child-delete: Delay the removal of the inbound SA of rekeyed CHILD_SAs
[strongswan.git] / src / libcharon / sa / ikev2 / tasks / child_rekey.c
index b32d2d7..761c860 100644 (file)
@@ -1,7 +1,8 @@
 /*
+ * Copyright (C) 2009-2016 Tobias Brunner
  * Copyright (C) 2005-2007 Martin Willi
  * Copyright (C) 2005 Jan Hutter
- * Hochschule fuer Technik Rapperswil
+ * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -131,6 +132,7 @@ static void find_child(private_child_rekey_t *this, message_t *message)
        notify_payload_t *notify;
        protocol_id_t protocol;
        uint32_t spi;
+       child_sa_t *child_sa;
 
        notify = message->get_notify(message, REKEY_SA);
        if (notify)
@@ -140,8 +142,15 @@ static void find_child(private_child_rekey_t *this, message_t *message)
 
                if (protocol == PROTO_ESP || protocol == PROTO_AH)
                {
-                       this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
-                                                                                                               spi, FALSE);
+                       child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
+                                                                                                 spi, FALSE);
+                       if (child_sa &&
+                               child_sa->get_state(child_sa) == CHILD_DELETING &&
+                               child_sa->get_outbound_state(child_sa) == CHILD_OUTBOUND_NONE)
+                       {       /* ignore rekeyed CHILD_SAs we keep around */
+                               return;
+                       }
+                       this->child_sa = child_sa;
                }
        }
 }
@@ -159,14 +168,21 @@ METHOD(task_t, build_i, status_t,
        {       /* check if it is an outbound CHILD_SA */
                this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
                                                                                                        this->spi, FALSE);
-               if (!this->child_sa)
-               {       /* CHILD_SA is gone, unable to rekey. As an empty CREATE_CHILD_SA
-                        * exchange is invalid, we fall back to an INFORMATIONAL exchange.*/
-                       message->set_exchange_type(message, INFORMATIONAL);
-                       return SUCCESS;
+               if (this->child_sa)
+               {
+                       /* we work only with the inbound SPI */
+                       this->spi = this->child_sa->get_spi(this->child_sa, TRUE);
                }
-               /* we work only with the inbound SPI */
-               this->spi = this->child_sa->get_spi(this->child_sa, TRUE);
+       }
+       if (!this->child_sa ||
+               (!this->child_create &&
+                 this->child_sa->get_state(this->child_sa) != CHILD_INSTALLED) ||
+               (this->child_create &&
+                this->child_sa->get_state(this->child_sa) != CHILD_REKEYING))
+       {
+               /* CHILD_SA is gone or in the wrong state, unable to rekey */
+               message->set_exchange_type(message, EXCHANGE_TYPE_UNDEFINED);
+               return SUCCESS;
        }
        config = this->child_sa->get_config(this->child_sa);
 
@@ -218,6 +234,8 @@ METHOD(task_t, build_r, status_t,
 {
        child_cfg_t *config;
        uint32_t reqid;
+       child_sa_state_t state;
+       child_sa_t *child_sa;
 
        if (!this->child_sa)
        {
@@ -242,14 +260,19 @@ METHOD(task_t, build_r, status_t,
        this->child_create->set_config(this->child_create, config->get_ref(config));
        this->child_create->task.build(&this->child_create->task, message);
 
+       state = this->child_sa->get_state(this->child_sa);
+       this->child_sa->set_state(this->child_sa, CHILD_REKEYING);
+
        if (message->get_payload(message, PLV2_SECURITY_ASSOCIATION) == NULL)
-       {
-               /* rekeying failed, reuse old child */
-               this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
+       {       /* rekeying failed, reuse old child */
+               this->child_sa->set_state(this->child_sa, state);
                return SUCCESS;
        }
 
-       this->child_sa->set_state(this->child_sa, CHILD_REKEYING);
+       child_sa = this->child_create->get_child(this->child_create);
+       this->child_sa->set_state(this->child_sa, CHILD_REKEYED);
+       this->child_sa->set_rekey_spi(this->child_sa,
+                                                                 child_sa->get_spi(child_sa, FALSE));
 
