ike_sa: Defer task manager destruction after child destruction
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
old mode 100755 (executable)
new mode 100644 (file)
index 1dc9bf5..131d812
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2011 Tobias Brunner
+ * Copyright (C) 2007-2013 Tobias Brunner
  * Copyright (C) 2007-2011 Martin Willi
  * Hochschule fuer Technik Rapperswil
  *
 
 #include <processing/jobs/retransmit_job.h>
 #include <processing/jobs/delete_ike_sa_job.h>
+#include <processing/jobs/dpd_timeout_job.h>
+#include <processing/jobs/process_message_job.h>
+
+#include <encoding/payloads/fragment_payload.h>
+#include <bio/bio_writer.h>
 
 /**
  * Number of old messages hashes we keep for retransmission.
 #define MAX_OLD_HASHES 2
 
 /**
+ * Maximum packet size for fragmented packets (same as in sockets)
+ */
+#define MAX_PACKET 10000
+
+/**
+ * Maximum size of fragment data when sending packets (currently the same is
+ * used for IPv4 and IPv6, even though the latter has a higher minimum datagram
+ * size).  576 (= min. IPv4) - 20 (= IP header) - 8 (= UDP header) -
+ *  - 28 (= IKE header) - 8 (= fragment header) = 512
+ * This is reduced by 4 in case of NAT-T (due to the non-ESP marker).
+ */
+#define MAX_FRAGMENT_SIZE 512
+
+/**
  * First sequence number of responding packets.
  *
  * To distinguish retransmission jobs for initiating and responding packets,
@@ -159,19 +178,65 @@ struct private_task_manager_t {
                packet_t *packet;
 
                /**
-                * type of the initated exchange
+                * type of the initiated exchange
                 */
                exchange_type_t type;
 
        } initiating;
 
        /**
+        * Data used to reassemble a fragmented message
+        */
+       struct {
+
+               /**
+                * Fragment ID (currently only one is supported at a time)
+                */
+               u_int16_t id;
+
+               /**
+                * The number of the last fragment (in case we receive the fragments out
+                * of order), since the first starts with 1 this defines the number of
+                * fragments we expect
+                */
+               u_int8_t last;
+
+               /**
+                * List of fragments (fragment_t*)
+                */
+               linked_list_t *list;
+
+               /**
+                * Length of all currently received fragments
+                */
+               size_t len;
+
+               /**
+                * Maximum length of a fragmented packet
+                */
+               size_t max_packet;
+
+               /**
+                * Maximum length of a single fragment (when sending)
+                */
+               size_t size;
+
+               /**
+                * The exchange type we use for fragments. Always the initial type even
+                * for fragmented quick mode or transaction messages (i.e. either
+                * ID_PROT or AGGRESSIVE)
+                */
+               exchange_type_t exchange;
+
+       } frag;
+
+       /**
         * List of queued tasks not yet in action
         */
        linked_list_t *queued_tasks;
 
        /**
-        * List of active tasks, initiated by ourselve
+        * List of active tasks, initiated by ourselves
         */
        linked_list_t *active_tasks;
 
@@ -212,10 +277,37 @@ struct private_task_manager_t {
 };
 
 /**
- * Flush a single task queue
+ * A single fragment within a fragmented message
  */
-static void flush_queue(private_task_manager_t *this, linked_list_t *list)
+typedef struct {
+
+       /** fragment number */
+       u_int8_t num;
+
+       /** fragment data */
+       chunk_t data;
+
+} fragment_t;
+
+static void fragment_destroy(fragment_t *this)
 {
+       chunk_free(&this->data);
+       free(this);
+}
+
+static void clear_fragments(private_task_manager_t *this, u_int16_t id)
+{
+       DESTROY_FUNCTION_IF(this->frag.list, (void*)fragment_destroy);
+       this->frag.list = NULL;
+       this->frag.last = 0;
+       this->frag.len = 0;
+       this->frag.id = id;
+}
+
+METHOD(task_manager_t, flush_queue, void,
+       private_task_manager_t *this, task_queue_t queue)
+{
+       linked_list_t *list;
        task_t *task;
 
        if (this->queued)
@@ -223,20 +315,36 @@ static void flush_queue(private_task_manager_t *this, linked_list_t *list)
                this->queued->destroy(this->queued);
                this->queued = NULL;
        }
+       switch (queue)
+       {
+               case TASK_QUEUE_ACTIVE:
+                       list = this->active_tasks;
+                       /* cancel pending retransmits */
+                       this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
+                       DESTROY_IF(this->initiating.packet);
+                       this->initiating.packet = NULL;
+                       break;
+               case TASK_QUEUE_PASSIVE:
+                       list = this->passive_tasks;
+                       break;
+               case TASK_QUEUE_QUEUED:
+                       list = this->queued_tasks;
+                       break;
+               default:
+                       return;
+       }
        while (list->remove_last(list, (void**)&task) == SUCCESS)
        {
                task->destroy(task);
        }
 }
 
