src/libcharon/sa/ikev1/task_manager_v1.c

   1 /*
   2  * Copyright (C) 2007-2014 Tobias Brunner
   3  * Copyright (C) 2007-2011 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include "task_manager_v1.h"
  18
  19 #include <math.h>
  20
  21 #include <daemon.h>
  22 #include <sa/ikev1/tasks/main_mode.h>
  23 #include <sa/ikev1/tasks/aggressive_mode.h>
  24 #include <sa/ikev1/tasks/quick_mode.h>
  25 #include <sa/ikev1/tasks/quick_delete.h>
  26 #include <sa/ikev1/tasks/xauth.h>
  27 #include <sa/ikev1/tasks/mode_config.h>
  28 #include <sa/ikev1/tasks/informational.h>
  29 #include <sa/ikev1/tasks/isakmp_natd.h>
  30 #include <sa/ikev1/tasks/isakmp_vendor.h>
  31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
  32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
  33 #include <sa/ikev1/tasks/isakmp_delete.h>
  34 #include <sa/ikev1/tasks/isakmp_dpd.h>
  35
  36 #include <processing/jobs/retransmit_job.h>
  37 #include <processing/jobs/delete_ike_sa_job.h>
  38 #include <processing/jobs/dpd_timeout_job.h>
  39 #include <processing/jobs/process_message_job.h>
  40
  41 #include <collections/array.h>
  42
  43 /**
  44  * Number of old messages hashes we keep for retransmission.
  45  *
  46  * In Main Mode, we must ignore messages from a previous message pair if
  47  * we already continued to the next. Otherwise a late retransmission
  48  * could be considered as a reply to the newer request.
  49  */
  50 #define MAX_OLD_HASHES 2
  51
  52 /**
  53  * First sequence number of responding packets.
  54  *
  55  * To distinguish retransmission jobs for initiating and responding packets,
  56  * we split up the sequence counter and use the upper half for responding.
  57  */
  58 #define RESPONDING_SEQ INT_MAX
  59
  60 typedef struct exchange_t exchange_t;
  61
  62 /**
  63  * An exchange in the air, used do detect and handle retransmission
  64  */
  65 struct exchange_t {
  66
  67         /**
  68          * Message ID used for this transaction
  69          */
  70         u_int32_t mid;
  71
  72         /**
  73          * generated packet for retransmission
  74          */
  75         packet_t *packet;
  76 };
  77
  78 typedef struct private_task_manager_t private_task_manager_t;
  79
  80 /**
  81  * private data of the task manager
  82  */
  83 struct private_task_manager_t {
  84
  85         /**
  86          * public functions
  87          */
  88         task_manager_v1_t public;
  89
  90         /**
  91          * associated IKE_SA we are serving
  92          */
  93         ike_sa_t *ike_sa;
  94
  95         /**
  96          * RNG to create message IDs
  97          */
  98         rng_t *rng;
  99
 100         /**
 101          * Exchange we are currently handling as responder
 102          */
 103         struct {
 104                 /**
 105                  * Message ID of the last response
 106                  */
 107                 u_int32_t mid;
 108
 109                 /**
 110                  * Hash of a previously received message
 111                  */
 112                 u_int32_t hash;
 113
 114                 /**
 115                  * packet(s) for retransmission
 116                  */
 117                 array_t *packets;
 118
 119                 /**
 120                  * Sequence number of the last sent message
 121                  */
 122                 u_int32_t seqnr;
 123
 124                 /**
 125                  * how many times we have retransmitted so far
 126                  */
 127                 u_int retransmitted;
 128
 129         } responding;
 130
 131         /**
 132          * Exchange we are currently handling as initiator
 133          */
 134         struct {
 135                 /**
 136                  * Message ID of the exchange
 137                  */
 138                 u_int32_t mid;
 139
 140                 /**
 141                  * Hashes of old responses we can ignore
 142                  */
 143                 u_int32_t old_hashes[MAX_OLD_HASHES];
 144
 145                 /**
 146                  * Position in old hash array
 147                  */
 148                 int old_hash_pos;
 149
 150                 /**
 151                  * Sequence number of the last sent message
 152                  */
 153                 u_int32_t seqnr;
 154
 155                 /**
 156                  * how many times we have retransmitted so far
 157                  */
 158                 u_int retransmitted;
 159
 160                 /**
 161                  * packet(s) for retransmission
 162                  */
 163                 array_t *packets;
 164
 165                 /**
 166                  * type of the initiated exchange
 167                  */
 168                 exchange_type_t type;
 169
 170         } initiating;
 171
 172         /**
 173          * Message we are currently defragmenting, if any (only one at a time)
 174          */
 175         message_t *defrag;
 176
 177         /**
 178          * List of queued tasks not yet in action
 179          */
 180         linked_list_t *queued_tasks;
 181
 182         /**
 183          * List of active tasks, initiated by ourselves
 184          */
 185         linked_list_t *active_tasks;
 186
 187         /**
 188          * List of tasks initiated by peer
 189          */
 190         linked_list_t *passive_tasks;
 191
 192         /**
 193          * Queued messages not yet ready to process
 194          */
 195         message_t *queued;
 196
 197         /**
 198          * Number of times we retransmit messages before giving up
 199          */
 200         u_int retransmit_tries;
 201
 202         /**
 203          * Retransmission timeout
 204          */
 205         double retransmit_timeout;
 206
 207         /**
 208          * Base to calculate retransmission timeout
 209          */
 210         double retransmit_base;
 211
 212         /**
 213          * Sequence number for sending DPD requests
 214          */
 215         u_int32_t dpd_send;
 216
 217         /**
 218          * Sequence number for received DPD requests
 219          */
 220         u_int32_t dpd_recv;
 221 };
 222
 223 /**
 224  * Reset retransmission packet list
 225  */
 226 static void clear_packets(array_t *array)
 227 {
 228         packet_t *packet;
 229
 230         while (array_remove(array, ARRAY_TAIL, &packet))
 231         {
 232                 packet->destroy(packet);
 233         }
 234 }
 235
 236 METHOD(task_manager_t, flush_queue, void,
 237         private_task_manager_t *this, task_queue_t queue)
 238 {
 239         linked_list_t *list;
 240         task_t *task;
 241
 242         if (this->queued)
 243         {
 244                 this->queued->destroy(this->queued);
 245                 this->queued = NULL;
 246         }
 247         switch (queue)
 248         {
 249                 case TASK_QUEUE_ACTIVE:
 250                         list = this->active_tasks;
 251                         /* cancel pending retransmits */
 252                         this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
 253                         clear_packets(this->initiating.packets);
 254                         break;
 255                 case TASK_QUEUE_PASSIVE:
 256                         list = this->passive_tasks;
 257                         break;
 258                 case TASK_QUEUE_QUEUED:
 259                         list = this->queued_tasks;
 260                         break;
 261                 default:
 262                         return;
 263         }
 264         while (list->remove_last(list, (void**)&task) == SUCCESS)
 265         {
 266                 task->destroy(task);
 267         }
 268 }
 269
 270 METHOD(task_manager_t, flush, void,
 271         private_task_manager_t *this)
 272 {
 273         flush_queue(this, TASK_QUEUE_QUEUED);
 274         flush_queue(this, TASK_QUEUE_PASSIVE);
 275         flush_queue(this, TASK_QUEUE_ACTIVE);
 276 }
 277
 278 /**
 279  * move a task of a specific type from the queue to the active list
 280  */
 281 static bool activate_task(private_task_manager_t *this, task_type_t type)
 282 {
 283         enumerator_t *enumerator;
 284         task_t *task;
 285         bool found = FALSE;
 286
 287         enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
 288         while (enumerator->enumerate(enumerator, (void**)&task))
 289         {
 290                 if (task->get_type(task) == type)
 291                 {
 292                         DBG2(DBG_IKE, "  activating %N task", task_type_names, type);
 293                         this->queued_tasks->remove_at(this->queued_tasks, enumerator);
 294                         this->active_tasks->insert_last(this->active_tasks, task);
 295                         found = TRUE;
 296                         break;
 297                 }
 298         }
 299         enumerator->destroy(enumerator);
 300         return found;
 301 }
 302
 303 /**
 304  * Send packets in the given array (they get cloned)
 305  */
 306 static void send_packets(private_task_manager_t *this, array_t *packets)
 307 {
 308         enumerator_t *enumerator;
 309         packet_t *packet;
 310
 311         enumerator = array_create_enumerator(packets);
 312         while (enumerator->enumerate(enumerator, &packet))
 313         {
 314                 charon->sender->send(charon->sender, packet->clone(packet));
 315         }
 316         enumerator->destroy(enumerator);
 317 }
 318
 319 /**
 320  * Generates the given message and stores packet(s) in the given array
 321  */
 322 static bool generate_message(private_task_manager_t *this, message_t *message,
 323                                                          array_t **packets)
 324 {
 325         enumerator_t *fragments;
 326         packet_t *fragment;
 327
 328         if (this->ike_sa->generate_message_fragmented(this->ike_sa, message,
 329                                                                                                   &fragments) != SUCCESS)
 330         {
 331                 return FALSE;
 332         }
 333         while (fragments->enumerate(fragments, &fragment))
 334         {
 335                 array_insert_create(packets, ARRAY_TAIL, fragment);
 336         }
 337         fragments->destroy(fragments);
 338         return TRUE;
 339 }
 340
 341 /**
 342  * Retransmit a packet (or its fragments)
 343  */
 344 static status_t retransmit_packet(private_task_manager_t *this, u_int32_t seqnr,
 345                                                         u_int mid, u_int retransmitted, array_t *packets)
