src/libcharon/sa/task_manager_v1.c

   1 /*
   2  * Copyright (C) 2007-2011 Tobias Brunner
   3  * Copyright (C) 2007-2011 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include "task_manager_v1.h"
  18
  19 #include <math.h>
  20
  21 #include <daemon.h>
  22 #include <sa/tasks/main_mode.h>
  23 #include <sa/tasks/quick_mode.h>
  24 #include <sa/tasks/xauth.h>
  25 #include <sa/tasks/mode_config.h>
  26 #include <sa/tasks/informational.h>
  27 #include <sa/tasks/ike_natd_v1.h>
  28 #include <sa/tasks/ike_vendor_v1.h>
  29 #include <sa/tasks/isakmp_cert_pre.h>
  30 #include <sa/tasks/isakmp_cert_post.h>
  31 #include <processing/jobs/retransmit_job.h>
  32 #include <processing/jobs/delete_ike_sa_job.h>
  33
  34 /**
  35  * Number of old messages hashes we keep for retransmission.
  36  *
  37  * In Main Mode, we must ignore messages from a previous message pair if
  38  * we already continued to the next. Otherwise a late retransmission
  39  * could be considered as a reply to the newer request.
  40  */
  41 #define MAX_OLD_HASHES 2
  42
  43 typedef struct exchange_t exchange_t;
  44
  45 /**
  46  * An exchange in the air, used do detect and handle retransmission
  47  */
  48 struct exchange_t {
  49
  50         /**
  51          * Message ID used for this transaction
  52          */
  53         u_int32_t mid;
  54
  55         /**
  56          * generated packet for retransmission
  57          */
  58         packet_t *packet;
  59 };
  60
  61 typedef struct private_task_manager_t private_task_manager_t;
  62
  63 /**
  64  * private data of the task manager
  65  */
  66 struct private_task_manager_t {
  67
  68         /**
  69          * public functions
  70          */
  71         task_manager_v1_t public;
  72
  73         /**
  74          * associated IKE_SA we are serving
  75          */
  76         ike_sa_t *ike_sa;
  77
  78         /**
  79          * RNG to create message IDs
  80          */
  81         rng_t *rng;
  82
  83         /**
  84          * Exchange we are currently handling as responder
  85          */
  86         struct {
  87                 /**
  88                  * Hash of a previously received message
  89                  */
  90                 u_int32_t hash;
  91
  92                 /**
  93                  * packet for retransmission
  94                  */
  95                 packet_t *packet;
  96
  97         } responding;
  98
  99         /**
 100          * Exchange we are currently handling as initiator
 101          */
 102         struct {
 103                 /**
 104                  * Message ID of the exchange
 105                  */
 106                 u_int32_t mid;
 107
 108                 /**
 109                  * Hashes of old responses we can ignore
 110                  */
 111                 u_int32_t old_hashes[MAX_OLD_HASHES];
 112
 113                 /**
 114                  * Position in old hash array
 115                  */
 116                 int old_hash_pos;
 117
 118                 /**
 119                  * Sequence number of the last sent message
 120                  */
 121                 u_int32_t seqnr;
 122
 123                 /**
 124                  * how many times we have retransmitted so far
 125                  */
 126                 u_int retransmitted;
 127
 128                 /**
 129                  * packet for retransmission
 130                  */
 131                 packet_t *packet;
 132
 133                 /**
 134                  * type of the initated exchange
 135                  */
 136                 exchange_type_t type;
 137
 138         } initiating;
 139
 140         /**
 141          * List of queued tasks not yet in action
 142          */
 143         linked_list_t *queued_tasks;
 144
 145         /**
 146          * List of active tasks, initiated by ourselve
 147          */
 148         linked_list_t *active_tasks;
 149
 150         /**
 151          * List of tasks initiated by peer
 152          */
 153         linked_list_t *passive_tasks;
 154
 155         /**
 156          * Queued messages not yet ready to process
 157          */
 158         message_t *queued;
 159
 160         /**
 161          * Number of times we retransmit messages before giving up
 162          */
 163         u_int retransmit_tries;
 164
 165         /**
 166          * Retransmission timeout
 167          */
 168         double retransmit_timeout;
 169
 170         /**
 171          * Base to calculate retransmission timeout
 172          */
 173         double retransmit_base;
 174 };
 175
 176 /**
 177  * Flush a single task queue
 178  */
 179 static void flush_queue(private_task_manager_t *this, linked_list_t *list)
 180 {
 181         task_t *task;
 182
 183         if (this->queued)
 184         {
 185                 this->queued->destroy(this->queued);
 186                 this->queued = NULL;
 187         }
 188         while (list->remove_last(list, (void**)&task) == SUCCESS)
 189         {
 190                 task->destroy(task);
 191         }
 192 }
 193
 194 /**
 195  * flush all tasks in the task manager
 196  */
 197 static void flush(private_task_manager_t *this)
 198 {
 199         flush_queue(this, this->queued_tasks);
 200         flush_queue(this, this->passive_tasks);
 201         flush_queue(this, this->active_tasks);
 202 }
 203
 204 /**
 205  * move a task of a specific type from the queue to the active list
 206  */
 207 static bool activate_task(private_task_manager_t *this, task_type_t type)
 208 {
 209         enumerator_t *enumerator;
 210         task_t *task;
 211         bool found = FALSE;
 212
 213         enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
 214         while (enumerator->enumerate(enumerator, (void**)&task))
 215         {
 216                 if (task->get_type(task) == type)
 217                 {
 218                         DBG2(DBG_IKE, "  activating %N task", task_type_names, type);
