2 * Copyright (C) 2006-2012 Tobias Brunner
3 * Copyright (C) 2006 Daniel Roethlisberger
4 * Copyright (C) 2005-2009 Martin Willi
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
29 #include <utils/linked_list.h>
30 #include <utils/lexparser.h>
31 #include <sa/task_manager.h>
32 #include <sa/tasks/ike_init.h>
33 #include <sa/tasks/ike_natd.h>
34 #include <sa/tasks/ike_mobike.h>
35 #include <sa/tasks/ike_auth.h>
36 #include <sa/tasks/ike_auth_lifetime.h>
37 #include <sa/tasks/ike_config.h>
38 #include <sa/tasks/ike_cert_pre.h>
39 #include <sa/tasks/ike_cert_post.h>
40 #include <sa/tasks/ike_rekey.h>
41 #include <sa/tasks/ike_reauth.h>
42 #include <sa/tasks/ike_delete.h>
43 #include <sa/tasks/ike_dpd.h>
44 #include <sa/tasks/ike_vendor.h>
45 #include <sa/tasks/child_create.h>
46 #include <sa/tasks/child_delete.h>
47 #include <sa/tasks/child_rekey.h>
48 #include <processing/jobs/retransmit_job.h>
49 #include <processing/jobs/delete_ike_sa_job.h>
50 #include <processing/jobs/send_dpd_job.h>
51 #include <processing/jobs/send_keepalive_job.h>
52 #include <processing/jobs/rekey_ike_sa_job.h>
53 #include <encoding/payloads/unknown_payload.h>
56 #include <sa/tasks/ike_me.h>
57 #include <processing/jobs/initiate_mediation_job.h>
60 ENUM(ike_sa_state_names
, IKE_CREATED
, IKE_DESTROYING
,
70 typedef struct private_ike_sa_t private_ike_sa_t
;
71 typedef struct attribute_entry_t attribute_entry_t
;
74 * Private data of an ike_sa_t object.
76 struct private_ike_sa_t
{
84 * Identifier for the current IKE_SA.
86 ike_sa_id_t
*ike_sa_id
;
89 * unique numerical ID for this IKE_SA.
94 * Current state of the IKE_SA
99 * IKE configuration used to set up this IKE_SA
104 * Peer and authentication information to establish IKE_SA.
106 peer_cfg_t
*peer_cfg
;
109 * currently used authentication ruleset, local (as auth_cfg_t)
114 * list of completed local authentication rounds
116 linked_list_t
*my_auths
;
119 * list of completed remote authentication rounds
121 linked_list_t
*other_auths
;
124 * currently used authentication constraints, remote (as auth_cfg_t)
126 auth_cfg_t
*other_auth
;
129 * Selected IKE proposal
131 proposal_t
*proposal
;
134 * Juggles tasks to process messages
136 task_manager_t
*task_manager
;
139 * Address of local host
144 * Address of remote host
150 * Are we mediation server
152 bool is_mediation_server
;
155 * Server reflexive host
157 host_t
*server_reflexive_host
;
166 * Identification used for us
168 identification_t
*my_id
;
171 * Identification used for other
173 identification_t
*other_id
;
176 * set of extensions the peer supports
178 ike_extension_t extensions
;
181 * set of condition flags currently enabled for this IKE_SA
183 ike_condition_t conditions
;
186 * Linked List containing the child sa's of the current IKE_SA.
188 linked_list_t
*child_sas
;
191 * keymat of this IKE_SA
196 * Virtual IP on local host, if any
198 host_t
*my_virtual_ip
;
201 * Virtual IP on remote host, if any
203 host_t
*other_virtual_ip
;
206 * List of configuration attributes (attribute_entry_t)
208 linked_list_t
*attributes
;
211 * list of peer's addresses, additional ones transmitted via MOBIKE
213 linked_list_t
*peer_addresses
;
216 * previously value of received DESTINATION_IP hash
218 chunk_t nat_detection_dest
;
221 * number pending UPDATE_SA_ADDRESS (MOBIKE)
223 u_int32_t pending_updates
;
226 * NAT keep alive interval
228 u_int32_t keepalive_interval
;
231 * Timestamps for this IKE_SA
233 u_int32_t stats
[STAT_MAX
];
236 * how many times we have retried so far (keyingtries)
241 * local host address to be used for IKE, set via MIGRATE kernel message
246 * remote host address to be used for IKE, set via MIGRATE kernel message
252 * Entry to maintain install configuration attributes during IKE_SA lifetime
254 struct attribute_entry_t
{
255 /** handler used to install this attribute */
256 attribute_handler_t
*handler
;
257 /** attribute type */
258 configuration_attribute_type_t type
;
259 /** attribute data */
264 * get the time of the latest traffic processed by the kernel
266 static time_t get_use_time(private_ike_sa_t
* this, bool inbound
)
268 enumerator_t
*enumerator
;
269 child_sa_t
*child_sa
;
270 time_t use_time
, current
;
274 use_time
= this->stats
[STAT_INBOUND
];
278 use_time
= this->stats
[STAT_OUTBOUND
];
280 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
281 while (enumerator
->enumerate(enumerator
, &child_sa
))
283 child_sa
->get_usestats(child_sa
, inbound
, ¤t
, NULL
);
284 use_time
= max(use_time
, current
);
286 enumerator
->destroy(enumerator
);
291 METHOD(ike_sa_t
, get_unique_id
, u_int32_t
,
292 private_ike_sa_t
*this)
294 return this->unique_id
;
297 METHOD(ike_sa_t
, get_name
, char*,
298 private_ike_sa_t
*this)
302 return this->peer_cfg
->get_name(this->peer_cfg
);
307 METHOD(ike_sa_t
, get_statistic
, u_int32_t
,
308 private_ike_sa_t
*this, statistic_t kind
)
312 return this->stats
[kind
];
317 METHOD(ike_sa_t
, get_my_host
, host_t
*,
318 private_ike_sa_t
*this)
320 return this->my_host
;
323 METHOD(ike_sa_t
, set_my_host
, void,
324 private_ike_sa_t
*this, host_t
*me
)
326 DESTROY_IF(this->my_host
);
330 METHOD(ike_sa_t
, get_other_host
, host_t
*,
331 private_ike_sa_t
*this)
333 return this->other_host
;
336 METHOD(ike_sa_t
, set_other_host
, void,
337 private_ike_sa_t
*this, host_t
*other
)
339 DESTROY_IF(this->other_host
);
340 this->other_host
= other
;
343 METHOD(ike_sa_t
, get_peer_cfg
, peer_cfg_t
*,
344 private_ike_sa_t
*this)
346 return this->peer_cfg
;
349 METHOD(ike_sa_t
, set_peer_cfg
, void,
350 private_ike_sa_t
*this, peer_cfg_t
*peer_cfg
)
352 peer_cfg
->get_ref(peer_cfg
);
353 DESTROY_IF(this->peer_cfg
);
354 this->peer_cfg
= peer_cfg
;
356 if (this->ike_cfg
== NULL
)
358 this->ike_cfg
= peer_cfg
->get_ike_cfg(peer_cfg
);
359 this->ike_cfg
->get_ref(this->ike_cfg
);
363 METHOD(ike_sa_t
, get_auth_cfg
, auth_cfg_t
*,
364 private_ike_sa_t
*this, bool local
)
368 return this->my_auth
;
370 return this->other_auth
;
373 METHOD(ike_sa_t
, add_auth_cfg
, void,
374 private_ike_sa_t
*this, bool local
, auth_cfg_t
*cfg
)
378 this->my_auths
->insert_last(this->my_auths
, cfg
);
382 this->other_auths
->insert_last(this->other_auths
, cfg
);
386 METHOD(ike_sa_t
, create_auth_cfg_enumerator
, enumerator_t
*,
387 private_ike_sa_t
*this, bool local
)
391 return this->my_auths
->create_enumerator(this->my_auths
);
393 return this->other_auths
->create_enumerator(this->other_auths
);
397 * Flush the stored authentication round information
399 static void flush_auth_cfgs(private_ike_sa_t
*this)
403 while (this->my_auths
->remove_last(this->my_auths
,
404 (void**)&cfg
) == SUCCESS
)
408 while (this->other_auths
->remove_last(this->other_auths
,
409 (void**)&cfg
) == SUCCESS
)
415 METHOD(ike_sa_t
, get_proposal
, proposal_t
*,
416 private_ike_sa_t
*this)
418 return this->proposal
;
421 METHOD(ike_sa_t
, set_proposal
, void,
422 private_ike_sa_t
*this, proposal_t
*proposal
)
424 DESTROY_IF(this->proposal
);
425 this->proposal
= proposal
