Reject quick modes if IKE_SA not yet established
[strongswan.git] / src / libcharon / sa / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/tasks/child_delete.h>
23 #include <sa/tasks/main_mode.h>
24 #include <sa/tasks/quick_mode.h>
25 #include <sa/tasks/xauth.h>
26 #include <sa/tasks/ike_delete.h>
27 #include <sa/tasks/ike_natd_v1.h>
28 #include <sa/tasks/ike_vendor_v1.h>
29 #include <sa/tasks/ike_cert_pre_v1.h>
30 #include <sa/tasks/ike_cert_post_v1.h>
31 #include <encoding/payloads/delete_payload.h>
32 #include <processing/jobs/retransmit_job.h>
33 #include <processing/jobs/delete_ike_sa_job.h>
34
35 typedef struct exchange_t exchange_t;
36
37 /**
38 * An exchange in the air, used do detect and handle retransmission
39 */
40 struct exchange_t {
41
42 /**
43 * Message ID used for this transaction
44 */
45 u_int32_t mid;
46
47 /**
48 * generated packet for retransmission
49 */
50 packet_t *packet;
51 };
52
53 typedef struct private_task_manager_t private_task_manager_t;
54
55 /**
56 * private data of the task manager
57 */
58 struct private_task_manager_t {
59
60 /**
61 * public functions
62 */
63 task_manager_v1_t public;
64
65 /**
66 * associated IKE_SA we are serving
67 */
68 ike_sa_t *ike_sa;
69
70 /**
71 * RNG to create message IDs
72 */
73 rng_t *rng;
74
75 /**
76 * Exchange we are currently handling as responder
77 */
78 struct {
79 /**
80 * Message ID of the exchange
81 */
82 u_int32_t mid;
83
84 /**
85 * Hash of a previously received message
86 */
87 u_int32_t hash;
88
89 /**
90 * packet for retransmission
91 */
92 packet_t *packet;
93
94 } responding;
95
96 /**
97 * Exchange we are currently handling as initiator
98 */
99 struct {
100 /**
101 * Message ID of the exchange
102 */
103 u_int32_t mid;
104
105 /**
106 * Sequence number of the last sent message
107 */
108 u_int32_t seqnr;
109
110 /**
111 * how many times we have retransmitted so far
112 */
113 u_int retransmitted;
114
115 /**
116 * packet for retransmission
117 */
118 packet_t *packet;
119
120 /**
121 * type of the initated exchange
122 */
123 exchange_type_t type;
124
125 } initiating;
126
127 /**
128 * List of queued tasks not yet in action
129 */
130 linked_list_t *queued_tasks;
131
132 /**
133 * List of active tasks, initiated by ourselve
134 */
135 linked_list_t *active_tasks;
136
137 /**
138 * List of tasks initiated by peer
139 */
140 linked_list_t *passive_tasks;
141
142 /**
143 * Number of times we retransmit messages before giving up
144 */
145 u_int retransmit_tries;
146
147 /**
148 * Retransmission timeout
149 */
150 double retransmit_timeout;
151
152 /**
153 * Base to calculate retransmission timeout
154 */
155 double retransmit_base;
156 };
157
158 /**
159 * flush all tasks in the task manager
160 */
161 static void flush(private_task_manager_t *this)
162 {
163 this->queued_tasks->destroy_offset(this->queued_tasks,
164 offsetof(task_t, destroy));
165 this->queued_tasks = linked_list_create();
166 this->passive_tasks->destroy_offset(this->passive_tasks,
167 offsetof(task_t, destroy));
168 this->passive_tasks = linked_list_create();
169 this->active_tasks->destroy_offset(this->active_tasks,
170 offsetof(task_t, destroy));
171 this->active_tasks = linked_list_create();
172 }
173
174 /**
175 * move a task of a specific type from the queue to the active list
176 */
177 static bool activate_task(private_task_manager_t *this, task_type_t type)
178 {
179 enumerator_t *enumerator;
180 task_t *task;
181 bool found = FALSE;
182
183 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
184 while (enumerator->enumerate(enumerator, (void**)&task))
185 {
186 if (task->get_type(task) == type)
187 {
188 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
189 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
190 this->active_tasks->insert_last(this->active_tasks, task);
191 found = TRUE;
192 break;
193 }
194 }
195 enumerator->destroy(enumerator);
196 return found;
197 }
198
199 METHOD(task_manager_t, retransmit, status_t,
