src/libcharon/sa/ikev1/task_manager_v1.c

   1 /*
   2  * Copyright (C) 2007-2015 Tobias Brunner
   3  * Copyright (C) 2007-2011 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include "task_manager_v1.h"
  18
  19 #include <math.h>
  20
  21 #include <daemon.h>
  22 #include <sa/ikev1/tasks/main_mode.h>
  23 #include <sa/ikev1/tasks/aggressive_mode.h>
  24 #include <sa/ikev1/tasks/quick_mode.h>
  25 #include <sa/ikev1/tasks/quick_delete.h>
  26 #include <sa/ikev1/tasks/xauth.h>
  27 #include <sa/ikev1/tasks/mode_config.h>
  28 #include <sa/ikev1/tasks/informational.h>
  29 #include <sa/ikev1/tasks/isakmp_natd.h>
  30 #include <sa/ikev1/tasks/isakmp_vendor.h>
  31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
  32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
  33 #include <sa/ikev1/tasks/isakmp_delete.h>
  34 #include <sa/ikev1/tasks/isakmp_dpd.h>
  35
  36 #include <processing/jobs/retransmit_job.h>
  37 #include <processing/jobs/delete_ike_sa_job.h>
  38 #include <processing/jobs/dpd_timeout_job.h>
  39 #include <processing/jobs/process_message_job.h>
  40
  41 #include <collections/array.h>
  42
  43 /**
  44  * Number of old messages hashes we keep for retransmission.
  45  *
  46  * In Main Mode, we must ignore messages from a previous message pair if
  47  * we already continued to the next. Otherwise a late retransmission
  48  * could be considered as a reply to the newer request.
  49  */
  50 #define MAX_OLD_HASHES 2
  51
  52 /**
  53  * First sequence number of responding packets.
  54  *
  55  * To distinguish retransmission jobs for initiating and responding packets,
  56  * we split up the sequence counter and use the upper half for responding.
  57  */
  58 #define RESPONDING_SEQ INT_MAX
  59
  60 typedef struct exchange_t exchange_t;
  61
  62 /**
  63  * An exchange in the air, used do detect and handle retransmission
  64  */
  65 struct exchange_t {
  66
  67         /**
  68          * Message ID used for this transaction
  69          */
  70         u_int32_t mid;
  71
  72         /**
  73          * generated packet for retransmission
  74          */
  75         packet_t *packet;
  76 };
  77
  78 typedef struct private_task_manager_t private_task_manager_t;
  79
  80 /**
  81  * private data of the task manager
  82  */
  83 struct private_task_manager_t {
  84
  85         /**
  86          * public functions
  87          */
  88         task_manager_v1_t public;
  89
  90         /**
  91          * associated IKE_SA we are serving
  92          */
  93         ike_sa_t *ike_sa;
  94
  95         /**
  96          * RNG to create message IDs
  97          */
  98         rng_t *rng;
  99
 100         /**
 101          * Exchange we are currently handling as responder
 102          */
 103         struct {
 104                 /**
 105                  * Message ID of the last response
 106                  */
 107                 u_int32_t mid;
 108
 109                 /**
 110                  * Hash of a previously received message
 111                  */
 112                 u_int32_t hash;
 113
 114                 /**
 115                  * packet(s) for retransmission
 116                  */
 117                 array_t *packets;
 118
 119                 /**
 120                  * Sequence number of the last sent message
 121                  */
 122                 u_int32_t seqnr;
 123
 124                 /**
 125                  * how many times we have retransmitted so far
 126                  */
 127                 u_int retransmitted;
 128
 129         } responding;
 130
 131         /**
 132          * Exchange we are currently handling as initiator
 133          */
 134         struct {
 135                 /**
 136                  * Message ID of the exchange
 137                  */
 138                 u_int32_t mid;
 139
 140                 /**
 141                  * Hashes of old responses we can ignore
 142                  */
 143                 u_int32_t old_hashes[MAX_OLD_HASHES];
 144
 145                 /**
 146                  * Position in old hash array
 147                  */
 148                 int old_hash_pos;
 149
 150                 /**
 151                  * Sequence number of the last sent message
 152                  */
 153                 u_int32_t seqnr;
 154
 155                 /**
 156                  * how many times we have retransmitted so far
 157                  */
 158                 u_int retransmitted;
 159
 160                 /**
 161                  * packet(s) for retransmission
 162                  */
 163                 array_t *packets;
 164
 165                 /**
 166                  * type of the initiated exchange
 167                  */
 168                 exchange_type_t type;
 169
 170         } initiating;
 171
 172         /**
 173          * Message we are currently defragmenting, if any (only one at a time)
 174          */
 175         message_t *defrag;
 176
 177         /**
 178          * List of queued tasks not yet in action
 179          */
 180         linked_list_t *queued_tasks;
 181
 182         /**
 183          * List of active tasks, initiated by ourselves
 184          */
 185         linked_list_t *active_tasks;
 186
 187         /**
 188          * List of tasks initiated by peer
 189          */
 190         linked_list_t *passive_tasks;
 191
 192         /**
 193          * Queued messages not yet ready to process
 194          */
 195         message_t *queued;
 196
 197         /**
 198          * Number of times we retransmit messages before giving up
 199          */
 200         u_int retransmit_tries;
 201
 202         /**
 203          * Retransmission timeout
 204          */
 205         double retransmit_timeout;
 206
 207         /**
 208          * Base to calculate retransmission timeout
 209          */
 210         double retransmit_base;
 211
 212         /**
 213          * Sequence number for sending DPD requests
 214          */
 215         u_int32_t dpd_send;
 216
 217         /**
 218          * Sequence number for received DPD requests
 219          */
 220         u_int32_t dpd_recv;
 221 };
 222
 223 /**
 224  * Reset retransmission packet list
 225  */
 226 static void clear_packets(array_t *array)
 227 {
 228         packet_t *packet;
 229
 230         while (array_remove(array, ARRAY_TAIL, &packet))
 231         {
 232                 packet->destroy(packet);
 233         }
 234 }
 235
 236 METHOD(task_manager_t, flush_queue, void,
 237         private_task_manager_t *this, task_queue_t queue)
 238 {
 239         linked_list_t *list;
 240         task_t *task;
 241
 242         if (this->queued)
 243         {
 244                 this->queued->destroy(this->queued);
 245                 this->queued = NULL;
 246         }
 247         switch (queue)
 248         {
 249                 case TASK_QUEUE_ACTIVE:
 250                         list = this->active_tasks;
 251                         /* cancel pending retransmits */
 252                         this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
 253                         clear_packets(this->initiating.packets);
 254                         break;
 255                 case TASK_QUEUE_PASSIVE:
 256                         list = this->passive_tasks;
 257                         break;
 258                 case TASK_QUEUE_QUEUED:
 259                         list = this->queued_tasks;
 260                         break;
 261                 default:
 262                         return;
 263         }
 264         while (list->remove_last(list, (void**)&task) == SUCCESS)
 265         {
 266                 task->destroy(task);
 267         }
 268 }
 269
 270 METHOD(task_manager_t, flush, void,
 271         private_task_manager_t *this)
 272 {
 273         flush_queue(this, TASK_QUEUE_QUEUED);
 274         flush_queue(this, TASK_QUEUE_PASSIVE);
 275         flush_queue(this, TASK_QUEUE_ACTIVE);
 276 }
 277
 278 /**
 279  * move a task of a specific type from the queue to the active list
 280  */
 281 static bool activate_task(private_task_manager_t *this, task_type_t type)
 282 {
 283         enumerator_t *enumerator;
 284         task_t *task;
 285         bool found = FALSE;
 286
 287         enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
 288         while (enumerator->enumerate(enumerator, (void**)&task))
 289         {
 290                 if (task->get_type(task) == type)
 291                 {
 292                         DBG2(DBG_IKE, "  activating %N task", task_type_names, type);
 293                         this->queued_tasks->remove_at(this->queued_tasks, enumerator);
 294                         this->active_tasks->insert_last(this->active_tasks, task);
 295                         found = TRUE;
 296                         break;
 297                 }
 298         }
 299         enumerator->destroy(enumerator);
 300         return found;
 301 }
 302
 303 /**
 304  * Send packets in the given array (they get cloned)
 305  */
 306 static void send_packets(private_task_manager_t *this, array_t *packets)
 307 {
 308         enumerator_t *enumerator;
 309         packet_t *packet;
 310
 311         enumerator = array_create_enumerator(packets);
 312         while (enumerator->enumerate(enumerator, &packet))
 313         {
 314                 charon->sender->send(charon->sender, packet->clone(packet));
 315         }
 316         enumerator->destroy(enumerator);
 317 }
 318
 319 /**
 320  * Generates the given message and stores packet(s) in the given array
 321  */
 322 static bool generate_message(private_task_manager_t *this, message_t *message,
 323                                                          array_t **packets)
 324 {
 325         enumerator_t *fragments;
 326         packet_t *fragment;
 327
 328         if (this->ike_sa->generate_message_fragmented(this->ike_sa, message,
 329                                                                                                   &fragments) != SUCCESS)
 330         {
 331                 return FALSE;
 332         }
 333         while (fragments->enumerate(fragments, &fragment))
 334         {
 335                 array_insert_create(packets, ARRAY_TAIL, fragment);
 336         }
 337         fragments->destroy(fragments);
 338         return TRUE;
 339 }
 340
 341 /**
 342  * Retransmit a packet (or its fragments)
 343  */
 344 static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
 345                                                         u_int mid, u_int retransmitted, array_t *packets)
 346 {
 347         packet_t *packet;
 348         u_int32_t t;
 349
 350         array_get(packets, 0, &packet);