->clone(proposal
);
428 METHOD(ike_sa_t
, set_message_id
, void,
429 private_ike_sa_t
*this, bool initiate
, u_int32_t mid
)
433 this->task_manager
->reset(this->task_manager
, mid
, UINT_MAX
);
437 this->task_manager
->reset(this->task_manager
, UINT_MAX
, mid
);
441 METHOD(ike_sa_t
, send_keepalive
, void,
442 private_ike_sa_t
*this)
444 send_keepalive_job_t
*job
;
445 time_t last_out
, now
, diff
;
447 if (!(this->conditions
& COND_NAT_HERE
) || this->keepalive_interval
== 0)
448 { /* disable keep alives if we are not NATed anymore */
452 last_out
= get_use_time(this, FALSE
);
453 now
= time_monotonic(NULL
);
455 diff
= now
- last_out
;
457 if (diff
>= this->keepalive_interval
)
462 packet
= packet_create();
463 packet
->set_source(packet
, this->my_host
->clone(this->my_host
));
464 packet
->set_destination(packet
, this->other_host
->clone(this->other_host
));
465 data
.ptr
= malloc(1);
468 packet
->set_data(packet
, data
);
469 DBG1(DBG_IKE
, "sending keep alive");
470 charon
->sender
->send(charon
->sender
, packet
);
473 job
= send_keepalive_job_create(this->ike_sa_id
);
474 lib
->scheduler
->schedule_job(lib
->scheduler
, (job_t
*)job
,
475 this->keepalive_interval
- diff
);
478 METHOD(ike_sa_t
, get_ike_cfg
, ike_cfg_t
*,
479 private_ike_sa_t
*this)
481 return this->ike_cfg
;
484 METHOD(ike_sa_t
, set_ike_cfg
, void,
485 private_ike_sa_t
*this, ike_cfg_t
*ike_cfg
)
487 ike_cfg
->get_ref(ike_cfg
);
488 this->ike_cfg
= ike_cfg
;
491 METHOD(ike_sa_t
, enable_extension
, void,
492 private_ike_sa_t
*this, ike_extension_t extension
)
494 this->extensions
|= extension
;
497 METHOD(ike_sa_t
, supports_extension
, bool,
498 private_ike_sa_t
*this, ike_extension_t extension
)
500 return (this->extensions
& extension
) != FALSE
;
503 METHOD(ike_sa_t
, has_condition
, bool,
504 private_ike_sa_t
*this, ike_condition_t condition
)
506 return (this->conditions
& condition
) != FALSE
;
509 METHOD(ike_sa_t
, set_condition
, void,
510 private_ike_sa_t
*this, ike_condition_t condition
, bool enable
)
512 if (has_condition(this, condition
) != enable
)
516 this->conditions
|= condition
;
520 DBG1(DBG_IKE
, "local host is behind NAT, sending keep alives");
521 this->conditions
|= COND_NAT_ANY
;
522 send_keepalive(this);
525 DBG1(DBG_IKE
, "remote host is behind NAT");
526 this->conditions
|= COND_NAT_ANY
;
529 DBG1(DBG_IKE
, "faking NAT situation to enforce UDP encapsulation");
530 this->conditions
|= COND_NAT_ANY
;
538 this->conditions
&= ~condition
;
544 set_condition(this, COND_NAT_ANY
,
545 has_condition(this, COND_NAT_HERE
) ||
546 has_condition(this, COND_NAT_THERE
) ||
547 has_condition(this, COND_NAT_FAKE
));
556 METHOD(ike_sa_t
, send_dpd
, status_t
,
557 private_ike_sa_t
*this)
562 if (this->state
== IKE_PASSIVE
)
564 return INVALID_STATE
;
566 delay
= this->peer_cfg
->get_dpd(this->peer_cfg
);
567 if (this->task_manager
->busy(this->task_manager
))
569 /* an exchange is in the air, no need to start a DPD check */
574 /* check if there was any inbound traffic */
576 last_in
= get_use_time(this, TRUE
);
577 now
= time_monotonic(NULL
);
578 diff
= now
- last_in
;
579 if (!delay
|| diff
>= delay
)
581 /* to long ago, initiate dead peer detection */
583 ike_mobike_t
*mobike
;
585 if (supports_extension(this, EXT_MOBIKE
) &&
586 has_condition(this, COND_NAT_HERE
))
588 /* use mobike enabled DPD to detect NAT mapping changes */
589 mobike
= ike_mobike_create(&this->public, TRUE
);
591 task
= &mobike
->task
;
595 task
= (task_t
*)ike_dpd_create(TRUE
);
598 DBG1(DBG_IKE
, "sending DPD request");
600 this->task_manager
->queue_task(this->task_manager
, task
);
601 this->task_manager
->initiate(this->task_manager
);
604 /* recheck in "interval" seconds */
607 job
= (job_t
*)send_dpd_job_create(this->ike_sa_id
);
608 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, delay
- diff
);
613 METHOD(ike_sa_t
, get_state
, ike_sa_state_t
,
614 private_ike_sa_t
*this)
619 METHOD(ike_sa_t
, set_state
, void,
620 private_ike_sa_t
*this, ike_sa_state_t state
)
622 bool trigger_dpd
= FALSE
;
624 DBG2(DBG_IKE
, "IKE_SA %s[%d] state change: %N => %N",
625 get_name(this), this->unique_id
,
626 ike_sa_state_names
, this->state
,
627 ike_sa_state_names
, state
);
631 case IKE_ESTABLISHED
:
633 if (this->state
== IKE_CONNECTING
||
634 this->state
== IKE_PASSIVE
)
639 /* calculate rekey, reauth and lifetime */
640 this->stats
[STAT_ESTABLISHED
] = time_monotonic(NULL
);
642 /* schedule rekeying if we have a time which is smaller than
643 * an already scheduled rekeying */
644 t
= this->peer_cfg
->get_rekey_time(this->peer_cfg
);
645 if (t
&& (this->stats
[STAT_REKEY
] == 0 ||
646 (this->stats
[STAT_REKEY
] > t
+ this->stats
[STAT_ESTABLISHED
])))
648 this->stats
[STAT_REKEY
] = t
+ this->stats
[STAT_ESTABLISHED
];
649 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, FALSE
);
650 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
651 DBG1(DBG_IKE
, "scheduling rekeying in %ds", t
);
653 t
= this->peer_cfg
->get_reauth_time(this->peer_cfg
);
654 if (t
&& (this->stats
[STAT_REAUTH
] == 0 ||
655 (this->stats
[STAT_REAUTH
] > t
+ this->stats
[STAT_ESTABLISHED
])))
657 this->stats
[STAT_REAUTH
] = t
+ this->stats
[STAT_ESTABLISHED
];
658 job
= (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
);
659 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
660 DBG1(DBG_IKE
, "scheduling reauthentication in %ds", t
);
662 t
= this->peer_cfg
->get_over_time(this->peer_cfg
);
663 if (this->stats
[STAT_REKEY
] || this->stats
[STAT_REAUTH
])
665 if (this->stats
[STAT_REAUTH
] == 0)
667 this->stats
[STAT_DELETE
] = this->stats
[STAT_REKEY
];
669 else if (this->stats
[STAT_REKEY
] == 0)
671 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
];
675 this->stats
[STAT_DELETE
] = min(this->stats
[STAT_REKEY
],
676 this->stats
[STAT_REAUTH
]);
678 this->stats
[STAT_DELETE
] += t
;
679 t
= this->stats
[STAT_DELETE
] - this->stats
[STAT_ESTABLISHED
];
680 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
681 lib
->scheduler
->schedule_job(lib
->scheduler
, job
, t
);
682 DBG1(DBG_IKE
, "maximum IKE_SA lifetime %ds", t
);
684 trigger_dpd
= this->peer_cfg
->get_dpd(this->peer_cfg
);
690 /* delete may fail if a packet gets lost, so set a timeout */
691 job_t
*job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
);
692 lib
->scheduler
->schedule_job(lib
->scheduler
, job
,
693 HALF_OPEN_IKE_SA_TIMEOUT
);
699 charon
->bus
->ike_state_change(charon
->bus
, &this->public, state
);
708 METHOD(ike_sa_t
, reset
, void,
709 private_ike_sa_t
*this)
711 /* the responder ID is reset, as peer may choose another one */
712 if (this->ike_sa_id
->is_initiator(this->ike_sa_id
))
714 this->ike_sa_id
->set_responder_spi(this->ike_sa_id
, 0);
717 set_state(this, IKE_CREATED
);
719 flush_auth_cfgs(this);
721 this->keymat
->destroy(this->keymat
);
722 this->keymat
= keymat_create(this->ike_sa_id
->is_initiator(this->ike_sa_id
));
724 this->task_manager
->reset(this->task_manager
, 0, 0);
727 METHOD(ike_sa_t
, get_keymat
