Compiler warning fixed.
[strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
old mode 100644 (file)
new mode 100755 (executable)
index dfc9608..1c9b43a
@@ -20,6 +20,7 @@
 
 #include <daemon.h>
 #include <sa/ikev1/tasks/main_mode.h>
+#include <sa/ikev1/tasks/aggressive_mode.h>
 #include <sa/ikev1/tasks/quick_mode.h>
 #include <sa/ikev1/tasks/quick_delete.h>
 #include <sa/ikev1/tasks/xauth.h>
@@ -30,6 +31,8 @@
 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
 #include <sa/ikev1/tasks/isakmp_cert_post.h>
 #include <sa/ikev1/tasks/isakmp_delete.h>
+#include <sa/ikev1/tasks/isakmp_dpd.h>
+
 #include <processing/jobs/retransmit_job.h>
 #include <processing/jobs/delete_ike_sa_job.h>
 
  */
 #define MAX_OLD_HASHES 2
 
+/**
+ * First sequence number of responding packets.
+ *
+ * To distinguish retransmission jobs for initiating and responding packets,
+ * we split up the sequence counter and use the upper half for responding.
+ */
+#define RESPONDING_SEQ INT_MAX
+
 typedef struct exchange_t exchange_t;
 
 /**
@@ -87,6 +98,11 @@ struct private_task_manager_t {
         */
        struct {
                /**
+                * Message ID of the last response
+                */
+               u_int32_t mid;
+
+               /**
                 * Hash of a previously received message
                 */
                u_int32_t hash;
@@ -96,6 +112,16 @@ struct private_task_manager_t {
                 */
                packet_t *packet;
 
+               /**
+                * Sequence number of the last sent message
+                */
+               u_int32_t seqnr;
+
+               /**
+                * how many times we have retransmitted so far
+                */
+               u_int retransmitted;
+
        } responding;
 
        /**
@@ -173,6 +199,16 @@ struct private_task_manager_t {
         * Base to calculate retransmission timeout
         */
        double retransmit_base;
+
+       /**
+        * Sequence number for sending DPD requests
+        */
+       u_int32_t dpd_send;
+
+       /**
+        * Sequence number for received DPD requests
+        */
+       u_int32_t dpd_recv;
 };
 
 /**
@@ -228,46 +264,63 @@ static bool activate_task(private_task_manager_t *this, task_type_t type)
        return found;
 }
 
-METHOD(task_manager_t, retransmit, status_t,
-       private_task_manager_t *this, u_int32_t message_seqnr)
+/**
+ * Retransmit a packet, either as initiator or as responder
+ */
+static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
+                                                       u_int mid, u_int retransmitted, packet_t *packet)
 {
-       /* this.initiating packet used as marker for received response */
-       if (message_seqnr == this->initiating.seqnr && this->initiating.packet )
-       {
-               u_int32_t timeout;
-               packet_t *packet;
-               job_t *job;
+       u_int32_t t;
 