 219                         this->queued_tasks->remove_at(this->queued_tasks, enumerator);
 220                         this->active_tasks->insert_last(this->active_tasks, task);
 221                         found = TRUE;
 222                         break;
 223                 }
 224         }
 225         enumerator->destroy(enumerator);
 226         return found;
 227 }
 228
 229 METHOD(task_manager_t, retransmit, status_t,
 230         private_task_manager_t *this, u_int32_t message_seqnr)
 231 {
 232         /* this.initiating packet used as marker for received response */
 233         if (message_seqnr == this->initiating.seqnr && this->initiating.packet )
 234         {
 235                 u_int32_t timeout;
 236                 packet_t *packet;
 237                 job_t *job;
 238
 239                 if (this->initiating.retransmitted <= this->retransmit_tries)
 240                 {
 241                         timeout = (u_int32_t)(this->retransmit_timeout * 1000.0 *
 242                                 pow(this->retransmit_base, this->initiating.retransmitted));
 243                 }
 244                 else
 245                 {
 246                         DBG1(DBG_IKE, "giving up after %d retransmits",
 247                                  this->initiating.retransmitted - 1);
 248                         if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
 249                         {
 250                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 251                         }
 252                         return DESTROY_ME;
 253                 }
 254
 255                 if (this->initiating.retransmitted)
 256                 {
 257                         DBG1(DBG_IKE, "retransmit %d of request with message ID %u seqnr (%d)",
 258                                  this->initiating.retransmitted, this->initiating.mid, message_seqnr);
 259                 }
 260                 packet = this->initiating.packet->clone(this->initiating.packet);
 261                 charon->sender->send(charon->sender, packet);
 262
 263                 this->initiating.retransmitted++;
 264                 job = (job_t*)retransmit_job_create(this->initiating.seqnr,
 265                                                                                         this->ike_sa->get_id(this->ike_sa));
 266                 lib->scheduler->schedule_job_ms(lib->scheduler, job, timeout);
 267         }
 268         return SUCCESS;
 269 }
 270
 271 METHOD(task_manager_t, initiate, status_t,
 272         private_task_manager_t *this)
 273 {
 274         enumerator_t *enumerator;
 275         task_t *task;
 276         message_t *message;
 277         host_t *me, *other;
 278         status_t status;
 279         exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
 280         bool new_mid = FALSE, expect_response = FALSE, flushed = FALSE;
 281
 282         if (!this->rng)
 283         {
 284                 DBG1(DBG_IKE, "no RNG supported");
 285                 return FAILED;
 286         }
 287
 288         if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED)
 289         {
 290                 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
 291                                 exchange_type_names, this->initiating.type);
 292                 /* do not initiate if we already have a message in the air */
 293                 return SUCCESS;
 294         }
 295
 296         if (this->active_tasks->get_count(this->active_tasks) == 0)
 297         {
 298                 DBG2(DBG_IKE, "activating new tasks");
 299                 switch (this->ike_sa->get_state(this->ike_sa))
 300                 {
 301                         case IKE_CREATED:
 302                                 activate_task(this, TASK_VENDOR_V1);
 303                                 activate_task(this, TASK_ISAKMP_CERT_PRE);
 304                                 if (activate_task(this, TASK_MAIN_MODE))
 305                                 {
 306                                         exchange = ID_PROT;
 307                                         activate_task(this, TASK_ISAKMP_CERT_POST);
 308                                         activate_task(this, TASK_IKE_NATD_V1);
 309                                 }
 310                                 break;
 311                         case IKE_CONNECTING:
 312                                 if (activate_task(this, TASK_ISAKMP_DELETE))
 313                                 {
 314                                         exchange = INFORMATIONAL_V1;
 315                                         new_mid = TRUE;
 316                                         break;
 317                                 }
 318                                 if (activate_task(this, TASK_XAUTH))
 319                                 {
 320                                         exchange = TRANSACTION;
 321                                         new_mid = TRUE;
 322                                         break;
 323                                 }
 324                                 if (activate_task(this, TASK_INFORMATIONAL))
 325                                 {
 326                                         exchange = INFORMATIONAL_V1;
 327                                         new_mid = TRUE;
 328                                         break;
 329                                 }
 330                                 break;
 331                         case IKE_ESTABLISHED:
 332                                 if (activate_task(this, TASK_MODE_CONFIG))
 333                                 {
 334                                         exchange = TRANSACTION;
 335                                         new_mid = TRUE;
 336                                         break;
 337                                 }
 338                                 if (activate_task(this, TASK_QUICK_MODE))
 339                                 {
