]> git.ipfire.org Git - thirdparty/strongswan.git/blob - src/libcharon/sa/ikev1/task_manager_v1.c
projects / thirdparty / strongswan.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'vip-shunts'
[thirdparty/strongswan.git] / src / libcharon / sa / ikev1 / task_manager_v1.c
1 /*
2 * Copyright (C) 2007-2013 Tobias Brunner
3 * Copyright (C) 2007-2011 Martin Willi
4 * Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include "task_manager_v1.h"
18
19 #include <math.h>
20
21 #include <daemon.h>
22 #include <sa/ikev1/tasks/main_mode.h>
23 #include <sa/ikev1/tasks/aggressive_mode.h>
24 #include <sa/ikev1/tasks/quick_mode.h>
25 #include <sa/ikev1/tasks/quick_delete.h>
26 #include <sa/ikev1/tasks/xauth.h>
27 #include <sa/ikev1/tasks/mode_config.h>
28 #include <sa/ikev1/tasks/informational.h>
29 #include <sa/ikev1/tasks/isakmp_natd.h>
30 #include <sa/ikev1/tasks/isakmp_vendor.h>
31 #include <sa/ikev1/tasks/isakmp_cert_pre.h>
32 #include <sa/ikev1/tasks/isakmp_cert_post.h>
33 #include <sa/ikev1/tasks/isakmp_delete.h>
34 #include <sa/ikev1/tasks/isakmp_dpd.h>
35
36 #include <processing/jobs/retransmit_job.h>
37 #include <processing/jobs/delete_ike_sa_job.h>
38 #include <processing/jobs/dpd_timeout_job.h>
39 #include <processing/jobs/process_message_job.h>
40
41 #include <encoding/payloads/fragment_payload.h>
42 #include <bio/bio_writer.h>
43
44 /**
45 * Number of old messages hashes we keep for retransmission.
46 *
47 * In Main Mode, we must ignore messages from a previous message pair if
48 * we already continued to the next. Otherwise a late retransmission
49 * could be considered as a reply to the newer request.
50 */
51 #define MAX_OLD_HASHES 2
52
53 /**
54 * Maximum packet size for fragmented packets (same as in sockets)
55 */
56 #define MAX_PACKET 10000
57
58 /**
59 * Maximum size of fragment data when sending packets (currently the same is
60 * used for IPv4 and IPv6, even though the latter has a higher minimum datagram
61 * size). 576 (= min. IPv4) - 20 (= IP header) - 8 (= UDP header) -
62 * - 28 (= IKE header) - 8 (= fragment header) = 512
63 * This is reduced by 4 in case of NAT-T (due to the non-ESP marker).
64 */
65 #define MAX_FRAGMENT_SIZE 512
66
67 /**
68 * First sequence number of responding packets.
69 *
70 * To distinguish retransmission jobs for initiating and responding packets,
71 * we split up the sequence counter and use the upper half for responding.
72 */
73 #define RESPONDING_SEQ INT_MAX
74
75 typedef struct exchange_t exchange_t;
76
77 /**
78 * An exchange in the air, used do detect and handle retransmission
79 */
80 struct exchange_t {
81
82 /**
83 * Message ID used for this transaction
84 */
85 u_int32_t mid;
86
87 /**
88 * generated packet for retransmission
89 */
90 packet_t *packet;
91 };
92
93 typedef struct private_task_manager_t private_task_manager_t;
94
95 /**
96 * private data of the task manager
97 */
98 struct private_task_manager_t {
99
100 /**
101 * public functions
102 */
103 task_manager_v1_t public;
104
105 /**
106 * associated IKE_SA we are serving
107 */
108 ike_sa_t *ike_sa;
109
110 /**
111 * RNG to create message IDs
112 */
113 rng_t *rng;
114
115 /**
116 * Exchange we are currently handling as responder
117 */
118 struct {
119 /**
120 * Message ID of the last response
121 */
122 u_int32_t mid;
123
124 /**
125 * Hash of a previously received message
126 */
127 u_int32_t hash;
128
129 /**
130 * packet for retransmission
131 */
132 packet_t *packet;
133
134 /**
135 * Sequence number of the last sent message
136 */
137 u_int32_t seqnr;
138
139 /**
140 * how many times we have retransmitted so far
141 */
142 u_int retransmitted;
143
144 } responding;
145
146 /**