200 private_task_manager_t *this, u_int32_t message_seqnr)
201 {
202 /* this.initiating packet used as marker for received response */
203 if (message_seqnr == this->initiating.seqnr && this->initiating.packet )
204 {
205 u_int32_t timeout;
206 packet_t *packet;
207 job_t *job;
208
209 if (this->initiating.retransmitted <= this->retransmit_tries)
210 {
211 timeout = (u_int32_t)(this->retransmit_timeout * 1000.0 *
212 pow(this->retransmit_base, this->initiating.retransmitted));
213 }
214 else
215 {
216 DBG1(DBG_IKE, "giving up after %d retransmits",
217 this->initiating.retransmitted - 1);
218 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
219 {
220 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
221 }
222 return DESTROY_ME;
223 }
224
225 if (this->initiating.retransmitted)
226 {
227 DBG1(DBG_IKE, "retransmit %d of request with message ID %d seqnr (%d)",
228 this->initiating.retransmitted, this->initiating.mid, message_seqnr);
229 }
230 packet = this->initiating.packet->clone(this->initiating.packet);
231 charon->sender->send(charon->sender, packet);
232
233 this->initiating.retransmitted++;
234 job = (job_t*)retransmit_job_create(this->initiating.seqnr,
235 this->ike_sa->get_id(this->ike_sa));
236 lib->scheduler->schedule_job_ms(lib->scheduler, job, timeout);
237 }
238 return SUCCESS;
239 }
240
241 METHOD(task_manager_t, initiate, status_t,
242 private_task_manager_t *this)
243 {
244 enumerator_t *enumerator;
245 task_t *task;
246 message_t *message;
247 host_t *me, *other;
248 status_t status;
249 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
250 bool new_mid = FALSE;
251 bool expect_response = FALSE;
252
253 if (!this->rng)
254 {
255 DBG1(DBG_IKE, "no RNG supported");
256 return FAILED;
257 }
258
259 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED)
260 {
261 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
262 exchange_type_names, this->initiating.type);
263 /* do not initiate if we already have a message in the air */
264 return SUCCESS;
265 }
266
267 if (this->active_tasks->get_count(this->active_tasks) == 0)
268 {
269 DBG2(DBG_IKE, "activating new tasks");
270 switch (this->ike_sa->get_state(this->ike_sa))
271 {
272 case IKE_CREATED:
273 activate_task(this, TASK_VENDOR_V1);
274 activate_task(this, TASK_IKE_CERT_PRE_V1);
275 if (activate_task(this, TASK_MAIN_MODE))
276 {
277 exchange = ID_PROT;
278 activate_task(this, TASK_IKE_CERT_POST_V1);
279 activate_task(this, TASK_IKE_NATD_V1);
280 }
281 break;
282 case IKE_CONNECTING:
283 if (activate_task(this, TASK_XAUTH))
284 {
285 exchange = TRANSACTION;
286 new_mid = TRUE;
287 }
288 break;
289 case IKE_ESTABLISHED:
290 if (activate_task(this, TASK_QUICK_MODE))
291 {
292 exchange = QUICK_MODE;
293 new_mid = TRUE;
294 break;
295 }
296 break;
297 default:
298 break;
299 }
300 }
301 else
302 {
303 DBG2(DBG_IKE, "reinitiating already active tasks");
304 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
305 while (enumerator->enumerate(enumerator, (void**)&task))
306 {
307 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
308 switch (task->get_type(task))
309 {
310 case TASK_MAIN_MODE:
311 exchange = ID_PROT;
312 break;
313 case TASK_QUICK_MODE:
314 exchange = QUICK_MODE;
315 break;
316 case TASK_XAUTH:
317 exchange = TRANSACTION;
318 new_mid = TRUE;
319 break;
320 default:
321 continue;
322 }
323 break;
324 }
325 enumerator->destroy(enumerator);
326 }
327
328 if (exchange == EXCHANGE_TYPE_UNDEFINED)
329 {
330 DBG2(DBG_IKE, "nothing to initiate");
331 /* nothing to do yet... */
332 return SUCCESS;
333 }
334
335 me = this->ike_sa->get_my_host(this->ike_sa);
336 other = this->ike_sa->get_other_host(this->ike_sa);
337
338 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
339 if (new_mid)
340 {
341 this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
342 (void*)&this->initiating.mid);
343 }
344 message->set_message_id(message, this->initiating.mid);
345 message->set_source(message, me->clone(me));
346 message->set_destination(message, other->clone(other));
