Moved liveness checking task creation to protocol specific task manager
[strongswan.git] / src / libcharon / sa / ikev2 / task_manager_v2.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2010 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v2.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev2/tasks/ike_init.h>
23 #include <sa/ikev2/tasks/ike_natd.h>
24 #include <sa/ikev2/tasks/ike_mobike.h>
25 #include <sa/ikev2/tasks/ike_auth.h>
26 #include <sa/ikev2/tasks/ike_auth_lifetime.h>
27 #include <sa/ikev2/tasks/ike_cert_pre.h>
28 #include <sa/ikev2/tasks/ike_cert_post.h>
29 #include <sa/ikev2/tasks/ike_rekey.h>
30 #include <sa/ikev2/tasks/ike_delete.h>
31 #include <sa/ikev2/tasks/ike_config.h>
32 #include <sa/ikev2/tasks/ike_dpd.h>
33 #include <sa/ikev2/tasks/ike_vendor.h>
34 #include <sa/ikev2/tasks/child_create.h>
35 #include <sa/ikev2/tasks/child_rekey.h>
36 #include <sa/ikev2/tasks/child_delete.h>
37 #include <encoding/payloads/delete_payload.h>
38 #include <encoding/payloads/unknown_payload.h>
39 #include <processing/jobs/retransmit_job.h>
40 #include <processing/jobs/delete_ike_sa_job.h>
41
42 #ifdef ME
43 #include <sa/ikev2/tasks/ike_me.h>
44 #endif
45
46 typedef struct exchange_t exchange_t;
47
48 /**
49 * An exchange in the air, used do detect and handle retransmission
50 */
51 struct exchange_t {
52
53 /**
54 * Message ID used for this transaction
55 */
56 u_int32_t mid;
57
58 /**
59 * generated packet for retransmission
60 */
61 packet_t *packet;
62 };
63
64 typedef struct private_task_manager_t private_task_manager_t;
65
66 /**
67 * private data of the task manager
68 */
69 struct private_task_manager_t {
70
71 /**
72 * public functions
73 */
74 task_manager_v2_t public;
75
76 /**
77 * associated IKE_SA we are serving
78 */
79 ike_sa_t *ike_sa;
80
81 /**
82 * Exchange we are currently handling as responder
83 */
84 struct {
85 /**
86 * Message ID of the exchange
87 */
88 u_int32_t mid;
89
90 /**
91 * packet for retransmission
92 */
93 packet_t *packet;
94
95 } responding;
96
97 /**
98 * Exchange we are currently handling as initiator
99 */
100 struct {
101 /**
102 * Message ID of the exchange
103 */
104 u_int32_t mid;
105
106 /**
107 * how many times we have retransmitted so far
108 */
109 u_int retransmitted;
110
111 /**
112 * packet for retransmission
113 */
114 packet_t *packet;
115
116 /**
117 * type of the initated exchange
118 */
119 exchange_type_t type;
120
121 } initiating;
122
123 /**
124 * List of queued tasks not yet in action
125 */
126 linked_list_t *queued_tasks;
127
128 /**
129 * List of active tasks, initiated by ourselve
130 */
131 linked_list_t *active_tasks;
132
133 /**
134 * List of tasks initiated by peer
135 */
136 linked_list_t *passive_tasks;
137
138 /**
139 * the task manager has been reset
140 */
141 bool reset;
142
143 /**
144 * Number of times we retransmit messages before giving up
145 */
146 u_int retransmit_tries;
147
148 /**
149 * Retransmission timeout
150 */
151 double retransmit_timeout;
152
153 /**
154 * Base to calculate retransmission timeout
155 */
156 double retransmit_base;
157 };
158
159 /**
160 * flush all tasks in the task manager
161 */
162 static void flush(private_task_manager_t *this)
163 {
164 this->queued_tasks->destroy_offset(this->queued_tasks,
165 offsetof(task_t, destroy));
166 this->queued_tasks = linked_list_create();
167 this->passive_tasks->destroy_offset(this->passive_tasks,
168 offsetof(task_t, destroy));
169 this->passive_tasks = linked_list_create();
170 this->active_tasks->destroy_offset(this->active_tasks,
171 offsetof(task_t, destroy));
172 this->active_tasks = linked_list_create();
173 }
174
175 /**
176 * move a task of a specific type from the queue to the active list
177 */
178 static bool activate_task(private_task_manager_t *this, task_type_t type)
179 {
180 enumerator_t *enumerator;
181 task_t *task;
182 bool found = FALSE;
183
184 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
