]> git.ipfire.org Git - thirdparty/strongswan.git/blob - src/libcharon/sa/ikev1/task_manager_v1.c
projects / thirdparty / strongswan.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ikev1: Minor code optimization in task manager
[thirdparty/strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2016 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * HSR Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/aggressive_mode.h>
24 #include <sa/ikev1/tasks/quick_mode.h>
25 #include <sa/ikev1/tasks/quick_delete.h>
26 #include <sa/ikev1/tasks/xauth.h>
27 #include <sa/ikev1/tasks/mode_config.h>
28 #include <sa/ikev1/tasks/informational.h>
29 #include <sa/ikev1/tasks/isakmp_natd.h>
30 #include <sa/ikev1/tasks/isakmp_vendor.h>
31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
33 #include <sa/ikev1/tasks/isakmp_delete.h>
34 #include <sa/ikev1/tasks/isakmp_dpd.h>
35
36 #include <processing/jobs/retransmit_job.h>
37 #include <processing/jobs/delete_ike_sa_job.h>
38 #include <processing/jobs/dpd_timeout_job.h>
39 #include <processing/jobs/process_message_job.h>
40
41 #include <collections/array.h>
42
43 /**
44 * Number of old messages hashes we keep for retransmission.
45 *
46 * In Main Mode, we must ignore messages from a previous message pair if
47 * we already continued to the next. Otherwise a late retransmission
48 * could be considered as a reply to the newer request.
49 */
50 #define MAX_OLD_HASHES 2
51
52 /**
53 * First sequence number of responding packets.
54 *
55 * To distinguish retransmission jobs for initiating and responding packets,
56 * we split up the sequence counter and use the upper half for responding.
57 */
58 #define RESPONDING_SEQ INT_MAX
59
60 typedef struct exchange_t exchange_t;
61
62 /**
63 * An exchange in the air, used do detect and handle retransmission
64 */
65 struct exchange_t {
66
67 /**
68 * Message ID used for this transaction
69 */
70 uint32_t mid;
71
72 /**
73 * generated packet for retransmission
74 */
75 packet_t *packet;
76 };
77
78 typedef struct private_task_manager_t private_task_manager_t;
79
80 /**
81 * private data of the task manager
82 */
83 struct private_task_manager_t {
84
85 /**
86 * public functions
87 */
88 task_manager_v1_t public;
89
90 /**
91 * associated IKE_SA we are serving
92 */
93 ike_sa_t *ike_sa;
94
95 /**
96 * RNG to create message IDs
97 */
98 rng_t *rng;
99
100 /**
101 * Exchange we are currently handling as responder
102 */
103 struct {
104 /**
105 * Message ID of the last response
106 */
107 uint32_t mid;
108
109 /**
110 * Hash of a previously received message
111 */
112 uint32_t hash;
113
114 /**
115 * packet(s) for retransmission
116 */
117 array_t *packets;
118
119 /**
120 * Sequence number of the last sent message
121 */
122 uint32_t seqnr;
123
124 /**
125 * how many times we have retransmitted so far
126 */
127 u_int retransmitted;
128
129 } responding;
130
131 /**
132 * Exchange we are currently handling as initiator
133 */
134 struct {
135 /**
136 * Message ID of the exchange
137 */
138 uint32_t mid;
139
140 /**
141 * Hashes of old responses we can ignore
142 */
143 uint32_t old_hashes[MAX_OLD_HASHES];
144
145 /**
146 * Position in old hash array
147 */
148 int old_hash_pos;
149
150 /**
151 * Sequence number of the last sent message
152 */
153 uint32_t seqnr;
154
155 /**
156 * how many times we have retransmitted so far
157 */
158 u_int retransmitted;
159
160 /**
161 * packet(s) for retransmission
162 */
163 array_t *packets;
164
165 /**
166 * type of the initiated exchange
167 */
168 exchange_type_t type;
169
170 } initiating;
171
172 /**
173 * Message we are currently defragmenting, if any (only one at a time)
174 */
175 message_t *defrag;
176
177 /**
178 * List of queued tasks not yet in action
179 */
180 linked_list_t *queued_tasks;
181
182 /**
183 * List of active tasks, initiated by ourselves
184 */
185 linked_list_t *active_tasks;
186
187 /**
188 * List of tasks initiated by peer
189 */
190 linked_list_t *passive_tasks;
191
192 /**
193 * Queued messages not yet ready to process
194 */
195 message_t *queued;
196
197 /**
198 * Number of times we retransmit messages before giving up
199 */
200 u_int retransmit_tries;
201
202 /**
203 * Retransmission timeout
204 */
205 double retransmit_timeout;
206
207 /**
208 * Base to calculate retransmission timeout
209 */
210 double retransmit_base;
211
212 /**
213 * Sequence number for sending DPD requests
214 */
215 uint32_t dpd_send;
216
217 /**
218 * Sequence number for received DPD requests
219 */
220 uint32_t dpd_recv;
221 };
222
223 /**
224 * Reset retransmission packet list
225 */
226 static void clear_packets(array_t *array)
227 {
228 packet_t *packet;
229
230 while (array_remove(array, ARRAY_TAIL, &packet))
231 {
232 packet->destroy(packet);
233 }
234 }
235
236 METHOD(task_manager_t, flush_queue, void,
237 private_task_manager_t *this, task_queue_t queue)
238 {
239 linked_list_t *list;
240 task_t *task;
241
242 if (this->queued)
243 {
244 this->queued->destroy(this->queued);
245 this->queued = NULL;
246 }
247 switch (queue)
248 {
249 case TASK_QUEUE_ACTIVE:
250 list = this->active_tasks;
251 /* cancel pending retransmits */
252 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
253 clear_packets(this->initiating.packets);
254 break;
255 case TASK_QUEUE_PASSIVE:
256 list = this->passive_tasks;
257 break;
258 case TASK_QUEUE_QUEUED:
259 list = this->queued_tasks;
260 break;
261 default:
262 return;
263 }
264 while (list->remove_last(list, (void**)&task) == SUCCESS)
265 {
266 task->destroy(task);
267 }
268 }
269
270 METHOD(task_manager_t, flush, void,
271 private_task_manager_t *this)
272 {
273 flush_queue(this, TASK_QUEUE_QUEUED);
274 flush_queue(this, TASK_QUEUE_PASSIVE);
275 flush_queue(this, TASK_QUEUE_ACTIVE);
276 }
277
278 /**
279 * move a task of a specific type from the queue to the active list
280 */
281 static bool activate_task(private_task_manager_t *this, task_type_t type)
282 {
283 enumerator_t *enumerator;
284 task_t *task;
285 bool found = FALSE;
286
287 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
288 while (enumerator->enumerate(enumerator, (void**)&task))
289 {
290 if (task->get_type(task) == type)
291 {
292 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
293 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
294 this->active_tasks->insert_last(this->active_tasks, task);
295 found = TRUE;
296 break;
297 }
298 }
299 enumerator->destroy(enumerator);
300 return found;
301 }
302
303 /**
304 * Send packets in the given array (they get cloned)
305 */
306 static void send_packets(private_task_manager_t *this, array_t *packets)
307 {
308 enumerator_t *enumerator;
309 packet_t *packet;
310
311 enumerator = array_create_enumerator(packets);
312 while (enumerator->enumerate(enumerator, &packet))
313 {
314 charon->sender->send(charon->sender, packet->clone(packet));
315 }
316 enumerator->destroy(enumerator);
317 }
318
319 /**
320 * Generates the given message and stores packet(s) in the given array
321 */
322 static bool generate_message(private_task_manager_t *this, message_t *message,
323 array_t **packets)
324 {
325 enumerator_t *fragments;
326 packet_t *fragment;
