508 {
509 status = retransmit_packet(this, FALSE, seqnr, this->responding.mid,
510 this->responding.retransmitted, this->responding.packet);
511 if (status == NEED_MORE)
512 {
513 this->responding.retransmitted++;
514 status = SUCCESS;
515 }
516 }
517 return status;
518 }
519
520 /**
521 * Check if we have to wait for a mode config before starting a quick mode
522 */
523 static bool mode_config_expected(private_task_manager_t *this)
524 {
525 enumerator_t *enumerator;
526 peer_cfg_t *peer_cfg;
527 char *pool;
528 host_t *host;
529
530 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
531 if (peer_cfg)
532 {
533 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
534 if (!enumerator->enumerate(enumerator, &pool))
535 { /* no pool configured */
536 enumerator->destroy(enumerator);
537 return FALSE;
538 }
539 enumerator->destroy(enumerator);
540
541 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
542 FALSE);
543 if (!enumerator->enumerate(enumerator, &host))
544 { /* have a pool, but no VIP assigned yet */
545 enumerator->destroy(enumerator);
546 return TRUE;
547 }
548 enumerator->destroy(enumerator);
549 }
550 return FALSE;
551 }
552
553 METHOD(task_manager_t, initiate, status_t,
554 private_task_manager_t *this)
555 {
556 enumerator_t *enumerator;
557 task_t *task;
558 message_t *message;
559 host_t *me, *other;
560 status_t status;
561 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
562 bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
563
564 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
565 this->initiating.type != INFORMATIONAL_V1)
566 {
567 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
568 exchange_type_names, this->initiating.type);
569 /* do not initiate if we already have a message in the air */
570 return SUCCESS;
571 }
572
573 if (this->active_tasks->get_count(this->active_tasks) == 0)
574 {
575 DBG2(DBG_IKE, "activating new tasks");
576 switch (this->ike_sa->get_state(this->ike_sa))
577 {
578 case IKE_CREATED:
579 activate_task(this, TASK_ISAKMP_VENDOR);
580 activate_task(this, TASK_ISAKMP_CERT_PRE);
581 if (activate_task(this, TASK_MAIN_MODE))
582 {
583 exchange = ID_PROT;
584 }
585 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
586 {
587 exchange = AGGRESSIVE;
588 }
589 activate_task(this, TASK_ISAKMP_CERT_POST);
590 activate_task(this, TASK_ISAKMP_NATD);
591 break;
592 case IKE_CONNECTING:
593 if (activate_task(this, TASK_ISAKMP_DELETE))
594 {
595 exchange = INFORMATIONAL_V1;
596 new_mid = TRUE;
597 break;
598 }
599 if (activate_task(this, TASK_XAUTH))
600 {
601 exchange = TRANSACTION;
602 new_mid = TRUE;
603 break;
604 }
605 if (activate_task(this, TASK_INFORMATIONAL))
606 {
607 exchange = INFORMATIONAL_V1;
608 new_mid = TRUE;
609 break;
610 }
611 break;
612 case IKE_ESTABLISHED:
613 if (activate_task(this, TASK_MODE_CONFIG))
614 {
615 exchange = TRANSACTION;
616 new_mid = TRUE;
617 break;
618 }
619 if (!mode_config_expected(this) &&
620 activate_task(this, TASK_QUICK_MODE))
621 {
622 exchange = QUICK_MODE;
623 new_mid = TRUE;
624 break;
625 }
626 if (activate_task(this, TASK_INFORMATIONAL))
627 {
628 exchange = INFORMATIONAL_V1;
629 new_mid = TRUE;
630 break;
631 }
632 if (activate_task(this, TASK_QUICK_DELETE))
633 {
634 exchange = INFORMATIONAL_V1;
635 new_mid = TRUE;
636 break;
637 }
638 if (activate_task(this, TASK_ISAKMP_DELETE))
639 {
640 exchange = INFORMATIONAL_V1;
641 new_mid = TRUE;
642 break;
643 }
644 if (activate_task(this, TASK_ISAKMP_DPD))
645 {
646 exchange = INFORMATIONAL_V1;
647 new_mid = TRUE;
648 break;
649 }
650 break;
651 default:
652 break;
653 }
654 }
655 else
656 {
657 DBG2(DBG_IKE, "reinitiating already active tasks");
658 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
659 while (enumerator->enumerate(enumerator, (void**)&task))
660 {
661 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
662 switch (task->get_type(task))
663 {
664 case TASK_MAIN_MODE:
665 exchange = ID_PROT;
666 break;
667 case TASK_AGGRESSIVE_MODE:
668 exchange = AGGRESSIVE;
669 break;
670 case TASK_QUICK_MODE:
671 exchange = QUICK_MODE;
672 break;
673 case TASK_XAUTH:
674 exchange = TRANSACTION;
675 new_mid = TRUE;
676 break;
677 default:
678 continue;
679 }
680 break;
681 }
682 enumerator->destroy(enumerator);
683 }
684
685 if (exchange == EXCHANGE_TYPE_UNDEFINED)
686 {
687 DBG2(DBG_IKE, "nothing to initiate");
688 /* nothing to do yet... */
689 return SUCCESS;
690 }
691
692 me = this->ike_sa->get_my_host(this->ike_sa);
693 other = this->ike_sa->get_other_host(this->ike_sa);
694
695 if (new_mid)
696 {
697 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
698 (void*)&this->initiating.mid))
699 {
700 DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
701 flush(this);
702 return DESTROY_ME;
703 }
704 }
705 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
706 message->set_message_id(message, this->initiating.mid);
707 message->set_source(message, me->clone(me));
708 message->set_destination(message, other->clone(other));
709 message->set_exchange_type(message, exchange);
710 this->initiating.type = exchange;
711 this->initiating.retransmitted = 0;
712
713 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
714 while (enumerator->enumerate(enumerator, (void*)&task))
715 {
716 switch (task->build(task, message))
717 {
718 case SUCCESS:
719 /* task completed, remove it */
720 this->active_tasks->remove_at(this->active_tasks, enumerator);
721 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
722 task->get_type(task) == TASK_QUICK_MODE)
723 { /* last message of three message exchange */
724 keep = TRUE;
725 }
726 task->destroy(task);
727 continue;
728 case NEED_MORE:
729 expect_response = TRUE;
730 /* processed, but task needs another exchange */
731 continue;
732 case ALREADY_DONE:
733 cancelled = TRUE;
734 break;
735 case FAILED:
736 default:
737 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
738 {
739 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
740 }
741 /* FALL */
742 case DESTROY_ME:
743 /* critical failure, destroy IKE_SA */
744 enumerator->destroy(enumerator);
745 message->destroy(message);
746 flush(this);
747 return DESTROY_ME;
748 }
749 break;
750 }
751 enumerator->destroy(enumerator);
752
753 if (this->active_tasks->get_count(this->active_tasks) == 0 &&
754 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
755 { /* tasks completed, no exchange active anymore */
756 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
757 }
758 if (cancelled)
759 {
760 message->destroy(message);
761 return initiate(this);
762 }
763
764 DESTROY_IF(this->initiating.packet);
765 status = this->ike_sa->generate_message(this->ike_sa, message,
766 &this->initiating.packet);
767 if (status != SUCCESS)
768 {
769 /* message generation failed. There is nothing more to do than to
770 * close the SA */
771 message->destroy(message);
772 flush(this);
773 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
774 return DESTROY_ME;
775 }
776
777 this->initiating.seqnr++;
778 if (expect_response)
779 {
780 message->destroy(message);
781 return retransmit(this, this->initiating.seqnr);
782 }
783 if (keep)
784 { /* keep the packet for retransmission, the responder might request it */
785 send_packet(this, TRUE,
786 this->initiating.packet->clone(this->initiating.packet));
787 }
788 else
789 {
790 send_packet(this, TRUE, this->initiating.packet);
791 this->initiating.packet = NULL;
792 }
793 message->destroy(message);
794
795 if (exchange == INFORMATIONAL_V1)
796 {
797 switch (this->ike_sa->get_state(this->ike_sa))
798 {
799 case IKE_CONNECTING:
800 /* close after sending an INFORMATIONAL when unestablished */
801 return FAILED;
802 case IKE_DELETING:
803 /* close after sending a DELETE */
804 return DESTROY_ME;
805 default:
806 break;
807 }
808 }
809 return initiate(this);
810 }
811
812 /**
813 * build a response depending on the "passive" task list
814 */
815 static status_t build_response(private_task_manager_t *this, message_t *request)
816 {
817 enumerator_t *enumerator;
818 task_t *task;
819 message_t *message;
820 host_t *me, *other;
821 bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
822 status_t status;
823
824 me = request->get_destination(request);
825 other = request->get_source(request);
826
827 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
828 message->set_exchange_type(message, request->get_exchange_type(request));
829 /* send response along the path the request came in */
830 message->set_source(message, me->clone(me));
831 message->set_destination(message, other->clone(other));
832 message->set_message_id(message, request->get_message_id(request));
833 message->set_request(message, FALSE);
834
835 this->responding.mid = request->get_message_id(request);
836 this->responding.retransmitted = 0;
837 this->responding.seqnr++;
838
839 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
840 while (enumerator->enumerate(enumerator, (void*)&task))
841 {
842 switch (task->build(task, message))
843 {
844 case SUCCESS:
845 /* task completed, remove it */
846 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
847 task->destroy(task);
848 continue;
849 case NEED_MORE:
850 /* processed, but task needs another exchange */
851 if (task->get_type(task) == TASK_QUICK_MODE ||
852 task->get_type(task) == TASK_AGGRESSIVE_MODE)
853 { /* we rely on initiator retransmission, except for
854 * three-message exchanges */
855 expect_request = TRUE;
856 }
857 continue;
858 case ALREADY_DONE:
859 cancelled = TRUE;
860 break;
861 case FAILED:
862 default:
863 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
864 /* FALL */
865 case DESTROY_ME:
866 /* destroy IKE_SA, but SEND response first */
867 delete = TRUE;
868 break;
869 }
870 break;
871 }
872 enumerator->destroy(enumerator);
873
874 DESTROY_IF(this->responding.packet);
875 this->responding.packet = NULL;
876 if (cancelled)
877 {
878 message->destroy(message);
879 return initiate(this);
880 }
881 status = this->ike_sa->generate_message(this->ike_sa, message,
882 &this->responding.packet);
883 message->destroy(message);
884 if (status != SUCCESS)
885 {
886 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
887 return DESTROY_ME;
888 }
889
890 if (expect_request && !delete)
891 {
892 return retransmit(this, this->responding.seqnr);
893 }
894 send_packet(this, FALSE,
895 this->responding.packet->clone(this->responding.packet));
896 if (delete)
897 {
898 return DESTROY_ME;
899 }
900 return SUCCESS;
901 }
902
903 /**
904 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
905 * The notify protocol_id is set to ISAKMP
906 */
907 static void send_notify(private_task_manager_t *this, message_t *request,
908 notify_type_t type)
909 {
910 message_t *response;
911 packet_t *packet;
912 host_t *me, *other;
913 u_int32_t mid;
914
915 if (request->get_exchange_type(request) == INFORMATIONAL_V1)
916 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
917 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
918 return;
919 }
920 if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
921 {
922 DBG1(DBG_IKE, "failed to allocate message ID");
923 return;
924 }
925 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
926 response->set_exchange_type(response, INFORMATIONAL_V1);
927 response->set_request(response, TRUE);
928 response->set_message_id(response, mid);
929 response->add_payload(response, (payload_t*)
930 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
931 PROTO_IKE, type));
932
933 me = this->ike_sa->get_my_host(this->ike_sa);
934 if (me->is_anyaddr(me))
935 {
936 me = request->get_destination(request);
