Check if IKEv1 exchange type matches before handling it as response
[strongswan.git] / src / libcharon / sa / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/tasks/child_delete.h>
23 #include <sa/tasks/main_mode.h>
24 #include <sa/tasks/quick_mode.h>
25 #include <sa/tasks/xauth.h>
26 #include <sa/tasks/mode_config.h>
27 #include <sa/tasks/ike_delete.h>
28 #include <sa/tasks/ike_natd_v1.h>
29 #include <sa/tasks/ike_vendor_v1.h>
30 #include <sa/tasks/ike_cert_pre_v1.h>
31 #include <sa/tasks/ike_cert_post_v1.h>
32 #include <encoding/payloads/delete_payload.h>
33 #include <processing/jobs/retransmit_job.h>
34 #include <processing/jobs/delete_ike_sa_job.h>
35
36 typedef struct exchange_t exchange_t;
37
38 /**
39 * An exchange in the air, used do detect and handle retransmission
40 */
41 struct exchange_t {
42
43 /**
44 * Message ID used for this transaction
45 */
46 u_int32_t mid;
47
48 /**
49 * generated packet for retransmission
50 */
51 packet_t *packet;
52 };
53
54 typedef struct private_task_manager_t private_task_manager_t;
55
56 /**
57 * private data of the task manager
58 */
59 struct private_task_manager_t {
60
61 /**
62 * public functions
63 */
64 task_manager_v1_t public;
65
66 /**
67 * associated IKE_SA we are serving
68 */
69 ike_sa_t *ike_sa;
70
71 /**
72 * RNG to create message IDs
73 */
74 rng_t *rng;
75
76 /**
77 * Exchange we are currently handling as responder
78 */
79 struct {
80 /**
81 * Message ID of the exchange
82 */
83 u_int32_t mid;
84
85 /**
86 * Hash of a previously received message
87 */
88 u_int32_t hash;
89
90 /**
91 * packet for retransmission
92 */
93 packet_t *packet;
94
95 } responding;
96
97 /**
98 * Exchange we are currently handling as initiator
99 */
100 struct {
101 /**
102 * Message ID of the exchange
103 */
104 u_int32_t mid;
105
106 /**
107 * Sequence number of the last sent message
108 */
109 u_int32_t seqnr;
110
111 /**
112 * how many times we have retransmitted so far
113 */
114 u_int retransmitted;
115
116 /**
117 * packet for retransmission
118 */
119 packet_t *packet;
120
121 /**
122 * type of the initated exchange
123 */
124 exchange_type_t type;
125
126 } initiating;
127
128 /**
129 * List of queued tasks not yet in action
130 */
131 linked_list_t *queued_tasks;
132
133 /**
134 * List of active tasks, initiated by ourselve
135 */
136 linked_list_t *active_tasks;
137
138 /**
139 * List of tasks initiated by peer
140 */
141 linked_list_t *passive_tasks;
142
143 /**
144 * Number of times we retransmit messages before giving up
145 */
146 u_int retransmit_tries;
147
148 /**
149 * Retransmission timeout
150 */
151 double retransmit_timeout;
152
153 /**
154 * Base to calculate retransmission timeout
155 */
156 double retransmit_base;
157 };
158
159 /**
160 * Flush a single task queue
161 */
162 static void flush_queue(private_task_manager_t *this, linked_list_t *list)
163 {
164 task_t *task;
165
166 while (list->remove_last(list, (void**)&task) == SUCCESS)
167 {
168 task->destroy(task);
169 }
170 }
171
172 /**
173 * flush all tasks in the task manager
174 */
175 static void flush(private_task_manager_t *this)
176 {
177 flush_queue(this, this->queued_tasks);
178 flush_queue(this, this->passive_tasks);
179 flush_queue(this, this->active_tasks);
180 }
181
182 /**
183 * move a task of a specific type from the queue to the active list
184 */
185 static bool activate_task(private_task_manager_t *this, task_type_t type)
186 {
187 enumerator_t *enumerator;
188 task_t *task;
189 bool found = FALSE;
190
191 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
192 while (enumerator->enumerate(enumerator, (void**)&task))
193 {
194 if (task->get_type(task) == type)
195 {
196 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
197 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
198 this->active_tasks->insert_last(this->active_tasks, task);
199 found = TRUE;
200 break;
201 }
202 }
203 enumerator->destroy(enumerator);
204 return found;
205 }
206
207 METHOD(task_manager_t, retransmit, status_t,
208 private_task_manager_t *this, u_int32_t message_seqnr)
209 {
210 /* this.initiating packet used as marker for received response */