327
328 if (this->ike_sa->generate_message_fragmented(this->ike_sa, message,
329 &fragments) != SUCCESS)
330 {
331 return FALSE;
332 }
333 while (fragments->enumerate(fragments, &fragment))
334 {
335 array_insert_create(packets, ARRAY_TAIL, fragment);
336 }
337 fragments->destroy(fragments);
338 return TRUE;
339 }
340
341 /**
342 * Retransmit a packet (or its fragments)
343 */
344 static status_t retransmit_packet(private_task_manager_t *this, uint32_t seqnr,
345 u_int mid, u_int retransmitted, array_t *packets)
346 {
347 packet_t *packet;
348 uint32_t t;
349
350 array_get(packets, 0, &packet);
351 if (retransmitted > this->retransmit_tries)
352 {
353 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
354 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_TIMEOUT, packet);
355 return DESTROY_ME;
356 }
357 t = (uint32_t)(this->retransmit_timeout * 1000.0 *
358 pow(this->retransmit_base, retransmitted));
359 if (retransmitted)
360 {
361 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
362 retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
363 mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
364 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND, packet,
365 retransmitted);
366 }
367 send_packets(this, packets);
368 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
369 retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
370 return SUCCESS;
371 }
372
373 METHOD(task_manager_t, retransmit, status_t,
374 private_task_manager_t *this, uint32_t seqnr)
375 {
376 status_t status = SUCCESS;
377
378 if (seqnr == this->initiating.seqnr &&
379 array_count(this->initiating.packets))
380 {
381 status = retransmit_packet(this, seqnr, this->initiating.mid,
382 this->initiating.retransmitted, this->initiating.packets);
383 if (status == SUCCESS)
384 {
385 this->initiating.retransmitted++;
386 }
387 }
388 if (seqnr == this->responding.seqnr &&
389 array_count(this->responding.packets))
390 {
391 status = retransmit_packet(this, seqnr, this->responding.mid,
392 this->responding.retransmitted, this->responding.packets);
393 if (status == SUCCESS)
394 {
395 this->responding.retransmitted++;
396 }
397 }
398 return status;
399 }
400
401 /**
402 * Check if we have to wait for a mode config before starting a quick mode
403 */
404 static bool mode_config_expected(private_task_manager_t *this)
405 {
406 enumerator_t *enumerator;
407 peer_cfg_t *peer_cfg;
408 char *pool;
409 bool local;
410 host_t *host;
411
412 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
413 if (peer_cfg)
414 {
415 if (peer_cfg->use_pull_mode(peer_cfg))
416 {
417 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
418 if (!enumerator->enumerate(enumerator, &pool))
419 { /* no pool configured */
420 enumerator->destroy(enumerator);
421 return FALSE;
422 }
423 enumerator->destroy(enumerator);
424
425 local = FALSE;
426 }
427 else
428 {
429 enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
430 if (!enumerator->enumerate(enumerator, &host))
431 { /* not requesting a vip */
432 enumerator->destroy(enumerator);
433 return FALSE;
434 }
435 enumerator->destroy(enumerator);
436
437 local = TRUE;
438 }
439 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
440 local);
441 if (!enumerator->enumerate(enumerator, &host))
442 { /* expecting a VIP exchange, but no VIP assigned yet */
443 enumerator->destroy(enumerator);
444 return TRUE;
445 }
446 enumerator->destroy(enumerator);
447 }
448 return FALSE;
449 }
450
451 METHOD(task_manager_t, initiate, status_t,
452 private_task_manager_t *this)
453 {
454 enumerator_t *enumerator;
455 task_t *task;
456 message_t *message;
457 host_t *me, *other;
458 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
459 bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
460
461 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
462 this->initiating.type != INFORMATIONAL_V1)
463 {
464 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
465 exchange_type_names, this->initiating.type);
466 /* do not initiate if we already have a message in the air */
467 return SUCCESS;
468 }
469
470 if (this->active_tasks->get_count(this->active_tasks) == 0)
471 {
472 DBG2(DBG_IKE, "activating new tasks");
473 switch (this->ike_sa->get_state(this->ike_sa))
474 {
475 case IKE_CREATED:
476 activate_task(this, TASK_ISAKMP_VENDOR);
477 activate_task(this, TASK_ISAKMP_CERT_PRE);
478 if (activate_task(this, TASK_MAIN_MODE))
479 {
480 exchange = ID_PROT;
481 }
482 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
483 {
484 exchange = AGGRESSIVE;
485 }
486 activate_task(this, TASK_ISAKMP_CERT_POST);
487 activate_task(this, TASK_ISAKMP_NATD);
488 break;
489 case IKE_CONNECTING:
490 if (activate_task(this, TASK_ISAKMP_DELETE))
491 {
492 exchange = INFORMATIONAL_V1;
493 new_mid = TRUE;
494 break;
495 }
496 if (activate_task(this, TASK_XAUTH))
497 {
498 exchange = TRANSACTION;
499 new_mid = TRUE;
500 break;
501 }
502 if (activate_task(this, TASK_INFORMATIONAL))
503 {
504 exchange = INFORMATIONAL_V1;
505 new_mid = TRUE;
506 break;
507 }
508 break;
509 case IKE_ESTABLISHED:
510 if (activate_task(this, TASK_MODE_CONFIG))
511 {
512 exchange = TRANSACTION;
513 new_mid = TRUE;
514 break;
515 }
516 if (activate_task(this, TASK_QUICK_DELETE))
517 {
518 exchange = INFORMATIONAL_V1;
519 new_mid = TRUE;
520 break;
521 }
522 if (activate_task(this, TASK_ISAKMP_DELETE))
523 {
524 exchange = INFORMATIONAL_V1;
525 new_mid = TRUE;
526 break;
527 }
528 if (!mode_config_expected(this) &&
529 activate_task(this, TASK_QUICK_MODE))
530 {
531 exchange = QUICK_MODE;
532 new_mid = TRUE;
533 break;
534 }
535 if (activate_task(this, TASK_INFORMATIONAL))
536 {
537 exchange = INFORMATIONAL_V1;
538 new_mid = TRUE;
539 break;
540 }
541 if (activate_task(this, TASK_ISAKMP_DPD))
542 {
543 exchange = INFORMATIONAL_V1;
544 new_mid = TRUE;
545 break;
546 }
547 break;
548 case IKE_REKEYING:
549 if (activate_task(this, TASK_ISAKMP_DELETE))
550 {
551 exchange = INFORMATIONAL_V1;
552 new_mid = TRUE;
553 break;
554 }
555 break;
556 default:
557 break;
558 }
559 }
560 else
561 {
562 DBG2(DBG_IKE, "reinitiating already active tasks");
563 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
564 while (enumerator->enumerate(enumerator, (void**)&task))
565 {
566 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
567 switch (task->get_type(task))
568 {
569 case TASK_MAIN_MODE:
570 exchange = ID_PROT;
571 break;
572 case TASK_AGGRESSIVE_MODE:
573 exchange = AGGRESSIVE;
574 break;
575 case TASK_QUICK_MODE:
576 exchange = QUICK_MODE;
577 break;
578 case TASK_XAUTH:
579 exchange = TRANSACTION;
580 new_mid = TRUE;
581 break;
582 default:
583 continue;
584 }
585 break;
586 }
587 enumerator->destroy(enumerator);
588 }
589
590 if (exchange == EXCHANGE_TYPE_UNDEFINED)
591 {
592 DBG2(DBG_IKE, "nothing to initiate");
593 /* nothing to do yet... */
594 return SUCCESS;
595 }
596
597 me = this->ike_sa->get_my_host(this->ike_sa);
598 other = this->ike_sa->get_other_host(this->ike_sa);
599
600 if (new_mid)
601 {
602 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
603 (void*)&this->initiating.mid))
604 {
605 DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