347 message->set_exchange_type(message, exchange);
348 this->initiating.type = exchange;
349 this->initiating.retransmitted = 0;
350
351 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
352 while (enumerator->enumerate(enumerator, (void*)&task))
353 {
354 switch (task->build(task, message))
355 {
356 case SUCCESS:
357 /* task completed, remove it */
358 this->active_tasks->remove_at(this->active_tasks, enumerator);
359 task->destroy(task);
360 break;
361 case NEED_MORE:
362 expect_response = TRUE;
363 /* processed, but task needs another exchange */
364 break;
365 case FAILED:
366 default:
367 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
368 {
369 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
370 }
371 /* FALL */
372 case DESTROY_ME:
373 /* critical failure, destroy IKE_SA */
374 enumerator->destroy(enumerator);
375 message->destroy(message);
376 flush(this);
377 return DESTROY_ME;
378 }
379 }
380 enumerator->destroy(enumerator);
381
382 /* update exchange type if a task changed it */
383 this->initiating.type = message->get_exchange_type(message);
384 this->initiating.seqnr++;
385
386 status = this->ike_sa->generate_message(this->ike_sa, message,
387 &this->initiating.packet);
388 if (status != SUCCESS)
389 {
390 /* message generation failed. There is nothing more to do than to
391 * close the SA */
392 message->destroy(message);
393 flush(this);
394 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
395 return DESTROY_ME;
396 }
397 message->destroy(message);
398
399 if (expect_response)
400 {
401 return retransmit(this, this->initiating.seqnr);
402 }
403 else
404 {
405 charon->sender->send(charon->sender,
406 this->initiating.packet->clone(this->initiating.packet));
407
408 this->initiating.packet->destroy(this->initiating.packet);
409 this->initiating.packet = NULL;
410 return SUCCESS;
411 }
412 }
413
414 /**
415 * handle exchange collisions
416 */
417 static bool handle_collisions(private_task_manager_t *this, task_t *task)
418 {
419 return FALSE;
420 }
421
422 /**
423 * build a response depending on the "passive" task list
424 */
425 static status_t build_response(private_task_manager_t *this, message_t *request)
426 {
427 enumerator_t *enumerator;
428 task_t *task;
429 message_t *message;
430 host_t *me, *other;
431 bool delete = FALSE;
432 status_t status;
433
434 me = request->get_destination(request);
435 other = request->get_source(request);
436
437 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
438 message->set_exchange_type(message, request->get_exchange_type(request));
439 /* send response along the path the request came in */
440 message->set_source(message, me->clone(me));
441 message->set_destination(message, other->clone(other));
442 message->set_message_id(message, request->get_message_id(request));
443 message->set_request(message, FALSE);
444
445 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
446 while (enumerator->enumerate(enumerator, (void*)&task))
447 {
448 switch (task->build(task, message))
449 {
450 case SUCCESS:
451 /* task completed, remove it */
452 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
453 if (!handle_collisions(this, task))
454 {
455 task->destroy(task);
456 }
457 break;
458 case NEED_MORE:
459 /* processed, but task needs another exchange */
460 if (handle_collisions(this, task))
461 {
462 this->passive_tasks->remove_at(this->passive_tasks,
463 enumerator);
464 }
465 break;
466 case FAILED:
467 default:
468 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
469 /* FALL */
470 case DESTROY_ME:
471 /* destroy IKE_SA, but SEND response first */
472 delete = TRUE;
473 break;
474 }
475 if (delete)
476 {
477 break;
478 }
479 }
480 enumerator->destroy(enumerator);
481
482 /* message complete, send it */
483 DESTROY_IF(this->responding.packet);
484 this->responding.packet = NULL;
485 status = this->ike_sa->generate_message(this->ike_sa, message,
486 &this->responding.packet);
487 message->destroy(message);
