]> git.ipfire.org Git - thirdparty/strongswan.git/blob - src/libcharon/sa/ikev1/task_manager_v1.c
projects / thirdparty / strongswan.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ikev1: Properly initialize list of fragments in case fragment ID is 0
[thirdparty/strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2013 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/aggressive_mode.h>
24 #include <sa/ikev1/tasks/quick_mode.h>
25 #include <sa/ikev1/tasks/quick_delete.h>
26 #include <sa/ikev1/tasks/xauth.h>
27 #include <sa/ikev1/tasks/mode_config.h>
28 #include <sa/ikev1/tasks/informational.h>
29 #include <sa/ikev1/tasks/isakmp_natd.h>
30 #include <sa/ikev1/tasks/isakmp_vendor.h>
31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
33 #include <sa/ikev1/tasks/isakmp_delete.h>
34 #include <sa/ikev1/tasks/isakmp_dpd.h>
35
36 #include <processing/jobs/retransmit_job.h>
37 #include <processing/jobs/delete_ike_sa_job.h>
38 #include <processing/jobs/dpd_timeout_job.h>
39 #include <processing/jobs/process_message_job.h>
40
41 #include <encoding/payloads/fragment_payload.h>
42 #include <bio/bio_writer.h>
43
44 /**
45 * Number of old messages hashes we keep for retransmission.
46 *
47 * In Main Mode, we must ignore messages from a previous message pair if
48 * we already continued to the next. Otherwise a late retransmission
49 * could be considered as a reply to the newer request.
50 */
51 #define MAX_OLD_HASHES 2
52
53 /**
54 * Maximum packet size for fragmented packets (same as in sockets)
55 */
56 #define MAX_PACKET 10000
57
58 /**
59 * Maximum size of fragment data when sending packets (currently the same is
60 * used for IPv4 and IPv6, even though the latter has a higher minimum datagram
61 * size). 576 (= min. IPv4) - 20 (= IP header) - 8 (= UDP header) -
62 * - 28 (= IKE header) - 8 (= fragment header) = 512
63 * This is reduced by 4 in case of NAT-T (due to the non-ESP marker).
64 */
65 #define MAX_FRAGMENT_SIZE 512
66
67 /**
68 * First sequence number of responding packets.
69 *
70 * To distinguish retransmission jobs for initiating and responding packets,
71 * we split up the sequence counter and use the upper half for responding.
72 */
73 #define RESPONDING_SEQ INT_MAX
74
75 typedef struct exchange_t exchange_t;
76
77 /**
78 * An exchange in the air, used do detect and handle retransmission
79 */
80 struct exchange_t {
81
82 /**
83 * Message ID used for this transaction
84 */
85 u_int32_t mid;
86
87 /**
88 * generated packet for retransmission
89 */
90 packet_t *packet;
91 };
92
93 typedef struct private_task_manager_t private_task_manager_t;
94
95 /**
96 * private data of the task manager
97 */
98 struct private_task_manager_t {
99
100 /**
101 * public functions
102 */
103 task_manager_v1_t public;
104
105 /**
106 * associated IKE_SA we are serving
107 */
108 ike_sa_t *ike_sa;
109
110 /**
111 * RNG to create message IDs
112 */
113 rng_t *rng;
114
115 /**
116 * Exchange we are currently handling as responder
117 */
118 struct {
119 /**
120 * Message ID of the last response
121 */
122 u_int32_t mid;
123
124 /**
125 * Hash of a previously received message
126 */
127 u_int32_t hash;
128
129 /**
130 * packet for retransmission
131 */
132 packet_t *packet;
133
134 /**
135 * Sequence number of the last sent message
136 */
137 u_int32_t seqnr;
138
139 /**
140 * how many times we have retransmitted so far
141 */
142 u_int retransmitted;
143
144 } responding;
145
146 /**
147 * Exchange we are currently handling as initiator
148 */
149 struct {
150 /**
151 * Message ID of the exchange
152 */
153 u_int32_t mid;
154
155 /**
156 * Hashes of old responses we can ignore
157 */
158 u_int32_t old_hashes[MAX_OLD_HASHES];
159
160 /**
161 * Position in old hash array
162 */
163 int old_hash_pos;
164
165 /**
166 * Sequence number of the last sent message
167 */
168 u_int32_t seqnr;
169
170 /**
171 * how many times we have retransmitted so far
172 */
173 u_int retransmitted;
174
175 /**
176 * packet for retransmission
177 */
178 packet_t *packet;
179
180 /**
181 * type of the initiated exchange
182 */
183 exchange_type_t type;
184
185 } initiating;
186
187 /**
188 * Data used to reassemble a fragmented message
189 */
190 struct {
191
192 /**
193 * Fragment ID (currently only one is supported at a time)
194 */
195 u_int16_t id;
196
197 /**
198 * The number of the last fragment (in case we receive the fragments out
199 * of order), since the first starts with 1 this defines the number of
200 * fragments we expect
201 */
202 u_int8_t last;
203
204 /**
205 * List of fragments (fragment_t*)
206 */
207 linked_list_t *list;
208
209 /**
210 * Length of all currently received fragments
211 */
212 size_t len;
213
214 /**
215 * Maximum length of a fragmented packet
216 */
217 size_t max_packet;
218
219 /**
220 * Maximum length of a single fragment (when sending)
221 */
222 size_t size;
223
224 /**
225 * The exchange type we use for fragments. Always the initial type even
226 * for fragmented quick mode or transaction messages (i.e. either
227 * ID_PROT or AGGRESSIVE)
228 */
229 exchange_type_t exchange;
230
231 } frag;
232
233 /**
234 * List of queued tasks not yet in action
235 */
236 linked_list_t *queued_tasks;
237
238 /**
239 * List of active tasks, initiated by ourselves
240 */
241 linked_list_t *active_tasks;
242
243 /**
244 * List of tasks initiated by peer
245 */
246 linked_list_t *passive_tasks;
247
248 /**
249 * Queued messages not yet ready to process
250 */
251 message_t *queued;
252
253 /**
254 * Number of times we retransmit messages before giving up
255 */
256 u_int retransmit_tries;
257
258 /**
259 * Retransmission timeout
260 */
261 double retransmit_timeout;
262
263 /**
264 * Base to calculate retransmission timeout
265 */
266 double retransmit_base;
267
268 /**
269 * Sequence number for sending DPD requests
270 */
271 u_int32_t dpd_send;
272
273 /**
274 * Sequence number for received DPD requests
275 */
276 u_int32_t dpd_recv;
277 };
278
279 /**
280 * A single fragment within a fragmented message
281 */
282 typedef struct {
283
284 /** fragment number */
285 u_int8_t num;
286
287 /** fragment data */
288 chunk_t data;
289
290 } fragment_t;
291
292 static void fragment_destroy(fragment_t *this)
293 {
294 chunk_free(&this->data);
295 free(this);
296 }
297
298 static void clear_fragments(private_task_manager_t *this, u_int16_t id)
299 {
300 DESTROY_FUNCTION_IF(this->frag.list, (void*)fragment_destroy);
301 this->frag.list = NULL;
302 this->frag.last = 0;
303 this->frag.len = 0;
304 this->frag.id = id;
305 }
306
307 METHOD(task_manager_t, flush_queue, void,
308 private_task_manager_t *this, task_queue_t queue)
309 {
310 linked_list_t *list;
311 task_t *task;
312
313 if (this->queued)
314 {
315 this->queued->destroy(this->queued);
316 this->queued = NULL;
317 }
318 switch (queue)
319 {
320 case TASK_QUEUE_ACTIVE:
321 list = this->active_tasks;
322 /* cancel pending retransmits */
323 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
324 DESTROY_IF(this->initiating.packet);
325 this->initiating.packet = NULL;
326 break;
327 case TASK_QUEUE_PASSIVE:
328 list = this->passive_tasks;
329 break;
330 case TASK_QUEUE_QUEUED:
331 list = this->queued_tasks;
332 break;
333 default:
334 return;
335 }
336 while (list->remove_last(list, (void**)&task) == SUCCESS)
337 {
338 task->destroy(task);
339 }
340 }
341
