1dc2bc3cd352a914a68cf37b7c1eedde0f8c7208
[strongswan.git] / src / libcharon / sa / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/tasks/main_mode.h>
23 #include <sa/tasks/quick_mode.h>
24 #include <sa/tasks/xauth.h>
25 #include <sa/tasks/mode_config.h>
26 #include <sa/tasks/informational.h>
27 #include <sa/tasks/ike_natd_v1.h>
28 #include <sa/tasks/ike_vendor_v1.h>
29 #include <sa/tasks/ike_cert_pre_v1.h>
30 #include <sa/tasks/ike_cert_post_v1.h>
31 #include <processing/jobs/retransmit_job.h>
32 #include <processing/jobs/delete_ike_sa_job.h>
33
34 typedef struct exchange_t exchange_t;
35
36 /**
37 * An exchange in the air, used do detect and handle retransmission
38 */
39 struct exchange_t {
40
41 /**
42 * Message ID used for this transaction
43 */
44 u_int32_t mid;
45
46 /**
47 * generated packet for retransmission
48 */
49 packet_t *packet;
50 };
51
52 typedef struct private_task_manager_t private_task_manager_t;
53
54 /**
55 * private data of the task manager
56 */
57 struct private_task_manager_t {
58
59 /**
60 * public functions
61 */
62 task_manager_v1_t public;
63
64 /**
65 * associated IKE_SA we are serving
66 */
67 ike_sa_t *ike_sa;
68
69 /**
70 * RNG to create message IDs
71 */
72 rng_t *rng;
73
74 /**
75 * Exchange we are currently handling as responder
76 */
77 struct {
78 /**
79 * Hash of a previously received message
80 */
81 u_int32_t hash;
82
83 /**
84 * packet for retransmission
85 */
86 packet_t *packet;
87
88 } responding;
89
90 /**
91 * Exchange we are currently handling as initiator
92 */
93 struct {
94 /**
95 * Message ID of the exchange
96 */
97 u_int32_t mid;
98
99 /**
100 * Sequence number of the last sent message
101 */
102 u_int32_t seqnr;
103
104 /**
105 * how many times we have retransmitted so far
106 */
107 u_int retransmitted;
108
109 /**
110 * packet for retransmission
111 */
112 packet_t *packet;
113
114 /**
115 * type of the initated exchange
116 */
117 exchange_type_t type;
118
119 } initiating;
120
121 /**
122 * List of queued tasks not yet in action
123 */
124 linked_list_t *queued_tasks;
125
126 /**
127 * List of active tasks, initiated by ourselve
128 */
129 linked_list_t *active_tasks;
130
131 /**
132 * List of tasks initiated by peer
133 */
134 linked_list_t *passive_tasks;
135
136 /**
137 * Queued messages not yet ready to process
138 */
139 message_t *queued;
140
141 /**
142 * Number of times we retransmit messages before giving up
143 */
144 u_int retransmit_tries;
145
146 /**
147 * Retransmission timeout
148 */
149 double retransmit_timeout;
150
151 /**
152 * Base to calculate retransmission timeout
153 */
154 double retransmit_base;
155 };
156
157 /**
158 * Flush a single task queue
159 */
160 static void flush_queue(private_task_manager_t *this, linked_list_t *list)
161 {
162 task_t *task;
163
164 while (list->remove_last(list, (void**)&task) == SUCCESS)
165 {
166 task->destroy(task);
167 }
168 }
169
170 /**
171 * flush all tasks in the task manager
172 */
173 static void flush(private_task_manager_t *this)
174 {
175 flush_queue(this, this->queued_tasks);
176 flush_queue(this, this->passive_tasks);
177 flush_queue(this, this->active_tasks);
178 }
179
180 /**
181 * move a task of a specific type from the queue to the active list
182 */
183 static bool activate_task(private_task_manager_t *this, task_type_t type)
184 {
185 enumerator_t *enumerator;
186 task_t *task;
187 bool found = FALSE;
188
189 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
190 while (enumerator->enumerate(enumerator, (void**)&task))
191 {
192 if (task->get_type(task) == type)
193 {
194 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
195 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
196 this->active_tasks->insert_last(this->active_tasks, task);
197 found = TRUE;
198 break;
199 }
200 }
201 enumerator->destroy(enumerator);
202 return found;
203 }
204
205 METHOD(task_manager_t, retransmit, status_t,
206 private_task_manager_t *this, u_int32_t message_seqnr)
207 {
208 /* this.initiating packet used as marker for received response */
209 if (message_seqnr == this->initiating.seqnr && this->initiating.packet )
