Moving charon to libcharon.
[strongswan.git] / src / libcharon / sa / tasks / ike_rekey.c
1 /*
2 * Copyright (C) 2005-2008 Martin Willi
3 * Copyright (C) 2005 Jan Hutter
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "ike_rekey.h"
18
19 #include <daemon.h>
20 #include <encoding/payloads/notify_payload.h>
21 #include <sa/tasks/ike_init.h>
22 #include <sa/tasks/ike_delete.h>
23 #include <processing/jobs/delete_ike_sa_job.h>
24 #include <processing/jobs/rekey_ike_sa_job.h>
25
26
27 typedef struct private_ike_rekey_t private_ike_rekey_t;
28
29 /**
30 * Private members of a ike_rekey_t task.
31 */
32 struct private_ike_rekey_t {
33
34 /**
35 * Public methods and task_t interface.
36 */
37 ike_rekey_t public;
38
39 /**
40 * Assigned IKE_SA.
41 */
42 ike_sa_t *ike_sa;
43
44 /**
45 * New IKE_SA which replaces the current one
46 */
47 ike_sa_t *new_sa;
48
49 /**
50 * Are we the initiator?
51 */
52 bool initiator;
53
54 /**
55 * the IKE_INIT task which is reused to simplify rekeying
56 */
57 ike_init_t *ike_init;
58
59 /**
60 * IKE_DELETE task to delete the old IKE_SA after rekeying was successful
61 */
62 ike_delete_t *ike_delete;
63
64 /**
65 * colliding task detected by the task manager
66 */
67 task_t *collision;
68 };
69
70 /**
71 * Implementation of task_t.build for initiator, after rekeying
72 */
73 static status_t build_i_delete(private_ike_rekey_t *this, message_t *message)
74 {
75 /* update exchange type to INFORMATIONAL for the delete */
76 message->set_exchange_type(message, INFORMATIONAL);
77
78 return this->ike_delete->task.build(&this->ike_delete->task, message);
79 }
80
81 /**
82 * Implementation of task_t.process for initiator, after rekeying
83 */
84 static status_t process_i_delete(private_ike_rekey_t *this, message_t *message)
85 {
86 return this->ike_delete->task.process(&this->ike_delete->task, message);
87 }
88
89 /**
90 * Implementation of task_t.build for initiator
91 */
92 static status_t build_i(private_ike_rekey_t *this, message_t *message)
93 {
94 peer_cfg_t *peer_cfg;
95 host_t *other_host;
96
97 /* create new SA only on first try */
98 if (this->new_sa == NULL)
99 {
100 this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
101 TRUE);
102
103 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
104 other_host = this->ike_sa->get_other_host(this->ike_sa);
105 this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
106 this->new_sa->set_other_host(this->new_sa, other_host->clone(other_host));
107 this->ike_init = ike_init_create(this->new_sa, TRUE, this->ike_sa);
108 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
109 }
110 this->ike_init->task.build(&this->ike_init->task, message);
111
112 return NEED_MORE;
113 }
114
115 /**
116 * Implementation of task_t.process for responder
117 */
118 static status_t process_r(private_ike_rekey_t *this, message_t *message)
119 {
120 peer_cfg_t *peer_cfg;
121 iterator_t *iterator;
122 child_sa_t *child_sa;
123
124 if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
125 {
126 DBG1(DBG_IKE, "peer initiated rekeying, but we are deleting");
127 return NEED_MORE;
128 }
129
130 iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa);
131 while (iterator->iterate(iterator, (void**)&child_sa))
132 {
133 switch (child_sa->get_state(child_sa))
134 {
135 case CHILD_CREATED:
136 case CHILD_REKEYING:
137 case CHILD_DELETING:
138 /* we do not allow rekeying while we have children in-progress */
139 DBG1(DBG_IKE, "peer initiated rekeying, but a child is half-open");
140 iterator->destroy(iterator);
141 return NEED_MORE;
142 default:
143 break;
144 }
145 }
146 iterator->destroy(iterator);
147
148 this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
149 FALSE);
150
151 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
152 this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
153 this->ike_init = ike_init_create(this->new_sa, FALSE, this->ike_sa);
154 this->ike_init->task.process(&this->ike_init->task, message);
155
156 return NEED_MORE;
157 }
158
159 /**