342 /**
343 * flush all tasks in the task manager
344 */
345 static void flush(private_task_manager_t *this)
346 {
347 flush_queue(this, TASK_QUEUE_QUEUED);
348 flush_queue(this, TASK_QUEUE_PASSIVE);
349 flush_queue(this, TASK_QUEUE_ACTIVE);
350 }
351
352 /**
353 * move a task of a specific type from the queue to the active list
354 */
355 static bool activate_task(private_task_manager_t *this, task_type_t type)
356 {
357 enumerator_t *enumerator;
358 task_t *task;
359 bool found = FALSE;
360
361 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
362 while (enumerator->enumerate(enumerator, (void**)&task))
363 {
364 if (task->get_type(task) == type)
365 {
366 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
367 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
368 this->active_tasks->insert_last(this->active_tasks, task);
369 found = TRUE;
370 break;
371 }
372 }
373 enumerator->destroy(enumerator);
374 return found;
375 }
376
377 /**
378 * Send a single fragment with the given data
379 */
380 static bool send_fragment(private_task_manager_t *this, bool request,
381 host_t *src, host_t *dst, fragment_payload_t *fragment)
382 {
383 message_t *message;
384 packet_t *packet;
385 status_t status;
386
387 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
388 /* other implementations seem to just use 0 as message ID, so here we go */
389 message->set_message_id(message, 0);
390 message->set_request(message, request);
391 message->set_source(message, src->clone(src));
392 message->set_destination(message, dst->clone(dst));
393 message->set_exchange_type(message, this->frag.exchange);
394 message->add_payload(message, (payload_t*)fragment);
395
396 status = this->ike_sa->generate_message(this->ike_sa, message, &packet);
397 if (status != SUCCESS)
398 {
399 DBG1(DBG_IKE, "failed to generate IKE fragment");
400 message->destroy(message);
401 return FALSE;
402 }
403 charon->sender->send(charon->sender, packet);
404 message->destroy(message);
405 return TRUE;
406 }
407
408 /**
409 * Send a packet, if supported and required do so in fragments
410 */
411 static bool send_packet(private_task_manager_t *this, bool request,
412 packet_t *packet)
413 {
414 bool use_frags = FALSE;
415 ike_cfg_t *ike_cfg;
416 chunk_t data;
417
418 ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
419 if (ike_cfg)
420 {
421 switch (ike_cfg->fragmentation(ike_cfg))
422 {
423 case FRAGMENTATION_FORCE:
424 use_frags = TRUE;
425 break;
426 case FRAGMENTATION_YES:
427 use_frags = this->ike_sa->supports_extension(this->ike_sa,
428 EXT_IKE_FRAGMENTATION);
429 break;
430 default:
431 break;
432 }
433 }
434 data = packet->get_data(packet);
435 if (data.len > this->frag.size && use_frags)
436 {
437 fragment_payload_t *fragment;
438 u_int8_t num, count;
439 size_t len, frag_size;
440 host_t *src, *dst;
441
442 src = packet->get_source(packet);
443 dst = packet->get_destination(packet);
444
445 frag_size = this->frag.size;
446 if (dst->get_port(dst) != IKEV2_UDP_PORT &&
447 src->get_port(src) != IKEV2_UDP_PORT)
448 { /* reduce size due to non-ESP marker */
449 frag_size -= 4;
450 }
451 count = data.len / frag_size + (data.len % frag_size ? 1 : 0);
452
453 DBG1(DBG_IKE, "sending IKE message with length of %zu bytes in "
454 "%hhu fragments", data.len, count);
455 for (num = 1; num <= count; num++)
456 {
457 len = min(data.len, frag_size);
458 fragment = fragment_payload_create_from_data(num, num == count,
459 chunk_create(data.ptr, len));
460 if (!send_fragment(this, request, src, dst, fragment))
461 {
462 packet->destroy(packet);
463 return FALSE;
464 }
465 data = chunk_skip(data, len);
466 }
467 packet->destroy(packet);
468 return TRUE;
469 }
470 charon->sender->send(charon->sender, packet);
471 return TRUE;
472 }
473
474 /**
475 * Retransmit a packet, either as initiator or as responder
476 */
477 static status_t retransmit_packet(private_task_manager_t *this, bool request,
478 u_int32_t seqnr, u_int mid, u_int retransmitted, packet_t *packet)
479 {
480 u_int32_t t;
481
482 if (retransmitted > this->retransmit_tries)
483 {
484 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
485 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_TIMEOUT, packet);
486 return DESTROY_ME;
487 }
488 t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
489 pow(this->retransmit_base, retransmitted));
490 if (retransmitted)
491 {
492 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
493 retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
494 mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
495 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND, packet);
496 }
497 if (!send_packet(this, request, packet->clone(packet)))
498 {
499 return DESTROY_ME;
500 }
501 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
502 retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
503 return NEED_MORE;
504 }
505
506 METHOD(task_manager_t, retransmit, status_t,
507 private_task_manager_t *this, u_int32_t seqnr)
508 {
509 status_t status = SUCCESS;
510
511 if (seqnr == this->initiating.seqnr && this->initiating.packet)
512 {
513 status = retransmit_packet(this, TRUE, seqnr, this->initiating.mid,
514 this->initiating.retransmitted, this->initiating.packet);
515 if (status == NEED_MORE)
516 {
517 this->initiating.retransmitted++;
518 status = SUCCESS;
519 }
520 }
521 if (seqnr == this->responding.seqnr && this->responding.packet)
522 {
523 status = retransmit_packet(this, FALSE, seqnr, this->responding.mid,
524 this->responding.retransmitted, this->responding.packet);
525 if (status == NEED_MORE)
526 {
527 this->responding.retransmitted++;
528 status = SUCCESS;
529 }
530 }
531 return status;
532 }
533
534 /**
535 * Check if we have to wait for a mode config before starting a quick mode
536 */
537 static bool mode_config_expected(private_task_manager_t *this)
538 {
539 enumerator_t *enumerator;
540 peer_cfg_t *peer_cfg;
541 char *pool;
542 bool local;
543 host_t *host;
544
545 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
546 if (peer_cfg)
547 {
548 if (peer_cfg->use_pull_mode(peer_cfg))
549 {
550 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
551 if (!enumerator->enumerate(enumerator, &pool))
552 { /* no pool configured */
553 enumerator->destroy(enumerator);
554 return FALSE;
555 }
556 enumerator->destroy(enumerator);
557
558 local = FALSE;
559 }
560 else
561 {
562 enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
563 if (!enumerator->enumerate(enumerator, &host))
564 { /* not requesting a vip */
565 enumerator->destroy(enumerator);
566 return FALSE;
567 }
568 enumerator->destroy(enumerator);
569
570 local = TRUE;
571 }
572 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
573 local);
574 if (!enumerator->enumerate(enumerator, &host))
575 { /* expecting a VIP exchange, but no VIP assigned yet */
576 enumerator->destroy(enumerator);
577 return TRUE;
578 }
579 enumerator->destroy(enumerator);
580 }
581 return FALSE;
582 }
583
584 METHOD(task_manager_t, initiate, status_t,
585 private_task_manager_t *this)
586 {
587 enumerator_t *enumerator;
588 task_t *task;
589 message_t *message;
590 host_t *me, *other;
591 status_t status;
592 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
593 bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
594
595 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