210 {
211 u_int32_t timeout;
212 packet_t *packet;
213 job_t *job;
214
215 if (this->initiating.retransmitted <= this->retransmit_tries)
216 {
217 timeout = (u_int32_t)(this->retransmit_timeout * 1000.0 *
218 pow(this->retransmit_base, this->initiating.retransmitted));
219 }
220 else
221 {
222 DBG1(DBG_IKE, "giving up after %d retransmits",
223 this->initiating.retransmitted - 1);
224 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
225 {
226 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
227 }
228 return DESTROY_ME;
229 }
230
231 if (this->initiating.retransmitted)
232 {
233 DBG1(DBG_IKE, "retransmit %d of request with message ID %u seqnr (%d)",
234 this->initiating.retransmitted, this->initiating.mid, message_seqnr);
235 }
236 packet = this->initiating.packet->clone(this->initiating.packet);
237 charon->sender->send(charon->sender, packet);
238
239 this->initiating.retransmitted++;
240 job = (job_t*)retransmit_job_create(this->initiating.seqnr,
241 this->ike_sa->get_id(this->ike_sa));
242 lib->scheduler->schedule_job_ms(lib->scheduler, job, timeout);
243 }
244 return SUCCESS;
245 }
246
247 METHOD(task_manager_t, initiate, status_t,
248 private_task_manager_t *this)
249 {
250 enumerator_t *enumerator;
251 task_t *task;
252 message_t *message;
253 host_t *me, *other;
254 status_t status;
255 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
256 bool new_mid = FALSE;
257 bool expect_response = FALSE;
258
259 if (!this->rng)
260 {
261 DBG1(DBG_IKE, "no RNG supported");
262 return FAILED;
263 }
264
265 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED)
266 {
267 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
268 exchange_type_names, this->initiating.type);
269 /* do not initiate if we already have a message in the air */
270 return SUCCESS;
271 }
272
273 if (this->active_tasks->get_count(this->active_tasks) == 0)
274 {
275 DBG2(DBG_IKE, "activating new tasks");
276 switch (this->ike_sa->get_state(this->ike_sa))
277 {
278 case IKE_CREATED:
279 activate_task(this, TASK_VENDOR_V1);
280 activate_task(this, TASK_IKE_CERT_PRE_V1);
281 if (activate_task(this, TASK_MAIN_MODE))
282 {
283 exchange = ID_PROT;
284 activate_task(this, TASK_IKE_CERT_POST_V1);
285 activate_task(this, TASK_IKE_NATD_V1);
286 }
287 break;
288 case IKE_CONNECTING:
289 if (activate_task(this, TASK_XAUTH))
290 {
291 exchange = TRANSACTION;
292 new_mid = TRUE;
293 }
294 if (activate_task(this, TASK_INFORMATIONAL))
295 {
296 exchange = INFORMATIONAL_V1;
297 new_mid = TRUE;
298 }
299 break;
300 case IKE_ESTABLISHED:
301 if (activate_task(this, TASK_MODE_CONFIG))
302 {
303 exchange = TRANSACTION;
304 new_mid = TRUE;
305 break;
306 }
307 if (activate_task(this, TASK_QUICK_MODE))
308 {
309 exchange = QUICK_MODE;
310 new_mid = TRUE;
311 break;
312 }
313 if (activate_task(this, TASK_INFORMATIONAL))
314 {
315 exchange = INFORMATIONAL_V1;
316 new_mid = TRUE;
317 }
318 if (activate_task(this, TASK_IKE_DELETE))
319 {
320 exchange = INFORMATIONAL_V1;
321 new_mid = TRUE;
322 }
323 if (activate_task(this, TASK_CHILD_DELETE))
324 {
325 exchange = INFORMATIONAL_V1;
326 new_mid = TRUE;
327 }
328 break;
329 default:
330 break;
331 }
332 }
333 else
334 {
335 DBG2(DBG_IKE, "reinitiating already active tasks");
336 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
337 while (enumerator->enumerate(enumerator, (void**)&task))
338 {
339 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
340 switch (task->get_type(task))
341 {
342 case TASK_MAIN_MODE:
343 exchange = ID_PROT;
344 break;
345 case TASK_QUICK_MODE:
346 exchange = QUICK_MODE;
347 break;
348 case TASK_XAUTH:
349 exchange = TRANSACTION;
350 new_mid = TRUE;
351 break;
352 default:
353 continue;
354 }
355 break;
356 }
357 enumerator->destroy(enumerator);
358 }
359
360 if (exchange == EXCHANGE_TYPE_UNDEFINED)
361 {
362 DBG2(DBG_IKE, "nothing to initiate");
363 /* nothing to do yet... */
364 return SUCCESS;
365 }
366
367 me = this->ike_sa->get_my_host(this->ike_sa);
368 other = this->ike_sa->get_other_host(this->ike_sa);
369
370 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