147 * Exchange we are currently handling as initiator
148 */
149 struct {
150 /**
151 * Message ID of the exchange
152 */
153 u_int32_t mid;
154
155 /**
156 * Hashes of old responses we can ignore
157 */
158 u_int32_t old_hashes[MAX_OLD_HASHES];
159
160 /**
161 * Position in old hash array
162 */
163 int old_hash_pos;
164
165 /**
166 * Sequence number of the last sent message
167 */
168 u_int32_t seqnr;
169
170 /**
171 * how many times we have retransmitted so far
172 */
173 u_int retransmitted;
174
175 /**
176 * packet for retransmission
177 */
178 packet_t *packet;
179
180 /**
181 * type of the initiated exchange
182 */
183 exchange_type_t type;
184
185 } initiating;
186
187 /**
188 * Data used to reassemble a fragmented message
189 */
190 struct {
191
192 /**
193 * Fragment ID (currently only one is supported at a time)
194 */
195 u_int16_t id;
196
197 /**
198 * The number of the last fragment (in case we receive the fragments out
199 * of order), since the first starts with 1 this defines the number of
200 * fragments we expect
201 */
202 u_int8_t last;
203
204 /**
205 * List of fragments (fragment_t*)
206 */
207 linked_list_t *list;
208
209 /**
210 * Length of all currently received fragments
211 */
212 size_t len;
213
214 /**
215 * Maximum length of a fragmented packet
216 */
217 size_t max_packet;
218
219 /**
220 * Maximum length of a single fragment (when sending)
221 */
222 size_t size;
223
224 /**
225 * The exchange type we use for fragments. Always the initial type even
226 * for fragmented quick mode or transaction messages (i.e. either
227 * ID_PROT or AGGRESSIVE)
228 */
229 exchange_type_t exchange;
230
231 } frag;
232
233 /**
234 * List of queued tasks not yet in action
235 */
236 linked_list_t *queued_tasks;
237
238 /**
239 * List of active tasks, initiated by ourselves
240 */
241 linked_list_t *active_tasks;
242
243 /**
244 * List of tasks initiated by peer
245 */
246 linked_list_t *passive_tasks;
247
248 /**
249 * Queued messages not yet ready to process
250 */
251 message_t *queued;
252
253 /**
254 * Number of times we retransmit messages before giving up
255 */
256 u_int retransmit_tries;
257
258 /**
259 * Retransmission timeout
260 */
261 double retransmit_timeout;
262
263 /**
264 * Base to calculate retransmission timeout
265 */
266 double retransmit_base;
267
268 /**
269 * Sequence number for sending DPD requests
270 */
271 u_int32_t dpd_send;
272
273 /**
274 * Sequence number for received DPD requests
275 */
276 u_int32_t dpd_recv;
277 };
278
279 /**
280 * A single fragment within a fragmented message
281 */
282 typedef struct {
283
284 /** fragment number */
285 u_int8_t num;
286
287 /** fragment data */
288 chunk_t data;
289
290 } fragment_t;
291
292 static void fragment_destroy(fragment_t *this)
293 {
294 chunk_free(&this->data);
295 free(this);
296 }
297
298 static void clear_fragments(private_task_manager_t *this, u_int16_t id)
299 {
300 DESTROY_FUNCTION_IF(this->frag.list, (void*)fragment_destroy);
301 this->frag.list = NULL;
302 this->frag.last = 0;
303 this->frag.len = 0;
304 this->frag.id = id;
305 }
306
307 METHOD(task_manager_t, flush_queue, void,
308 private_task_manager_t *this, task_queue_t queue)
309 {
310 linked_list_t *list;
311 task_t *task;
312
313 if (this->queued)
314 {
315 this->queued->destroy(this->queued);
316 this->queued = NULL;
317 }
318 switch (queue)
319 {
320 case TASK_QUEUE_ACTIVE:
321 list = this->active_tasks;
322 /* cancel pending retransmits */
323 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
324 DESTROY_IF(this->initiating.packet);
325 this->initiating.packet = NULL;
326 break;
327 case TASK_QUEUE_PASSIVE:
328 list = this->passive_tasks;
