Send delete if Main Mode authentication fails as initiator
[strongswan.git] / src / libcharon / sa / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/tasks/main_mode.h>
23 #include <sa/tasks/quick_mode.h>
24 #include <sa/tasks/xauth.h>
25 #include <sa/tasks/mode_config.h>
26 #include <sa/tasks/informational.h>
27 #include <sa/tasks/ike_natd_v1.h>
28 #include <sa/tasks/ike_vendor_v1.h>
29 #include <sa/tasks/ike_cert_pre_v1.h>
30 #include <sa/tasks/ike_cert_post_v1.h>
31 #include <processing/jobs/retransmit_job.h>
32 #include <processing/jobs/delete_ike_sa_job.h>
33
34 /**
35 * Number of old messages hashes we keep for retransmission.
36 *
37 * In Main Mode, we must ignore messages from a previous message pair if
38 * we already continued to the next. Otherwise a late retransmission
39 * could be considered as a reply to the newer request.
40 */
41 #define MAX_OLD_HASHES 2
42
43 typedef struct exchange_t exchange_t;
44
45 /**
46 * An exchange in the air, used do detect and handle retransmission
47 */
48 struct exchange_t {
49
50 /**
51 * Message ID used for this transaction
52 */
53 u_int32_t mid;
54
55 /**
56 * generated packet for retransmission
57 */
58 packet_t *packet;
59 };
60
61 typedef struct private_task_manager_t private_task_manager_t;
62
63 /**
64 * private data of the task manager
65 */
66 struct private_task_manager_t {
67
68 /**
69 * public functions
70 */
71 task_manager_v1_t public;
72
73 /**
74 * associated IKE_SA we are serving
75 */
76 ike_sa_t *ike_sa;
77
78 /**
79 * RNG to create message IDs
80 */
81 rng_t *rng;
82
83 /**
84 * Exchange we are currently handling as responder
85 */
86 struct {
87 /**
88 * Hash of a previously received message
89 */
90 u_int32_t hash;
91
92 /**
93 * packet for retransmission
94 */
95 packet_t *packet;
96
97 } responding;
98
99 /**
100 * Exchange we are currently handling as initiator
101 */
102 struct {
103 /**
104 * Message ID of the exchange
105 */
106 u_int32_t mid;
107
108 /**
109 * Hashes of old responses we can ignore
110 */
111 u_int32_t old_hashes[MAX_OLD_HASHES];
112
113 /**
114 * Position in old hash array
115 */
116 int old_hash_pos;
117
118 /**
119 * Sequence number of the last sent message
120 */
121 u_int32_t seqnr;
122
123 /**
124 * how many times we have retransmitted so far
125 */
126 u_int retransmitted;
127
128 /**
129 * packet for retransmission
130 */
131 packet_t *packet;
132
133 /**
134 * type of the initated exchange
135 */
136 exchange_type_t type;
137
138 } initiating;
139
140 /**
141 * List of queued tasks not yet in action
142 */
143 linked_list_t *queued_tasks;
144
145 /**
146 * List of active tasks, initiated by ourselve
147 */
148 linked_list_t *active_tasks;
149
150 /**
151 * List of tasks initiated by peer
152 */
153 linked_list_t *passive_tasks;
154
155 /**
156 * Queued messages not yet ready to process
157 */
158 message_t *queued;
159
160 /**
161 * Number of times we retransmit messages before giving up
162 */
163 u_int retransmit_tries;
164
165 /**
166 * Retransmission timeout
167 */
168 double retransmit_timeout;
169
170 /**
171 * Base to calculate retransmission timeout
172 */
173 double retransmit_base;
174 };
175
176 /**
177 * Flush a single task queue
178 */
179 static void flush_queue(private_task_manager_t *this, linked_list_t *list)
180 {
181 task_t *task;
182
183 if (this->queued)
184 {
185 this->queued->destroy(this->queued);
186 this->queued = NULL;
187 }
188 while (list->remove_last(list, (void**)&task) == SUCCESS)
189 {
190 task->destroy(task);
191 }
192 }
193
194 /**
195 * flush all tasks in the task manager
196 */
197 static void flush(private_task_manager_t *this)
198 {
199 flush_queue(this, this->queued_tasks);
200 flush_queue(this, this->passive_tasks);
201 flush_queue(this, this->active_tasks);