596 this->initiating.type != INFORMATIONAL_V1)
597 {
598 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
599 exchange_type_names, this->initiating.type);
600 /* do not initiate if we already have a message in the air */
601 return SUCCESS;
602 }
603
604 if (this->active_tasks->get_count(this->active_tasks) == 0)
605 {
606 DBG2(DBG_IKE, "activating new tasks");
607 switch (this->ike_sa->get_state(this->ike_sa))
608 {
609 case IKE_CREATED:
610 activate_task(this, TASK_ISAKMP_VENDOR);
611 activate_task(this, TASK_ISAKMP_CERT_PRE);
612 if (activate_task(this, TASK_MAIN_MODE))
613 {
614 exchange = ID_PROT;
615 }
616 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
617 {
618 exchange = AGGRESSIVE;
619 }
620 activate_task(this, TASK_ISAKMP_CERT_POST);
621 activate_task(this, TASK_ISAKMP_NATD);
622 break;
623 case IKE_CONNECTING:
624 if (activate_task(this, TASK_ISAKMP_DELETE))
625 {
626 exchange = INFORMATIONAL_V1;
627 new_mid = TRUE;
628 break;
629 }
630 if (activate_task(this, TASK_XAUTH))
631 {
632 exchange = TRANSACTION;
633 new_mid = TRUE;
634 break;
635 }
636 if (activate_task(this, TASK_INFORMATIONAL))
637 {
638 exchange = INFORMATIONAL_V1;
639 new_mid = TRUE;
640 break;
641 }
642 break;
643 case IKE_ESTABLISHED:
644 if (activate_task(this, TASK_MODE_CONFIG))
645 {
646 exchange = TRANSACTION;
647 new_mid = TRUE;
648 break;
649 }
650 if (!mode_config_expected(this) &&
651 activate_task(this, TASK_QUICK_MODE))
652 {
653 exchange = QUICK_MODE;
654 new_mid = TRUE;
655 break;
656 }
657 if (activate_task(this, TASK_INFORMATIONAL))
658 {
659 exchange = INFORMATIONAL_V1;
660 new_mid = TRUE;
661 break;
662 }
663 if (activate_task(this, TASK_QUICK_DELETE))
664 {
665 exchange = INFORMATIONAL_V1;
666 new_mid = TRUE;
667 break;
668 }
669 if (activate_task(this, TASK_ISAKMP_DELETE))
670 {
671 exchange = INFORMATIONAL_V1;
672 new_mid = TRUE;
673 break;
674 }
675 if (activate_task(this, TASK_ISAKMP_DPD))
676 {
677 exchange = INFORMATIONAL_V1;
678 new_mid = TRUE;
679 break;
680 }
681 break;
682 default:
683 break;
684 }
685 }
686 else
687 {
688 DBG2(DBG_IKE, "reinitiating already active tasks");
689 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
690 while (enumerator->enumerate(enumerator, (void**)&task))
691 {
692 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
693 switch (task->get_type(task))
694 {
695 case TASK_MAIN_MODE:
696 exchange = ID_PROT;
697 break;
698 case TASK_AGGRESSIVE_MODE:
699 exchange = AGGRESSIVE;
700 break;
701 case TASK_QUICK_MODE:
702 exchange = QUICK_MODE;
703 break;
704 case TASK_XAUTH:
705 exchange = TRANSACTION;
706 new_mid = TRUE;
707 break;
708 default:
709 continue;
710 }
711 break;
712 }
713 enumerator->destroy(enumerator);
714 }
715
716 if (exchange == EXCHANGE_TYPE_UNDEFINED)
717 {
718 DBG2(DBG_IKE, "nothing to initiate");
719 /* nothing to do yet... */
720 return SUCCESS;
721 }
722
723 me = this->ike_sa->get_my_host(this->ike_sa);
724 other = this->ike_sa->get_other_host(this->ike_sa);
725
726 if (new_mid)
727 {
728 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
729 (void*)&this->initiating.mid))
730 {
731 DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
732 flush(this);
733 return DESTROY_ME;
734 }
735 }
736 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
737 message->set_message_id(message, this->initiating.mid);
738 message->set_source(message, me->clone(me));
739 message->set_destination(message, other->clone(other));
740 message->set_exchange_type(message, exchange);
741 this->initiating.type = exchange;
742 this->initiating.retransmitted = 0;
743
744 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
745 while (enumerator->enumerate(enumerator, (void*)&task))
746 {
747 switch (task->build(task, message))
748 {
749 case SUCCESS:
750 /* task completed, remove it */
751 this->active_tasks->remove_at(this->active_tasks, enumerator);
752 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
753 task->get_type(task) == TASK_QUICK_MODE)
754 { /* last message of three message exchange */
755 keep = TRUE;
756 }
757 task->destroy(task);
758 continue;
759 case NEED_MORE:
760 expect_response = TRUE;
761 /* processed, but task needs another exchange */
762 continue;
763 case ALREADY_DONE:
764 cancelled = TRUE;
765 break;
766 case FAILED:
767 default:
768 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
769 {
770 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
771 }
772 /* FALL */
773 case DESTROY_ME:
774 /* critical failure, destroy IKE_SA */
775 enumerator->destroy(enumerator);
776 message->destroy(message);
777 flush(this);
778 return DESTROY_ME;
779 }
780 break;
781 }
782 enumerator->destroy(enumerator);
783
784 if (this->active_tasks->get_count(this->active_tasks) == 0 &&
785 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
786 { /* tasks completed, no exchange active anymore */
787 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
788 }
789 if (cancelled)
790 {
791 message->destroy(message);
792 return initiate(this);
793 }
794
795 DESTROY_IF(this->initiating.packet);
796 status = this->ike_sa->generate_message(this->ike_sa, message,
797 &this->initiating.packet);
798 if (status != SUCCESS)
799 {
800 /* message generation failed. There is nothing more to do than to
801 * close the SA */
802 message->destroy(message);
803 flush(this);
804 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
805 return DESTROY_ME;
806 }
807
808 this->initiating.seqnr++;
809 if (expect_response)
810 {
811 message->destroy(message);
812 return retransmit(this, this->initiating.seqnr);
813 }
814 if (keep)
815 { /* keep the packet for retransmission, the responder might request it */
816 send_packet(this, TRUE,
817 this->initiating.packet->clone(this->initiating.packet));
818 }
819 else
820 {
821 send_packet(this, TRUE, this->initiating.packet);
822 this->initiating.packet = NULL;
823 }
824 message->destroy(message);
825
826 if (exchange == INFORMATIONAL_V1)
827 {
828 switch (this->ike_sa->get_state(this->ike_sa))
829 {
830 case IKE_CONNECTING:
831 /* close after sending an INFORMATIONAL when unestablished */
832 return FAILED;
833 case IKE_DELETING:
834 /* close after sending a DELETE */
835 return DESTROY_ME;
836 default:
837 break;
838 }
839 }
840 return initiate(this);
841 }
842
843 /**
844 * build a response depending on the "passive" task list
845 */
846 static status_t build_response(private_task_manager_t *this, message_t *request)
847 {
848 enumerator_t *enumerator;
849 task_t *task;
850 message_t *message;
851 host_t *me, *other;
852 bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
853 status_t status;
854
855 me = request->get_destination(request);
856 other = request->get_source(request);
857
858 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
859 message->set_exchange_type(message, request->get_exchange_type(request));
860 /* send response along the path the request came in */
861 message->set_source(message, me->clone(me));
862 message->set_destination(message, other->clone(other));
863 message->set_message_id(message, request->get_message_id(request));
864 message->set_request(message, FALSE);
865
866 this->responding.mid = request->get_message_id(request);
867 this->responding.retransmitted = 0;
868 this->responding.seqnr++;
869
870 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
871 while (enumerator->enumerate(enumerator, (void*)&task))