185 while (enumerator->enumerate(enumerator, (void**)&task))
186 {
187 if (task->get_type(task) == type)
188 {
189 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
190 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
191 this->active_tasks->insert_last(this->active_tasks, task);
192 found = TRUE;
193 break;
194 }
195 }
196 enumerator->destroy(enumerator);
197 return found;
198 }
199
200 METHOD(task_manager_t, retransmit, status_t,
201 private_task_manager_t *this, u_int32_t message_id)
202 {
203 if (message_id == this->initiating.mid)
204 {
205 u_int32_t timeout;
206 job_t *job;
207 enumerator_t *enumerator;
208 packet_t *packet;
209 task_t *task;
210 ike_mobike_t *mobike = NULL;
211
212 /* check if we are retransmitting a MOBIKE routability check */
213 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
214 while (enumerator->enumerate(enumerator, (void*)&task))
215 {
216 if (task->get_type(task) == TASK_IKE_MOBIKE)
217 {
218 mobike = (ike_mobike_t*)task;
219 if (!mobike->is_probing(mobike))
220 {
221 mobike = NULL;
222 }
223 break;
224 }
225 }
226 enumerator->destroy(enumerator);
227
228 if (mobike == NULL)
229 {
230 if (this->initiating.retransmitted <= this->retransmit_tries)
231 {
232 timeout = (u_int32_t)(this->retransmit_timeout * 1000.0 *
233 pow(this->retransmit_base, this->initiating.retransmitted));
234 }
235 else
236 {
237 DBG1(DBG_IKE, "giving up after %d retransmits",
238 this->initiating.retransmitted - 1);
239 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
240 {
241 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
242 }
243 return DESTROY_ME;
244 }
245
246 if (this->initiating.retransmitted)
247 {
248 DBG1(DBG_IKE, "retransmit %d of request with message ID %d",
249 this->initiating.retransmitted, message_id);
250 }
251 packet = this->initiating.packet->clone(this->initiating.packet);
252 charon->sender->send(charon->sender, packet);
253 }
254 else
255 { /* for routeability checks, we use a more aggressive behavior */
256 if (this->initiating.retransmitted <= ROUTEABILITY_CHECK_TRIES)
257 {
258 timeout = ROUTEABILITY_CHECK_INTERVAL;
259 }
260 else
261 {
262 DBG1(DBG_IKE, "giving up after %d path probings",
263 this->initiating.retransmitted - 1);
264 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
265 return DESTROY_ME;
266 }
267
268 if (this->initiating.retransmitted)
269 {
270 DBG1(DBG_IKE, "path probing attempt %d",
271 this->initiating.retransmitted);
272 }
273 mobike->transmit(mobike, this->initiating.packet);
274 }
275
276 this->initiating.retransmitted++;
277 job = (job_t*)retransmit_job_create(this->initiating.mid,
278 this->ike_sa->get_id(this->ike_sa));
279 lib->scheduler->schedule_job_ms(lib->scheduler, job, timeout);
280 }
281 return SUCCESS;
282 }
283
284 METHOD(task_manager_t, initiate, status_t,
285 private_task_manager_t *this)
286 {
287 enumerator_t *enumerator;
288 task_t *task;
289 message_t *message;
290 host_t *me, *other;
291 status_t status;
292 exchange_type_t exchange = 0;
293
294 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED)
295 {
296 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
297 exchange_type_names, this->initiating.type);
298 /* do not initiate if we already have a message in the air */
299 return SUCCESS;
300 }
301
302 if (this->active_tasks->get_count(this->active_tasks) == 0)
303 {
304 DBG2(DBG_IKE, "activating new tasks");
305 switch (this->ike_sa->get_state(this->ike_sa))
306 {
307 case IKE_CREATED:
308 activate_task(this, TASK_IKE_VENDOR);
309 if (activate_task(this, TASK_IKE_INIT))
310 {
311 this->initiating.mid = 0;
312 exchange = IKE_SA_INIT;
313 activate_task(this, TASK_IKE_NATD);
314 activate_task(this, TASK_IKE_CERT_PRE);
315 #ifdef ME
316 /* this task has to be activated before the TASK_IKE_AUTH
317 * task, because that task pregenerates the packet after
318 * which no payloads can be added to the message anymore.