, keymat_t
*,
728 private_ike_sa_t
*this)
733 METHOD(ike_sa_t
, set_virtual_ip
, void,
734 private_ike_sa_t
*this, bool local
, host_t
*ip
)
738 DBG1(DBG_IKE
, "installing new virtual IP %H", ip
);
739 if (hydra
->kernel_interface
->add_ip(hydra
->kernel_interface
, ip
,
740 this->my_host
) == SUCCESS
)
742 if (this->my_virtual_ip
)
744 DBG1(DBG_IKE
, "removing old virtual IP %H", this->my_virtual_ip
);
745 hydra
->kernel_interface
->del_ip(hydra
->kernel_interface
,
746 this->my_virtual_ip
);
748 DESTROY_IF(this->my_virtual_ip
);
749 this->my_virtual_ip
= ip
->clone(ip
);
753 DBG1(DBG_IKE
, "installing virtual IP %H failed", ip
);
754 this->my_virtual_ip
= NULL
;
759 DESTROY_IF(this->other_virtual_ip
);
760 this->other_virtual_ip
= ip
->clone(ip
);
764 METHOD(ike_sa_t
, get_virtual_ip
, host_t
*,
765 private_ike_sa_t
*this, bool local
)
769 return this->my_virtual_ip
;
773 return this->other_virtual_ip
;
777 METHOD(ike_sa_t
, add_peer_address
, void,
778 private_ike_sa_t
*this, host_t
*host
)
780 this->peer_addresses
->insert_last(this->peer_addresses
, host
);
783 METHOD(ike_sa_t
, create_peer_address_enumerator
, enumerator_t
*,
784 private_ike_sa_t
*this)
786 return this->peer_addresses
->create_enumerator(this->peer_addresses
);
789 METHOD(ike_sa_t
, clear_peer_addresses
, void,
790 private_ike_sa_t
*this)
792 enumerator_t
*enumerator
= create_peer_address_enumerator(this);
795 while (enumerator
->enumerate(enumerator
, (void**)&host
))
797 this->peer_addresses
->remove_at(this->peer_addresses
,
801 enumerator
->destroy(enumerator
);
804 METHOD(ike_sa_t
, has_mapping_changed
, bool,
805 private_ike_sa_t
*this, chunk_t hash
)
807 if (this->nat_detection_dest
.ptr
== NULL
)
809 this->nat_detection_dest
= chunk_clone(hash
);
812 if (chunk_equals(hash
, this->nat_detection_dest
))
816 free(this->nat_detection_dest
.ptr
);
817 this->nat_detection_dest
= chunk_clone(hash
);
821 METHOD(ike_sa_t
, set_pending_updates
, void,
822 private_ike_sa_t
*this, u_int32_t updates
)
824 this->pending_updates
= updates
;
827 METHOD(ike_sa_t
, get_pending_updates
, u_int32_t
,
828 private_ike_sa_t
*this)
830 return this->pending_updates
;
833 METHOD(ike_sa_t
, float_ports
, void,
834 private_ike_sa_t
*this)
836 /* do not switch if we have a custom port from MOBIKE/NAT */
837 if (this->my_host
->get_port(this->my_host
) == IKEV2_UDP_PORT
)
839 this->my_host
->set_port(this->my_host
, IKEV2_NATT_PORT
);
841 if (this->other_host
->get_port(this->other_host
) == IKEV2_UDP_PORT
)
843 this->other_host
->set_port(this->other_host
, IKEV2_NATT_PORT
);
847 METHOD(ike_sa_t
, update_hosts
, void,
848 private_ike_sa_t
*this, host_t
*me
, host_t
*other
, bool force
)
858 other
= this->other_host
;
861 /* apply hosts on first received message */
862 if (this->my_host
->is_anyaddr(this->my_host
) ||
863 this->other_host
->is_anyaddr(this->other_host
))
865 set_my_host(this, me
->clone(me
));
866 set_other_host(this, other
->clone(other
));
871 /* update our address in any case */
872 if (!me
->equals(me
, this->my_host
))
874 set_my_host(this, me
->clone(me
));
878 if (!other
->equals(other
, this->other_host
))
880 /* update others address if we are NOT NATed */
881 if (force
|| !has_condition(this, COND_NAT_HERE
))
883 set_other_host(this, other
->clone(other
));
889 /* update all associated CHILD_SAs, if required */
892 enumerator_t
*enumerator
;
893 child_sa_t
*child_sa
;
895 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
896 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
898 if (child_sa
->update(child_sa
, this->my_host
,
899 this->other_host
, this->my_virtual_ip
,
900 has_condition(this, COND_NAT_ANY
)) == NOT_SUPPORTED
)
902 this->public.rekey_child_sa(&this->public,
903 child_sa
->get_protocol(child_sa
),
904 child_sa
->get_spi(child_sa
, TRUE
));
907 enumerator
->destroy(enumerator
);
911 METHOD(ike_sa_t
, generate_message
, status_t
,
912 private_ike_sa_t
*this, message_t
*message
, packet_t
**packet
)
914 if (message
->is_encoded(message
))
916 *packet
= message
->get_packet(message
);
919 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
920 message
->set_ike_sa_id(message
, this->ike_sa_id
);
921 charon
->bus
->message(charon
->bus
, message
, FALSE
);
922 return message
->generate(message
,
923 this->keymat
->get_aead(this->keymat
, FALSE
), packet
);
927 * send a notify back to the sender
929 static void send_notify_response(private_ike_sa_t
*this, message_t
*request
,
930 notify_type_t type
, chunk_t data
)
935 response
= message_create();
936 response
->set_exchange_type(response
, request
->get_exchange_type(request
));
937 response
->set_request(response
, FALSE
);
938 response
->set_message_id(response
, request
->get_message_id(request
));
939 response
->add_notify(response
, FALSE
, type
, data
);
940 if (this->my_host
->is_anyaddr(this->my_host
))
942 this->my_host
->destroy(this->my_host
);
943 this->my_host
= request
->get_destination(request
);
944 this->my_host
= this->my_host
->clone(this->my_host
);
946 if (this->other_host
->is_anyaddr(this->other_host
))
948 this->other_host
->destroy(this->other_host
);
949 this->other_host
= request
->get_source(request
);
950 this->other_host
= this->other_host
->clone(this->other_host
);
952 response
->set_source(response
, this->my_host
->clone(this->my_host
));
953 response
->set_destination(response
, this->other_host
->clone(this->other_host
));
954 if (generate_message(this, response
, &packet
) == SUCCESS
)
956 charon
->sender
->send(charon
->sender
, packet
);
958 response
->destroy(response
);
961 METHOD(ike_sa_t
, set_kmaddress
, void,
962 private_ike_sa_t
*this, host_t
*local
, host_t
*remote
)
964 DESTROY_IF(this->local_host
);
965 DESTROY_IF(this->remote_host
);
966 this->local_host
= local
->clone(local
);
967 this->remote_host
= remote
->clone(remote
);
971 METHOD(ike_sa_t
, act_as_mediation_server
, void,
972 private_ike_sa_t
*this)
974 charon
->mediation_manager
->update_sa_id(charon
->mediation_manager
,
975 this->other_id
, this->ike_sa_id
);
976 this->is_mediation_server
= TRUE
;
979 METHOD(ike_sa_t
, get_server_reflexive_host
, host_t
*,
980 private_ike_sa_t
*this)
982 return this->server_reflexive_host
;
985 METHOD(ike_sa_t
, set_server_reflexive_host
, void,
986 private_ike_sa_t
*this, host_t
*host
)
988 DESTROY_IF(this->server_reflexive_host
);
989 this->server_reflexive_host
= host
;
992 METHOD(ike_sa_t
, get_connect_id
, chunk_t
,
993 private_ike_sa_t
*this)
995 return this->connect_id
;
998 METHOD(ike_sa_t
, respond
, status_t
,
999 private_ike_sa_t
*this, identification_t
*peer_id
, chunk_t connect_id
)
1001 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1002 task
->respond(task
, peer_id
, connect_id
);
1003 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1004 return this->task_manager
->initiate(this->task_manager
);
1007 METHOD(ike_sa_t
, callback
, status_t
,
1008 private_ike_sa_t
*this, identification_t
*peer_id
)
1010 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1011 task
