corrected naming of tnccs_reason_strings_msg_t object
[strongswan.git] / src / libcharon / sa / tasks / ike_rekey.c
1 /*
2 * Copyright (C) 2005-2008 Martin Willi
3 * Copyright (C) 2005 Jan Hutter
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "ike_rekey.h"
18
19 #include <daemon.h>
20 #include <encoding/payloads/notify_payload.h>
21 #include <sa/tasks/ike_init.h>
22 #include <sa/tasks/ike_delete.h>
23 #include <processing/jobs/delete_ike_sa_job.h>
24 #include <processing/jobs/rekey_ike_sa_job.h>
25
26
27 typedef struct private_ike_rekey_t private_ike_rekey_t;
28
29 /**
30 * Private members of a ike_rekey_t task.
31 */
32 struct private_ike_rekey_t {
33
34 /**
35 * Public methods and task_t interface.
36 */
37 ike_rekey_t public;
38
39 /**
40 * Assigned IKE_SA.
41 */
42 ike_sa_t *ike_sa;
43
44 /**
45 * New IKE_SA which replaces the current one
46 */
47 ike_sa_t *new_sa;
48
49 /**
50 * Are we the initiator?
51 */
52 bool initiator;
53
54 /**
55 * the IKE_INIT task which is reused to simplify rekeying
56 */
57 ike_init_t *ike_init;
58
59 /**
60 * IKE_DELETE task to delete the old IKE_SA after rekeying was successful
61 */
62 ike_delete_t *ike_delete;
63
64 /**
65 * colliding task detected by the task manager
66 */
67 task_t *collision;
68 };
69
70 /**
71 * Implementation of task_t.build for initiator, after rekeying
72 */
73 static status_t build_i_delete(private_ike_rekey_t *this, message_t *message)
74 {
75 /* update exchange type to INFORMATIONAL for the delete */
76 message->set_exchange_type(message, INFORMATIONAL);
77
78 return this->ike_delete->task.build(&this->ike_delete->task, message);
79 }
80
81 /**
82 * Implementation of task_t.process for initiator, after rekeying
83 */
84 static status_t process_i_delete(private_ike_rekey_t *this, message_t *message)
85 {
86 return this->ike_delete->task.process(&this->ike_delete->task, message);
87 }
88
89 /**
90 * Implementation of task_t.build for initiator
91 */
92 static status_t build_i(private_ike_rekey_t *this, message_t *message)
93 {
94 peer_cfg_t *peer_cfg;
95 host_t *other_host;
96
97 /* create new SA only on first try */
98 if (this->new_sa == NULL)
99 {
100 this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
101 TRUE);
102
103 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
104 other_host = this->ike_sa->get_other_host(this->ike_sa);
105 this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
106 this->new_sa->set_other_host(this->new_sa, other_host->clone(other_host));
107 this->ike_init = ike_init_create(this->new_sa, TRUE, this->ike_sa);
108 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
109 }
110 this->ike_init->task.build(&this->ike_init->task, message);
111
112 return NEED_MORE;
113 }
114
115 /**
116 * Implementation of task_t.process for responder
117 */
118 static status_t process_r(private_ike_rekey_t *this, message_t *message)
119 {
120 peer_cfg_t *peer_cfg;
121 iterator_t *iterator;
122 child_sa_t *child_sa;
123
124 if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
125 {
126 DBG1(DBG_IKE, "peer initiated rekeying, but we are deleting");
127 return NEED_MORE;
128 }
129
130 iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa);
131 while (iterator->iterate(iterator, (void**)&child_sa))
132 {
133 switch (child_sa->get_state(child_sa))
134 {
135 case CHILD_CREATED:
136 case CHILD_REKEYING:
137 case CHILD_DELETING:
138 /* we do not allow rekeying while we have children in-progress */
139 DBG1(DBG_IKE, "peer initiated rekeying, but a child is half-open");
140 iterator->destroy(iterator);
141 return NEED_MORE;
142 default:
143 break;
144 }
145 }
146 iterator->destroy(iterator);
147
148 this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
149 FALSE);
150
151 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
152 this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
153 this->ike_init = ike_init_create(this->new_sa, FALSE, this->ike_sa);
154 this->ike_init->task.process(&this->ike_init->task, message);
155
156 return NEED_MORE;
157 }
158
159 /**