-               if (this->initiating.retransmitted <= this->retransmit_tries)
+       if (retransmitted > this->retransmit_tries)
+       {
+               DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
+               if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
                {
-                       timeout = (u_int32_t)(this->retransmit_timeout * 1000.0 *
-                               pow(this->retransmit_base, this->initiating.retransmitted));
+                       charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
                }
-               else
+               return DESTROY_ME;
+       }
+       t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
+                                       pow(this->retransmit_base, retransmitted));
+       if (retransmitted)
+       {
+               DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
+                        retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
+                        mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
+       }
+       charon->sender->send(charon->sender, packet->clone(packet));
+       lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
+                       retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
+       return NEED_MORE;
+}
+
+METHOD(task_manager_t, retransmit, status_t,
+       private_task_manager_t *this, u_int32_t seqnr)
+{
+       status_t status = SUCCESS;
+
+       if (seqnr == this->initiating.seqnr && this->initiating.packet)
+       {
+               status = retransmit_packet(this, seqnr, this->initiating.mid,
+                                       this->initiating.retransmitted, this->initiating.packet);
+               if (status == NEED_MORE)
                {
-                       DBG1(DBG_IKE, "giving up after %d retransmits",
-                                this->initiating.retransmitted - 1);
-                       if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
-                       {
-                               charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
-                       }
-                       return DESTROY_ME;
+                       this->initiating.retransmitted++;
+                       status = SUCCESS;
                }
-
-               if (this->initiating.retransmitted)
+       }
+       if (seqnr == this->responding.seqnr && this->responding.packet)
+       {
+               status = retransmit_packet(this, seqnr, this->responding.mid,
+                                       this->responding.retransmitted, this->responding.packet);
+               if (status == NEED_MORE)
                {
-                       DBG1(DBG_IKE, "retransmit %d of request with message ID %u seqnr (%d)",
-                                this->initiating.retransmitted, this->initiating.mid, message_seqnr);
+                       this->responding.retransmitted++;
+                       status = SUCCESS;
                }
-               packet = this->initiating.packet->clone(this->initiating.packet);
-               charon->sender->send(charon->sender, packet);
-
-               this->initiating.retransmitted++;
-               job = (job_t*)retransmit_job_create(this->initiating.seqnr,
-                                                                                       this->ike_sa->get_id(this->ike_sa));
-               lib->scheduler->schedule_job_ms(lib->scheduler, job, timeout);
        }
-       return SUCCESS;
+       return status;
 }
 
 METHOD(task_manager_t, initiate, status_t,
@@ -279,15 +332,10 @@ METHOD(task_manager_t, initiate, status_t,
        host_t *me, *other;
        status_t status;
        exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
-       bool new_mid = FALSE, expect_response = FALSE, flushed = FALSE;
+       bool new_mid = FALSE, expect_response = FALSE, flushed = FALSE, keep = FALSE;
 
-       if (!this->rng)
-       {
-               DBG1(DBG_IKE, "no RNG supported");
-               return FAILED;
-       }
-
-       if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED)
+       if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
+               this->initiating.type != INFORMATIONAL_V1)
        {
                DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
                                exchange_type_names, this->initiating.type);
@@ -306,9 +354,13 @@ METHOD(task_manager_t, initiate, status_t,
                                if (activate_task(this, TASK_MAIN_MODE))
                                {
                                        exchange = ID_PROT;
-                                       activate_task(this, TASK_ISAKMP_CERT_POST);
-                                       activate_task(this, TASK_ISAKMP_NATD);
                                }
+                               else if (activate_task(this, TASK_AGGRESSIVE_MODE))
+                               {
+                                       exchange = AGGRESSIVE;
+                               }
+                               activate_task(this, TASK_ISAKMP_CERT_POST);
+                               activate_task(this, TASK_ISAKMP_NATD);
                                break;
                        case IKE_CONNECTING:
                                if (activate_task(this, TASK_ISAKMP_DELETE))
@@ -349,13 +401,19 @@ METHOD(task_manager_t, initiate, status_t,
                                        new_mid = TRUE;
                                        break;
                                }
+                               if (activate_task(this, TASK_QUICK_DELETE))
+                               {
+                                       exchange = INFORMATIONAL_V1;
+                                       new_mid = TRUE;
+                                       break;
+                               }
                                if (activate_task(this, TASK_ISAKMP_DELETE))
                                {
                                        exchange = INFORMATIONAL_V1;
                                        new_mid = TRUE;
                                        break;
                                }
-                               if (activate_task(this, TASK_QUICK_DELETE))
+                               if (activate_task(this, TASK_ISAKMP_DPD))
                                {
                                        exchange = INFORMATIONAL_V1;
                                        new_mid = TRUE;
@@ -378,6 +436,9 @@ METHOD(task_manager_t, initiate, status_t,
                                case TASK_MAIN_MODE:
                                        exchange = ID_PROT;
                                        break;
+                               case TASK_AGGRESSIVE_MODE:
+                                       exchange = AGGRESSIVE;
+                                       break;
                                case TASK_QUICK_MODE:
                                        exchange = QUICK_MODE;
                                        break;
@@ -424,6 +485,11 @@ METHOD(task_manager_t, initiate, status_t,
                        case SUCCESS:
                                /* task completed, remove it */
                                this->active_tasks->remove_at(this->active_tasks, enumerator);
+                               if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
+                                       task->get_type(task) == TASK_QUICK_MODE)
+                               {       /* last message of three message exchange */
+                                       keep = TRUE;
+                               }
                                task->destroy(task);
                                continue;
                        case NEED_MORE:
@@ -452,17 +518,29 @@ METHOD(task_manager_t, initiate, status_t,
        }
        enumerator->destroy(enumerator);
 