 346 {
 347         packet_t *packet;
 348         u_int32_t t;
 349
 350         array_get(packets, 0, &packet);
 351         if (retransmitted > this->retransmit_tries)
 352         {
 353                 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
 354                 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_TIMEOUT, packet);
 355                 return DESTROY_ME;
 356         }
 357         t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
 358                                         pow(this->retransmit_base, retransmitted));
 359         if (retransmitted)
 360         {
 361                 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
 362                          retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
 363                          mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
 364                 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND, packet);
 365         }
 366         send_packets(this, packets);
 367         lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
 368                         retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
 369         return NEED_MORE;
 370 }
 371
 372 METHOD(task_manager_t, retransmit, status_t,
 373         private_task_manager_t *this, u_int32_t seqnr)
 374 {
 375         status_t status = SUCCESS;
 376
 377         if (seqnr == this->initiating.seqnr &&
 378                 array_count(this->initiating.packets))
 379         {
 380                 status = retransmit_packet(this, seqnr, this->initiating.mid,
 381                                         this->initiating.retransmitted, this->initiating.packets);
 382                 if (status == NEED_MORE)
 383                 {
 384                         this->initiating.retransmitted++;
 385                         status = SUCCESS;
 386                 }
 387         }
 388         if (seqnr == this->responding.seqnr &&
 389                 array_count(this->responding.packets))
 390         {
 391                 status = retransmit_packet(this, seqnr, this->responding.mid,
 392                                         this->responding.retransmitted, this->responding.packets);
 393                 if (status == NEED_MORE)
 394                 {
 395                         this->responding.retransmitted++;
 396                         status = SUCCESS;
 397                 }
 398         }
 399         return status;
 400 }
 401
 402 /**
 403  * Check if we have to wait for a mode config before starting a quick mode
 404  */
 405 static bool mode_config_expected(private_task_manager_t *this)
 406 {
 407         enumerator_t *enumerator;
 408         peer_cfg_t *peer_cfg;
 409         char *pool;
 410         bool local;
 411         host_t *host;
 412
 413         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 414         if (peer_cfg)
 415         {
 416                 if (peer_cfg->use_pull_mode(peer_cfg))
 417                 {
 418                         enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
 419                         if (!enumerator->enumerate(enumerator, &pool))
 420                         {       /* no pool configured */
 421                                 enumerator->destroy(enumerator);
 422                                 return FALSE;
 423                         }
 424                         enumerator->destroy(enumerator);
 425
 426                         local = FALSE;
 427                 }
 428                 else
 429                 {
 430                         enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
 431                         if (!enumerator->enumerate(enumerator, &host))
 432                         {       /* not requesting a vip */
 433                                 enumerator->destroy(enumerator);
 434                                 return FALSE;
 435                         }
 436                         enumerator->destroy(enumerator);
 437
 438                         local = TRUE;
 439                 }
 440                 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
 441                                                                                                                                 local);
 442                 if (!enumerator->enumerate(enumerator, &host))
 443                 {       /* expecting a VIP exchange, but no VIP assigned yet */
 444                         enumerator->destroy(enumerator);
 445                         return TRUE;
 446                 }
 447                 enumerator->destroy(enumerator);
 448         }
 449         return FALSE;
 450 }
 451
 452 METHOD(task_manager_t, initiate, status_t,
 453         private_task_manager_t *this)
 454 {
 455         enumerator_t *enumerator;
 456         task_t *task;
 457         message_t *message;
 458         host_t *me, *other;
 459         exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
 460         bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
 461
 462         if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
 463                 this->initiating.type != INFORMATIONAL_V1)
 464         {
 465                 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
 466                                 exchange_type_names, this->initiating.type);
 467                 /* do not initiate if we already have a message in the air */
 468                 return SUCCESS;
 469         }
 470
 471         if (this->active_tasks->get_count(this->active_tasks) == 0)
 472         {
 473                 DBG2(DBG_IKE, "activating new tasks");
 474                 switch (this->ike_sa->get_state(this->ike_sa))
 475                 {
 476                         case IKE_CREATED:
 477                                 activate_task(this, TASK_ISAKMP_VENDOR);
 478                                 activate_task(this, TASK_ISAKMP_CERT_PRE);
 479                                 if (activate_task(this, TASK_MAIN_MODE))
 480                                 {
 481                                         exchange = ID_PROT;
 482                                 }
 483                                 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
 484                                 {
 485                                         exchange = AGGRESSIVE;
 486                                 }
 487                                 activate_task(this, TASK_ISAKMP_CERT_POST);
 488                                 activate_task(this, TASK_ISAKMP_NATD);
 489                                 break;
 490                         case IKE_CONNECTING:
 491                                 if (activate_task(this, TASK_ISAKMP_DELETE))
 492                                 {
 493                                         exchange = INFORMATIONAL_V1;
 494                                         new_mid = TRUE;
 495                                         break;
 496                                 }
 497                                 if (activate_task(this, TASK_XAUTH))
 498                                 {
 499                                         exchange = TRANSACTION;
 500                                         new_mid = TRUE;
 501                                         break;
 502                                 }
 503                                 if (activate_task(this, TASK_INFORMATIONAL))
 504                                 {
 505                                         exchange = INFORMATIONAL_V1;
 506                                         new_mid = TRUE;
 507                                         break;
 508                                 }
 509                                 break;
 510                         case IKE_ESTABLISHED:
 511                                 if (activate_task(this, TASK_MODE_CONFIG))
 512                                 {
 513                                         exchange = TRANSACTION;
 514                                         new_mid = TRUE;
 515                                         break;
 516                                 }
 517                                 if (!mode_config_expected(this) &&
 518                                         activate_task(this, TASK_QUICK_MODE))
 519                                 {
 520                                         exchange = QUICK_MODE;
 521                                         new_mid = TRUE;
 522                                         break;
 523                                 }
 524                                 if (activate_task(this, TASK_INFORMATIONAL))
 525                                 {
 526                                         exchange = INFORMATIONAL_V1;
 527                                         new_mid = TRUE;
 528                                         break;
 529                                 }
 530                                 if (activate_task(this, TASK_QUICK_DELETE))
 531                                 {
 532                                         exchange = INFORMATIONAL_V1;
 533                                         new_mid = TRUE;
 534                                         break;
 535                                 }
 536                                 if (activate_task(this, TASK_ISAKMP_DELETE))
 537                                 {
 538                                         exchange = INFORMATIONAL_V1;
 539                                         new_mid = TRUE;
 540                                         break;
 541                                 }
 542                                 if (activate_task(this, TASK_ISAKMP_DPD))
 543                                 {
 544                                         exchange = INFORMATIONAL_V1;
 545                                         new_mid = TRUE;
 546                                         break;
 547                                 }
 548                                 break;
 549                         default:
 550                                 break;
 551                 }
 552         }
 553         else
 554         {
 555                 DBG2(DBG_IKE, "reinitiating already active tasks");
 556                 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
 557                 while (enumerator->enumerate(enumerator, (void**)&task))
 558                 {
 559                         DBG2(DBG_IKE, "  %N task", task_type_names, task->get_type(task));
 560                         switch (task->get_type(task))
 561                         {
 562                                 case TASK_MAIN_MODE:
 563                                         exchange = ID_PROT;
 564                                         break;
 565                                 case TASK_AGGRESSIVE_MODE:
 566                                         exchange = AGGRESSIVE;
 567                                         break;
 568                                 case TASK_QUICK_MODE:
 569                                         exchange = QUICK_MODE;
 570                                         break;
 571                                 case TASK_XAUTH:
 572                                         exchange = TRANSACTION;
 573                                         new_mid = TRUE;
 574                                         break;
 575                                 default:
 576                                         continue;
 577                         }
 578                         break;
 579                 }
 580                 enumerator->destroy(enumerator);
 581         }
 582
 583         if (exchange == EXCHANGE_TYPE_UNDEFINED)
 584         {
 585                 DBG2(DBG_IKE, "nothing to initiate");
 586                 /* nothing to do yet... */
 587                 return SUCCESS;
 588         }
 589
 590         me = this->ike_sa->get_my_host(this->ike_sa);
 591         other = this->ike_sa->get_other_host(this->ike_sa);
 592
 593         if (new_mid)
 594         {
 595                 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
 596                                                                  (void*)&this->initiating.mid))
 597                 {
 598                         DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
 599                         flush(this);
 600                         return DESTROY_ME;
 601                 }
 602         }
 603         message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 604         message->set_message_id(message, this->initiating.mid);
 605         message->set_source(message, me->clone(me));
 606         message->set_destination(message, other->clone(other));
 607         message->set_exchange_type(message, exchange);
 608         this->initiating.type = exchange;
 609         this->initiating.retransmitted = 0;
 610
 611         enumerator = this->active_tasks->create_enumerator(this->active_tasks);
 612         while (enumerator->enumerate(enumerator, (void*)&task))
 613         {
 614                 switch (task->build(task, message))
 615                 {
 616                         case SUCCESS:
 617                                 /* task completed, remove it */
 618                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
 619                                 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
 620                                         task->get_type(task) == TASK_QUICK_MODE)
 621                                 {       /* last message of three message exchange */
 622                                         keep = TRUE;
 623                                 }
 624                                 task->destroy(task);
 625                                 continue;
 626                         case NEED_MORE:
 627                                 expect_response = TRUE;
 628                                 /* processed, but task needs another exchange */
 629                                 continue;
 630                         case ALREADY_DONE:
 631                                 cancelled = TRUE;
 632                                 break;
 633                         case FAILED:
 634                         default:
 635                                 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
 636                                 {
 637                                         charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 638                                 }
 639                                 /* FALL */
 640                         case DESTROY_ME:
 641                                 /* critical failure, destroy IKE_SA */
 642                                 enumerator->destroy(enumerator);
 643                                 message->destroy(message);
 644                                 flush(this);
 645                                 return DESTROY_ME;
 646                 }
 647                 break;
 648         }
 649         enumerator->destroy(enumerator);
 650
 651         if (this->active_tasks->get_count(this->active_tasks) == 0 &&
 652                 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
 653         {       /* tasks completed, no exchange active anymore */
 654                 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
 655         }
 656         if (cancelled)
 657         {
 658                 message->destroy(message);
 659                 return initiate(this);
 660         }
 661
 662         clear_packets(this->initiating.packets);
 663         if (!generate_message(this, message, &this->initiating.packets))
 664         {
 665                 /* message generation failed. There is nothing more to do than to
 666                  * close the SA */
 667                 message->destroy(message);
 668                 flush(this);
 669                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 670                 return DESTROY_ME;
 671         }
 672
 673         this->initiating.seqnr++;
 674         if (expect_response)
 675         {
 676                 message->destroy(message);
 677                 return retransmit(this, this->initiating.seqnr);
 678         }
 679         if (keep)
 680         {       /* keep the packet for retransmission, the responder might request it */
 681                 send_packets(this, this->initiating.packets);
 682         }
 683         else
 684         {
 685                 send_packets(this, this->initiating.packets);
 686                 clear_packets(this->initiating.packets);
 687         }
 688         message->destroy(message);
 689
 690         if (exchange == INFORMATIONAL_V1)
 691         {
 692                 switch (this->ike_sa->get_state(this->ike_sa))
 693                 {
 694                         case IKE_CONNECTING:
 695                                 /* close after sending an INFORMATIONAL when unestablished */
 696                                 return FAILED;
 697                         case IKE_DELETING:
 698                                 /* close after sending a DELETE */
 699                                 return DESTROY_ME;
 700                         default:
 701                                 break;
 702                 }
 703         }
 704         return initiate(this);
 705 }
 706
 707 /**
 708  * build a response depending on the "passive" task list
 709  */
 710 static status_t build_response(private_task_manager_t *this, message_t *request)
 711 {
 712         enumerator_t *enumerator;
 713         task_t *task;
 714         message_t *message;
 715         host_t *me, *other;
 716         bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
 717
 718         me = request->get_destination(request);
 719         other = request->get_source(request);
 720
 721         message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 722         message->set_exchange_type(message, request->get_exchange_type(request));
 723         /* send response along the path the request came in */
 724         message->set_source(message, me->clone(me));
 725         message->set_destination(message, other->clone(other));
 726         message->set_message_id(message, request->get_message_id(request));
 727         message->set_request(message, FALSE);
 728
 729         this->responding.mid = request->get_message_id(request);
 730         this->responding.retransmitted = 0;
 731         this->responding.seqnr++;
 732
 733         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
 734         while (enumerator->enumerate(enumerator, (void*)&task))
 735         {
 736                 switch (task->build(task, message))
 737                 {
 738                         case SUCCESS:
 739                                 /* task completed, remove it */
 740                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
 741                                 task->destroy(task);
 742                                 continue;
 743                         case NEED_MORE:
 744                                 /* processed, but task needs another exchange */
 745                                 if (task->get_type(task) == TASK_QUICK_MODE ||
 746                                         task->get_type(task) == TASK_AGGRESSIVE_MODE)
 747                                 {       /* we rely on initiator retransmission, except for
 748                                          * three-message exchanges */
 749                                         expect_request = TRUE;
 750                                 }
 751                                 continue;
 752                         case ALREADY_DONE:
 753                                 cancelled = TRUE;
 754                                 break;
 755                         case FAILED:
 756                         default:
 757                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 758                                 /* FALL */
 759                         case DESTROY_ME:
 760                                 /* destroy IKE_SA, but SEND response first */
 761                                 delete = TRUE;
 762                                 break;
 763                 }
 764                 break;
 765         }
 766         enumerator->destroy(enumerator);
 767
 768         clear_packets(this->responding.packets);
 769         if (cancelled)
 770         {
 771                 message->destroy(message);
 772                 return initiate(this);
 773         }
 774         if (!generate_message(this, message, &this->responding.packets))
 775         {
 776                 message->destroy(message);
 777                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 778                 return DESTROY_ME;
 779         }
 780         message->destroy(message);
 781
 782         if (expect_request && !delete)
 783         {
 784                 return retransmit(this, this->responding.seqnr);
 785         }
 786         send_packets(this, this->responding.packets);
 787         if (delete)
 788         {
 789                 return DESTROY_ME;
 790         }
 791         return SUCCESS;
 792 }
 793
 794 /**
 795  * Send a notify in a separate INFORMATIONAL exchange back to the sender.