202 }
203
204 /**
205 * move a task of a specific type from the queue to the active list
206 */
207 static bool activate_task(private_task_manager_t *this, task_type_t type)
208 {
209 enumerator_t *enumerator;
210 task_t *task;
211 bool found = FALSE;
212
213 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
214 while (enumerator->enumerate(enumerator, (void**)&task))
215 {
216 if (task->get_type(task) == type)
217 {
218 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
219 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
220 this->active_tasks->insert_last(this->active_tasks, task);
221 found = TRUE;
222 break;
223 }
224 }
225 enumerator->destroy(enumerator);
226 return found;
227 }
228
229 METHOD(task_manager_t, retransmit, status_t,
230 private_task_manager_t *this, u_int32_t message_seqnr)
231 {
232 /* this.initiating packet used as marker for received response */
233 if (message_seqnr == this->initiating.seqnr && this->initiating.packet )
234 {
235 u_int32_t timeout;
236 packet_t *packet;
237 job_t *job;
238
239 if (this->initiating.retransmitted <= this->retransmit_tries)
240 {
241 timeout = (u_int32_t)(this->retransmit_timeout * 1000.0 *
242 pow(this->retransmit_base, this->initiating.retransmitted));
243 }
244 else
245 {
246 DBG1(DBG_IKE, "giving up after %d retransmits",
247 this->initiating.retransmitted - 1);
248 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
249 {
250 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
251 }
252 return DESTROY_ME;
253 }
254
255 if (this->initiating.retransmitted)
256 {
257 DBG1(DBG_IKE, "retransmit %d of request with message ID %u seqnr (%d)",
258 this->initiating.retransmitted, this->initiating.mid, message_seqnr);
259 }
260 packet = this->initiating.packet->clone(this->initiating.packet);
261 charon->sender->send(charon->sender, packet);
262
263 this->initiating.retransmitted++;
264 job = (job_t*)retransmit_job_create(this->initiating.seqnr,
265 this->ike_sa->get_id(this->ike_sa));
266 lib->scheduler->schedule_job_ms(lib->scheduler, job, timeout);
267 }
268 return SUCCESS;
269 }
270
271 METHOD(task_manager_t, initiate, status_t,
272 private_task_manager_t *this)
273 {
274 enumerator_t *enumerator;
275 task_t *task;
276 message_t *message;
277 host_t *me, *other;
278 status_t status;
279 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
280 bool new_mid = FALSE;
281 bool expect_response = FALSE;
282
283 if (!this->rng)
284 {
285 DBG1(DBG_IKE, "no RNG supported");
286 return FAILED;
287 }
288
289 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED)
290 {
291 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
292 exchange_type_names, this->initiating.type);
293 /* do not initiate if we already have a message in the air */
294 return SUCCESS;
295 }
296
297 if (this->active_tasks->get_count(this->active_tasks) == 0)
298 {
299 DBG2(DBG_IKE, "activating new tasks");
300 switch (this->ike_sa->get_state(this->ike_sa))
301 {
302 case IKE_CREATED:
303 activate_task(this, TASK_VENDOR_V1);
304 activate_task(this, TASK_IKE_CERT_PRE_V1);
305 if (activate_task(this, TASK_MAIN_MODE))
306 {
307 exchange = ID_PROT;
308 activate_task(this, TASK_IKE_CERT_POST_V1);
309 activate_task(this, TASK_IKE_NATD_V1);
310 }
311 break;
312 case IKE_CONNECTING:
313 if (activate_task(this, TASK_ISAKMP_DELETE))
314 {
315 exchange = INFORMATIONAL_V1;
316 new_mid = TRUE;
317 break;
318 }
319 if (activate_task(this, TASK_XAUTH))
320 {
321 exchange = TRANSACTION;
322 new_mid = TRUE;
323 break;
324 }
325 if (activate_task(this, TASK_INFORMATIONAL))
326 {
327 exchange = INFORMATIONAL_V1;
328 new_mid = TRUE;
329 break;
330 }
331 break;
332 case IKE_ESTABLISHED:
333 if (activate_task(this, TASK_MODE_CONFIG))
334 {
335 exchange = TRANSACTION;