488 if (status != SUCCESS)
489 {
490 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
491 return DESTROY_ME;
492 }
493
494 charon->sender->send(charon->sender,
495 this->responding.packet->clone(this->responding.packet));
496 if (delete)
497 {
498 return DESTROY_ME;
499 }
500 return SUCCESS;
501 }
502
503 /**
504 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
505 */
506 static void send_notify_response(private_task_manager_t *this,
507 message_t *request, notify_type_t type,
508 chunk_t data, task_t *task)
509 {
510 message_t *response;
511 packet_t *packet;
512 host_t *me, *other;
513 u_int32_t mid;
514
515 if (request && request->get_exchange_type(request) == INFORMATIONAL_V1)
516 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
517 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
518 return;
519 }
520
521 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
522 response->set_exchange_type(response, INFORMATIONAL_V1);
523 response->set_request(response, TRUE);
524 this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid);
525 response->set_message_id(response, mid);
526
527 if (task)
528 {
529 /* Let the task build the response */
530 if (task->build(task,response) != SUCCESS)
531 {
532 response->destroy(response);
533 return;
534 }
535 }
536 else
537 {
538 response->add_notify(response, FALSE, type, data);
539 }
540
541 me = this->ike_sa->get_my_host(this->ike_sa);
542 if (me->is_anyaddr(me))
543 {
544 me = request->get_destination(request);
545 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
546 }
547 other = this->ike_sa->get_other_host(this->ike_sa);
548 if (other->is_anyaddr(other))
549 {
550 other = request->get_source(request);
551 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
552 }
553 response->set_source(response, me->clone(me));
554 response->set_destination(response, other->clone(other));
555 if (this->ike_sa->generate_message(this->ike_sa, response,
556 &packet) == SUCCESS)
557 {
558 charon->sender->send(charon->sender, packet);
559 }
560 response->destroy(response);
561 }
562
563 /**
564 * handle an incoming request message
565 */
566 static status_t process_request(private_task_manager_t *this,
567 message_t *message)
568 {
569 enumerator_t *enumerator;
570 task_t *task = NULL;
571 bool send_response = FALSE;
572 payload_t *payload;
573 notify_payload_t *notify;
574
575 if (this->passive_tasks->get_count(this->passive_tasks) == 0)
576 { /* create tasks depending on request type, if not already some queued */
577 switch (message->get_exchange_type(message))
578 {
579 case ID_PROT:
580 task = (task_t *)ike_vendor_v1_create(this->ike_sa, FALSE);
581 this->passive_tasks->insert_last(this->passive_tasks, task);
582 task = (task_t*)ike_cert_pre_v1_create(this->ike_sa, FALSE);
583 this->passive_tasks->insert_last(this->passive_tasks, task);
584 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
585 this->passive_tasks->insert_last(this->passive_tasks, task);
586 task = (task_t*)ike_cert_post_v1_create(this->ike_sa, FALSE);
587 this->passive_tasks->insert_last(this->passive_tasks, task);
588 task = (task_t *)ike_natd_v1_create(this->ike_sa, FALSE);
589 this->passive_tasks->insert_last(this->passive_tasks, task);
590 break;
591 case AGGRESSIVE:
592 /* TODO-IKEv1: agressive mode */
593 return FAILED;
594 case QUICK_MODE:
595 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
596 {
597 DBG1(DBG_IKE, "received quick mode request for "
598 "unestablished IKE_SA, ignored");
599 return FAILED;
600 }
601 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
602 NULL, NULL);
603 this->passive_tasks->insert_last(this->passive_tasks, task);
604 break;
605 case INFORMATIONAL_V1:
606 enumerator = message->create_payload_enumerator(message);
607 while (enumerator->enumerate(enumerator, &payload))
608 {
609 switch (payload->get_type(payload))
610 {
611 case NOTIFY_V1:
612 {
613 notify = (notify_payload_t*)payload;
614 switch (notify->get_notify_type(notify))
615 {
