4 * @brief Implementation of the ike_rekey task.
9 * Copyright (C) 2005-2007 Martin Willi
10 * Copyright (C) 2005 Jan Hutter
11 * Hochschule fuer Technik Rapperswil
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms of the GNU General Public License as published by the
15 * Free Software Foundation; either version 2 of the License, or (at your
16 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
18 * This program is distributed in the hope that it will be useful, but
19 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
20 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
24 #include "ike_rekey.h"
27 #include <encoding/payloads/notify_payload.h>
28 #include <sa/tasks/ike_init.h>
29 #include <queues/jobs/delete_ike_sa_job.h>
30 #include <queues/jobs/rekey_ike_sa_job.h>
33 typedef struct private_ike_rekey_t private_ike_rekey_t
;
36 * Private members of a ike_rekey_t task.
38 struct private_ike_rekey_t
{
41 * Public methods and task_t interface.
51 * New IKE_SA which replaces the current one
56 * Are we the initiator?
61 * the IKE_INIT task which is reused to simplify rekeying
66 * colliding task detected by the task manager
72 * Implementation of task_t.build for initiator
74 static status_t
build_i(private_ike_rekey_t
*this, message_t
*message
)
76 connection_t
*connection
;
79 this->new_sa
= charon
->ike_sa_manager
->checkout_new(charon
->ike_sa_manager
,
82 connection
= this->ike_sa
->get_connection(this->ike_sa
);
83 policy
= this->ike_sa
->get_policy(this->ike_sa
);
84 this->new_sa
->set_connection(this->new_sa
, connection
);
85 this->new_sa
->set_policy(this->new_sa
, policy
);
87 this->ike_init
= ike_init_create(this->new_sa
, TRUE
, this->ike_sa
);
88 this->ike_init
->task
.build(&this->ike_init
->task
, message
);
90 this->ike_sa
->set_state(this->ike_sa
, IKE_REKEYING
);
96 * Implementation of task_t.process for initiator
98 static status_t
process_r(private_ike_rekey_t
*this, message_t
*message
)
100 connection_t
*connection
;
102 iterator_t
*iterator
;
103 child_sa_t
*child_sa
;
105 if (this->ike_sa
->get_state(this->ike_sa
) == IKE_DELETING
)
107 DBG1(DBG_IKE
, "peer initiated rekeying, but we are deleting");
111 iterator
= this->ike_sa
->create_child_sa_iterator(this->ike_sa
);
112 while (iterator
->iterate(iterator
, (void**)&child_sa
))
114 switch (child_sa
->get_state(child_sa
))
119 /* we do not allow rekeying while we have children in-progress */
120 DBG1(DBG_IKE
, "peer initiated rekeying, but a child is half-open");
121 iterator
->destroy(iterator
);
127 iterator
->destroy(iterator
);
129 this->new_sa
= charon
->ike_sa_manager
->checkout_new(charon
->ike_sa_manager
,
132 connection
= this->ike_sa
->get_connection(this->ike_sa
);
133 policy
= this->ike_sa
->get_policy(this->ike_sa
);
134 this->new_sa
->set_connection(this->new_sa
, connection
);
135 this->new_sa
->set_policy(this->new_sa
, policy
);
137 this->ike_init
= ike_init_create(this->new_sa
, FALSE
, this->ike_sa
);
138 this->ike_init
->task
.process(&this->ike_init
->task
, message
);
144 * Implementation of task_t.build for responder
146 static status_t
build_r(private_ike_rekey_t
*this, message_t
*message
)
148 if (this->new_sa
== NULL
)
150 /* IKE_SA/a CHILD_SA is in an inacceptable state, deny rekeying */
151 message
->add_notify(message
, TRUE
, NO_PROPOSAL_CHOSEN
, chunk_empty
);
155 if (this->ike_init
->task
.build(&this->ike_init
->task
, message
) == FAILED
)
160 this->ike_sa
->set_state(this->ike_sa
, IKE_REKEYING
);
161 this->new_sa
->set_state(this->new_sa
, IKE_ESTABLISHED
);
167 * Implementation of task_t.process for initiator
169 static status_t
process_i(private_ike_rekey_t
*this, message_t
*message
)
172 ike_sa_id_t
*to_delete
;
174 if (this->ike_init
->task
.process(&this->ike_init
->task
, message
) == FAILED
)
176 /* rekeying failed, fallback to old SA */
177 if (!(this->collision
&&
178 this->collision
->get_type(this->collision
) == IKE_DELETE
))
181 u_int32_t retry
= charon
->configuration