 340                                         exchange = QUICK_MODE;
 341                                         new_mid = TRUE;
 342                                         break;
 343                                 }
 344                                 if (activate_task(this, TASK_INFORMATIONAL))
 345                                 {
 346                                         exchange = INFORMATIONAL_V1;
 347                                         new_mid = TRUE;
 348                                         break;
 349                                 }
 350                                 if (activate_task(this, TASK_ISAKMP_DELETE))
 351                                 {
 352                                         exchange = INFORMATIONAL_V1;
 353                                         new_mid = TRUE;
 354                                         break;
 355                                 }
 356                                 if (activate_task(this, TASK_QUICK_DELETE))
 357                                 {
 358                                         exchange = INFORMATIONAL_V1;
 359                                         new_mid = TRUE;
 360                                         break;
 361                                 }
 362                                 break;
 363                         default:
 364                                 break;
 365                 }
 366         }
 367         else
 368         {
 369                 DBG2(DBG_IKE, "reinitiating already active tasks");
 370                 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
 371                 while (enumerator->enumerate(enumerator, (void**)&task))
 372                 {
 373                         DBG2(DBG_IKE, "  %N task", task_type_names, task->get_type(task));
 374                         switch (task->get_type(task))
 375                         {
 376                                 case TASK_MAIN_MODE:
 377                                         exchange = ID_PROT;
 378                                         break;
 379                                 case TASK_QUICK_MODE:
 380                                         exchange = QUICK_MODE;
 381                                         break;
 382                                 case TASK_XAUTH:
 383                                         exchange = TRANSACTION;
 384                                         new_mid = TRUE;
 385                                         break;
 386                                 default:
 387                                         continue;
 388                         }
 389                         break;
 390                 }
 391                 enumerator->destroy(enumerator);
 392         }
 393
 394         if (exchange == EXCHANGE_TYPE_UNDEFINED)
 395         {
 396                 DBG2(DBG_IKE, "nothing to initiate");
 397                 /* nothing to do yet... */
 398                 return SUCCESS;
 399         }
 400
 401         me = this->ike_sa->get_my_host(this->ike_sa);
 402         other = this->ike_sa->get_other_host(this->ike_sa);
 403
 404         message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 405         if (new_mid)
 406         {
 407                 this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
 408                                                          (void*)&this->initiating.mid);
 409         }
 410         message->set_message_id(message, this->initiating.mid);
 411         message->set_source(message, me->clone(me));
 412         message->set_destination(message, other->clone(other));
 413         message->set_exchange_type(message, exchange);
 414         this->initiating.type = exchange;
 415         this->initiating.retransmitted = 0;
 416
 417         enumerator = this->active_tasks->create_enumerator(this->active_tasks);
 418         while (enumerator->enumerate(enumerator, (void*)&task))
 419         {
 420                 switch (task->build(task, message))
 421                 {
 422                         case SUCCESS:
 423                                 /* task completed, remove it */
 424                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
 425                                 task->destroy(task);
 426                                 continue;
 427                         case NEED_MORE:
 428                                 expect_response = TRUE;
 429                                 /* processed, but task needs another exchange */
 430                                 continue;
 431                         case ALREADY_DONE:
 432                                 flush_queue(this, this->active_tasks);
 433                                 flushed = TRUE;
 434                                 break;
 435                         case FAILED:
 436                         default:
 437                                 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
 438                                 {
 439                                         charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 440                                 }
 441                                 /* FALL */
 442                         case DESTROY_ME:
 443                                 /* critical failure, destroy IKE_SA */
 444                                 enumerator->destroy(enumerator);
 445                                 message->destroy(message);
 446                                 flush(this);
 447                                 return DESTROY_ME;
 448                 }
 449                 break;
 450         }
 451         enumerator->destroy(enumerator);
 452
 453         if (this->active_tasks->get_count(this->active_tasks) == 0)
 454         {       /* tasks completed, no exchange active anymore */
 455                 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
 456         }
 457         if (flushed)
 458         {
 459                 message->destroy(message);
 460                 return initiate(this);