872 {
873 switch (task->build(task, message))
874 {
875 case SUCCESS:
876 /* task completed, remove it */
877 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
878 task->destroy(task);
879 continue;
880 case NEED_MORE:
881 /* processed, but task needs another exchange */
882 if (task->get_type(task) == TASK_QUICK_MODE ||
883 task->get_type(task) == TASK_AGGRESSIVE_MODE)
884 { /* we rely on initiator retransmission, except for
885 * three-message exchanges */
886 expect_request = TRUE;
887 }
888 continue;
889 case ALREADY_DONE:
890 cancelled = TRUE;
891 break;
892 case FAILED:
893 default:
894 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
895 /* FALL */
896 case DESTROY_ME:
897 /* destroy IKE_SA, but SEND response first */
898 delete = TRUE;
899 break;
900 }
901 break;
902 }
903 enumerator->destroy(enumerator);
904
905 DESTROY_IF(this->responding.packet);
906 this->responding.packet = NULL;
907 if (cancelled)
908 {
909 message->destroy(message);
910 return initiate(this);
911 }
912 status = this->ike_sa->generate_message(this->ike_sa, message,
913 &this->responding.packet);
914 message->destroy(message);
915 if (status != SUCCESS)
916 {
917 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
918 return DESTROY_ME;
919 }
920
921 if (expect_request && !delete)
922 {
923 return retransmit(this, this->responding.seqnr);
924 }
925 send_packet(this, FALSE,
926 this->responding.packet->clone(this->responding.packet));
927 if (delete)
928 {
929 return DESTROY_ME;
930 }
931 return SUCCESS;
932 }
933
934 /**
935 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
936 * The notify protocol_id is set to ISAKMP
937 */
938 static void send_notify(private_task_manager_t *this, message_t *request,
939 notify_type_t type)
940 {
941 message_t *response;
942 packet_t *packet;
943 host_t *me, *other;
944 u_int32_t mid;
945
946 if (request->get_exchange_type(request) == INFORMATIONAL_V1)
947 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
948 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
949 return;
950 }
951 if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
952 {
953 DBG1(DBG_IKE, "failed to allocate message ID");
954 return;
955 }
956 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
957 response->set_exchange_type(response, INFORMATIONAL_V1);
958 response->set_request(response, TRUE);
959 response->set_message_id(response, mid);
960 response->add_payload(response, (payload_t*)
961 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
962 PROTO_IKE, type));
963
964 me = this->ike_sa->get_my_host(this->ike_sa);
965 if (me->is_anyaddr(me))
966 {
967 me = request->get_destination(request);
968 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
969 }
970 other = this->ike_sa->get_other_host(this->ike_sa);
971 if (other->is_anyaddr(other))
972 {
973 other = request->get_source(request);
974 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
975 }
976 response->set_source(response, me->clone(me));
977 response->set_destination(response, other->clone(other));
978 if (this->ike_sa->generate_message(this->ike_sa, response,
979 &packet) == SUCCESS)
980 {
981 send_packet(this, TRUE, packet);
982 }
983 response->destroy(response);
984 }
985
986 /**
987 * Process a DPD request/response
988 */
989 static bool process_dpd(private_task_manager_t *this, message_t *message)
990 {
991 notify_payload_t *notify;
992 notify_type_t type;
993 u_int32_t seq;
994 chunk_t data;
995
996 type = DPD_R_U_THERE;
997 notify = message->get_notify(message, type);
998 if (!notify)
999 {
1000 type = DPD_R_U_THERE_ACK;
1001 notify = message->get_notify(message, type);
1002 }
1003 if (!notify)
1004 {
1005 return FALSE;
1006 }
1007 data = notify->get_notification_data(notify);
1008 if (data.len != 4)
1009 {
1010 return FALSE;
1011 }
1012 seq = untoh32(data.ptr);
1013
1014 if (type == DPD_R_U_THERE)
1015 {
1016 if (this->dpd_recv == 0 || seq == this->dpd_recv)
1017 { /* check sequence validity */
1018 this->dpd_recv = seq + 1;
1019 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1020 time_monotonic(NULL));
1021 }
1022 /* but respond anyway */
1023 this->ike_sa->queue_task(this->ike_sa,
1024 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
1025 }
1026 else /* DPD_R_U_THERE_ACK */
1027 {
1028 if (seq == this->dpd_send - 1)
1029 {
1030 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1031 time_monotonic(NULL));
1032 }
1033 else
1034 {
1035 DBG1(DBG_IKE, "received invalid DPD sequence number %u "
1036 "(expected %u), ignored", seq, this->dpd_send - 1);
1037 }
1038 }
1039 return TRUE;
1040 }
1041
1042 /**
1043 * handle an incoming request message
1044 */
1045 static status_t process_request(private_task_manager_t *this,
1046 message_t *message)
1047 {
1048 enumerator_t *enumerator;
1049 task_t *task = NULL;
1050 bool send_response = FALSE, dpd = FALSE;
1051
1052 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
1053 this->passive_tasks->get_count(this->passive_tasks) == 0)
1054 { /* create tasks depending on request type, if not already some queued */
1055 switch (message->get_exchange_type(message))
1056 {
1057 case ID_PROT:
1058 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
1059 this->passive_tasks->insert_last(this->passive_tasks, task);
1060 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
1061 this->passive_tasks->insert_last(this->passive_tasks, task);
1062 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
1063 this->passive_tasks->insert_last(this->passive_tasks, task);
1064 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
1065 this->passive_tasks->insert_last(this->passive_tasks, task);
1066 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
1067 this->passive_tasks->insert_last(this->passive_tasks, task);
1068 break;
1069 case AGGRESSIVE:
1070 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
1071 this->passive_tasks->insert_last(this->passive_tasks, task);
1072 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
1073 this->passive_tasks->insert_last(this->passive_tasks, task);
1074 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
1075 this->passive_tasks->insert_last(this->passive_tasks, task);
1076 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
1077 this->passive_tasks->insert_last(this->passive_tasks, task);
1078 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
1079 this->passive_tasks->insert_last(this->passive_tasks, task);
1080 this->frag.exchange = AGGRESSIVE;
1081 break;
1082 case QUICK_MODE:
1083 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1084 {
1085 DBG1(DBG_IKE, "received quick mode request for "
1086 "unestablished IKE_SA, ignored");
1087 return FAILED;
1088 }
1089 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
1090 NULL, NULL);
1091 this->passive_tasks->insert_last(this->passive_tasks, task);
1092 break;
1093 case INFORMATIONAL_V1:
1094 if (process_dpd(this, message))
1095 {
1096 dpd = TRUE;
1097 }
1098 else
1099 {
1100 task = (task_t *)informational_create(this->ike_sa, NULL);
1101 this->passive_tasks->insert_first(this->passive_tasks, task);
1102 }
1103 break;
1104 case TRANSACTION:
1105 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
1106 {
1107 task = (task_t *)mode_config_create(this->ike_sa,
1108 FALSE, TRUE);
1109 }
1110 else
1111 {
1112 task = (task_t *)xauth_create(this->ike_sa, FALSE);