 796  * The notify protocol_id is set to ISAKMP
 797  */
 798 static void send_notify(private_task_manager_t *this, message_t *request,
 799                                                 notify_type_t type)
 800 {
 801         message_t *response;
 802         array_t *packets = NULL;
 803         host_t *me, *other;
 804         u_int32_t mid;
 805
 806         if (request->get_exchange_type(request) == INFORMATIONAL_V1)
 807         {       /* don't respond to INFORMATIONAL requests to avoid a notify war */
 808                 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
 809                 return;
 810         }
 811         if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
 812         {
 813                 DBG1(DBG_IKE, "failed to allocate message ID");
 814                 return;
 815         }
 816         response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
 817         response->set_exchange_type(response, INFORMATIONAL_V1);
 818         response->set_request(response, TRUE);
 819         response->set_message_id(response, mid);
 820         response->add_payload(response, (payload_t*)
 821                                 notify_payload_create_from_protocol_and_type(PLV1_NOTIFY,
 822                                                                                                         PROTO_IKE, type));
 823
 824         me = this->ike_sa->get_my_host(this->ike_sa);
 825         if (me->is_anyaddr(me))
 826         {
 827                 me = request->get_destination(request);
 828                 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
 829         }
 830         other = this->ike_sa->get_other_host(this->ike_sa);
 831         if (other->is_anyaddr(other))
 832         {
 833                 other = request->get_source(request);
 834                 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
 835         }
 836         response->set_source(response, me->clone(me));
 837         response->set_destination(response, other->clone(other));
 838         if (generate_message(this, response, &packets))
 839         {
 840                 send_packets(this, packets);
 841         }
 842         clear_packets(packets);
 843         array_destroy(packets);
 844         response->destroy(response);
 845 }
 846
 847 /**
 848  * Process a DPD request/response
 849  */
 850 static bool process_dpd(private_task_manager_t *this, message_t *message)
 851 {
 852         notify_payload_t *notify;
 853         notify_type_t type;
 854         u_int32_t seq;
 855         chunk_t data;
 856
 857         type = DPD_R_U_THERE;
 858         notify = message->get_notify(message, type);
 859         if (!notify)
 860         {
 861                 type = DPD_R_U_THERE_ACK;
 862                 notify = message->get_notify(message, type);
 863         }
 864         if (!notify)
 865         {
 866                 return FALSE;
 867         }
 868         data = notify->get_notification_data(notify);
 869         if (data.len != 4)
 870         {
 871                 return FALSE;
 872         }
 873         seq = untoh32(data.ptr);
 874
 875         if (type == DPD_R_U_THERE)
 876         {
 877                 if (this->dpd_recv == 0 || seq == this->dpd_recv)
 878                 {       /* check sequence validity */
 879                         this->dpd_recv = seq + 1;
 880                         this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
 881                                                                                 time_monotonic(NULL));
 882                 }
 883                 /* but respond anyway */
 884                 this->ike_sa->queue_task(this->ike_sa,
 885                                 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
 886         }
 887         else /* DPD_R_U_THERE_ACK */
 888         {
 889                 if (seq == this->dpd_send - 1)
 890                 {
 891                         this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
 892                                                                                 time_monotonic(NULL));
 893                 }
 894                 else
 895                 {
 896                         DBG1(DBG_IKE, "received invalid DPD sequence number %u "
 897                                  "(expected %u), ignored", seq, this->dpd_send - 1);
 898                 }
 899         }
 900         return TRUE;
 901 }
 902
 903 /**
 904  * handle an incoming request message
 905  */
 906 static status_t process_request(private_task_manager_t *this,
 907                                                                 message_t *message)
 908 {
 909         enumerator_t *enumerator;
 910         task_t *task = NULL;
 911         bool send_response = FALSE, dpd = FALSE;
 912
 913         if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
 914                 this->passive_tasks->get_count(this->passive_tasks) == 0)
 915         {       /* create tasks depending on request type, if not already some queued */
 916                 switch (message->get_exchange_type(message))
 917                 {
 918                         case ID_PROT:
 919                                 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
 920                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 921                                 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
 922                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 923                                 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
 924                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 925                                 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
 926                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 927                                 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
 928                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 929                                 break;
 930                         case AGGRESSIVE:
 931                                 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
 932                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 933                                 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
 934                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 935                                 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
 936                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 937                                 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
 938                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 939                                 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
 940                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 941                                 break;
 942                         case QUICK_MODE:
 943                                 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
 944                                 {
 945                                         DBG1(DBG_IKE, "received quick mode request for "
 946                                                  "unestablished IKE_SA, ignored");
 947                                         return FAILED;
 948                                 }
 949                                 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
 950                                                                                                    NULL, NULL);
 951                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 952                                 break;
 953                         case INFORMATIONAL_V1:
 954                                 if (process_dpd(this, message))
 955                                 {
 956                                         dpd = TRUE;
 957                                 }
 958                                 else
 959                                 {
 960                                         task = (task_t *)informational_create(this->ike_sa, NULL);
 961                                         this->passive_tasks->insert_first(this->passive_tasks, task);
 962                                 }