 461         }
 462         this->initiating.seqnr++;
 463
 464         status = this->ike_sa->generate_message(this->ike_sa, message,
 465                                                                                         &this->initiating.packet);
 466         if (status != SUCCESS)
 467         {
 468                 /* message generation failed. There is nothing more to do than to
 469                  * close the SA */
 470                 message->destroy(message);
 471                 flush(this);
 472                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 473                 return DESTROY_ME;
 474         }
 475         message->destroy(message);
 476
 477         if (expect_response)
 478         {
 479                 return retransmit(this, this->initiating.seqnr);
 480         }
 481         charon->sender->send(charon->sender,
 482                                 this->initiating.packet->clone(this->initiating.packet));
 483         this->initiating.packet->destroy(this->initiating.packet);
 484         this->initiating.packet = NULL;
 485
 486         if (exchange == INFORMATIONAL_V1)
 487         {
 488                 switch (this->ike_sa->get_state(this->ike_sa))
 489                 {
 490                         case IKE_CONNECTING:
 491                                 /* close after sending an INFORMATIONAL when unestablished */
 492                                 return FAILED;
 493                         case IKE_DELETING:
 494                                 /* close after sending a DELETE */
 495                                 return DESTROY_ME;
 496                         default:
 497                                 break;
 498                 }
 499         }
 500         return SUCCESS;
 501 }
 502
 503 /**
 504  * handle exchange collisions
 505  */
 506 static bool handle_collisions(private_task_manager_t *this, task_t *task)
 507 {
 508         return FALSE;
 509 }
 510
 511 /**
 512  * build a response depending on the "passive" task list
 513  */
 514 static status_t build_response(private_task_manager_t *this, message_t *request)
 515 {
 516         enumerator_t *enumerator;
 517         task_t *task;
 518         message_t *message;
 519         host_t *me, *other;
 520         bool delete = FALSE, flushed = FALSE;
 521         status_t status;
 522
 523         me = request->get_destination(request);
 524         other = request->get_source(request);
 525
 526         message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 527         message->set_exchange_type(message, request->get_exchange_type(request));
 528         /* send response along the path the request came in */
 529         message->set_source(message, me->clone(me));
 530         message->set_destination(message, other->clone(other));
 531         message->set_message_id(message, request->get_message_id(request));
 532         message->set_request(message, FALSE);
 533
 534         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
 535         while (enumerator->enumerate(enumerator, (void*)&task))
 536         {
 537                 switch (task->build(task, message))
 538                 {
 539                         case SUCCESS:
 540                                 /* task completed, remove it */
 541                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
 542                                 if (!handle_collisions(this, task))
 543                                 {
 544                                         task->destroy(task);
 545                                 }
 546                                 continue;
 547                         case NEED_MORE:
 548                                 /* processed, but task needs another exchange */
 549                                 if (handle_collisions(this, task))
 550                                 {
 551                                         this->passive_tasks->remove_at(this->passive_tasks,
 552                                                                                                    enumerator);
 553                                 }
 554                                 continue;
 555                         case ALREADY_DONE:
 556                                 flush_queue(this, this->passive_tasks);
 557                                 flushed = TRUE;
 558                                 break;
 559                         case FAILED:
 560                         default:
 561                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 562                                 /* FALL */
 563                         case DESTROY_ME:
 564                                 /* destroy IKE_SA, but SEND response first */
 565                                 delete = TRUE;
 566                                 break;
 567                 }
 568                 break;
 569         }
 570         enumerator->destroy(enumerator);
 571
 572         DESTROY_IF(this->responding.packet);
 573         this->responding.packet = NULL;
 574         if (flushed)
 575         {
 576                 message->destroy(message);
 577                 return initiate(this);
 578         }
 579         status = this->ike_sa->generate_message(this->ike_sa, message,
 580                                                                                         &this->responding.packet);
 581         message->destroy(message);
 582         if (status != SUCCESS)
 583         {
 584                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 585                 return DESTROY_ME;
 586         }
 587
 588         charon->sender->send(charon->sender,
 589                                                  this->responding.packet->clone(this->responding.packet));
 590         if (delete)
 591         {
 592                 return DESTROY_ME;
 593         }
 594         return SUCCESS;
 595 }
 596
 597 /**
 598  * Send a notify in a separate INFORMATIONAL exchange back to the sender.
