fixing a problem if the mediation server initiates the rekeying

[strongswan.git] / src / charon / sa / tasks / ike_me.c

diff --git a/src/charon/sa/tasks/ike_me.c b/src/charon/sa/tasks/ike_me.c
index 64741c6..58d99ea 100644 (file)
--- a/src/charon/sa/tasks/ike_me.c
+++ b/src/charon/sa/tasks/ike_me.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Tobias Brunner
+ * Copyright (C) 2007-2008 Tobias Brunner
  * Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -26,16 +26,9 @@
 #include <encoding/payloads/endpoint_notify.h>
 #include <processing/jobs/mediation_job.h>
 
-#define ME_CONNECTID_LEN 8
+#define ME_CONNECTID_LEN 4
 #define ME_CONNECTKEY_LEN 16
 
-/* FIXME: proposed values */
-#define ME_CONNECTID_MIN_LEN 4
-#define ME_CONNECTID_MAX_LEN 16
-#define ME_CONNECTKEY_MIN_LEN 8
-#define ME_CONNECTKEY_MAX_LEN 64
-
-
 typedef struct private_ike_me_t private_ike_me_t;
 
 /**
@@ -248,7 +241,7 @@ static void process_payloads(private_ike_me_t *this, message_t *message)
 }
 
 /**
- * Implementation of task_t.process for initiator
+ * Implementation of task_t.build for initiator
  */
 static status_t build_i(private_ike_me_t *this, message_t *message)
 {
@@ -487,9 +480,7 @@ static status_t process_i(private_ike_me_t *this, message_t *message)
                        if (this->failed)
                        {
                                DBG1(DBG_IKE, "peer '%D' is not online", this->peer_id);
-                               /* FIXME: notify the mediated connection (job?)
-                                * FIXME: probably delete the created checklist, at least as 
-                                * responder */
+                               /* FIXME: notify the mediated connection (job?) */
                        }
                        else
                        {
@@ -508,6 +499,8 @@ static status_t process_i(private_ike_me_t *this, message_t *message)
                                                this->ike_sa->get_my_id(this->ike_sa), this->peer_id,
                                                this->connect_id, this->connect_key, this->local_endpoints,
                                                TRUE);
+                                       /* FIXME: also start a timer for the whole transaction (maybe
+                                        * within the connect_manager?) */
                                }
                        }
                        break;
@@ -519,7 +512,7 @@ static status_t process_i(private_ike_me_t *this, message_t *message)
 }
 
 /**
- * Implementation of task_t.process for initiator (mediation server)
+ * Implementation of task_t.build for initiator (mediation server)
  */
 static status_t build_i_ms(private_ike_me_t *this, message_t *message)
 {
@@ -563,14 +556,24 @@ static status_t process_r_ms(private_ike_me_t *this, message_t *message)
        {
                case IKE_SA_INIT:
                {
+                       /* FIXME: we should check for SA* and TS* payloads
+                        * if any are there send NO_ADDITIONAL_SAS back and delete this SA */
                        process_payloads(this, message);
                        return this->mediation ? NEED_MORE : SUCCESS;
                }
                case IKE_AUTH:
                {
+                       /* FIXME: we should check whether the current peer_config is configured
+                        * as mediation connection */
                        process_payloads(this, message);
                        break;
                }
+               case CREATE_CHILD_SA:
+               {
+                       /* FIXME: if this is not to rekey the IKE SA we have to return a
+                        * NO_ADDITIONAL_SAS and then delete the SA */
+                       break;
+               }
                case ME_CONNECT:
                {
                        id_payload_t *id_payload;
@@ -640,11 +643,11 @@ static status_t build_r_ms(private_ike_me_t *this, message_t *message)
                                
                                endpoint = endpoint_notify_create_from_host(SERVER_REFLEXIVE, host, NULL);                                                              
                                message->add_payload(message, (payload_t*)endpoint->build_notify(endpoint));
+                               endpoint->destroy(endpoint);
                        }
                        
-                       charon->mediation_manager->update_sa_id(charon->mediation_manager,
-                                       this->ike_sa->get_other_id(this->ike_sa),
-                                       this->ike_sa->get_id(this->ike_sa));
+                       /* FIXME: we actually must delete any existing IKE_SAs with the same remote id */
+                       this->ike_sa->act_as_mediation_server(this->ike_sa);
                        
                        SIG(CHILD_UP_SUCCESS, "established mediation connection without CHILD_SA successfully");
                        
@@ -695,6 +698,10 @@ static status_t build_r_ms(private_ike_me_t *this, message_t *message)
  */
 static status_t process_i_ms(private_ike_me_t *this, message_t *message)
 {
+       /* FIXME: theoretically we should be prepared to receive a ME_CONNECT_FAILED
+        * here if the responding peer is not able to proceed. in this case we shall
+        * notify the initiating peer with a ME_CONNECT request containing only a
+        * ME_CONNECT_FAILED */
        return SUCCESS;
 }
 
@@ -735,7 +742,10 @@ static void relay(private_ike_me_t *this, identification_t *requester, chunk_t c
        this->peer_id = requester->clone(requester);
        this->connect_id = chunk_clone(connect_id);
        this->connect_key = chunk_clone(connect_key);
+       
+       this->remote_endpoints->destroy_offset(this->remote_endpoints, offsetof(endpoint_notify_t, destroy));
        this->remote_endpoints = endpoints->clone_offset(endpoints, offsetof(endpoint_notify_t, clone));
+       
        this->response = response;
 }
 
@@ -783,8 +793,7 @@ ike_me_t *ike_me_create(ike_sa_t *ike_sa, bool initiator)
        this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
        this->public.task.destroy = (void(*)(task_t*))destroy;
        
-       ike_sa_id_t *id = ike_sa->get_id(ike_sa);
-       if (id->is_initiator(id))
+       if (ike_sa->is_ike_initiator(ike_sa))
        {
                if (initiator)
                {