 963                                 break;
 964                         case TRANSACTION:
 965                                 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
 966                                 {
 967                                         task = (task_t *)mode_config_create(this->ike_sa,
 968                                                                                                                 FALSE, TRUE);
 969                                 }
 970                                 else
 971                                 {
 972                                         task = (task_t *)xauth_create(this->ike_sa, FALSE);
 973                                 }
 974                                 this->passive_tasks->insert_last(this->passive_tasks, task);
 975                                 break;
 976                         default:
 977                                 return FAILED;
 978                 }
 979         }
 980         if (dpd)
 981         {
 982                 return initiate(this);
 983         }
 984         this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
 985
 986         /* let the tasks process the message */
 987         enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
 988         while (enumerator->enumerate(enumerator, (void*)&task))
 989         {
 990                 switch (task->process(task, message))
 991                 {
 992                         case SUCCESS:
 993                                 /* task completed, remove it */
 994                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
 995                                 task->destroy(task);
 996                                 continue;
 997                         case NEED_MORE:
 998                                 /* processed, but task needs at least another call to build() */
 999                                 send_response = TRUE;
1000                                 continue;
1001                         case ALREADY_DONE:
1002                                 send_response = FALSE;
1003                                 break;
1004                         case FAILED:
1005                         default:
1006                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1007                                 /* FALL */
1008                         case DESTROY_ME:
1009                                 /* critical failure, destroy IKE_SA */
1010                                 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1011                                 enumerator->destroy(enumerator);
1012                                 task->destroy(task);
1013                                 return DESTROY_ME;
1014                 }
1015                 break;
1016         }
1017         enumerator->destroy(enumerator);
1018
1019         if (send_response)
1020         {
1021                 if (build_response(this, message) != SUCCESS)
1022                 {
1023                         return DESTROY_ME;
1024                 }
1025         }
1026         else
1027         {       /* We don't send a response, so don't retransmit one if we get
1028                  * the same message again. */
1029                 clear_packets(this->responding.packets);
1030         }
1031         if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
1032                 this->queued_tasks->get_count(this->queued_tasks) > 0)
1033         {
1034                 /* passive tasks completed, check if an active task has been queued,
1035                  * such as XAUTH or modeconfig push */
1036                 return initiate(this);
1037         }
1038         return SUCCESS;
1039 }
1040
1041 /**
1042  * handle an incoming response message
1043  */
1044 static status_t process_response(private_task_manager_t *this,
1045                                                                  message_t *message)
1046 {
1047         enumerator_t *enumerator;
1048         message_t *queued;
1049         status_t status;
1050         task_t *task;
1051
1052         if (message->get_exchange_type(message) != this->initiating.type)
1053         {
1054                 /* Windows server sends a fourth quick mode message having an initial
1055                  * contact notify. Ignore this message for compatibility. */
1056                 if (this->initiating.type == EXCHANGE_TYPE_UNDEFINED &&
1057                         message->get_exchange_type(message) == QUICK_MODE &&
1058                         message->get_notify(message, INITIAL_CONTACT))
1059                 {
1060                         DBG1(DBG_IKE, "ignoring fourth Quick Mode message");
1061                         return SUCCESS;
1062                 }
1063                 DBG1(DBG_IKE, "received %N response, but expected %N",
1064                          exchange_type_names, message->get_exchange_type(message),
1065                          exchange_type_names, this->initiating.type);
1066                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1067                 return DESTROY_ME;
1068         }
1069
1070         enumerator = this->active_tasks->create_enumerator(this->active_tasks);
1071         while (enumerator->enumerate(enumerator, (void*)&task))
1072         {
1073                 switch (task->process(task, message))
1074                 {
1075                         case SUCCESS:
1076                                 /* task completed, remove it */
1077                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
1078                                 task->destroy(task);
1079                                 continue;
1080                         case NEED_MORE:
1081                                 /* processed, but task needs another exchange */
1082                                 continue;
1083                         case ALREADY_DONE:
1084                                 break;
1085                         case FAILED:
1086                         default:
1087                                 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1088                                 /* FALL */
1089                         case DESTROY_ME:
1090                                 /* critical failure, destroy IKE_SA */
1091                                 this->active_tasks->remove_at(this->active_tasks, enumerator);
1092                                 enumerator->destroy(enumerator);
1093                                 task->destroy(task);
1094                                 return DESTROY_ME;
1095                 }
1096                 break;
1097         }
1098         enumerator->destroy(enumerator);
1099
1100         this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1101         clear_packets(this->initiating.packets);
1102
1103         if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
1104         {
1105                 queued = this->queued;
1106                 this->queued = NULL;
1107                 status = this->public.task_manager.process_message(
1108                                                                                         &this->public.task_manager, queued);
1109                 queued->destroy(queued);
1110                 if (status == DESTROY_ME)
1111                 {
1112                         return status;
1113                 }
1114         }
1115
1116         return initiate(this);
1117 }
1118
1119 static status_t handle_fragment(private_task_manager_t *this, message_t *msg)
1120 {
1121         status_t status;
1122
1123         if (!this->defrag)
1124         {
1125                 this->defrag = message_create_defrag(msg);
1126                 if (!this->defrag)
1127                 {
1128                         return FAILED;
1129                 }
1130         }
1131         status = this->defrag->add_fragment(this->defrag, msg);
1132         if (status == SUCCESS)
1133         {
1134                 lib->processor->queue_job(lib->processor,
1135                                                         (job_t*)process_message_job_create(this->defrag));
1136                 this->defrag = NULL;
1137                 /* do not process the last fragment */
1138                 status = NEED_MORE;
1139         }
1140         return status;
1141 }
1142
1143 /**
1144  * Parse the given message and verify that it is valid.