319 */
320 activate_task(this, TASK_IKE_ME);
321 #endif /* ME */
322 activate_task(this, TASK_IKE_AUTH);
323 activate_task(this, TASK_IKE_CERT_POST);
324 activate_task(this, TASK_IKE_CONFIG);
325 activate_task(this, TASK_CHILD_CREATE);
326 activate_task(this, TASK_IKE_AUTH_LIFETIME);
327 activate_task(this, TASK_IKE_MOBIKE);
328 }
329 break;
330 case IKE_ESTABLISHED:
331 if (activate_task(this, TASK_CHILD_CREATE))
332 {
333 exchange = CREATE_CHILD_SA;
334 break;
335 }
336 if (activate_task(this, TASK_CHILD_DELETE))
337 {
338 exchange = INFORMATIONAL;
339 break;
340 }
341 if (activate_task(this, TASK_CHILD_REKEY))
342 {
343 exchange = CREATE_CHILD_SA;
344 break;
345 }
346 if (activate_task(this, TASK_IKE_DELETE))
347 {
348 exchange = INFORMATIONAL;
349 break;
350 }
351 if (activate_task(this, TASK_IKE_REKEY))
352 {
353 exchange = CREATE_CHILD_SA;
354 break;
355 }
356 if (activate_task(this, TASK_IKE_REAUTH))
357 {
358 exchange = INFORMATIONAL;
359 break;
360 }
361 if (activate_task(this, TASK_IKE_MOBIKE))
362 {
363 exchange = INFORMATIONAL;
364 break;
365 }
366 if (activate_task(this, TASK_IKE_DPD))
367 {
368 exchange = INFORMATIONAL;
369 break;
370 }
371 #ifdef ME
372 if (activate_task(this, TASK_IKE_ME))
373 {
374 exchange = ME_CONNECT;
375 break;
376 }
377 #endif /* ME */
378 case IKE_REKEYING:
379 if (activate_task(this, TASK_IKE_DELETE))
380 {
381 exchange = INFORMATIONAL;
382 break;
383 }
384 case IKE_DELETING:
385 default:
386 break;
387 }
388 }
389 else
390 {
391 DBG2(DBG_IKE, "reinitiating already active tasks");
392 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
393 while (enumerator->enumerate(enumerator, (void**)&task))
394 {
395 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
396 switch (task->get_type(task))
397 {
398 case TASK_IKE_INIT:
399 exchange = IKE_SA_INIT;
400 break;
401 case TASK_IKE_AUTH:
402 exchange = IKE_AUTH;
403 break;
404 case TASK_CHILD_CREATE:
405 case TASK_CHILD_REKEY:
406 case TASK_IKE_REKEY:
407 exchange = CREATE_CHILD_SA;
408 break;
409 case TASK_IKE_MOBIKE:
410 exchange = INFORMATIONAL;
411 break;
412 default:
413 continue;
414 }
415 break;
416 }
417 enumerator->destroy(enumerator);
418 }
419
420 if (exchange == 0)
421 {
422 DBG2(DBG_IKE, "nothing to initiate");
423 /* nothing to do yet... */
424 return SUCCESS;
425 }
426
427 me = this->ike_sa->get_my_host(this->ike_sa);
428 other = this->ike_sa->get_other_host(this->ike_sa);
429
430 message = message_create(IKEV2_MAJOR_VERSION, IKEV2_MINOR_VERSION);
431 message->set_message_id(message, this->initiating.mid);
432 message->set_source(message, me->clone(me));
433 message->set_destination(message, other->clone(other));
434 message->set_exchange_type(message, exchange);
435 this->initiating.type = exchange;
436 this->initiating.retransmitted = 0;
437
438 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
439 while (enumerator->enumerate(enumerator, (void*)&task))
440 {
441 switch (task->build(task, message))
442 {
443 case SUCCESS:
444 /* task completed, remove it */
445 this->active_tasks->remove_at(this->active_tasks, enumerator);
446 task->destroy(task);
447 break;
448 case NEED_MORE:
449 /* processed, but task needs another exchange */
450 break;
451 case FAILED:
452 default:
453 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
454 {
455 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
456 }
457 /* FALL */
458 case DESTROY_ME:
459 /* critical failure, destroy IKE_SA */
460 enumerator->destroy(enumerator);
461 message->destroy(message);
462 flush(this);
463 return DESTROY_ME;
464 }
465 }
466 enumerator->destroy(enumerator);
467
468 /* update exchange type if a task changed it */
469 this->initiating.type = message->get_exchange_type(message);
470
471 status = this->ike_sa->generate_message(this->ike_sa, message,
472 &this->initiating.packet);
473 if (status != SUCCESS)
474 {
475 /* message generation failed. There is nothing more to do than to
476 * close the SA */
477 message->destroy(message);
478 flush(this);
479 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
480 return DESTROY_ME;
481 }
482 message->destroy(message);
483
484 return retransmit(this, this->initiating.mid);
485 }
486
487 /**
488 * handle an incoming response message
489 */
490 static status_t process_response(private_task_manager_t *this,
491 message_t *message)
492 {
493 enumerator_t *enumerator;
494 task_t *task;
495
496 if (message->get_exchange_type(message) != this->initiating.type)
497 {
498 DBG1(DBG_IKE, "received %N response, but expected %N",
499 exchange_type_names, message->get_exchange_type(message),
500 exchange_type_names, this->initiating.type);
501 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
502 return DESTROY_ME;
503 }
504
505 /* catch if we get resetted while processing */