 599  * The notify protocol_id is set to ISAKMP
 600  */
 601 static void send_notify(private_task_manager_t *this, message_t *request,
 602                                                 notify_type_t type)
 603 {
 604         message_t *response;
 605         packet_t *packet;
 606         host_t *me, *other;
 607         u_int32_t mid;
 608
 609         if (request && request->get_exchange_type(request) == INFORMATIONAL_V1)
 610         {       /* don't respond to INFORMATIONAL requests to avoid a notify war */
 611                 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
 612                 return;
 613         }
 614
 615         response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 616         response->set_exchange_type(response, INFORMATIONAL_V1);
 617         response->set_request(response, TRUE);
 618         this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid);
 619         response->set_message_id(response, mid);
 620         response->add_payload(response, (payload_t*)
 621                                 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
 622                                                                                                         PROTO_IKE, type));
 623
 624         me = this->ike_sa->get_my_host(this->ike_sa);
 625         if (me->is_anyaddr(me))
 626         {
 627                 me = request->get_destination(request);
 628                 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
 629         }
 630         other = this->ike_sa->get_other_host(this->ike_sa);
 631         if (other->is_anyaddr(other))
 632         {
 633                 other = request->get_source(request);
 634                 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
 635         }
 636         response->set_source(response, me->clone(me));
 637         response->set_destination(response, other->clone(other));
 638         if (this->ike_sa->generate_message(this->ike_sa, response,
 639                                                                            &packet) == SUCCESS)
 640         {
 641                 charon->sender->send(charon->sender, packet);
 642         }
 643         response->destroy(response);
 644 }
 645
 646 /**
 647  * handle an incoming request message
 648  */
 649 static status_t process_request(private_task_manager_t *this,
 650                                                                 message_t *message)
 651 {
 652         enumerator_t *enumerator;
 653         task_t *task = NULL;
 654         bool send_response = FALSE;
 655
 656         if (this->passive_tasks->get_count(this->passive_tasks) == 0)
 657         {       /* create tasks depending on request type, if not already some queued */
 658                 switch (message->get_exchange_type(message))
 659                 {
 660                         case ID_PROT:
 661                                 task = (task_t *)ike_vendor_v1_create(this->ike_sa, FALSE);
 662                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 663                                 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
 664                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 665                                 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
 666                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 667                                 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
 668                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 669                                 task = (task_t *)ike_natd_v1_create(this->ike_sa, FALSE);
 670                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 671                                 break;
 672                         case AGGRESSIVE:
 673                                 /* TODO-IKEv1: agressive mode */
 674                                 return FAILED;
 675                         case QUICK_MODE:
 676                                 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
 677                                 {
 678                                         DBG1(DBG_IKE, "received quick mode request for "
 679                                                  "unestablished IKE_SA, ignored");
 680                                         return FAILED;
 681                                 }
 682                                 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
 683                                                                                                    NULL, NULL);
 684                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 685                                 break;
 686                         case INFORMATIONAL_V1:
 687                                 task = (task_t *)informational_create(this->ike_sa, NULL);
 688                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 689                                 break;
 690                         case TRANSACTION:
 691                                 if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
 692                                 {
 693                                         task = (task_t *)mode_config_create(this->ike_sa, FALSE);
 694                                 }
 695                                 else
 696                                 {
 697                                         task = (task_t *)xauth_create(this->ike_sa, FALSE);
 698                                 }
 699                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 700                                 break;
 701                         default:
 702                                 return FAILED;
 703                 }
 704         }
 705         /* let the tasks process the message */