1145  */
1146 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1147 {
1148         status_t status;
1149
1150         status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1151
1152         if (status != SUCCESS)
1153         {
1154                 switch (status)
1155                 {
1156                         case NOT_SUPPORTED:
1157                                 DBG1(DBG_IKE, "unsupported exchange type");
1158                                 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1159                                 break;
1160                         case PARSE_ERROR:
1161                                 DBG1(DBG_IKE, "message parsing failed");
1162                                 send_notify(this, msg, PAYLOAD_MALFORMED);
1163                                 break;
1164                         case VERIFY_ERROR:
1165                                 DBG1(DBG_IKE, "message verification failed");
1166                                 send_notify(this, msg, PAYLOAD_MALFORMED);
1167                                 break;
1168                         case FAILED:
1169                                 DBG1(DBG_IKE, "integrity check failed");
1170                                 send_notify(this, msg, INVALID_HASH_INFORMATION);
1171                                 break;
1172                         case INVALID_STATE:
1173                                 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1174                                 send_notify(this, msg, PAYLOAD_MALFORMED);
1175                         default:
1176                                 break;
1177                 }
1178                 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1179                          exchange_type_names, msg->get_exchange_type(msg),
1180                          msg->get_request(msg) ? "request" : "response",
1181                          msg->get_message_id(msg));
1182
1183                 charon->bus->alert(charon->bus, ALERT_PARSE_ERROR_BODY, msg, status);
1184
1185                 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1186                 {       /* invalid initiation attempt, close SA */
1187                         return DESTROY_ME;
1188                 }
1189         }
1190
1191         if (msg->get_first_payload_type(msg) == PLV1_FRAGMENT)
1192         {
1193                 return handle_fragment(this, msg);
1194         }
1195         return status;
1196 }
1197
1198 METHOD(task_manager_t, process_message, status_t,
1199         private_task_manager_t *this, message_t *msg)
1200 {
1201         u_int32_t hash, mid, i;
1202         host_t *me, *other;
1203         status_t status;
1204
1205         /* TODO-IKEv1: update hosts more selectively */
1206         me = msg->get_destination(msg);
1207         other = msg->get_source(msg);
1208         mid = msg->get_message_id(msg);
1209         hash = chunk_hash(msg->get_packet_data(msg));
1210         for (i = 0; i < MAX_OLD_HASHES; i++)
1211         {
1212                 if (this->initiating.old_hashes[i] == hash)
1213                 {
1214                         if (array_count(this->initiating.packets) &&
1215                                 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1216                                 (msg->get_exchange_type(msg) == QUICK_MODE ||
1217                                  msg->get_exchange_type(msg) == AGGRESSIVE))
1218                         {
1219                                 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1220                                          "resending last request", mid);
1221                                 send_packets(this, this->initiating.packets);
1222                                 return SUCCESS;
1223                         }
1224                         DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1225                                  "but next request already sent", mid);
1226                         return SUCCESS;
1227                 }
1228         }
1229
1230         if ((mid && mid == this->initiating.mid) ||
1231                 (this->initiating.mid == 0 &&
1232                  msg->get_exchange_type(msg) == this->initiating.type &&
1233                  this->active_tasks->get_count(this->active_tasks)))
1234         {
1235                 msg->set_request(msg, FALSE);
1236                 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1237                 status = parse_message(this, msg);
1238                 if (status == NEED_MORE)
1239                 {
1240                         return SUCCESS;
1241                 }
1242                 if (status != SUCCESS)
1243                 {
1244                         return status;
1245                 }
1246                 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1247                                                                         time_monotonic(NULL));
1248                 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1249                 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1250                 if (process_response(this, msg) != SUCCESS)
1251                 {
1252                         flush(this);
1253                         return DESTROY_ME;
1254                 }
1255                 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1256                                                                         MAX_OLD_HASHES] = hash;
1257         }
1258         else
1259         {
1260                 if (hash == this->responding.hash)
1261                 {
1262                         if (array_count(this->responding.packets))
1263                         {
1264                                 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1265                                          "retransmitting response", mid);
1266                                 send_packets(this, this->responding.packets);
1267                         }
1268                         else if (array_count(this->initiating.packets) &&
1269                                          this->initiating.type == INFORMATIONAL_V1)
1270                         {
1271                                 DBG1(DBG_IKE, "received retransmit of DPD request, "
1272                                          "retransmitting response");
1273                                 send_packets(this, this->initiating.packets);
1274                         }
1275                         else
1276                         {
1277                                 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1278                                          "but no response to retransmit", mid);
1279                         }
1280                         charon->bus->alert(charon->bus, ALERT_RETRANSMIT_RECEIVE, msg);
1281                         return SUCCESS;
1282                 }
1283
1284                 /* reject Main/Aggressive Modes once established */
1285                 if (msg->get_exchange_type(msg) == ID_PROT ||
1286                         msg->get_exchange_type(msg) == AGGRESSIVE)
1287                 {
1288                         if (this->ike_sa->get_state(this->ike_sa) != IKE_CREATED &&
1289                                 this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING &&
1290                                 msg->get_first_payload_type(msg) != PLV1_FRAGMENT)
1291                         {
1292                                 DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
1293                                          exchange_type_names, msg->get_exchange_type(msg));
1294                                 return FAILED;
1295                         }
1296                 }
1297
1298                 if (msg->get_exchange_type(msg) == TRANSACTION &&
1299                         this->active_tasks->get_count(this->active_tasks))
1300                 {       /* main mode not yet complete, queue XAuth/Mode config tasks */
1301                         if (this->queued)
1302                         {
1303                                 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
1304                                          exchange_type_names, TRANSACTION);
1305                                 return SUCCESS;
1306                         }
1307                         this->queued = message_create_from_packet(msg->get_packet(msg));
1308                         if (this->queued->parse_header(this->queued) != SUCCESS)
1309                         {
1310                                 this->queued->destroy(this->queued);
1311                                 this->queued = NULL;
1312                                 return FAILED;
1313                         }
1314                         DBG1(DBG_IKE, "queueing %N request as tasks still active",
1315                                  exchange_type_names, TRANSACTION);
1316                         return SUCCESS;
1317                 }
1318
1319                 msg->set_request(msg, TRUE);
1320                 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1321                 status = parse_message(this, msg);
1322                 if (status == NEED_MORE)
1323                 {
1324                         return SUCCESS;
1325                 }
1326                 if (status != SUCCESS)
1327                 {
1328                         return status;
1329                 }
1330                 /* if this IKE_SA is virgin, we check for a config */
1331                 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1332                 {
1333                         ike_sa_id_t *ike_sa_id;
1334                         ike_cfg_t *ike_cfg;
1335                         job_t *job;
1336
1337                         ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1338                                                                                                         me, other, IKEV1);
1339                         if (ike_cfg == NULL)
1340                         {
1341                                 /* no config found for these hosts, destroy */
1342                                 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1343                                          me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1344                                 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1345                                 return DESTROY_ME;
1346                         }
1347                         this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1348                         ike_cfg->destroy(ike_cfg);
1349                         /* add a timeout if peer does not establish it completely */
1350                         ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1351                         job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1352                         lib->scheduler->schedule_job(lib->scheduler, job,
1353                                         lib->settings->get_int(lib->settings,