-       if (this->active_tasks->get_count(this->active_tasks) == 0)
+       if (this->active_tasks->get_count(this->active_tasks) == 0 &&
+               (exchange == QUICK_MODE || exchange == AGGRESSIVE))
        {       /* tasks completed, no exchange active anymore */
                this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
        }
+       if (exchange == INFORMATIONAL_V1)
+       {
+               if (message->get_notify(message, DPD_R_U_THERE))
+               {
+                       expect_response = TRUE;
+               }
+               if (message->get_notify(message, DPD_R_U_THERE_ACK))
+               {
+                       keep = TRUE;
+               }
+       }
        if (flushed)
        {
                message->destroy(message);
                return initiate(this);
        }
-       this->initiating.seqnr++;
 
+       DESTROY_IF(this->initiating.packet);
        status = this->ike_sa->generate_message(this->ike_sa, message,
                                                                                        &this->initiating.packet);
        if (status != SUCCESS)
@@ -474,16 +552,24 @@ METHOD(task_manager_t, initiate, status_t,
                charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
                return DESTROY_ME;
        }
-       message->destroy(message);
 
-       if (expect_response)
+       this->initiating.seqnr++;
+       if (expect_response )
        {
+               message->destroy(message);
                return retransmit(this, this->initiating.seqnr);
        }
-       charon->sender->send(charon->sender,
-                               this->initiating.packet->clone(this->initiating.packet));
-       this->initiating.packet->destroy(this->initiating.packet);
-       this->initiating.packet = NULL;
+       if (keep)
+       {       /* keep the packet for retransmission, the responder might request it */
+               charon->sender->send(charon->sender,
+                                       this->initiating.packet->clone(this->initiating.packet));
+       }
+       else
+       {
+               charon->sender->send(charon->sender, this->initiating.packet);
+               this->initiating.packet = NULL;
+       }
+       message->destroy(message);
 
        if (exchange == INFORMATIONAL_V1)
        {
@@ -499,15 +585,7 @@ METHOD(task_manager_t, initiate, status_t,
                                break;
                }
        }
-       return SUCCESS;
-}
-
-/**
- * handle exchange collisions
- */
-static bool handle_collisions(private_task_manager_t *this, task_t *task)
-{
-       return FALSE;
+       return initiate(this);
 }
 
 /**
@@ -519,7 +597,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
        task_t *task;
        message_t *message;
        host_t *me, *other;
-       bool delete = FALSE, flushed = FALSE;
+       bool delete = FALSE, flushed = FALSE, expect_request = FALSE;
        status_t status;
 
        me = request->get_destination(request);
@@ -533,6 +611,10 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
        message->set_message_id(message, request->get_message_id(request));
        message->set_request(message, FALSE);
 
+       this->responding.mid = request->get_message_id(request);
+       this->responding.retransmitted = 0;
+       this->responding.seqnr++;
+
        enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
        while (enumerator->enumerate(enumerator, (void*)&task))
        {
@@ -541,17 +623,15 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
                        case SUCCESS:
                                /* task completed, remove it */
                                this->passive_tasks->remove_at(this->passive_tasks, enumerator);
-                               if (!handle_collisions(this, task))
-                               {
-                                       task->destroy(task);
-                               }
+                               task->destroy(task);
                                continue;
                        case NEED_MORE:
                                /* processed, but task needs another exchange */
-                               if (handle_collisions(this, task))
-                               {
-                                       this->passive_tasks->remove_at(this->passive_tasks,
-                                                                                                  enumerator);
+                               if (task->get_type(task) == TASK_QUICK_MODE ||
+                                       task->get_type(task) == TASK_AGGRESSIVE_MODE)
+                               {       /* we rely on initiator retransmission, except for
+                                        * three-message exchanges */
+                                       expect_request = TRUE;
                                }
                                continue;
                        case ALREADY_DONE:
@@ -587,8 +667,12 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
                return DESTROY_ME;
        }
 