1113 }
1114 this->passive_tasks->insert_last(this->passive_tasks, task);
1115 break;
1116 default:
1117 return FAILED;
1118 }
1119 }
1120 if (dpd)
1121 {
1122 return initiate(this);
1123 }
1124 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
1125
1126 /* let the tasks process the message */
1127 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
1128 while (enumerator->enumerate(enumerator, (void*)&task))
1129 {
1130 switch (task->process(task, message))
1131 {
1132 case SUCCESS:
1133 /* task completed, remove it */
1134 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1135 task->destroy(task);
1136 continue;
1137 case NEED_MORE:
1138 /* processed, but task needs at least another call to build() */
1139 send_response = TRUE;
1140 continue;
1141 case ALREADY_DONE:
1142 send_response = FALSE;
1143 break;
1144 case FAILED:
1145 default:
1146 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1147 /* FALL */
1148 case DESTROY_ME:
1149 /* critical failure, destroy IKE_SA */
1150 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1151 enumerator->destroy(enumerator);
1152 task->destroy(task);
1153 return DESTROY_ME;
1154 }
1155 break;
1156 }
1157 enumerator->destroy(enumerator);
1158
1159 if (send_response)
1160 {
1161 if (build_response(this, message) != SUCCESS)
1162 {
1163 return DESTROY_ME;
1164 }
1165 }
1166 else
1167 { /* We don't send a response, so don't retransmit one if we get
1168 * the same message again. */
1169 DESTROY_IF(this->responding.packet);
1170 this->responding.packet = NULL;
1171 }
1172 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
1173 this->queued_tasks->get_count(this->queued_tasks) > 0)
1174 {
1175 /* passive tasks completed, check if an active task has been queued,
1176 * such as XAUTH or modeconfig push */
1177 return initiate(this);
1178 }
1179 return SUCCESS;
1180 }
1181
1182 /**
1183 * handle an incoming response message
1184 */
1185 static status_t process_response(private_task_manager_t *this,
1186 message_t *message)
1187 {
1188 enumerator_t *enumerator;
1189 message_t *queued;
1190 status_t status;
1191 task_t *task;
1192
1193 if (message->get_exchange_type(message) != this->initiating.type)
1194 {
1195 /* Windows server sends a fourth quick mode message having an initial
1196 * contact notify. Ignore this message for compatibility. */
1197 if (this->initiating.type == EXCHANGE_TYPE_UNDEFINED &&
1198 message->get_exchange_type(message) == QUICK_MODE &&
1199 message->get_notify(message, INITIAL_CONTACT))
1200 {
1201 DBG1(DBG_IKE, "ignoring fourth Quick Mode message");
1202 return SUCCESS;
1203 }
1204 DBG1(DBG_IKE, "received %N response, but expected %N",
1205 exchange_type_names, message->get_exchange_type(message),
1206 exchange_type_names, this->initiating.type);
1207 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1208 return DESTROY_ME;
1209 }
1210
1211 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
1212 while (enumerator->enumerate(enumerator, (void*)&task))
1213 {
1214 switch (task->process(task, message))
1215 {
1216 case SUCCESS:
1217 /* task completed, remove it */
1218 this->active_tasks->remove_at(this->active_tasks, enumerator);
1219 task->destroy(task);
1220 continue;
1221 case NEED_MORE:
1222 /* processed, but task needs another exchange */
1223 continue;
1224 case ALREADY_DONE:
1225 break;
1226 case FAILED:
1227 default:
1228 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1229 /* FALL */
1230 case DESTROY_ME:
1231 /* critical failure, destroy IKE_SA */
1232 this->active_tasks->remove_at(this->active_tasks, enumerator);
1233 enumerator->destroy(enumerator);
1234 task->destroy(task);
1235 return DESTROY_ME;
1236 }
1237 break;
1238 }
1239 enumerator->destroy(enumerator);
1240
1241 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1242 DESTROY_IF(this->initiating.packet);
1243 this->initiating.packet = NULL;
1244
1245 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
1246 {
1247 queued = this->queued;
1248 this->queued = NULL;
1249 status = this->public.task_manager.process_message(
1250 &this->public.task_manager, queued);
1251 queued->destroy(queued);
1252 if (status == DESTROY_ME)
1253 {
1254 return status;
1255 }
1256 }
1257
1258 return initiate(this);
1259 }
1260
1261 static status_t handle_fragment(private_task_manager_t *this, message_t *msg)
1262 {
1263 fragment_payload_t *payload;
1264 enumerator_t *enumerator;
1265 fragment_t *fragment;
1266 status_t status = SUCCESS;
1267 chunk_t data;
1268 u_int8_t num;
1269
1270 payload = (fragment_payload_t*)msg->get_payload(msg, FRAGMENT_V1);
1271 if (!payload)
1272 {
1273 return FAILED;
1274 }
1275
1276 if (!this->frag.list || this->frag.id != payload->get_id(payload))
1277 {
1278 clear_fragments(this, payload->get_id(payload));
1279 this->frag.list = linked_list_create();
1280 }
1281
1282 num = payload->get_number(payload);
1283 if (!this->frag.last && payload->is_last(payload))
1284 {
1285 this->frag.last = num;
1286 }
1287
1288 enumerator = this->frag.list->create_enumerator(this->frag.list);
1289 while (enumerator->enumerate(enumerator, &fragment))
1290 {
1291 if (fragment->num == num)
1292 { /* ignore a duplicate fragment */
1293 DBG1(DBG_IKE, "received duplicate fragment #%hhu", num);
1294 enumerator->destroy(enumerator);
1295 return NEED_MORE;
1296 }
1297 if (fragment->num > num)
1298 {
1299 break;
1300 }
1301 }
1302
1303 data = payload->get_data(payload);
1304 this->frag.len += data.len;
1305 if (this->frag.len > this->frag.max_packet)
1306 {
1307 DBG1(DBG_IKE, "fragmented IKE message is too large");
1308 enumerator->destroy(enumerator);
1309 clear_fragments(this, 0);
1310 return FAILED;
1311 }
1312
1313 INIT(fragment,
1314 .num = num,
1315 .data = chunk_clone(data),
1316 );
1317
1318 this->frag.list->insert_before(this->frag.list, enumerator, fragment);
1319 enumerator->destroy(enumerator);
1320
1321 if (this->frag.list->get_count(this->frag.list) == this->frag.last)
1322 {
1323 message_t *message;
1324 packet_t *pkt;
1325 host_t *src, *dst;
1326 bio_writer_t *writer;
1327
1328 writer = bio_writer_create(this->frag.len);
1329 DBG1(DBG_IKE, "received fragment #%hhu, reassembling fragmented IKE "
1330 "message", num);
1331 enumerator = this->frag.list->create_enumerator(this->frag.list);
1332 while (enumerator->enumerate(enumerator, &fragment))
1333 {
1334 writer->write_data(writer, fragment->data);
1335 }
1336 enumerator->destroy(enumerator);
1337
1338 src = msg->get_source(msg);
1339 dst = msg->get_destination(msg);
1340 pkt = packet_create_from_data(src->clone(src), dst->clone(dst),
1341 writer->extract_buf(writer));
1342 writer->destroy(writer);
1343
1344 message = message_create_from_packet(pkt);
1345 if (message->parse_header(message) != SUCCESS)
1346 {
1347 DBG1(DBG_IKE, "failed to parse header of reassembled IKE message");
1348 message->destroy(message);
1349 status = FAILED;
1350 }
1351 else
1352 {
1353 lib->processor->queue_job(lib->processor,
1354 (job_t*)process_message_job_create(message));
1355 status = NEED_MORE;
1356
1357 }
1358 clear_fragments(this, 0);
1359 }
1360 else
1361 { /* there are some fragments missing */
1362 DBG1(DBG_IKE, "received fragment #%hhu, waiting for complete IKE "
1363 "message", num);
1364 status = NEED_MORE;
1365 }
1366 return status;
1367 }
1368
1369 /**
1370 * Parse the given message and verify that it is valid.