937 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
938 }
939 other = this->ike_sa->get_other_host(this->ike_sa);
940 if (other->is_anyaddr(other))
941 {
942 other = request->get_source(request);
943 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
944 }
945 response->set_source(response, me->clone(me));
946 response->set_destination(response, other->clone(other));
947 if (this->ike_sa->generate_message(this->ike_sa, response,
948 &packet) == SUCCESS)
949 {
950 send_packet(this, TRUE, packet);
951 }
952 response->destroy(response);
953 }
954
955 /**
956 * Process a DPD request/response
957 */
958 static bool process_dpd(private_task_manager_t *this, message_t *message)
959 {
960 notify_payload_t *notify;
961 notify_type_t type;
962 u_int32_t seq;
963 chunk_t data;
964
965 type = DPD_R_U_THERE;
966 notify = message->get_notify(message, type);
967 if (!notify)
968 {
969 type = DPD_R_U_THERE_ACK;
970 notify = message->get_notify(message, type);
971 }
972 if (!notify)
973 {
974 return FALSE;
975 }
976 data = notify->get_notification_data(notify);
977 if (data.len != 4)
978 {
979 return FALSE;
980 }
981 seq = untoh32(data.ptr);
982
983 if (type == DPD_R_U_THERE)
984 {
985 if (this->dpd_recv == 0 || seq == this->dpd_recv)
986 { /* check sequence validity */
987 this->dpd_recv = seq + 1;
988 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
989 time_monotonic(NULL));
990 }
991 /* but respond anyway */
992 this->ike_sa->queue_task(this->ike_sa,
993 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
994 }
995 else /* DPD_R_U_THERE_ACK */
996 {
997 if (seq == this->dpd_send - 1)
998 {
999 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1000 time_monotonic(NULL));
1001 }
1002 else
1003 {
1004 DBG1(DBG_IKE, "received invalid DPD sequence number %u "
1005 "(expected %u), ignored", seq, this->dpd_send - 1);
1006 }
1007 }
1008 return TRUE;
1009 }
1010
1011 /**
1012 * handle an incoming request message
1013 */
1014 static status_t process_request(private_task_manager_t *this,
1015 message_t *message)
1016 {
1017 enumerator_t *enumerator;
1018 task_t *task = NULL;
1019 bool send_response = FALSE, dpd = FALSE;
1020
1021 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
1022 this->passive_tasks->get_count(this->passive_tasks) == 0)
1023 { /* create tasks depending on request type, if not already some queued */
1024 switch (message->get_exchange_type(message))
1025 {
1026 case ID_PROT:
1027 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
1028 this->passive_tasks->insert_last(this->passive_tasks, task);
1029 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
1030 this->passive_tasks->insert_last(this->passive_tasks, task);
1031 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
1032 this->passive_tasks->insert_last(this->passive_tasks, task);
1033 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
1034 this->passive_tasks->insert_last(this->passive_tasks, task);
1035 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
1036 this->passive_tasks->insert_last(this->passive_tasks, task);
1037 break;
1038 case AGGRESSIVE:
1039 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
1040 this->passive_tasks->insert_last(this->passive_tasks, task);
1041 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
1042 this->passive_tasks->insert_last(this->passive_tasks, task);
1043 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
1044 this->passive_tasks->insert_last(this->passive_tasks, task);
1045 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
1046 this->passive_tasks->insert_last(this->passive_tasks, task);
1047 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
1048 this->passive_tasks->insert_last(this->passive_tasks, task);
1049 this->frag.exchange = AGGRESSIVE;
1050 break;
1051 case QUICK_MODE:
1052 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1053 {
1054 DBG1(DBG_IKE, "received quick mode request for "
1055 "unestablished IKE_SA, ignored");
1056 return FAILED;
1057 }
1058 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
1059 NULL, NULL);
1060 this->passive_tasks->insert_last(this->passive_tasks, task);
1061 break;
1062 case INFORMATIONAL_V1:
1063 if (process_dpd(this, message))
1064 {
1065 dpd = TRUE;
1066 }
1067 else
1068 {
1069 task = (task_t *)informational_create(this->ike_sa, NULL);
1070 this->passive_tasks->insert_first(this->passive_tasks, task);
1071 }
1072 break;
1073 case TRANSACTION:
1074 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
1075 {
1076 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
1077 }
1078 else
1079 {
1080 task = (task_t *)xauth_create(this->ike_sa, FALSE);
1081 }
1082 this->passive_tasks->insert_last(this->passive_tasks, task);
1083 break;
1084 default:
1085 return FAILED;
1086 }
1087 }
1088 if (dpd)
1089 {
1090 return initiate(this);
1091 }
1092 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
1093
1094 /* let the tasks process the message */
1095 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
1096 while (enumerator->enumerate(enumerator, (void*)&task))
1097 {
1098 switch (task->process(task, message))
1099 {
1100 case SUCCESS:
1101 /* task completed, remove it */
1102 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1103 task->destroy(task);
1104 continue;
1105 case NEED_MORE:
1106 /* processed, but task needs at least another call to build() */
1107 send_response = TRUE;
1108 continue;
1109 case ALREADY_DONE:
1110 send_response = FALSE;
1111 break;
1112 case FAILED:
1113 default:
1114 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1115 /* FALL */
1116 case DESTROY_ME:
1117 /* critical failure, destroy IKE_SA */
1118 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1119 enumerator->destroy(enumerator);
1120 task->destroy(task);
1121 return DESTROY_ME;