-/**
- * flush all tasks in the task manager
- */
-static void flush(private_task_manager_t *this)
+METHOD(task_manager_t, flush, void,
+       private_task_manager_t *this)
 {
-       flush_queue(this, this->queued_tasks);
-       flush_queue(this, this->passive_tasks);
-       flush_queue(this, this->active_tasks);
+       flush_queue(this, TASK_QUEUE_QUEUED);
+       flush_queue(this, TASK_QUEUE_PASSIVE);
+       flush_queue(this, TASK_QUEUE_ACTIVE);
 }
 
 /**
@@ -265,20 +373,114 @@ static bool activate_task(private_task_manager_t *this, task_type_t type)
 }
 
 /**
+ * Send a single fragment with the given data
+ */
+static bool send_fragment(private_task_manager_t *this, bool request,
+                                       host_t *src, host_t *dst, fragment_payload_t *fragment)
+{
+       message_t *message;
+       packet_t *packet;
+       status_t status;
+
+       message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
+       /* other implementations seem to just use 0 as message ID, so here we go */
+       message->set_message_id(message, 0);
+       message->set_request(message, request);
+       message->set_source(message, src->clone(src));
+       message->set_destination(message, dst->clone(dst));
+       message->set_exchange_type(message, this->frag.exchange);
+       message->add_payload(message, (payload_t*)fragment);
+
+       status = this->ike_sa->generate_message(this->ike_sa, message, &packet);
+       if (status != SUCCESS)
+       {
+               DBG1(DBG_IKE, "failed to generate IKE fragment");
+               message->destroy(message);
+               return FALSE;
+       }
+       charon->sender->send(charon->sender, packet);
+       message->destroy(message);
+       return TRUE;
+}
+
+/**
+ * Send a packet, if supported and required do so in fragments
+ */
+static bool send_packet(private_task_manager_t *this, bool request,
+                                               packet_t *packet)
+{
+       bool use_frags = FALSE;
+       ike_cfg_t *ike_cfg;
+       chunk_t data;
+
+       ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
+       if (ike_cfg)
+       {
+               switch (ike_cfg->fragmentation(ike_cfg))
+               {
+                       case FRAGMENTATION_FORCE:
+                               use_frags = TRUE;
+                               break;
+                       case FRAGMENTATION_YES:
+                               use_frags = this->ike_sa->supports_extension(this->ike_sa,
+                                                                                                               EXT_IKE_FRAGMENTATION);
+                               break;
+                       default:
+                               break;
+               }
+       }
+       data = packet->get_data(packet);
+       if (data.len > this->frag.size && use_frags)
+       {
+               fragment_payload_t *fragment;
+               u_int8_t num, count;
+               size_t len, frag_size;
+               host_t *src, *dst;
+
+               src = packet->get_source(packet);
+               dst = packet->get_destination(packet);
+
+               frag_size = this->frag.size;
+               if (dst->get_port(dst) != IKEV2_UDP_PORT &&
+                       src->get_port(src) != IKEV2_UDP_PORT)
+               {       /* reduce size due to non-ESP marker */
+                       frag_size -= 4;
+               }
+               count = data.len / frag_size + (data.len % frag_size ? 1 : 0);
+
+               DBG1(DBG_IKE, "sending IKE message with length of %zu bytes in "
+                        "%hhu fragments", data.len, count);
+               for (num = 1; num <= count; num++)
+               {
+                       len = min(data.len, frag_size);
+                       fragment = fragment_payload_create_from_data(num, num == count,
+                                                                                               chunk_create(data.ptr, len));
+                       if (!send_fragment(this, request, src, dst, fragment))
+                       {
+                               packet->destroy(packet);
+                               return FALSE;
+                       }
+                       data = chunk_skip(data, len);
+               }
+               packet->destroy(packet);
+               return TRUE;
+       }
+       charon->sender->send(charon->sender, packet);
+       return TRUE;
+}
+
+/**
  * Retransmit a packet, either as initiator or as responder
  */
-static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
-                                                       u_int mid, u_int retransmitted, packet_t *packet)
+static status_t retransmit_packet(private_task_manager_t *this, bool request,
+                       u_int32_t seqnr, u_int mid, u_int retransmitted, packet_t *packet)
 {
        u_int32_t t;
 
        if (retransmitted > this->retransmit_tries)
        {
                DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
-               if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
-               {
-                       charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
-               }
+               charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_TIMEOUT, packet);
                return DESTROY_ME;
        }
        t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
@@ -288,8 +490,12 @@ static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
                DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
                         retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
                         mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
+               charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND, packet);
+       }
+       if (!send_packet(this, request, packet->clone(packet)))
+       {
+               return DESTROY_ME;
        }
-       charon->sender->send(charon->sender, packet->clone(packet));
        lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
                        retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
        return NEED_MORE;
@@ -302,7 +508,7 @@ METHOD(task_manager_t, retransmit, status_t,
 
        if (seqnr == this->initiating.seqnr && this->initiating.packet)
        {
-               status = retransmit_packet(this, seqnr, this->initiating.mid,
+               status = retransmit_packet(this, TRUE, seqnr, this->initiating.mid,
                                        this->initiating.retransmitted, this->initiating.packet);
                if (status == NEED_MORE)
                {
@@ -312,7 +518,7 @@ METHOD(task_manager_t, retransmit, status_t,
        }
        if (seqnr == this->responding.seqnr && this->responding.packet)
        {
-               status = retransmit_packet(this, seqnr, this->responding.mid,
+               status = retransmit_packet(this, FALSE, seqnr, this->responding.mid,
                                        this->responding.retransmitted, this->responding.packet);
                if (status == NEED_MORE)
                {
@@ -323,6 +529,56 @@ METHOD(task_manager_t, retransmit, status_t,
        return status;
 }
 