371 if (new_mid)
372 {
373 this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
374 (void*)&this->initiating.mid);
375 }
376 message->set_message_id(message, this->initiating.mid);
377 message->set_source(message, me->clone(me));
378 message->set_destination(message, other->clone(other));
379 message->set_exchange_type(message, exchange);
380 this->initiating.type = exchange;
381 this->initiating.retransmitted = 0;
382
383 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
384 while (enumerator->enumerate(enumerator, (void*)&task))
385 {
386 switch (task->build(task, message))
387 {
388 case SUCCESS:
389 /* task completed, remove it */
390 this->active_tasks->remove_at(this->active_tasks, enumerator);
391 task->destroy(task);
392 continue;
393 case NEED_MORE:
394 expect_response = TRUE;
395 /* processed, but task needs another exchange */
396 continue;
397 case ALREADY_DONE:
398 flush_queue(this, this->active_tasks);
399 break;
400 case FAILED:
401 default:
402 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
403 {
404 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
405 }
406 /* FALL */
407 case DESTROY_ME:
408 /* critical failure, destroy IKE_SA */
409 enumerator->destroy(enumerator);
410 message->destroy(message);
411 flush(this);
412 return DESTROY_ME;
413 }
414 break;
415 }
416 enumerator->destroy(enumerator);
417
418 if (this->active_tasks->get_count(this->active_tasks) == 0)
419 { /* tasks completed, no exchange active anymore */
420 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
421 }
422 this->initiating.seqnr++;
423
424 status = this->ike_sa->generate_message(this->ike_sa, message,
425 &this->initiating.packet);
426 if (status != SUCCESS)
427 {
428 /* message generation failed. There is nothing more to do than to
429 * close the SA */
430 message->destroy(message);
431 flush(this);
432 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
433 return DESTROY_ME;
434 }
435 message->destroy(message);
436
437 if (expect_response)
438 {
439 return retransmit(this, this->initiating.seqnr);
440 }
441 charon->sender->send(charon->sender,
442 this->initiating.packet->clone(this->initiating.packet));
443 this->initiating.packet->destroy(this->initiating.packet);
444 this->initiating.packet = NULL;
445
446 /* close after sending an INFORMATIONAL error but not yet established */
447 if (exchange == INFORMATIONAL_V1 &&
448 this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING)
449 {
450 return FAILED;
451 }
452 return SUCCESS;
453 }
454
455 /**
456 * handle exchange collisions
457 */
458 static bool handle_collisions(private_task_manager_t *this, task_t *task)
459 {
460 return FALSE;
461 }
462
463 /**
464 * build a response depending on the "passive" task list
465 */
466 static status_t build_response(private_task_manager_t *this, message_t *request)
467 {
468 enumerator_t *enumerator;
469 task_t *task;
470 message_t *message;
471 host_t *me, *other;
472 bool delete = FALSE;
473 status_t status;
474
475 me = request->get_destination(request);
476 other = request->get_source(request);
477
478 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
479 message->set_exchange_type(message, request->get_exchange_type(request));
480 /* send response along the path the request came in */
481 message->set_source(message, me->clone(me));
482 message->set_destination(message, other->clone(other));
483 message->set_message_id(message, request->get_message_id(request));
484 message->set_request(message, FALSE);
485
486 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
487 while (enumerator->enumerate(enumerator, (void*)&task))
488 {
489 switch (task->build(task, message))
490 {
491 case SUCCESS:
492 /* task completed, remove it */
493 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
494 if (!handle_collisions(this, task))
495 {
496 task->destroy(task);
497 }
498 continue;
499 case NEED_MORE:
500 /* processed, but task needs another exchange */
501 if (handle_collisions(this, task))
502 {
503 this->passive_tasks->remove_at(this->passive_tasks,
504 enumerator);
505 }
506 continue;