606 flush(this);
607 return DESTROY_ME;
608 }
609 }
610 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
611 message->set_message_id(message, this->initiating.mid);
612 message->set_source(message, me->clone(me));
613 message->set_destination(message, other->clone(other));
614 message->set_exchange_type(message, exchange);
615 this->initiating.type = exchange;
616 this->initiating.retransmitted = 0;
617
618 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
619 while (enumerator->enumerate(enumerator, (void*)&task))
620 {
621 switch (task->build(task, message))
622 {
623 case SUCCESS:
624 /* task completed, remove it */
625 this->active_tasks->remove_at(this->active_tasks, enumerator);
626 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
627 task->get_type(task) == TASK_QUICK_MODE)
628 { /* last message of three message exchange */
629 keep = TRUE;
630 }
631 task->destroy(task);
632 continue;
633 case NEED_MORE:
634 expect_response = TRUE;
635 /* processed, but task needs another exchange */
636 continue;
637 case ALREADY_DONE:
638 cancelled = TRUE;
639 break;
640 case FAILED:
641 default:
642 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
643 {
644 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
645 }
646 /* FALL */
647 case DESTROY_ME:
648 /* critical failure, destroy IKE_SA */
649 enumerator->destroy(enumerator);
650 message->destroy(message);
651 flush(this);
652 return DESTROY_ME;
653 }
654 break;
655 }
656 enumerator->destroy(enumerator);
657
658 if (this->active_tasks->get_count(this->active_tasks) == 0 &&
659 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
660 { /* tasks completed, no exchange active anymore */
661 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
662 }
663 if (cancelled)
664 {
665 message->destroy(message);
666 return initiate(this);
667 }
668
669 clear_packets(this->initiating.packets);
670 if (!generate_message(this, message, &this->initiating.packets))
671 {
672 /* message generation failed. There is nothing more to do than to
673 * close the SA */
674 message->destroy(message);
675 flush(this);
676 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
677 return DESTROY_ME;
678 }
679
680 this->initiating.seqnr++;
681 if (expect_response)
682 {
683 message->destroy(message);
684 return retransmit(this, this->initiating.seqnr);
685 }
686 send_packets(this, this->initiating.packets);
687 if (!keep)
688 {
689 clear_packets(this->initiating.packets);
690 }
691 message->destroy(message);
692
693 if (exchange == INFORMATIONAL_V1)
694 {
695 switch (this->ike_sa->get_state(this->ike_sa))
696 {
697 case IKE_CONNECTING:
698 /* close after sending an INFORMATIONAL when unestablished */
699 return FAILED;
700 case IKE_DELETING:
701 /* close after sending a DELETE */
702 return DESTROY_ME;
703 default:
704 break;
705 }
706 }
707 return initiate(this);
708 }
709
710 /**
711 * build a response depending on the "passive" task list
712 */
713 static status_t build_response(private_task_manager_t *this, message_t *request)
714 {
715 enumerator_t *enumerator;
716 task_t *task;
717 message_t *message;
718 host_t *me, *other;
719 bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
720
721 me = request->get_destination(request);
722 other = request->get_source(request);
723
724 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
725 message->set_exchange_type(message, request->get_exchange_type(request));
726 /* send response along the path the request came in */
727 message->set_source(message, me->clone(me));
728 message->set_destination(message, other->clone(other));
729 message->set_message_id(message, request->get_message_id(request));
730 message->set_request(message, FALSE);
731
732 this->responding.mid = request->get_message_id(request);
733 this->responding.retransmitted = 0;
734 this->responding.seqnr++;
735
736 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
737 while (enumerator->enumerate(enumerator, (void*)&task))
738 {
739 switch (task->build(task, message))
740 {
741 case SUCCESS:
742 /* task completed, remove it */
743 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
744 task->destroy(task);
745 continue;
746 case NEED_MORE:
747 /* processed, but task needs another exchange */
748 if (task->get_type(task) == TASK_QUICK_MODE ||
749 task->get_type(task) == TASK_AGGRESSIVE_MODE)
750 { /* we rely on initiator retransmission, except for
751 * three-message exchanges */
752 expect_request = TRUE;
753 }
754 continue;
755 case ALREADY_DONE:
756 cancelled = TRUE;
757 break;
758 case INVALID_ARG:
759 if (task->get_type(task) == TASK_QUICK_MODE)
760 { /* not responsible for this exchange */
761 continue;
762 }
763 /* FALL */
764 case FAILED:
765 default:
766 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
767 /* FALL */
768 case DESTROY_ME:
769 /* destroy IKE_SA, but SEND response first */
770 delete = TRUE;
771 break;
772 }
773 break;
774 }
775 enumerator->destroy(enumerator);
776
777 clear_packets(this->responding.packets);
778 if (cancelled)
779 {
780 message->destroy(message);
781 return initiate(this);
782 }
783 if (!generate_message(this, message, &this->responding.packets))
784 {
785 message->destroy(message);
786 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
787 return DESTROY_ME;
788 }
789 message->destroy(message);
790
791 if (expect_request && !delete)
792 {
793 return retransmit(this, this->responding.seqnr);
794 }
795 send_packets(this, this->responding.packets);
796 if (delete)
797 {
798 return DESTROY_ME;
799 }
800 return SUCCESS;
801 }
802
803 /**
804 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
805 * The notify protocol_id is set to ISAKMP
806 */
807 static void send_notify(private_task_manager_t *this, message_t *request,
808 notify_type_t type)
809 {
810 message_t *response;
811 array_t *packets = NULL;
812 host_t *me, *other;
813 uint32_t mid;
814
815 if (request->get_exchange_type(request) == INFORMATIONAL_V1)
816 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
817 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
818 return;
819 }
820 if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
821 {
822 DBG1(DBG_IKE, "failed to allocate message ID");
823 return;
824 }
825 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
826 response->set_exchange_type(response, INFORMATIONAL_V1);
827 response->set_request(response, TRUE);
828 response->set_message_id(response, mid);
829 response->add_payload(response, (payload_t*)
830 notify_payload_create_from_protocol_and_type(PLV1_NOTIFY,
831 PROTO_IKE, type));
832
833 me = this->ike_sa->get_my_host(this->ike_sa);
834 if (me->is_anyaddr(me))
835 {
836 me = request->get_destination(request);
837 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
838 }
839 other = this->ike_sa->get_other_host(this->ike_sa);
840 if (other->is_anyaddr(other))
841 {
842 other = request->get_source(request);
843 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
844 }
845 response->set_source(response, me->clone(me));
846 response->set_destination(response, other->clone(other));
847 if (generate_message(this, response, &packets))
848 {
849 send_packets(this, packets);
850 }