1354                                                         "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1355                                                         lib->ns));
1356                 }
1357                 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1358                 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1359                 if (process_request(this, msg) != SUCCESS)
1360                 {
1361                         flush(this);
1362                         return DESTROY_ME;
1363                 }
1364                 this->responding.hash = hash;
1365         }
1366         return SUCCESS;
1367 }
1368
1369 /**
1370  * Check if a given task has been queued already
1371  */
1372 static bool has_queued(private_task_manager_t *this, task_type_t type)
1373 {
1374         enumerator_t *enumerator;
1375         bool found = FALSE;
1376         task_t *task;
1377
1378         enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1379         while (enumerator->enumerate(enumerator, &task))
1380         {
1381                 if (task->get_type(task) == type)
1382                 {
1383                         found = TRUE;
1384                         break;
1385                 }
1386         }
1387         enumerator->destroy(enumerator);
1388         return found;
1389 }
1390
1391 METHOD(task_manager_t, queue_task, void,
1392         private_task_manager_t *this, task_t *task)
1393 {
1394         task_type_t type = task->get_type(task);
1395
1396         switch (type)
1397         {
1398                 case TASK_MODE_CONFIG:
1399                 case TASK_XAUTH:
1400                         if (has_queued(this, type))
1401                         {
1402                                 task->destroy(task);
1403                                 return;
1404                         }
1405                         break;
1406                 default:
1407                         break;
1408         }
1409         DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1410         this->queued_tasks->insert_last(this->queued_tasks, task);
1411 }
1412
1413 METHOD(task_manager_t, queue_ike, void,
1414         private_task_manager_t *this)
1415 {
1416         peer_cfg_t *peer_cfg;
1417
1418         if (!has_queued(this, TASK_ISAKMP_VENDOR))
1419         {
1420                 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1421         }
1422         if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1423         {
1424                 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1425         }
1426         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1427         if (peer_cfg->use_aggressive(peer_cfg))
1428         {
1429                 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1430                 {
1431                         queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1432                 }
1433         }
1434         else
1435         {
1436                 if (!has_queued(this, TASK_MAIN_MODE))
1437                 {
1438                         queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1439                 }
1440         }
1441         if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1442         {
1443                 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1444         }
1445         if (!has_queued(this, TASK_ISAKMP_NATD))
1446         {
1447                 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1448         }
1449 }
1450
1451 METHOD(task_manager_t, queue_ike_reauth, void,
1452         private_task_manager_t *this)
1453 {
1454         enumerator_t *enumerator;
1455         child_sa_t *child_sa;
1456         ike_sa_t *new;
1457         host_t *host;
1458
1459         new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1460                                                                 this->ike_sa->get_version(this->ike_sa), TRUE);
1461         if (!new)
1462         {       /* shouldn't happen */
1463                 return;
1464         }
1465
1466         new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1467         host = this->ike_sa->get_other_host(this->ike_sa);
1468         new->set_other_host(new, host->clone(host));
1469         host = this->ike_sa->get_my_host(this->ike_sa);
1470         new->set_my_host(new, host->clone(host));
1471         enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1472         while (enumerator->enumerate(enumerator, &host))
1473         {
1474                 new->add_virtual_ip(new, TRUE, host);
1475         }
1476         enumerator->destroy(enumerator);
1477
1478         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1479         while (enumerator->enumerate(enumerator, &child_sa))
1480         {
1481                 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1482                 new->add_child_sa(new, child_sa);
1483         }
1484         enumerator->destroy(enumerator);
1485
1486         if (!new->get_child_count(new))
1487         {       /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1488                 task_t *task;
1489
1490                 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1491                 while (enumerator->enumerate(enumerator, &task))
1492                 {
1493                         if (task->get_type(task) == TASK_QUICK_MODE)
1494                         {
1495                                 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1496                                 task->migrate(task, new);
1497                                 new->queue_task(new, task);
1498                         }
1499                 }
1500                 enumerator->destroy(enumerator);
1501         }
1502
1503         if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1504         {
1505                 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1506                 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1507         }
1508         else
1509         {
1510                 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1511                 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1512         }
1513         charon->bus->set_sa(charon->bus, this->ike_sa);
1514 }
1515
1516 METHOD(task_manager_t, queue_ike_rekey, void,
1517         private_task_manager_t *this)
1518 {
1519         queue_ike_reauth(this);
1520 }
1521
1522 METHOD(task_manager_t, queue_ike_delete, void,
1523         private_task_manager_t *this)
1524 {
1525         enumerator_t *enumerator;
1526         child_sa_t *child_sa;
1527
1528         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1529         while (enumerator->enumerate(enumerator, &child_sa))
1530         {
1531                 queue_task(this, (task_t*)
1532                         quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1533                                                                 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1534         }
1535         enumerator->destroy(enumerator);
1536
1537         queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1538 }
1539
1540 METHOD(task_manager_t, queue_mobike, void,
1541         private_task_manager_t *this, bool roam, bool address)
1542 {
1543         /* Not supported in IKEv1 */
1544 }
1545
1546 METHOD(task_manager_t, queue_child, void,
1547         private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1548         traffic_selector_t *tsi, traffic_selector_t *tsr)
1549 {
1550         quick_mode_t *task;
1551
1552         task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1553         task->use_reqid(task, reqid);
1554
1555         queue_task(this, &task->task);
1556 }
1557
1558 /**
1559  * Check if two CHILD_SAs have the same traffic selector
1560  */
1561 static bool have_equal_ts(child_sa_t *child1, child_sa_t *child2, bool local)
1562 {
1563         enumerator_t *e1, *e2;
1564         traffic_selector_t *ts1, *ts2;
1565         bool equal = FALSE;
1566
1567         e1 = child1->create_ts_enumerator(child1, local);
1568         e2 = child2->create_ts_enumerator(child2, local);
1569         if (e1->enumerate(e1, &ts1) && e2->enumerate(e2, &ts2))
1570         {
1571                 equal = ts1->equals(ts1, ts2);
1572         }
1573         e2->destroy(e2);
1574         e1->destroy(e1);
1575
1576         return equal;
1577 }
1578
1579 /**
1580  * Check if a CHILD_SA is redundant and we should delete instead of rekey
1581  */
1582 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1583 {
1584         enumerator_t *enumerator;
1585         child_sa_t *current;
1586         bool redundant = FALSE;
1587
1588         enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1589         while (enumerator->enumerate(enumerator, &current))
1590         {
1591                 if (current->get_state(current) == CHILD_INSTALLED &&
1592                         streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1593                         have_equal_ts(current, child_sa, TRUE) &&
1594                         have_equal_ts(current, child_sa, FALSE) &&
1595                         current->get_lifetime(current, FALSE) >
1596                                 child_sa->get_lifetime(child_sa, FALSE))
1597                 {
1598                         DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1599                                  child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
1600                         redundant = TRUE;
1601                         break;
1602                 }
1603         }
1604         enumerator->destroy(enumerator);
1605
1606         return redundant;
1607 }
1608
1609 /**
1610  * Get the first traffic selector of a CHILD_SA, local or remote
1611  */
1612 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1613 {
1614         traffic_selector_t *ts = NULL;
1615         enumerator_t *enumerator;
1616
1617         enumerator = child_sa->create_ts_enumerator(child_sa, local);
1618         enumerator->enumerate(enumerator, &ts);
1619         enumerator->destroy(enumerator);
1620
1621         return ts;
1622 }
1623
1624 METHOD(task_manager_t, queue_child_rekey, void,
1625         private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1626 {
1627         child_sa_t *child_sa;
1628         child_cfg_t *cfg;
1629         quick_mode_t *task;
1630
1631         child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1632         if (!child_sa)
1633         {
1634                 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1635         }
1636         if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1637         {
1638                 if (is_redundant(this, child_sa))
1639                 {
1640                         queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1641                                                                                                 protocol, spi, FALSE, FALSE));
1642                 }
1643                 else
1644                 {
1645                         child_sa->set_state(child_sa, CHILD_REKEYING);