1122 }
1123 break;
1124 }
1125 enumerator->destroy(enumerator);
1126
1127 if (send_response)
1128 {
1129 if (build_response(this, message) != SUCCESS)
1130 {
1131 return DESTROY_ME;
1132 }
1133 }
1134 else
1135 { /* We don't send a response, so don't retransmit one if we get
1136 * the same message again. */
1137 DESTROY_IF(this->responding.packet);
1138 this->responding.packet = NULL;
1139 }
1140 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
1141 this->queued_tasks->get_count(this->queued_tasks) > 0)
1142 {
1143 /* passive tasks completed, check if an active task has been queued,
1144 * such as XAUTH or modeconfig push */
1145 return initiate(this);
1146 }
1147 return SUCCESS;
1148 }
1149
1150 /**
1151 * handle an incoming response message
1152 */
1153 static status_t process_response(private_task_manager_t *this,
1154 message_t *message)
1155 {
1156 enumerator_t *enumerator;
1157 message_t *queued;
1158 status_t status;
1159 task_t *task;
1160
1161 if (message->get_exchange_type(message) != this->initiating.type)
1162 {
1163 DBG1(DBG_IKE, "received %N response, but expected %N",
1164 exchange_type_names, message->get_exchange_type(message),
1165 exchange_type_names, this->initiating.type);
1166 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1167 return DESTROY_ME;
1168 }
1169
1170 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
1171 while (enumerator->enumerate(enumerator, (void*)&task))
1172 {
1173 switch (task->process(task, message))
1174 {
1175 case SUCCESS:
1176 /* task completed, remove it */
1177 this->active_tasks->remove_at(this->active_tasks, enumerator);
1178 task->destroy(task);
1179 continue;
1180 case NEED_MORE:
1181 /* processed, but task needs another exchange */
1182 continue;
1183 case ALREADY_DONE:
1184 break;
1185 case FAILED:
1186 default:
1187 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1188 /* FALL */
1189 case DESTROY_ME:
1190 /* critical failure, destroy IKE_SA */
1191 this->active_tasks->remove_at(this->active_tasks, enumerator);
1192 enumerator->destroy(enumerator);
1193 task->destroy(task);
1194 return DESTROY_ME;
1195 }
1196 break;
1197 }
1198 enumerator->destroy(enumerator);
1199
1200 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1201 DESTROY_IF(this->initiating.packet);
1202 this->initiating.packet = NULL;
1203
1204 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
1205 {
1206 queued = this->queued;
1207 this->queued = NULL;
1208 status = this->public.task_manager.process_message(
1209 &this->public.task_manager, queued);
1210 queued->destroy(queued);
1211 if (status == DESTROY_ME)
1212 {
1213 return status;
1214 }
1215 }
1216
1217 return initiate(this);
1218 }
1219
1220 static status_t handle_fragment(private_task_manager_t *this, message_t *msg)
1221 {
1222 fragment_payload_t *payload;
1223 enumerator_t *enumerator;
1224 fragment_t *fragment;
1225 status_t status = SUCCESS;
1226 chunk_t data;
1227 u_int8_t num;
1228
1229 payload = (fragment_payload_t*)msg->get_payload(msg, FRAGMENT_V1);
1230 if (!payload)
1231 {
1232 return FAILED;
1233 }
1234
1235 if (this->frag.id != payload->get_id(payload))
1236 {
1237 clear_fragments(this, payload->get_id(payload));
1238 this->frag.list = linked_list_create();
1239 }
1240
1241 num = payload->get_number(payload);
1242 if (!this->frag.last && payload->is_last(payload))
1243 {
1244 this->frag.last = num;
1245 }
1246
1247 enumerator = this->frag.list->create_enumerator(this->frag.list);
1248 while (enumerator->enumerate(enumerator, &fragment))
1249 {
1250 if (fragment->num == num)
1251 { /* ignore a duplicate fragment */
1252 DBG1(DBG_IKE, "received duplicate fragment #%hhu", num);
1253 enumerator->destroy(enumerator);
1254 return NEED_MORE;
1255 }
1256 if (fragment->num > num)
1257 {
1258 break;
1259 }
1260 }
1261
1262 data = payload->get_data(payload);
1263 this->frag.len += data.len;
1264 if (this->frag.len > this->frag.max_packet)
1265 {
1266 DBG1(DBG_IKE, "fragmented IKE message is too large");
1267 enumerator->destroy(enumerator);
1268 clear_fragments(this, 0);
1269 return FAILED;
1270 }
1271
1272 INIT(fragment,
1273 .num = num,
1274 .data = chunk_clone(data),
1275 );
1276
1277 this->frag.list->insert_before(this->frag.list, enumerator, fragment);
1278 enumerator->destroy(enumerator);
1279
1280 if (this->frag.list->get_count(this->frag.list) == this->frag.last)
1281 {
1282 message_t *message;
1283 packet_t *pkt;
1284 host_t *src, *dst;
1285 bio_writer_t *writer;
1286
1287 writer = bio_writer_create(this->frag.len);
1288 DBG1(DBG_IKE, "received fragment #%hhu, reassembling fragmented IKE "
1289 "message", num);
1290 enumerator = this->frag.list->create_enumerator(this->frag.list);
1291 while (enumerator->enumerate(enumerator, &fragment))
1292 {
1293 writer->write_data(writer, fragment->data);
1294 }
1295 enumerator->destroy(enumerator);
1296
1297 src = msg->get_source(msg);
1298 dst = msg->get_destination(msg);
1299 pkt = packet_create_from_data(src->clone(src), dst->clone(dst),
1300 writer->extract_buf(writer));
1301 writer->destroy(writer);
1302
1303 message = message_create_from_packet(pkt);
1304 if (message->parse_header(message) != SUCCESS)
1305 {
1306 DBG1(DBG_IKE, "failed to parse header of reassembled IKE message");
1307 message->destroy(message);
1308 status = FAILED;
1309 }
1310 else
1311 {
1312 lib->processor->queue_job(lib->processor,
1313 (job_t*)process_message_job_create(message));
1314 status = NEED_MORE;
1315
1316 }
1317 clear_fragments(this, 0);
1318 }
1319 else
1320 { /* there are some fragments missing */
1321 DBG1(DBG_IKE, "received fragment #%hhu, waiting for complete IKE "
1322 "message", num);
1323 status = NEED_MORE;
1324 }
1325 return status;
1326 }
1327
1328 /**
1329 * Parse the given message and verify that it is valid.