336 new_mid = TRUE;
337 break;
338 }
339 if (activate_task(this, TASK_QUICK_MODE))
340 {
341 exchange = QUICK_MODE;
342 new_mid = TRUE;
343 break;
344 }
345 if (activate_task(this, TASK_INFORMATIONAL))
346 {
347 exchange = INFORMATIONAL_V1;
348 new_mid = TRUE;
349 break;
350 }
351 if (activate_task(this, TASK_ISAKMP_DELETE))
352 {
353 exchange = INFORMATIONAL_V1;
354 new_mid = TRUE;
355 break;
356 }
357 if (activate_task(this, TASK_QUICK_DELETE))
358 {
359 exchange = INFORMATIONAL_V1;
360 new_mid = TRUE;
361 break;
362 }
363 break;
364 default:
365 break;
366 }
367 }
368 else
369 {
370 DBG2(DBG_IKE, "reinitiating already active tasks");
371 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
372 while (enumerator->enumerate(enumerator, (void**)&task))
373 {
374 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
375 switch (task->get_type(task))
376 {
377 case TASK_MAIN_MODE:
378 exchange = ID_PROT;
379 break;
380 case TASK_QUICK_MODE:
381 exchange = QUICK_MODE;
382 break;
383 case TASK_XAUTH:
384 exchange = TRANSACTION;
385 new_mid = TRUE;
386 break;
387 default:
388 continue;
389 }
390 break;
391 }
392 enumerator->destroy(enumerator);
393 }
394
395 if (exchange == EXCHANGE_TYPE_UNDEFINED)
396 {
397 DBG2(DBG_IKE, "nothing to initiate");
398 /* nothing to do yet... */
399 return SUCCESS;
400 }
401
402 me = this->ike_sa->get_my_host(this->ike_sa);
403 other = this->ike_sa->get_other_host(this->ike_sa);
404
405 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
406 if (new_mid)
407 {
408 this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
409 (void*)&this->initiating.mid);
410 }
411 message->set_message_id(message, this->initiating.mid);
412 message->set_source(message, me->clone(me));
413 message->set_destination(message, other->clone(other));
414 message->set_exchange_type(message, exchange);
415 this->initiating.type = exchange;
416 this->initiating.retransmitted = 0;
417
418 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
419 while (enumerator->enumerate(enumerator, (void*)&task))
420 {
421 switch (task->build(task, message))
422 {
423 case SUCCESS:
424 /* task completed, remove it */
425 this->active_tasks->remove_at(this->active_tasks, enumerator);
426 task->destroy(task);
427 continue;
428 case NEED_MORE:
429 expect_response = TRUE;
430 /* processed, but task needs another exchange */
431 continue;
432 case ALREADY_DONE:
433 flush_queue(this, this->active_tasks);
434 break;
435 case FAILED:
436 default:
437 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
438 {
439 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
440 }
441 /* FALL */
442 case DESTROY_ME:
443 /* critical failure, destroy IKE_SA */
444 enumerator->destroy(enumerator);
445 message->destroy(message);
446 flush(this);
447 return DESTROY_ME;
448 }
449 break;
450 }
451 enumerator->destroy(enumerator);
452
453 if (this->active_tasks->get_count(this->active_tasks) == 0)
454 { /* tasks completed, no exchange active anymore */
455 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
456 }
457 this->initiating.seqnr++;
458
459 status = this->ike_sa->generate_message(this->ike_sa, message,
460 &this->initiating.packet);
461 if (status != SUCCESS)
462 {
463 /* message generation failed. There is nothing more to do than to
464 * close the SA */
465 message->destroy(message);
466 flush(this);
467 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
468 return DESTROY_ME;
469 }
470 message->destroy(message);
471
472 if (expect_response)
473 {
474 return retransmit(this, this->initiating.seqnr);
475 }
476 charon->sender->send(charon->sender,
477 this->initiating.packet->clone(this->initiating.packet));
478 this->initiating.packet->destroy(this->initiating.packet);
479 this->initiating.packet = NULL;