+       if (expect_request && !delete)
+       {
+               return retransmit(this, this->responding.seqnr);
+       }
        charon->sender->send(charon->sender,
-                                                this->responding.packet->clone(this->responding.packet));
+                                       this->responding.packet->clone(this->responding.packet));
        if (delete)
        {
                return DESTROY_ME;
@@ -653,9 +737,12 @@ static status_t process_request(private_task_manager_t *this,
 {
        enumerator_t *enumerator;
        task_t *task = NULL;
-       bool send_response = FALSE;
+       bool send_response = FALSE, dpd = FALSE;
+       notify_payload_t *notify;
+       chunk_t data;
 
-       if (this->passive_tasks->get_count(this->passive_tasks) == 0)
+       if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
+               this->passive_tasks->get_count(this->passive_tasks) == 0)
        {       /* create tasks depending on request type, if not already some queued */
                switch (message->get_exchange_type(message))
                {
@@ -672,8 +759,17 @@ static status_t process_request(private_task_manager_t *this,
                                this->passive_tasks->insert_last(this->passive_tasks, task);
                                break;
                        case AGGRESSIVE:
-                               /* TODO-IKEv1: agressive mode */
-                               return FAILED;
+                               task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
+                               this->passive_tasks->insert_last(this->passive_tasks, task);
+                               task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
+                               this->passive_tasks->insert_last(this->passive_tasks, task);
+                               task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
+                               this->passive_tasks->insert_last(this->passive_tasks, task);
+                               task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
+                               this->passive_tasks->insert_last(this->passive_tasks, task);
+                               task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
+                               this->passive_tasks->insert_last(this->passive_tasks, task);
+                               break;
                        case QUICK_MODE:
                                if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
                                {
@@ -686,8 +782,29 @@ static status_t process_request(private_task_manager_t *this,
                                this->passive_tasks->insert_last(this->passive_tasks, task);
                                break;
                        case INFORMATIONAL_V1:
-                               task = (task_t *)informational_create(this->ike_sa, NULL);
-                               this->passive_tasks->insert_last(this->passive_tasks, task);
+                               notify = message->get_notify(message, DPD_R_U_THERE);
+                               if (notify)
+                               {
+                                       data = notify->get_notification_data(notify);
+                                       if (this->dpd_recv == 0 && data.len == 4)
+                                       {       /* first DPD request, initialize counter */
+                                               this->dpd_recv = untoh32(data.ptr);
+                                       }
+                                       task = (task_t *)isakmp_dpd_create(this->ike_sa, FALSE,
+                                                                                                          this->dpd_recv++);
+                                       dpd = TRUE;
+                               }
+                               else if (message->get_notify(message, DPD_R_U_THERE_ACK))
+                               {
+                                       task = (task_t *)isakmp_dpd_create(this->ike_sa, TRUE,
+                                                                                                          this->dpd_send - 1);
+                                       dpd = TRUE;
+                               }
+                               else
+                               {
+                                       task = (task_t *)informational_create(this->ike_sa, NULL);
+                               }
+                               this->passive_tasks->insert_first(this->passive_tasks, task);
                                break;
                        case TRANSACTION:
                                if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
@@ -704,6 +821,11 @@ static status_t process_request(private_task_manager_t *this,
                                return FAILED;
                }
        }
+       if (!dpd)
+       {
+               this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
+                                                                       time_monotonic(NULL));
+       }
        /* let the tasks process the message */
        enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
        while (enumerator->enumerate(enumerator, (void*)&task))
@@ -738,6 +860,12 @@ static status_t process_request(private_task_manager_t *this,
        }
        enumerator->destroy(enumerator);
 