 351         if (retransmitted > this->retransmit_tries)
 352         {
 353                 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
 354                 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_TIMEOUT, packet);
 355                 return DESTROY_ME;
 356         }
 357         t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
 358                                         pow(this->retransmit_base, retransmitted));
 359         if (retransmitted)
 360         {
 361                 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
 362                          retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
 363                          mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
 364                 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND, packet);
 365         }
 366         send_packets(this, packets);
 367         lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
 368                         retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
 369         return NEED_MORE;
 370 }
 371
 372 METHOD(task_manager_t, retransmit, status_t,
 373         private_task_manager_t *this, u_int32_t seqnr)
 374 {
 375         status_t status = SUCCESS;
 376
 377         if (seqnr == this->initiating.seqnr &&
 378                 array_count(this->initiating.packets))
 379         {
 380                 status = retransmit_packet(this, seqnr, this->initiating.mid,
 381                                         this->initiating.retransmitted, this->initiating.packets);
 382                 if (status == NEED_MORE)
 383                 {
 384                         this->initiating.retransmitted++;
 385                         status = SUCCESS;
 386                 }
 387         }
 388         if (seqnr == this->responding.seqnr &&
 389                 array_count(this->responding.packets))
 390         {
 391                 status = retransmit_packet(this, seqnr, this->responding.mid,
 392                                         this->responding.retransmitted, this->responding.packets);
 393                 if (status == NEED_MORE)
 394                 {
 395                         this->responding.retransmitted++;
 396                         status = SUCCESS;
 397                 }
 398         }
 399         return status;
 400 }
 401
 402 /**
 403  * Check if we have to wait for a mode config before starting a quick mode
 404  */
 405 static bool mode_config_expected(private_task_manager_t *this)
 406 {
 407         enumerator_t *enumerator;
 408         peer_cfg_t *peer_cfg;
 409         char *pool;
 410         bool local;
 411         host_t *host;
 412
 413         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 414         if (peer_cfg)
 415         {
 416                 if (peer_cfg->use_pull_mode(peer_cfg))
 417                 {
 418                         enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
 419                         if (!enumerator->enumerate(enumerator, &pool))
 420                         {       /* no pool configured */
 421                                 enumerator->destroy(enumerator);
 422                                 return FALSE;
 423                         }
 424                         enumerator->destroy(enumerator);
 425
 426                         local = FALSE;
 427                 }
 428                 else
 429                 {
 430                         enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
 431                         if (!enumerator->enumerate(enumerator, &host))
 432                         {       /* not requesting a vip */
 433                                 enumerator->destroy(enumerator);
 434                                 return FALSE;
 435                         }
 436                         enumerator->destroy(enumerator);
 437
 438                         local = TRUE;
 439                 }
 440                 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
 441                                                                                                                                 local);
 442                 if (!enumerator->enumerate(enumerator, &host))
 443                 {       /* expecting a VIP exchange, but no VIP assigned yet */
 444                         enumerator->destroy(enumerator);
 445                         return TRUE;
 446                 }
 447                 enumerator->destroy(enumerator);
 448         }
 449         return FALSE;
 450 }
 451
 452 METHOD(task_manager_t, initiate, status_t,
 453         private_task_manager_t *this)
 454 {
 455         enumerator_t *enumerator;
 456         task_t *task;
 457         message_t *message;
 458         host_t *me, *other;
 459         exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
 460         bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
 461
 462         if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
 463                 this->initiating.type != INFORMATIONAL_V1)
 464         {
 465                 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
 466                                 exchange_type_names, this->initiating.type);
 467                 /* do not initiate if we already have a message in the air */
 468                 return SUCCESS;
 469         }
 470
 471         if (this->active_tasks->get_count(this->active_tasks) == 0)
 472         {
 473                 DBG2(DBG_IKE, "activating new tasks");
 474                 switch (this->ike_sa->get_state(this->ike_sa))
 475                 {
 476                         case IKE_CREATED:
 477                                 activate_task(this, TASK_ISAKMP_VENDOR);
 478                                 activate_task(this, TASK_ISAKMP_CERT_PRE);
 479                                 if (activate_task(this, TASK_MAIN_MODE))
 480                                 {
 481                                         exchange = ID_PROT;
 482                                 }
 483                                 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
 484                                 {
 485                                         exchange = AGGRESSIVE;
 486                                 }
 487                                 activate_task(this, TASK_ISAKMP_CERT_POST);
 488                                 activate_task(this, TASK_ISAKMP_NATD);
 489                                 break;
 490                         case IKE_CONNECTING:
 491                                 if (activate_task(this, TASK_ISAKMP_DELETE))
 492                                 {
 493                                         exchange = INFORMATIONAL_V1;
 494                                         new_mid = TRUE;
 495                                         break;
 496                                 }
 497                                 if (activate_task(this, TASK_XAUTH))
 498                                 {
 499                                         exchange = TRANSACTION;
 500                                         new_mid = TRUE;
 501                                         break;
 502                                 }
 503                                 if (activate_task(this, TASK_INFORMATIONAL))
 504                                 {
 505                                         exchange = INFORMATIONAL_V1;
 506                                         new_mid = TRUE;
 507                                         break;
 508                                 }
 509                                 break;
 510                         case IKE_ESTABLISHED:
 511                                 if (activate_task(this, TASK_MODE_CONFIG))
 512                                 {
 513                                         exchange = TRANSACTION;
 514                                         new_mid = TRUE;
 515                                         break;
 516                                 }
 517                                 if (!mode_config_expected(this) &&
 518                                         activate_task(this, TASK_QUICK_MODE))
 519                                 {
 520                                         exchange = QUICK_MODE;
 521                                         new_mid = TRUE;
 522                                         break;
 523                                 }
 524                                 if (activate_task(this, TASK_INFORMATIONAL))
 525                                 {
 526                                         exchange = INFORMATIONAL_V1;
 527                                         new_mid = TRUE;
 528                                         break;
 529                                 }
 530                                 if (activate_task(this, TASK_QUICK_DELETE))
 531                                 {
 532                                         exchange = INFORMATIONAL_V1;
 533                                         new_mid = TRUE;
 534                                         break;
 535                                 }
 536                                 if (activate_task(this, TASK_ISAKMP_DELETE))
 537                                 {
 538                                         exchange = INFORMATIONAL_V1;
 539                                         new_mid = TRUE;
 540                                         break;
 541                                 }
 542                                 if (activate_task(this, TASK_ISAKMP_DPD))
 543                                 {
 544                                         exchange = INFORMATIONAL_V1;
 545                                         new_mid = TRUE;
 546                                         break;
 547                                 }
 548                                 break;
 549                         default:
 550                                 break;
 551                 }
 552         }
 553         else
 554         {
 555                 DBG2(DBG_IKE, "reinitiating already active tasks");
 556                 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
 557                 while (enumerator->enumerate(enumerator, (void**)&task))
 558                 {
 559                         DBG2(DBG_IKE, "  %N task", task_type_names, task->get_type(task));
 560                         switch (task->get_type(task))
 561                         {
 562                                 case TASK_MAIN_MODE:
 563                                         exchange = ID_PROT;
 564                                         break;
 565                                 case TASK_AGGRESSIVE_MODE:
 566                                         exchange = AGGRESSIVE;
