Handle initiation of not supported IKE versions properly
[strongswan.git] / src / libcharon / sa / ikev2 / tasks / ike_rekey.c
1 /*
2 * Copyright (C) 2005-2008 Martin Willi
3 * Copyright (C) 2005 Jan Hutter
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "ike_rekey.h"
18
19 #include <daemon.h>
20 #include <encoding/payloads/notify_payload.h>
21 #include <sa/ikev2/tasks/ike_init.h>
22 #include <sa/ikev2/tasks/ike_delete.h>
23 #include <processing/jobs/delete_ike_sa_job.h>
24 #include <processing/jobs/rekey_ike_sa_job.h>
25
26
27 typedef struct private_ike_rekey_t private_ike_rekey_t;
28
29 /**
30 * Private members of a ike_rekey_t task.
31 */
32 struct private_ike_rekey_t {
33
34 /**
35 * Public methods and task_t interface.
36 */
37 ike_rekey_t public;
38
39 /**
40 * Assigned IKE_SA.
41 */
42 ike_sa_t *ike_sa;
43
44 /**
45 * New IKE_SA which replaces the current one
46 */
47 ike_sa_t *new_sa;
48
49 /**
50 * Are we the initiator?
51 */
52 bool initiator;
53
54 /**
55 * the TASK_IKE_INIT task which is reused to simplify rekeying
56 */
57 ike_init_t *ike_init;
58
59 /**
60 * IKE_DELETE task to delete the old IKE_SA after rekeying was successful
61 */
62 ike_delete_t *ike_delete;
63
64 /**
65 * colliding task detected by the task manager
66 */
67 task_t *collision;
68 };
69
70 /**
71 * Establish the new replacement IKE_SA
72 */
73 static void establish_new(private_ike_rekey_t *this)
74 {
75 if (this->new_sa)
76 {
77 this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
78 DBG0(DBG_IKE, "IKE_SA %s[%d] rekeyed between %H[%Y]...%H[%Y]",
79 this->new_sa->get_name(this->new_sa),
80 this->new_sa->get_unique_id(this->new_sa),
81 this->ike_sa->get_my_host(this->ike_sa),
82 this->ike_sa->get_my_id(this->ike_sa),
83 this->ike_sa->get_other_host(this->ike_sa),
84 this->ike_sa->get_other_id(this->ike_sa));
85
86 this->new_sa->inherit(this->new_sa, this->ike_sa);
87 charon->bus->ike_rekey(charon->bus, this->ike_sa, this->new_sa);
88 charon->ike_sa_manager->checkin(charon->ike_sa_manager, this->new_sa);
89 this->new_sa = NULL;
90 /* set threads active IKE_SA after checkin */
91 charon->bus->set_sa(charon->bus, this->ike_sa);
92 }
93 }
94
95 METHOD(task_t, process_r_delete, status_t,
96 private_ike_rekey_t *this, message_t *message)
97 {
98 establish_new(this);
99 return this->ike_delete->task.process(&this->ike_delete->task, message);
100 }
101
102 METHOD(task_t, build_r_delete, status_t,
103 private_ike_rekey_t *this, message_t *message)
104 {
105 return this->ike_delete->task.build(&this->ike_delete->task, message);
106 }
107
108 METHOD(task_t, build_i_delete, status_t,
109 private_ike_rekey_t *this, message_t *message)
110 {
111 /* update exchange type to INFORMATIONAL for the delete */
112 message->set_exchange_type(message, INFORMATIONAL);
113
114 return this->ike_delete->task.build(&this->ike_delete->task, message);
115 }
116
117 METHOD(task_t, process_i_delete, status_t,
118 private_ike_rekey_t *this, message_t *message)
119 {
120 return this->ike_delete->task.process(&this->ike_delete->task, message);
121 }
122
123 METHOD(task_t, build_i, status_t,
124 private_ike_rekey_t *this, message_t *message)
125 {
126 ike_version_t version;
127 peer_cfg_t *peer_cfg;
128 host_t *other_host;
129
130 /* create new SA only on first try */
131 if (this->new_sa == NULL)
132 {
133 version = this->ike_sa->get_version(this->ike_sa);
134 this->new_sa = charon->ike_sa_manager->checkout_new(
135 charon->ike_sa_manager, version, TRUE);
136 if (!this->new_sa)
137 { /* shouldn't happen */
138 return FAILED;
139 }
140 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
141 other_host = this->ike_sa->get_other_host(this->ike_sa);
142 this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
143 this->new_sa->set_other_host(this->new_sa, other_host->clone(other_host));
144 this->ike_init = ike_init_create(this->new_sa, TRUE, this->ike_sa);