+       if (dpd && this->initiating.type == INFORMATIONAL_V1)
+       {       /* got a DPD reply, cancel any retransmission */
+               this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
+               DESTROY_IF(this->initiating.packet);
+               this->initiating.packet = NULL;
+       }
        if (send_response)
        {
                if (build_response(this, message) != SUCCESS)
@@ -894,6 +1022,17 @@ METHOD(task_manager_t, process_message, status_t,
        {
                if (this->initiating.old_hashes[i] == hash)
                {
+                       if (this->initiating.packet &&
+                               i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
+                               (msg->get_exchange_type(msg) == QUICK_MODE ||
+                                msg->get_exchange_type(msg) == AGGRESSIVE))
+                       {
+                               DBG1(DBG_IKE, "received retransmit of response with ID %u, "
+                                        "resending last request", mid);
+                               charon->sender->send(charon->sender,
+                                               this->initiating.packet->clone(this->initiating.packet));
+                               return SUCCESS;
+                       }
                        DBG1(DBG_IKE, "received retransmit of response with ID %u, "
                                 "but next request already sent", mid);
                        return SUCCESS;
@@ -903,9 +1042,10 @@ METHOD(task_manager_t, process_message, status_t,
        if ((mid && mid == this->initiating.mid) ||
                (this->initiating.mid == 0 &&
                 msg->get_exchange_type(msg) == this->initiating.type &&
-               this->active_tasks->get_count(this->active_tasks)))
+                this->active_tasks->get_count(this->active_tasks)))
        {
                msg->set_request(msg, FALSE);
+               charon->bus->message(charon->bus, msg, TRUE, FALSE);
                status = parse_message(this, msg);
                if (status != SUCCESS)
                {
@@ -914,13 +1054,13 @@ METHOD(task_manager_t, process_message, status_t,
                this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
                                                                        time_monotonic(NULL));
                this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
-               charon->bus->message(charon->bus, msg, FALSE);
+               charon->bus->message(charon->bus, msg, TRUE, TRUE);
                if (process_response(this, msg) != SUCCESS)
                {
                        flush(this);
                        return DESTROY_ME;
                }
-               this->initiating.old_hashes[(this->initiating.old_hash_pos++) %
+               this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
                                                                        MAX_OLD_HASHES] = hash;
        }
        else
@@ -934,6 +1074,14 @@ METHOD(task_manager_t, process_message, status_t,
                                charon->sender->send(charon->sender,
                                                this->responding.packet->clone(this->responding.packet));
                        }
+                       else if (this->initiating.packet &&
+                                        this->initiating.type == INFORMATIONAL_V1)
+                       {
+                               DBG1(DBG_IKE, "received retransmit of DPD request, "
+                                        "retransmitting response");
+                               charon->sender->send(charon->sender,
+                                               this->initiating.packet->clone(this->initiating.packet));
+                       }
                        else
                        {
                                DBG1(DBG_IKE, "received retransmit of request with ID %u, "
@@ -963,6 +1111,7 @@ METHOD(task_manager_t, process_message, status_t,
                }
 
                msg->set_request(msg, TRUE);
+               charon->bus->message(charon->bus, msg, TRUE, FALSE);
                status = parse_message(this, msg);
                if (status != SUCCESS)
                {
@@ -974,6 +1123,7 @@ METHOD(task_manager_t, process_message, status_t,
                        ike_sa_id_t *ike_sa_id;
                        ike_cfg_t *ike_cfg;
                        job_t *job;
+
                        ike_cfg = charon->backends->get_ike_cfg(charon->backends, me, other);
                        if (ike_cfg == NULL)
                        {
@@ -990,12 +1140,10 @@ METHOD(task_manager_t, process_message, status_t,
                        job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
                        lib->scheduler->schedule_job(lib->scheduler, job,
                                        lib->settings->get_int(lib->settings,
-                                               "charon.half_open_timeout",  HALF_OPEN_IKE_SA_TIMEOUT));
+                                               "charon.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT));
                }
-               this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
-                                                                       time_monotonic(NULL));
                this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
-               charon->bus->message(charon->bus, msg, TRUE);
+               charon->bus->message(charon->bus, msg, TRUE, TRUE);
                if (process_request(this, msg) != SUCCESS)
                {
                        flush(this);
@@ -1013,31 +1161,134 @@ METHOD(task_manager_t, queue_task, void,
        this->queued_tasks->insert_last(this->queued_tasks, task);
 }
 