160 * Implementation of task_t.build for responder
161 */
162 static status_t build_r(private_ike_rekey_t *this, message_t *message)
163 {
164 if (this->new_sa == NULL)
165 {
166 /* IKE_SA/a CHILD_SA is in an inacceptable state, deny rekeying */
167 message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
168 return SUCCESS;
169 }
170
171 if (this->ike_init->task.build(&this->ike_init->task, message) == FAILED)
172 {
173 return SUCCESS;
174 }
175
176 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
177 this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
178 DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
179 this->new_sa->get_name(this->new_sa),
180 this->new_sa->get_unique_id(this->new_sa),
181 this->ike_sa->get_my_host(this->ike_sa),
182 this->ike_sa->get_my_id(this->ike_sa),
183 this->ike_sa->get_other_host(this->ike_sa),
184 this->ike_sa->get_other_id(this->ike_sa));
185
186 return SUCCESS;
187 }
188
189 /**
190 * Implementation of task_t.process for initiator
191 */
192 static status_t process_i(private_ike_rekey_t *this, message_t *message)
193 {
194 if (message->get_notify(message, NO_ADDITIONAL_SAS))
195 {
196 DBG1(DBG_IKE, "peer seems to not support IKE rekeying, "
197 "starting reauthentication");
198 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
199 lib->processor->queue_job(lib->processor,
200 (job_t*)rekey_ike_sa_job_create(
201 this->ike_sa->get_id(this->ike_sa), TRUE));
202 return SUCCESS;
203 }
204
205 switch (this->ike_init->task.process(&this->ike_init->task, message))
206 {
207 case FAILED:
208 /* rekeying failed, fallback to old SA */
209 if (!(this->collision && (
210 this->collision->get_type(this->collision) == IKE_DELETE ||
211 this->collision->get_type(this->collision) == IKE_REAUTH)))
212 {
213 job_t *job;
214 u_int32_t retry = RETRY_INTERVAL - (random() % RETRY_JITTER);
215 job = (job_t*)rekey_ike_sa_job_create(
216 this->ike_sa->get_id(this->ike_sa), FALSE);
217 DBG1(DBG_IKE, "IKE_SA rekeying failed, "
218 "trying again in %d seconds", retry);
219 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
220 lib->scheduler->schedule_job(lib->scheduler, job, retry);
221 }
222 return SUCCESS;
223 case NEED_MORE:
224 /* bad dh group, try again */
225 this->ike_init->task.migrate(&this->ike_init->task, this->new_sa);
226 return NEED_MORE;
227 default:
228 break;
229 }
230
231 this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
232 DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
233 this->new_sa->get_name(this->new_sa),
234 this->new_sa->get_unique_id(this->new_sa),
235 this->ike_sa->get_my_host(this->ike_sa),
236 this->ike_sa->get_my_id(this->ike_sa),
237 this->ike_sa->get_other_host(this->ike_sa),
238 this->ike_sa->get_other_id(this->ike_sa));
239
240 /* check for collisions */
241 if (this->collision &&
242 this->collision->get_type(this->collision) == IKE_REKEY)
243 {
244 private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision;
245
246 /* ike_init can be NULL, if child_sa is half-open */
247 if (other->ike_init)
248 {
249 host_t *host;
250 chunk_t this_nonce, other_nonce;
251
252 this_nonce = this->ike_init->get_lower_nonce(this->ike_init);
253 other_nonce = other->ike_init->get_lower_nonce(other->ike_init);
254
255 /* if we have the lower nonce, delete rekeyed SA. If not, delete
256 * the redundant. */
257 if (memcmp(this_nonce.ptr, other_nonce.ptr,
258 min(this_nonce.len, other_nonce.len)) < 0)
259 {
260 /* peer should delete this SA. Add a timeout just in case. */
261 job_t *job = (job_t*)delete_ike_sa_job_create(
262 other->new_sa->get_id(other->new_sa), TRUE);
263 lib->scheduler->schedule_job(lib->scheduler, job, 10);
264 DBG1(DBG_IKE, "IKE_SA rekey collision won, deleting rekeyed IKE_SA");
265 charon->ike_sa_manager->checkin(charon->ike_sa_manager, other->new_sa);
266 other->new_sa = NULL;
267 }
268 else
269 {
270 DBG1(DBG_IKE, "IKE_SA rekey collision lost, deleting redundant IKE_SA");
271 /* apply host for a proper delete */
272 host = this->ike_sa->get_my_host(this->ike_sa);