1330 */
1331 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1332 {
1333 status_t status;
1334
1335 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1336
1337 if (status != SUCCESS)
1338 {
1339 switch (status)
1340 {
1341 case NOT_SUPPORTED:
1342 DBG1(DBG_IKE, "unsupported exchange type");
1343 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1344 break;
1345 case PARSE_ERROR:
1346 DBG1(DBG_IKE, "message parsing failed");
1347 send_notify(this, msg, PAYLOAD_MALFORMED);
1348 break;
1349 case VERIFY_ERROR:
1350 DBG1(DBG_IKE, "message verification failed");
1351 send_notify(this, msg, PAYLOAD_MALFORMED);
1352 break;
1353 case FAILED:
1354 DBG1(DBG_IKE, "integrity check failed");
1355 send_notify(this, msg, INVALID_HASH_INFORMATION);
1356 break;
1357 case INVALID_STATE:
1358 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1359 send_notify(this, msg, PAYLOAD_MALFORMED);
1360 default:
1361 break;
1362 }
1363 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1364 exchange_type_names, msg->get_exchange_type(msg),
1365 msg->get_request(msg) ? "request" : "response",
1366 msg->get_message_id(msg));
1367
1368 charon->bus->alert(charon->bus, ALERT_PARSE_ERROR_BODY, msg, status);
1369
1370 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1371 { /* invalid initiation attempt, close SA */
1372 return DESTROY_ME;
1373 }
1374 }
1375
1376 if (msg->get_first_payload_type(msg) == FRAGMENT_V1)
1377 {
1378 return handle_fragment(this, msg);
1379 }
1380 return status;
1381 }
1382
1383 METHOD(task_manager_t, process_message, status_t,
1384 private_task_manager_t *this, message_t *msg)
1385 {
1386 u_int32_t hash, mid, i;
1387 host_t *me, *other;
1388 status_t status;
1389
1390 /* TODO-IKEv1: update hosts more selectively */
1391 me = msg->get_destination(msg);
1392 other = msg->get_source(msg);
1393 mid = msg->get_message_id(msg);
1394 hash = chunk_hash(msg->get_packet_data(msg));
1395 for (i = 0; i < MAX_OLD_HASHES; i++)
1396 {
1397 if (this->initiating.old_hashes[i] == hash)
1398 {
1399 if (this->initiating.packet &&
1400 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1401 (msg->get_exchange_type(msg) == QUICK_MODE ||
1402 msg->get_exchange_type(msg) == AGGRESSIVE))
1403 {
1404 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1405 "resending last request", mid);
1406 send_packet(this, TRUE,
1407 this->initiating.packet->clone(this->initiating.packet));
1408 return SUCCESS;
1409 }
1410 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1411 "but next request already sent", mid);
1412 return SUCCESS;
1413 }
1414 }
1415
1416 if ((mid && mid == this->initiating.mid) ||
1417 (this->initiating.mid == 0 &&
1418 msg->get_exchange_type(msg) == this->initiating.type &&
1419 this->active_tasks->get_count(this->active_tasks)))
1420 {
1421 msg->set_request(msg, FALSE);
1422 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1423 status = parse_message(this, msg);
1424 if (status == NEED_MORE)
1425 {
1426 return SUCCESS;
1427 }
1428 if (status != SUCCESS)
1429 {
1430 return status;
1431 }
1432 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1433 time_monotonic(NULL));
1434 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1435 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1436 if (process_response(this, msg) != SUCCESS)
1437 {
1438 flush(this);
1439 return DESTROY_ME;
1440 }
1441 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1442 MAX_OLD_HASHES] = hash;
1443 }
1444 else
1445 {
1446 if (hash == this->responding.hash)
1447 {
1448 if (this->responding.packet)
1449 {
1450 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1451 "retransmitting response", mid);
1452 send_packet(this, FALSE,
1453 this->responding.packet->clone(this->responding.packet));
1454 }
1455 else if (this->initiating.packet &&
1456 this->initiating.type == INFORMATIONAL_V1)
1457 {
1458 DBG1(DBG_IKE, "received retransmit of DPD request, "
1459 "retransmitting response");
1460 send_packet(this, TRUE,
1461 this->initiating.packet->clone(this->initiating.packet));
1462 }
1463 else
1464 {
1465 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1466 "but no response to retransmit", mid);
1467 }
1468 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_RECEIVE, msg);
1469 return SUCCESS;
1470 }
1471 if (msg->get_exchange_type(msg) == TRANSACTION &&
1472 this->active_tasks->get_count(this->active_tasks))
1473 { /* main mode not yet complete, queue XAuth/Mode config tasks */
1474 if (this->queued)
1475 {
1476 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
1477 exchange_type_names, TRANSACTION);
1478 return SUCCESS;
1479 }
1480 this->queued = message_create_from_packet(msg->get_packet(msg));
1481 if (this->queued->parse_header(this->queued) != SUCCESS)
1482 {
1483 this->queued->destroy(this->queued);
1484 this->queued = NULL;
1485 return FAILED;
1486 }
1487 DBG1(DBG_IKE, "queueing %N request as tasks still active",
1488 exchange_type_names, TRANSACTION);
1489 return SUCCESS;
1490 }
1491
1492 msg->set_request(msg, TRUE);
1493 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1494 status = parse_message(this, msg);
1495 if (status == NEED_MORE)
1496 {
1497 return SUCCESS;
1498 }
1499 if (status != SUCCESS)
1500 {
1501 return status;
1502 }