 706         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
 707         while (enumerator->enumerate(enumerator, (void*)&task))
 708         {
 709                 switch (task->process(task, message))
 710                 {
 711                         case SUCCESS:
 712                                 /* task completed, remove it */
 713                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
 714                                 task->destroy(task);
 715                                 continue;
 716                         case NEED_MORE:
 717                                 /* processed, but task needs at least another call to build() */
 718                                 send_response = TRUE;
 719                                 continue;
 720                         case ALREADY_DONE:
 721                                 send_response = FALSE;
 722                                 flush_queue(this, this->passive_tasks);
 723                                 break;
 724                         case FAILED:
 725                         default:
 726                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 727                                 /* FALL */
 728                         case DESTROY_ME:
 729                                 /* critical failure, destroy IKE_SA */
 730                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
 731                                 enumerator->destroy(enumerator);
 732                                 task->destroy(task);
 733                                 return DESTROY_ME;
 734                 }
 735                 break;
 736         }
 737         enumerator->destroy(enumerator);
 738
 739         if (send_response)
 740         {
 741                 if (build_response(this, message) != SUCCESS)
 742                 {
 743                         return DESTROY_ME;
 744                 }
 745         }
 746         else
 747         {       /* We don't send a response, so don't retransmit one if we get
 748                  * the same message again. */
 749                 DESTROY_IF(this->responding.packet);
 750                 this->responding.packet = NULL;
 751         }
 752         if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
 753                 this->queued_tasks->get_count(this->queued_tasks) > 0)
 754         {
 755                 /* passive tasks completed, check if an active task has been queued,
 756                  * such as XAUTH or modeconfig push */
 757                 return initiate(this);
 758         }
 759         return SUCCESS;
 760 }
 761
 762 /**
 763  * handle an incoming response message
 764  */
 765 static status_t process_response(private_task_manager_t *this,
 766                                                                  message_t *message)
 767 {
 768         enumerator_t *enumerator;
 769         status_t status;
 770         task_t *task;
 771
 772         if (message->get_exchange_type(message) != this->initiating.type)
 773         {
 774                 DBG1(DBG_IKE, "received %N response, but expected %N",
 775                          exchange_type_names, message->get_exchange_type(message),
 776                          exchange_type_names, this->initiating.type);
 777                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 778                 return DESTROY_ME;
 779         }
 780
 781         enumerator = this->active_tasks->create_enumerator(this->active_tasks);
 782         while (enumerator->enumerate(enumerator, (void*)&task))
 783         {
 784                 switch (task->process(task, message))
 785                 {
 786                         case SUCCESS:
 787                                 /* task completed, remove it */
 788                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
 789                                 task->destroy(task);
 790                                 continue;
 791                         case NEED_MORE:
 792                                 /* processed, but task needs another exchange */
 793                                 continue;
 794                         case ALREADY_DONE:
 795                                 flush_queue(this, this->active_tasks);
 796                                 break;
 797                         case FAILED:
 798                         default:
 799                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 800                                 /* FALL */
 801                         case DESTROY_ME:
 802                                 /* critical failure, destroy IKE_SA */
 803                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
 804                                 enumerator->destroy(enumerator);
 805                                 task->destroy(task);
 806                                 return DESTROY_ME;
 807                 }
 808                 break;
 809         }
 810         enumerator->destroy(enumerator);
 811
 812         this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
 813         this->initiating.packet->destroy(this->initiating.packet);
 814         this->initiating.packet = NULL;
 815
 816         if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
 817         {
 818                 status = this->public.task_manager.process_message(
 819                                                                         &this->public.task_manager, this->queued);
 820                 this->queued->destroy(this->queued);
 821                 this->queued = NULL;
 822                 if (status == DESTROY_ME)
 823                 {
 824                         return status;
 825                 }
 826         }
 827
 828         return initiate(this);
 829 }
 830
 831 /**
 832  * Parse the given message and verify that it is valid.