851 clear_packets(packets);
852 array_destroy(packets);
853 response->destroy(response);
854 }
855
856 /**
857 * Process a DPD request/response
858 */
859 static bool process_dpd(private_task_manager_t *this, message_t *message)
860 {
861 notify_payload_t *notify;
862 notify_type_t type;
863 uint32_t seq;
864 chunk_t data;
865
866 type = DPD_R_U_THERE;
867 notify = message->get_notify(message, type);
868 if (!notify)
869 {
870 type = DPD_R_U_THERE_ACK;
871 notify = message->get_notify(message, type);
872 }
873 if (!notify)
874 {
875 return FALSE;
876 }
877 data = notify->get_notification_data(notify);
878 if (data.len != 4)
879 {
880 return FALSE;
881 }
882 seq = untoh32(data.ptr);
883
884 if (type == DPD_R_U_THERE)
885 {
886 if (this->dpd_recv == 0 || seq == this->dpd_recv)
887 { /* check sequence validity */
888 this->dpd_recv = seq + 1;
889 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
890 time_monotonic(NULL));
891 }
892 /* but respond anyway */
893 this->ike_sa->queue_task(this->ike_sa,
894 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
895 }
896 else /* DPD_R_U_THERE_ACK */
897 {
898 if (seq == this->dpd_send - 1)
899 {
900 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
901 time_monotonic(NULL));
902 }
903 else
904 {
905 DBG1(DBG_IKE, "received invalid DPD sequence number %u "
906 "(expected %u), ignored", seq, this->dpd_send - 1);
907 }
908 }
909 return TRUE;
910 }
911
912 /**
913 * Check if we already have a quick mode task queued for the exchange with the
914 * given message ID
915 */
916 static bool have_quick_mode_task(private_task_manager_t *this, uint32_t mid)
917 {
918 enumerator_t *enumerator;
919 quick_mode_t *qm;
920 task_t *task;
921 bool found = FALSE;
922
923 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
924 while (enumerator->enumerate(enumerator, &task))
925 {
926 if (task->get_type(task) == TASK_QUICK_MODE)
927 {
928 qm = (quick_mode_t*)task;
929 if (qm->get_mid(qm) == mid)
930 {
931 found = TRUE;
932 break;
933 }
934 }
935 }
936 enumerator->destroy(enumerator);
937 return found;
938 }
939
940 /**
941 * Check if we still have a specific task queued
942 */
943 static bool have_task_queued(private_task_manager_t *this, task_type_t type)
944 {
945 enumerator_t *enumerator;
946 task_t *task;
947 bool found = FALSE;
948
949 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
950 while (enumerator->enumerate(enumerator, &task))
951 {
952 if (task->get_type(task) == type)
953 {
954 found = TRUE;
955 break;
956 }
957 }
958 enumerator->destroy(enumerator);
959 return found;
960 }
961
962 /**
963 * handle an incoming request message
964 */
965 static status_t process_request(private_task_manager_t *this,
966 message_t *message)
967 {
968 enumerator_t *enumerator;
969 task_t *task = NULL;
970 bool send_response = FALSE, dpd = FALSE;
971
972 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
973 message->get_exchange_type(message) == QUICK_MODE ||
974 this->passive_tasks->get_count(this->passive_tasks) == 0)
975 { /* create tasks depending on request type, if not already some queued */
976 switch (message->get_exchange_type(message))
977 {
978 case ID_PROT:
979 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
980 this->passive_tasks->insert_last(this->passive_tasks, task);
981 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
982 this->passive_tasks->insert_last(this->passive_tasks, task);
983 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
984 this->passive_tasks->insert_last(this->passive_tasks, task);
985 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
986 this->passive_tasks->insert_last(this->passive_tasks, task);
987 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
988 this->passive_tasks->insert_last(this->passive_tasks, task);
989 break;
990 case AGGRESSIVE:
991 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
992 this->passive_tasks->insert_last(this->passive_tasks, task);
993 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
994 this->passive_tasks->insert_last(this->passive_tasks, task);
995 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
996 this->passive_tasks->insert_last(this->passive_tasks, task);
997 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
998 this->passive_tasks->insert_last(this->passive_tasks, task);
999 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
1000 this->passive_tasks->insert_last(this->passive_tasks, task);
1001 break;
1002 case QUICK_MODE:
1003 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1004 {
1005 DBG1(DBG_IKE, "received quick mode request for "
1006 "unestablished IKE_SA, ignored");
1007 return FAILED;
1008 }
1009 if (have_quick_mode_task(this, message->get_message_id(message)))
1010 {
1011 break;
1012 }
1013 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
1014 NULL, NULL);
1015 this->passive_tasks->insert_last(this->passive_tasks, task);
1016 break;
1017 case INFORMATIONAL_V1:
1018 if (process_dpd(this, message))
1019 {
1020 dpd = TRUE;
1021 }
1022 else
1023 {
1024 task = (task_t *)informational_create(this->ike_sa, NULL);
1025 this->passive_tasks->insert_first(this->passive_tasks, task);
1026 }
1027 break;
1028 case TRANSACTION:
1029 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
1030 {
1031 task = (task_t *)mode_config_create(this->ike_sa,
1032 FALSE, TRUE);
1033 }
1034 else
1035 {
1036 task = (task_t *)xauth_create(this->ike_sa, FALSE);
1037 }
1038 this->passive_tasks->insert_last(this->passive_tasks, task);
1039 break;
1040 default:
1041 return FAILED;
1042 }
1043 }
1044 if (dpd)
1045 {
1046 return initiate(this);
1047 }
1048 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
1049
1050 /* let the tasks process the message */
1051 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
1052 while (enumerator->enumerate(enumerator, (void*)&task))
1053 {
1054 switch (task->process(task, message))
1055 {
1056 case SUCCESS:
1057 /* task completed, remove it */
1058 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1059 task->destroy(task);
1060 continue;
1061 case NEED_MORE:
1062 /* processed, but task needs at least another call to build() */
1063 send_response = TRUE;
1064 continue;
1065 case ALREADY_DONE:
1066 send_response = FALSE;
1067 break;
1068 case INVALID_ARG:
1069 if (task->get_type(task) == TASK_QUICK_MODE)
1070 { /* not responsible for this exchange */
1071 continue;
1072 }
1073 /* FALL */
1074 case FAILED:
1075 default:
1076 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1077 /* FALL */
1078 case DESTROY_ME:
1079 /* critical failure, destroy IKE_SA */
1080 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1081 enumerator->destroy(enumerator);
1082 task->destroy(task);
1083 return DESTROY_ME;
1084 }
1085 break;
1086 }
1087 enumerator->destroy(enumerator);
1088
1089 if (send_response)
1090 {
1091 if (build_response(this, message) != SUCCESS)
1092 {
1093 return DESTROY_ME;
1094 }
1095 }
1096 else
1097 { /* We don't send a response, so don't retransmit one if we get
1098 * the same message again. */
1099 clear_packets(this->responding.packets);
1100 }
1101 if (this->queued &&
1102 this->queued->get_exchange_type(this->queued) == INFORMATIONAL_V1)