480
481 if (exchange == INFORMATIONAL_V1)
482 {
483 switch (this->ike_sa->get_state(this->ike_sa))
484 {
485 case IKE_CONNECTING:
486 /* close after sending an INFORMATIONAL when unestablished */
487 return FAILED;
488 case IKE_DELETING:
489 /* close after sending a DELETE */
490 return DESTROY_ME;
491 default:
492 break;
493 }
494 }
495 return SUCCESS;
496 }
497
498 /**
499 * handle exchange collisions
500 */
501 static bool handle_collisions(private_task_manager_t *this, task_t *task)
502 {
503 return FALSE;
504 }
505
506 /**
507 * build a response depending on the "passive" task list
508 */
509 static status_t build_response(private_task_manager_t *this, message_t *request)
510 {
511 enumerator_t *enumerator;
512 task_t *task;
513 message_t *message;
514 host_t *me, *other;
515 bool delete = FALSE;
516 status_t status;
517
518 me = request->get_destination(request);
519 other = request->get_source(request);
520
521 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
522 message->set_exchange_type(message, request->get_exchange_type(request));
523 /* send response along the path the request came in */
524 message->set_source(message, me->clone(me));
525 message->set_destination(message, other->clone(other));
526 message->set_message_id(message, request->get_message_id(request));
527 message->set_request(message, FALSE);
528
529 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
530 while (enumerator->enumerate(enumerator, (void*)&task))
531 {
532 switch (task->build(task, message))
533 {
534 case SUCCESS:
535 /* task completed, remove it */
536 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
537 if (!handle_collisions(this, task))
538 {
539 task->destroy(task);
540 }
541 continue;
542 case NEED_MORE:
543 /* processed, but task needs another exchange */
544 if (handle_collisions(this, task))
545 {
546 this->passive_tasks->remove_at(this->passive_tasks,
547 enumerator);
548 }
549 continue;
550 case ALREADY_DONE:
551 flush_queue(this, this->passive_tasks);
552 break;
553 case FAILED:
554 default:
555 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
556 /* FALL */
557 case DESTROY_ME:
558 /* destroy IKE_SA, but SEND response first */
559 delete = TRUE;
560 break;
561 }
562 break;
563 }
564 enumerator->destroy(enumerator);
565
566 /* message complete, send it */
567 DESTROY_IF(this->responding.packet);
568 this->responding.packet = NULL;
569 status = this->ike_sa->generate_message(this->ike_sa, message,
570 &this->responding.packet);
571 message->destroy(message);
572 if (status != SUCCESS)
573 {
574 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
575 return DESTROY_ME;
576 }
577
578 charon->sender->send(charon->sender,
579 this->responding.packet->clone(this->responding.packet));
580 if (delete)
581 {
582 return DESTROY_ME;
583 }
584 return SUCCESS;
585 }
586
587 /**
588 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
589 * The notify protocol_id is set to ISAKMP
590 */
591 static void send_notify(private_task_manager_t *this, message_t *request,
592 notify_type_t type)
593 {
594 message_t *response;
595 packet_t *packet;
596 host_t *me, *other;
597 u_int32_t mid;
598
599 if (request && request->get_exchange_type(request) == INFORMATIONAL_V1)
600 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
601 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
602 return;
603 }
604
605 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
606 response->set_exchange_type(response, INFORMATIONAL_V1);
607 response->set_request(response, TRUE);
608 this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid);
609 response->set_message_id(response, mid);
610 response->add_payload(response, (payload_t*)
611 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