1503 /* if this IKE_SA is virgin, we check for a config */
1504 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1505 {
1506 ike_sa_id_t *ike_sa_id;
1507 ike_cfg_t *ike_cfg;
1508 job_t *job;
1509
1510 ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1511 me, other, IKEV1);
1512 if (ike_cfg == NULL)
1513 {
1514 /* no config found for these hosts, destroy */
1515 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1516 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1517 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1518 return DESTROY_ME;
1519 }
1520 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1521 ike_cfg->destroy(ike_cfg);
1522 /* add a timeout if peer does not establish it completely */
1523 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1524 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1525 lib->scheduler->schedule_job(lib->scheduler, job,
1526 lib->settings->get_int(lib->settings,
1527 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1528 charon->name));
1529 }
1530 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1531 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1532 if (process_request(this, msg) != SUCCESS)
1533 {
1534 flush(this);
1535 return DESTROY_ME;
1536 }
1537 this->responding.hash = hash;
1538 }
1539 return SUCCESS;
1540 }
1541
1542 METHOD(task_manager_t, queue_task, void,
1543 private_task_manager_t *this, task_t *task)
1544 {
1545 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1546 this->queued_tasks->insert_last(this->queued_tasks, task);
1547 }
1548
1549 /**
1550 * Check if a given task has been queued already
1551 */
1552 static bool has_queued(private_task_manager_t *this, task_type_t type)
1553 {
1554 enumerator_t *enumerator;
1555 bool found = FALSE;
1556 task_t *task;
1557
1558 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1559 while (enumerator->enumerate(enumerator, &task))
1560 {
1561 if (task->get_type(task) == type)
1562 {
1563 found = TRUE;
1564 break;
1565 }
1566 }
1567 enumerator->destroy(enumerator);
1568 return found;
1569 }
1570
1571 METHOD(task_manager_t, queue_ike, void,
1572 private_task_manager_t *this)
1573 {
1574 peer_cfg_t *peer_cfg;
1575
1576 if (!has_queued(this, TASK_ISAKMP_VENDOR))
1577 {
1578 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1579 }
1580 if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1581 {
1582 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1583 }
1584 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1585 if (peer_cfg->use_aggressive(peer_cfg))
1586 {
1587 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1588 {
1589 queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1590 }
1591 this->frag.exchange = AGGRESSIVE;
1592 }
1593 else
1594 {
1595 if (!has_queued(this, TASK_MAIN_MODE))
1596 {
1597 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1598 }
1599 }
1600 if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1601 {
1602 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1603 }
1604 if (!has_queued(this, TASK_ISAKMP_NATD))
1605 {
1606 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1607 }
1608 }
1609
1610 METHOD(task_manager_t, queue_ike_reauth, void,
1611 private_task_manager_t *this)
1612 {
1613 enumerator_t *enumerator;
1614 child_sa_t *child_sa;
1615 ike_sa_t *new;
1616 host_t *host;
1617
1618 new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1619 this->ike_sa->get_version(this->ike_sa), TRUE);
1620 if (!new)
1621 { /* shouldn't happen */
1622 return;
1623 }
1624
1625 new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1626 host = this->ike_sa->get_other_host(this->ike_sa);
1627 new->set_other_host(new, host->clone(host));
1628 host = this->ike_sa->get_my_host(this->ike_sa);
1629 new->set_my_host(new, host->clone(host));
1630 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1631 while (enumerator->enumerate(enumerator, &host))
1632 {
1633 new->add_virtual_ip(new, TRUE, host);
1634 }
1635 enumerator->destroy(enumerator);
1636
1637 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1638 while (enumerator->enumerate(enumerator, &child_sa))
1639 {
1640 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1641 new->add_child_sa(new, child_sa);
1642 }
1643 enumerator->destroy(enumerator);
1644
1645 if (!new->get_child_count(new))
1646 { /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1647 task_t *task;
1648
1649 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1650 while (enumerator->enumerate(enumerator, &task))
1651 {
1652 if (task->get_type(task) == TASK_QUICK_MODE)
1653 {
1654 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1655 task->migrate(task, new);
1656 new->queue_task(new, task);
1657 }
1658 }
1659 enumerator->destroy(enumerator);
1660 }
1661
1662 if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1663 {
1664 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1665 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1666 }
1667 else
1668 {
1669 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1670 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1671 }
1672 charon->bus->set_sa(charon->bus, this->ike_sa);
1673 }
1674
1675 METHOD(task_manager_t, queue_ike_rekey, void,
1676 private_task_manager_t *this)
1677 {
1678 queue_ike_reauth(this);