 567                                         break;
 568                                 case TASK_QUICK_MODE:
 569                                         exchange = QUICK_MODE;
 570                                         break;
 571                                 case TASK_XAUTH:
 572                                         exchange = TRANSACTION;
 573                                         new_mid = TRUE;
 574                                         break;
 575                                 default:
 576                                         continue;
 577                         }
 578                         break;
 579                 }
 580                 enumerator->destroy(enumerator);
 581         }
 582
 583         if (exchange == EXCHANGE_TYPE_UNDEFINED)
 584         {
 585                 DBG2(DBG_IKE, "nothing to initiate");
 586                 /* nothing to do yet... */
 587                 return SUCCESS;
 588         }
 589
 590         me = this->ike_sa->get_my_host(this->ike_sa);
 591         other = this->ike_sa->get_other_host(this->ike_sa);
 592
 593         if (new_mid)
 594         {
 595                 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
 596                                                                  (void*)&this->initiating.mid))
 597                 {
 598                         DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
 599                         flush(this);
 600                         return DESTROY_ME;
 601                 }
 602         }
 603         message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 604         message->set_message_id(message, this->initiating.mid);
 605         message->set_source(message, me->clone(me));
 606         message->set_destination(message, other->clone(other));
 607         message->set_exchange_type(message, exchange);
 608         this->initiating.type = exchange;
 609         this->initiating.retransmitted = 0;
 610
 611         enumerator = this->active_tasks->create_enumerator(this->active_tasks);
 612         while (enumerator->enumerate(enumerator, (void*)&task))
 613         {
 614                 switch (task->build(task, message))
 615                 {
 616                         case SUCCESS:
 617                                 /* task completed, remove it */
 618                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
 619                                 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
 620                                         task->get_type(task) == TASK_QUICK_MODE)
 621                                 {       /* last message of three message exchange */
 622                                         keep = TRUE;
 623                                 }
 624                                 task->destroy(task);
 625                                 continue;
 626                         case NEED_MORE:
 627                                 expect_response = TRUE;
 628                                 /* processed, but task needs another exchange */
 629                                 continue;
 630                         case ALREADY_DONE:
 631                                 cancelled = TRUE;
 632                                 break;
 633                         case FAILED:
 634                         default:
 635                                 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
 636                                 {
 637                                         charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 638                                 }
 639                                 /* FALL */
 640                         case DESTROY_ME:
 641                                 /* critical failure, destroy IKE_SA */
 642                                 enumerator->destroy(enumerator);
 643                                 message->destroy(message);
 644                                 flush(this);
 645                                 return DESTROY_ME;
 646                 }
 647                 break;
 648         }
 649         enumerator->destroy(enumerator);
 650
 651         if (this->active_tasks->get_count(this->active_tasks) == 0 &&
 652                 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
 653         {       /* tasks completed, no exchange active anymore */
 654                 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
 655         }
 656         if (cancelled)
 657         {
 658                 message->destroy(message);
 659                 return initiate(this);
 660         }
 661
 662         clear_packets(this->initiating.packets);
 663         if (!generate_message(this, message, &this->initiating.packets))
 664         {
 665                 /* message generation failed. There is nothing more to do than to
 666                  * close the SA */
 667                 message->destroy(message);
 668                 flush(this);
 669                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 670                 return DESTROY_ME;
 671         }
 672
 673         this->initiating.seqnr++;
 674         if (expect_response)
 675         {
 676                 message->destroy(message);
 677                 return retransmit(this, this->initiating.seqnr);
 678         }
 679         if (keep)
 680         {       /* keep the packet for retransmission, the responder might request it */
 681                 send_packets(this, this->initiating.packets);
 682         }
 683         else
 684         {
 685                 send_packets(this, this->initiating.packets);
 686                 clear_packets(this->initiating.packets);
 687         }
 688         message->destroy(message);
 689
 690         if (exchange == INFORMATIONAL_V1)
 691         {
 692                 switch (this->ike_sa->get_state(this->ike_sa))
 693                 {
 694                         case IKE_CONNECTING:
 695                                 /* close after sending an INFORMATIONAL when unestablished */
 696                                 return FAILED;
 697                         case IKE_DELETING:
 698                                 /* close after sending a DELETE */
 699                                 return DESTROY_ME;
 700                         default:
 701                                 break;
 702                 }
 703         }
 704         return initiate(this);
 705 }
 706
 707 /**
 708  * build a response depending on the "passive" task list
 709  */
 710 static status_t build_response(private_task_manager_t *this, message_t *request)
 711 {
 712         enumerator_t *enumerator;
 713         task_t *task;
 714         message_t *message;
 715         host_t *me, *other;
 716         bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
 717
 718         me = request->get_destination(request);
 719         other = request->get_source(request);
 720
 721         message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 722         message->set_exchange_type(message, request->get_exchange_type(request));
 723         /* send response along the path the request came in */
 724         message->set_source(message, me->clone(me));
 725         message->set_destination(message, other->clone(other));
 726         message->set_message_id(message, request->get_message_id(request));
 727         message->set_request(message, FALSE);
 728
 729         this->responding.mid = request->get_message_id(request);
 730         this->responding.retransmitted = 0;
 731         this->responding.seqnr++;
 732
 733         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
 734         while (enumerator->enumerate(enumerator, (void*)&task))
 735         {
 736                 switch (task->build(task, message))
 737                 {
 738                         case SUCCESS:
 739                                 /* task completed, remove it */
 740                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
 741                                 task->destroy(task);
 742                                 continue;
 743                         case NEED_MORE:
 744                                 /* processed, but task needs another exchange */
 745                                 if (task->get_type(task) == TASK_QUICK_MODE ||
 746                                         task->get_type(task) == TASK_AGGRESSIVE_MODE)
 747                                 {       /* we rely on initiator retransmission, except for
 748                                          * three-message exchanges */
 749                                         expect_request = TRUE;
 750                                 }
 751                                 continue;
 752                         case ALREADY_DONE:
 753                                 cancelled = TRUE;
 754                                 break;
 755                         case INVALID_ARG:
 756                                 if (task->get_type(task) == TASK_QUICK_MODE)
 757                                 {       /* not responsible for this exchange */
 758                                         continue;
 759                                 }
 760                                 /* FALL */
 761                         case FAILED:
 762                         default:
 763                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 764                                 /* FALL */
 765                         case DESTROY_ME:
 766                                 /* destroy IKE_SA, but SEND response first */
 767                                 delete = TRUE;
 768                                 break;
 769                 }
 770                 break;
 771         }
 772         enumerator->destroy(enumerator);
 773
 774         clear_packets(this->responding.packets);
 775         if (cancelled)
 776         {
 777                 message->destroy(message);
 778                 return initiate(this);
 779         }
 780         if (!generate_message(this, message, &this->responding.packets))
 781         {
 782                 message->destroy(message);
 783                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 784                 return DESTROY_ME;
 785         }
 786         message->destroy(message);
 787
 788         if (expect_request && !delete)
 789         {
 790                 return retransmit(this, this->responding.seqnr);
 791         }
 792         send_packets(this, this->responding.packets);
 793         if (delete)
 794         {
 795                 return DESTROY_ME;
 796         }
 797         return SUCCESS;
 798 }
 799
 800 /**
 801  * Send a notify in a separate INFORMATIONAL exchange back to the sender.