211 if (message_seqnr == this->initiating.seqnr && this->initiating.packet )
212 {
213 u_int32_t timeout;
214 packet_t *packet;
215 job_t *job;
216
217 if (this->initiating.retransmitted <= this->retransmit_tries)
218 {
219 timeout = (u_int32_t)(this->retransmit_timeout * 1000.0 *
220 pow(this->retransmit_base, this->initiating.retransmitted));
221 }
222 else
223 {
224 DBG1(DBG_IKE, "giving up after %d retransmits",
225 this->initiating.retransmitted - 1);
226 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
227 {
228 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
229 }
230 return DESTROY_ME;
231 }
232
233 if (this->initiating.retransmitted)
234 {
235 DBG1(DBG_IKE, "retransmit %d of request with message ID %d seqnr (%d)",
236 this->initiating.retransmitted, this->initiating.mid, message_seqnr);
237 }
238 packet = this->initiating.packet->clone(this->initiating.packet);
239 charon->sender->send(charon->sender, packet);
240
241 this->initiating.retransmitted++;
242 job = (job_t*)retransmit_job_create(this->initiating.seqnr,
243 this->ike_sa->get_id(this->ike_sa));
244 lib->scheduler->schedule_job_ms(lib->scheduler, job, timeout);
245 }
246 return SUCCESS;
247 }
248
249 METHOD(task_manager_t, initiate, status_t,
250 private_task_manager_t *this)
251 {
252 enumerator_t *enumerator;
253 task_t *task;
254 message_t *message;
255 host_t *me, *other;
256 status_t status;
257 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
258 bool new_mid = FALSE;
259 bool expect_response = FALSE;
260
261 if (!this->rng)
262 {
263 DBG1(DBG_IKE, "no RNG supported");
264 return FAILED;
265 }
266
267 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED)
268 {
269 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
270 exchange_type_names, this->initiating.type);
271 /* do not initiate if we already have a message in the air */
272 return SUCCESS;
273 }
274
275 if (this->active_tasks->get_count(this->active_tasks) == 0)
276 {
277 DBG2(DBG_IKE, "activating new tasks");
278 switch (this->ike_sa->get_state(this->ike_sa))
279 {
280 case IKE_CREATED:
281 activate_task(this, TASK_VENDOR_V1);
282 activate_task(this, TASK_IKE_CERT_PRE_V1);
283 if (activate_task(this, TASK_MAIN_MODE))
284 {
285 exchange = ID_PROT;
286 activate_task(this, TASK_IKE_CERT_POST_V1);
287 activate_task(this, TASK_IKE_NATD_V1);
288 }
289 break;
290 case IKE_CONNECTING:
291 if (activate_task(this, TASK_XAUTH))
292 {
293 exchange = TRANSACTION;
294 new_mid = TRUE;
295 }
296 if (activate_task(this, TASK_INFORMATIONAL))
297 {
298 exchange = INFORMATIONAL_V1;
299 new_mid = TRUE;
300 }
301 break;
302 case IKE_ESTABLISHED:
303 if (activate_task(this, TASK_MODE_CONFIG))
304 {
305 exchange = TRANSACTION;
306 new_mid = TRUE;
307 break;
308 }
309 if (activate_task(this, TASK_QUICK_MODE))
310 {
311 exchange = QUICK_MODE;
312 new_mid = TRUE;
313 break;
314 }
315 if (activate_task(this, TASK_INFORMATIONAL))
316 {
317 exchange = INFORMATIONAL_V1;
318 new_mid = TRUE;
319 }
320 break;
321 default:
322 break;
323 }
324 }
325 else
326 {
327 DBG2(DBG_IKE, "reinitiating already active tasks");
328 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
329 while (enumerator->enumerate(enumerator, (void**)&task))
330 {
331 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
332 switch (task->get_type(task))
333 {
334 case TASK_MAIN_MODE:
335 exchange = ID_PROT;
336 break;
337 case TASK_QUICK_MODE:
338 exchange = QUICK_MODE;
339 break;
340 case TASK_XAUTH:
341 exchange = TRANSACTION;
342 new_mid = TRUE;
343 break;
344 default:
345 continue;
346 }
347 break;
348 }
349 enumerator->destroy(enumerator);
350 }
351
352 if (exchange == EXCHANGE_TYPE_UNDEFINED)
353 {
354 DBG2(DBG_IKE, "nothing to initiate");
355 /* nothing to do yet... */
356 return SUCCESS;
357 }
358
359 me = this->ike_sa->get_my_host(this->ike_sa);
360 other = this->ike_sa->get_other_host(this->ike_sa);
361
362 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
363 if (new_mid)
364 {
365 this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
366 (void*)&this->initiating.mid);
367 }
368 message->set_message_id(message, this->initiating.mid);