329 break;
330 case TASK_QUEUE_QUEUED:
331 list = this->queued_tasks;
332 break;
333 default:
334 return;
335 }
336 while (list->remove_last(list, (void**)&task) == SUCCESS)
337 {
338 task->destroy(task);
339 }
340 }
341
342 /**
343 * flush all tasks in the task manager
344 */
345 static void flush(private_task_manager_t *this)
346 {
347 flush_queue(this, TASK_QUEUE_QUEUED);
348 flush_queue(this, TASK_QUEUE_PASSIVE);
349 flush_queue(this, TASK_QUEUE_ACTIVE);
350 }
351
352 /**
353 * move a task of a specific type from the queue to the active list
354 */
355 static bool activate_task(private_task_manager_t *this, task_type_t type)
356 {
357 enumerator_t *enumerator;
358 task_t *task;
359 bool found = FALSE;
360
361 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
362 while (enumerator->enumerate(enumerator, (void**)&task))
363 {
364 if (task->get_type(task) == type)
365 {
366 DBG2(DBG_IKE, " activating %N task", task_type_names, type);
367 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
368 this->active_tasks->insert_last(this->active_tasks, task);
369 found = TRUE;
370 break;
371 }
372 }
373 enumerator->destroy(enumerator);
374 return found;
375 }
376
377 /**
378 * Send a single fragment with the given data
379 */
380 static bool send_fragment(private_task_manager_t *this, bool request,
381 host_t *src, host_t *dst, fragment_payload_t *fragment)
382 {
383 message_t *message;
384 packet_t *packet;
385 status_t status;
386
387 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
388 /* other implementations seem to just use 0 as message ID, so here we go */
389 message->set_message_id(message, 0);
390 message->set_request(message, request);
391 message->set_source(message, src->clone(src));
392 message->set_destination(message, dst->clone(dst));
393 message->set_exchange_type(message, this->frag.exchange);
394 message->add_payload(message, (payload_t*)fragment);
395
396 status = this->ike_sa->generate_message(this->ike_sa, message, &packet);
397 if (status != SUCCESS)
398 {
399 DBG1(DBG_IKE, "failed to generate IKE fragment");
400 message->destroy(message);
401 return FALSE;
402 }
403 charon->sender->send(charon->sender, packet);
404 message->destroy(message);
405 return TRUE;
406 }
407
408 /**
409 * Send a packet, if supported and required do so in fragments
410 */
411 static bool send_packet(private_task_manager_t *this, bool request,
412 packet_t *packet)
413 {
414 fragmentation_t fragmentation = FRAGMENTATION_NO;
415 ike_cfg_t *ike_cfg;
416 host_t *src, *dst;
417 chunk_t data;
418
419 ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
420 if (ike_cfg)
421 {
422 fragmentation = ike_cfg->fragmentation(ike_cfg);
423 }
424 data = packet->get_data(packet);
425 if (data.len > this->frag.size && (fragmentation == FRAGMENTATION_FORCE ||
426 (this->ike_sa->supports_extension(this->ike_sa, EXT_IKE_FRAGMENTATION) &&
427 fragmentation == FRAGMENTATION_YES)))
428 {
429 fragment_payload_t *fragment;
430 u_int8_t num, count;
431 size_t len, frag_size;
432 bool nat;
433
434 /* reduce size due to non-ESP marker */
435 nat = this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY);
436 frag_size = this->frag.size - (nat ? 4 : 0);
437
438 src = packet->get_source(packet);
439 dst = packet->get_destination(packet);
440 count = (data.len / (frag_size + 1)) + 1;
441
442 DBG1(DBG_IKE, "sending IKE message with length of %zu bytes in "
443 "%hhu fragments", data.len, count);
444 for (num = 1; num <= count; num++)
445 {
446 len = min(data.len, frag_size);
447 fragment = fragment_payload_create_from_data(num, num == count,
448 chunk_create(data.ptr, len));
449 if (!send_fragment(this, request, src, dst, fragment))