 802  * The notify protocol_id is set to ISAKMP
 803  */
 804 static void send_notify(private_task_manager_t *this, message_t *request,
 805                                                 notify_type_t type)
 806 {
 807         message_t *response;
 808         array_t *packets = NULL;
 809         host_t *me, *other;
 810         u_int32_t mid;
 811
 812         if (request->get_exchange_type(request) == INFORMATIONAL_V1)
 813         {       /* don't respond to INFORMATIONAL requests to avoid a notify war */
 814                 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
 815                 return;
 816         }
 817         if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
 818         {
 819                 DBG1(DBG_IKE, "failed to allocate message ID");
 820                 return;
 821         }
 822         response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 823         response->set_exchange_type(response, INFORMATIONAL_V1);
 824         response->set_request(response, TRUE);
 825         response->set_message_id(response, mid);
 826         response->add_payload(response, (payload_t*)
 827                                 notify_payload_create_from_protocol_and_type(PLV1_NOTIFY,
 828                                                                                                         PROTO_IKE, type));
 829
 830         me = this->ike_sa->get_my_host(this->ike_sa);
 831         if (me->is_anyaddr(me))
 832         {
 833                 me = request->get_destination(request);
 834                 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
 835         }
 836         other = this->ike_sa->get_other_host(this->ike_sa);
 837         if (other->is_anyaddr(other))
 838         {
 839                 other = request->get_source(request);
 840                 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
 841         }
 842         response->set_source(response, me->clone(me));
 843         response->set_destination(response, other->clone(other));
 844         if (generate_message(this, response, &packets))
 845         {
 846                 send_packets(this, packets);
 847         }
 848         clear_packets(packets);
 849         array_destroy(packets);
 850         response->destroy(response);
 851 }
 852
 853 /**
 854  * Process a DPD request/response
 855  */
 856 static bool process_dpd(private_task_manager_t *this, message_t *message)
 857 {
 858         notify_payload_t *notify;
 859         notify_type_t type;
 860         u_int32_t seq;
 861         chunk_t data;
 862
 863         type = DPD_R_U_THERE;
 864         notify = message->get_notify(message, type);
 865         if (!notify)
 866         {
 867                 type = DPD_R_U_THERE_ACK;
 868                 notify = message->get_notify(message, type);
 869         }
 870         if (!notify)
 871         {
 872                 return FALSE;
 873         }
 874         data = notify->get_notification_data(notify);
 875         if (data.len != 4)
 876         {
 877                 return FALSE;
 878         }
 879         seq = untoh32(data.ptr);
 880
 881         if (type == DPD_R_U_THERE)
 882         {
 883                 if (this->dpd_recv == 0 || seq == this->dpd_recv)
 884                 {       /* check sequence validity */
 885                         this->dpd_recv = seq + 1;
 886                         this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
 887                                                                                 time_monotonic(NULL));
 888                 }
 889                 /* but respond anyway */
 890                 this->ike_sa->queue_task(this->ike_sa,
 891                                 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
 892         }
 893         else /* DPD_R_U_THERE_ACK */
 894         {
 895                 if (seq == this->dpd_send - 1)
 896                 {
 897                         this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
 898                                                                                 time_monotonic(NULL));
 899                 }
 900                 else
 901                 {
 902                         DBG1(DBG_IKE, "received invalid DPD sequence number %u "
 903                                  "(expected %u), ignored", seq, this->dpd_send - 1);
 904                 }
 905         }
 906         return TRUE;
 907 }
 908
 909 /**
 910  * Check if we already have a quick mode task queued for the exchange with the
 911  * given message ID
 912  */
 913 static bool have_quick_mode_task(private_task_manager_t *this, u_int32_t mid)
 914 {
 915         enumerator_t *enumerator;
 916         quick_mode_t *qm;
 917         task_t *task;
 918         bool found = FALSE;
 919
 920         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
 921         while (enumerator->enumerate(enumerator, &task))
 922         {
 923                 if (task->get_type(task) == TASK_QUICK_MODE)
 924                 {
 925                         qm = (quick_mode_t*)task;
 926                         if (qm->get_mid(qm) == mid)
 927                         {
 928                                 found = TRUE;
 929                                 break;
 930                         }
 931                 }
 932         }
 933         enumerator->destroy(enumerator);
 934         return found;
 935 }
 936
 937 /**
 938  * Check if we still have an aggressive mode task queued
 939  */
 940 static bool have_aggressive_mode_task(private_task_manager_t *this)
 941 {
 942         enumerator_t *enumerator;
 943         task_t *task;
 944         bool found = FALSE;
 945
 946         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
 947         while (enumerator->enumerate(enumerator, &task))
 948         {
 949                 if (task->get_type(task) == TASK_AGGRESSIVE_MODE)
 950                 {
 951                         found = TRUE;
 952                         break;
 953                 }
 954         }
 955         enumerator->destroy(enumerator);
 956         return found;
 957 }
 958
 959 /**
 960  * handle an incoming request message
 961  */
 962 static status_t process_request(private_task_manager_t *this,
 963                                                                 message_t *message)
 964 {
 965         enumerator_t *enumerator;
 966         task_t *task = NULL;
 967         bool send_response = FALSE, dpd = FALSE;
 968
 969         if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
 970                 message->get_exchange_type(message) == QUICK_MODE ||
 971                 this->passive_tasks->get_count(this->passive_tasks) == 0)
 972         {       /* create tasks depending on request type, if not already some queued */
 973                 switch (message->get_exchange_type(message))
 974                 {
 975                         case ID_PROT:
 976                                 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
 977                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 978                                 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
 979                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 980                                 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
 981                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 982                                 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
 983                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 984                                 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
 985                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 986                                 break;
 987                         case AGGRESSIVE:
 988                                 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
 989                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 990                                 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
 991                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 992                                 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
 993                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 994                                 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
 995                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 996                                 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
 997                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 998                                 break;
 999                         case QUICK_MODE:
1000                                 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1001                                 {
1002                                         DBG1(DBG_IKE, "received quick mode request for "
1003                                                  "unestablished IKE_SA, ignored");
1004                                         return FAILED;
1005                                 }
1006                                 if (have_quick_mode_task(this, message->get_message_id(message)))
1007                                 {
1008                                         break;
1009                                 }
1010                                 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