369 message->set_source(message, me->clone(me));
370 message->set_destination(message, other->clone(other));
371 message->set_exchange_type(message, exchange);
372 this->initiating.type = exchange;
373 this->initiating.retransmitted = 0;
374
375 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
376 while (enumerator->enumerate(enumerator, (void*)&task))
377 {
378 switch (task->build(task, message))
379 {
380 case SUCCESS:
381 /* task completed, remove it */
382 this->active_tasks->remove_at(this->active_tasks, enumerator);
383 task->destroy(task);
384 continue;
385 case NEED_MORE:
386 expect_response = TRUE;
387 /* processed, but task needs another exchange */
388 continue;
389 case ALREADY_DONE:
390 flush_queue(this, this->active_tasks);
391 break;
392 case FAILED:
393 default:
394 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
395 {
396 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
397 }
398 /* FALL */
399 case DESTROY_ME:
400 /* critical failure, destroy IKE_SA */
401 enumerator->destroy(enumerator);
402 message->destroy(message);
403 flush(this);
404 return DESTROY_ME;
405 }
406 break;
407 }
408 enumerator->destroy(enumerator);
409
410 /* update exchange type if a task changed it */
411 this->initiating.type = message->get_exchange_type(message);
412 this->initiating.seqnr++;
413
414 status = this->ike_sa->generate_message(this->ike_sa, message,
415 &this->initiating.packet);
416 if (status != SUCCESS)
417 {
418 /* message generation failed. There is nothing more to do than to
419 * close the SA */
420 message->destroy(message);
421 flush(this);
422 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
423 return DESTROY_ME;
424 }
425 message->destroy(message);
426
427 if (expect_response)
428 {
429 return retransmit(this, this->initiating.seqnr);
430 }
431 charon->sender->send(charon->sender,
432 this->initiating.packet->clone(this->initiating.packet));
433 this->initiating.packet->destroy(this->initiating.packet);
434 this->initiating.packet = NULL;
435 return SUCCESS;
436 }
437
438 /**
439 * handle exchange collisions
440 */
441 static bool handle_collisions(private_task_manager_t *this, task_t *task)
442 {
443 return FALSE;
444 }
445
446 /**
447 * build a response depending on the "passive" task list
448 */
449 static status_t build_response(private_task_manager_t *this, message_t *request)
450 {
451 enumerator_t *enumerator;
452 task_t *task;
453 message_t *message;
454 host_t *me, *other;
455 bool delete = FALSE;
456 status_t status;
457
458 me = request->get_destination(request);
459 other = request->get_source(request);
460
461 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
462 message->set_exchange_type(message, request->get_exchange_type(request));
463 /* send response along the path the request came in */
464 message->set_source(message, me->clone(me));
465 message->set_destination(message, other->clone(other));
466 message->set_message_id(message, request->get_message_id(request));
467 message->set_request(message, FALSE);
468
469 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
470 while (enumerator->enumerate(enumerator, (void*)&task))
471 {
472 switch (task->build(task, message))
473 {
474 case SUCCESS:
475 /* task completed, remove it */
476 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
477 if (!handle_collisions(this, task))
478 {
479 task->destroy(task);
480 }
481 continue;
482 case NEED_MORE:
483 /* processed, but task needs another exchange */
484 if (handle_collisions(this, task))
485 {
486 this->passive_tasks->remove_at(this->passive_tasks,
487 enumerator);
488 }
489 continue;
490 case ALREADY_DONE:
491 flush_queue(this, this->passive_tasks);
492 break;
493 case FAILED:
494 default:
495 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
496 /* FALL */
497 case DESTROY_ME:
498 /* destroy IKE_SA, but SEND response first */
499 delete = TRUE;
500 break;
501 }
502 break;
503 }
504 enumerator->destroy(enumerator);
505
506 /* message complete, send it */
507 DESTROY_IF(this->responding.packet);
508 this->responding.packet = NULL;
509 status = this->ike_sa->generate_message(this->ike_sa, message,