1679 }
1680
1681 METHOD(task_manager_t, queue_ike_delete, void,
1682 private_task_manager_t *this)
1683 {
1684 enumerator_t *enumerator;
1685 child_sa_t *child_sa;
1686
1687 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1688 while (enumerator->enumerate(enumerator, &child_sa))
1689 {
1690 queue_task(this, (task_t*)
1691 quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1692 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1693 }
1694 enumerator->destroy(enumerator);
1695
1696 queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1697 }
1698
1699 METHOD(task_manager_t, queue_mobike, void,
1700 private_task_manager_t *this, bool roam, bool address)
1701 {
1702 /* Not supported in IKEv1 */
1703 }
1704
1705 METHOD(task_manager_t, queue_child, void,
1706 private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1707 traffic_selector_t *tsi, traffic_selector_t *tsr)
1708 {
1709 quick_mode_t *task;
1710
1711 task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1712 task->use_reqid(task, reqid);
1713
1714 queue_task(this, &task->task);
1715 }
1716
1717 /**
1718 * Check if two CHILD_SAs have the same traffic selector
1719 */
1720 static bool have_equal_ts(child_sa_t *a, child_sa_t *b, bool local)
1721 {
1722 linked_list_t *list;
1723 traffic_selector_t *ts_a, *ts_b;
1724
1725 list = a->get_traffic_selectors(a, local);
1726 if (list->get_first(list, (void**)&ts_a) == SUCCESS)
1727 {
1728 list = b->get_traffic_selectors(b, local);
1729 if (list->get_first(list, (void**)&ts_b) == SUCCESS)
1730 {
1731 return ts_a->equals(ts_a, ts_b);
1732 }
1733 }
1734 return FALSE;
1735 }
1736
1737 /**
1738 * Check if a CHILD_SA is redundant and we should delete instead of rekey
1739 */
1740 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1741 {
1742 enumerator_t *enumerator;
1743 child_sa_t *current;
1744 bool redundant = FALSE;
1745
1746 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1747 while (enumerator->enumerate(enumerator, &current))
1748 {
1749 if (current->get_state(current) == CHILD_INSTALLED &&
1750 streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1751 have_equal_ts(current, child_sa, TRUE) &&
1752 have_equal_ts(current, child_sa, FALSE) &&
1753 current->get_lifetime(current, FALSE) >
1754 child_sa->get_lifetime(child_sa, FALSE))
1755 {
1756 DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1757 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
1758 redundant = TRUE;
1759 break;
1760 }
1761 }
1762 enumerator->destroy(enumerator);
1763
1764 return redundant;
1765 }
1766
1767 /**
1768 * Get the first traffic selector of a CHILD_SA, local or remote
1769 */
1770 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1771 {
1772 traffic_selector_t *ts = NULL;
1773 linked_list_t *list;
1774
1775 list = child_sa->get_traffic_selectors(child_sa, local);
1776 if (list->get_first(list, (void**)&ts) == SUCCESS)
1777 {
1778 return ts;
1779 }
1780 return NULL;
1781 }
1782
1783 METHOD(task_manager_t, queue_child_rekey, void,
1784 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1785 {
1786 child_sa_t *child_sa;
1787 child_cfg_t *cfg;
1788 quick_mode_t *task;
1789
1790 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1791 if (!child_sa)
1792 {
1793 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1794 }
1795 if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1796 {
1797 if (is_redundant(this, child_sa))
1798 {
1799 queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1800 protocol, spi, FALSE, FALSE));
1801 }
1802 else
1803 {
1804 child_sa->set_state(child_sa, CHILD_REKEYING);
1805 cfg = child_sa->get_config(child_sa);
1806 task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1807 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1808 task->use_reqid(task, child_sa->get_reqid(child_sa));
1809 task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1810
1811 queue_task(this, &task->task);
1812 }
1813 }
1814 }
1815
1816 METHOD(task_manager_t, queue_child_delete, void,
1817 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1818 bool expired)
1819 {
1820 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1821 spi, FALSE, expired));
1822 }
1823
1824 METHOD(task_manager_t, queue_dpd, void,
1825 private_task_manager_t *this)
1826 {
1827 peer_cfg_t *peer_cfg;
1828 u_int32_t t, retransmit;
1829
1830 queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1831 this->dpd_send++));
1832 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1833
1834 /* compute timeout in milliseconds */
1835 t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1836 if (t == 0)
1837 {
1838 /* use the same timeout as a retransmitting IKE message would have */
1839 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1840 {
1841 t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1842 pow(this->retransmit_base, retransmit));
1843 }
1844 }
1845
1846 /* schedule DPD timeout job */
1847 lib->scheduler->schedule_job_ms(lib->scheduler,
1848 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1849 }
1850
1851 METHOD(task_manager_t, adopt_tasks, void,
1852 private_task_manager_t *this, task_manager_t *other_public)
1853 {
1854 private_task_manager_t *other = (private_task_manager_t*)other_public;
1855 task_t *task;
1856