1011                                                                                                    NULL, NULL);
1012                                 this->passive_tasks->insert_last(this->passive_tasks, task);
1013                                 break;
1014                         case INFORMATIONAL_V1:
1015                                 if (process_dpd(this, message))
1016                                 {
1017                                         dpd = TRUE;
1018                                 }
1019                                 else
1020                                 {
1021                                         task = (task_t *)informational_create(this->ike_sa, NULL);
1022                                         this->passive_tasks->insert_first(this->passive_tasks, task);
1023                                 }
1024                                 break;
1025                         case TRANSACTION:
1026                                 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
1027                                 {
1028                                         task = (task_t *)mode_config_create(this->ike_sa,
1029                                                                                                                 FALSE, TRUE);
1030                                 }
1031                                 else
1032                                 {
1033                                         task = (task_t *)xauth_create(this->ike_sa, FALSE);
1034                                 }
1035                                 this->passive_tasks->insert_last(this->passive_tasks, task);
1036                                 break;
1037                         default:
1038                                 return FAILED;
1039                 }
1040         }
1041         if (dpd)
1042         {
1043                 return initiate(this);
1044         }
1045         this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
1046
1047         /* let the tasks process the message */
1048         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
1049         while (enumerator->enumerate(enumerator, (void*)&task))
1050         {
1051                 switch (task->process(task, message))
1052                 {
1053                         case SUCCESS:
1054                                 /* task completed, remove it */
1055                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1056                                 task->destroy(task);
1057                                 continue;
1058                         case NEED_MORE:
1059                                 /* processed, but task needs at least another call to build() */
1060                                 send_response = TRUE;
1061                                 continue;
1062                         case ALREADY_DONE:
1063                                 send_response = FALSE;
1064                                 break;
1065                         case INVALID_ARG:
1066                                 if (task->get_type(task) == TASK_QUICK_MODE)
1067                                 {       /* not responsible for this exchange */
1068                                         continue;
1069                                 }
1070                                 /* FALL */
1071                         case FAILED:
1072                         default:
1073                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1074                                 /* FALL */
1075                         case DESTROY_ME:
1076                                 /* critical failure, destroy IKE_SA */
1077                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1078                                 enumerator->destroy(enumerator);
1079                                 task->destroy(task);
1080                                 return DESTROY_ME;
1081                 }
1082                 break;
1083         }
1084         enumerator->destroy(enumerator);
1085
1086         if (send_response)
1087         {
1088                 if (build_response(this, message) != SUCCESS)
1089                 {
1090                         return DESTROY_ME;
1091                 }
1092         }
1093         else
1094         {       /* We don't send a response, so don't retransmit one if we get
1095                  * the same message again. */
1096                 clear_packets(this->responding.packets);
1097         }
1098         if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
1099                 this->queued_tasks->get_count(this->queued_tasks) > 0)
1100         {
1101                 /* passive tasks completed, check if an active task has been queued,
1102                  * such as XAUTH or modeconfig push */
1103                 return initiate(this);
1104         }
1105         return SUCCESS;
1106 }
1107
1108 /**
1109  * handle an incoming response message
1110  */
1111 static status_t process_response(private_task_manager_t *this,
1112                                                                  message_t *message)
1113 {
1114         enumerator_t *enumerator;
1115         message_t *queued;
1116         status_t status;
1117         task_t *task;
1118
1119         if (message->get_exchange_type(message) != this->initiating.type)
1120         {
1121                 /* Windows server sends a fourth quick mode message having an initial
1122                  * contact notify. Ignore this message for compatibility. */
1123                 if (this->initiating.type == EXCHANGE_TYPE_UNDEFINED &&
1124                         message->get_exchange_type(message) == QUICK_MODE &&
1125                         message->get_notify(message, INITIAL_CONTACT))
1126                 {
1127                         DBG1(DBG_IKE, "ignoring fourth Quick Mode message");
1128                         return SUCCESS;
1129                 }
1130                 DBG1(DBG_IKE, "received %N response, but expected %N",
1131                          exchange_type_names, message->get_exchange_type(message),
1132                          exchange_type_names, this->initiating.type);
1133                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1134                 return DESTROY_ME;
1135         }
1136
1137         enumerator = this->active_tasks->create_enumerator(this->active_tasks);
1138         while (enumerator->enumerate(enumerator, (void*)&task))
1139         {
1140                 switch (task->process(task, message))
1141                 {
1142                         case SUCCESS:
1143                                 /* task completed, remove it */
1144                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
1145                                 task->destroy(task);
1146                                 continue;
1147                         case NEED_MORE:
1148                                 /* processed, but task needs another exchange */
1149                                 continue;
1150                         case ALREADY_DONE:
1151                                 break;
1152                         case FAILED:
1153                         default:
1154                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1155                                 /* FALL */
1156                         case DESTROY_ME:
1157                                 /* critical failure, destroy IKE_SA */
1158                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
1159                                 enumerator->destroy(enumerator);
1160                                 task->destroy(task);
1161                                 return DESTROY_ME;
1162                 }
1163                 break;
1164         }
1165         enumerator->destroy(enumerator);
1166
1167         this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1168         clear_packets(this->initiating.packets);
1169
1170         if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
1171         {
1172                 queued = this->queued;
1173                 this->queued = NULL;
1174                 status = this->public.task_manager.process_message(
1175                                                                                         &this->public.task_manager, queued);
1176                 queued->destroy(queued);
1177                 if (status == DESTROY_ME)
1178                 {
1179                         return status;
1180                 }
1181         }
1182
1183         return initiate(this);
1184 }
1185
1186 static status_t handle_fragment(private_task_manager_t *this, message_t *msg)
1187 {
1188         status_t status;
1189
1190         if (!this->defrag)
1191         {
1192                 this->defrag = message_create_defrag(msg);
1193                 if (!this->defrag)
1194                 {
1195                         return FAILED;
1196                 }
1197         }
1198         status = this->defrag->add_fragment(this->defrag, msg);
1199         if (status == SUCCESS)
1200         {
1201                 lib->processor->queue_job(lib->processor,
1202                                                         (job_t*)process_message_job_create(this->defrag));
1203                 this->defrag = NULL;
1204                 /* do not process the last fragment */
1205                 status = NEED_MORE;
1206         }
1207         return status;
1208 }
1209
1210 /**
1211  * Parse the given message and verify that it is valid.