->get_retry_interval(
182 charon
->configuration
);
183 job
= (job_t
*)rekey_ike_sa_job_create(
184 this->ike_sa
->get_id(this->ike_sa
), FALSE
);
185 DBG1(DBG_IKE
, "IKE_SA rekeying failed, "
186 "trying again in %d seconds", retry
);
187 this->ike_sa
->set_state(this->ike_sa
, IKE_ESTABLISHED
);
188 charon
->event_queue
->add_relative(charon
->event_queue
, job
, retry
* 1000);
193 this->new_sa
->set_state(this->new_sa
, IKE_ESTABLISHED
);
194 to_delete
= this->ike_sa
->get_id(this->ike_sa
);
196 /* check for collisions */
197 if (this->collision
&&
198 this->collision
->get_type(this->collision
) == IKE_REKEY
)
200 chunk_t this_nonce
, other_nonce
;
202 private_ike_rekey_t
*other
= (private_ike_rekey_t
*)this->collision
;
204 this_nonce
= this->ike_init
->get_lower_nonce(this->ike_init
);
205 other_nonce
= other
->ike_init
->get_lower_nonce(other
->ike_init
);
207 /* if we have the lower nonce, delete rekeyed SA. If not, delete
209 if (memcmp(this_nonce
.ptr
, other_nonce
.ptr
,
210 min(this_nonce
.len
, other_nonce
.len
)) < 0)
212 DBG1(DBG_IKE
, "IKE_SA rekey collision won, deleting rekeyed IKE_SA");
213 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, other
->new_sa
);
217 DBG1(DBG_IKE
, "IKE_SA rekey collision lost, deleting redundant IKE_SA");
218 /* apply host for a proper delete */
219 host
= this->ike_sa
->get_my_host(this->ike_sa
);
220 this->new_sa
->set_my_host(this->new_sa
, host
->clone(host
));
221 host
= this->ike_sa
->get_other_host(this->ike_sa
);
222 this->new_sa
->set_other_host(this->new_sa
, host
->clone(host
));
223 this->ike_sa
->set_state(this->ike_sa
, IKE_ESTABLISHED
);
224 to_delete
= this->new_sa
->get_id(this->new_sa
);
225 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, this->new_sa
);
226 /* inherit to other->new_sa in destroy() */
227 this->new_sa
= other
->new_sa
;
228 other
->new_sa
= NULL
;
232 job
= (job_t
*)delete_ike_sa_job_create(to_delete
, TRUE
);
233 charon
->job_queue
->add(charon
->job_queue
, job
);
239 * Implementation of task_t.get_type
241 static task_type_t
get_type(private_ike_rekey_t
*this)
246 static void collide(private_ike_rekey_t
* this, task_t
*other
)
248 DESTROY_IF(this->collision
);
249 this->collision
= other
;
253 * Implementation of task_t.migrate
255 static void migrate(private_ike_rekey_t
*this, ike_sa_t
*ike_sa
)
259 this->ike_init
->task
.destroy(&this->ike_init
->task
);
263 charon
->ike_sa_manager
->checkin_and_destroy(charon
->ike_sa_manager
,
266 DESTROY_IF(this->collision
);
268 this->collision
= NULL
;
269 this->ike_sa
= ike_sa
;
271 this->ike_init
= NULL
;
275 * Implementation of task_t.destroy
277 static void destroy(private_ike_rekey_t
*this)
281 if (this->new_sa
->get_state(this->new_sa
) == IKE_ESTABLISHED
&&
282 this->new_sa
->inherit(this->new_sa
, this->ike_sa
) != DESTROY_ME
)
284 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, this->new_sa
);
288 charon
->ike_sa_manager
->checkin_and_destroy(charon
->ike_sa_manager
,
294 this->ike_init
->task
.destroy(&this->ike_init
->task
);
296 DESTROY_IF(this->collision
);
301 * Described in header.
303 ike_rekey_t
*ike_rekey_create(ike_sa_t
*ike_sa
, bool initiator
)
305 private_ike_rekey_t
*this = malloc_thing(private_ike_rekey_t
);
307 this->public.collide
= (void(*)(ike_rekey_t
*,task_t
*))collide
;
308 this->public.task
.get_type
= (task_type_t(*)(task_t
*))get_type
;
309 this->public.task
.migrate
= (void(*)(task_t
*,ike_sa_t
*))migrate
;
310 this->public.task
.destroy
= (void(*)(task_t
*))destroy
;
313 this->public.task
.build
= (status_t(*)(task_t
*,message_t
*))build_i
;
314 this->public.task
.process
= (status_t(*)(task_t
*,message_t
*))process_i
;
318 this->public.task
.build
= (status_t(*)(task_t
*,message_t
*))build_r
;
319 this->public.task
.process
= (status_t(*)(task_t
*,message_t
*))process_r
;
322 this->ike_sa
= ike_sa
;
324 this->ike_init
= NULL
;
325 this->initiator
= initiator
;
326 this->collision
= NULL
;
328 return &this->public;