612 PROTO_IKE, type));
613
614 me = this->ike_sa->get_my_host(this->ike_sa);
615 if (me->is_anyaddr(me))
616 {
617 me = request->get_destination(request);
618 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
619 }
620 other = this->ike_sa->get_other_host(this->ike_sa);
621 if (other->is_anyaddr(other))
622 {
623 other = request->get_source(request);
624 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
625 }
626 response->set_source(response, me->clone(me));
627 response->set_destination(response, other->clone(other));
628 if (this->ike_sa->generate_message(this->ike_sa, response,
629 &packet) == SUCCESS)
630 {
631 charon->sender->send(charon->sender, packet);
632 }
633 response->destroy(response);
634 }
635
636 /**
637 * handle an incoming request message
638 */
639 static status_t process_request(private_task_manager_t *this,
640 message_t *message)
641 {
642 enumerator_t *enumerator;
643 task_t *task = NULL;
644 bool send_response = FALSE;
645
646 if (this->passive_tasks->get_count(this->passive_tasks) == 0)
647 { /* create tasks depending on request type, if not already some queued */
648 switch (message->get_exchange_type(message))
649 {
650 case ID_PROT:
651 task = (task_t *)ike_vendor_v1_create(this->ike_sa, FALSE);
652 this->passive_tasks->insert_last(this->passive_tasks, task);
653 task = (task_t*)ike_cert_pre_v1_create(this->ike_sa, FALSE);
654 this->passive_tasks->insert_last(this->passive_tasks, task);
655 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
656 this->passive_tasks->insert_last(this->passive_tasks, task);
657 task = (task_t*)ike_cert_post_v1_create(this->ike_sa, FALSE);
658 this->passive_tasks->insert_last(this->passive_tasks, task);
659 task = (task_t *)ike_natd_v1_create(this->ike_sa, FALSE);
660 this->passive_tasks->insert_last(this->passive_tasks, task);
661 break;
662 case AGGRESSIVE:
663 /* TODO-IKEv1: agressive mode */
664 return FAILED;
665 case QUICK_MODE:
666 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
667 {
668 DBG1(DBG_IKE, "received quick mode request for "
669 "unestablished IKE_SA, ignored");
670 return FAILED;
671 }
672 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
673 NULL, NULL);
674 this->passive_tasks->insert_last(this->passive_tasks, task);
675 break;
676 case INFORMATIONAL_V1:
677 task = (task_t *)informational_create(this->ike_sa, NULL);
678 this->passive_tasks->insert_last(this->passive_tasks, task);
679 break;
680 case TRANSACTION:
681 if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
682 {
683 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
684 }
685 else
686 {
687 task = (task_t *)xauth_create(this->ike_sa, FALSE);
688 }
689 this->passive_tasks->insert_last(this->passive_tasks, task);
690 break;
691 default:
692 return FAILED;
693 }
694 }
695 /* let the tasks process the message */
696 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
697 while (enumerator->enumerate(enumerator, (void*)&task))
698 {
699 switch (task->process(task, message))
700 {
701 case SUCCESS:
702 /* task completed, remove it */
703 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
704 task->destroy(task);
705 continue;
706 case NEED_MORE:
707 /* processed, but task needs at least another call to build() */
708 send_response = TRUE;
709 continue;
710 case ALREADY_DONE:
711 send_response = FALSE;
712 flush_queue(this, this->passive_tasks);
713 break;
714 case FAILED:
715 default:
716 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
717 /* FALL */
718 case DESTROY_ME:
719 /* critical failure, destroy IKE_SA */
720 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
721 enumerator->destroy(enumerator);
722 task->destroy(task);
723 return DESTROY_ME;
724 }
725 break;
726 }
727 enumerator->destroy(enumerator);