1212  */
1213 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1214 {
1215         status_t status;
1216
1217         status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1218
1219         if (status != SUCCESS)
1220         {
1221                 switch (status)
1222                 {
1223                         case NOT_SUPPORTED:
1224                                 DBG1(DBG_IKE, "unsupported exchange type");
1225                                 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1226                                 break;
1227                         case PARSE_ERROR:
1228                                 DBG1(DBG_IKE, "message parsing failed");
1229                                 send_notify(this, msg, PAYLOAD_MALFORMED);
1230                                 break;
1231                         case VERIFY_ERROR:
1232                                 DBG1(DBG_IKE, "message verification failed");
1233                                 send_notify(this, msg, PAYLOAD_MALFORMED);
1234                                 break;
1235                         case FAILED:
1236                                 DBG1(DBG_IKE, "integrity check failed");
1237                                 send_notify(this, msg, INVALID_HASH_INFORMATION);
1238                                 break;
1239                         case INVALID_STATE:
1240                                 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1241                                 send_notify(this, msg, PAYLOAD_MALFORMED);
1242                         default:
1243                                 break;
1244                 }
1245                 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1246                          exchange_type_names, msg->get_exchange_type(msg),
1247                          msg->get_request(msg) ? "request" : "response",
1248                          msg->get_message_id(msg));
1249
1250                 charon->bus->alert(charon->bus, ALERT_PARSE_ERROR_BODY, msg, status);
1251
1252                 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1253                 {       /* invalid initiation attempt, close SA */
1254                         return DESTROY_ME;
1255                 }
1256         }
1257
1258         if (msg->get_first_payload_type(msg) == PLV1_FRAGMENT)
1259         {
1260                 return handle_fragment(this, msg);
1261         }
1262         return status;
1263 }
1264
1265 /**
1266  * Queue the given message if possible
1267  */
1268 static status_t queue_message(private_task_manager_t *this, message_t *msg)
1269 {
1270         if (this->queued)
1271         {
1272                 DBG1(DBG_IKE, "ignoring %N request, queue full",
1273                          exchange_type_names, msg->get_exchange_type(msg));
1274                 return FAILED;
1275         }
1276         this->queued = message_create_from_packet(msg->get_packet(msg));
1277         if (this->queued->parse_header(this->queued) != SUCCESS)
1278         {
1279                 this->queued->destroy(this->queued);
1280                 this->queued = NULL;
1281                 return FAILED;
1282         }
1283         DBG1(DBG_IKE, "queueing %N request as tasks still active",
1284                  exchange_type_names, msg->get_exchange_type(msg));
1285         return SUCCESS;
1286 }
1287
1288 METHOD(task_manager_t, process_message, status_t,
1289         private_task_manager_t *this, message_t *msg)
1290 {
1291         u_int32_t hash, mid, i;
1292         host_t *me, *other;
1293         status_t status;
1294
1295         /* TODO-IKEv1: update hosts more selectively */
1296         me = msg->get_destination(msg);
1297         other = msg->get_source(msg);
1298         mid = msg->get_message_id(msg);
1299         hash = chunk_hash(msg->get_packet_data(msg));
1300         for (i = 0; i < MAX_OLD_HASHES; i++)
1301         {
1302                 if (this->initiating.old_hashes[i] == hash)
1303                 {
1304                         if (array_count(this->initiating.packets) &&
1305                                 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1306                                 (msg->get_exchange_type(msg) == QUICK_MODE ||
1307                                  msg->get_exchange_type(msg) == AGGRESSIVE))
1308                         {
1309                                 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1310                                          "resending last request", mid);
1311                                 send_packets(this, this->initiating.packets);
1312                                 return SUCCESS;
1313                         }
1314                         DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1315                                  "but next request already sent", mid);
1316                         return SUCCESS;
1317                 }
1318         }
1319
1320         if ((mid && mid == this->initiating.mid) ||
1321                 (this->initiating.mid == 0 &&
1322                  msg->get_exchange_type(msg) == this->initiating.type &&
1323                  this->active_tasks->get_count(this->active_tasks)))
1324         {
1325                 msg->set_request(msg, FALSE);
1326                 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1327                 status = parse_message(this, msg);
1328                 if (status == NEED_MORE)
1329                 {
1330                         return SUCCESS;
1331                 }
1332                 if (status != SUCCESS)
1333                 {
1334                         return status;
1335                 }
1336                 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1337                                                                         time_monotonic(NULL));
1338                 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1339                 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1340                 if (process_response(this, msg) != SUCCESS)
1341                 {
1342                         flush(this);
1343                         return DESTROY_ME;
1344                 }
1345                 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1346                                                                         MAX_OLD_HASHES] = hash;
1347         }
1348         else
1349         {
1350                 if (hash == this->responding.hash)
1351                 {
1352                         if (array_count(this->responding.packets))
1353                         {
1354                                 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1355                                          "retransmitting response", mid);
1356                                 send_packets(this, this->responding.packets);
1357                         }
1358                         else if (array_count(this->initiating.packets) &&
1359                                          this->initiating.type == INFORMATIONAL_V1)
1360                         {
1361                                 DBG1(DBG_IKE, "received retransmit of DPD request, "
1362                                          "retransmitting response");
1363                                 send_packets(this, this->initiating.packets);
1364                         }
1365                         else
1366                         {
1367                                 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1368                                          "but no response to retransmit", mid);
1369                         }
1370                         charon->bus->alert(charon->bus, ALERT_RETRANSMIT_RECEIVE, msg);
1371                         return SUCCESS;
1372                 }
1373
1374                 /* reject Main/Aggressive Modes once established */
1375                 if (msg->get_exchange_type(msg) == ID_PROT ||
1376                         msg->get_exchange_type(msg) == AGGRESSIVE)
1377                 {
1378                         if (this->ike_sa->get_state(this->ike_sa) != IKE_CREATED &&
1379                                 this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING &&
1380                                 msg->get_first_payload_type(msg) != PLV1_FRAGMENT)
1381                         {
1382                                 DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
1383                                          exchange_type_names, msg->get_exchange_type(msg));
1384                                 return FAILED;
1385                         }
1386                 }
1387
1388                 /* drop XAuth/Mode Config/Quick Mode messages until we received the last
1389                  * Aggressive Mode message */
1390                 if (have_aggressive_mode_task(this) &&
1391                         msg->get_exchange_type(msg) != AGGRESSIVE)
1392                 {
1393                         DBG1(DBG_IKE, "ignoring %N request while phase 1 is incomplete",
1394                                  exchange_type_names, msg->get_exchange_type(msg));
1395                         return FAILED;
1396                 }
1397
1398                 /* queue XAuth/Mode Config messages unless the Main Mode exchange we
1399                  * initiated is complete */
1400                 if (msg->get_exchange_type(msg) == TRANSACTION &&
1401                         this->active_tasks->get_count(this->active_tasks))
1402                 {
1403                         return queue_message(this, msg);
1404                 }
1405
1406                 msg->set_request(msg, TRUE);
1407                 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1408                 status = parse_message(this, msg);
1409                 if (status == NEED_MORE)
1410                 {
1411                         return SUCCESS;
1412                 }
1413                 if (status != SUCCESS)
1414                 {
1415                         return status;
1416                 }
1417                 /* if this IKE_SA is virgin, we check for a config */
1418                 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1419                 {
1420                         ike_sa_id_t *ike_sa_id;
1421                         ike_cfg_t *ike_cfg;
1422                         job_t *job;
1423
1424                         ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1425                                                                                                         me, other, IKEV1);
1426                         if (ike_cfg == NULL)
1427                         {
1428                                 /* no config found for these hosts, destroy */
1429                                 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1430                                          me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1431                                 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1432                                 return DESTROY_ME;
1433                         }
1434                         this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1435                         ike_cfg->destroy(ike_cfg);
1436                         /* add a timeout if peer does not establish it completely */
1437                         ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1438                         job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1439                         lib->scheduler->schedule_job(lib->scheduler, job,