1371 */
1372 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1373 {
1374 status_t status;
1375
1376 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1377
1378 if (status != SUCCESS)
1379 {
1380 switch (status)
1381 {
1382 case NOT_SUPPORTED:
1383 DBG1(DBG_IKE, "unsupported exchange type");
1384 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1385 break;
1386 case PARSE_ERROR:
1387 DBG1(DBG_IKE, "message parsing failed");
1388 send_notify(this, msg, PAYLOAD_MALFORMED);
1389 break;
1390 case VERIFY_ERROR:
1391 DBG1(DBG_IKE, "message verification failed");
1392 send_notify(this, msg, PAYLOAD_MALFORMED);
1393 break;
1394 case FAILED:
1395 DBG1(DBG_IKE, "integrity check failed");
1396 send_notify(this, msg, INVALID_HASH_INFORMATION);
1397 break;
1398 case INVALID_STATE:
1399 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1400 send_notify(this, msg, PAYLOAD_MALFORMED);
1401 default:
1402 break;
1403 }
1404 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1405 exchange_type_names, msg->get_exchange_type(msg),
1406 msg->get_request(msg) ? "request" : "response",
1407 msg->get_message_id(msg));
1408
1409 charon->bus->alert(charon->bus, ALERT_PARSE_ERROR_BODY, msg, status);
1410
1411 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1412 { /* invalid initiation attempt, close SA */
1413 return DESTROY_ME;
1414 }
1415 }
1416
1417 if (msg->get_first_payload_type(msg) == FRAGMENT_V1)
1418 {
1419 return handle_fragment(this, msg);
1420 }
1421 return status;
1422 }
1423
1424 METHOD(task_manager_t, process_message, status_t,
1425 private_task_manager_t *this, message_t *msg)
1426 {
1427 u_int32_t hash, mid, i;
1428 host_t *me, *other;
1429 status_t status;
1430
1431 /* TODO-IKEv1: update hosts more selectively */
1432 me = msg->get_destination(msg);
1433 other = msg->get_source(msg);
1434 mid = msg->get_message_id(msg);
1435 hash = chunk_hash(msg->get_packet_data(msg));
1436 for (i = 0; i < MAX_OLD_HASHES; i++)
1437 {
1438 if (this->initiating.old_hashes[i] == hash)
1439 {
1440 if (this->initiating.packet &&
1441 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1442 (msg->get_exchange_type(msg) == QUICK_MODE ||
1443 msg->get_exchange_type(msg) == AGGRESSIVE))
1444 {
1445 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1446 "resending last request", mid);
1447 send_packet(this, TRUE,
1448 this->initiating.packet->clone(this->initiating.packet));
1449 return SUCCESS;
1450 }
1451 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1452 "but next request already sent", mid);
1453 return SUCCESS;
1454 }
1455 }
1456
1457 if ((mid && mid == this->initiating.mid) ||
1458 (this->initiating.mid == 0 &&
1459 msg->get_exchange_type(msg) == this->initiating.type &&
1460 this->active_tasks->get_count(this->active_tasks)))
1461 {
1462 msg->set_request(msg, FALSE);
1463 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1464 status = parse_message(this, msg);
1465 if (status == NEED_MORE)
1466 {
1467 return SUCCESS;
1468 }
1469 if (status != SUCCESS)
1470 {
1471 return status;
1472 }
1473 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1474 time_monotonic(NULL));
1475 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1476 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1477 if (process_response(this, msg) != SUCCESS)
1478 {
1479 flush(this);
1480 return DESTROY_ME;
1481 }
1482 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1483 MAX_OLD_HASHES] = hash;
1484 }
1485 else
1486 {
1487 if (hash == this->responding.hash)
1488 {
1489 if (this->responding.packet)
1490 {
1491 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1492 "retransmitting response", mid);
1493 send_packet(this, FALSE,
1494 this->responding.packet->clone(this->responding.packet));
1495 }
1496 else if (this->initiating.packet &&
1497 this->initiating.type == INFORMATIONAL_V1)
1498 {
1499 DBG1(DBG_IKE, "received retransmit of DPD request, "
1500 "retransmitting response");
1501 send_packet(this, TRUE,
1502 this->initiating.packet->clone(this->initiating.packet));
1503 }
1504 else
1505 {
1506 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1507 "but no response to retransmit", mid);
1508 }
1509 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_RECEIVE, msg);
1510 return SUCCESS;
1511 }
1512
1513 /* reject Main/Aggressive Modes once established */
1514 if (msg->get_exchange_type(msg) == ID_PROT ||
1515 msg->get_exchange_type(msg) == AGGRESSIVE)
1516 {
1517 if (this->ike_sa->get_state(this->ike_sa) != IKE_CREATED &&
1518 this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING &&
1519 msg->get_first_payload_type(msg) != FRAGMENT_V1)
1520 {
1521 DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
1522 exchange_type_names, msg->get_exchange_type(msg));
1523 return FAILED;
1524 }
1525 }
1526
1527 if (msg->get_exchange_type(msg) == TRANSACTION &&
1528 this->active_tasks->get_count(this->active_tasks))
1529 { /* main mode not yet complete, queue XAuth/Mode config tasks */
1530 if (this->queued)
1531 {
1532 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
1533 exchange_type_names, TRANSACTION);
1534 return SUCCESS;
1535 }
1536 this->queued = message_create_from_packet(msg->get_packet(msg));
1537 if (this->queued->parse_header(this->queued) != SUCCESS)
1538 {
1539 this->queued->destroy(this->queued);
1540 this->queued = NULL;
1541 return FAILED;
1542 }
1543 DBG1(DBG_IKE, "queueing %N request as tasks still active",
1544 exchange_type_names, TRANSACTION);
1545 return SUCCESS;
1546 }
1547
1548 msg->set_request(msg, TRUE);
1549 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1550 status = parse_message(this, msg);
1551 if (status == NEED_MORE)
1552 {
1553 return SUCCESS;
1554 }
1555 if (status != SUCCESS)
1556 {
1557 return status;
1558 }
1559 /* if this IKE_SA is virgin, we check for a config */
1560 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1561 {
1562 ike_sa_id_t *ike_sa_id;
1563 ike_cfg_t *ike_cfg;
1564 job_t *job;
1565
1566 ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1567 me, other, IKEV1);
1568 if (ike_cfg == NULL)
1569 {
1570 /* no config found for these hosts, destroy */
1571 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1572 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1573 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1574 return DESTROY_ME;
1575 }
1576 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1577 ike_cfg->destroy(ike_cfg);
1578 /* add a timeout if peer does not establish it completely */
1579 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1580 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1581 lib->scheduler->schedule_job(lib->scheduler, job,
1582 lib->settings->get_int(lib->settings,
1583 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1584 charon->name));
1585 }
1586 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1587 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1588 if (process_request(this, msg) != SUCCESS)
1589 {
1590 flush(this);
1591 return DESTROY_ME;
1592 }
1593 this->responding.hash = hash;
1594 }
1595 return SUCCESS;
1596 }
1597
1598 METHOD(task_manager_t, queue_task, void,
1599 private_task_manager_t *this, task_t *task)
1600 {
1601 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1602 this->queued_tasks->insert_last(this->queued_tasks, task);
1603 }
1604
1605 /**
1606 * Check if a given task has been queued already
1607 */
1608 static bool has_queued(private_task_manager_t *this, task_type_t type)
1609 {
1610 enumerator_t *enumerator;
1611 bool found = FALSE;
1612 task_t *task;
1613