507 case ALREADY_DONE:
508 flush_queue(this, this->passive_tasks);
509 break;
510 case FAILED:
511 default:
512 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
513 /* FALL */
514 case DESTROY_ME:
515 /* destroy IKE_SA, but SEND response first */
516 delete = TRUE;
517 break;
518 }
519 break;
520 }
521 enumerator->destroy(enumerator);
522
523 /* message complete, send it */
524 DESTROY_IF(this->responding.packet);
525 this->responding.packet = NULL;
526 status = this->ike_sa->generate_message(this->ike_sa, message,
527 &this->responding.packet);
528 message->destroy(message);
529 if (status != SUCCESS)
530 {
531 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
532 return DESTROY_ME;
533 }
534
535 charon->sender->send(charon->sender,
536 this->responding.packet->clone(this->responding.packet));
537 if (delete)
538 {
539 return DESTROY_ME;
540 }
541 return SUCCESS;
542 }
543
544 /**
545 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
546 * The notify protocol_id is set to ISAKMP
547 */
548 static void send_notify(private_task_manager_t *this, message_t *request,
549 notify_type_t type)
550 {
551 message_t *response;
552 packet_t *packet;
553 host_t *me, *other;
554 u_int32_t mid;
555
556 if (request && request->get_exchange_type(request) == INFORMATIONAL_V1)
557 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
558 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
559 return;
560 }
561
562 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
563 response->set_exchange_type(response, INFORMATIONAL_V1);
564 response->set_request(response, TRUE);
565 this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid);
566 response->set_message_id(response, mid);
567 response->add_payload(response, (payload_t*)
568 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
569 PROTO_IKE, type));
570
571 me = this->ike_sa->get_my_host(this->ike_sa);
572 if (me->is_anyaddr(me))
573 {
574 me = request->get_destination(request);
575 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
576 }
577 other = this->ike_sa->get_other_host(this->ike_sa);
578 if (other->is_anyaddr(other))
579 {
580 other = request->get_source(request);
581 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
582 }
583 response->set_source(response, me->clone(me));
584 response->set_destination(response, other->clone(other));
585 if (this->ike_sa->generate_message(this->ike_sa, response,
586 &packet) == SUCCESS)
587 {
588 charon->sender->send(charon->sender, packet);
589 }
590 response->destroy(response);
591 }
592
593 /**
594 * handle an incoming request message
595 */
596 static status_t process_request(private_task_manager_t *this,
597 message_t *message)
598 {
599 enumerator_t *enumerator;
600 task_t *task = NULL;
601 bool send_response = FALSE;
602
603 if (this->passive_tasks->get_count(this->passive_tasks) == 0)
604 { /* create tasks depending on request type, if not already some queued */
605 switch (message->get_exchange_type(message))
606 {
607 case ID_PROT:
608 task = (task_t *)ike_vendor_v1_create(this->ike_sa, FALSE);
609 this->passive_tasks->insert_last(this->passive_tasks, task);
610 task = (task_t*)ike_cert_pre_v1_create(this->ike_sa, FALSE);
611 this->passive_tasks->insert_last(this->passive_tasks, task);
612 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
613 this->passive_tasks->insert_last(this->passive_tasks, task);
614 task = (task_t*)ike_cert_post_v1_create(this->ike_sa, FALSE);
615 this->passive_tasks->insert_last(this->passive_tasks, task);
616 task = (task_t *)ike_natd_v1_create(this->ike_sa, FALSE);
617 this->passive_tasks->insert_last(this->passive_tasks, task);
618 break;
619 case AGGRESSIVE:
620 /* TODO-IKEv1: agressive mode */
621 return FAILED;
622 case QUICK_MODE:
623 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
624 {
625 DBG1(DBG_IKE, "received quick mode request for "
626 "unestablished IKE_SA, ignored");
627 return FAILED;
628 }
629 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
630 NULL, NULL);
631 this->passive_tasks->insert_last(this->passive_tasks, task);
632 break;
633 case INFORMATIONAL_V1:
634 task = (task_t *)informational_create(this->ike_sa, NULL);
635 this->passive_tasks->insert_last(this->passive_tasks, task);
636 break;
637 case TRANSACTION:
638 if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
639 {
640 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
641 }
642 else
643 {
644 task = (task_t *)xauth_create(this->ike_sa, FALSE);
645 }
646 this->passive_tasks->insert_last(this->passive_tasks, task);
647 break;
648 default:
649 return FAILED;
650 }
651 }
652 /* let the tasks process the message */
653 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
654 while (enumerator->enumerate(enumerator, (void*)&task))
655 {
656 switch (task->process(task, message))
657 {
658 case SUCCESS:
659 /* task completed, remove it */
660 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
661 task->destroy(task);
662 continue;
663 case NEED_MORE:
664 /* processed, but task needs at least another call to build() */
665 send_response = TRUE;
666 continue;
667 case ALREADY_DONE:
668 send_response = FALSE;
669 flush_queue(this, this->passive_tasks);
670 break;
671 case FAILED:
672 default:
673 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
674 /* FALL */
675 case DESTROY_ME:
676 /* critical failure, destroy IKE_SA */
677 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
678 enumerator->destroy(enumerator);
679 task->destroy(task);
680 return DESTROY_ME;
681 }
682 break;
683 }
684 enumerator->destroy(enumerator);
685
686 if (send_response)
687 {
688 if (build_response(this, message) != SUCCESS)
689 {
690 return DESTROY_ME;
691 }
692 }
693 else
694 { /* We don't send a response, so don't retransmit one if we get
695 * the same message again. */
696 DESTROY_IF(this->responding.packet);
697 this->responding.packet = NULL;
698 }
699 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
700 this->queued_tasks->get_count(this->queued_tasks) > 0)
701 {
702 /* passive tasks completed, check if an active task has been queued,
703 * such as XAUTH or modeconfig push */
704 return initiate(this);
705 }
706 return SUCCESS;
707 }
708
709 /**
710 * handle an incoming response message
711 */
712 static status_t process_response(private_task_manager_t *this,
713 message_t *message)
714 {
715 enumerator_t *enumerator;
716 status_t status;
717 task_t *task;
718
719 if (message->get_exchange_type(message) != this->initiating.type)
720 {
721 DBG1(DBG_IKE, "received %N response, but expected %N",
722 exchange_type_names, message->get_exchange_type(message),
723 exchange_type_names, this->initiating.type);
724 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
725 return DESTROY_ME;
726 }
727
728 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
729 while (enumerator->enumerate(enumerator, (void*)&task))
730 {
731 switch (task->process(task, message))
732 {
733 case SUCCESS:
734 /* task completed, remove it */
735 this->active_tasks->remove_at(this->active_tasks, enumerator);
736 task->destroy(task);
737 continue;
738 case NEED_MORE:
739 /* processed, but task needs another exchange */
740 continue;
741 case ALREADY_DONE:
742 flush_queue(this, this->active_tasks);
743 break;
744 case FAILED:
745 default:
746 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
747 /* FALL */
748 case DESTROY_ME:
749 /* critical failure, destroy IKE_SA */
750 this->active_tasks->remove_at(this->active_tasks, enumerator);
751 enumerator->destroy(enumerator);
752 task->destroy(task);
753 return DESTROY_ME;
754 }
755 break;
756 }
757 enumerator->destroy(enumerator);
758
759 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
760 this->initiating.packet->destroy(this->initiating.packet);
761 this->initiating.packet = NULL;
762
763 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
764 {
765 status = this->public.task_manager.process_message(
766 &this->public.task_manager, this->queued);
767 this->queued->destroy(this->queued);
768 this->queued = NULL;
769 if (status == DESTROY_ME)
770 {
771 return status;
772 }
773 }
774
775 return initiate(this);
776 }
777
778 /**
779 * Parse the given message and verify that it is valid.