+/**
+ * Check if we have to wait for a mode config before starting a quick mode
+ */
+static bool mode_config_expected(private_task_manager_t *this)
+{
+       enumerator_t *enumerator;
+       peer_cfg_t *peer_cfg;
+       char *pool;
+       bool local;
+       host_t *host;
+
+       peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
+       if (peer_cfg)
+       {
+               if (peer_cfg->use_pull_mode(peer_cfg))
+               {
+                       enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
+                       if (!enumerator->enumerate(enumerator, &pool))
+                       {       /* no pool configured */
+                               enumerator->destroy(enumerator);
+                               return FALSE;
+                       }
+                       enumerator->destroy(enumerator);
+
+                       local = FALSE;
+               }
+               else
+               {
+                       enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
+                       if (!enumerator->enumerate(enumerator, &host))
+                       {       /* not requesting a vip */
+                               enumerator->destroy(enumerator);
+                               return FALSE;
+                       }
+                       enumerator->destroy(enumerator);
+
+                       local = TRUE;
+               }
+               enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
+                                                                                                                               local);
+               if (!enumerator->enumerate(enumerator, &host))
+               {       /* expecting a VIP exchange, but no VIP assigned yet */
+                       enumerator->destroy(enumerator);
+                       return TRUE;
+               }
+               enumerator->destroy(enumerator);
+       }
+       return FALSE;
+}
+
 METHOD(task_manager_t, initiate, status_t,
        private_task_manager_t *this)
 {
@@ -332,7 +588,7 @@ METHOD(task_manager_t, initiate, status_t,
        host_t *me, *other;
        status_t status;
        exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
-       bool new_mid = FALSE, expect_response = FALSE, flushed = FALSE, keep = FALSE;
+       bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
 
        if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
                this->initiating.type != INFORMATIONAL_V1)
@@ -389,7 +645,8 @@ METHOD(task_manager_t, initiate, status_t,
                                        new_mid = TRUE;
                                        break;
                                }
-                               if (activate_task(this, TASK_QUICK_MODE))
+                               if (!mode_config_expected(this) &&
+                                       activate_task(this, TASK_QUICK_MODE))
                                {
                                        exchange = QUICK_MODE;
                                        new_mid = TRUE;
@@ -464,12 +721,17 @@ METHOD(task_manager_t, initiate, status_t,
        me = this->ike_sa->get_my_host(this->ike_sa);
        other = this->ike_sa->get_other_host(this->ike_sa);
 
-       message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
        if (new_mid)
        {
-               this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
-                                                        (void*)&this->initiating.mid);
+               if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
+                                                                (void*)&this->initiating.mid))
+               {
+                       DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
+                       flush(this);
+                       return DESTROY_ME;
+               }
        }
+       message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
        message->set_message_id(message, this->initiating.mid);
        message->set_source(message, me->clone(me));
        message->set_destination(message, other->clone(other));
@@ -497,8 +759,7 @@ METHOD(task_manager_t, initiate, status_t,
                                /* processed, but task needs another exchange */
                                continue;
                        case ALREADY_DONE:
-                               flush_queue(this, this->active_tasks);
-                               flushed = TRUE;
+                               cancelled = TRUE;
                                break;
                        case FAILED:
                        default:
@@ -523,7 +784,7 @@ METHOD(task_manager_t, initiate, status_t,
        {       /* tasks completed, no exchange active anymore */
                this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
        }
-       if (flushed)
+       if (cancelled)
        {
                message->destroy(message);
                return initiate(this);
@@ -543,19 +804,19 @@ METHOD(task_manager_t, initiate, status_t,
        }
 
        this->initiating.seqnr++;
-       if (expect_response )
+       if (expect_response)
        {
                message->destroy(message);
                return retransmit(this, this->initiating.seqnr);
        }
        if (keep)
        {       /* keep the packet for retransmission, the responder might request it */
-               charon->sender->send(charon->sender,
+               send_packet(this, TRUE,
                                        this->initiating.packet->clone(this->initiating.packet));
        }
        else
        {
-               charon->sender->send(charon->sender, this->initiating.packet);
+               send_packet(this, TRUE, this->initiating.packet);
                this->initiating.packet = NULL;
        }
        message->destroy(message);
@@ -586,7 +847,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
        task_t *task;
        message_t *message;
        host_t *me, *other;
-       bool delete = FALSE, flushed = FALSE, expect_request = FALSE;
+       bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
        status_t status;
 
        me = request->get_destination(request);
@@ -624,8 +885,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
                                }
                                continue;
                        case ALREADY_DONE:
-                               flush_queue(this, this->passive_tasks);
-                               flushed = TRUE;
+                               cancelled = TRUE;
                                break;
                        case FAILED:
                        default:
@@ -642,7 +902,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
 