160 * Implementation of task_t.build for responder
161 */
162 static status_t build_r(private_ike_rekey_t *this, message_t *message)
163 {
164 if (this->new_sa == NULL)
165 {
166 /* IKE_SA/a CHILD_SA is in an inacceptable state, deny rekeying */
167 message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
168 return SUCCESS;
169 }
170
171 if (this->ike_init->task.build(&this->ike_init->task, message) == FAILED)
172 {
173 return SUCCESS;
174 }
175
176 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
177 this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
178 DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
179 this->new_sa->get_name(this->new_sa),
180 this->new_sa->get_unique_id(this->new_sa),
181 this->ike_sa->get_my_host(this->ike_sa),
182 this->ike_sa->get_my_id(this->ike_sa),
183 this->ike_sa->get_other_host(this->ike_sa),
184 this->ike_sa->get_other_id(this->ike_sa));
185
186 return SUCCESS;
187 }
188
189 /**
190 * Implementation of task_t.process for initiator
191 */
192 static status_t process_i(private_ike_rekey_t *this, message_t *message)
193 {
194 if (message->get_notify(message, NO_ADDITIONAL_SAS))
195 {
196 DBG1(DBG_IKE, "peer seems to not support IKE rekeying, "
197 "starting reauthentication");
198 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
199 charon->processor->queue_job(charon->processor,
200 (job_t*)rekey_ike_sa_job_create(
201 this->ike_sa->get_id(this->ike_sa), TRUE));
202 return SUCCESS;
203 }
204
205 switch (this->ike_init->task.process(&this->ike_init->task, message))
206 {
207 case FAILED:
208 /* rekeying failed, fallback to old SA */
209 if (!(this->collision && (
210 this->collision->get_type(this->collision) == IKE_DELETE ||
211 this->collision->get_type(this->collision) == IKE_REAUTH)))
212 {
213 job_t *job;
214 u_int32_t retry = RETRY_INTERVAL - (random() % RETRY_JITTER);
215 job = (job_t*)rekey_ike_sa_job_create(
216 this->ike_sa->get_id(this->ike_sa), FALSE);
217 DBG1(DBG_IKE, "IKE_SA rekeying failed, "
218 "trying again in %d seconds", retry);
219 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
220 charon->scheduler->schedule_job(charon->scheduler, job, retry);
221 }
222 return SUCCESS;
223 case NEED_MORE:
224 /* bad dh group, try again */
225 this->ike_init->task.migrate(&this->ike_init->task, this->new_sa);
226 return NEED_MORE;
227 default:
228 break;
229 }
230
231 this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
232 DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
233 this->new_sa->get_name(this->new_sa),
234 this->new_sa->get_unique_id(this->new_sa),
235 this->ike_sa->get_my_host(this->ike_sa),
236 this->ike_sa->get_my_id(this->ike_sa),
237 this->ike_sa->get_other_host(this->ike_sa),
238 this->ike_sa->get_other_id(this->ike_sa));
239
240 /* check for collisions */
241 if (this->collision &&
242 this->collision->get_type(this->collision) == IKE_REKEY)
243 {
244 chunk_t this_nonce, other_nonce;
245 host_t *host;
246 private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision;
247
248 this_nonce = this->ike_init->get_lower_nonce(this->ike_init);
249 other_nonce = other->ike_init->get_lower_nonce(other->ike_init);
250
251 /* if we have the lower nonce, delete rekeyed SA. If not, delete
252 * the redundant. */
253 if (memcmp(this_nonce.ptr, other_nonce.ptr,
254 min(this_nonce.len, other_nonce.len)) < 0)
255 {
256 /* peer should delete this SA. Add a timeout just in case. */
257 job_t *job = (job_t*)delete_ike_sa_job_create(
258 other->new_sa->get_id(other->new_sa), TRUE);
259 charon->scheduler->schedule_job(charon->scheduler, job, 10);
260 DBG1(DBG_IKE, "IKE_SA rekey collision won, deleting rekeyed IKE_SA");
261 charon->ike_sa_manager->checkin(charon->ike_sa_manager, other->new_sa);
262 other->new_sa = NULL;
263 }
264 else
265 {
266 DBG1(DBG_IKE, "IKE_SA rekey collision lost, deleting redundant IKE_SA");
267 /* apply host for a proper delete */
268 host = this->ike_sa->get_my_host(this->ike_sa);
269 this->new_sa->set_my_host(this->new_sa, host->clone(host));