450 {
451 packet->destroy(packet);
452 return FALSE;
453 }
454 data = chunk_skip(data, len);
455 }
456 packet->destroy(packet);
457 return TRUE;
458 }
459 charon->sender->send(charon->sender, packet);
460 return TRUE;
461 }
462
463 /**
464 * Retransmit a packet, either as initiator or as responder
465 */
466 static status_t retransmit_packet(private_task_manager_t *this, bool request,
467 u_int32_t seqnr, u_int mid, u_int retransmitted, packet_t *packet)
468 {
469 u_int32_t t;
470
471 if (retransmitted > this->retransmit_tries)
472 {
473 DBG1(DBG_IKE, "giving up after %u retransmits", retransmitted - 1);
474 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND_TIMEOUT, packet);
475 return DESTROY_ME;
476 }
477 t = (u_int32_t)(this->retransmit_timeout * 1000.0 *
478 pow(this->retransmit_base, retransmitted));
479 if (retransmitted)
480 {
481 DBG1(DBG_IKE, "sending retransmit %u of %s message ID %u, seq %u",
482 retransmitted, seqnr < RESPONDING_SEQ ? "request" : "response",
483 mid, seqnr < RESPONDING_SEQ ? seqnr : seqnr - RESPONDING_SEQ);
484 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_SEND, packet);
485 }
486 if (!send_packet(this, request, packet->clone(packet)))
487 {
488 return DESTROY_ME;
489 }
490 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
491 retransmit_job_create(seqnr, this->ike_sa->get_id(this->ike_sa)), t);
492 return NEED_MORE;
493 }
494
495 METHOD(task_manager_t, retransmit, status_t,
496 private_task_manager_t *this, u_int32_t seqnr)
497 {
498 status_t status = SUCCESS;
499
500 if (seqnr == this->initiating.seqnr && this->initiating.packet)
501 {
502 status = retransmit_packet(this, TRUE, seqnr, this->initiating.mid,
503 this->initiating.retransmitted, this->initiating.packet);
504 if (status == NEED_MORE)
505 {
506 this->initiating.retransmitted++;
507 status = SUCCESS;
508 }
509 }
510 if (seqnr == this->responding.seqnr && this->responding.packet)
511 {
512 status = retransmit_packet(this, FALSE, seqnr, this->responding.mid,
513 this->responding.retransmitted, this->responding.packet);
514 if (status == NEED_MORE)
515 {
516 this->responding.retransmitted++;
517 status = SUCCESS;
518 }
519 }
520 return status;
521 }
522
523 /**
524 * Check if we have to wait for a mode config before starting a quick mode
525 */
526 static bool mode_config_expected(private_task_manager_t *this)
527 {
528 enumerator_t *enumerator;
529 peer_cfg_t *peer_cfg;
530 char *pool;
531 host_t *host;
532
533 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
534 if (peer_cfg)
535 {
536 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
537 if (!enumerator->enumerate(enumerator, &pool))
538 { /* no pool configured */
539 enumerator->destroy(enumerator);
540 return FALSE;
541 }
542 enumerator->destroy(enumerator);
543
544 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa,
545 FALSE);
546 if (!enumerator->enumerate(enumerator, &host))
547 { /* have a pool, but no VIP assigned yet */
548 enumerator->destroy(enumerator);
549 return TRUE;
550 }
551 enumerator->destroy(enumerator);
552 }
553 return FALSE;
554 }
555
556 METHOD(task_manager_t, initiate, status_t,
557 private_task_manager_t *this)
558 {
559 enumerator_t *enumerator;
560 task_t *task;
561 message_t *message;
562 host_t *me, *other;
563 status_t status;
564 exchange_type_t exchange = EXCHANGE_TYPE_UNDEFINED;
565 bool new_mid = FALSE, expect_response = FALSE, cancelled = FALSE, keep = FALSE;
566
567 if (this->initiating.type != EXCHANGE_TYPE_UNDEFINED &&
568 this->initiating.type != INFORMATIONAL_V1)
569 {
570 DBG2(DBG_IKE, "delaying task initiation, %N exchange in progress",
571 exchange_type_names, this->initiating.type);