728
729 if (send_response)
730 {
731 if (build_response(this, message) != SUCCESS)
732 {
733 return DESTROY_ME;
734 }
735 }
736 else
737 { /* We don't send a response, so don't retransmit one if we get
738 * the same message again. */
739 DESTROY_IF(this->responding.packet);
740 this->responding.packet = NULL;
741 }
742 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
743 this->queued_tasks->get_count(this->queued_tasks) > 0)
744 {
745 /* passive tasks completed, check if an active task has been queued,
746 * such as XAUTH or modeconfig push */
747 return initiate(this);
748 }
749 return SUCCESS;
750 }
751
752 /**
753 * handle an incoming response message
754 */
755 static status_t process_response(private_task_manager_t *this,
756 message_t *message)
757 {
758 enumerator_t *enumerator;
759 status_t status;
760 task_t *task;
761
762 if (message->get_exchange_type(message) != this->initiating.type)
763 {
764 DBG1(DBG_IKE, "received %N response, but expected %N",
765 exchange_type_names, message->get_exchange_type(message),
766 exchange_type_names, this->initiating.type);
767 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
768 return DESTROY_ME;
769 }
770
771 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
772 while (enumerator->enumerate(enumerator, (void*)&task))
773 {
774 switch (task->process(task, message))
775 {
776 case SUCCESS:
777 /* task completed, remove it */
778 this->active_tasks->remove_at(this->active_tasks, enumerator);
779 task->destroy(task);
780 continue;
781 case NEED_MORE:
782 /* processed, but task needs another exchange */
783 continue;
784 case ALREADY_DONE:
785 flush_queue(this, this->active_tasks);
786 break;
787 case FAILED:
788 default:
789 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
790 /* FALL */
791 case DESTROY_ME:
792 /* critical failure, destroy IKE_SA */
793 this->active_tasks->remove_at(this->active_tasks, enumerator);
794 enumerator->destroy(enumerator);
795 task->destroy(task);
796 return DESTROY_ME;
797 }
798 break;
799 }
800 enumerator->destroy(enumerator);
801
802 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
803 this->initiating.packet->destroy(this->initiating.packet);
804 this->initiating.packet = NULL;
805
806 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
807 {
808 status = this->public.task_manager.process_message(
809 &this->public.task_manager, this->queued);
810 this->queued->destroy(this->queued);
811 this->queued = NULL;
812 if (status == DESTROY_ME)
813 {
814 return status;
815 }
816 }
817
818 return initiate(this);
819 }
820
821 /**
822 * Parse the given message and verify that it is valid.
823 */
824 static status_t parse_message(private_task_manager_t *this, message_t *msg)
825 {
826 status_t status;
827
828 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
829
830 if (status != SUCCESS)
831 {
832 switch (status)
833 {
834 case NOT_SUPPORTED:
835 DBG1(DBG_IKE, "unsupported exchange type");
836 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
837 break;
838 case PARSE_ERROR:
839 DBG1(DBG_IKE, "message parsing failed");
840 send_notify(this, msg, PAYLOAD_MALFORMED);
841 break;
842 case VERIFY_ERROR:
843 DBG1(DBG_IKE, "message verification failed");
844 send_notify(this, msg, PAYLOAD_MALFORMED);
845 break;
846 case FAILED:
847 DBG1(DBG_IKE, "integrity check failed");
848 send_notify(this, msg, INVALID_HASH_INFORMATION);
849 break;
850 case INVALID_STATE:
851 DBG1(DBG_IKE, "found encrypted message, but no keys available");
852 send_notify(this, msg, PAYLOAD_MALFORMED);
853 default:
854 break;
855 }
856 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
857 exchange_type_names, msg->get_exchange_type(msg),
858 msg->get_request(msg) ? "request" : "response",
859 msg->get_message_id(msg));