506 this->reset = FALSE;
507 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
508 while (enumerator->enumerate(enumerator, (void*)&task))
509 {
510 switch (task->process(task, message))
511 {
512 case SUCCESS:
513 /* task completed, remove it */
514 this->active_tasks->remove_at(this->active_tasks, enumerator);
515 task->destroy(task);
516 break;
517 case NEED_MORE:
518 /* processed, but task needs another exchange */
519 break;
520 case FAILED:
521 default:
522 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
523 /* FALL */
524 case DESTROY_ME:
525 /* critical failure, destroy IKE_SA */
526 this->active_tasks->remove_at(this->active_tasks, enumerator);
527 enumerator->destroy(enumerator);
528 task->destroy(task);
529 return DESTROY_ME;
530 }
531 if (this->reset)
532 { /* start all over again if we were reset */
533 this->reset = FALSE;
534 enumerator->destroy(enumerator);
535 return initiate(this);
536 }
537 }
538 enumerator->destroy(enumerator);
539
540 this->initiating.mid++;
541 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
542 this->initiating.packet->destroy(this->initiating.packet);
543 this->initiating.packet = NULL;
544
545 return initiate(this);
546 }
547
548 /**
549 * handle exchange collisions
550 */
551 static bool handle_collisions(private_task_manager_t *this, task_t *task)
552 {
553 enumerator_t *enumerator;
554 task_t *active;
555 task_type_t type;
556
557 type = task->get_type(task);
558
559 /* do we have to check */
560 if (type == TASK_IKE_REKEY || type == TASK_CHILD_REKEY ||
561 type == TASK_CHILD_DELETE || type == TASK_IKE_DELETE ||
562 type == TASK_IKE_REAUTH)
563 {
564 /* find an exchange collision, and notify these tasks */
565 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
566 while (enumerator->enumerate(enumerator, (void**)&active))
567 {
568 switch (active->get_type(active))
569 {
570 case TASK_IKE_REKEY:
571 if (type == TASK_IKE_REKEY || type == TASK_IKE_DELETE ||
572 type == TASK_IKE_REAUTH)
573 {
574 ike_rekey_t *rekey = (ike_rekey_t*)active;
575 rekey->collide(rekey, task);
576 break;
577 }
578 continue;
579 case TASK_CHILD_REKEY:
580 if (type == TASK_CHILD_REKEY || type == TASK_CHILD_DELETE)
581 {
582 child_rekey_t *rekey = (child_rekey_t*)active;
583 rekey->collide(rekey, task);
584 break;
585 }
586 continue;
587 default:
588 continue;
589 }
590 enumerator->destroy(enumerator);
591 return TRUE;
592 }
593 enumerator->destroy(enumerator);
594 }
595 return FALSE;
596 }
597
598 /**
599 * build a response depending on the "passive" task list
600 */
601 static status_t build_response(private_task_manager_t *this, message_t *request)
602 {
603 enumerator_t *enumerator;
604 task_t *task;
605 message_t *message;
606 host_t *me, *other;
607 bool delete = FALSE;
608 status_t status;
609
610 me = request->get_destination(request);
611 other = request->get_source(request);
612
613 message = message_create(IKEV2_MAJOR_VERSION, IKEV2_MINOR_VERSION);
614 message->set_exchange_type(message, request->get_exchange_type(request));
615 /* send response along the path the request came in */
616 message->set_source(message, me->clone(me));
617 message->set_destination(message, other->clone(other));
618 message->set_message_id(message, this->responding.mid);
619 message->set_request(message, FALSE);
620
621 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
622 while (enumerator->enumerate(enumerator, (void*)&task))
623 {
624 switch (task->build(task, message))
625 {
626 case SUCCESS:
627 /* task completed, remove it */
628 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
629 if (!handle_collisions(this, task))
630 {
631 task->destroy(task);
632 }
633 break;
634 case NEED_MORE:
635 /* processed, but task needs another exchange */
636 if (handle_collisions(this, task))
637 {
638 this->passive_tasks->remove_at(this->passive_tasks,
639 enumerator);
640 }
641 break;
642 case FAILED:
643 default:
644 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
645 /* FALL */
646 case DESTROY_ME:
647 /* destroy IKE_SA, but SEND response first */
648 delete = TRUE;
649 break;
650 }
651 if (delete)
652 {
653 break;
654 }
655 }
656 enumerator->destroy(enumerator);
657
658 /* remove resonder SPI if IKE_SA_INIT failed */
659 if (delete && request->get_exchange_type(request) == IKE_SA_INIT)
660 {
661 ike_sa_id_t *id = this->ike_sa->get_id(this->ike_sa);
662 id->set_responder_spi(id, 0);
663 }
664
665 /* message complete, send it */
666 DESTROY_IF(this->responding.packet);
667 this->responding.packet = NULL;
668 status = this->ike_sa->generate_message(this->ike_sa, message,
669 &this->responding.packet);
670 message->destroy(message);
671 if (status != SUCCESS)
672 {
673 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
674 return DESTROY_ME;
