Refer to scheduler via hydra and not charon.
[strongswan.git] / src / libcharon / sa / tasks / ike_rekey.c
1 /*
2 * Copyright (C) 2005-2008 Martin Willi
3 * Copyright (C) 2005 Jan Hutter
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "ike_rekey.h"
18
19 #include <hydra.h>
20 #include <daemon.h>
21 #include <encoding/payloads/notify_payload.h>
22 #include <sa/tasks/ike_init.h>
23 #include <sa/tasks/ike_delete.h>
24 #include <processing/jobs/delete_ike_sa_job.h>
25 #include <processing/jobs/rekey_ike_sa_job.h>
26
27
28 typedef struct private_ike_rekey_t private_ike_rekey_t;
29
30 /**
31 * Private members of a ike_rekey_t task.
32 */
33 struct private_ike_rekey_t {
34
35 /**
36 * Public methods and task_t interface.
37 */
38 ike_rekey_t public;
39
40 /**
41 * Assigned IKE_SA.
42 */
43 ike_sa_t *ike_sa;
44
45 /**
46 * New IKE_SA which replaces the current one
47 */
48 ike_sa_t *new_sa;
49
50 /**
51 * Are we the initiator?
52 */
53 bool initiator;
54
55 /**
56 * the IKE_INIT task which is reused to simplify rekeying
57 */
58 ike_init_t *ike_init;
59
60 /**
61 * IKE_DELETE task to delete the old IKE_SA after rekeying was successful
62 */
63 ike_delete_t *ike_delete;
64
65 /**
66 * colliding task detected by the task manager
67 */
68 task_t *collision;
69 };
70
71 /**
72 * Implementation of task_t.build for initiator, after rekeying
73 */
74 static status_t build_i_delete(private_ike_rekey_t *this, message_t *message)
75 {
76 /* update exchange type to INFORMATIONAL for the delete */
77 message->set_exchange_type(message, INFORMATIONAL);
78
79 return this->ike_delete->task.build(&this->ike_delete->task, message);
80 }
81
82 /**
83 * Implementation of task_t.process for initiator, after rekeying
84 */
85 static status_t process_i_delete(private_ike_rekey_t *this, message_t *message)
86 {
87 return this->ike_delete->task.process(&this->ike_delete->task, message);
88 }
89
90 /**
91 * Implementation of task_t.build for initiator
92 */
93 static status_t build_i(private_ike_rekey_t *this, message_t *message)
94 {
95 peer_cfg_t *peer_cfg;
96 host_t *other_host;
97
98 /* create new SA only on first try */
99 if (this->new_sa == NULL)
100 {
101 this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
102 TRUE);
103
104 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
105 other_host = this->ike_sa->get_other_host(this->ike_sa);
106 this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
107 this->new_sa->set_other_host(this->new_sa, other_host->clone(other_host));
108 this->ike_init = ike_init_create(this->new_sa, TRUE, this->ike_sa);
109 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
110 }
111 this->ike_init->task.build(&this->ike_init->task, message);
112
113 return NEED_MORE;
114 }
115
116 /**
117 * Implementation of task_t.process for responder
118 */
119 static status_t process_r(private_ike_rekey_t *this, message_t *message)
120 {
121 peer_cfg_t *peer_cfg;
122 iterator_t *iterator;
123 child_sa_t *child_sa;
124
125 if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
126 {
127 DBG1(DBG_IKE, "peer initiated rekeying, but we are deleting");
128 return NEED_MORE;
129 }
130
131 iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa);
132 while (iterator->iterate(iterator, (void**)&child_sa))
133 {
134 switch (child_sa->get_state(child_sa))
135 {
136 case CHILD_CREATED:
137 case CHILD_REKEYING:
138 case CHILD_DELETING:
139 /* we do not allow rekeying while we have children in-progress */
140 DBG1(DBG_IKE, "peer initiated rekeying, but a child is half-open");
141 iterator->destroy(iterator);
142 return NEED_MORE;
143 default:
144 break;
145 }
146 }
147 iterator->destroy(iterator);
148
149 this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
150 FALSE);
151
152 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
153 this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
154 this->ike_init = ike_init_create(this->new_sa, FALSE, this->ike_sa);
155 this->ike_init->task.process(&this->ike_init->task, message);
156
157 return NEED_MORE;
158 }
159
160 /**