1614 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1615 while (enumerator->enumerate(enumerator, &task))
1616 {
1617 if (task->get_type(task) == type)
1618 {
1619 found = TRUE;
1620 break;
1621 }
1622 }
1623 enumerator->destroy(enumerator);
1624 return found;
1625 }
1626
1627 METHOD(task_manager_t, queue_ike, void,
1628 private_task_manager_t *this)
1629 {
1630 peer_cfg_t *peer_cfg;
1631
1632 if (!has_queued(this, TASK_ISAKMP_VENDOR))
1633 {
1634 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1635 }
1636 if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1637 {
1638 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1639 }
1640 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1641 if (peer_cfg->use_aggressive(peer_cfg))
1642 {
1643 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1644 {
1645 queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1646 }
1647 this->frag.exchange = AGGRESSIVE;
1648 }
1649 else
1650 {
1651 if (!has_queued(this, TASK_MAIN_MODE))
1652 {
1653 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1654 }
1655 }
1656 if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1657 {
1658 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1659 }
1660 if (!has_queued(this, TASK_ISAKMP_NATD))
1661 {
1662 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1663 }
1664 }
1665
1666 METHOD(task_manager_t, queue_ike_reauth, void,
1667 private_task_manager_t *this)
1668 {
1669 enumerator_t *enumerator;
1670 child_sa_t *child_sa;
1671 ike_sa_t *new;
1672 host_t *host;
1673
1674 new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1675 this->ike_sa->get_version(this->ike_sa), TRUE);
1676 if (!new)
1677 { /* shouldn't happen */
1678 return;
1679 }
1680
1681 new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1682 host = this->ike_sa->get_other_host(this->ike_sa);
1683 new->set_other_host(new, host->clone(host));
1684 host = this->ike_sa->get_my_host(this->ike_sa);
1685 new->set_my_host(new, host->clone(host));
1686 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1687 while (enumerator->enumerate(enumerator, &host))
1688 {
1689 new->add_virtual_ip(new, TRUE, host);
1690 }
1691 enumerator->destroy(enumerator);
1692
1693 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1694 while (enumerator->enumerate(enumerator, &child_sa))
1695 {
1696 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1697 new->add_child_sa(new, child_sa);
1698 }
1699 enumerator->destroy(enumerator);
1700
1701 if (!new->get_child_count(new))
1702 { /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1703 task_t *task;
1704
1705 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1706 while (enumerator->enumerate(enumerator, &task))
1707 {
1708 if (task->get_type(task) == TASK_QUICK_MODE)
1709 {
1710 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1711 task->migrate(task, new);
1712 new->queue_task(new, task);
1713 }
1714 }
1715 enumerator->destroy(enumerator);
1716 }
1717
1718 if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1719 {
1720 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1721 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1722 }
1723 else
1724 {
1725 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1726 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1727 }
1728 charon->bus->set_sa(charon->bus, this->ike_sa);
1729 }
1730
1731 METHOD(task_manager_t, queue_ike_rekey, void,
1732 private_task_manager_t *this)
1733 {
1734 queue_ike_reauth(this);
1735 }
1736
1737 METHOD(task_manager_t, queue_ike_delete, void,
1738 private_task_manager_t *this)
1739 {
1740 enumerator_t *enumerator;
1741 child_sa_t *child_sa;
1742
1743 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1744 while (enumerator->enumerate(enumerator, &child_sa))
1745 {
1746 queue_task(this, (task_t*)
1747 quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1748 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1749 }
1750 enumerator->destroy(enumerator);
1751
1752 queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1753 }
1754
1755 METHOD(task_manager_t, queue_mobike, void,
1756 private_task_manager_t *this, bool roam, bool address)
1757 {
1758 /* Not supported in IKEv1 */
1759 }
1760
1761 METHOD(task_manager_t, queue_child, void,
1762 private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1763 traffic_selector_t *tsi, traffic_selector_t *tsr)
1764 {
1765 quick_mode_t *task;
1766
1767 task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1768 task->use_reqid(task, reqid);
1769
1770 queue_task(this, &task->task);
1771 }
1772
1773 /**
1774 * Check if two CHILD_SAs have the same traffic selector
1775 */
1776 static bool have_equal_ts(child_sa_t *child1, child_sa_t *child2, bool local)
1777 {
1778 enumerator_t *e1, *e2;
1779 traffic_selector_t *ts1, *ts2;
1780 bool equal = FALSE;
1781
1782 e1 = child1->create_ts_enumerator(child1, local);
1783 e2 = child2->create_ts_enumerator(child2, local);
1784 if (e1->enumerate(e1, &ts1) && e2->enumerate(e2, &ts2))
1785 {
1786 equal = ts1->equals(ts1, ts2);
1787 }
1788 e2->destroy(e2);
1789 e1->destroy(e1);
1790
1791 return equal;
1792 }
1793
1794 /**
1795 * Check if a CHILD_SA is redundant and we should delete instead of rekey
1796 */
1797 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1798 {
1799 enumerator_t *enumerator;
1800 child_sa_t *current;
1801 bool redundant = FALSE;
1802
1803 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1804 while (enumerator->enumerate(enumerator, &current))
1805 {
1806 if (current->get_state(current) == CHILD_INSTALLED &&
1807 streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1808 have_equal_ts(current, child_sa, TRUE) &&
1809 have_equal_ts(current, child_sa, FALSE) &&
1810 current->get_lifetime(current, FALSE) >
1811 child_sa->get_lifetime(child_sa, FALSE))
1812 {
1813 DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1814 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
1815 redundant = TRUE;
1816 break;
1817 }
1818 }
1819 enumerator->destroy(enumerator);
1820
1821 return redundant;
1822 }
1823
1824 /**
1825 * Get the first traffic selector of a CHILD_SA, local or remote
1826 */
1827 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1828 {
1829 traffic_selector_t *ts = NULL;
1830 enumerator_t *enumerator;
1831
1832 enumerator = child_sa->create_ts_enumerator(child_sa, local);
1833 enumerator->enumerate(enumerator, &ts);
1834 enumerator->destroy(enumerator);
1835
1836 return ts;
1837 }
1838
1839 METHOD(task_manager_t, queue_child_rekey, void,
1840 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1841 {
1842 child_sa_t *child_sa;
1843 child_cfg_t *cfg;
1844 quick_mode_t *task;
1845
1846 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1847 if (!child_sa)
1848 {
1849 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1850 }
1851 if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1852 {
1853 if (is_redundant(this, child_sa))
1854 {
1855 queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1856 protocol, spi, FALSE, FALSE));
1857 }
1858 else
1859 {
1860 child_sa->set_state(child_sa, CHILD_REKEYING);
1861 cfg = child_sa->get_config(child_sa);
1862 task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1863 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1864 task->use_reqid(task, child_sa->get_reqid(child_sa));
1865 task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1866
1867 queue_task(this, &task->task);
1868 }
1869 }
1870 }
1871
1872 METHOD(task_manager_t, queue_child_delete, void,
1873 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1874 bool expired)
1875 {