780 */
781 static status_t parse_message(private_task_manager_t *this, message_t *msg)
782 {
783 status_t status;
784
785 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
786
787 if (status != SUCCESS)
788 {
789 switch (status)
790 {
791 case NOT_SUPPORTED:
792 DBG1(DBG_IKE, "unsupported exchange type");
793 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
794 break;
795 case PARSE_ERROR:
796 DBG1(DBG_IKE, "message parsing failed");
797 send_notify(this, msg, PAYLOAD_MALFORMED);
798 break;
799 case VERIFY_ERROR:
800 DBG1(DBG_IKE, "message verification failed");
801 send_notify(this, msg, PAYLOAD_MALFORMED);
802 break;
803 case FAILED:
804 DBG1(DBG_IKE, "integrity check failed");
805 send_notify(this, msg, INVALID_HASH_INFORMATION);
806 break;
807 case INVALID_STATE:
808 DBG1(DBG_IKE, "found encrypted message, but no keys available");
809 send_notify(this, msg, PAYLOAD_MALFORMED);
810 default:
811 break;
812 }
813 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
814 exchange_type_names, msg->get_exchange_type(msg),
815 msg->get_request(msg) ? "request" : "response",
816 msg->get_message_id(msg));
817
818 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
819 { /* invalid initiation attempt, close SA */
820 return DESTROY_ME;
821 }
822 }
823 return status;
824 }
825
826 METHOD(task_manager_t, process_message, status_t,
827 private_task_manager_t *this, message_t *msg)
828 {
829 u_int32_t hash, mid;
830 host_t *me, *other;
831 status_t status;
832
833 /* TODO-IKEv1: update hosts more selectively */
834 me = msg->get_destination(msg);
835 other = msg->get_source(msg);
836 mid = msg->get_message_id(msg);
837
838 if ((mid && mid == this->initiating.mid) ||
839 (this->initiating.mid == 0 &&
840 msg->get_exchange_type(msg) == this->initiating.type &&
841 this->active_tasks->get_count(this->active_tasks)))
842 {
843 msg->set_request(msg, FALSE);
844 status = parse_message(this, msg);
845 if (status != SUCCESS)
846 {
847 return status;
848 }
849 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
850 time_monotonic(NULL));
851 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
852 charon->bus->message(charon->bus, msg, FALSE);
853 if (process_response(this, msg) != SUCCESS)
854 {
855 flush(this);
856 return DESTROY_ME;
857 }
858 }
859 else
860 {
861 hash = chunk_hash(msg->get_packet_data(msg));
862 if (hash == this->responding.hash)
863 {
864 if (this->responding.packet)
865 {
866 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
867 "retransmitting response", mid);
868 charon->sender->send(charon->sender,
869 this->responding.packet->clone(this->responding.packet));
870 }
871 else
872 {
873 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
874 "but no response to retransmit", mid);
875 }
876 return SUCCESS;
877 }
878
879 if (msg->get_exchange_type(msg) == TRANSACTION &&
880 this->active_tasks->get_count(this->active_tasks) &&
881 !this->queued)
882 { /* main mode not yet complete, queue XAuth/Mode config tasks */
883 this->queued = message_create_from_packet(msg->get_packet(msg));
884 if (this->queued->parse_header(this->queued) != SUCCESS)
885 {
886 this->queued->destroy(this->queued);
887 this->queued = NULL;
888 return FAILED;
889 }
890 DBG1(DBG_IKE, "queueing %N request as tasks still active",
891 exchange_type_names, TRANSACTION);
892 return SUCCESS;
893 }
894
895 msg->set_request(msg, TRUE);
896 status = parse_message(this, msg);
897 if (status != SUCCESS)
898 {
899 return status;
900 }
901 /* if this IKE_SA is virgin, we check for a config */
902 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
903 {
904 ike_sa_id_t *ike_sa_id;
905 ike_cfg_t *ike_cfg;
906 job_t *job;
907 ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
908 if (ike_cfg == NULL)
909 {
910 /* no config found for these hosts, destroy */
911 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
912 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
913 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
914 return DESTROY_ME;
915 }
916 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