860
861 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
862 { /* invalid initiation attempt, close SA */
863 return DESTROY_ME;
864 }
865 }
866 return status;
867 }
868
869 METHOD(task_manager_t, process_message, status_t,
870 private_task_manager_t *this, message_t *msg)
871 {
872 u_int32_t hash, mid, i;
873 host_t *me, *other;
874 status_t status;
875
876 /* TODO-IKEv1: update hosts more selectively */
877 me = msg->get_destination(msg);
878 other = msg->get_source(msg);
879 mid = msg->get_message_id(msg);
880 hash = chunk_hash(msg->get_packet_data(msg));
881 for (i = 0; i < MAX_OLD_HASHES; i++)
882 {
883 if (this->initiating.old_hashes[i] == hash)
884 {
885 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
886 "but next request already sent", mid);
887 return SUCCESS;
888 }
889 }
890
891 if ((mid && mid == this->initiating.mid) ||
892 (this->initiating.mid == 0 &&
893 msg->get_exchange_type(msg) == this->initiating.type &&
894 this->active_tasks->get_count(this->active_tasks)))
895 {
896 msg->set_request(msg, FALSE);
897 status = parse_message(this, msg);
898 if (status != SUCCESS)
899 {
900 return status;
901 }
902 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
903 time_monotonic(NULL));
904 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
905 charon->bus->message(charon->bus, msg, FALSE);
906 if (process_response(this, msg) != SUCCESS)
907 {
908 flush(this);
909 return DESTROY_ME;
910 }
911 this->initiating.old_hashes[(this->initiating.old_hash_pos++) %
912 MAX_OLD_HASHES] = hash;
913 }
914 else
915 {
916 if (hash == this->responding.hash)
917 {
918 if (this->responding.packet)
919 {
920 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
921 "retransmitting response", mid);
922 charon->sender->send(charon->sender,
923 this->responding.packet->clone(this->responding.packet));
924 }
925 else
926 {
927 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
928 "but no response to retransmit", mid);
929 }
930 return SUCCESS;
931 }
932 if (msg->get_exchange_type(msg) == TRANSACTION &&
933 this->active_tasks->get_count(this->active_tasks))
934 { /* main mode not yet complete, queue XAuth/Mode config tasks */
935 if (this->queued)
936 {
937 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
938 exchange_type_names, TRANSACTION);
939 return SUCCESS;
940 }
941 this->queued = message_create_from_packet(msg->get_packet(msg));
942 if (this->queued->parse_header(this->queued) != SUCCESS)
943 {
944 this->queued->destroy(this->queued);
945 this->queued = NULL;
946 return FAILED;
947 }
948 DBG1(DBG_IKE, "queueing %N request as tasks still active",
949 exchange_type_names, TRANSACTION);
950 return SUCCESS;
951 }
952
953 msg->set_request(msg, TRUE);
954 status = parse_message(this, msg);
955 if (status != SUCCESS)
956 {
957 return status;
958 }
959 /* if this IKE_SA is virgin, we check for a config */
960 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
961 {
962 ike_sa_id_t *ike_sa_id;
963 ike_cfg_t *ike_cfg;
964 job_t *job;
965 ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
966 if (ike_cfg == NULL)
967 {
968 /* no config found for these hosts, destroy */
969 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
970 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
971 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
972 return DESTROY_ME;
973 }
974 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
975 ike_cfg->destroy(ike_cfg);
976 /* add a timeout if peer does not establish it completely */
977 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
978 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
979 lib->scheduler->schedule_job(lib->scheduler, job,
980 lib->settings->get_int(lib->settings,