270 host = this->ike_sa->get_other_host(this->ike_sa);
271 this->new_sa->set_other_host(this->new_sa, host->clone(host));
272 this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
273 if (this->new_sa->delete(this->new_sa) == DESTROY_ME)
274 {
275 charon->ike_sa_manager->checkin_and_destroy(
276 charon->ike_sa_manager, this->new_sa);
277 }
278 else
279 {
280 charon->ike_sa_manager->checkin(
281 charon->ike_sa_manager, this->new_sa);
282 }
283 /* set threads active IKE_SA after checkin */
284 charon->bus->set_sa(charon->bus, this->ike_sa);
285 /* inherit to other->new_sa in destroy() */
286 this->new_sa = other->new_sa;
287 other->new_sa = NULL;
288 return SUCCESS;
289 }
290 /* set threads active IKE_SA after checkin */
291 charon->bus->set_sa(charon->bus, this->ike_sa);
292 }
293
294 /* rekeying successful, delete the IKE_SA using a subtask */
295 this->ike_delete = ike_delete_create(this->ike_sa, TRUE);
296 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i_delete;
297 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i_delete;
298
299 return NEED_MORE;
300 }
301
302 /**
303 * Implementation of task_t.get_type
304 */
305 static task_type_t get_type(private_ike_rekey_t *this)
306 {
307 return IKE_REKEY;
308 }
309
310 static void collide(private_ike_rekey_t* this, task_t *other)
311 {
312 DESTROY_IF(this->collision);
313 this->collision = other;
314 }
315
316 /**
317 * Implementation of task_t.migrate
318 */
319 static void migrate(private_ike_rekey_t *this, ike_sa_t *ike_sa)
320 {
321 if (this->ike_init)
322 {
323 this->ike_init->task.destroy(&this->ike_init->task);
324 }
325 if (this->ike_delete)
326 {
327 this->ike_delete->task.destroy(&this->ike_delete->task);
328 }
329 if (this->new_sa)
330 {
331 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
332 this->new_sa);
333 /* set threads active IKE_SA after checkin */
334 charon->bus->set_sa(charon->bus, this->ike_sa);
335 }
336 DESTROY_IF(this->collision);
337
338 this->collision = NULL;
339 this->ike_sa = ike_sa;
340 this->new_sa = NULL;
341 this->ike_init = NULL;
342 this->ike_delete = NULL;
343 }
344
345 /**
346 * Implementation of task_t.destroy
347 */
348 static void destroy(private_ike_rekey_t *this)
349 {
350 if (this->new_sa)
351 {
352 if (this->new_sa->get_state(this->new_sa) == IKE_ESTABLISHED &&
353 this->new_sa->inherit(this->new_sa, this->ike_sa) != DESTROY_ME)
354 {
355 /* invoke hook if rekeying was successful */
356 charon->bus->ike_rekey(charon->bus, this->ike_sa, this->new_sa);
357 charon->ike_sa_manager->checkin(charon->ike_sa_manager, this->new_sa);
358 }
359 else
360 {
361 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
362 this->new_sa);
363 }
364 /* set threads active IKE_SA after checkin */
365 charon->bus->set_sa(charon->bus, this->ike_sa);
366 }
367 if (this->ike_init)
368 {
369 this->ike_init->task.destroy(&this->ike_init->task);
370 }
371 if (this->ike_delete)
372 {
373 this->ike_delete->task.destroy(&this->ike_delete->task);
374 }
375 DESTROY_IF(this->collision);
376 free(this);
377 }
378
379 /*
380 * Described in header.
381 */
382 ike_rekey_t *ike_rekey_create(ike_sa_t *ike_sa, bool initiator)
383 {
384 private_ike_rekey_t *this = malloc_thing(private_ike_rekey_t);
385
386 this->public.collide = (void(*)(ike_rekey_t*,task_t*))collide;
387 this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
388 this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
389 this->public.task.destroy = (void(*)(task_t*))destroy;
390 if (initiator)
391 {
392 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
393 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
394 }
395 else
396 {
397 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
398 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
399 }
400
401 this->ike_sa = ike_sa;
402 this->new_sa = NULL;
403 this->ike_init = NULL;
404 this->ike_delete = NULL;
405 this->initiator = initiator;
406 this->collision = NULL;
407
408 return &this->public;
409 }