1103 {
1104 message_t *queued;
1105 status_t status;
1106
1107 queued = this->queued;
1108 this->queued = NULL;
1109 status = this->public.task_manager.process_message(
1110 &this->public.task_manager, queued);
1111 queued->destroy(queued);
1112 if (status == DESTROY_ME)
1113 {
1114 return status;
1115 }
1116 }
1117 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
1118 this->queued_tasks->get_count(this->queued_tasks) > 0)
1119 {
1120 /* passive tasks completed, check if an active task has been queued,
1121 * such as XAUTH or modeconfig push */
1122 return initiate(this);
1123 }
1124 return SUCCESS;
1125 }
1126
1127 /**
1128 * handle an incoming response message
1129 */
1130 static status_t process_response(private_task_manager_t *this,
1131 message_t *message)
1132 {
1133 enumerator_t *enumerator;
1134 message_t *queued;
1135 status_t status;
1136 task_t *task;
1137
1138 if (message->get_exchange_type(message) != this->initiating.type)
1139 {
1140 /* Windows server sends a fourth quick mode message having an initial
1141 * contact notify. Ignore this message for compatibility. */
1142 if (this->initiating.type == EXCHANGE_TYPE_UNDEFINED &&
1143 message->get_exchange_type(message) == QUICK_MODE &&
1144 message->get_notify(message, INITIAL_CONTACT))
1145 {
1146 DBG1(DBG_IKE, "ignoring fourth Quick Mode message");
1147 return SUCCESS;
1148 }
1149 DBG1(DBG_IKE, "received %N response, but expected %N",
1150 exchange_type_names, message->get_exchange_type(message),
1151 exchange_type_names, this->initiating.type);
1152 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1153 return DESTROY_ME;
1154 }
1155
1156 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
1157 while (enumerator->enumerate(enumerator, (void*)&task))
1158 {
1159 switch (task->process(task, message))
1160 {
1161 case SUCCESS:
1162 /* task completed, remove it */
1163 this->active_tasks->remove_at(this->active_tasks, enumerator);
1164 task->destroy(task);
1165 continue;
1166 case NEED_MORE:
1167 /* processed, but task needs another exchange */
1168 continue;
1169 case ALREADY_DONE:
1170 break;
1171 case FAILED:
1172 default:
1173 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1174 /* FALL */
1175 case DESTROY_ME:
1176 /* critical failure, destroy IKE_SA */
1177 this->active_tasks->remove_at(this->active_tasks, enumerator);
1178 enumerator->destroy(enumerator);
1179 task->destroy(task);
1180 return DESTROY_ME;
1181 }
1182 break;
1183 }
1184 enumerator->destroy(enumerator);
1185
1186 if (this->initiating.retransmitted > 1)
1187 {
1188 packet_t *packet = NULL;
1189 array_get(this->initiating.packets, 0, &packet);
1190 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_CLEARED, packet);
1191 }
1192 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1193 clear_packets(this->initiating.packets);
1194
1195 if (this->queued && !this->active_tasks->get_count(this->active_tasks) &&
1196 this->queued->get_exchange_type(this->queued) == TRANSACTION)
1197 {
1198 queued = this->queued;
1199 this->queued = NULL;
1200 status = this->public.task_manager.process_message(
1201 &this->public.task_manager, queued);
1202 queued->destroy(queued);
1203 if (status == DESTROY_ME)
1204 {
1205 return status;
1206 }
1207 }
1208
1209 return initiate(this);
1210 }
1211
1212 static status_t handle_fragment(private_task_manager_t *this, message_t *msg)
1213 {
1214 status_t status;
1215
1216 if (!this->defrag)
1217 {
1218 this->defrag = message_create_defrag(msg);
1219 if (!this->defrag)
1220 {
1221 return FAILED;
1222 }
1223 }
1224 status = this->defrag->add_fragment(this->defrag, msg);
1225 if (status == SUCCESS)
1226 {
1227 lib->processor->queue_job(lib->processor,
1228 (job_t*)process_message_job_create(this->defrag));
1229 this->defrag = NULL;
1230 /* do not process the last fragment */
1231 status = NEED_MORE;
1232 }
1233 return status;
1234 }
1235
1236 /**
1237 * Parse the given message and verify that it is valid.
1238 */
1239 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1240 {
1241 status_t status;
1242
1243 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1244
1245 if (status != SUCCESS)
1246 {
1247 switch (status)
1248 {
1249 case NOT_SUPPORTED:
1250 DBG1(DBG_IKE, "unsupported exchange type");
1251 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1252 break;
1253 case PARSE_ERROR:
1254 DBG1(DBG_IKE, "message parsing failed");
1255 send_notify(this, msg, PAYLOAD_MALFORMED);
1256 break;
1257 case VERIFY_ERROR:
1258 DBG1(DBG_IKE, "message verification failed");
1259 send_notify(this, msg, PAYLOAD_MALFORMED);
1260 break;
1261 case FAILED:
1262 DBG1(DBG_IKE, "integrity check failed");
1263 send_notify(this, msg, INVALID_HASH_INFORMATION);
1264 break;
1265 case INVALID_STATE:
1266 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1267 send_notify(this, msg, PAYLOAD_MALFORMED);
1268 default:
1269 break;
1270 }
1271 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1272 exchange_type_names, msg->get_exchange_type(msg),
1273 msg->get_request(msg) ? "request" : "response",
1274 msg->get_message_id(msg));
1275
1276 charon->bus->alert(charon->bus, ALERT_PARSE_ERROR_BODY, msg, status);
1277
1278 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1279 { /* invalid initiation attempt, close SA */
1280 return DESTROY_ME;
1281 }
1282 }
1283
1284 if (msg->get_first_payload_type(msg) == PLV1_FRAGMENT)
1285 {
1286 return handle_fragment(this, msg);
1287 }
1288 return status;
1289 }
1290
1291 /**
1292 * Queue the given message if possible
1293 */
1294 static status_t queue_message(private_task_manager_t *this, message_t *msg)
1295 {
1296 if (this->queued)
1297 {
1298 DBG1(DBG_IKE, "ignoring %N request, queue full",
1299 exchange_type_names, msg->get_exchange_type(msg));
1300 return FAILED;
1301 }
1302 this->queued = message_create_from_packet(msg->get_packet(msg));
1303 if (this->queued->parse_header(this->queued) != SUCCESS)
1304 {
1305 this->queued->destroy(this->queued);
1306 this->queued = NULL;
1307 return FAILED;
1308 }
1309 DBG1(DBG_IKE, "queueing %N request as tasks still active",
1310 exchange_type_names, msg->get_exchange_type(msg));
1311 return SUCCESS;
1312 }
1313
1314 METHOD(task_manager_t, process_message, status_t,
1315 private_task_manager_t *this, message_t *msg)
1316 {
1317 uint32_t hash, mid, i;
1318 host_t *me, *other;
1319 status_t status;
1320
1321 /* TODO-IKEv1: update hosts more selectively */
1322 me = msg->get_destination(msg);
1323 other = msg->get_source(msg);
1324 mid = msg->get_message_id(msg);
1325 hash = chunk_hash(msg->get_packet_data(msg));
1326 for (i = 0; i < MAX_OLD_HASHES; i++)
1327 {
1328 if (this->initiating.old_hashes[i] == hash)
1329 {
1330 if (array_count(this->initiating.packets) &&
1331 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1332 (msg->get_exchange_type(msg) == QUICK_MODE ||
1333 msg->get_exchange_type(msg) == AGGRESSIVE))
1334 {
1335 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1336 "resending last request", mid);
1337 send_packets(this, this->initiating.packets);
1338 return SUCCESS;
1339 }
1340 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1341 "but next request already sent", mid);