        DESTROY_IF(this->responding.packet);
        this->responding.packet = NULL;
-       if (flushed)
+       if (cancelled)
        {
                message->destroy(message);
                return initiate(this);
@@ -660,8 +920,8 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
        {
                return retransmit(this, this->responding.seqnr);
        }
-       charon->sender->send(charon->sender,
-                                       this->responding.packet->clone(this->responding.packet));
+       send_packet(this, FALSE,
+                               this->responding.packet->clone(this->responding.packet));
        if (delete)
        {
                return DESTROY_ME;
@@ -681,16 +941,19 @@ static void send_notify(private_task_manager_t *this, message_t *request,
        host_t *me, *other;
        u_int32_t mid;
 
-       if (request && request->get_exchange_type(request) == INFORMATIONAL_V1)
+       if (request->get_exchange_type(request) == INFORMATIONAL_V1)
        {       /* don't respond to INFORMATIONAL requests to avoid a notify war */
                DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
                return;
        }
-
+       if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
+       {
+               DBG1(DBG_IKE, "failed to allocate message ID");
+               return;
+       }
        response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
        response->set_exchange_type(response, INFORMATIONAL_V1);
        response->set_request(response, TRUE);
-       this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid);
        response->set_message_id(response, mid);
        response->add_payload(response, (payload_t*)
                                notify_payload_create_from_protocol_and_type(NOTIFY_V1,
@@ -713,12 +976,68 @@ static void send_notify(private_task_manager_t *this, message_t *request,
        if (this->ike_sa->generate_message(this->ike_sa, response,
                                                                           &packet) == SUCCESS)
        {
-               charon->sender->send(charon->sender, packet);
+               send_packet(this, TRUE, packet);
        }
        response->destroy(response);
 }
 
 /**
+ * Process a DPD request/response
+ */
+static bool process_dpd(private_task_manager_t *this, message_t *message)
+{
+       notify_payload_t *notify;
+       notify_type_t type;
+       u_int32_t seq;
+       chunk_t data;
+
+       type = DPD_R_U_THERE;
+       notify = message->get_notify(message, type);
+       if (!notify)
+       {
+               type = DPD_R_U_THERE_ACK;
+               notify = message->get_notify(message, type);
+       }
+       if (!notify)
+       {
+               return FALSE;
+       }
+       data = notify->get_notification_data(notify);
+       if (data.len != 4)
+       {
+               return FALSE;
+       }
+       seq = untoh32(data.ptr);
+
+       if (type == DPD_R_U_THERE)
+       {
+               if (this->dpd_recv == 0 || seq == this->dpd_recv)
+               {       /* check sequence validity */
+                       this->dpd_recv = seq + 1;
+                       this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
+                                                                               time_monotonic(NULL));
+               }
+               /* but respond anyway */
+               this->ike_sa->queue_task(this->ike_sa,
+                               &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
+       }
+       else /* DPD_R_U_THERE_ACK */
+       {
+               if (seq == this->dpd_send - 1)
+               {
+                       this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
+                                                                               time_monotonic(NULL));
+               }
+               else
+               {
+                       DBG1(DBG_IKE, "received invalid DPD sequence number %u "
+                                "(expected %u), ignored", seq, this->dpd_send - 1);
+               }
+       }
+       return TRUE;
+}
+
+/**
  * handle an incoming request message
  */
 static status_t process_request(private_task_manager_t *this,
@@ -727,8 +1046,6 @@ static status_t process_request(private_task_manager_t *this,
        enumerator_t *enumerator;
        task_t *task = NULL;
        bool send_response = FALSE, dpd = FALSE;
-       notify_payload_t *notify;
-       chunk_t data;
 