161 * Implementation of task_t.build for responder
162 */
163 static status_t build_r(private_ike_rekey_t *this, message_t *message)
164 {
165 if (this->new_sa == NULL)
166 {
167 /* IKE_SA/a CHILD_SA is in an inacceptable state, deny rekeying */
168 message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
169 return SUCCESS;
170 }
171
172 if (this->ike_init->task.build(&this->ike_init->task, message) == FAILED)
173 {
174 return SUCCESS;
175 }
176
177 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
178 this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
179 DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
180 this->new_sa->get_name(this->new_sa),
181 this->new_sa->get_unique_id(this->new_sa),
182 this->ike_sa->get_my_host(this->ike_sa),
183 this->ike_sa->get_my_id(this->ike_sa),
184 this->ike_sa->get_other_host(this->ike_sa),
185 this->ike_sa->get_other_id(this->ike_sa));
186
187 return SUCCESS;
188 }
189
190 /**
191 * Implementation of task_t.process for initiator
192 */
193 static status_t process_i(private_ike_rekey_t *this, message_t *message)
194 {
195 if (message->get_notify(message, NO_ADDITIONAL_SAS))
196 {
197 DBG1(DBG_IKE, "peer seems to not support IKE rekeying, "
198 "starting reauthentication");
199 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
200 hydra->processor->queue_job(hydra->processor,
201 (job_t*)rekey_ike_sa_job_create(
202 this->ike_sa->get_id(this->ike_sa), TRUE));
203 return SUCCESS;
204 }
205
206 switch (this->ike_init->task.process(&this->ike_init->task, message))
207 {
208 case FAILED:
209 /* rekeying failed, fallback to old SA */
210 if (!(this->collision && (
211 this->collision->get_type(this->collision) == IKE_DELETE ||
212 this->collision->get_type(this->collision) == IKE_REAUTH)))
213 {
214 job_t *job;
215 u_int32_t retry = RETRY_INTERVAL - (random() % RETRY_JITTER);
216 job = (job_t*)rekey_ike_sa_job_create(
217 this->ike_sa->get_id(this->ike_sa), FALSE);
218 DBG1(DBG_IKE, "IKE_SA rekeying failed, "
219 "trying again in %d seconds", retry);
220 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
221 hydra->scheduler->schedule_job(hydra->scheduler, job, retry);
222 }
223 return SUCCESS;
224 case NEED_MORE:
225 /* bad dh group, try again */
226 this->ike_init->task.migrate(&this->ike_init->task, this->new_sa);
227 return NEED_MORE;
228 default:
229 break;
230 }
231
232 this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
233 DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
234 this->new_sa->get_name(this->new_sa),
235 this->new_sa->get_unique_id(this->new_sa),
236 this->ike_sa->get_my_host(this->ike_sa),
237 this->ike_sa->get_my_id(this->ike_sa),
238 this->ike_sa->get_other_host(this->ike_sa),
239 this->ike_sa->get_other_id(this->ike_sa));
240
241 /* check for collisions */
242 if (this->collision &&
243 this->collision->get_type(this->collision) == IKE_REKEY)
244 {
245 private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision;
246
247 /* ike_init can be NULL, if child_sa is half-open */
248 if (other->ike_init)
249 {
250 host_t *host;
251 chunk_t this_nonce, other_nonce;
252
253 this_nonce = this->ike_init->get_lower_nonce(this->ike_init);
254 other_nonce = other->ike_init->get_lower_nonce(other->ike_init);
255
256 /* if we have the lower nonce, delete rekeyed SA. If not, delete
257 * the redundant. */
258 if (memcmp(this_nonce.ptr, other_nonce.ptr,
259 min(this_nonce.len, other_nonce.len)) < 0)
260 {
261 /* peer should delete this SA. Add a timeout just in case. */
262 job_t *job = (job_t*)delete_ike_sa_job_create(
263 other->new_sa->get_id(other->new_sa), TRUE);
264 hydra->scheduler->schedule_job(hydra->scheduler, job, 10);
265 DBG1(DBG_IKE, "IKE_SA rekey collision won, deleting rekeyed IKE_SA");
266 charon->ike_sa_manager->checkin(charon->ike_sa_manager, other->new_sa);
267 other->new_sa = NULL;
268 }
269 else
270 {
271 DBG1(DBG_IKE, "IKE_SA rekey collision lost, deleting redundant IKE_SA");
272 /* apply host for a proper delete */
273 host = this->ike_sa->get_my_host(this->ike_sa);