        /* invoke rekey hook */
        charon->bus->child_rekey(charon->bus, this->child_sa,
@@ -289,9 +312,9 @@ static child_sa_t *handle_collision(private_child_rekey_t *this)
                                if (child_sa)
                                {
                                        child_sa->set_close_action(child_sa, ACTION_NONE);
-                                       if (child_sa->get_state(child_sa) != CHILD_REKEYING)
+                                       if (child_sa->get_state(child_sa) != CHILD_REKEYED)
                                        {
-                                               child_sa->set_state(child_sa, CHILD_REKEYING);
+                                               child_sa->set_state(child_sa, CHILD_REKEYED);
                                        }
                                }
                        }
@@ -410,9 +433,9 @@ METHOD(task_t, process_i, status_t,
                return SUCCESS;
        }
        /* disable updown event for redundant CHILD_SA */
-       if (to_delete->get_state(to_delete) != CHILD_REKEYING)
+       if (to_delete->get_state(to_delete) != CHILD_REKEYED)
        {
-               to_delete->set_state(to_delete, CHILD_REKEYING);
+               to_delete->set_state(to_delete, CHILD_REKEYED);
        }
        spi = to_delete->get_spi(to_delete, TRUE);
        protocol = to_delete->get_protocol(to_delete);
@@ -431,6 +454,18 @@ METHOD(task_t, get_type, task_type_t,
        return TASK_CHILD_REKEY;
 }
 
+METHOD(child_rekey_t, is_redundant, bool,
+       private_child_rekey_t *this, child_sa_t *child)
+{
+       if (this->collision &&
+               this->collision->get_type(this->collision) == TASK_CHILD_REKEY)
+       {
+               private_child_rekey_t *rekey = (private_child_rekey_t*)this->collision;
+               return child == rekey->child_create->get_child(rekey->child_create);
+       }
+       return FALSE;
+}
+
 METHOD(child_rekey_t, collide, void,
        private_child_rekey_t *this, task_t *other)
 {
@@ -439,9 +474,18 @@ METHOD(child_rekey_t, collide, void,
        if (other->get_type(other) == TASK_CHILD_REKEY)
        {
                private_child_rekey_t *rekey = (private_child_rekey_t*)other;
+               child_sa_t *other_child;
+
                if (rekey->child_sa != this->child_sa)
+               {       /* not the same child => no collision */
+                       other->destroy(other);
+                       return;
+               }
+               /* ignore passive tasks that did not successfully create a CHILD_SA */
+               other_child = rekey->child_create->get_child(rekey->child_create);
+               if (!other_child ||
+                        other_child->get_state(other_child) != CHILD_INSTALLED)
                {
-                       /* not the same child => no collision */
                        other->destroy(other);
                        return;
                }
@@ -449,19 +493,11 @@ METHOD(child_rekey_t, collide, void,
        else if (other->get_type(other) == TASK_CHILD_DELETE)
        {
                child_delete_t *del = (child_delete_t*)other;
-               if (this->collision &&
-                       this->collision->get_type(this->collision) == TASK_CHILD_REKEY)
+               if (is_redundant(this, del->get_child(del)))
                {
-                       private_child_rekey_t *rekey;
-
-                       rekey = (private_child_rekey_t*)this->collision;
-                       if (del->get_child(del) == rekey->child_create->get_child(rekey->child_create))
-                       {
-                               /* peer deletes redundant child created in collision */
-                               this->other_child_destroyed = TRUE;
-                               other->destroy(other);
-                               return;
-                       }
+                       this->other_child_destroyed = TRUE;
+                       other->destroy(other);
+                       return;
                }
                if (del->get_child(del) != this->child_sa)
                {
@@ -472,7 +508,7 @@ METHOD(child_rekey_t, collide, void,
        }
        else
        {
-               /* any other task is not critical for collisisions, ignore */
+               /* any other task is not critical for collisions, ignore */
                other->destroy(other);
                return;
        }
@@ -529,6 +565,7 @@ child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, protocol_id_t protocol,
                                .migrate = _migrate,
                                .destroy = _destroy,
                        },
+                       .is_redundant = _is_redundant,
                        .collide = _collide,
                },
                .ike_sa = ike_sa,