1646                         cfg = child_sa->get_config(child_sa);
1647                         task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1648                                 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1649                         task->use_reqid(task, child_sa->get_reqid(child_sa));
1650                         task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1651
1652                         queue_task(this, &task->task);
1653                 }
1654         }
1655 }
1656
1657 METHOD(task_manager_t, queue_child_delete, void,
1658         private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1659         bool expired)
1660 {
1661         queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1662                                                                                                   spi, FALSE, expired));
1663 }
1664
1665 METHOD(task_manager_t, queue_dpd, void,
1666         private_task_manager_t *this)
1667 {
1668         peer_cfg_t *peer_cfg;
1669         u_int32_t t, retransmit;
1670
1671         queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1672                                                                                                 this->dpd_send++));
1673         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1674
1675         /* compute timeout in milliseconds */
1676         t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1677         if (t == 0)
1678         {
1679                 /* use the same timeout as a retransmitting IKE message would have */
1680                 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1681                 {
1682                         t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1683                                                         pow(this->retransmit_base, retransmit));
1684                 }
1685         }
1686
1687         /* schedule DPD timeout job */
1688         lib->scheduler->schedule_job_ms(lib->scheduler,
1689                 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1690 }
1691
1692 METHOD(task_manager_t, adopt_tasks, void,
1693         private_task_manager_t *this, task_manager_t *other_public)
1694 {
1695         private_task_manager_t *other = (private_task_manager_t*)other_public;
1696         task_t *task;
1697
1698         /* move queued tasks from other to this */
1699         while (other->queued_tasks->remove_last(other->queued_tasks,
1700                                                                                                 (void**)&task) == SUCCESS)
1701         {
1702                 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1703                 task->migrate(task, this->ike_sa);
1704                 this->queued_tasks->insert_first(this->queued_tasks, task);
1705         }
1706 }
1707
1708 /**
1709  * Migrates child-creating tasks from src to dst
1710  */
1711 static void migrate_child_tasks(private_task_manager_t *this,
1712                                                                 linked_list_t *src, linked_list_t *dst)
1713 {
1714         enumerator_t *enumerator;
1715         task_t *task;
1716
1717         enumerator = src->create_enumerator(src);
1718         while (enumerator->enumerate(enumerator, &task))
1719         {
1720                 if (task->get_type(task) == TASK_QUICK_MODE)
1721                 {
1722                         src->remove_at(src, enumerator);
1723                         task->migrate(task, this->ike_sa);
1724                         dst->insert_last(dst, task);
1725                 }
1726         }
1727         enumerator->destroy(enumerator);
1728 }
1729
1730 METHOD(task_manager_t, adopt_child_tasks, void,
1731         private_task_manager_t *this, task_manager_t *other_public)
1732 {
1733         private_task_manager_t *other = (private_task_manager_t*)other_public;
1734
1735         /* move active child tasks from other to this */
1736         migrate_child_tasks(this, other->active_tasks, this->queued_tasks);
1737         /* do the same for queued tasks */
1738         migrate_child_tasks(this, other->queued_tasks, this->queued_tasks);
1739 }
1740
1741 METHOD(task_manager_t, busy, bool,
1742         private_task_manager_t *this)
1743 {
1744         return (this->active_tasks->get_count(this->active_tasks) > 0);
1745 }
1746
1747 METHOD(task_manager_t, incr_mid, void,
1748         private_task_manager_t *this, bool initiate)
1749 {
1750 }
1751
1752 METHOD(task_manager_t, reset, void,
1753         private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1754 {
1755         enumerator_t *enumerator;
1756         task_t *task;
1757
1758         /* reset message counters and retransmit packets */
1759         clear_packets(this->responding.packets);
1760         clear_packets(this->initiating.packets);
1761         this->responding.seqnr = RESPONDING_SEQ;
1762         this->responding.retransmitted = 0;
1763         this->initiating.mid = 0;
1764         this->initiating.seqnr = 0;
1765         this->initiating.retransmitted = 0;
1766         this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1767         DESTROY_IF(this->defrag);
1768         this->defrag = NULL;
1769         if (initiate != UINT_MAX)
1770         {
1771                 this->dpd_send = initiate;
1772         }
1773         if (respond != UINT_MAX)
1774         {
1775                 this->dpd_recv = respond;
1776         }
1777
1778         /* reset queued tasks */
1779         enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1780         while (enumerator->enumerate(enumerator, &task))
1781         {
1782                 task->migrate(task, this->ike_sa);
1783         }
1784         enumerator->destroy(enumerator);
1785
1786         /* reset active tasks */
1787         while (this->active_tasks->remove_last(this->active_tasks,
1788                                                                                    (void**)&task) == SUCCESS)
1789         {
1790                 task->migrate(task, this->ike_sa);
1791                 this->queued_tasks->insert_first(this->queued_tasks, task);
1792         }
1793 }
1794
1795 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1796         private_task_manager_t *this, task_queue_t queue)
1797 {
1798         switch (queue)
1799         {
1800                 case TASK_QUEUE_ACTIVE:
1801                         return this->active_tasks->create_enumerator(this->active_tasks);
1802                 case TASK_QUEUE_PASSIVE:
1803                         return this->passive_tasks->create_enumerator(this->passive_tasks);
1804                 case TASK_QUEUE_QUEUED:
1805                         return this->queued_tasks->create_enumerator(this->queued_tasks);
1806                 default:
1807                         return enumerator_create_empty();
1808         }
1809 }
1810
1811 METHOD(task_manager_t, destroy, void,
1812         private_task_manager_t *this)
1813 {
1814         flush(this);
1815
1816         this->active_tasks->destroy(this->active_tasks);
1817         this->queued_tasks->destroy(this->queued_tasks);
1818         this->passive_tasks->destroy(this->passive_tasks);
1819         DESTROY_IF(this->defrag);
1820
1821         DESTROY_IF(this->queued);
1822         clear_packets(this->responding.packets);
1823         array_destroy(this->responding.packets);
1824         clear_packets(this->initiating.packets);
1825         array_destroy(this->initiating.packets);
1826         DESTROY_IF(this->rng);
1827         free(this);
1828 }
1829
1830 /*
1831  * see header file
1832  */
1833 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1834 {
1835         private_task_manager_t *this;
1836
1837         INIT(this,
1838                 .public = {
1839                         .task_manager = {
1840                                 .process_message = _process_message,
1841                                 .queue_task = _queue_task,
1842                                 .queue_ike = _queue_ike,
1843                                 .queue_ike_rekey = _queue_ike_rekey,
1844                                 .queue_ike_reauth = _queue_ike_reauth,
1845                                 .queue_ike_delete = _queue_ike_delete,
1846                                 .queue_mobike = _queue_mobike,
1847                                 .queue_child = _queue_child,
1848                                 .queue_child_rekey = _queue_child_rekey,
1849                                 .queue_child_delete = _queue_child_delete,
1850                                 .queue_dpd = _queue_dpd,
1851                                 .initiate = _initiate,
1852                                 .retransmit = _retransmit,
1853                                 .incr_mid = _incr_mid,
1854                                 .reset = _reset,
1855                                 .adopt_tasks = _adopt_tasks,
1856                                 .adopt_child_tasks = _adopt_child_tasks,
1857                                 .busy = _busy,
1858                                 .create_task_enumerator = _create_task_enumerator,
1859                                 .flush = _flush,
1860                                 .flush_queue = _flush_queue,
1861                                 .destroy = _destroy,
1862                         },
1863                 },
1864                 .initiating = {
1865                         .type = EXCHANGE_TYPE_UNDEFINED,
1866                 },
1867                 .responding = {
1868                         .seqnr = RESPONDING_SEQ,
1869                 },
1870                 .ike_sa = ike_sa,
1871                 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
1872                 .queued_tasks = linked_list_create(),
1873                 .active_tasks = linked_list_create(),
1874                 .passive_tasks = linked_list_create(),
1875                 .retransmit_tries = lib->settings->get_int(lib->settings,
1876                                                 "%s.retransmit_tries", RETRANSMIT_TRIES, lib->ns),
1877                 .retransmit_timeout = lib->settings->get_double(lib->settings,
1878                                                 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, lib->ns),
1879                 .retransmit_base = lib->settings->get_double(lib->settings,
1880                                                 "%s.retransmit_base", RETRANSMIT_BASE, lib->ns),
1881         );
1882
1883         if (!this->rng)
1884         {
1885                 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
1886                 destroy(this);
1887                 return NULL;
1888         }
1889         if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
1890                                                           (void*)&this->dpd_send))
1891         {
1892                 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
1893                 destroy(this);
1894                 return NULL;
1895         }
1896         this->dpd_send &= 0x7FFFFFFF;
1897
1898         return &this->public;
1899 }