675 }
676
677 charon->sender->send(charon->sender,
678 this->responding.packet->clone(this->responding.packet));
679 if (delete)
680 {
681 return DESTROY_ME;
682 }
683 return SUCCESS;
684 }
685
686 /**
687 * handle an incoming request message
688 */
689 static status_t process_request(private_task_manager_t *this,
690 message_t *message)
691 {
692 enumerator_t *enumerator;
693 task_t *task = NULL;
694 payload_t *payload;
695 notify_payload_t *notify;
696 delete_payload_t *delete;
697
698 if (this->passive_tasks->get_count(this->passive_tasks) == 0)
699 { /* create tasks depending on request type, if not already some queued */
700 switch (message->get_exchange_type(message))
701 {
702 case IKE_SA_INIT:
703 {
704 task = (task_t*)ike_vendor_create(this->ike_sa, FALSE);
705 this->passive_tasks->insert_last(this->passive_tasks, task);
706 task = (task_t*)ike_init_create(this->ike_sa, FALSE, NULL);
707 this->passive_tasks->insert_last(this->passive_tasks, task);
708 task = (task_t*)ike_natd_create(this->ike_sa, FALSE);
709 this->passive_tasks->insert_last(this->passive_tasks, task);
710 task = (task_t*)ike_cert_pre_create(this->ike_sa, FALSE);
711 this->passive_tasks->insert_last(this->passive_tasks, task);
712 #ifdef ME
713 task = (task_t*)ike_me_create(this->ike_sa, FALSE);
714 this->passive_tasks->insert_last(this->passive_tasks, task);
715 #endif /* ME */
716 task = (task_t*)ike_auth_create(this->ike_sa, FALSE);
717 this->passive_tasks->insert_last(this->passive_tasks, task);
718 task = (task_t*)ike_cert_post_create(this->ike_sa, FALSE);
719 this->passive_tasks->insert_last(this->passive_tasks, task);
720 task = (task_t*)ike_config_create(this->ike_sa, FALSE);
721 this->passive_tasks->insert_last(this->passive_tasks, task);
722 task = (task_t*)child_create_create(this->ike_sa, NULL, FALSE,
723 NULL, NULL);
724 this->passive_tasks->insert_last(this->passive_tasks, task);
725 task = (task_t*)ike_auth_lifetime_create(this->ike_sa, FALSE);
726 this->passive_tasks->insert_last(this->passive_tasks, task);
727 task = (task_t*)ike_mobike_create(this->ike_sa, FALSE);
728 this->passive_tasks->insert_last(this->passive_tasks, task);
729 break;
730 }
731 case CREATE_CHILD_SA:
732 { /* FIXME: we should prevent this on mediation connections */
733 bool notify_found = FALSE, ts_found = FALSE;
734 enumerator = message->create_payload_enumerator(message);
735 while (enumerator->enumerate(enumerator, &payload))
736 {
737 switch (payload->get_type(payload))
738 {
739 case NOTIFY:
740 { /* if we find a rekey notify, its CHILD_SA rekeying */
741 notify = (notify_payload_t*)payload;
742 if (notify->get_notify_type(notify) == REKEY_SA &&
743 (notify->get_protocol_id(notify) == PROTO_AH ||
744 notify->get_protocol_id(notify) == PROTO_ESP))
745 {
746 notify_found = TRUE;
747 }
748 break;
749 }
750 case TRAFFIC_SELECTOR_INITIATOR:
751 case TRAFFIC_SELECTOR_RESPONDER:
752 { /* if we don't find a TS, its IKE rekeying */
753 ts_found = TRUE;
754 break;
755 }
756 default:
757 break;
758 }
759 }
760 enumerator->destroy(enumerator);
761
762 if (ts_found)
763 {
764 if (notify_found)
765 {
766 task = (task_t*)child_rekey_create(this->ike_sa,
767 PROTO_NONE, 0);
768 }
769 else
770 {
771 task = (task_t*)child_create_create(this->ike_sa, NULL,
772 FALSE, NULL, NULL);
773 }
774 }
775 else
776 {
777 task = (task_t*)ike_rekey_create(this->ike_sa, FALSE);
778 }
779 this->passive_tasks->insert_last(this->passive_tasks, task);
780 break;
781 }
782 case INFORMATIONAL:
783 {
784 enumerator = message->create_payload_enumerator(message);
785 while (enumerator->enumerate(enumerator, &payload))
786 {
787 switch (payload->get_type(payload))
788 {
789 case NOTIFY:
790 {
791 notify = (notify_payload_t*)payload;
792 switch (notify->get_notify_type(notify))
793 {
794 case ADDITIONAL_IP4_ADDRESS:
795 case ADDITIONAL_IP6_ADDRESS:
796 case NO_ADDITIONAL_ADDRESSES:
797 case UPDATE_SA_ADDRESSES:
798 case NO_NATS_ALLOWED:
799 case UNACCEPTABLE_ADDRESSES:
800 case UNEXPECTED_NAT_DETECTED:
801 case COOKIE2:
802 case NAT_DETECTION_SOURCE_IP:
803 case NAT_DETECTION_DESTINATION_IP:
804 task = (task_t*)ike_mobike_create(
805 this->ike_sa, FALSE);
806 break;
807 case AUTH_LIFETIME:
808 task = (task_t*)ike_auth_lifetime_create(
809 this->ike_sa, FALSE);
810 break;
811 default:
812 break;
813 }
814 break;
815 }
816 case DELETE:
817 {
818 delete = (delete_payload_t*)payload;
819 if (delete->get_protocol_id(delete) == PROTO_IKE)
820 {
821 task = (task_t*)ike_delete_create(this->ike_sa,
822 FALSE);
823 }
824 else
825 {
826 task = (task_t*)child_delete_create(this->ike_sa,
827 PROTO_NONE, 0);
828 }
829 break;
830 }
831 default:
832 break;
833 }
834 if (task)
835 {
836 break;
837 }
838 }
839 enumerator->destroy(enumerator);
840
841 if (task == NULL)
842 {