145 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
146 }
147 this->ike_init->task.build(&this->ike_init->task, message);
148
149 return NEED_MORE;
150 }
151
152 METHOD(task_t, process_r, status_t,
153 private_ike_rekey_t *this, message_t *message)
154 {
155 enumerator_t *enumerator;
156 peer_cfg_t *peer_cfg;
157 child_sa_t *child_sa;
158
159 if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
160 {
161 DBG1(DBG_IKE, "peer initiated rekeying, but we are deleting");
162 return NEED_MORE;
163 }
164
165 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
166 while (enumerator->enumerate(enumerator, (void**)&child_sa))
167 {
168 switch (child_sa->get_state(child_sa))
169 {
170 case CHILD_CREATED:
171 case CHILD_REKEYING:
172 case CHILD_DELETING:
173 /* we do not allow rekeying while we have children in-progress */
174 DBG1(DBG_IKE, "peer initiated rekeying, but a child is half-open");
175 enumerator->destroy(enumerator);
176 return NEED_MORE;
177 default:
178 break;
179 }
180 }
181 enumerator->destroy(enumerator);
182
183 this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
184 this->ike_sa->get_version(this->ike_sa), FALSE);
185 if (!this->new_sa)
186 { /* shouldn't happen */
187 return FAILED;
188 }
189
190 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
191 this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
192 this->ike_init = ike_init_create(this->new_sa, FALSE, this->ike_sa);
193 this->ike_init->task.process(&this->ike_init->task, message);
194
195 return NEED_MORE;
196 }
197
198 METHOD(task_t, build_r, status_t,
199 private_ike_rekey_t *this, message_t *message)
200 {
201 if (this->new_sa == NULL)
202 {
203 /* IKE_SA/a CHILD_SA is in an inacceptable state, deny rekeying */
204 message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
205 return SUCCESS;
206 }
207
208 if (this->ike_init->task.build(&this->ike_init->task, message) == FAILED)
209 {
210 return SUCCESS;
211 }
212
213 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
214
215 /* rekeying successful, delete the IKE_SA using a subtask */
216 this->ike_delete = ike_delete_create(this->ike_sa, FALSE);
217 this->public.task.build = _build_r_delete;
218 this->public.task.process = _process_r_delete;
219
220 return NEED_MORE;
221 }
222
223 METHOD(task_t, process_i, status_t,
224 private_ike_rekey_t *this, message_t *message)
225 {
226 if (message->get_notify(message, NO_ADDITIONAL_SAS))
227 {
228 DBG1(DBG_IKE, "peer seems to not support IKE rekeying, "
229 "starting reauthentication");
230 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
231 lib->processor->queue_job(lib->processor,
232 (job_t*)rekey_ike_sa_job_create(
233 this->ike_sa->get_id(this->ike_sa), TRUE));
234 return SUCCESS;
235 }
236
237 switch (this->ike_init->task.process(&this->ike_init->task, message))
238 {
239 case FAILED:
240 /* rekeying failed, fallback to old SA */
241 if (!(this->collision && (
242 this->collision->get_type(this->collision) == TASK_IKE_DELETE ||
243 this->collision->get_type(this->collision) == TASK_IKE_REAUTH)))
244 {
245 job_t *job;
246 u_int32_t retry = RETRY_INTERVAL - (random() % RETRY_JITTER);
247 job = (job_t*)rekey_ike_sa_job_create(
248 this->ike_sa->get_id(this->ike_sa), FALSE);
249 DBG1(DBG_IKE, "IKE_SA rekeying failed, "
250 "trying again in %d seconds", retry);
251 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
252 lib->scheduler->schedule_job(lib->scheduler, job, retry);
253 }
254 return SUCCESS;
255 case NEED_MORE:
256 /* bad dh group, try again */
257 this->ike_init->task.migrate(&this->ike_init->task, this->new_sa);
258 return NEED_MORE;
259 default:
260 break;
261 }
262
263 /* check for collisions */
264 if (this->collision &&
265 this->collision->get_type(this->collision) == TASK_IKE_REKEY)
266 {
267 private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision;
268
269 /* ike_init can be NULL, if child_sa is half-open */
270 if (other->ike_init)
271 {