510 &this->responding.packet);
511 message->destroy(message);
512 if (status != SUCCESS)
513 {
514 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
515 return DESTROY_ME;
516 }
517
518 charon->sender->send(charon->sender,
519 this->responding.packet->clone(this->responding.packet));
520 if (delete)
521 {
522 return DESTROY_ME;
523 }
524 return SUCCESS;
525 }
526
527 /**
528 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
529 * The notify protocol_id is set to ISAKMP
530 */
531 static void send_notify(private_task_manager_t *this, message_t *request,
532 notify_type_t type)
533 {
534 message_t *response;
535 packet_t *packet;
536 host_t *me, *other;
537 u_int32_t mid;
538
539 if (request && request->get_exchange_type(request) == INFORMATIONAL_V1)
540 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
541 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
542 return;
543 }
544
545 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
546 response->set_exchange_type(response, INFORMATIONAL_V1);
547 response->set_request(response, TRUE);
548 this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid);
549 response->set_message_id(response, mid);
550 response->add_payload(response, (payload_t*)
551 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
552 PROTO_IKE, type));
553
554 me = this->ike_sa->get_my_host(this->ike_sa);
555 if (me->is_anyaddr(me))
556 {
557 me = request->get_destination(request);
558 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
559 }
560 other = this->ike_sa->get_other_host(this->ike_sa);
561 if (other->is_anyaddr(other))
562 {
563 other = request->get_source(request);
564 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
565 }
566 response->set_source(response, me->clone(me));
567 response->set_destination(response, other->clone(other));
568 if (this->ike_sa->generate_message(this->ike_sa, response,
569 &packet) == SUCCESS)
570 {
571 charon->sender->send(charon->sender, packet);
572 }
573 response->destroy(response);
574 }
575
576 /**
577 * handle an incoming request message
578 */
579 static status_t process_request(private_task_manager_t *this,
580 message_t *message)
581 {
582 enumerator_t *enumerator;
583 task_t *task = NULL;
584 bool send_response = FALSE;
585 payload_t *payload;
586 notify_payload_t *notify;
587
588 if (this->passive_tasks->get_count(this->passive_tasks) == 0)
589 { /* create tasks depending on request type, if not already some queued */
590 switch (message->get_exchange_type(message))
591 {
592 case ID_PROT:
593 task = (task_t *)ike_vendor_v1_create(this->ike_sa, FALSE);
594 this->passive_tasks->insert_last(this->passive_tasks, task);
595 task = (task_t*)ike_cert_pre_v1_create(this->ike_sa, FALSE);
596 this->passive_tasks->insert_last(this->passive_tasks, task);
597 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
598 this->passive_tasks->insert_last(this->passive_tasks, task);
599 task = (task_t*)ike_cert_post_v1_create(this->ike_sa, FALSE);
600 this->passive_tasks->insert_last(this->passive_tasks, task);
601 task = (task_t *)ike_natd_v1_create(this->ike_sa, FALSE);
602 this->passive_tasks->insert_last(this->passive_tasks, task);
603 break;
604 case AGGRESSIVE:
605 /* TODO-IKEv1: agressive mode */
606 return FAILED;
607 case QUICK_MODE:
608 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
609 {
610 DBG1(DBG_IKE, "received quick mode request for "
611 "unestablished IKE_SA, ignored");
612 return FAILED;
613 }
614 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
615 NULL, NULL);
616 this->passive_tasks->insert_last(this->passive_tasks, task);
617 break;
618 case INFORMATIONAL_V1:
619 enumerator = message->create_payload_enumerator(message);
620 while (enumerator->enumerate(enumerator, &payload))
621 {
622 switch (payload->get_type(payload))
623 {
624 case NOTIFY_V1:
625 {
626 notify = (notify_payload_t*)payload;
627 switch (notify->get_notify_type(notify))
628 {
629 /* TODO-IKEv1: Add notification types here as needed */
630 case INITIAL_CONTACT_IKEV1:
631 break;
632 default:
633 if(notify->get_notify_type(notify) < 16384)
634 {