->callback(task
, peer_id
);
1012 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1013 return this->task_manager
->initiate(this->task_manager
);
1016 METHOD(ike_sa_t
, relay
, status_t
,
1017 private_ike_sa_t
*this, identification_t
*requester
, chunk_t connect_id
,
1018 chunk_t connect_key
, linked_list_t
*endpoints
, bool response
)
1020 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1021 task
->relay(task
, requester
, connect_id
, connect_key
, endpoints
, response
);
1022 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1023 return this->task_manager
->initiate(this->task_manager
);
1026 METHOD(ike_sa_t
, initiate_mediation
, status_t
,
1027 private_ike_sa_t
*this, peer_cfg_t
*mediated_cfg
)
1029 ike_me_t
*task
= ike_me_create(&this->public, TRUE
);
1030 task
->connect(task
, mediated_cfg
->get_peer_id(mediated_cfg
));
1031 this->task_manager
->queue_task(this->task_manager
, (task_t
*)task
);
1032 return this->task_manager
->initiate(this->task_manager
);
1035 METHOD(ike_sa_t
, initiate_mediated
, status_t
,
1036 private_ike_sa_t
*this, host_t
*me
, host_t
*other
, chunk_t connect_id
)
1038 set_my_host(this, me
->clone(me
));
1039 set_other_host(this, other
->clone(other
));
1040 chunk_free(&this->connect_id
);
1041 this->connect_id
= chunk_clone(connect_id
);
1042 return this->task_manager
->initiate(this->task_manager
);
1047 * Resolve DNS host in configuration
1049 static void resolve_hosts(private_ike_sa_t
*this)
1053 if (this->remote_host
)
1055 host
= this->remote_host
->clone(this->remote_host
);
1056 host
->set_port(host
, IKEV2_UDP_PORT
);
1060 host
= host_create_from_dns(this->ike_cfg
->get_other_addr(this->ike_cfg
),
1061 0, this->ike_cfg
->get_other_port(this->ike_cfg
));
1065 set_other_host(this, host
);
1068 if (this->local_host
)
1070 host
= this->local_host
->clone(this->local_host
);
1071 host
->set_port(host
, IKEV2_UDP_PORT
);
1077 /* use same address family as for other */
1078 if (!this->other_host
->is_anyaddr(this->other_host
))
1080 family
= this->other_host
->get_family(this->other_host
);
1082 host
= host_create_from_dns(this->ike_cfg
->get_my_addr(this->ike_cfg
),
1083 family
, this->ike_cfg
->get_my_port(this->ike_cfg
));
1085 if (host
&& host
->is_anyaddr(host
) &&
1086 !this->other_host
->is_anyaddr(this->other_host
))
1088 host
->destroy(host
);
1089 host
= hydra
->kernel_interface
->get_source_addr(
1090 hydra
->kernel_interface
, this->other_host
, NULL
);
1093 host
->set_port(host
, this->ike_cfg
->get_my_port(this->ike_cfg
));
1096 { /* fallback to address family specific %any(6), if configured */
1097 host
= host_create_from_dns(
1098 this->ike_cfg
->get_my_addr(this->ike_cfg
),
1099 0, this->ike_cfg
->get_my_port(this->ike_cfg
));
1105 set_my_host(this, host
);
1109 METHOD(ike_sa_t
, initiate
, status_t
,
1110 private_ike_sa_t
*this, child_cfg_t
*child_cfg
, u_int32_t reqid
,
1111 traffic_selector_t
*tsi
, traffic_selector_t
*tsr
)
1115 if (this->state
== IKE_CREATED
)
1117 resolve_hosts(this);
1119 if (this->other_host
->is_anyaddr(this->other_host
)
1121 && !this->peer_cfg
->get_mediated_by(this->peer_cfg
)
1125 child_cfg
->destroy(child_cfg
);
1126 DBG1(DBG_IKE
, "unable to initiate to %%any");
1127 charon
->bus
->alert(charon
->bus
, ALERT_PEER_ADDR_FAILED
);
1131 set_condition(this, COND_ORIGINAL_INITIATOR
, TRUE
);
1133 task
= (task_t
*)ike_vendor_create(&this->public, TRUE
);
1134 this->task_manager
->queue_task(this->task_manager
, task
);
1135 task
= (task_t
*)ike_init_create(&this->public, TRUE
, NULL
);
1136 this->task_manager
->queue_task(this->task_manager
, task
);
1137 task
= (task_t
*)ike_natd_create(&this->public, TRUE
);
1138 this->task_manager
->queue_task(this->task_manager
, task
);
1139 task
= (task_t
*)ike_cert_pre_create(&this->public, TRUE
);
1140 this->task_manager
->queue_task(this->task_manager
, task
);
1141 task
= (task_t
*)ike_auth_create(&this->public, TRUE
);
1142 this->task_manager
->queue_task(this->task_manager
, task
);
1143 task
= (task_t
*)ike_cert_post_create(&this->public, TRUE
);
1144 this->task_manager
->queue_task(this->task_manager
, task
);
1145 task
= (task_t
*)ike_config_create(&this->public, TRUE
);
1146 this->task_manager
->queue_task(this->task_manager
, task
);
1147 task
= (task_t
*)ike_auth_lifetime_create(&this->public, TRUE
);
1148 this->task_manager
->queue_task(this->task_manager
, task
);
1149 if (this->peer_cfg
->use_mobike(this->peer_cfg
))
1151 task
= (task_t
*)ike_mobike_create(&this->public, TRUE
);
1152 this->task_manager
->queue_task(this->task_manager
, task
);
1155 task
= (task_t
*)ike_me_create(&this->public, TRUE
);
1156 this->task_manager
->queue_task(this->task_manager
, task
);
1161 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1163 if (this->state
== IKE_ESTABLISHED
)
1165 /* mediation connection is already established, retrigger state
1166 * change to notify bus listeners */
1167 DBG1(DBG_IKE
, "mediation connection is already up");
1168 set_state(this, IKE_ESTABLISHED
);
1170 DESTROY_IF(child_cfg
);
1175 /* normal IKE_SA with CHILD_SA */
1176 task
= (task_t
*)child_create_create(&this->public, child_cfg
, FALSE
,
1178 child_cfg
->destroy(child_cfg
);
1181 child_create_t
*child_create
= (child_create_t
*)task
;
1182 child_create
->use_reqid(child_create
, reqid
);
1184 this->task_manager
->queue_task(this->task_manager
, task
);
1187 if (this->peer_cfg
->get_mediated_by(this->peer_cfg
))
1189 /* mediated connection, initiate mediation process */
1190 job_t
*job
= (job_t
*)initiate_mediation_job_create(this->ike_sa_id
);
1191 lib
->processor
->queue_job(lib
->processor
, job
);
1197 return this->task_manager
->initiate(this->task_manager
);
1200 METHOD(ike_sa_t
, process_message
, status_t
,
1201 private_ike_sa_t
*this, message_t
*message
)
1207 if (this->state
== IKE_PASSIVE
)
1208 { /* do not handle messages in passive state */
1212 is_request
= message
->get_request(message
);
1214 status
= message
->parse_body(message
,
1215 this->keymat
->get_aead(this->keymat
, TRUE
));
1216 if (status
== SUCCESS
)
1217 { /* check for unsupported critical payloads */
1218 enumerator_t
*enumerator
;
1219 unknown_payload_t
*unknown
;
1222 enumerator
= message
->create_payload_enumerator(message
);
1223 while (enumerator
->enumerate(enumerator
, &payload
))
1225 unknown
= (unknown_payload_t
*)payload
;
1226 type
= payload
->get_type(payload
);
1227 if (!payload_is_known(type
) &&
1228 unknown
->is_critical(unknown
))
1230 DBG1(DBG_ENC
, "payload type %N is not supported, "
1231 "but its critical!", payload_type_names
, type
);
1232 status
= NOT_SUPPORTED
;
1235 enumerator
->destroy(enumerator
);
1237 if (status
!= SUCCESS
)
1244 DBG1(DBG_IKE
, "critical unknown payloads found");
1247 send_notify_response(this, message
,
1248 UNSUPPORTED_CRITICAL_PAYLOAD
,
1249 chunk_from_thing(type
));
1250 this->task_manager
->incr_mid(this->task_manager
, FALSE
);
1254 DBG1(DBG_IKE
, "message parsing failed");
1257 send_notify_response(this, message