616 /* TODO-IKEv1: Add notification types here as needed */
617 case INITIAL_CONTACT_IKEV1:
618 break;
619 default:
620 if(notify->get_notify_type(notify) < 16384)
621 {
622 DBG1(DBG_IKE, "Received %N error notification.", notify_type_names, notify->get_notify_type(notify));
623 return FAILED;
624 }
625 break;
626 }
627 break;
628 }
629 case DELETE_V1:
630 {
631 delete_payload_t *delete;
632 delete = (delete_payload_t*)payload;
633
634 if (delete->get_protocol_id(delete) == PROTO_IKE)
635 {
636 task = (task_t*)ike_delete_create(this->ike_sa,
637 FALSE);
638 }
639 else
640 {
641 task = (task_t*)child_delete_create(this->ike_sa,
642 PROTO_NONE, 0);
643 }
644 break;
645 }
646 default:
647 break;
648 }
649 if (task)
650 {
651 this->passive_tasks->insert_last(this->passive_tasks, task);
652 }
653 }
654 enumerator->destroy(enumerator);
655 break;
656 case TRANSACTION:
657 task = (task_t *)xauth_create(this->ike_sa, FALSE);
658 this->passive_tasks->insert_last(this->passive_tasks, task);
659 break;
660 default:
661 return FAILED;
662 }
663 }
664 /* let the tasks process the message */
665 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
666 while (enumerator->enumerate(enumerator, (void*)&task))
667 {
668 switch (task->process(task, message))
669 {
670 case SUCCESS:
671 /* task completed, remove it */
672 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
673 task->destroy(task);
674 break;
675 case NEED_MORE:
676 /* processed, but task needs at least another call to build() */
677 send_response = TRUE;
678 break;
679 case FAILED_SEND_ERROR:
680 send_notify_response(this, NULL, 0, chunk_empty, task);
681 case FAILED:
682 default:
683 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
684 /* FALL */
685 case DESTROY_ME:
686 /* critical failure, destroy IKE_SA */
687 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
688 enumerator->destroy(enumerator);
689 task->destroy(task);
690 return DESTROY_ME;
691 }
692 }
693 enumerator->destroy(enumerator);
694
695 if (send_response)
696 {
697 if (build_response(this, message) != SUCCESS)
698 {
699 return DESTROY_ME;
700 }
701 }
702 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
703 this->queued_tasks->get_count(this->queued_tasks) > 0)
704 {
705 /* passive tasks completed, check if an active task has been queued,
706 * such as XAUTH or modeconfig push */
707 return initiate(this);
708 }
709 return SUCCESS;
710 }
711
712 /**
713 * handle an incoming response message
714 */
715 static status_t process_response(private_task_manager_t *this,
716 message_t *message)
717 {
718 enumerator_t *enumerator;
719 task_t *task;
720
721 if (message->get_exchange_type(message) != this->initiating.type)
722 {
723 DBG1(DBG_IKE, "received %N response, but expected %N",
724 exchange_type_names, message->get_exchange_type(message),
725 exchange_type_names, this->initiating.type);
726 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
727 return DESTROY_ME;
728 }
729
730 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
731 while (enumerator->enumerate(enumerator, (void*)&task))
732 {
733 switch (task->process(task, message))
734 {
735 case SUCCESS:
736 /* task completed, remove it */
737 this->active_tasks->remove_at(this->active_tasks, enumerator);
738 task->destroy(task);
739 break;
740 case NEED_MORE:
741 /* processed, but task needs another exchange */
742 break;
743 case FAILED:
744 default:
745 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
746 /* FALL */
747 case DESTROY_ME:
748 /* critical failure, destroy IKE_SA */
749 this->active_tasks->remove_at(this->active_tasks, enumerator);
750 enumerator->destroy(enumerator);
751 task->destroy(task);
752 return DESTROY_ME;
753 }
754 }
755 enumerator->destroy(enumerator);
756
757 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
758 this->initiating.packet->destroy(this->initiating.packet);
759 this->initiating.packet = NULL;
760
761 return initiate(this);
762 }
763
764 /**
765 * Parse the given message and verify that it is valid.