 833  */
 834 static status_t parse_message(private_task_manager_t *this, message_t *msg)
 835 {
 836         status_t status;
 837
 838         status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
 839
 840         if (status != SUCCESS)
 841         {
 842                 switch (status)
 843                 {
 844                         case NOT_SUPPORTED:
 845                                 DBG1(DBG_IKE, "unsupported exchange type");
 846                                 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
 847                                 break;
 848                         case PARSE_ERROR:
 849                                 DBG1(DBG_IKE, "message parsing failed");
 850                                 send_notify(this, msg, PAYLOAD_MALFORMED);
 851                                 break;
 852                         case VERIFY_ERROR:
 853                                 DBG1(DBG_IKE, "message verification failed");
 854                                 send_notify(this, msg, PAYLOAD_MALFORMED);
 855                                 break;
 856                         case FAILED:
 857                                 DBG1(DBG_IKE, "integrity check failed");
 858                                 send_notify(this, msg, INVALID_HASH_INFORMATION);
 859                                 break;
 860                         case INVALID_STATE:
 861                                 DBG1(DBG_IKE, "found encrypted message, but no keys available");
 862                                 send_notify(this, msg, PAYLOAD_MALFORMED);
 863                         default:
 864                                 break;
 865                 }
 866                 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
 867                          exchange_type_names, msg->get_exchange_type(msg),
 868                          msg->get_request(msg) ? "request" : "response",
 869                          msg->get_message_id(msg));
 870
 871                 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
 872                 {       /* invalid initiation attempt, close SA */
 873                         return DESTROY_ME;
 874                 }
 875         }
 876         return status;
 877 }
 878
 879 METHOD(task_manager_t, process_message, status_t,
 880         private_task_manager_t *this, message_t *msg)
 881 {
 882         u_int32_t hash, mid, i;
 883         host_t *me, *other;
 884         status_t status;
 885
 886         /* TODO-IKEv1: update hosts more selectively */
 887         me = msg->get_destination(msg);
 888         other = msg->get_source(msg);
 889         mid = msg->get_message_id(msg);
 890         hash = chunk_hash(msg->get_packet_data(msg));
 891         for (i = 0; i < MAX_OLD_HASHES; i++)
 892         {
 893                 if (this->initiating.old_hashes[i] == hash)
 894                 {
 895                         DBG1(DBG_IKE, "received retransmit of response with ID %u, "
 896                                  "but next request already sent", mid);
 897                         return SUCCESS;
 898                 }
 899         }
 900
 901         if ((mid && mid == this->initiating.mid) ||
 902                 (this->initiating.mid == 0 &&
 903                  msg->get_exchange_type(msg) == this->initiating.type &&
 904                 this->active_tasks->get_count(this->active_tasks)))
 905         {
 906                 msg->set_request(msg, FALSE);
 907                 status = parse_message(this, msg);
 908                 if (status != SUCCESS)
 909                 {
 910                         return status;
 911                 }
 912                 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
 913                                                                         time_monotonic(NULL));
 914                 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
 915                 charon->bus->message(charon->bus, msg, FALSE);
 916                 if (process_response(this, msg) != SUCCESS)
 917                 {
 918                         flush(this);
 919                         return DESTROY_ME;
 920                 }
 921                 this->initiating.old_hashes[(this->initiating.old_hash_pos++) %
 922                                                                         MAX_OLD_HASHES] = hash;
 923         }
 924         else
 925         {
 926                 if (hash == this->responding.hash)
 927                 {
 928                         if (this->responding.packet)
 929                         {
 930                                 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
 931                                          "retransmitting response", mid);
 932                                 charon->sender->send(charon->sender,
 933                                                 this->responding.packet->clone(this->responding.packet));
 934                         }
 935                         else
 936                         {
 937                                 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
 938                                          "but no response to retransmit", mid);
 939                         }
 940                         return SUCCESS;
 941                 }
 942                 if (msg->get_exchange_type(msg) == TRANSACTION &&
 943                         this->active_tasks->get_count(this->active_tasks))
 944                 {       /* main mode not yet complete, queue XAuth/Mode config tasks */
 945                         if (this->queued)
 946                         {
 947                                 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
 948                                          exchange_type_names, TRANSACTION);
 949                                 return SUCCESS;
 950                         }
 951                         this->queued = message_create_from_packet(msg->get_packet(msg));
 952                         if (this->queued->parse_header(this->queued) != SUCCESS)
 953                         {
 954                                 this->queued->destroy(this->queued);
 955                                 this->queued = NULL;
 956                                 return FAILED;
 957                         }
 958                         DBG1(DBG_IKE, "queueing %N request as tasks still active",
 959                                  exchange_type_names, TRANSACTION);
 960                         return SUCCESS;
 961                 }
 962
 963                 msg->set_request(msg, TRUE);
 964                 status = parse_message(this, msg);
 965                 if (status != SUCCESS)
 966                 {
 967                         return status;
 968                 }
 969                 /* if this IKE_SA is virgin, we check for a config */