+/**
+ * Check if a given task has been queued already
+ */
+static bool has_queued(private_task_manager_t *this, task_type_t type)
+{
+       enumerator_t *enumerator;
+       bool found = FALSE;
+       task_t *task;
+
+       enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
+       while (enumerator->enumerate(enumerator, &task))
+       {
+               if (task->get_type(task) == type)
+               {
+                       found = TRUE;
+                       break;
+               }
+       }
+       enumerator->destroy(enumerator);
+       return found;
+}
+
 METHOD(task_manager_t, queue_ike, void,
        private_task_manager_t *this)
 {
-       queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
-       queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
-       queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
-       queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
-       queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
+       peer_cfg_t *peer_cfg;
+
+       if (!has_queued(this, TASK_ISAKMP_VENDOR))
+       {
+               queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
+       }
+       if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
+       {
+               queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
+       }
+       peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
+       if (peer_cfg->use_aggressive(peer_cfg))
+       {
+               if (!has_queued(this, TASK_AGGRESSIVE_MODE))
+               {
+                       queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
+               }
+       }
+       else
+       {
+               if (!has_queued(this, TASK_MAIN_MODE))
+               {
+                       queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
+               }
+       }
+       if (!has_queued(this, TASK_ISAKMP_CERT_POST))
+       {
+               queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
+       }
+       if (!has_queued(this, TASK_ISAKMP_NATD))
+       {
+               queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
+       }
 }
 
-METHOD(task_manager_t, queue_ike_rekey, void,
+METHOD(task_manager_t, queue_ike_reauth, void,
        private_task_manager_t *this)
 {
-       /* TODO-IKEv1: IKE_SA rekeying */
+       enumerator_t *enumerator;
+       child_sa_t *child_sa;
+       ike_sa_t *new;
+       host_t *host;
+
+       new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
+                                                               this->ike_sa->get_version(this->ike_sa), TRUE);
+       if (!new)
+       {       /* shouldn't happen */
+               return;
+       }
+
+       new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
+       host = this->ike_sa->get_other_host(this->ike_sa);
+       new->set_other_host(new, host->clone(host));
+       host = this->ike_sa->get_my_host(this->ike_sa);
+       new->set_my_host(new, host->clone(host));
+       host = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
+       if (host)
+       {
+               new->set_virtual_ip(new, TRUE, host);
+       }
+
+       enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
+       while (enumerator->enumerate(enumerator, &child_sa))
+       {
+               this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
+               new->add_child_sa(new, child_sa);
+       }
+       enumerator->destroy(enumerator);
+
+       if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
+       {
+               charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
+               this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
+       }
+       else
+       {
+               charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
+               DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
+       }
+       charon->bus->set_sa(charon->bus, this->ike_sa);
 }
 
-METHOD(task_manager_t, queue_ike_reauth, void,
+METHOD(task_manager_t, queue_ike_rekey, void,
        private_task_manager_t *this)
 {
-       /* TODO-IKEv1: IKE_SA reauth */
+       queue_ike_reauth(this);
 }
 
 METHOD(task_manager_t, queue_ike_delete, void,
        private_task_manager_t *this)
 {
+       enumerator_t *enumerator;
+       child_sa_t *child_sa;
+
+       enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
+       while (enumerator->enumerate(enumerator, &child_sa))
+       {
+               queue_task(this, (task_t*)
+                       quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
+                                                               child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
+       }
+       enumerator->destroy(enumerator);
+
        queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
 }
 