1857 /* move queued tasks from other to this */
1858 while (other->queued_tasks->remove_last(other->queued_tasks,
1859 (void**)&task) == SUCCESS)
1860 {
1861 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1862 task->migrate(task, this->ike_sa);
1863 this->queued_tasks->insert_first(this->queued_tasks, task);
1864 }
1865 }
1866
1867 METHOD(task_manager_t, busy, bool,
1868 private_task_manager_t *this)
1869 {
1870 return (this->active_tasks->get_count(this->active_tasks) > 0);
1871 }
1872
1873 METHOD(task_manager_t, incr_mid, void,
1874 private_task_manager_t *this, bool initiate)
1875 {
1876 }
1877
1878 METHOD(task_manager_t, reset, void,
1879 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1880 {
1881 enumerator_t *enumerator;
1882 task_t *task;
1883
1884 /* reset message counters and retransmit packets */
1885 DESTROY_IF(this->responding.packet);
1886 DESTROY_IF(this->initiating.packet);
1887 this->responding.packet = NULL;
1888 this->responding.seqnr = RESPONDING_SEQ;
1889 this->responding.retransmitted = 0;
1890 this->initiating.packet = NULL;
1891 this->initiating.mid = 0;
1892 this->initiating.seqnr = 0;
1893 this->initiating.retransmitted = 0;
1894 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1895 clear_fragments(this, 0);
1896 if (initiate != UINT_MAX)
1897 {
1898 this->dpd_send = initiate;
1899 }
1900 if (respond != UINT_MAX)
1901 {
1902 this->dpd_recv = respond;
1903 }
1904
1905 /* reset queued tasks */
1906 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1907 while (enumerator->enumerate(enumerator, &task))
1908 {
1909 task->migrate(task, this->ike_sa);
1910 }
1911 enumerator->destroy(enumerator);
1912
1913 /* reset active tasks */
1914 while (this->active_tasks->remove_last(this->active_tasks,
1915 (void**)&task) == SUCCESS)
1916 {
1917 task->migrate(task, this->ike_sa);
1918 this->queued_tasks->insert_first(this->queued_tasks, task);
1919 }
1920 }
1921
1922 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1923 private_task_manager_t *this, task_queue_t queue)
1924 {
1925 switch (queue)
1926 {
1927 case TASK_QUEUE_ACTIVE:
1928 return this->active_tasks->create_enumerator(this->active_tasks);
1929 case TASK_QUEUE_PASSIVE:
1930 return this->passive_tasks->create_enumerator(this->passive_tasks);
1931 case TASK_QUEUE_QUEUED:
1932 return this->queued_tasks->create_enumerator(this->queued_tasks);
1933 default:
1934 return enumerator_create_empty();
1935 }
1936 }
1937
1938 METHOD(task_manager_t, destroy, void,
1939 private_task_manager_t *this)
1940 {
1941 flush(this);
1942
1943 this->active_tasks->destroy(this->active_tasks);
1944 this->queued_tasks->destroy(this->queued_tasks);
1945 this->passive_tasks->destroy(this->passive_tasks);
1946 clear_fragments(this, 0);
1947
1948 DESTROY_IF(this->queued);
1949 DESTROY_IF(this->responding.packet);
1950 DESTROY_IF(this->initiating.packet);
1951 DESTROY_IF(this->rng);
1952 free(this);
1953 }
1954
1955 /*
1956 * see header file
1957 */
1958 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1959 {
1960 private_task_manager_t *this;
1961
1962 INIT(this,
1963 .public = {
1964 .task_manager = {
1965 .process_message = _process_message,
1966 .queue_task = _queue_task,
1967 .queue_ike = _queue_ike,
1968 .queue_ike_rekey = _queue_ike_rekey,
1969 .queue_ike_reauth = _queue_ike_reauth,
1970 .queue_ike_delete = _queue_ike_delete,
1971 .queue_mobike = _queue_mobike,
1972 .queue_child = _queue_child,
1973 .queue_child_rekey = _queue_child_rekey,
1974 .queue_child_delete = _queue_child_delete,
1975 .queue_dpd = _queue_dpd,
1976 .initiate = _initiate,
1977 .retransmit = _retransmit,
1978 .incr_mid = _incr_mid,
1979 .reset = _reset,
1980 .adopt_tasks = _adopt_tasks,
1981 .busy = _busy,
1982 .create_task_enumerator = _create_task_enumerator,
1983 .flush_queue = _flush_queue,
1984 .destroy = _destroy,
1985 },
1986 },
1987 .initiating = {
1988 .type = EXCHANGE_TYPE_UNDEFINED,
1989 },
1990 .responding = {
1991 .seqnr = RESPONDING_SEQ,
1992 },
1993 .frag = {
1994 .exchange = ID_PROT,
1995 .max_packet = lib->settings->get_int(lib->settings,
1996 "%s.max_packet", MAX_PACKET, charon->name),
1997 .size = lib->settings->get_int(lib->settings,
1998 "%s.fragment_size", MAX_FRAGMENT_SIZE, charon->name),
1999 },
2000 .ike_sa = ike_sa,
2001 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
2002 .queued_tasks = linked_list_create(),
2003 .active_tasks = linked_list_create(),
2004 .passive_tasks = linked_list_create(),
2005 .retransmit_tries = lib->settings->get_int(lib->settings,
2006 "%s.retransmit_tries", RETRANSMIT_TRIES, charon->name),
2007 .retransmit_timeout = lib->settings->get_double(lib->settings,
2008 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name),
2009 .retransmit_base = lib->settings->get_double(lib->settings,
2010 "%s.retransmit_base", RETRANSMIT_BASE, charon->name),
2011 );
2012
2013 if (!this->rng)
2014 {
2015 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
2016 destroy(this);
2017 return NULL;
2018 }
2019 if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
2020 (void*)&this->dpd_send))
2021 {
2022 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
2023 destroy(this);
2024 return NULL;
2025 }
2026 this->dpd_send &= 0x7FFFFFFF;
2027
2028 return &this->public;
2029 }
2030