1440                                         lib->settings->get_int(lib->settings,
1441                                                         "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1442                                                         lib->ns));
1443                 }
1444                 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1445                 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1446                 if (process_request(this, msg) != SUCCESS)
1447                 {
1448                         flush(this);
1449                         return DESTROY_ME;
1450                 }
1451                 this->responding.hash = hash;
1452         }
1453         return SUCCESS;
1454 }
1455
1456 /**
1457  * Check if a given task has been queued already
1458  */
1459 static bool has_queued(private_task_manager_t *this, task_type_t type)
1460 {
1461         enumerator_t *enumerator;
1462         bool found = FALSE;
1463         task_t *task;
1464
1465         enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1466         while (enumerator->enumerate(enumerator, &task))
1467         {
1468                 if (task->get_type(task) == type)
1469                 {
1470                         found = TRUE;
1471                         break;
1472                 }
1473         }
1474         enumerator->destroy(enumerator);
1475         return found;
1476 }
1477
1478 METHOD(task_manager_t, queue_task, void,
1479         private_task_manager_t *this, task_t *task)
1480 {
1481         task_type_t type = task->get_type(task);
1482
1483         switch (type)
1484         {
1485                 case TASK_MODE_CONFIG:
1486                 case TASK_XAUTH:
1487                         if (has_queued(this, type))
1488                         {
1489                                 task->destroy(task);
1490                                 return;
1491                         }
1492                         break;
1493                 default:
1494                         break;
1495         }
1496         DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1497         this->queued_tasks->insert_last(this->queued_tasks, task);
1498 }
1499
1500 METHOD(task_manager_t, queue_ike, void,
1501         private_task_manager_t *this)
1502 {
1503         peer_cfg_t *peer_cfg;
1504
1505         if (!has_queued(this, TASK_ISAKMP_VENDOR))
1506         {
1507                 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1508         }
1509         if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1510         {
1511                 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1512         }
1513         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1514         if (peer_cfg->use_aggressive(peer_cfg))
1515         {
1516                 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1517                 {
1518                         queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1519                 }
1520         }
1521         else
1522         {
1523                 if (!has_queued(this, TASK_MAIN_MODE))
1524                 {
1525                         queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1526                 }
1527         }
1528         if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1529         {
1530                 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1531         }
1532         if (!has_queued(this, TASK_ISAKMP_NATD))
1533         {
1534                 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1535         }
1536 }
1537
1538 METHOD(task_manager_t, queue_ike_reauth, void,
1539         private_task_manager_t *this)
1540 {
1541         enumerator_t *enumerator;
1542         child_sa_t *child_sa;
1543         ike_sa_t *new;
1544         host_t *host;
1545
1546         new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1547                                                                 this->ike_sa->get_version(this->ike_sa), TRUE);
1548         if (!new)
1549         {       /* shouldn't happen */
1550                 return;
1551         }
1552
1553         new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1554         host = this->ike_sa->get_other_host(this->ike_sa);
1555         new->set_other_host(new, host->clone(host));
1556         host = this->ike_sa->get_my_host(this->ike_sa);
1557         new->set_my_host(new, host->clone(host));
1558         enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1559         while (enumerator->enumerate(enumerator, &host))
1560         {
1561                 new->add_virtual_ip(new, TRUE, host);
1562         }
1563         enumerator->destroy(enumerator);
1564
1565         charon->bus->children_migrate(charon->bus, new->get_id(new),
1566                                                                   new->get_unique_id(new));
1567         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1568         while (enumerator->enumerate(enumerator, &child_sa))
1569         {
1570                 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1571                 new->add_child_sa(new, child_sa);
1572         }
1573         enumerator->destroy(enumerator);
1574         charon->bus->set_sa(charon->bus, new);
1575         charon->bus->children_migrate(charon->bus, NULL, 0);
1576         charon->bus->set_sa(charon->bus, this->ike_sa);
1577
1578         if (!new->get_child_count(new))
1579         {       /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1580                 task_t *task;
1581
1582                 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1583                 while (enumerator->enumerate(enumerator, &task))
1584                 {
1585                         if (task->get_type(task) == TASK_QUICK_MODE)
1586                         {
1587                                 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1588                                 task->migrate(task, new);
1589                                 new->queue_task(new, task);
1590                         }
1591                 }
1592                 enumerator->destroy(enumerator);
1593         }
1594
1595         if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1596         {
1597                 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1598                 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1599         }
1600         else
1601         {
1602                 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1603                 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1604         }
1605         charon->bus->set_sa(charon->bus, this->ike_sa);
1606 }
1607
1608 METHOD(task_manager_t, queue_ike_rekey, void,
1609         private_task_manager_t *this)
1610 {
1611         queue_ike_reauth(this);
1612 }
1613
1614 METHOD(task_manager_t, queue_ike_delete, void,
1615         private_task_manager_t *this)
1616 {
1617         enumerator_t *enumerator;
1618         child_sa_t *child_sa;
1619
1620         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1621         while (enumerator->enumerate(enumerator, &child_sa))
1622         {
1623                 queue_task(this, (task_t*)
1624                         quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1625                                                                 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1626         }
1627         enumerator->destroy(enumerator);
1628
1629         queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1630 }
1631
1632 METHOD(task_manager_t, queue_mobike, void,
1633         private_task_manager_t *this, bool roam, bool address)
1634 {
1635         /* Not supported in IKEv1 */
1636 }
1637
1638 METHOD(task_manager_t, queue_child, void,
1639         private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1640         traffic_selector_t *tsi, traffic_selector_t *tsr)
1641 {
1642         quick_mode_t *task;
1643
1644         task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1645         task->use_reqid(task, reqid);
1646
1647         queue_task(this, &task->task);
1648 }
1649
1650 /**
1651  * Check if two CHILD_SAs have the same traffic selector
1652  */
1653 static bool have_equal_ts(child_sa_t *child1, child_sa_t *child2, bool local)
1654 {
1655         enumerator_t *e1, *e2;
1656         traffic_selector_t *ts1, *ts2;
1657         bool equal = FALSE;
1658
1659         e1 = child1->create_ts_enumerator(child1, local);
1660         e2 = child2->create_ts_enumerator(child2, local);
1661         if (e1->enumerate(e1, &ts1) && e2->enumerate(e2, &ts2))
1662         {
1663                 equal = ts1->equals(ts1, ts2);
1664         }
1665         e2->destroy(e2);
1666         e1->destroy(e1);
1667
1668         return equal;
1669 }
1670
1671 /**
1672  * Check if a CHILD_SA is redundant and we should delete instead of rekey
1673  */
1674 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1675 {
1676         enumerator_t *enumerator;
1677         child_sa_t *current;
1678         bool redundant = FALSE;
1679
1680         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1681         while (enumerator->enumerate(enumerator, &current))
1682         {
1683                 if (current->get_state(current) == CHILD_INSTALLED &&
1684                         streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1685                         have_equal_ts(current, child_sa, TRUE) &&
1686                         have_equal_ts(current, child_sa, FALSE) &&
1687                         current->get_lifetime(current, FALSE) >
1688                                 child_sa->get_lifetime(child_sa, FALSE))
1689                 {
1690                         DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1691                                  child_sa->get_name(child_sa),
1692                                  child_sa->get_unique_id(child_sa));
1693                         redundant = TRUE;
1694                         break;
1695                 }
1696         }
1697         enumerator->destroy(enumerator);
1698
1699         return redundant;
1700 }
1701
1702 /**
1703  * Get the first traffic selector of a CHILD_SA, local or remote
1704  */
1705 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1706 {
1707         traffic_selector_t *ts = NULL;
1708         enumerator_t *enumerator;
1709
1710         enumerator = child_sa->create_ts_enumerator(child_sa, local);
1711         enumerator->enumerate(enumerator, &ts);
1712         enumerator->destroy(enumerator);
1713
1714         return ts;
1715 }
1716
1717 METHOD(task_manager_t, queue_child_rekey, void,
1718         private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1719 {
1720         child_sa_t *child_sa;
1721         child_cfg_t *cfg;
1722         quick_mode_t *task;
1723
1724         child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1725         if (!child_sa)
1726         {
1727                 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1728         }
1729         if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1730         {
1731                 if (is_redundant(this, child_sa))
1732                 {
1733                         queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1734                                                                                                 protocol, spi, FALSE, FALSE));