1876 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1877 spi, FALSE, expired));
1878 }
1879
1880 METHOD(task_manager_t, queue_dpd, void,
1881 private_task_manager_t *this)
1882 {
1883 peer_cfg_t *peer_cfg;
1884 u_int32_t t, retransmit;
1885
1886 queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1887 this->dpd_send++));
1888 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1889
1890 /* compute timeout in milliseconds */
1891 t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1892 if (t == 0)
1893 {
1894 /* use the same timeout as a retransmitting IKE message would have */
1895 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1896 {
1897 t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1898 pow(this->retransmit_base, retransmit));
1899 }
1900 }
1901
1902 /* schedule DPD timeout job */
1903 lib->scheduler->schedule_job_ms(lib->scheduler,
1904 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1905 }
1906
1907 METHOD(task_manager_t, adopt_tasks, void,
1908 private_task_manager_t *this, task_manager_t *other_public)
1909 {
1910 private_task_manager_t *other = (private_task_manager_t*)other_public;
1911 task_t *task;
1912
1913 /* move queued tasks from other to this */
1914 while (other->queued_tasks->remove_last(other->queued_tasks,
1915 (void**)&task) == SUCCESS)
1916 {
1917 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1918 task->migrate(task, this->ike_sa);
1919 this->queued_tasks->insert_first(this->queued_tasks, task);
1920 }
1921 }
1922
1923 /**
1924 * Migrates child-creating tasks from src to dst
1925 */
1926 static void migrate_child_tasks(private_task_manager_t *this,
1927 linked_list_t *src, linked_list_t *dst)
1928 {
1929 enumerator_t *enumerator;
1930 task_t *task;
1931
1932 enumerator = src->create_enumerator(src);
1933 while (enumerator->enumerate(enumerator, &task))
1934 {
1935 if (task->get_type(task) == TASK_QUICK_MODE)
1936 {
1937 src->remove_at(src, enumerator);
1938 task->migrate(task, this->ike_sa);
1939 dst->insert_last(dst, task);
1940 }
1941 }
1942 enumerator->destroy(enumerator);
1943 }
1944
1945 METHOD(task_manager_t, adopt_child_tasks, void,
1946 private_task_manager_t *this, task_manager_t *other_public)
1947 {
1948 private_task_manager_t *other = (private_task_manager_t*)other_public;
1949
1950 /* move active child tasks from other to this */
1951 migrate_child_tasks(this, other->active_tasks, this->queued_tasks);
1952 /* do the same for queued tasks */
1953 migrate_child_tasks(this, other->queued_tasks, this->queued_tasks);
1954 }
1955
1956 METHOD(task_manager_t, busy, bool,
1957 private_task_manager_t *this)
1958 {
1959 return (this->active_tasks->get_count(this->active_tasks) > 0);
1960 }
1961
1962 METHOD(task_manager_t, incr_mid, void,
1963 private_task_manager_t *this, bool initiate)
1964 {
1965 }
1966
1967 METHOD(task_manager_t, reset, void,
1968 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1969 {
1970 enumerator_t *enumerator;
1971 task_t *task;
1972
1973 /* reset message counters and retransmit packets */
1974 DESTROY_IF(this->responding.packet);
1975 DESTROY_IF(this->initiating.packet);
1976 this->responding.packet = NULL;
1977 this->responding.seqnr = RESPONDING_SEQ;
1978 this->responding.retransmitted = 0;
1979 this->initiating.packet = NULL;
1980 this->initiating.mid = 0;
1981 this->initiating.seqnr = 0;
1982 this->initiating.retransmitted = 0;
1983 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1984 clear_fragments(this, 0);
1985 if (initiate != UINT_MAX)
1986 {
1987 this->dpd_send = initiate;
1988 }
1989 if (respond != UINT_MAX)
1990 {
1991 this->dpd_recv = respond;
1992 }
1993
1994 /* reset queued tasks */
1995 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1996 while (enumerator->enumerate(enumerator, &task))
1997 {
1998 task->migrate(task, this->ike_sa);
1999 }
2000 enumerator->destroy(enumerator);
2001
2002 /* reset active tasks */
2003 while (this->active_tasks->remove_last(this->active_tasks,
2004 (void**)&task) == SUCCESS)
2005 {
2006 task->migrate(task, this->ike_sa);
2007 this->queued_tasks->insert_first(this->queued_tasks, task);
2008 }
2009 }
2010
2011 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
2012 private_task_manager_t *this, task_queue_t queue)
2013 {
2014 switch (queue)
2015 {
2016 case TASK_QUEUE_ACTIVE:
2017 return this->active_tasks->create_enumerator(this->active_tasks);
2018 case TASK_QUEUE_PASSIVE:
2019 return this->passive_tasks->create_enumerator(this->passive_tasks);
2020 case TASK_QUEUE_QUEUED:
2021 return this->queued_tasks->create_enumerator(this->queued_tasks);
2022 default:
2023 return enumerator_create_empty();
2024 }
2025 }
2026
2027 METHOD(task_manager_t, destroy, void,
2028 private_task_manager_t *this)
2029 {
2030 flush(this);
2031
2032 this->active_tasks->destroy(this->active_tasks);
2033 this->queued_tasks->destroy(this->queued_tasks);
2034 this->passive_tasks->destroy(this->passive_tasks);
2035 clear_fragments(this, 0);
2036
2037 DESTROY_IF(this->queued);
2038 DESTROY_IF(this->responding.packet);
2039 DESTROY_IF(this->initiating.packet);
2040 DESTROY_IF(this->rng);
2041 free(this);
2042 }
2043
2044 /*
2045 * see header file
2046 */
2047 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
2048 {
2049 private_task_manager_t *this;
2050
2051 INIT(this,
2052 .public = {
2053 .task_manager = {
2054 .process_message = _process_message,
2055 .queue_task = _queue_task,
2056 .queue_ike = _queue_ike,
2057 .queue_ike_rekey = _queue_ike_rekey,
2058 .queue_ike_reauth = _queue_ike_reauth,
2059 .queue_ike_delete = _queue_ike_delete,
2060 .queue_mobike = _queue_mobike,
2061 .queue_child = _queue_child,
2062 .queue_child_rekey = _queue_child_rekey,
2063 .queue_child_delete = _queue_child_delete,
2064 .queue_dpd = _queue_dpd,
2065 .initiate = _initiate,
2066 .retransmit = _retransmit,
2067 .incr_mid = _incr_mid,
2068 .reset = _reset,
2069 .adopt_tasks = _adopt_tasks,
2070 .adopt_child_tasks = _adopt_child_tasks,
2071 .busy = _busy,
2072 .create_task_enumerator = _create_task_enumerator,
2073 .flush_queue = _flush_queue,
2074 .destroy = _destroy,
2075 },
2076 },
2077 .initiating = {
2078 .type = EXCHANGE_TYPE_UNDEFINED,
2079 },
2080 .responding = {
2081 .seqnr = RESPONDING_SEQ,
2082 },
2083 .frag = {
2084 .exchange = ID_PROT,
2085 .max_packet = lib->settings->get_int(lib->settings,
2086 "%s.max_packet", MAX_PACKET, charon->name),
2087 .size = lib->settings->get_int(lib->settings,
2088 "%s.fragment_size", MAX_FRAGMENT_SIZE, charon->name),
2089 },
2090 .ike_sa = ike_sa,
2091 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
2092 .queued_tasks = linked_list_create(),
2093 .active_tasks = linked_list_create(),
2094 .passive_tasks = linked_list_create(),
2095 .retransmit_tries = lib->settings->get_int(lib->settings,
2096 "%s.retransmit_tries", RETRANSMIT_TRIES, charon->name),
2097 .retransmit_timeout = lib->settings->get_double(lib->settings,
2098 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name),
2099 .retransmit_base = lib->settings->get_double(lib->settings,
2100 "%s.retransmit_base", RETRANSMIT_BASE, charon->name),
2101 );
2102
2103 if (!this->rng)
2104 {
2105 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
2106 destroy(this);
2107 return NULL;
2108 }
2109 if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
2110 (void*)&this->dpd_send))
2111 {
2112 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
2113 destroy(this);
2114 return NULL;
2115 }
2116 this->dpd_send &= 0x7FFFFFFF;
2117
2118 return &this->public;
2119 }
Unnamed repository; edit this file 'description' to name the repository.