272 host_t *host;
273 chunk_t this_nonce, other_nonce;
274
275 this_nonce = this->ike_init->get_lower_nonce(this->ike_init);
276 other_nonce = other->ike_init->get_lower_nonce(other->ike_init);
277
278 /* if we have the lower nonce, delete rekeyed SA. If not, delete
279 * the redundant. */
280 if (memcmp(this_nonce.ptr, other_nonce.ptr,
281 min(this_nonce.len, other_nonce.len)) > 0)
282 {
283 /* peer should delete this SA. Add a timeout just in case. */
284 job_t *job = (job_t*)delete_ike_sa_job_create(
285 other->new_sa->get_id(other->new_sa), TRUE);
286 lib->scheduler->schedule_job(lib->scheduler, job, 10);
287 DBG1(DBG_IKE, "IKE_SA rekey collision won, waiting for delete");
288 charon->ike_sa_manager->checkin(charon->ike_sa_manager, other->new_sa);
289 other->new_sa = NULL;
290 }
291 else
292 {
293 DBG1(DBG_IKE, "IKE_SA rekey collision lost, "
294 "deleting redundant IKE_SA");
295 /* apply host for a proper delete */
296 host = this->ike_sa->get_my_host(this->ike_sa);
297 this->new_sa->set_my_host(this->new_sa, host->clone(host));
298 host = this->ike_sa->get_other_host(this->ike_sa);
299 this->new_sa->set_other_host(this->new_sa, host->clone(host));
300 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
301 this->new_sa->set_state(this->new_sa, IKE_REKEYING);
302 if (this->new_sa->delete(this->new_sa) == DESTROY_ME)
303 {
304 this->new_sa->destroy(this->new_sa);
305 }
306 else
307 {
308 charon->ike_sa_manager->checkin(
309 charon->ike_sa_manager, this->new_sa);
310 /* set threads active IKE_SA after checkin */
311 charon->bus->set_sa(charon->bus, this->ike_sa);
312 }
313 this->new_sa = NULL;
314 establish_new(other);
315 return SUCCESS;
316 }
317 }
318 /* set threads active IKE_SA after checkin */
319 charon->bus->set_sa(charon->bus, this->ike_sa);
320 }
321
322 establish_new(this);
323
324 /* rekeying successful, delete the IKE_SA using a subtask */
325 this->ike_delete = ike_delete_create(this->ike_sa, TRUE);
326 this->public.task.build = _build_i_delete;
327 this->public.task.process = _process_i_delete;
328
329 return NEED_MORE;
330 }
331
332 METHOD(task_t, get_type, task_type_t,
333 private_ike_rekey_t *this)
334 {
335 return TASK_IKE_REKEY;
336 }
337
338 METHOD(ike_rekey_t, collide, void,
339 private_ike_rekey_t* this, task_t *other)
340 {
341 DBG1(DBG_IKE, "detected %N collision with %N", task_type_names,
342 TASK_IKE_REKEY, task_type_names, other->get_type(other));
343 DESTROY_IF(this->collision);
344 this->collision = other;
345 }
346
347 METHOD(task_t, migrate, void,
348 private_ike_rekey_t *this, ike_sa_t *ike_sa)
349 {
350 if (this->ike_init)
351 {
352 this->ike_init->task.destroy(&this->ike_init->task);
353 }
354 if (this->ike_delete)
355 {
356 this->ike_delete->task.destroy(&this->ike_delete->task);
357 }
358 DESTROY_IF(this->new_sa);
359 DESTROY_IF(this->collision);
360
361 this->collision = NULL;
362 this->ike_sa = ike_sa;
363 this->new_sa = NULL;
364 this->ike_init = NULL;
365 this->ike_delete = NULL;
366 }
367
368 METHOD(task_t, destroy, void,
369 private_ike_rekey_t *this)
370 {
371 if (this->ike_init)
372 {
373 this->ike_init->task.destroy(&this->ike_init->task);
374 }
375 if (this->ike_delete)
376 {
377 this->ike_delete->task.destroy(&this->ike_delete->task);
378 }
379 DESTROY_IF(this->new_sa);
380 DESTROY_IF(this->collision);
381 free(this);
382 }
383
384 /*
385 * Described in header.
386 */
387 ike_rekey_t *ike_rekey_create(ike_sa_t *ike_sa, bool initiator)
388 {
389 private_ike_rekey_t *this;
390
391 INIT(this,
392 .public = {
393 .task = {
394 .get_type = _get_type,
395 .build = _build_r,
396 .process = _process_r,
397 .migrate = _migrate,
398 .destroy = _destroy,
399 },
400 .collide = _collide,
401 },
402 .ike_sa = ike_sa,
403 .initiator = initiator,
404 );
405 if (initiator)
406 {
407 this->public.task.build = _build_i;
408 this->public.task.process = _process_i;
409 }
410
411 return &this->public;
412 }