@@ -1051,26 +1302,51 @@ METHOD(task_manager_t, queue_child, void,
        private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
        traffic_selector_t *tsi, traffic_selector_t *tsr)
 {
-       queue_task(this, (task_t*)quick_mode_create(this->ike_sa, cfg, tsi, tsr));
+       quick_mode_t *task;
+
+       task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
+       task->use_reqid(task, reqid);
+
+       queue_task(this, &task->task);
 }
 
 METHOD(task_manager_t, queue_child_rekey, void,
        private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
 {
-       /* TODO-IKEv1: CHILD rekeying */
+       child_sa_t *child_sa;
+       child_cfg_t *cfg;
+       quick_mode_t *task;
+
+       child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
+       if (!child_sa)
+       {
+               child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
+       }
+       if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
+       {
+               child_sa->set_state(child_sa, CHILD_REKEYING);
+               cfg = child_sa->get_config(child_sa);
+               task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg), NULL, NULL);
+               task->use_reqid(task, child_sa->get_reqid(child_sa));
+               task->rekey(task, child_sa->get_spi(child_sa, TRUE));
+
+               queue_task(this, &task->task);
+       }
 }
 
 METHOD(task_manager_t, queue_child_delete, void,
-       private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
+       private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
+       bool expired)
 {
        queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
-                                                                                                 spi, FALSE));
+                                                                                                 spi, FALSE, expired));
 }
 
 METHOD(task_manager_t, queue_dpd, void,
        private_task_manager_t *this)
 {
-       /* TODO-IKEv1: DPD checking */
+       queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, TRUE,
+                                                                                               this->dpd_send++));
 }
 
 METHOD(task_manager_t, adopt_tasks, void,
@@ -1103,6 +1379,44 @@ METHOD(task_manager_t, incr_mid, void,
 METHOD(task_manager_t, reset, void,
        private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
 {
+       enumerator_t *enumerator;
+       task_t *task;
+
+       /* reset message counters and retransmit packets */
+       DESTROY_IF(this->responding.packet);
+       DESTROY_IF(this->initiating.packet);
+       this->responding.packet = NULL;
+       this->responding.seqnr = RESPONDING_SEQ;
+       this->responding.retransmitted = 0;
+       this->initiating.packet = NULL;
+       this->initiating.mid = 0;
+       this->initiating.seqnr = 0;
+       this->initiating.retransmitted = 0;
+       this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
+       if (initiate != UINT_MAX)
+       {
+               this->dpd_send = initiate;
+       }
+       if (respond != UINT_MAX)
+       {
+               this->dpd_recv = respond;
+       }
+
+       /* reset queued tasks */
+       enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
+       while (enumerator->enumerate(enumerator, &task))
+       {
+               task->migrate(task, this->ike_sa);
+       }
+       enumerator->destroy(enumerator);
+
+       /* reset active tasks */
+       while (this->active_tasks->remove_last(this->active_tasks,
+                                                                                  (void**)&task) == SUCCESS)
+       {
+               task->migrate(task, this->ike_sa);
+               this->queued_tasks->insert_first(this->queued_tasks, task);
+       }
 }
 
 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
@@ -1168,8 +1482,13 @@ task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
                                .destroy = _destroy,
                        },
                },
+               .initiating = {
+                       .type = EXCHANGE_TYPE_UNDEFINED,
+               },
+               .responding = {
+                       .seqnr = RESPONDING_SEQ,
+               },
                .ike_sa = ike_sa,
-               .initiating.type = EXCHANGE_TYPE_UNDEFINED,
                .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
                .queued_tasks = linked_list_create(),
                .active_tasks = linked_list_create(),
@@ -1182,5 +1501,17 @@ task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
                                                                "charon.retransmit_base", RETRANSMIT_BASE),
        );
 
+       if (!this->rng)
+       {
+               DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
+               destroy(this);
+               return NULL;
+       }
+
+       this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
+                                                (void*)&this->dpd_send);
+       this->dpd_send &= 0x7FFFFFFF;
+
        return &this->public;
 }
+