843 task = (task_t*)ike_dpd_create(FALSE);
844 }
845 this->passive_tasks->insert_last(this->passive_tasks, task);
846 break;
847 }
848 #ifdef ME
849 case ME_CONNECT:
850 {
851 task = (task_t*)ike_me_create(this->ike_sa, FALSE);
852 this->passive_tasks->insert_last(this->passive_tasks, task);
853 }
854 #endif /* ME */
855 default:
856 break;
857 }
858 }
859
860 /* let the tasks process the message */
861 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
862 while (enumerator->enumerate(enumerator, (void*)&task))
863 {
864 switch (task->process(task, message))
865 {
866 case SUCCESS:
867 /* task completed, remove it */
868 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
869 task->destroy(task);
870 break;
871 case NEED_MORE:
872 /* processed, but task needs at least another call to build() */
873 break;
874 case FAILED:
875 default:
876 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
877 /* FALL */
878 case DESTROY_ME:
879 /* critical failure, destroy IKE_SA */
880 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
881 enumerator->destroy(enumerator);
882 task->destroy(task);
883 return DESTROY_ME;
884 }
885 }
886 enumerator->destroy(enumerator);
887
888 return build_response(this, message);
889 }
890
891 METHOD(task_manager_t, incr_mid, void,
892 private_task_manager_t *this, bool initiate)
893 {
894 if (initiate)
895 {
896 this->initiating.mid++;
897 }
898 else
899 {
900 this->responding.mid++;
901 }
902 }
903
904 /**
905 * Send a notify back to the sender
906 */
907 static void send_notify_response(private_task_manager_t *this,
908 message_t *request, notify_type_t type,
909 chunk_t data)
910 {
911 message_t *response;
912 packet_t *packet;
913 host_t *me, *other;
914
915 response = message_create(IKEV2_MAJOR_VERSION, IKEV2_MINOR_VERSION);
916 response->set_exchange_type(response, request->get_exchange_type(request));
917 response->set_request(response, FALSE);
918 response->set_message_id(response, request->get_message_id(request));
919 response->add_notify(response, FALSE, type, data);
920 me = this->ike_sa->get_my_host(this->ike_sa);
921 if (me->is_anyaddr(me))
922 {
923 me = request->get_destination(request);
924 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
925 }
926 other = this->ike_sa->get_other_host(this->ike_sa);
927 if (other->is_anyaddr(other))
928 {
929 other = request->get_source(request);
930 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
931 }
932 response->set_source(response, me->clone(me));
933 response->set_destination(response, other->clone(other));
934 if (this->ike_sa->generate_message(this->ike_sa, response,
935 &packet) == SUCCESS)
936 {
937 charon->sender->send(charon->sender, packet);
938 }
939 response->destroy(response);
940 }
941
942 /**
943 * Parse the given message and verify that it is valid.
944 */
945 static status_t parse_message(private_task_manager_t *this, message_t *msg)
946 {
947 status_t status;
948 u_int8_t type = 0;
949
950 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
951
952 if (status == SUCCESS)
953 { /* check for unsupported critical payloads */
954 enumerator_t *enumerator;
955 unknown_payload_t *unknown;
956 payload_t *payload;
957
958 enumerator = msg->create_payload_enumerator(msg);
959 while (enumerator->enumerate(enumerator, &payload))
960 {
961 unknown = (unknown_payload_t*)payload;
962 type = payload->get_type(payload);
963 if (!payload_is_known(type) &&
964 unknown->is_critical(unknown))
965 {
966 DBG1(DBG_ENC, "payload type %N is not supported, "
967 "but its critical!", payload_type_names, type);
968 status = NOT_SUPPORTED;
969 }
970 }
971 enumerator->destroy(enumerator);
972 }
973
974 if (status != SUCCESS)
975 {
976 bool is_request = msg->get_request(msg);
977
978 switch (status)
979 {
980 case NOT_SUPPORTED:
981 DBG1(DBG_IKE, "critical unknown payloads found");
982 if (is_request)
983 {
984 send_notify_response(this, msg,
985 UNSUPPORTED_CRITICAL_PAYLOAD,
986 chunk_from_thing(type));
987 incr_mid(this, FALSE);
988 }
989 break;
990 case PARSE_ERROR:
991 DBG1(DBG_IKE, "message parsing failed");
992 if (is_request)
993 {
994 send_notify_response(this, msg,
995 INVALID_SYNTAX, chunk_empty);
996 incr_mid(this, FALSE);
997 }
998 break;
999 case VERIFY_ERROR:
1000 DBG1(DBG_IKE, "message verification failed");
1001 if (is_request)
1002 {
1003 send_notify_response(this, msg,
1004 INVALID_SYNTAX, chunk_empty);
1005 incr_mid(this, FALSE);
1006 }
1007 break;
1008 case FAILED:
1009 DBG1(DBG_IKE, "integrity check failed");
1010 /* ignored */
1011 break;
1012 case INVALID_STATE:
1013 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1014 default:
1015 break;
1016 }
1017 DBG1(DBG_IKE, "%N %s with message ID %d processing failed",
1018 exchange_type_names, msg->get_exchange_type(msg),