1342 return SUCCESS;
1343 }
1344 }
1345
1346 if ((mid && mid == this->initiating.mid) ||
1347 (this->initiating.mid == 0 &&
1348 msg->get_exchange_type(msg) == this->initiating.type &&
1349 this->active_tasks->get_count(this->active_tasks)))
1350 {
1351 msg->set_request(msg, FALSE);
1352 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1353 status = parse_message(this, msg);
1354 if (status == NEED_MORE)
1355 {
1356 return SUCCESS;
1357 }
1358 if (status != SUCCESS)
1359 {
1360 return status;
1361 }
1362 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1363 time_monotonic(NULL));
1364 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1365 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1366 if (process_response(this, msg) != SUCCESS)
1367 {
1368 flush(this);
1369 return DESTROY_ME;
1370 }
1371 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1372 MAX_OLD_HASHES] = hash;
1373 }
1374 else
1375 {
1376 if (hash == this->responding.hash)
1377 {
1378 if (array_count(this->responding.packets))
1379 {
1380 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1381 "retransmitting response", mid);
1382 send_packets(this, this->responding.packets);
1383 }
1384 else if (array_count(this->initiating.packets) &&
1385 this->initiating.type == INFORMATIONAL_V1)
1386 {
1387 DBG1(DBG_IKE, "received retransmit of DPD request, "
1388 "retransmitting response");
1389 send_packets(this, this->initiating.packets);
1390 }
1391 else
1392 {
1393 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1394 "but no response to retransmit", mid);
1395 }
1396 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_RECEIVE, msg);
1397 return SUCCESS;
1398 }
1399
1400 /* reject Main/Aggressive Modes once established */
1401 if (msg->get_exchange_type(msg) == ID_PROT ||
1402 msg->get_exchange_type(msg) == AGGRESSIVE)
1403 {
1404 if (this->ike_sa->get_state(this->ike_sa) != IKE_CREATED &&
1405 this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING &&
1406 msg->get_first_payload_type(msg) != PLV1_FRAGMENT)
1407 {
1408 DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
1409 exchange_type_names, msg->get_exchange_type(msg));
1410 return FAILED;
1411 }
1412 }
1413
1414 /* drop XAuth/Mode Config/Quick Mode messages until we received the last
1415 * Aggressive Mode message. since Informational messages are not
1416 * retransmitted we queue them. */
1417 if (have_task_queued(this, TASK_AGGRESSIVE_MODE))
1418 {
1419 if (msg->get_exchange_type(msg) == INFORMATIONAL_V1)
1420 {
1421 return queue_message(this, msg);
1422 }
1423 else if (msg->get_exchange_type(msg) != AGGRESSIVE)
1424 {
1425 DBG1(DBG_IKE, "ignoring %N request while phase 1 is incomplete",
1426 exchange_type_names, msg->get_exchange_type(msg));
1427 return FAILED;
1428 }
1429 }
1430
1431 /* queue XAuth/Mode Config messages unless the Main Mode exchange we
1432 * initiated is complete */
1433 if (msg->get_exchange_type(msg) == TRANSACTION &&
1434 this->active_tasks->get_count(this->active_tasks))
1435 {
1436 return queue_message(this, msg);
1437 }
1438
1439 /* some peers send INITIAL_CONTACT notifies during XAuth, cache it */
1440 if (have_task_queued(this, TASK_XAUTH) &&
1441 msg->get_exchange_type(msg) == INFORMATIONAL_V1)
1442 {
1443 return queue_message(this, msg);
1444 }
1445
1446 msg->set_request(msg, TRUE);
1447 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1448 status = parse_message(this, msg);
1449 if (status == NEED_MORE)
1450 {
1451 return SUCCESS;
1452 }
1453 if (status != SUCCESS)
1454 {
1455 return status;
1456 }
1457 /* if this IKE_SA is virgin, we check for a config */
1458 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1459 {
1460 ike_sa_id_t *ike_sa_id;
1461 ike_cfg_t *ike_cfg;
1462 job_t *job;
1463
1464 ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1465 me, other, IKEV1);
1466 if (ike_cfg == NULL)
1467 {
1468 /* no config found for these hosts, destroy */
1469 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1470 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1471 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1472 return DESTROY_ME;
1473 }
1474 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1475 ike_cfg->destroy(ike_cfg);
1476 /* add a timeout if peer does not establish it completely */
1477 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1478 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1479 lib->scheduler->schedule_job(lib->scheduler, job,
1480 lib->settings->get_int(lib->settings,
1481 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1482 lib->ns));
1483 }
1484 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1485 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1486 if (process_request(this, msg) != SUCCESS)
1487 {
1488 flush(this);
1489 return DESTROY_ME;
1490 }
1491 this->responding.hash = hash;
1492 }
1493 return SUCCESS;
1494 }
1495
1496 /**
1497 * Check if a given task has been queued already
1498 */
1499 static bool has_queued(private_task_manager_t *this, task_type_t type)
1500 {
1501 enumerator_t *enumerator;
1502 bool found = FALSE;
1503 task_t *task;
1504
1505 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1506 while (enumerator->enumerate(enumerator, &task))
1507 {
1508 if (task->get_type(task) == type)
1509 {
1510 found = TRUE;
1511 break;
1512 }
1513 }
1514 enumerator->destroy(enumerator);
1515 return found;
1516 }
1517
1518 METHOD(task_manager_t, queue_task_delayed, void,
1519 private_task_manager_t *this, task_t *task, uint32_t delay)
1520 {
1521 task_type_t type = task->get_type(task);
1522
1523 switch (type)
1524 {
1525 case TASK_MODE_CONFIG:
1526 case TASK_XAUTH:
1527 if (has_queued(this, type))
1528 {
1529 task->destroy(task);
1530 return;
1531 }
1532 break;
1533 default:
1534 break;
1535 }
1536 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1537 this->queued_tasks->insert_last(this->queued_tasks, task);
1538 }
1539
1540 METHOD(task_manager_t, queue_task, void,
1541 private_task_manager_t *this, task_t *task)
1542 {
1543 queue_task_delayed(this, task, 0);
1544 }
1545
1546 METHOD(task_manager_t, queue_ike, void,
1547 private_task_manager_t *this)
1548 {
1549 peer_cfg_t *peer_cfg;
1550
1551 if (!has_queued(this, TASK_ISAKMP_VENDOR))
1552 {
1553 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1554 }
1555 if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1556 {
1557 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1558 }
1559 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1560 if (peer_cfg->use_aggressive(peer_cfg))
1561 {
1562 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1563 {
1564 queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1565 }
1566 }
1567 else
1568 {
1569 if (!has_queued(this, TASK_MAIN_MODE))
1570 {
1571 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1572 }
1573 }
1574 if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1575 {
1576 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1577 }
1578 if (!has_queued(this, TASK_ISAKMP_NATD))
1579 {
1580 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1581 }
1582 }
1583
1584 METHOD(task_manager_t, queue_ike_reauth, void,
1585 private_task_manager_t *this)
