kernel-interface: Raise mapping event with a proto/SPI/dst tuple
[strongswan.git] / src / libcharon / processing / jobs / rekey_ike_sa_job.c
index 5ec0b1b..516dc5d 100644 (file)
@@ -39,22 +39,54 @@ struct private_rekey_ike_sa_job_t {
        bool reauth;
 };
 
-/**
- * Implementation of job_t.destroy.
- */
-static void destroy(private_rekey_ike_sa_job_t *this)
+METHOD(job_t, destroy, void,
+       private_rekey_ike_sa_job_t *this)
 {
        this->ike_sa_id->destroy(this->ike_sa_id);
        free(this);
 }
 
 /**
- * Implementation of job_t.execute.
+ * Check if we should delay a reauth, and by how many seconds
  */
-static void execute(private_rekey_ike_sa_job_t *this)
+static u_int32_t get_retry_delay(ike_sa_t *ike_sa)
+{
+       enumerator_t *enumerator;
+       child_sa_t *child_sa;
+       u_int32_t retry = 0;
+
+       /* avoid reauth collisions for certain IKE_SA/CHILD_SA states */
+       if (ike_sa->get_state(ike_sa) != IKE_ESTABLISHED)
+       {
+               retry = RETRY_INTERVAL - (random() % RETRY_JITTER);
+               DBG1(DBG_IKE, "unable to reauthenticate in %N state, delaying for %us",
+                        ike_sa_state_names, ike_sa->get_state(ike_sa), retry);
+       }
+       else
+       {
+               enumerator = ike_sa->create_child_sa_enumerator(ike_sa);
+               while (enumerator->enumerate(enumerator, &child_sa))
+               {
+                       if (child_sa->get_state(child_sa) != CHILD_INSTALLED)
+                       {
+                               retry = RETRY_INTERVAL - (random() % RETRY_JITTER);
+                               DBG1(DBG_IKE, "unable to reauthenticate in CHILD_SA %N state, "
+                                        "delaying for %us", child_sa_state_names,
+                                        child_sa->get_state(child_sa), retry);
+                               break;
+                       }
+               }
+               enumerator->destroy(enumerator);
+       }
+       return retry;
+}
+
+METHOD(job_t, execute, job_requeue_t,
+       private_rekey_ike_sa_job_t *this)
 {
        ike_sa_t *ike_sa;
        status_t status = SUCCESS;
+       u_int32_t retry = 0;
 
        ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager,
                                                                                          this->ike_sa_id);
@@ -66,7 +98,11 @@ static void execute(private_rekey_ike_sa_job_t *this)
        {
                if (this->reauth)
                {
-                       status = ike_sa->reauth(ike_sa);
+                       retry = get_retry_delay(ike_sa);
+                       if (!retry)
+                       {
+                               status = ike_sa->reauth(ike_sa);
+                       }
                }
                else
                {
@@ -75,14 +111,25 @@ static void execute(private_rekey_ike_sa_job_t *this)
 
                if (status == DESTROY_ME)
                {
-                       charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
+                       charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
+                                                                                                               ike_sa);
                }
                else
                {
                        charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
                }
        }
-       destroy(this);
+       if (retry)
+       {
+               return JOB_RESCHEDULE(retry);
+       }
+       return JOB_REQUEUE_NONE;
+}
+
+METHOD(job_t, get_priority, job_priority_t,
+       private_rekey_ike_sa_job_t *this)
+{
+       return JOB_PRIO_MEDIUM;
 }
 
 /*
@@ -90,15 +137,19 @@ static void execute(private_rekey_ike_sa_job_t *this)
  */
 rekey_ike_sa_job_t *rekey_ike_sa_job_create(ike_sa_id_t *ike_sa_id, bool reauth)
 {
-       private_rekey_ike_sa_job_t *this = malloc_thing(private_rekey_ike_sa_job_t);
-
-       /* interface functions */
-       this->public.job_interface.execute = (void (*) (job_t *)) execute;
-       this->public.job_interface.destroy = (void (*)(job_t*)) destroy;
+       private_rekey_ike_sa_job_t *this;
 
-       /* private variables */
-       this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
-       this->reauth = reauth;
+       INIT(this,
+               .public = {
+                       .job_interface = {
+                               .execute = _execute,
+                               .get_priority = _get_priority,
+                               .destroy = _destroy,
+                       },
+               },
+               .ike_sa_id = ike_sa_id->clone(ike_sa_id),
+               .reauth = reauth,
+       );
 
        return &(this->public);
 }