273 this->new_sa->set_my_host(this->new_sa, host->clone(host));
274 host = this->ike_sa->get_other_host(this->ike_sa);
275 this->new_sa->set_other_host(this->new_sa, host->clone(host));
276 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
277 if (this->new_sa->delete(this->new_sa) == DESTROY_ME)
278 {
279 charon->ike_sa_manager->checkin_and_destroy(
280 charon->ike_sa_manager, this->new_sa);
281 }
282 else
283 {
284 charon->ike_sa_manager->checkin(
285 charon->ike_sa_manager, this->new_sa);
286 }
287 /* set threads active IKE_SA after checkin */
288 charon->bus->set_sa(charon->bus, this->ike_sa);
289 /* inherit to other->new_sa in destroy() */
290 this->new_sa = other->new_sa;
291 other->new_sa = NULL;
292 return SUCCESS;
293 }
294 }
295 /* set threads active IKE_SA after checkin */
296 charon->bus->set_sa(charon->bus, this->ike_sa);
297 }
298
299 /* rekeying successful, delete the IKE_SA using a subtask */
300 this->ike_delete = ike_delete_create(this->ike_sa, TRUE);
301 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i_delete;
302 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i_delete;
303
304 return NEED_MORE;
305 }
306
307 /**
308 * Implementation of task_t.get_type
309 */
310 static task_type_t get_type(private_ike_rekey_t *this)
311 {
312 return IKE_REKEY;
313 }
314
315 static void collide(private_ike_rekey_t* this, task_t *other)
316 {
317 DESTROY_IF(this->collision);
318 this->collision = other;
319 }
320
321 /**
322 * Implementation of task_t.migrate
323 */
324 static void migrate(private_ike_rekey_t *this, ike_sa_t *ike_sa)
325 {
326 if (this->ike_init)
327 {
328 this->ike_init->task.destroy(&this->ike_init->task);
329 }
330 if (this->ike_delete)
331 {
332 this->ike_delete->task.destroy(&this->ike_delete->task);
333 }
334 if (this->new_sa)
335 {
336 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
337 this->new_sa);
338 /* set threads active IKE_SA after checkin */
339 charon->bus->set_sa(charon->bus, this->ike_sa);
340 }
341 DESTROY_IF(this->collision);
342
343 this->collision = NULL;
344 this->ike_sa = ike_sa;
345 this->new_sa = NULL;
346 this->ike_init = NULL;
347 this->ike_delete = NULL;
348 }
349
350 /**
351 * Implementation of task_t.destroy
352 */
353 static void destroy(private_ike_rekey_t *this)
354 {
355 if (this->new_sa)
356 {
357 if (this->new_sa->get_state(this->new_sa) == IKE_ESTABLISHED &&
358 this->new_sa->inherit(this->new_sa, this->ike_sa) != DESTROY_ME)
359 {
360 /* invoke hook if rekeying was successful */
361 charon->bus->ike_rekey(charon->bus, this->ike_sa, this->new_sa);
362 charon->ike_sa_manager->checkin(charon->ike_sa_manager, this->new_sa);
363 }
364 else
365 {
366 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
367 this->new_sa);
368 }
369 /* set threads active IKE_SA after checkin */
370 charon->bus->set_sa(charon->bus, this->ike_sa);
371 }
372 if (this->ike_init)
373 {
374 this->ike_init->task.destroy(&this->ike_init->task);
375 }
376 if (this->ike_delete)
377 {
378 this->ike_delete->task.destroy(&this->ike_delete->task);
379 }
380 DESTROY_IF(this->collision);
381 free(this);
382 }
383
384 /*
385 * Described in header.
386 */
387 ike_rekey_t *ike_rekey_create(ike_sa_t *ike_sa, bool initiator)
388 {
389 private_ike_rekey_t *this = malloc_thing(private_ike_rekey_t);
390
391 this->public.collide = (void(*)(ike_rekey_t*,task_t*))collide;
392 this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
393 this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
394 this->public.task.destroy = (void(*)(task_t*))destroy;
395 if (initiator)
396 {
397 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
398 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
399 }
400 else
401 {
402 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
403 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
404 }
405
406 this->ike_sa = ike_sa;
407 this->new_sa = NULL;
408 this->ike_init = NULL;
409 this->ike_delete = NULL;
410 this->initiator = initiator;
411 this->collision = NULL;
412
413 return &this->public;
414 }