766 */
767 static status_t parse_message(private_task_manager_t *this, message_t *msg)
768 {
769 status_t status;
770
771 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
772
773 if (status != SUCCESS)
774 {
775 switch (status)
776 {
777 case NOT_SUPPORTED:
778 DBG1(DBG_IKE, "unsupported exchange type");
779 send_notify_response(this, msg,
780 INVALID_EXCHANGE_TYPE, chunk_empty, NULL);
781 break;
782 case PARSE_ERROR:
783 DBG1(DBG_IKE, "message parsing failed");
784 send_notify_response(this, msg,
785 PAYLOAD_MALFORMED, chunk_empty, NULL);
786 break;
787 case VERIFY_ERROR:
788 DBG1(DBG_IKE, "message verification failed");
789 send_notify_response(this, msg,
790 PAYLOAD_MALFORMED, chunk_empty, NULL);
791 break;
792 case FAILED:
793 DBG1(DBG_IKE, "integrity check failed");
794 send_notify_response(this, msg,
795 INVALID_HASH_INFORMATION, chunk_empty, NULL);
796 break;
797 case INVALID_STATE:
798 DBG1(DBG_IKE, "found encrypted message, but no keys available");
799 send_notify_response(this, msg,
800 PAYLOAD_MALFORMED, chunk_empty, NULL);
801 default:
802 break;
803 }
804 DBG1(DBG_IKE, "%N %s with message ID %d processing failed",
805 exchange_type_names, msg->get_exchange_type(msg),
806 msg->get_request(msg) ? "request" : "response",
807 msg->get_message_id(msg));
808
809 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
810 { /* invalid initiation attempt, close SA */
811 return DESTROY_ME;
812 }
813 }
814 return status;
815 }
816
817 METHOD(task_manager_t, process_message, status_t,
818 private_task_manager_t *this, message_t *msg)
819 {
820 u_int32_t hash, mid;
821 host_t *me, *other;
822 status_t status;
823
824 /* TODO-IKEv1: update hosts more selectively */
825 me = msg->get_destination(msg);
826 other = msg->get_source(msg);
827 mid = msg->get_message_id(msg);
828
829 if ((mid && mid == this->initiating.mid) ||
830 (this->initiating.mid == 0 &&
831 this->active_tasks->get_count(this->active_tasks)))
832 {
833 msg->set_request(msg, FALSE);
834 status = parse_message(this, msg);
835 if (status != SUCCESS)
836 {
837 return status;
838 }
839 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
840 time_monotonic(NULL));
841 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
842 charon->bus->message(charon->bus, msg, FALSE);
843 if (process_response(this, msg) != SUCCESS)
844 {
845 flush(this);
846 return DESTROY_ME;
847 }
848 }
849 else
850 {
851 hash = chunk_hash(msg->get_packet_data(msg));
852 if (hash == this->responding.hash)
853 {
854 DBG1(DBG_IKE, "received retransmit of request with ID %d, "
855 "retransmitting response", mid);
856 charon->sender->send(charon->sender,
857 this->responding.packet->clone(this->responding.packet));
858 return SUCCESS;
859 }
860 msg->set_request(msg, TRUE);
861 status = parse_message(this, msg);
862 if (status != SUCCESS)
863 {
864 return status;
865 }
866 /* if this IKE_SA is virgin, we check for a config */
867 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
868 {
869 ike_sa_id_t *ike_sa_id;
870 ike_cfg_t *ike_cfg;
871 job_t *job;
872 ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
873 if (ike_cfg == NULL)
874 {
875 /* no config found for these hosts, destroy */
876 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
877 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
878 send_notify_response(this, msg,
879 NO_PROPOSAL_CHOSEN, chunk_empty, NULL);
880 return DESTROY_ME;
881 }
882 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
883 ike_cfg->destroy(ike_cfg);
884 /* add a timeout if peer does not establish it completely */
885 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
886 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
887 lib->scheduler->schedule_job(lib->scheduler, job,