1586 {
1587 enumerator_t *enumerator;
1588 child_sa_t *child_sa;
1589 ike_sa_t *new;
1590 host_t *host;
1591
1592 new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1593 this->ike_sa->get_version(this->ike_sa), TRUE);
1594 if (!new)
1595 { /* shouldn't happen */
1596 return;
1597 }
1598
1599 new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1600 host = this->ike_sa->get_other_host(this->ike_sa);
1601 new->set_other_host(new, host->clone(host));
1602 host = this->ike_sa->get_my_host(this->ike_sa);
1603 new->set_my_host(new, host->clone(host));
1604 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1605 while (enumerator->enumerate(enumerator, &host))
1606 {
1607 new->add_virtual_ip(new, TRUE, host);
1608 }
1609 enumerator->destroy(enumerator);
1610
1611 charon->bus->children_migrate(charon->bus, new->get_id(new),
1612 new->get_unique_id(new));
1613 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1614 while (enumerator->enumerate(enumerator, &child_sa))
1615 {
1616 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1617 new->add_child_sa(new, child_sa);
1618 }
1619 enumerator->destroy(enumerator);
1620 charon->bus->set_sa(charon->bus, new);
1621 charon->bus->children_migrate(charon->bus, NULL, 0);
1622 charon->bus->set_sa(charon->bus, this->ike_sa);
1623
1624 if (!new->get_child_count(new))
1625 { /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1626 task_t *task;
1627
1628 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1629 while (enumerator->enumerate(enumerator, &task))
1630 {
1631 if (task->get_type(task) == TASK_QUICK_MODE)
1632 {
1633 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1634 task->migrate(task, new);
1635 new->queue_task(new, task);
1636 }
1637 }
1638 enumerator->destroy(enumerator);
1639 }
1640
1641 if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1642 {
1643 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1644 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1645 }
1646 else
1647 {
1648 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1649 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1650 }
1651 charon->bus->set_sa(charon->bus, this->ike_sa);
1652 }
1653
1654 METHOD(task_manager_t, queue_ike_rekey, void,
1655 private_task_manager_t *this)
1656 {
1657 queue_ike_reauth(this);
1658 }
1659
1660 METHOD(task_manager_t, queue_ike_delete, void,
1661 private_task_manager_t *this)
1662 {
1663 enumerator_t *enumerator;
1664 child_sa_t *child_sa;
1665
1666 /* cancel any currently active task to get the DELETE done quickly */
1667 flush_queue(this, TASK_QUEUE_ACTIVE);
1668
1669 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1670 while (enumerator->enumerate(enumerator, &child_sa))
1671 {
1672 queue_task(this, (task_t*)
1673 quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1674 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1675 }
1676 enumerator->destroy(enumerator);
1677
1678 queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1679 }
1680
1681 METHOD(task_manager_t, queue_mobike, void,
1682 private_task_manager_t *this, bool roam, bool address)
1683 {
1684 /* Not supported in IKEv1 */
1685 }
1686
1687 METHOD(task_manager_t, queue_child, void,
1688 private_task_manager_t *this, child_cfg_t *cfg, uint32_t reqid,
1689 traffic_selector_t *tsi, traffic_selector_t *tsr)
1690 {
1691 quick_mode_t *task;
1692
1693 task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1694 task->use_reqid(task, reqid);
1695
1696 queue_task(this, &task->task);
1697 }
1698
1699 /**
1700 * Check if two CHILD_SAs have the same traffic selector
1701 */
1702 static bool have_equal_ts(child_sa_t *child1, child_sa_t *child2, bool local)
1703 {
1704 enumerator_t *e1, *e2;
1705 traffic_selector_t *ts1, *ts2;
1706 bool equal = FALSE;
1707
1708 e1 = child1->create_ts_enumerator(child1, local);
1709 e2 = child2->create_ts_enumerator(child2, local);
1710 if (e1->enumerate(e1, &ts1) && e2->enumerate(e2, &ts2))
1711 {
1712 equal = ts1->equals(ts1, ts2);
1713 }
1714 e2->destroy(e2);
1715 e1->destroy(e1);
1716
1717 return equal;
1718 }
1719
1720 /**
1721 * Check if a CHILD_SA is redundant and we should delete instead of rekey
1722 */
1723 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1724 {
1725 enumerator_t *enumerator;
1726 child_sa_t *current;
1727 bool redundant = FALSE;
1728
1729 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1730 while (enumerator->enumerate(enumerator, &current))
1731 {
1732 if (current->get_state(current) == CHILD_INSTALLED &&
1733 streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1734 have_equal_ts(current, child_sa, TRUE) &&
1735 have_equal_ts(current, child_sa, FALSE) &&
1736 current->get_lifetime(current, FALSE) >
1737 child_sa->get_lifetime(child_sa, FALSE))
1738 {
1739 DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1740 child_sa->get_name(child_sa),
1741 child_sa->get_unique_id(child_sa));
1742 redundant = TRUE;
1743 break;
1744 }
1745 }
1746 enumerator->destroy(enumerator);
1747
1748 return redundant;
1749 }
1750
1751 /**
1752 * Get the first traffic selector of a CHILD_SA, local or remote
1753 */
1754 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1755 {
1756 traffic_selector_t *ts = NULL;
1757 enumerator_t *enumerator;
1758
1759 enumerator = child_sa->create_ts_enumerator(child_sa, local);
1760 enumerator->enumerate(enumerator, &ts);
1761 enumerator->destroy(enumerator);
1762
1763 return ts;
1764 }
1765
1766 METHOD(task_manager_t, queue_child_rekey, void,
1767 private_task_manager_t *this, protocol_id_t protocol, uint32_t spi)
1768 {
1769 child_sa_t *child_sa;
1770 child_cfg_t *cfg;
1771 quick_mode_t *task;
1772
1773 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1774 if (!child_sa)
1775 {
1776 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1777 }
1778 if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1779 {
1780 if (is_redundant(this, child_sa))
1781 {
1782 child_sa->set_state(child_sa, CHILD_REKEYED);
1783 queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1784 protocol, spi, FALSE, FALSE));
1785 }
1786 else
1787 {
1788 child_sa->set_state(child_sa, CHILD_REKEYING);
1789 cfg = child_sa->get_config(child_sa);
1790 task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1791 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1792 task->use_reqid(task, child_sa->get_reqid(child_sa));
1793 task->use_marks(task, child_sa->get_mark(child_sa, TRUE).value,
1794 child_sa->get_mark(child_sa, FALSE).value);
1795 task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1796
1797 queue_task(this, &task->task);
1798 }
1799 }
1800 }
1801
1802 METHOD(task_manager_t, queue_child_delete, void,
1803 private_task_manager_t *this, protocol_id_t protocol, uint32_t spi,
1804 bool expired)
1805 {
1806 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1807 spi, FALSE, expired));
1808 }
1809
1810 METHOD(task_manager_t, queue_dpd, void,
1811 private_task_manager_t *this)
1812 {
1813 peer_cfg_t *peer_cfg;
1814 uint32_t t, retransmit;
1815
1816 queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1817 this->dpd_send++));
1818 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1819