        if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
                this->passive_tasks->get_count(this->passive_tasks) == 0)
@@ -758,6 +1075,7 @@ static status_t process_request(private_task_manager_t *this,
                                this->passive_tasks->insert_last(this->passive_tasks, task);
                                task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
                                this->passive_tasks->insert_last(this->passive_tasks, task);
+                               this->frag.exchange = AGGRESSIVE;
                                break;
                        case QUICK_MODE:
                                if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
@@ -771,34 +1089,21 @@ static status_t process_request(private_task_manager_t *this,
                                this->passive_tasks->insert_last(this->passive_tasks, task);
                                break;
                        case INFORMATIONAL_V1:
-                               notify = message->get_notify(message, DPD_R_U_THERE);
-                               if (notify)
+                               if (process_dpd(this, message))
                                {
-                                       data = notify->get_notification_data(notify);
-                                       if (this->dpd_recv == 0 && data.len == 4)
-                                       {       /* first DPD request, initialize counter */
-                                               this->dpd_recv = untoh32(data.ptr);
-                                       }
-                                       task = (task_t *)isakmp_dpd_create(this->ike_sa, FALSE,
-                                                                                                          this->dpd_recv++);
-                                       dpd = TRUE;
-                               }
-                               else if (message->get_notify(message, DPD_R_U_THERE_ACK))
-                               {
-                                       task = (task_t *)isakmp_dpd_create(this->ike_sa, TRUE,
-                                                                                                          this->dpd_send - 1);
                                        dpd = TRUE;
                                }
                                else
                                {
                                        task = (task_t *)informational_create(this->ike_sa, NULL);
+                                       this->passive_tasks->insert_first(this->passive_tasks, task);
                                }
-                               this->passive_tasks->insert_first(this->passive_tasks, task);
                                break;
                        case TRANSACTION:
-                               if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
+                               if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
                                {
-                                       task = (task_t *)mode_config_create(this->ike_sa, FALSE);
+                                       task = (task_t *)mode_config_create(this->ike_sa,
+                                                                                                               FALSE, TRUE);
                                }
                                else
                                {
@@ -810,11 +1115,12 @@ static status_t process_request(private_task_manager_t *this,
                                return FAILED;
                }
        }
-       if (!dpd)
+       if (dpd)
        {
-               this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
-                                                                       time_monotonic(NULL));
+               return initiate(this);
        }
+       this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
+
        /* let the tasks process the message */
        enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
        while (enumerator->enumerate(enumerator, (void*)&task))
@@ -832,7 +1138,6 @@ static status_t process_request(private_task_manager_t *this,
                                continue;
                        case ALREADY_DONE:
                                send_response = FALSE;
-                               flush_queue(this, this->passive_tasks);
                                break;
                        case FAILED:
                        default:
@@ -849,12 +1154,6 @@ static status_t process_request(private_task_manager_t *this,
        }
        enumerator->destroy(enumerator);
 
-       if (dpd && this->initiating.type == INFORMATIONAL_V1)
-       {       /* got a DPD reply, cancel any retransmission */
-               this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
-               DESTROY_IF(this->initiating.packet);
-               this->initiating.packet = NULL;
-       }
        if (send_response)
        {
                if (build_response(this, message) != SUCCESS)
@@ -885,11 +1184,21 @@ static status_t process_response(private_task_manager_t *this,
                                                                 message_t *message)
 {
        enumerator_t *enumerator;
+       message_t *queued;
        status_t status;
        task_t *task;
 
        if (message->get_exchange_type(message) != this->initiating.type)
        {
+               /* Windows server sends a fourth quick mode message having an initial
+                * contact notify. Ignore this message for compatibility. */
+               if (this->initiating.type == EXCHANGE_TYPE_UNDEFINED &&
+                       message->get_exchange_type(message) == QUICK_MODE &&
+                       message->get_notify(message, INITIAL_CONTACT))
+               {
+                       DBG1(DBG_IKE, "ignoring fourth Quick Mode message");
+                       return SUCCESS;
+               }
                DBG1(DBG_IKE, "received %N response, but expected %N",
                         exchange_type_names, message->get_exchange_type(message),
                         exchange_type_names, this->initiating.type);
@@ -911,7 +1220,6 @@ static status_t process_response(private_task_manager_t *this,
                                /* processed, but task needs another exchange */
                                continue;
                        case ALREADY_DONE:
-                               flush_queue(this, this->active_tasks);
                                break;
                        case FAILED:
                        default:
@@ -929,15 +1237,16 @@ static status_t process_response(private_task_manager_t *this,
        enumerator->destroy(enumerator);
 
        this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
-       this->initiating.packet->destroy(this->initiating.packet);
+       DESTROY_IF(this->initiating.packet);
        this->initiating.packet = NULL;
 
        if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
        {
-               status = this->public.task_manager.process_message(
-                                                                       &this->public.task_manager, this->queued);
-               this->queued->destroy(this->queued);
+               queued = this->queued;
                this->queued = NULL;
+               status = this->public.task_manager.process_message(
+                                                                                       &this->public.task_manager, queued);
+               queued->destroy(queued);
                if (status == DESTROY_ME)
                {
                        return status;
@@ -947,6 +1256,114 @@ static status_t process_response(private_task_manager_t *this,
        return initiate(this);
 }
 