917 ike_cfg->destroy(ike_cfg);
918 /* add a timeout if peer does not establish it completely */
919 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
920 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
921 lib->scheduler->schedule_job(lib->scheduler, job,
922 lib->settings->get_int(lib->settings,
923 "charon.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT));
924 }
925 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
926 time_monotonic(NULL));
927 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
928 charon->bus->message(charon->bus, msg, TRUE);
929 if (process_request(this, msg) != SUCCESS)
930 {
931 flush(this);
932 return DESTROY_ME;
933 }
934 this->responding.hash = hash;
935 }
936 return SUCCESS;
937 }
938
939 METHOD(task_manager_t, queue_task, void,
940 private_task_manager_t *this, task_t *task)
941 {
942 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
943 this->queued_tasks->insert_last(this->queued_tasks, task);
944 }
945
946 METHOD(task_manager_t, adopt_tasks, void,
947 private_task_manager_t *this, task_manager_t *other_public)
948 {
949 private_task_manager_t *other = (private_task_manager_t*)other_public;
950 task_t *task;
951
952 /* move queued tasks from other to this */
953 while (other->queued_tasks->remove_last(other->queued_tasks,
954 (void**)&task) == SUCCESS)
955 {
956 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
957 task->migrate(task, this->ike_sa);
958 this->queued_tasks->insert_first(this->queued_tasks, task);
959 }
960 }
961
962 METHOD(task_manager_t, busy, bool,
963 private_task_manager_t *this)
964 {
965 return (this->active_tasks->get_count(this->active_tasks) > 0);
966 }
967
968 METHOD(task_manager_t, incr_mid, void,
969 private_task_manager_t *this, bool initiate)
970 {
971 }
972
973 METHOD(task_manager_t, reset, void,
974 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
975 {
976 }
977
978 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
979 private_task_manager_t *this, task_queue_t queue)
980 {
981 switch (queue)
982 {
983 case TASK_QUEUE_ACTIVE:
984 return this->active_tasks->create_enumerator(this->active_tasks);
985 case TASK_QUEUE_PASSIVE:
986 return this->passive_tasks->create_enumerator(this->passive_tasks);
987 case TASK_QUEUE_QUEUED:
988 return this->queued_tasks->create_enumerator(this->queued_tasks);
989 default:
990 return enumerator_create_empty();
991 }
992 }
993
994 METHOD(task_manager_t, destroy, void,
995 private_task_manager_t *this)
996 {
997 flush(this);
998
999 this->active_tasks->destroy(this->active_tasks);
1000 this->queued_tasks->destroy(this->queued_tasks);
1001 this->passive_tasks->destroy(this->passive_tasks);
1002
1003 DESTROY_IF(this->queued);
1004 DESTROY_IF(this->responding.packet);
1005 DESTROY_IF(this->initiating.packet);
1006 DESTROY_IF(this->rng);
1007 free(this);
1008 }
1009
1010 /*
1011 * see header file
1012 */
1013 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1014 {
1015 private_task_manager_t *this;
1016
1017 INIT(this,
1018 .public = {
1019 .task_manager = {
1020 .process_message = _process_message,
1021 .queue_task = _queue_task,
1022 .initiate = _initiate,
1023 .retransmit = _retransmit,
1024 .incr_mid = _incr_mid,
1025 .reset = _reset,
1026 .adopt_tasks = _adopt_tasks,
1027 .busy = _busy,
1028 .create_task_enumerator = _create_task_enumerator,
1029 .destroy = _destroy,
1030 },
1031 },
1032 .ike_sa = ike_sa,
1033 .initiating.type = EXCHANGE_TYPE_UNDEFINED,
1034 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1035 .queued_tasks = linked_list_create(),
1036 .active_tasks = linked_list_create(),
1037 .passive_tasks = linked_list_create(),
1038 .retransmit_tries = lib->settings->get_int(lib->settings,
1039 "charon.retransmit_tries", RETRANSMIT_TRIES),
1040 .retransmit_timeout = lib->settings->get_double(lib->settings,
1041 "charon.retransmit_timeout", RETRANSMIT_TIMEOUT),
1042 .retransmit_base = lib->settings->get_double(lib->settings,
1043 "charon.retransmit_base", RETRANSMIT_BASE),
1044 );
1045
1046 return &this->public;
1047 }