1735                 }
1736                 else
1737                 {
1738                         child_sa->set_state(child_sa, CHILD_REKEYING);
1739                         cfg = child_sa->get_config(child_sa);
1740                         task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1741                                 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1742                         task->use_reqid(task, child_sa->get_reqid(child_sa));
1743                         task->use_marks(task, child_sa->get_mark(child_sa, TRUE).value,
1744                                                         child_sa->get_mark(child_sa, FALSE).value);
1745                         task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1746
1747                         queue_task(this, &task->task);
1748                 }
1749         }
1750 }
1751
1752 METHOD(task_manager_t, queue_child_delete, void,
1753         private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1754         bool expired)
1755 {
1756         queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1757                                                                                                   spi, FALSE, expired));
1758 }
1759
1760 METHOD(task_manager_t, queue_dpd, void,
1761         private_task_manager_t *this)
1762 {
1763         peer_cfg_t *peer_cfg;
1764         u_int32_t t, retransmit;
1765
1766         queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1767                                                                                                 this->dpd_send++));
1768         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1769
1770         /* compute timeout in milliseconds */
1771         t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1772         if (t == 0)
1773         {
1774                 /* use the same timeout as a retransmitting IKE message would have */
1775                 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1776                 {
1777                         t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1778                                                         pow(this->retransmit_base, retransmit));
1779                 }
1780         }
1781
1782         /* schedule DPD timeout job */
1783         lib->scheduler->schedule_job_ms(lib->scheduler,
1784                 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1785 }
1786
1787 METHOD(task_manager_t, adopt_tasks, void,
1788         private_task_manager_t *this, task_manager_t *other_public)
1789 {
1790         private_task_manager_t *other = (private_task_manager_t*)other_public;
1791         task_t *task;
1792
1793         /* move queued tasks from other to this */
1794         while (other->queued_tasks->remove_last(other->queued_tasks,
1795                                                                                                 (void**)&task) == SUCCESS)
1796         {
1797                 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1798                 task->migrate(task, this->ike_sa);
1799                 this->queued_tasks->insert_first(this->queued_tasks, task);
1800         }
1801 }
1802
1803 /**
1804  * Migrates child-creating tasks from src to dst
1805  */
1806 static void migrate_child_tasks(private_task_manager_t *this,
1807                                                                 linked_list_t *src, linked_list_t *dst)
1808 {
1809         enumerator_t *enumerator;
1810         task_t *task;
1811
1812         enumerator = src->create_enumerator(src);
1813         while (enumerator->enumerate(enumerator, &task))
1814         {
1815                 if (task->get_type(task) == TASK_QUICK_MODE)
1816                 {
1817                         src->remove_at(src, enumerator);
1818                         task->migrate(task, this->ike_sa);
1819                         dst->insert_last(dst, task);
1820                 }
1821         }
1822         enumerator->destroy(enumerator);
1823 }
1824
1825 METHOD(task_manager_t, adopt_child_tasks, void,
1826         private_task_manager_t *this, task_manager_t *other_public)
1827 {
1828         private_task_manager_t *other = (private_task_manager_t*)other_public;
1829
1830         /* move active child tasks from other to this */
1831         migrate_child_tasks(this, other->active_tasks, this->queued_tasks);
1832         /* do the same for queued tasks */
1833         migrate_child_tasks(this, other->queued_tasks, this->queued_tasks);
1834 }
1835
1836 METHOD(task_manager_t, busy, bool,
1837         private_task_manager_t *this)
1838 {
1839         return (this->active_tasks->get_count(this->active_tasks) > 0);
1840 }
1841
1842 METHOD(task_manager_t, incr_mid, void,
1843         private_task_manager_t *this, bool initiate)
1844 {
1845 }
1846
1847 METHOD(task_manager_t, reset, void,
1848         private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1849 {
1850         enumerator_t *enumerator;
1851         task_t *task;
1852
1853         /* reset message counters and retransmit packets */
1854         clear_packets(this->responding.packets);
1855         clear_packets(this->initiating.packets);
1856         this->responding.seqnr = RESPONDING_SEQ;
1857         this->responding.retransmitted = 0;
1858         this->initiating.mid = 0;
1859         this->initiating.seqnr = 0;
1860         this->initiating.retransmitted = 0;
1861         this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1862         DESTROY_IF(this->defrag);
1863         this->defrag = NULL;
1864         if (initiate != UINT_MAX)
1865         {
1866                 this->dpd_send = initiate;
1867         }
1868         if (respond != UINT_MAX)
1869         {
1870                 this->dpd_recv = respond;
1871         }
1872
1873         /* reset queued tasks */
1874         enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1875         while (enumerator->enumerate(enumerator, &task))
1876         {
1877                 task->migrate(task, this->ike_sa);
1878         }
1879         enumerator->destroy(enumerator);
1880
1881         /* reset active tasks */
1882         while (this->active_tasks->remove_last(this->active_tasks,
1883                                                                                    (void**)&task) == SUCCESS)
1884         {
1885                 task->migrate(task, this->ike_sa);
1886                 this->queued_tasks->insert_first(this->queued_tasks, task);
1887         }
1888 }
1889
1890 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1891         private_task_manager_t *this, task_queue_t queue)
1892 {
1893         switch (queue)
1894         {
1895                 case TASK_QUEUE_ACTIVE:
1896                         return this->active_tasks->create_enumerator(this->active_tasks);
1897                 case TASK_QUEUE_PASSIVE:
1898                         return this->passive_tasks->create_enumerator(this->passive_tasks);
1899                 case TASK_QUEUE_QUEUED:
1900                         return this->queued_tasks->create_enumerator(this->queued_tasks);
1901                 default:
1902                         return enumerator_create_empty();
1903         }
1904 }
1905
1906 METHOD(task_manager_t, destroy, void,
1907         private_task_manager_t *this)
1908 {
1909         flush(this);
1910
1911         this->active_tasks->destroy(this->active_tasks);
1912         this->queued_tasks->destroy(this->queued_tasks);
1913         this->passive_tasks->destroy(this->passive_tasks);
1914         DESTROY_IF(this->defrag);
1915
1916         DESTROY_IF(this->queued);
1917         clear_packets(this->responding.packets);
1918         array_destroy(this->responding.packets);
1919         clear_packets(this->initiating.packets);
1920         array_destroy(this->initiating.packets);
1921         DESTROY_IF(this->rng);
1922         free(this);
1923 }
1924
1925 /*
1926  * see header file
1927  */
1928 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1929 {
1930         private_task_manager_t *this;
1931
1932         INIT(this,
1933                 .public = {
1934                         .task_manager = {
1935                                 .process_message = _process_message,
1936                                 .queue_task = _queue_task,
1937                                 .queue_ike = _queue_ike,
1938                                 .queue_ike_rekey = _queue_ike_rekey,
1939                                 .queue_ike_reauth = _queue_ike_reauth,
1940                                 .queue_ike_delete = _queue_ike_delete,
1941                                 .queue_mobike = _queue_mobike,
1942                                 .queue_child = _queue_child,
1943                                 .queue_child_rekey = _queue_child_rekey,
1944                                 .queue_child_delete = _queue_child_delete,
1945                                 .queue_dpd = _queue_dpd,
1946                                 .initiate = _initiate,
1947                                 .retransmit = _retransmit,
1948                                 .incr_mid = _incr_mid,
1949                                 .reset = _reset,
1950                                 .adopt_tasks = _adopt_tasks,
1951                                 .adopt_child_tasks = _adopt_child_tasks,
1952                                 .busy = _busy,
1953                                 .create_task_enumerator = _create_task_enumerator,
1954                                 .flush = _flush,
1955                                 .flush_queue = _flush_queue,
1956                                 .destroy = _destroy,
1957                         },
1958                 },
1959                 .initiating = {
1960                         .type = EXCHANGE_TYPE_UNDEFINED,
1961                 },
1962                 .responding = {
1963                         .seqnr = RESPONDING_SEQ,
1964                 },
1965                 .ike_sa = ike_sa,
1966                 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1967                 .queued_tasks = linked_list_create(),
1968                 .active_tasks = linked_list_create(),
1969                 .passive_tasks = linked_list_create(),
1970                 .retransmit_tries = lib->settings->get_int(lib->settings,
1971                                                 "%s.retransmit_tries", RETRANSMIT_TRIES, lib->ns),
1972                 .retransmit_timeout = lib->settings->get_double(lib->settings,
1973                                                 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, lib->ns),
1974                 .retransmit_base = lib->settings->get_double(lib->settings,
1975                                                 "%s.retransmit_base", RETRANSMIT_BASE, lib->ns),
1976         );
1977
1978         if (!this->rng)
1979         {
1980                 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
1981                 destroy(this);
1982                 return NULL;
1983         }
1984         if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
1985                                                           (void*)&this->dpd_send))
1986         {
1987                 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
1988                 destroy(this);
1989                 return NULL;
1990         }
1991         this->dpd_send &= 0x7FFFFFFF;
1992
1993         return &this->public;
1994 }