+static status_t handle_fragment(private_task_manager_t *this, message_t *msg)
+{
+       fragment_payload_t *payload;
+       enumerator_t *enumerator;
+       fragment_t *fragment;
+       status_t status = SUCCESS;
+       chunk_t data;
+       u_int8_t num;
+
+       payload = (fragment_payload_t*)msg->get_payload(msg, FRAGMENT_V1);
+       if (!payload)
+       {
+               return FAILED;
+       }
+
+       if (!this->frag.list || this->frag.id != payload->get_id(payload))
+       {
+               clear_fragments(this, payload->get_id(payload));
+               this->frag.list = linked_list_create();
+       }
+
+       num = payload->get_number(payload);
+       if (!this->frag.last && payload->is_last(payload))
+       {
+               this->frag.last = num;
+       }
+
+       enumerator = this->frag.list->create_enumerator(this->frag.list);
+       while (enumerator->enumerate(enumerator, &fragment))
+       {
+               if (fragment->num == num)
+               {       /* ignore a duplicate fragment */
+                       DBG1(DBG_IKE, "received duplicate fragment #%hhu", num);
+                       enumerator->destroy(enumerator);
+                       return NEED_MORE;
+               }
+               if (fragment->num > num)
+               {
+                       break;
+               }
+       }
+
+       data = payload->get_data(payload);
+       this->frag.len += data.len;
+       if (this->frag.len > this->frag.max_packet)
+       {
+               DBG1(DBG_IKE, "fragmented IKE message is too large");
+               enumerator->destroy(enumerator);
+               clear_fragments(this, 0);
+               return FAILED;
+       }
+
+       INIT(fragment,
+               .num = num,
+               .data = chunk_clone(data),
+       );
+
+       this->frag.list->insert_before(this->frag.list, enumerator, fragment);
+       enumerator->destroy(enumerator);
+
+       if (this->frag.list->get_count(this->frag.list) == this->frag.last)
+       {
+               message_t *message;
+               packet_t *pkt;
+               host_t *src, *dst;
+               bio_writer_t *writer;
+
+               writer = bio_writer_create(this->frag.len);
+               DBG1(DBG_IKE, "received fragment #%hhu, reassembling fragmented IKE "
+                        "message", num);
+               enumerator = this->frag.list->create_enumerator(this->frag.list);
+               while (enumerator->enumerate(enumerator, &fragment))
+               {
+                       writer->write_data(writer, fragment->data);
+               }
+               enumerator->destroy(enumerator);
+
+               src = msg->get_source(msg);
+               dst = msg->get_destination(msg);
+               pkt = packet_create_from_data(src->clone(src), dst->clone(dst),
+                                                                         writer->extract_buf(writer));
+               writer->destroy(writer);
+
+               message = message_create_from_packet(pkt);
+               if (message->parse_header(message) != SUCCESS)
+               {
+                       DBG1(DBG_IKE, "failed to parse header of reassembled IKE message");
+                       message->destroy(message);
+                       status = FAILED;
+               }
+               else
+               {
+                       lib->processor->queue_job(lib->processor,
+                                                               (job_t*)process_message_job_create(message));
+                       status = NEED_MORE;
+
+               }
+               clear_fragments(this, 0);
+       }
+       else
+       {       /* there are some fragments missing */
+               DBG1(DBG_IKE, "received fragment #%hhu, waiting for complete IKE "
+                        "message", num);
+               status = NEED_MORE;
+       }
+       return status;
+}
+
 /**
  * Parse the given message and verify that it is valid.
  */
@@ -987,11 +1404,18 @@ static status_t parse_message(private_task_manager_t *this, message_t *msg)
                         msg->get_request(msg) ? "request" : "response",
                         msg->get_message_id(msg));
 
+               charon->bus->alert(charon->bus, ALERT_PARSE_ERROR_BODY, msg, status);
+
                if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
                {       /* invalid initiation attempt, close SA */
                        return DESTROY_ME;
                }
        }
+
+       if (msg->get_first_payload_type(msg) == FRAGMENT_V1)
+       {
+               return handle_fragment(this, msg);
+       }
        return status;
 }
 
@@ -1018,8 +1442,8 @@ METHOD(task_manager_t, process_message, status_t,
                        {
                                DBG1(DBG_IKE, "received retransmit of response with ID %u, "
                                         "resending last request", mid);
-                               charon->sender->send(charon->sender,
-                                               this->initiating.packet->clone(this->initiating.packet));
+                               send_packet(this, TRUE,
+                                       this->initiating.packet->clone(this->initiating.packet));
                                return SUCCESS;
                        }
                        DBG1(DBG_IKE, "received retransmit of response with ID %u, "
@@ -1036,6 +1460,10 @@ METHOD(task_manager_t, process_message, status_t,
                msg->set_request(msg, FALSE);
                charon->bus->message(charon->bus, msg, TRUE, FALSE);
                status = parse_message(this, msg);
+               if (status == NEED_MORE)
+               {
+                       return SUCCESS;
+               }
                if (status != SUCCESS)
                {
                        return status;
@@ -1060,7 +1488,7 @@ METHOD(task_manager_t, process_message, status_t,
                        {
                                DBG1(DBG_IKE, "received retransmit of request with ID %u, "
                                         "retransmitting response", mid);
-                               charon->sender->send(charon->sender,
+                               send_packet(this, FALSE,
                                                this->responding.packet->clone(this->responding.packet));
                        }
                        else if (this->initiating.packet &&
@@ -1068,7 +1496,7 @@ METHOD(task_manager_t, process_message, status_t,
                        {
                                DBG1(DBG_IKE, "received retransmit of DPD request, "
                                         "retransmitting response");
-                               charon->sender->send(charon->sender,
+                               send_packet(this, TRUE,
                                                this->initiating.packet->clone(this->initiating.packet));
                        }
                        else
@@ -1076,8 +1504,24 @@ METHOD(task_manager_t, process_message, status_t,
                                DBG1(DBG_IKE, "received retransmit of request with ID %u, "
                                         "but no response to retransmit", mid);
                        }
+                       charon->bus->alert(charon->bus, ALERT_RETRANSMIT_RECEIVE, msg);
                        return SUCCESS;
                }
+
+               /* reject Main/Aggressive Modes once established */
+               if (msg->get_exchange_type(msg) == ID_PROT ||
+                       msg->get_exchange_type(msg) == AGGRESSIVE)
+               {
+                       if (this->ike_sa->get_state(this->ike_sa) != IKE_CREATED &&
+                               this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING &&
+                               msg->get_first_payload_type(msg) != FRAGMENT_V1)
+                       {
+                               DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
+                                        exchange_type_names, msg->get_exchange_type(msg));
+                               return FAILED;
+                       }
+               }
+
                if (msg->get_exchange_type(msg) == TRANSACTION &&
                        this->active_tasks->get_count(this->active_tasks))
                {       /* main mode not yet complete, queue XAuth/Mode config tasks */
@@ -1102,6 +1546,10 @@ METHOD(task_manager_t, process_message, status_t,
                msg->set_request(msg, TRUE);
                charon->bus->message(charon->bus, msg, TRUE, FALSE);
                status = parse_message(this, msg);
+               if (status == NEED_MORE)
+               {
+                       return SUCCESS;
+               }
                if (status != SUCCESS)
                {
                        return status;
@@ -1113,7 +1561,8 @@ METHOD(task_manager_t, process_message, status_t,
                        ike_cfg_t *ike_cfg;
                        job_t *job;
 