 970                 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
 971                 {
 972                         ike_sa_id_t *ike_sa_id;
 973                         ike_cfg_t *ike_cfg;
 974                         job_t *job;
 975                         ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
 976                         if (ike_cfg == NULL)
 977                         {
 978                                 /* no config found for these hosts, destroy */
 979                                 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
 980                                          me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
 981                                 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
 982                                 return DESTROY_ME;
 983                         }
 984                         this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
 985                         ike_cfg->destroy(ike_cfg);
 986                         /* add a timeout if peer does not establish it completely */
 987                         ike_sa_id = this->ike_sa->get_id(this->ike_sa);
 988                         job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
 989                         lib->scheduler->schedule_job(lib->scheduler, job,
 990                                         lib->settings->get_int(lib->settings,
 991                                                 "charon.half_open_timeout",  HALF_OPEN_IKE_SA_TIMEOUT));
 992                 }
 993                 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
 994                                                                         time_monotonic(NULL));
 995                 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
 996                 charon->bus->message(charon->bus, msg, TRUE);
 997                 if (process_request(this, msg) != SUCCESS)
 998                 {
 999                         flush(this);
1000                         return DESTROY_ME;
1001                 }
1002                 this->responding.hash = hash;
1003         }
1004         return SUCCESS;
1005 }
1006
1007 METHOD(task_manager_t, queue_task, void,
1008         private_task_manager_t *this, task_t *task)
1009 {
1010         DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1011         this->queued_tasks->insert_last(this->queued_tasks, task);
1012 }
1013
1014 METHOD(task_manager_t, adopt_tasks, void,
1015         private_task_manager_t *this, task_manager_t *other_public)
1016 {
1017         private_task_manager_t *other = (private_task_manager_t*)other_public;
1018         task_t *task;
1019
1020         /* move queued tasks from other to this */
1021         while (other->queued_tasks->remove_last(other->queued_tasks,
1022                                                                                                 (void**)&task) == SUCCESS)
1023         {
1024                 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1025                 task->migrate(task, this->ike_sa);
1026                 this->queued_tasks->insert_first(this->queued_tasks, task);
1027         }
1028 }
1029
1030 METHOD(task_manager_t, busy, bool,
1031         private_task_manager_t *this)
1032 {
1033         return (this->active_tasks->get_count(this->active_tasks) > 0);
1034 }
1035
1036 METHOD(task_manager_t, incr_mid, void,
1037         private_task_manager_t *this, bool initiate)
1038 {
1039 }
1040
1041 METHOD(task_manager_t, reset, void,
1042         private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1043 {
1044 }
1045
1046 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1047         private_task_manager_t *this, task_queue_t queue)
1048 {
1049         switch (queue)
1050         {
1051                 case TASK_QUEUE_ACTIVE:
1052                         return this->active_tasks->create_enumerator(this->active_tasks);
1053                 case TASK_QUEUE_PASSIVE:
1054                         return this->passive_tasks->create_enumerator(this->passive_tasks);
1055                 case TASK_QUEUE_QUEUED:
1056                         return this->queued_tasks->create_enumerator(this->queued_tasks);
1057                 default:
1058                         return enumerator_create_empty();
1059         }
1060 }
1061
1062 METHOD(task_manager_t, destroy, void,
1063         private_task_manager_t *this)
1064 {
1065         flush(this);
1066
1067         this->active_tasks->destroy(this->active_tasks);
1068         this->queued_tasks->destroy(this->queued_tasks);
1069         this->passive_tasks->destroy(this->passive_tasks);
1070
1071         DESTROY_IF(this->queued);
1072         DESTROY_IF(this->responding.packet);
1073         DESTROY_IF(this->initiating.packet);
1074         DESTROY_IF(this->rng);
1075         free(this);
1076 }
1077
1078 /*
1079  * see header file
1080  */
1081 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1082 {
1083         private_task_manager_t *this;
1084
1085         INIT(this,
1086                 .public = {
1087                         .task_manager = {
1088                                 .process_message = _process_message,
1089                                 .queue_task = _queue_task,
1090                                 .initiate = _initiate,
1091                                 .retransmit = _retransmit,
1092                                 .incr_mid = _incr_mid,
1093                                 .reset = _reset,
1094                                 .adopt_tasks = _adopt_tasks,
1095                                 .busy = _busy,
1096                                 .create_task_enumerator = _create_task_enumerator,
1097                                 .destroy = _destroy,
1098                         },
1099                 },
1100                 .ike_sa = ike_sa,
1101                 .initiating.type = EXCHANGE_TYPE_UNDEFINED,
1102                 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1103                 .queued_tasks = linked_list_create(),
1104                 .active_tasks = linked_list_create(),
1105                 .passive_tasks = linked_list_create(),
1106                 .retransmit_tries = lib->settings->get_int(lib->settings,
1107                                                                 "charon.retransmit_tries", RETRANSMIT_TRIES),
1108                 .retransmit_timeout = lib->settings->get_double(lib->settings,
1109                                                                 "charon.retransmit_timeout", RETRANSMIT_TIMEOUT),
1110                 .retransmit_base = lib->settings->get_double(lib->settings,
1111                                                                 "charon.retransmit_base", RETRANSMIT_BASE),
1112         );
1113
1114         return &this->public;
1115 }