635 DBG1(DBG_IKE, "Received %N error notification.", notify_type_names, notify->get_notify_type(notify));
636 enumerator->destroy(enumerator);
637 return FAILED;
638 }
639 break;
640 }
641 break;
642 }
643 case DELETE_V1:
644 {
645 delete_payload_t *delete;
646 delete = (delete_payload_t*)payload;
647
648 if (delete->get_protocol_id(delete) == PROTO_IKE)
649 {
650 task = (task_t*)ike_delete_create(this->ike_sa,
651 FALSE);
652 }
653 else
654 {
655 task = (task_t*)child_delete_create(this->ike_sa,
656 PROTO_NONE, 0);
657 }
658 break;
659 }
660 default:
661 break;
662 }
663 if (task)
664 {
665 this->passive_tasks->insert_last(this->passive_tasks, task);
666 }
667 }
668 enumerator->destroy(enumerator);
669 break;
670 case TRANSACTION:
671 if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
672 {
673 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
674 }
675 else
676 {
677 task = (task_t *)xauth_create(this->ike_sa, FALSE);
678 }
679 this->passive_tasks->insert_last(this->passive_tasks, task);
680 break;
681 default:
682 return FAILED;
683 }
684 }
685 /* let the tasks process the message */
686 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
687 while (enumerator->enumerate(enumerator, (void*)&task))
688 {
689 switch (task->process(task, message))
690 {
691 case SUCCESS:
692 /* task completed, remove it */
693 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
694 task->destroy(task);
695 continue;
696 case NEED_MORE:
697 /* processed, but task needs at least another call to build() */
698 send_response = TRUE;
699 continue;
700 case ALREADY_DONE:
701 send_response = FALSE;
702 flush_queue(this, this->passive_tasks);
703 break;
704 case FAILED:
705 default:
706 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
707 /* FALL */
708 case DESTROY_ME:
709 /* critical failure, destroy IKE_SA */
710 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
711 enumerator->destroy(enumerator);
712 task->destroy(task);
713 return DESTROY_ME;
714 }
715 break;
716 }
717 enumerator->destroy(enumerator);
718
719 if (send_response)
720 {
721 if (build_response(this, message) != SUCCESS)
722 {
723 return DESTROY_ME;
724 }
725 }
726 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
727 this->queued_tasks->get_count(this->queued_tasks) > 0)
728 {
729 /* passive tasks completed, check if an active task has been queued,
730 * such as XAUTH or modeconfig push */
731 return initiate(this);
732 }
733 return SUCCESS;
734 }
735
736 /**
737 * handle an incoming response message
738 */
739 static status_t process_response(private_task_manager_t *this,
740 message_t *message)
741 {
742 enumerator_t *enumerator;
743 task_t *task;
744
745 if (message->get_exchange_type(message) != this->initiating.type)
746 {
747 DBG1(DBG_IKE, "received %N response, but expected %N",
748 exchange_type_names, message->get_exchange_type(message),
749 exchange_type_names, this->initiating.type);
750 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
751 return DESTROY_ME;
752 }
753
754 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
755 while (enumerator->enumerate(enumerator, (void*)&task))
756 {
757 switch (task->process(task, message))
758 {
759 case SUCCESS:
760 /* task completed, remove it */
761 this->active_tasks->remove_at(this->active_tasks, enumerator);
762 task->destroy(task);
763 continue;
764 case NEED_MORE:
765 /* processed, but task needs another exchange */
766 continue;
767 case ALREADY_DONE:
768 flush_queue(this, this->active_tasks);
769 break;
770 case FAILED:
771 default:
772 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
773 /* FALL */
774 case DESTROY_ME:
775 /* critical failure, destroy IKE_SA */
776 this->active_tasks->remove_at(this->active_tasks, enumerator);
777 enumerator->destroy(enumerator);
778 task->destroy(task);
779 return DESTROY_ME;
780 }
781 break;
782 }
783 enumerator->destroy(enumerator);
784
785 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
786 this->initiating.packet->destroy(this->initiating.packet);
787 this->initiating.packet = NULL;
788
789 return initiate(this);
790 }
791
792 /**
793 * Parse the given message and verify that it is valid.