,
1258 INVALID_SYNTAX
, chunk_empty
);
1259 this->task_manager
->incr_mid(this->task_manager
, FALSE
);
1263 DBG1(DBG_IKE
, "message verification failed");
1266 send_notify_response(this, message
,
1267 INVALID_SYNTAX
, chunk_empty
);
1268 this->task_manager
->incr_mid(this->task_manager
, FALSE
);
1272 DBG1(DBG_IKE
, "integrity check failed");
1276 DBG1(DBG_IKE
, "found encrypted message, but no keys available");
1281 DBG1(DBG_IKE
, "%N %s with message ID %d processing failed",
1282 exchange_type_names
, message
->get_exchange_type(message
),
1283 message
->get_request(message
) ? "request" : "response",
1284 message
->get_message_id(message
));
1286 if (this->state
== IKE_CREATED
)
1287 { /* invalid initiation attempt, close SA */
1293 /* if this IKE_SA is virgin, we check for a config */
1294 if (this->ike_cfg
== NULL
)
1297 host_t
*me
= message
->get_destination(message
),
1298 *other
= message
->get_source(message
);
1299 this->ike_cfg
= charon
->backends
->get_ike_cfg(charon
->backends
,
1301 if (this->ike_cfg
== NULL
)
1303 /* no config found for these hosts, destroy */
1304 DBG1(DBG_IKE
, "no IKE config found for %H...%H, sending %N",
1305 me
, other
, notify_type_names
, NO_PROPOSAL_CHOSEN
);
1306 send_notify_response(this, message
,
1307 NO_PROPOSAL_CHOSEN
, chunk_empty
);
1310 /* add a timeout if peer does not establish it completely */
1311 job
= (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, FALSE
);
1312 lib
->scheduler
->schedule_job(lib
->scheduler
, job
,
1313 lib
->settings
->get_int(lib
->settings
,
1314 "charon.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT
));
1316 this->stats
[STAT_INBOUND
] = time_monotonic(NULL
);
1317 status
= this->task_manager
->process_message(this->task_manager
,
1319 if (message
->get_exchange_type(message
) == IKE_AUTH
&&
1320 this->state
== IKE_ESTABLISHED
&&
1321 lib
->settings
->get_bool(lib
->settings
,
1322 "charon.flush_auth_cfg", FALSE
))
1323 { /* authentication completed */
1324 flush_auth_cfgs(this);
1330 METHOD(ike_sa_t
, get_id
, ike_sa_id_t
*,
1331 private_ike_sa_t
*this)
1333 return this->ike_sa_id
;
1336 METHOD(ike_sa_t
, get_my_id
, identification_t
*,
1337 private_ike_sa_t
*this)
1342 METHOD(ike_sa_t
, set_my_id
, void,
1343 private_ike_sa_t
*this, identification_t
*me
)
1345 DESTROY_IF(this->my_id
);
1349 METHOD(ike_sa_t
, get_other_id
, identification_t
*,
1350 private_ike_sa_t
*this)
1352 return this->other_id
;
1355 METHOD(ike_sa_t
, get_other_eap_id
, identification_t
*,
1356 private_ike_sa_t
*this)
1358 identification_t
*id
= NULL
, *current
;
1359 enumerator_t
*enumerator
;
1362 enumerator
= this->other_auths
->create_enumerator(this->other_auths
);
1363 while (enumerator
->enumerate(enumerator
, &cfg
))
1365 /* prefer EAP-Identity of last round */
1366 current
= cfg
->get(cfg
, AUTH_RULE_EAP_IDENTITY
);
1367 if (!current
|| current
->get_type(current
) == ID_ANY
)
1369 current
= cfg
->get(cfg
, AUTH_RULE_IDENTITY
);
1371 if (current
&& current
->get_type(current
) != ID_ANY
)
1377 enumerator
->destroy(enumerator
);
1382 return this->other_id
;
1385 METHOD(ike_sa_t
, set_other_id
, void,
1386 private_ike_sa_t
*this, identification_t
*other
)
1388 DESTROY_IF(this->other_id
);
1389 this->other_id
= other
;
1392 METHOD(ike_sa_t
, add_child_sa
, void,
1393 private_ike_sa_t
*this, child_sa_t
*child_sa
)
1395 this->child_sas
->insert_last(this->child_sas
, child_sa
);
1398 METHOD(ike_sa_t
, get_child_sa
, child_sa_t
*,
1399 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
, bool inbound
)
1401 enumerator_t
*enumerator
;
1402 child_sa_t
*current
, *found
= NULL
;
1404 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
1405 while (enumerator
->enumerate(enumerator
, (void**)¤t
))
1407 if (current
->get_spi(current
, inbound
) == spi
&&
1408 current
->get_protocol(current
) == protocol
)
1413 enumerator
->destroy(enumerator
);
1417 METHOD(ike_sa_t
, get_child_count
, int,
1418 private_ike_sa_t
*this)
1420 return this->child_sas
->get_count(this->child_sas
);
1423 METHOD(ike_sa_t
, create_child_sa_enumerator
, enumerator_t
*,
1424 private_ike_sa_t
*this)
1426 return this->child_sas
->create_enumerator(this->child_sas
);
1429 METHOD(ike_sa_t
, remove_child_sa
, void,
1430 private_ike_sa_t
*this, enumerator_t
*enumerator
)
1432 this->child_sas
->remove_at(this->child_sas
, enumerator
);
1435 METHOD(ike_sa_t
, rekey_child_sa
, status_t
,
1436 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1438 child_rekey_t
*child_rekey
;
1440 if (this->state
== IKE_PASSIVE
)
1442 return INVALID_STATE
;
1445 child_rekey
= child_rekey_create(&this->public, protocol
, spi
);
1446 this->task_manager
->queue_task(this->task_manager
, &child_rekey
->task
);
1447 return this->task_manager
->initiate(this->task_manager
);
1450 METHOD(ike_sa_t
, delete_child_sa
, status_t
,
1451 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1453 child_delete_t
*child_delete
;
1455 if (this->state
== IKE_PASSIVE
)
1457 return INVALID_STATE
;
1460 child_delete
= child_delete_create(&this->public, protocol
, spi
);
1461 this->task_manager
->queue_task(this->task_manager
, &child_delete
->task
);
1462 return this->task_manager
->initiate(this->task_manager
);
1465 METHOD(ike_sa_t
, destroy_child_sa
, status_t
,
1466 private_ike_sa_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1468 enumerator_t
*enumerator
;
1469 child_sa_t
*child_sa
;
1470 status_t status
= NOT_FOUND
;
1472 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
1473 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1475 if (child_sa
->get_protocol(child_sa
) == protocol
&&
1476 child_sa
->get_spi(child_sa
, TRUE
) == spi
)
1478 this->child_sas
->remove_at(this->child_sas
, enumerator
);
1479 child_sa
->destroy(child_sa
);
1484 enumerator
->destroy(enumerator
);
1488 METHOD(ike_sa_t
, delete_
, status_t
,
1489 private_ike_sa_t
*this)
1491 ike_delete_t
*ike_delete
;
1493 switch (this->state
)
1495 case IKE_ESTABLISHED
:
1497 ike_delete
= ike_delete_create(&this->public, TRUE
);
1498 this->task_manager
->queue_task(this->task_manager
, &ike_delete
->task
);
1499 return this->task_manager
->initiate(this->task_manager
);
1501 DBG1(DBG_IKE
, "deleting unestablished IKE_SA");
1506 DBG1(DBG_IKE
, "destroying IKE_SA in state %N "
1507 "without notification", ike_sa_state_names
, this->state
);
1508 charon
->bus
->ike_updown(charon
->bus
, &this->public, FALSE
);
1514 METHOD(ike_sa_t
, rekey
, status_t
,
1515 private_ike_sa_t
*this)
1517 ike_rekey_t
*ike_rekey
;
1519 if (this->state
== IKE_PASSIVE
)
1521 return INVALID_STATE
;
1523 ike_rekey
= ike_rekey_create(&this->public, TRUE
);
1525 this->task_manager
->queue_task(this->task_manager
, &ike_rekey
->task
);
1526 return this->task_manager
->initiate(this->task_manager
);
1529 METHOD(ike_sa_t
, reauth
, status_t
,
1530 private_ike_sa_t
*this)
1534 if (this->state
== IKE_PASSIVE
)
1536 return INVALID_STATE
;
1538 /* we can't reauthenticate as responder when we use EAP or virtual IPs.