981 "charon.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT));
982 }
983 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
984 time_monotonic(NULL));
985 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
986 charon->bus->message(charon->bus, msg, TRUE);
987 if (process_request(this, msg) != SUCCESS)
988 {
989 flush(this);
990 return DESTROY_ME;
991 }
992 this->responding.hash = hash;
993 }
994 return SUCCESS;
995 }
996
997 METHOD(task_manager_t, queue_task, void,
998 private_task_manager_t *this, task_t *task)
999 {
1000 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1001 this->queued_tasks->insert_last(this->queued_tasks, task);
1002 }
1003
1004 METHOD(task_manager_t, adopt_tasks, void,
1005 private_task_manager_t *this, task_manager_t *other_public)
1006 {
1007 private_task_manager_t *other = (private_task_manager_t*)other_public;
1008 task_t *task;
1009
1010 /* move queued tasks from other to this */
1011 while (other->queued_tasks->remove_last(other->queued_tasks,
1012 (void**)&task) == SUCCESS)
1013 {
1014 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1015 task->migrate(task, this->ike_sa);
1016 this->queued_tasks->insert_first(this->queued_tasks, task);
1017 }
1018 }
1019
1020 METHOD(task_manager_t, busy, bool,
1021 private_task_manager_t *this)
1022 {
1023 return (this->active_tasks->get_count(this->active_tasks) > 0);
1024 }
1025
1026 METHOD(task_manager_t, incr_mid, void,
1027 private_task_manager_t *this, bool initiate)
1028 {
1029 }
1030
1031 METHOD(task_manager_t, reset, void,
1032 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1033 {
1034 }
1035
1036 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1037 private_task_manager_t *this, task_queue_t queue)
1038 {
1039 switch (queue)
1040 {
1041 case TASK_QUEUE_ACTIVE:
1042 return this->active_tasks->create_enumerator(this->active_tasks);
1043 case TASK_QUEUE_PASSIVE:
1044 return this->passive_tasks->create_enumerator(this->passive_tasks);
1045 case TASK_QUEUE_QUEUED:
1046 return this->queued_tasks->create_enumerator(this->queued_tasks);
1047 default:
1048 return enumerator_create_empty();
1049 }
1050 }
1051
1052 METHOD(task_manager_t, destroy, void,
1053 private_task_manager_t *this)
1054 {
1055 flush(this);
1056
1057 this->active_tasks->destroy(this->active_tasks);
1058 this->queued_tasks->destroy(this->queued_tasks);
1059 this->passive_tasks->destroy(this->passive_tasks);
1060
1061 DESTROY_IF(this->queued);
1062 DESTROY_IF(this->responding.packet);
1063 DESTROY_IF(this->initiating.packet);
1064 DESTROY_IF(this->rng);
1065 free(this);
1066 }
1067
1068 /*
1069 * see header file
1070 */
1071 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1072 {
1073 private_task_manager_t *this;
1074
1075 INIT(this,
1076 .public = {
1077 .task_manager = {
1078 .process_message = _process_message,
1079 .queue_task = _queue_task,
1080 .initiate = _initiate,
1081 .retransmit = _retransmit,
1082 .incr_mid = _incr_mid,
1083 .reset = _reset,
1084 .adopt_tasks = _adopt_tasks,
1085 .busy = _busy,
1086 .create_task_enumerator = _create_task_enumerator,
1087 .destroy = _destroy,
1088 },
1089 },
1090 .ike_sa = ike_sa,
1091 .initiating.type = EXCHANGE_TYPE_UNDEFINED,
1092 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1093 .queued_tasks = linked_list_create(),
1094 .active_tasks = linked_list_create(),
1095 .passive_tasks = linked_list_create(),
1096 .retransmit_tries = lib->settings->get_int(lib->settings,
1097 "charon.retransmit_tries", RETRANSMIT_TRIES),
1098 .retransmit_timeout = lib->settings->get_double(lib->settings,
1099 "charon.retransmit_timeout", RETRANSMIT_TIMEOUT),
1100 .retransmit_base = lib->settings->get_double(lib->settings,
1101 "charon.retransmit_base", RETRANSMIT_BASE),
1102 );
1103
1104 return &this->public;
1105 }