888 lib->settings->get_int(lib->settings,
889 "charon.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT));
890 }
891 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
892 time_monotonic(NULL));
893 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
894 charon->bus->message(charon->bus, msg, TRUE);
895 if (process_request(this, msg) != SUCCESS)
896 {
897 flush(this);
898 return DESTROY_ME;
899 }
900
901 this->responding.mid = mid;
902 this->responding.hash = hash;
903 }
904 return SUCCESS;
905 }
906
907 METHOD(task_manager_t, queue_task, void,
908 private_task_manager_t *this, task_t *task)
909 {
910 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
911 this->queued_tasks->insert_last(this->queued_tasks, task);
912 }
913
914 METHOD(task_manager_t, adopt_tasks, void,
915 private_task_manager_t *this, task_manager_t *other_public)
916 {
917 private_task_manager_t *other = (private_task_manager_t*)other_public;
918 task_t *task;
919
920 /* move queued tasks from other to this */
921 while (other->queued_tasks->remove_last(other->queued_tasks,
922 (void**)&task) == SUCCESS)
923 {
924 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
925 task->migrate(task, this->ike_sa);
926 this->queued_tasks->insert_first(this->queued_tasks, task);
927 }
928 }
929
930 METHOD(task_manager_t, busy, bool,
931 private_task_manager_t *this)
932 {
933 return (this->active_tasks->get_count(this->active_tasks) > 0);
934 }
935
936 METHOD(task_manager_t, incr_mid, void,
937 private_task_manager_t *this, bool initiate)
938 {
939 }
940
941 METHOD(task_manager_t, reset, void,
942 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
943 {
944 }
945
946 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
947 private_task_manager_t *this, task_queue_t queue)
948 {
949 switch (queue)
950 {
951 case TASK_QUEUE_ACTIVE:
952 return this->active_tasks->create_enumerator(this->active_tasks);
953 case TASK_QUEUE_PASSIVE:
954 return this->passive_tasks->create_enumerator(this->passive_tasks);
955 case TASK_QUEUE_QUEUED:
956 return this->queued_tasks->create_enumerator(this->queued_tasks);
957 default:
958 return enumerator_create_empty();
959 }
960 }
961
962 METHOD(task_manager_t, destroy, void,
963 private_task_manager_t *this)
964 {
965 flush(this);
966
967 this->active_tasks->destroy(this->active_tasks);
968 this->queued_tasks->destroy(this->queued_tasks);
969 this->passive_tasks->destroy(this->passive_tasks);
970
971 DESTROY_IF(this->responding.packet);
972 DESTROY_IF(this->initiating.packet);
973 DESTROY_IF(this->rng);
974 free(this);
975 }
976
977 /*
978 * see header file
979 */
980 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
981 {
982 private_task_manager_t *this;
983
984 INIT(this,
985 .public = {
986 .task_manager = {
987 .process_message = _process_message,
988 .queue_task = _queue_task,
989 .initiate = _initiate,
990 .retransmit = _retransmit,
991 .incr_mid = _incr_mid,
992 .reset = _reset,
993 .adopt_tasks = _adopt_tasks,
994 .busy = _busy,
995 .create_task_enumerator = _create_task_enumerator,
996 .destroy = _destroy,
997 },
998 },
999 .ike_sa = ike_sa,
1000 .initiating.type = EXCHANGE_TYPE_UNDEFINED,
1001 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1002 .queued_tasks = linked_list_create(),
1003 .active_tasks = linked_list_create(),
1004 .passive_tasks = linked_list_create(),
1005 .retransmit_tries = lib->settings->get_int(lib->settings,
1006 "charon.retransmit_tries", RETRANSMIT_TRIES),
1007 .retransmit_timeout = lib->settings->get_double(lib->settings,
1008 "charon.retransmit_timeout", RETRANSMIT_TIMEOUT),
1009 .retransmit_base = lib->settings->get_double(lib->settings,
1010 "charon.retransmit_base", RETRANSMIT_BASE),
1011 );
1012
1013 return &this->public;
1014 }