1539 * If the peer does not support RFC4478, there is no way to keep the
1541 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
1543 DBG1(DBG_IKE
, "initiator did not reauthenticate as requested");
1544 if (this->other_virtual_ip
!= NULL
||
1545 has_condition(this, COND_EAP_AUTHENTICATED
)
1547 /* as mediation server we too cannot reauth the IKE_SA */
1548 || this->is_mediation_server
1554 del
= this->stats
[STAT_DELETE
];
1555 now
= time_monotonic(NULL
);
1556 DBG1(DBG_IKE
, "IKE_SA %s[%d] will timeout in %V",
1557 get_name(this), this->unique_id
, &now
, &del
);
1562 DBG0(DBG_IKE
, "reauthenticating IKE_SA %s[%d] actively",
1563 get_name(this), this->unique_id
);
1568 DBG0(DBG_IKE
, "reauthenticating IKE_SA %s[%d]",
1569 get_name(this), this->unique_id
);
1571 task
= (task_t
*)ike_reauth_create(&this->public);
1572 this->task_manager
->queue_task(this->task_manager
, task
);
1574 return this->task_manager
->initiate(this->task_manager
);
1577 METHOD(ike_sa_t
, reestablish
, status_t
,
1578 private_ike_sa_t
*this)
1583 enumerator_t
*enumerator
;
1584 child_sa_t
*child_sa
;
1585 child_cfg_t
*child_cfg
;
1586 bool restart
= FALSE
;
1587 status_t status
= FAILED
;
1589 /* check if we have children to keep up at all */
1590 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
1591 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1593 if (this->state
== IKE_DELETING
)
1595 action
= child_sa
->get_close_action(child_sa
);
1599 action
= child_sa
->get_dpd_action(child_sa
);
1603 case ACTION_RESTART
:
1607 charon
->traps
->install(charon
->traps
, this->peer_cfg
,
1608 child_sa
->get_config(child_sa
));
1614 enumerator
->destroy(enumerator
);
1616 /* mediation connections have no children, keep them up anyway */
1617 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1627 /* check if we are able to reestablish this IKE_SA */
1628 if (!has_condition(this, COND_ORIGINAL_INITIATOR
) &&
1629 (this->other_virtual_ip
!= NULL
||
1630 has_condition(this, COND_EAP_AUTHENTICATED
)
1632 || this->is_mediation_server
1636 DBG1(DBG_IKE
, "unable to reestablish IKE_SA due to asymmetric setup");
1640 new = charon
->ike_sa_manager
->checkout_new(charon
->ike_sa_manager
, TRUE
);
1641 new->set_peer_cfg(new, this->peer_cfg
);
1642 host
= this->other_host
;
1643 new->set_other_host(new, host
->clone(host
));
1644 host
= this->my_host
;
1645 new->set_my_host(new, host
->clone(host
));
1646 /* if we already have a virtual IP, we reuse it */
1647 host
= this->my_virtual_ip
;
1650 new->set_virtual_ip(new, TRUE
, host
);
1654 if (this->peer_cfg
->is_mediation(this->peer_cfg
))
1656 status
= new->initiate(new, NULL
, 0, NULL
, NULL
);
1661 enumerator
= this->child_sas
->create_enumerator(this->child_sas
);
1662 while (enumerator
->enumerate(enumerator
, (void**)&child_sa
))
1664 if (this->state
== IKE_DELETING
)
1666 action
= child_sa
->get_close_action(child_sa
);
1670 action
= child_sa
->get_dpd_action(child_sa
);
1674 case ACTION_RESTART
:
1675 child_cfg
= child_sa
->get_config(child_sa
);
1676 DBG1(DBG_IKE
, "restarting CHILD_SA %s",
1677 child_cfg
->get_name(child_cfg
));
1678 child_cfg
->get_ref(child_cfg
);
1679 status
= new->initiate(new, child_cfg
, 0, NULL
, NULL
);
1684 if (status
== DESTROY_ME
)
1689 enumerator
->destroy(enumerator
);
1692 if (status
== DESTROY_ME
)
1694 charon
->ike_sa_manager
->checkin_and_destroy(charon
->ike_sa_manager
, new);
1699 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, new);
1702 charon
->bus
->set_sa(charon
->bus
, &this->public);
1707 * Requeue the IKE_SA_INIT tasks for initiation, if required
1709 static void requeue_init_tasks(private_ike_sa_t
*this)
1711 enumerator_t
*enumerator
;
1712 bool has_init
= FALSE
;
1715 /* if we have advanced to IKE_AUTH, the IKE_INIT and related tasks
1716 * have already completed. Recreate them if necessary. */
1717 enumerator
= this->task_manager
->create_task_enumerator(
1718 this->task_manager
, TASK_QUEUE_QUEUED
);
1719 while (enumerator
->enumerate(enumerator
, &task
))
1721 if (task
->get_type(task
) == IKE_INIT
)
1727 enumerator
->destroy(enumerator
);
1731 task
= (task_t
*)ike_vendor_create(&this->public, TRUE
);
1732 this->task_manager
->queue_task(this->task_manager
, task
);
1733 task
= (task_t
*)ike_natd_create(&this->public, TRUE
);
1734 this->task_manager
->queue_task(this->task_manager
, task
);
1735 task
= (task_t
*)ike_init_create(&this->public, TRUE
, NULL
);
1736 this->task_manager
->queue_task(this->task_manager
, task
);
1740 METHOD(ike_sa_t
, retransmit
, status_t
,
1741 private_ike_sa_t
*this, u_int32_t message_id
)
1743 if (this->state
== IKE_PASSIVE
)
1745 return INVALID_STATE
;
1747 this->stats
[STAT_OUTBOUND
] = time_monotonic(NULL
);
1748 if (this->task_manager
->retransmit(this->task_manager
, message_id
) != SUCCESS
)
1750 /* send a proper signal to brief interested bus listeners */
1751 switch (this->state
)
1753 case IKE_CONNECTING
:
1755 /* retry IKE_SA_INIT if we have multiple keyingtries */
1756 u_int32_t tries
= this->peer_cfg
->get_keyingtries(this->peer_cfg
);
1758 if (tries
== 0 || tries
> this->keyingtry
)
1760 DBG1(DBG_IKE
, "peer not responding, trying again (%d/%d)",
1761 this->keyingtry
+ 1, tries
);
1763 resolve_hosts(this);
1764 requeue_init_tasks(this);
1765 return this->task_manager
->initiate(this->task_manager
);
1767 DBG1(DBG_IKE
, "establishing IKE_SA failed, peer not responding");
1771 DBG1(DBG_IKE
, "proper IKE_SA delete failed, peer not responding");
1774 DBG1(DBG_IKE
, "rekeying IKE_SA failed, peer not responding");
1785 METHOD(ike_sa_t
, set_auth_lifetime
, status_t
,
1786 private_ike_sa_t
*this, u_int32_t lifetime
)
1788 u_int32_t diff
, hard
, soft
, now
;
1789 ike_auth_lifetime_t
*task
;
1792 diff
= this->peer_cfg
->get_over_time(this->peer_cfg
);
1793 now
= time_monotonic(NULL
);
1794 hard
= now
+ lifetime
;
1797 /* check if we have to send an AUTH_LIFETIME to enforce the new lifetime.
1798 * We send the notify in IKE_AUTH if not yet ESTABLISHED. */
1799 send_update
= this->state
== IKE_ESTABLISHED
&&
1800 !has_condition(this, COND_ORIGINAL_INITIATOR
) &&
1801 (this->other_virtual_ip
!= NULL
||
1802 has_condition(this, COND_EAP_AUTHENTICATED
));
1804 if (lifetime
< diff
)
1806 this->stats
[STAT_REAUTH
] = now
;
1810 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, "
1811 "starting reauthentication", lifetime
);
1812 lib
->processor
->queue_job(lib
->processor
,
1813 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
));
1816 else if (this->stats
[STAT_REAUTH
] == 0 ||
1817 this->stats
[STAT_REAUTH
] > soft
)
1819 this->stats
[STAT_REAUTH
] = soft
;
1822 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, scheduling "
1823 "reauthentication in %ds", lifetime
, lifetime
- diff
);
1824 lib
->scheduler
->schedule_job(lib
->scheduler
,
1825 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
),
1831 DBG1(DBG_IKE
, "received AUTH_LIFETIME of %ds, "
1832 "reauthentication already scheduled in %ds", lifetime
,
1833 this->stats
[STAT_REAUTH
] - time_monotonic(NULL
));
1834 send_update
= FALSE
;
1836 /* give at least some seconds to reauthenticate */
1837 this->stats
[STAT_DELETE
] = max(hard
, now
+ 10);
1841 task
= ike_auth_lifetime_create(&this->public, TRUE
);
1842 this->task_manager
->queue_task(this->task_manager
, &task
->task
);
1843 return this->task_manager
->initiate(this->task_manager
);
1849 * Check if the current combination of source and destination address is still
1852 static bool is_current_path_valid(private_ike_sa_t
*this)
1856 src
= hydra
->kernel_interface
->get_source_addr(hydra
->kernel_interface
,
1857 this->other_host
, this->my_host
);
1860 if (src
->ip_equals(src
, this->my_host
))
1870 * Check if we have any path avialable for this IKE SA.