794 */
795 static status_t parse_message(private_task_manager_t *this, message_t *msg)
796 {
797 status_t status;
798
799 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
800
801 if (status != SUCCESS)
802 {
803 switch (status)
804 {
805 case NOT_SUPPORTED:
806 DBG1(DBG_IKE, "unsupported exchange type");
807 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
808 break;
809 case PARSE_ERROR:
810 DBG1(DBG_IKE, "message parsing failed");
811 send_notify(this, msg, PAYLOAD_MALFORMED);
812 break;
813 case VERIFY_ERROR:
814 DBG1(DBG_IKE, "message verification failed");
815 send_notify(this, msg, PAYLOAD_MALFORMED);
816 break;
817 case FAILED:
818 DBG1(DBG_IKE, "integrity check failed");
819 send_notify(this, msg, INVALID_HASH_INFORMATION);
820 break;
821 case INVALID_STATE:
822 DBG1(DBG_IKE, "found encrypted message, but no keys available");
823 send_notify(this, msg, PAYLOAD_MALFORMED);
824 default:
825 break;
826 }
827 DBG1(DBG_IKE, "%N %s with message ID %d processing failed",
828 exchange_type_names, msg->get_exchange_type(msg),
829 msg->get_request(msg) ? "request" : "response",
830 msg->get_message_id(msg));
831
832 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
833 { /* invalid initiation attempt, close SA */
834 return DESTROY_ME;
835 }
836 }
837 return status;
838 }
839
840 METHOD(task_manager_t, process_message, status_t,
841 private_task_manager_t *this, message_t *msg)
842 {
843 u_int32_t hash, mid;
844 host_t *me, *other;
845 status_t status;
846
847 /* TODO-IKEv1: update hosts more selectively */
848 me = msg->get_destination(msg);
849 other = msg->get_source(msg);
850 mid = msg->get_message_id(msg);
851
852 if ((mid && mid == this->initiating.mid) ||
853 (this->initiating.mid == 0 &&
854 msg->get_exchange_type(msg) == this->initiating.type &&
855 this->active_tasks->get_count(this->active_tasks)))
856 {
857 msg->set_request(msg, FALSE);
858 status = parse_message(this, msg);
859 if (status != SUCCESS)
860 {
861 return status;
862 }
863 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
864 time_monotonic(NULL));
865 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
866 charon->bus->message(charon->bus, msg, FALSE);
867 if (process_response(this, msg) != SUCCESS)
868 {
869 flush(this);
870 return DESTROY_ME;
871 }
872 }
873 else
874 {
875 hash = chunk_hash(msg->get_packet_data(msg));
876 if (hash == this->responding.hash && this->responding.packet)
877 {
878 DBG1(DBG_IKE, "received retransmit of request with ID %d, "
879 "retransmitting response", mid);
880 charon->sender->send(charon->sender,
881 this->responding.packet->clone(this->responding.packet));
882 return SUCCESS;
883 }
884 msg->set_request(msg, TRUE);
885 status = parse_message(this, msg);
886 if (status != SUCCESS)
887 {
888 return status;
889 }
890 /* if this IKE_SA is virgin, we check for a config */
891 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
892 {
893 ike_sa_id_t *ike_sa_id;
894 ike_cfg_t *ike_cfg;
895 job_t *job;
896 ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
897 if (ike_cfg == NULL)
898 {
899 /* no config found for these hosts, destroy */
900 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
901 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
902 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
903 return DESTROY_ME;
904 }
905 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
906 ike_cfg->destroy(ike_cfg);
907 /* add a timeout if peer does not establish it completely */
908 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
909 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
910 lib->scheduler->schedule_job(lib->scheduler, job,
911 lib->settings->get_int(lib->settings,