1019 is_request ? "request" : "response",
1020 msg->get_message_id(msg));
1021
1022 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1023 { /* invalid initiation attempt, close SA */
1024 return DESTROY_ME;
1025 }
1026 }
1027 return status;
1028 }
1029
1030
1031 METHOD(task_manager_t, process_message, status_t,
1032 private_task_manager_t *this, message_t *msg)
1033 {
1034 host_t *me, *other;
1035 status_t status;
1036 u_int32_t mid;
1037
1038 status = parse_message(this, msg);
1039 if (status != SUCCESS)
1040 {
1041 return status;
1042 }
1043
1044 me = msg->get_destination(msg);
1045 other = msg->get_source(msg);
1046
1047 /* if this IKE_SA is virgin, we check for a config */
1048 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1049 {
1050 ike_sa_id_t *ike_sa_id;
1051 ike_cfg_t *ike_cfg;
1052 job_t *job;
1053 ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
1054 if (ike_cfg == NULL)
1055 {
1056 /* no config found for these hosts, destroy */
1057 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1058 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1059 send_notify_response(this, msg,
1060 NO_PROPOSAL_CHOSEN, chunk_empty);
1061 return DESTROY_ME;
1062 }
1063 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1064 ike_cfg->destroy(ike_cfg);
1065 /* add a timeout if peer does not establish it completely */
1066 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1067 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1068 lib->scheduler->schedule_job(lib->scheduler, job,
1069 lib->settings->get_int(lib->settings,
1070 "charon.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT));
1071 }
1072 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1073 time_monotonic(NULL));
1074
1075 mid = msg->get_message_id(msg);
1076 if (msg->get_request(msg))
1077 {
1078 if (mid == this->responding.mid)
1079 {
1080 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED ||
1081 this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING ||
1082 msg->get_exchange_type(msg) != IKE_SA_INIT)
1083 { /* only do host updates based on verified messages */
1084 if (!this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
1085 { /* with MOBIKE, we do no implicit updates */
1086 this->ike_sa->update_hosts(this->ike_sa, me, other, mid == 1);
1087 }
1088 }
1089 charon->bus->message(charon->bus, msg, TRUE);
1090 if (msg->get_exchange_type(msg) == EXCHANGE_TYPE_UNDEFINED)
1091 { /* ignore messages altered to EXCHANGE_TYPE_UNDEFINED */
1092 return SUCCESS;
1093 }
1094 if (process_request(this, msg) != SUCCESS)
1095 {
1096 flush(this);
1097 return DESTROY_ME;
1098 }
1099 this->responding.mid++;
1100 }
1101 else if ((mid == this->responding.mid - 1) && this->responding.packet)
1102 {
1103 packet_t *clone;
1104 host_t *host;
1105
1106 DBG1(DBG_IKE, "received retransmit of request with ID %d, "
1107 "retransmitting response", mid);
1108 clone = this->responding.packet->clone(this->responding.packet);
1109 host = msg->get_destination(msg);
1110 clone->set_source(clone, host->clone(host));
1111 host = msg->get_source(msg);
1112 clone->set_destination(clone, host->clone(host));
1113 charon->sender->send(charon->sender, clone);
1114 }
1115 else
1116 {
1117 DBG1(DBG_IKE, "received message ID %d, expected %d. Ignored",
1118 mid, this->responding.mid);
1119 }
1120 }
1121 else
1122 {
1123 if (mid == this->initiating.mid)
1124 {
1125 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED ||
1126 this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING ||
1127 msg->get_exchange_type(msg) != IKE_SA_INIT)
1128 { /* only do host updates based on verified messages */
1129 if (!this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
1130 { /* with MOBIKE, we do no implicit updates */
1131 this->ike_sa->update_hosts(this->ike_sa, me, other, FALSE);
1132 }
1133 }
1134 charon->bus->message(charon->bus, msg, TRUE);
1135 if (msg->get_exchange_type(msg) == EXCHANGE_TYPE_UNDEFINED)
1136 { /* ignore messages altered to EXCHANGE_TYPE_UNDEFINED */
1137 return SUCCESS;
1138 }
1139 if (process_response(this, msg) != SUCCESS)
1140 {
1141 flush(this);
1142 return DESTROY_ME;
1143 }
1144 }
1145 else
1146 {
1147 DBG1(DBG_IKE, "received message ID %d, expected %d. Ignored",
1148 mid, this->initiating.mid);
1149 return SUCCESS;
1150 }
1151 }
1152 return SUCCESS;
1153 }
1154
1155 METHOD(task_manager_t, queue_task, void,
1156 private_task_manager_t *this, task_t *task)
1157 {
1158 if (task->get_type(task) == TASK_IKE_MOBIKE)
1159 { /* there is no need to queue more than one mobike task */
1160 enumerator_t *enumerator;
1161 task_t *current;
1162
1163 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1164 while (enumerator->enumerate(enumerator, (void**)&current))
1165 {
1166 if (current->get_type(current) == TASK_IKE_MOBIKE)