-                       ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
+                       ike_cfg = charon->backends->get_ike_cfg(charon->backends,
+                                                                                                       me, other, IKEV1);
                        if (ike_cfg == NULL)
                        {
                                /* no config found for these hosts, destroy */
@@ -1193,6 +1642,7 @@ METHOD(task_manager_t, queue_ike, void,
                {
                        queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
                }
+               this->frag.exchange = AGGRESSIVE;
        }
        else
        {
@@ -1231,11 +1681,12 @@ METHOD(task_manager_t, queue_ike_reauth, void,
        new->set_other_host(new, host->clone(host));
        host = this->ike_sa->get_my_host(this->ike_sa);
        new->set_my_host(new, host->clone(host));
-       host = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
-       if (host)
+       enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
+       while (enumerator->enumerate(enumerator, &host))
        {
-               new->set_virtual_ip(new, TRUE, host);
+               new->add_virtual_ip(new, TRUE, host);
        }
+       enumerator->destroy(enumerator);
 
        enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
        while (enumerator->enumerate(enumerator, &child_sa))
@@ -1317,6 +1768,72 @@ METHOD(task_manager_t, queue_child, void,
        queue_task(this, &task->task);
 }
 
+/**
+ * Check if two CHILD_SAs have the same traffic selector
+ */
+static bool have_equal_ts(child_sa_t *child1, child_sa_t *child2, bool local)
+{
+       enumerator_t *e1, *e2;
+       traffic_selector_t *ts1, *ts2;
+       bool equal = FALSE;
+
+       e1 = child1->create_ts_enumerator(child1, local);
+       e2 = child2->create_ts_enumerator(child2, local);
+       if (e1->enumerate(e1, &ts1) && e2->enumerate(e2, &ts2))
+       {
+               equal = ts1->equals(ts1, ts2);
+       }
+       e2->destroy(e2);
+       e1->destroy(e1);
+
+       return equal;
+}
+
+/**
+ * Check if a CHILD_SA is redundant and we should delete instead of rekey
+ */
+static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
+{
+       enumerator_t *enumerator;
+       child_sa_t *current;
+       bool redundant = FALSE;
+
+       enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
+       while (enumerator->enumerate(enumerator, &current))
+       {
+               if (current->get_state(current) == CHILD_INSTALLED &&
+                       streq(current->get_name(current), child_sa->get_name(child_sa)) &&
+                       have_equal_ts(current, child_sa, TRUE) &&
+                       have_equal_ts(current, child_sa, FALSE) &&
+                       current->get_lifetime(current, FALSE) >
+                               child_sa->get_lifetime(child_sa, FALSE))
+               {
+                       DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
+                                child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
+                       redundant = TRUE;
+                       break;
+               }
+       }
+       enumerator->destroy(enumerator);
+
+       return redundant;
+}
+
+/**
+ * Get the first traffic selector of a CHILD_SA, local or remote
+ */
+static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
+{
+       traffic_selector_t *ts = NULL;
+       enumerator_t *enumerator;
+
+       enumerator = child_sa->create_ts_enumerator(child_sa, local);
+       enumerator->enumerate(enumerator, &ts);
+       enumerator->destroy(enumerator);
+
+       return ts;
+}
+
 METHOD(task_manager_t, queue_child_rekey, void,
        private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
 {
@@ -1331,13 +1848,22 @@ METHOD(task_manager_t, queue_child_rekey, void,
        }
        if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
        {
-               child_sa->set_state(child_sa, CHILD_REKEYING);
-               cfg = child_sa->get_config(child_sa);
-               task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg), NULL, NULL);
-               task->use_reqid(task, child_sa->get_reqid(child_sa));
-               task->rekey(task, child_sa->get_spi(child_sa, TRUE));
-
-               queue_task(this, &task->task);
+               if (is_redundant(this, child_sa))
+               {
+                       queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
+                                                                                               protocol, spi, FALSE, FALSE));
+               }
+               else
+               {
+                       child_sa->set_state(child_sa, CHILD_REKEYING);
+                       cfg = child_sa->get_config(child_sa);
+                       task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
+                               get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
+                       task->use_reqid(task, child_sa->get_reqid(child_sa));
+                       task->rekey(task, child_sa->get_spi(child_sa, TRUE));
+
+                       queue_task(this, &task->task);
+               }
        }
 }
 