1872 static bool is_any_path_valid(private_ike_sa_t
*this)
1875 enumerator_t
*enumerator
;
1878 DBG1(DBG_IKE
, "old path is not available anymore, try to find another");
1879 enumerator
= this->peer_addresses
->create_enumerator(this->peer_addresses
);
1880 while (enumerator
->enumerate(enumerator
, &addr
))
1882 DBG1(DBG_IKE
, "looking for a route to %H ...", addr
);
1883 src
= hydra
->kernel_interface
->get_source_addr(
1884 hydra
->kernel_interface
, addr
, NULL
);
1890 enumerator
->destroy(enumerator
);
1899 METHOD(ike_sa_t
, roam
, status_t
,
1900 private_ike_sa_t
*this, bool address
)
1902 ike_mobike_t
*mobike
;
1904 switch (this->state
)
1908 case IKE_DESTROYING
:
1915 /* keep existing path if possible */
1916 if (is_current_path_valid(this))
1918 DBG2(DBG_IKE
, "keeping connection path %H - %H",
1919 this->my_host
, this->other_host
);
1920 set_condition(this, COND_STALE
, FALSE
);
1922 if (supports_extension(this, EXT_MOBIKE
) && address
)
1923 { /* if any addresses changed, send an updated list */
1924 DBG1(DBG_IKE
, "sending address list update using MOBIKE");
1925 mobike
= ike_mobike_create(&this->public, TRUE
);
1926 mobike
->addresses(mobike
);
1927 this->task_manager
->queue_task(this->task_manager
,
1929 return this->task_manager
->initiate(this->task_manager
);
1934 if (!is_any_path_valid(this))
1936 DBG1(DBG_IKE
, "no route found to reach %H, MOBIKE update deferred",
1938 set_condition(this, COND_STALE
, TRUE
);
1941 set_condition(this, COND_STALE
, FALSE
);
1943 /* update addresses with mobike, if supported ... */
1944 if (supports_extension(this, EXT_MOBIKE
))
1946 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
1947 { /* responder updates the peer about changed address config */
1948 DBG1(DBG_IKE
, "sending address list update using MOBIKE, "
1949 "implicitly requesting an address change");
1954 DBG1(DBG_IKE
, "requesting address change using MOBIKE");
1956 mobike
= ike_mobike_create(&this->public, TRUE
);
1957 mobike
->roam(mobike
, address
);
1958 this->task_manager
->queue_task(this->task_manager
, (task_t
*)mobike
);
1959 return this->task_manager
->initiate(this->task_manager
);
1962 /* ... reauth if not */
1963 if (!has_condition(this, COND_ORIGINAL_INITIATOR
))
1964 { /* responder does not reauthenticate */
1965 set_condition(this, COND_STALE
, TRUE
);
1968 DBG1(DBG_IKE
, "reauthenticating IKE_SA due to address change");
1969 return reauth(this);
1972 METHOD(ike_sa_t
, add_configuration_attribute
, void,
1973 private_ike_sa_t
*this, attribute_handler_t
*handler
,
1974 configuration_attribute_type_t type
, chunk_t data
)
1976 attribute_entry_t
*entry
= malloc_thing(attribute_entry_t
);
1978 entry
->handler
= handler
;
1980 entry
->data
= chunk_clone(data
);
1982 this->attributes
->insert_last(this->attributes
, entry
);
1985 METHOD(ike_sa_t
, create_task_enumerator
, enumerator_t
*,
1986 private_ike_sa_t
*this, task_queue_t queue
)
1988 return this->task_manager
->create_task_enumerator(this->task_manager
, queue
);
1991 METHOD(ike_sa_t
, inherit
, void,
1992 private_ike_sa_t
*this, ike_sa_t
*other_public
)
1994 private_ike_sa_t
*other
= (private_ike_sa_t
*)other_public
;
1995 child_sa_t
*child_sa
;
1996 attribute_entry_t
*entry
;
1997 enumerator_t
*enumerator
;
2000 /* apply hosts and ids */
2001 this->my_host
->destroy(this->my_host
);
2002 this->other_host
->destroy(this->other_host
);
2003 this->my_id
->destroy(this->my_id
);
2004 this->other_id
->destroy(this->other_id
);
2005 this->my_host
= other
->my_host
->clone(other
->my_host
);
2006 this->other_host
= other
->other_host
->clone(other
->other_host
);
2007 this->my_id
= other
->my_id
->clone(other
->my_id
);
2008 this->other_id
= other
->other_id
->clone(other
->other_id
);
2010 /* apply virtual assigned IPs... */
2011 if (other
->my_virtual_ip
)
2013 this->my_virtual_ip
= other
->my_virtual_ip
;
2014 other
->my_virtual_ip
= NULL
;
2016 if (other
->other_virtual_ip
)
2018 this->other_virtual_ip
= other
->other_virtual_ip
;
2019 other
->other_virtual_ip
= NULL
;
2022 /* authentication information */
2023 enumerator
= other
->my_auths
->create_enumerator(other
->my_auths
);
2024 while (enumerator
->enumerate(enumerator
, &cfg
))
2026 this->my_auths
->insert_last(this->my_auths
, cfg
->clone(cfg
));
2028 enumerator
->destroy(enumerator
);
2029 enumerator
= other
->other_auths
->create_enumerator(other
->other_auths
);
2030 while (enumerator
->enumerate(enumerator
, &cfg
))
2032 this->other_auths
->insert_last(this->other_auths
, cfg
->clone(cfg
));
2034 enumerator
->destroy(enumerator
);
2036 /* ... and configuration attributes */
2037 while (other
->attributes
->remove_last(other
->attributes
,
2038 (void**)&entry
) == SUCCESS
)
2040 this->attributes
->insert_first(this->attributes
, entry
);
2043 /* inherit all conditions */
2044 this->conditions
= other
->conditions
;
2045 if (this->conditions
& COND_NAT_HERE
)
2047 send_keepalive(this);
2051 if (other
->is_mediation_server
)
2053 act_as_mediation_server(this);
2055 else if (other
->server_reflexive_host
)
2057 this->server_reflexive_host
= other
->server_reflexive_host
->clone(
2058 other
->server_reflexive_host
);
2062 /* adopt all children */
2063 while (other
->child_sas
->remove_last(other
->child_sas
,
2064 (void**)&child_sa
) == SUCCESS
)
2066 this->child_sas
->insert_first(this->child_sas
, (void*)child_sa
);
2069 /* move pending tasks to the new IKE_SA */
2070 this->task_manager
->adopt_tasks(this->task_manager
, other
->task_manager
);
2072 /* reauthentication timeout survives a rekeying */
2073 if (other
->stats
[STAT_REAUTH
])
2075 time_t reauth
, delete, now
= time_monotonic(NULL
);
2077 this->stats
[STAT_REAUTH
] = other
->stats
[STAT_REAUTH
];
2078 reauth
= this->stats
[STAT_REAUTH
] - now
;
2079 delete = reauth
+ this->peer_cfg
->get_over_time(this->peer_cfg
);
2080 this->stats
[STAT_DELETE
] = this->stats
[STAT_REAUTH
] + delete;
2081 DBG1(DBG_IKE
, "rescheduling reauthentication in %ds after rekeying, "
2082 "lifetime reduced to %ds", reauth
, delete);
2083 lib
->scheduler
->schedule_job(lib
->scheduler
,
2084 (job_t
*)rekey_ike_sa_job_create(this->ike_sa_id
, TRUE
), reauth
);
2085 lib
->scheduler
->schedule_job(lib
->scheduler
,
2086 (job_t
*)delete_ike_sa_job_create(this->ike_sa_id
, TRUE
), delete);
2090 METHOD(ike_sa_t
, destroy
, void,
2091 private_ike_sa_t
*this)