274 this->new_sa->set_my_host(this->new_sa, host->clone(host));
275 host = this->ike_sa->get_other_host(this->ike_sa);
276 this->new_sa->set_other_host(this->new_sa, host->clone(host));
277 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
278 if (this->new_sa->delete(this->new_sa) == DESTROY_ME)
279 {
280 charon->ike_sa_manager->checkin_and_destroy(
281 charon->ike_sa_manager, this->new_sa);
282 }
283 else
284 {
285 charon->ike_sa_manager->checkin(
286 charon->ike_sa_manager, this->new_sa);
287 }
288 /* set threads active IKE_SA after checkin */
289 charon->bus->set_sa(charon->bus, this->ike_sa);
290 /* inherit to other->new_sa in destroy() */
291 this->new_sa = other->new_sa;
292 other->new_sa = NULL;
293 return SUCCESS;
294 }
295 }
296 /* set threads active IKE_SA after checkin */
297 charon->bus->set_sa(charon->bus, this->ike_sa);
298 }
299
300 /* rekeying successful, delete the IKE_SA using a subtask */
301 this->ike_delete = ike_delete_create(this->ike_sa, TRUE);
302 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i_delete;
303 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i_delete;
304
305 return NEED_MORE;
306 }
307
308 /**
309 * Implementation of task_t.get_type
310 */
311 static task_type_t get_type(private_ike_rekey_t *this)
312 {
313 return IKE_REKEY;
314 }
315
316 static void collide(private_ike_rekey_t* this, task_t *other)
317 {
318 DESTROY_IF(this->collision);
319 this->collision = other;
320 }
321
322 /**
323 * Implementation of task_t.migrate
324 */
325 static void migrate(private_ike_rekey_t *this, ike_sa_t *ike_sa)
326 {
327 if (this->ike_init)
328 {
329 this->ike_init->task.destroy(&this->ike_init->task);
330 }
331 if (this->ike_delete)
332 {
333 this->ike_delete->task.destroy(&this->ike_delete->task);
334 }
335 if (this->new_sa)
336 {
337 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
338 this->new_sa);
339 /* set threads active IKE_SA after checkin */
340 charon->bus->set_sa(charon->bus, this->ike_sa);
341 }
342 DESTROY_IF(this->collision);
343
344 this->collision = NULL;
345 this->ike_sa = ike_sa;
346 this->new_sa = NULL;
347 this->ike_init = NULL;
348 this->ike_delete = NULL;
349 }
350
351 /**
352 * Implementation of task_t.destroy
353 */
354 static void destroy(private_ike_rekey_t *this)
355 {
356 if (this->new_sa)
357 {
358 if (this->new_sa->get_state(this->new_sa) == IKE_ESTABLISHED &&
359 this->new_sa->inherit(this->new_sa, this->ike_sa) != DESTROY_ME)
360 {
361 /* invoke hook if rekeying was successful */
362 charon->bus->ike_rekey(charon->bus, this->ike_sa, this->new_sa);
363 charon->ike_sa_manager->checkin(charon->ike_sa_manager, this->new_sa);
364 }
365 else
366 {
367 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
368 this->new_sa);
369 }
370 /* set threads active IKE_SA after checkin */
371 charon->bus->set_sa(charon->bus, this->ike_sa);
372 }
373 if (this->ike_init)
374 {
375 this->ike_init->task.destroy(&this->ike_init->task);
376 }
377 if (this->ike_delete)
378 {
379 this->ike_delete->task.destroy(&this->ike_delete->task);
380 }
381 DESTROY_IF(this->collision);
382 free(this);
383 }
384
385 /*
386 * Described in header.
387 */
388 ike_rekey_t *ike_rekey_create(ike_sa_t *ike_sa, bool initiator)
389 {
390 private_ike_rekey_t *this = malloc_thing(private_ike_rekey_t);
391
392 this->public.collide = (void(*)(ike_rekey_t*,task_t*))collide;
393 this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
394 this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
395 this->public.task.destroy = (void(*)(task_t*))destroy;
396 if (initiator)
397 {
398 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
399 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
400 }
401 else
402 {
403 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
404 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
405 }
406
407 this->ike_sa = ike_sa;
408 this->new_sa = NULL;
409 this->ike_init = NULL;
410 this->ike_delete = NULL;
411 this->initiator = initiator;
412 this->collision = NULL;
413
414 return &this->public;
415 }