@@ -1352,8 +1878,28 @@ METHOD(task_manager_t, queue_child_delete, void,
 METHOD(task_manager_t, queue_dpd, void,
        private_task_manager_t *this)
 {
-       queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, TRUE,
+       peer_cfg_t *peer_cfg;
+       u_int32_t t, retransmit;
+
+       queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
                                                                                                this->dpd_send++));
+       peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
+
+       /* compute timeout in milliseconds */
+       t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
+       if (t == 0)
+       {
+               /* use the same timeout as a retransmitting IKE message would have */
+               for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
+               {
+                       t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
+                                                       pow(this->retransmit_base, retransmit));
+               }
+       }
+
+       /* schedule DPD timeout job */
+       lib->scheduler->schedule_job_ms(lib->scheduler,
+               (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
 }
 
 METHOD(task_manager_t, adopt_tasks, void,
@@ -1372,6 +1918,39 @@ METHOD(task_manager_t, adopt_tasks, void,
        }
 }
 
+/**
+ * Migrates child-creating tasks from src to dst
+ */
+static void migrate_child_tasks(private_task_manager_t *this,
+                                                               linked_list_t *src, linked_list_t *dst)
+{
+       enumerator_t *enumerator;
+       task_t *task;
+
+       enumerator = src->create_enumerator(src);
+       while (enumerator->enumerate(enumerator, &task))
+       {
+               if (task->get_type(task) == TASK_QUICK_MODE)
+               {
+                       src->remove_at(src, enumerator);
+                       task->migrate(task, this->ike_sa);
+                       dst->insert_last(dst, task);
+               }
+       }
+       enumerator->destroy(enumerator);
+}
+
+METHOD(task_manager_t, adopt_child_tasks, void,
+       private_task_manager_t *this, task_manager_t *other_public)
+{
+       private_task_manager_t *other = (private_task_manager_t*)other_public;
+
+       /* move active child tasks from other to this */
+       migrate_child_tasks(this, other->active_tasks, this->queued_tasks);
+       /* do the same for queued tasks */
+       migrate_child_tasks(this, other->queued_tasks, this->queued_tasks);
+}
+
 METHOD(task_manager_t, busy, bool,
        private_task_manager_t *this)
 {
@@ -1400,6 +1979,7 @@ METHOD(task_manager_t, reset, void,
        this->initiating.seqnr = 0;
        this->initiating.retransmitted = 0;
        this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
+       clear_fragments(this, 0);
        if (initiate != UINT_MAX)
        {
                this->dpd_send = initiate;
@@ -1450,6 +2030,7 @@ METHOD(task_manager_t, destroy, void,
        this->active_tasks->destroy(this->active_tasks);
        this->queued_tasks->destroy(this->queued_tasks);
        this->passive_tasks->destroy(this->passive_tasks);
+       clear_fragments(this, 0);
 
        DESTROY_IF(this->queued);
        DESTROY_IF(this->responding.packet);
@@ -1484,8 +2065,11 @@ task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
                                .incr_mid = _incr_mid,
                                .reset = _reset,
                                .adopt_tasks = _adopt_tasks,
+                               .adopt_child_tasks = _adopt_child_tasks,
                                .busy = _busy,
                                .create_task_enumerator = _create_task_enumerator,
+                               .flush = _flush,
+                               .flush_queue = _flush_queue,
                                .destroy = _destroy,
                        },
                },
@@ -1495,6 +2079,13 @@ task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
                .responding = {
                        .seqnr = RESPONDING_SEQ,
                },
+               .frag = {
+                       .exchange = ID_PROT,
+                       .max_packet = lib->settings->get_int(lib->settings,
+                                       "%s.max_packet", MAX_PACKET, charon->name),
+                       .size = lib->settings->get_int(lib->settings,
+                                       "%s.fragment_size", MAX_FRAGMENT_SIZE, charon->name),
+               },
                .ike_sa = ike_sa,
                .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
                .queued_tasks = linked_list_create(),
@@ -1514,11 +2105,14 @@ task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
                destroy(this);
                return NULL;
        }
-
-       this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
-                                                (void*)&this->dpd_send);
+       if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
+                                                         (void*)&this->dpd_send))
+       {
+               DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
+               destroy(this);
+               return NULL;
+       }
        this->dpd_send &= 0x7FFFFFFF;
 
        return &this->public;
 }
-