2093 attribute_entry_t
*entry
;
2095 charon
->bus
->set_sa(charon
->bus
, &this->public);
2097 set_state(this, IKE_DESTROYING
);
2098 this->task_manager
->destroy(this->task_manager
);
2100 /* remove attributes first, as we pass the IKE_SA to the handler */
2101 while (this->attributes
->remove_last(this->attributes
,
2102 (void**)&entry
) == SUCCESS
)
2104 hydra
->attributes
->release(hydra
->attributes
, entry
->handler
,
2105 this->other_id
, entry
->type
, entry
->data
);
2106 free(entry
->data
.ptr
);
2109 this->attributes
->destroy(this->attributes
);
2111 this->child_sas
->destroy_offset(this->child_sas
, offsetof(child_sa_t
, destroy
));
2113 /* unset SA after here to avoid usage by the listeners */
2114 charon
->bus
->set_sa(charon
->bus
, NULL
);
2116 this->keymat
->destroy(this->keymat
);
2118 if (this->my_virtual_ip
)
2120 hydra
->kernel_interface
->del_ip(hydra
->kernel_interface
,
2121 this->my_virtual_ip
);
2122 this->my_virtual_ip
->destroy(this->my_virtual_ip
);
2124 if (this->other_virtual_ip
)
2126 if (this->peer_cfg
&& this->peer_cfg
->get_pool(this->peer_cfg
))
2128 hydra
->attributes
->release_address(hydra
->attributes
,
2129 this->peer_cfg
->get_pool(this->peer_cfg
),
2130 this->other_virtual_ip
, get_other_eap_id(this));
2132 this->other_virtual_ip
->destroy(this->other_virtual_ip
);
2134 this->peer_addresses
->destroy_offset(this->peer_addresses
,
2135 offsetof(host_t
, destroy
));
2137 if (this->is_mediation_server
)
2139 charon
->mediation_manager
->remove(charon
->mediation_manager
,
2142 DESTROY_IF(this->server_reflexive_host
);
2143 chunk_free(&this->connect_id
);
2145 free(this->nat_detection_dest
.ptr
);
2147 DESTROY_IF(this->my_host
);
2148 DESTROY_IF(this->other_host
);
2149 DESTROY_IF(this->my_id
);
2150 DESTROY_IF(this->other_id
);
2151 DESTROY_IF(this->local_host
);
2152 DESTROY_IF(this->remote_host
);
2154 DESTROY_IF(this->ike_cfg
);
2155 DESTROY_IF(this->peer_cfg
);
2156 DESTROY_IF(this->proposal
);
2157 this->my_auth
->destroy(this->my_auth
);
2158 this->other_auth
->destroy(this->other_auth
);
2159 this->my_auths
->destroy_offset(this->my_auths
,
2160 offsetof(auth_cfg_t
, destroy
));
2161 this->other_auths
->destroy_offset(this->other_auths
,
2162 offsetof(auth_cfg_t
, destroy
));
2164 this->ike_sa_id
->destroy(this->ike_sa_id
);
2169 * Described in header.
2171 ike_sa_t
* ike_sa_create(ike_sa_id_t
*ike_sa_id
)
2173 private_ike_sa_t
*this;
2174 static u_int32_t unique_id
= 0;
2178 .get_state
= _get_state
,
2179 .set_state
= _set_state
,
2180 .get_name
= _get_name
,
2181 .get_statistic
= _get_statistic
,
2182 .process_message
= _process_message
,
2183 .initiate
= _initiate
,
2184 .get_ike_cfg
= _get_ike_cfg
,
2185 .set_ike_cfg
= _set_ike_cfg
,
2186 .get_peer_cfg
= _get_peer_cfg
,
2187 .set_peer_cfg
= _set_peer_cfg
,
2188 .get_auth_cfg
= _get_auth_cfg
,
2189 .create_auth_cfg_enumerator
= _create_auth_cfg_enumerator
,
2190 .add_auth_cfg
= _add_auth_cfg
,
2191 .get_proposal
= _get_proposal
,
2192 .set_proposal
= _set_proposal
,
2194 .get_my_host
= _get_my_host
,
2195 .set_my_host
= _set_my_host
,
2196 .get_other_host
= _get_other_host
,
2197 .set_other_host
= _set_other_host
,
2198 .set_message_id
= _set_message_id
,
2199 .float_ports
= _float_ports
,
2200 .update_hosts
= _update_hosts
,
2201 .get_my_id
= _get_my_id
,
2202 .set_my_id
= _set_my_id
,
2203 .get_other_id
= _get_other_id
,
2204 .set_other_id
= _set_other_id
,
2205 .get_other_eap_id
= _get_other_eap_id
,
2206 .enable_extension
= _enable_extension
,
2207 .supports_extension
= _supports_extension
,
2208 .set_condition
= _set_condition
,
2209 .has_condition
= _has_condition
,
2210 .set_pending_updates
= _set_pending_updates
,
2211 .get_pending_updates
= _get_pending_updates
,
2212 .create_peer_address_enumerator
= _create_peer_address_enumerator
,
2213 .add_peer_address
= _add_peer_address
,
2214 .clear_peer_addresses
= _clear_peer_addresses
,
2215 .has_mapping_changed
= _has_mapping_changed
,
2216 .retransmit
= _retransmit
,
2218 .destroy
= _destroy
,
2219 .send_dpd
= _send_dpd
,
2220 .send_keepalive
= _send_keepalive
,
2221 .get_keymat
= _get_keymat
,
2222 .add_child_sa
= _add_child_sa
,
2223 .get_child_sa
= _get_child_sa
,
2224 .get_child_count
= _get_child_count
,
2225 .create_child_sa_enumerator
= _create_child_sa_enumerator
,
2226 .remove_child_sa
= _remove_child_sa
,
2227 .rekey_child_sa
= _rekey_child_sa
,
2228 .delete_child_sa
= _delete_child_sa
,
2229 .destroy_child_sa
= _destroy_child_sa
,
2232 .reestablish
= _reestablish
,
2233 .set_auth_lifetime
= _set_auth_lifetime
,
2235 .inherit
= _inherit
,
2236 .generate_message
= _generate_message
,
2238 .get_unique_id
= _get_unique_id
,
2239 .set_virtual_ip
= _set_virtual_ip
,
2240 .get_virtual_ip
= _get_virtual_ip
,
2241 .add_configuration_attribute
= _add_configuration_attribute
,
2242 .set_kmaddress
= _set_kmaddress
,
2243 .create_task_enumerator
= _create_task_enumerator
,
2245 .act_as_mediation_server
= _act_as_mediation_server
,
2246 .get_server_reflexive_host
= _get_server_reflexive_host
,
2247 .set_server_reflexive_host
= _set_server_reflexive_host
,
2248 .get_connect_id
= _get_connect_id
,
2249 .initiate_mediation
= _initiate_mediation
,
2250 .initiate_mediated
= _initiate_mediated
,
2252 .callback
= _callback
,
2253 .respond
= _respond
,
2256 .ike_sa_id
= ike_sa_id
->clone(ike_sa_id
),
2257 .child_sas
= linked_list_create(),
2258 .my_host
= host_create_any(AF_INET
),
2259 .other_host
= host_create_any(AF_INET
),
2260 .my_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
),
2261 .other_id
= identification_create_from_encoding(ID_ANY
, chunk_empty
),
2262 .keymat
= keymat_create(ike_sa_id
->is_initiator(ike_sa_id
)),
2263 .state
= IKE_CREATED
,
2264 .stats
[STAT_INBOUND
] = time_monotonic(NULL
),
2265 .stats
[STAT_OUTBOUND
] = time_monotonic(NULL
),
2266 .my_auth
= auth_cfg_create(),
2267 .other_auth
= auth_cfg_create(),
2268 .my_auths
= linked_list_create(),
2269 .other_auths
= linked_list_create(),
2270 .unique_id
= ++unique_id
,
2271 .peer_addresses
= linked_list_create(),
2272 .attributes
= linked_list_create(),
2273 .keepalive_interval
= lib
->settings
->get_time(lib
->settings
,
2274 "charon.keep_alive", KEEPALIVE_INTERVAL
),
2276 this->task_manager
= task_manager_create(&this->public);
2277 this->my_host
->set_port(this->my_host
, IKEV2_UDP_PORT
);
2279 return &this->public;