912 "charon.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT));
913 }
914 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
915 time_monotonic(NULL));
916 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
917 charon->bus->message(charon->bus, msg, TRUE);
918 if (process_request(this, msg) != SUCCESS)
919 {
920 flush(this);
921 return DESTROY_ME;
922 }
923
924 this->responding.mid = mid;
925 this->responding.hash = hash;
926 }
927 return SUCCESS;
928 }
929
930 METHOD(task_manager_t, queue_task, void,
931 private_task_manager_t *this, task_t *task)
932 {
933 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
934 this->queued_tasks->insert_last(this->queued_tasks, task);
935 }
936
937 METHOD(task_manager_t, adopt_tasks, void,
938 private_task_manager_t *this, task_manager_t *other_public)
939 {
940 private_task_manager_t *other = (private_task_manager_t*)other_public;
941 task_t *task;
942
943 /* move queued tasks from other to this */
944 while (other->queued_tasks->remove_last(other->queued_tasks,
945 (void**)&task) == SUCCESS)
946 {
947 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
948 task->migrate(task, this->ike_sa);
949 this->queued_tasks->insert_first(this->queued_tasks, task);
950 }
951 }
952
953 METHOD(task_manager_t, busy, bool,
954 private_task_manager_t *this)
955 {
956 return (this->active_tasks->get_count(this->active_tasks) > 0);
957 }
958
959 METHOD(task_manager_t, incr_mid, void,
960 private_task_manager_t *this, bool initiate)
961 {
962 }
963
964 METHOD(task_manager_t, reset, void,
965 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
966 {
967 }
968
969 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
970 private_task_manager_t *this, task_queue_t queue)
971 {
972 switch (queue)
973 {
974 case TASK_QUEUE_ACTIVE:
975 return this->active_tasks->create_enumerator(this->active_tasks);
976 case TASK_QUEUE_PASSIVE:
977 return this->passive_tasks->create_enumerator(this->passive_tasks);
978 case TASK_QUEUE_QUEUED:
979 return this->queued_tasks->create_enumerator(this->queued_tasks);
980 default:
981 return enumerator_create_empty();
982 }
983 }
984
985 METHOD(task_manager_t, destroy, void,
986 private_task_manager_t *this)
987 {
988 flush(this);
989
990 this->active_tasks->destroy(this->active_tasks);
991 this->queued_tasks->destroy(this->queued_tasks);
992 this->passive_tasks->destroy(this->passive_tasks);
993
994 DESTROY_IF(this->responding.packet);
995 DESTROY_IF(this->initiating.packet);
996 DESTROY_IF(this->rng);
997 free(this);
998 }
999
1000 /*
1001 * see header file
1002 */
1003 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1004 {
1005 private_task_manager_t *this;
1006
1007 INIT(this,
1008 .public = {
1009 .task_manager = {
1010 .process_message = _process_message,
1011 .queue_task = _queue_task,
1012 .initiate = _initiate,
1013 .retransmit = _retransmit,
1014 .incr_mid = _incr_mid,
1015 .reset = _reset,
1016 .adopt_tasks = _adopt_tasks,
1017 .busy = _busy,
1018 .create_task_enumerator = _create_task_enumerator,
1019 .destroy = _destroy,
1020 },
1021 },
1022 .ike_sa = ike_sa,
1023 .initiating.type = EXCHANGE_TYPE_UNDEFINED,
1024 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1025 .queued_tasks = linked_list_create(),
1026 .active_tasks = linked_list_create(),
1027 .passive_tasks = linked_list_create(),
1028 .retransmit_tries = lib->settings->get_int(lib->settings,
1029 "charon.retransmit_tries", RETRANSMIT_TRIES),
1030 .retransmit_timeout = lib->settings->get_double(lib->settings,
1031 "charon.retransmit_timeout", RETRANSMIT_TIMEOUT),
1032 .retransmit_base = lib->settings->get_double(lib->settings,
1033 "charon.retransmit_base", RETRANSMIT_BASE),
1034 );
1035
1036 return &this->public;
1037 }