src/libcharon/sa/ikev2/tasks/ike_reauth.c

   1 /*
   2  * Copyright (C) 2006-2008 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "ike_reauth.h"
  17
  18 #include <daemon.h>
  19 #include <sa/ikev2/tasks/ike_delete.h>
  20
  21
  22 typedef struct private_ike_reauth_t private_ike_reauth_t;
  23
  24 /**
  25  * Private members of a ike_reauth_t task.
  26  */
  27 struct private_ike_reauth_t {
  28
  29         /**
  30          * Public methods and task_t interface.
  31          */
  32         ike_reauth_t public;
  33
  34         /**
  35          * Assigned IKE_SA.
  36          */
  37         ike_sa_t *ike_sa;
  38
  39         /**
  40          * reused ike_delete task
  41          */
  42         ike_delete_t *ike_delete;
  43 };
  44
  45 METHOD(task_t, build_i, status_t,
  46         private_ike_reauth_t *this, message_t *message)
  47 {
  48         return this->ike_delete->task.build(&this->ike_delete->task, message);
  49 }
  50
  51 METHOD(task_t, process_i, status_t,
  52         private_ike_reauth_t *this, message_t *message)
  53 {
  54         ike_sa_t *new;
  55         host_t *host;
  56         enumerator_t *enumerator;
  57         child_sa_t *child_sa;
  58         peer_cfg_t *peer_cfg;
  59
  60         /* process delete response first */
  61         this->ike_delete->task.process(&this->ike_delete->task, message);
  62
  63         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
  64
  65         /* reauthenticate only if we have children */
  66         if (this->ike_sa->get_child_count(this->ike_sa) == 0
  67 #ifdef ME
  68                 /* we allow peers to reauth mediation connections (without children) */
  69                 && !peer_cfg->is_mediation(peer_cfg)
  70 #endif /* ME */
  71                 )
  72         {
  73                 DBG1(DBG_IKE, "unable to reauthenticate IKE_SA, no CHILD_SA to recreate");
  74                 return FAILED;
  75         }
  76
  77         new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
  78                                                                 this->ike_sa->get_version(this->ike_sa), TRUE);
  79         if (!new)
  80         {       /* shouldn't happen */
  81                 return FAILED;
  82         }
  83
  84         new->set_peer_cfg(new, peer_cfg);
  85         host = this->ike_sa->get_other_host(this->ike_sa);
  86         new->set_other_host(new, host->clone(host));
  87         host = this->ike_sa->get_my_host(this->ike_sa);
  88         new->set_my_host(new, host->clone(host));
  89         /* if we already have a virtual IP, we reuse it */
  90         host = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
  91         if (host)
  92         {
  93                 new->set_virtual_ip(new, TRUE, host);
  94         }
  95
  96 #ifdef ME
  97         /* we initiate the new IKE_SA of the mediation connection without CHILD_SA */
  98         if (peer_cfg->is_mediation(peer_cfg))
  99         {
 100                 if (new->initiate(new, NULL, 0, NULL, NULL) == DESTROY_ME)
 101                 {
 102                         charon->ike_sa_manager->checkin_and_destroy(
 103                                                                 charon->ike_sa_manager, new);
 104                         /* set threads active IKE_SA after checkin */
 105                         charon->bus->set_sa(charon->bus, this->ike_sa);
 106                         DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
 107                         return FAILED;
 108                 }
 109         }
 110 #endif /* ME */
 111
 112         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
 113         while (enumerator->enumerate(enumerator, (void**)&child_sa))
 114         {
 115                 switch (child_sa->get_state(child_sa))
 116                 {
 117                         case CHILD_ROUTED:
 118                         {
 119                                 /* move routed child directly */
 120                                 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
 121                                 new->add_child_sa(new, child_sa);
 122                                 break;
 123                         }
 124                         default:
 125                         {
 126                                 /* initiate/queue all child SAs */
 127                                 child_cfg_t *child_cfg = child_sa->get_config(child_sa);
 128                                 child_cfg->get_ref(child_cfg);
 129                                 if (new->initiate(new, child_cfg, 0, NULL, NULL) == DESTROY_ME)
 130                                 {
 131                                         enumerator->destroy(enumerator);
 132                                         charon->ike_sa_manager->checkin_and_destroy(
 133                                                                                 charon->ike_sa_manager, new);
 134                                         /* set threads active IKE_SA after checkin */
 135                                         charon->bus->set_sa(charon->bus, this->ike_sa);
 136                                         DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
 137                                         return FAILED;
 138                                 }
 139                                 break;
 140                         }
 141                 }
 142         }
 143         enumerator->destroy(enumerator);
 144         charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
 145         /* set threads active IKE_SA after checkin */
 146         charon->bus->set_sa(charon->bus, this->ike_sa);
 147
 148         /* we always destroy the obsolete IKE_SA */
 149         return DESTROY_ME;
 150 }
 151
 152 METHOD(task_t, get_type, task_type_t,
 153         private_ike_reauth_t *this)
 154 {
 155         return TASK_IKE_REAUTH;
 156 }
 157
 158 METHOD(task_t, migrate, void,
 159         private_ike_reauth_t *this, ike_sa_t *ike_sa)
 160 {
 161         this->ike_delete->task.migrate(&this->ike_delete->task, ike_sa);
 162         this->ike_sa = ike_sa;
 163 }
 164
 165 METHOD(task_t, destroy, void,
 166         private_ike_reauth_t *this)
 167 {
 168         this->ike_delete->task.destroy(&this->ike_delete->task);
 169         free(this);
 170 }
 171
 172 /*
 173  * Described in header.
 174  */
 175 ike_reauth_t *ike_reauth_create(ike_sa_t *ike_sa)
 176 {
 177         private_ike_reauth_t *this;
 178
 179         INIT(this,
 180                 .public = {
 181                         .task = {
 182                                 .get_type = _get_type,
 183                                 .migrate = _migrate,
 184                                 .build = _build_i,
 185                                 .process = _process_i,
 186                                 .destroy = _destroy,
 187                         },
 188                 },
 189                 .ike_sa = ike_sa,
 190                 .ike_delete = ike_delete_create(ike_sa, TRUE),
 191         );
 192
 193         return &this->public;
 194 }