1167 {
1168 enumerator->destroy(enumerator);
1169 task->destroy(task);
1170 return;
1171 }
1172 }
1173 enumerator->destroy(enumerator);
1174 }
1175 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1176 this->queued_tasks->insert_last(this->queued_tasks, task);
1177 }
1178
1179 METHOD(task_manager_t, queue_dpd, void,
1180 private_task_manager_t *this)
1181 {
1182 ike_mobike_t *mobike;
1183
1184 if (this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE) &&
1185 this->ike_sa->has_condition(this->ike_sa, COND_NAT_HERE))
1186 {
1187 /* use mobike enabled DPD to detect NAT mapping changes */
1188 mobike = ike_mobike_create(this->ike_sa, TRUE);
1189 mobike->dpd(mobike);
1190 queue_task(this, &mobike->task);
1191 }
1192 else
1193 {
1194 queue_task(this, (task_t*)ike_dpd_create(TRUE));
1195 }
1196 }
1197
1198
1199 METHOD(task_manager_t, adopt_tasks, void,
1200 private_task_manager_t *this, task_manager_t *other_public)
1201 {
1202 private_task_manager_t *other = (private_task_manager_t*)other_public;
1203 task_t *task;
1204
1205 /* move queued tasks from other to this */
1206 while (other->queued_tasks->remove_last(other->queued_tasks,
1207 (void**)&task) == SUCCESS)
1208 {
1209 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1210 task->migrate(task, this->ike_sa);
1211 this->queued_tasks->insert_first(this->queued_tasks, task);
1212 }
1213 }
1214
1215 METHOD(task_manager_t, busy, bool,
1216 private_task_manager_t *this)
1217 {
1218 return (this->active_tasks->get_count(this->active_tasks) > 0);
1219 }
1220
1221 METHOD(task_manager_t, reset, void,
1222 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1223 {
1224 enumerator_t *enumerator;
1225 task_t *task;
1226
1227 /* reset message counters and retransmit packets */
1228 DESTROY_IF(this->responding.packet);
1229 DESTROY_IF(this->initiating.packet);
1230 this->responding.packet = NULL;
1231 this->initiating.packet = NULL;
1232 if (initiate != UINT_MAX)
1233 {
1234 this->initiating.mid = initiate;
1235 }
1236 if (respond != UINT_MAX)
1237 {
1238 this->responding.mid = respond;
1239 }
1240 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1241
1242 /* reset queued tasks */
1243 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1244 while (enumerator->enumerate(enumerator, &task))
1245 {
1246 task->migrate(task, this->ike_sa);
1247 }
1248 enumerator->destroy(enumerator);
1249
1250 /* reset active tasks */
1251 while (this->active_tasks->remove_last(this->active_tasks,
1252 (void**)&task) == SUCCESS)
1253 {
1254 task->migrate(task, this->ike_sa);
1255 this->queued_tasks->insert_first(this->queued_tasks, task);
1256 }
1257
1258 this->reset = TRUE;
1259 }
1260
1261 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1262 private_task_manager_t *this, task_queue_t queue)
1263 {
1264 switch (queue)
1265 {
1266 case TASK_QUEUE_ACTIVE:
1267 return this->active_tasks->create_enumerator(this->active_tasks);
1268 case TASK_QUEUE_PASSIVE:
1269 return this->passive_tasks->create_enumerator(this->passive_tasks);
1270 case TASK_QUEUE_QUEUED:
1271 return this->queued_tasks->create_enumerator(this->queued_tasks);
1272 default:
1273 return enumerator_create_empty();
1274 }
1275 }
1276
1277 METHOD(task_manager_t, destroy, void,
1278 private_task_manager_t *this)
1279 {
1280 flush(this);
1281
1282 this->active_tasks->destroy(this->active_tasks);
1283 this->queued_tasks->destroy(this->queued_tasks);
1284 this->passive_tasks->destroy(this->passive_tasks);
1285
1286 DESTROY_IF(this->responding.packet);
1287 DESTROY_IF(this->initiating.packet);
1288 free(this);
1289 }
1290
1291 /*
1292 * see header file
1293 */
1294 task_manager_v2_t *task_manager_v2_create(ike_sa_t *ike_sa)
1295 {
1296 private_task_manager_t *this;
1297
1298 INIT(this,
1299 .public = {
1300 .task_manager = {
1301 .process_message = _process_message,
1302 .queue_task = _queue_task,
1303 .queue_dpd = _queue_dpd,
1304 .initiate = _initiate,
1305 .retransmit = _retransmit,
1306 .incr_mid = _incr_mid,
1307 .reset = _reset,
1308 .adopt_tasks = _adopt_tasks,
1309 .busy = _busy,
1310 .create_task_enumerator = _create_task_enumerator,
1311 .destroy = _destroy,
1312 },
1313 },
1314 .ike_sa = ike_sa,
1315 .initiating.type = EXCHANGE_TYPE_UNDEFINED,
1316 .queued_tasks = linked_list_create(),
1317 .active_tasks = linked_list_create(),
1318 .passive_tasks = linked_list_create(),
1319 .retransmit_tries = lib->settings->get_int(lib->settings,
1320 "charon.retransmit_tries", RETRANSMIT_TRIES),
1321 .retransmit_timeout = lib->settings->get_double(lib->settings,
1322 "charon.retransmit_timeout", RETRANSMIT_TIMEOUT),
1323 .retransmit_base = lib->settings->get_double(lib->settings,
1324 "charon.retransmit_base", RETRANSMIT_BASE),
1325 );
1326
1327 return &this->public;
1328 }