1820 /* compute timeout in milliseconds */
1821 t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1822 if (t == 0)
1823 {
1824 /* use the same timeout as a retransmitting IKE message would have */
1825 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1826 {
1827 t += (uint32_t)(this->retransmit_timeout * 1000.0 *
1828 pow(this->retransmit_base, retransmit));
1829 }
1830 }
1831 /* compensate for the already elapsed dpd delay */
1832 t -= 1000 * peer_cfg->get_dpd(peer_cfg);
1833
1834 /* schedule DPD timeout job */
1835 lib->scheduler->schedule_job_ms(lib->scheduler,
1836 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1837 }
1838
1839 METHOD(task_manager_t, adopt_tasks, void,
1840 private_task_manager_t *this, task_manager_t *other_public)
1841 {
1842 private_task_manager_t *other = (private_task_manager_t*)other_public;
1843 task_t *task;
1844
1845 /* move queued tasks from other to this */
1846 while (other->queued_tasks->remove_last(other->queued_tasks,
1847 (void**)&task) == SUCCESS)
1848 {
1849 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1850 task->migrate(task, this->ike_sa);
1851 this->queued_tasks->insert_first(this->queued_tasks, task);
1852 }
1853 }
1854
1855 /**
1856 * Migrates child-creating tasks from src to dst
1857 */
1858 static void migrate_child_tasks(private_task_manager_t *this,
1859 linked_list_t *src, linked_list_t *dst)
1860 {
1861 enumerator_t *enumerator;
1862 task_t *task;
1863
1864 enumerator = src->create_enumerator(src);
1865 while (enumerator->enumerate(enumerator, &task))
1866 {
1867 if (task->get_type(task) == TASK_QUICK_MODE)
1868 {
1869 src->remove_at(src, enumerator);
1870 task->migrate(task, this->ike_sa);
1871 dst->insert_last(dst, task);
1872 }
1873 }
1874 enumerator->destroy(enumerator);
1875 }
1876
1877 METHOD(task_manager_t, adopt_child_tasks, void,
1878 private_task_manager_t *this, task_manager_t *other_public)
1879 {
1880 private_task_manager_t *other = (private_task_manager_t*)other_public;
1881
1882 /* move active child tasks from other to this */
1883 migrate_child_tasks(this, other->active_tasks, this->queued_tasks);
1884 /* do the same for queued tasks */
1885 migrate_child_tasks(this, other->queued_tasks, this->queued_tasks);
1886 }
1887
1888 METHOD(task_manager_t, busy, bool,
1889 private_task_manager_t *this)
1890 {
1891 return (this->active_tasks->get_count(this->active_tasks) > 0);
1892 }
1893
1894 METHOD(task_manager_t, incr_mid, void,
1895 private_task_manager_t *this, bool initiate)
1896 {
1897 }
1898
1899 METHOD(task_manager_t, reset, void,
1900 private_task_manager_t *this, uint32_t initiate, uint32_t respond)
1901 {
1902 enumerator_t *enumerator;
1903 task_t *task;
1904
1905 /* reset message counters and retransmit packets */
1906 clear_packets(this->responding.packets);
1907 clear_packets(this->initiating.packets);
1908 this->responding.seqnr = RESPONDING_SEQ;
1909 this->responding.retransmitted = 0;
1910 this->initiating.mid = 0;
1911 this->initiating.seqnr = 0;
1912 this->initiating.retransmitted = 0;
1913 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1914 DESTROY_IF(this->defrag);
1915 this->defrag = NULL;
1916 if (initiate != UINT_MAX)
1917 {
1918 this->dpd_send = initiate;
1919 }
1920 if (respond != UINT_MAX)
1921 {
1922 this->dpd_recv = respond;
1923 }
1924
1925 /* reset queued tasks */
1926 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1927 while (enumerator->enumerate(enumerator, &task))
1928 {
1929 task->migrate(task, this->ike_sa);
1930 }
1931 enumerator->destroy(enumerator);
1932
1933 /* reset active tasks */
1934 while (this->active_tasks->remove_last(this->active_tasks,
1935 (void**)&task) == SUCCESS)
1936 {
1937 task->migrate(task, this->ike_sa);
1938 this->queued_tasks->insert_first(this->queued_tasks, task);
1939 }
1940 }
1941
1942 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1943 private_task_manager_t *this, task_queue_t queue)
1944 {
1945 switch (queue)
1946 {
1947 case TASK_QUEUE_ACTIVE:
1948 return this->active_tasks->create_enumerator(this->active_tasks);
1949 case TASK_QUEUE_PASSIVE:
1950 return this->passive_tasks->create_enumerator(this->passive_tasks);
1951 case TASK_QUEUE_QUEUED:
1952 return this->queued_tasks->create_enumerator(this->queued_tasks);
1953 default:
1954 return enumerator_create_empty();
1955 }
1956 }
1957
1958 METHOD(task_manager_t, destroy, void,
1959 private_task_manager_t *this)
1960 {
1961 flush(this);
1962
1963 this->active_tasks->destroy(this->active_tasks);
1964 this->queued_tasks->destroy(this->queued_tasks);
1965 this->passive_tasks->destroy(this->passive_tasks);
1966 DESTROY_IF(this->defrag);
1967
1968 DESTROY_IF(this->queued);
1969 clear_packets(this->responding.packets);
1970 array_destroy(this->responding.packets);
1971 clear_packets(this->initiating.packets);
1972 array_destroy(this->initiating.packets);
1973 DESTROY_IF(this->rng);
1974 free(this);
1975 }
1976
1977 /*
1978 * see header file
1979 */
1980 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1981 {
1982 private_task_manager_t *this;
1983
1984 INIT(this,
1985 .public = {
1986 .task_manager = {
1987 .process_message = _process_message,
1988 .queue_task = _queue_task,
1989 .queue_task_delayed = _queue_task_delayed,
1990 .queue_ike = _queue_ike,
1991 .queue_ike_rekey = _queue_ike_rekey,
1992 .queue_ike_reauth = _queue_ike_reauth,
1993 .queue_ike_delete = _queue_ike_delete,
1994 .queue_mobike = _queue_mobike,
1995 .queue_child = _queue_child,
1996 .queue_child_rekey = _queue_child_rekey,
1997 .queue_child_delete = _queue_child_delete,
1998 .queue_dpd = _queue_dpd,
1999 .initiate = _initiate,
2000 .retransmit = _retransmit,
2001 .incr_mid = _incr_mid,
2002 .reset = _reset,
2003 .adopt_tasks = _adopt_tasks,
2004 .adopt_child_tasks = _adopt_child_tasks,
2005 .busy = _busy,
2006 .create_task_enumerator = _create_task_enumerator,
2007 .flush = _flush,
2008 .flush_queue = _flush_queue,
2009 .destroy = _destroy,
2010 },
2011 },
2012 .initiating = {
2013 .type = EXCHANGE_TYPE_UNDEFINED,
2014 },
2015 .responding = {
2016 .seqnr = RESPONDING_SEQ,
2017 },
2018 .ike_sa = ike_sa,
2019 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
2020 .queued_tasks = linked_list_create(),
2021 .active_tasks = linked_list_create(),
2022 .passive_tasks = linked_list_create(),
2023 .retransmit_tries = lib->settings->get_int(lib->settings,
2024 "%s.retransmit_tries", RETRANSMIT_TRIES, lib->ns),
2025 .retransmit_timeout = lib->settings->get_double(lib->settings,
2026 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, lib->ns),
2027 .retransmit_base = lib->settings->get_double(lib->settings,
2028 "%s.retransmit_base", RETRANSMIT_BASE, lib->ns),
2029 );
2030
2031 if (!this->rng)
2032 {
2033 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
2034 destroy(this);
2035 return NULL;
2036 }
2037 if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
2038 (void*)&this->dpd_send))
2039 {
2040 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
2041 destroy(this);
2042 return NULL;
2043 }
2044 this->dpd_send &= 0x7FFFFFFF;
2045
2046 return &this->public;
2047 }
Unnamed repository; edit this file 'description' to name the repository.