572 /* do not initiate if we already have a message in the air */
573 return SUCCESS;
574 }
575
576 if (this->active_tasks->get_count(this->active_tasks) == 0)
577 {
578 DBG2(DBG_IKE, "activating new tasks");
579 switch (this->ike_sa->get_state(this->ike_sa))
580 {
581 case IKE_CREATED:
582 activate_task(this, TASK_ISAKMP_VENDOR);
583 activate_task(this, TASK_ISAKMP_CERT_PRE);
584 if (activate_task(this, TASK_MAIN_MODE))
585 {
586 exchange = ID_PROT;
587 }
588 else if (activate_task(this, TASK_AGGRESSIVE_MODE))
589 {
590 exchange = AGGRESSIVE;
591 }
592 activate_task(this, TASK_ISAKMP_CERT_POST);
593 activate_task(this, TASK_ISAKMP_NATD);
594 break;
595 case IKE_CONNECTING:
596 if (activate_task(this, TASK_ISAKMP_DELETE))
597 {
598 exchange = INFORMATIONAL_V1;
599 new_mid = TRUE;
600 break;
601 }
602 if (activate_task(this, TASK_XAUTH))
603 {
604 exchange = TRANSACTION;
605 new_mid = TRUE;
606 break;
607 }
608 if (activate_task(this, TASK_INFORMATIONAL))
609 {
610 exchange = INFORMATIONAL_V1;
611 new_mid = TRUE;
612 break;
613 }
614 break;
615 case IKE_ESTABLISHED:
616 if (activate_task(this, TASK_MODE_CONFIG))
617 {
618 exchange = TRANSACTION;
619 new_mid = TRUE;
620 break;
621 }
622 if (!mode_config_expected(this) &&
623 activate_task(this, TASK_QUICK_MODE))
624 {
625 exchange = QUICK_MODE;
626 new_mid = TRUE;
627 break;
628 }
629 if (activate_task(this, TASK_INFORMATIONAL))
630 {
631 exchange = INFORMATIONAL_V1;
632 new_mid = TRUE;
633 break;
634 }
635 if (activate_task(this, TASK_QUICK_DELETE))
636 {
637 exchange = INFORMATIONAL_V1;
638 new_mid = TRUE;
639 break;
640 }
641 if (activate_task(this, TASK_ISAKMP_DELETE))
642 {
643 exchange = INFORMATIONAL_V1;
644 new_mid = TRUE;
645 break;
646 }
647 if (activate_task(this, TASK_ISAKMP_DPD))
648 {
649 exchange = INFORMATIONAL_V1;
650 new_mid = TRUE;
651 break;
652 }
653 break;
654 default:
655 break;
656 }
657 }
658 else
659 {
660 DBG2(DBG_IKE, "reinitiating already active tasks");
661 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
662 while (enumerator->enumerate(enumerator, (void**)&task))
663 {
664 DBG2(DBG_IKE, " %N task", task_type_names, task->get_type(task));
665 switch (task->get_type(task))
666 {
667 case TASK_MAIN_MODE:
668 exchange = ID_PROT;
669 break;
670 case TASK_AGGRESSIVE_MODE:
671 exchange = AGGRESSIVE;
672 break;
673 case TASK_QUICK_MODE:
674 exchange = QUICK_MODE;
675 break;
676 case TASK_XAUTH:
677 exchange = TRANSACTION;
678 new_mid = TRUE;
679 break;
680 default:
681 continue;
682 }
683 break;
684 }
685 enumerator->destroy(enumerator);
686 }
687
688 if (exchange == EXCHANGE_TYPE_UNDEFINED)
689 {
690 DBG2(DBG_IKE, "nothing to initiate");
691 /* nothing to do yet... */
692 return SUCCESS;
693 }
694
695 me = this->ike_sa->get_my_host(this->ike_sa);
696 other = this->ike_sa->get_other_host(this->ike_sa);
697
698 if (new_mid)
699 {
700 if (!this->rng->get_bytes(this->rng, sizeof(this->initiating.mid),
701 (void*)&this->initiating.mid))
702 {
703 DBG1(DBG_IKE, "failed to allocate message ID, destroying IKE_SA");
704 flush(this);
705 return DESTROY_ME;
706 }
707 }
708 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
709 message->set_message_id(message, this->initiating.mid);
710 message->set_source(message, me->clone(me));
711 message->set_destination(message, other->clone(other));
712 message->set_exchange_type(message, exchange);
713 this->initiating.type = exchange;
714 this->initiating.retransmitted = 0;
715
716 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
717 while (enumerator->enumerate(enumerator, (void*)&task))
718 {
719 switch (task->build(task, message))
720 {
721 case SUCCESS:
722 /* task completed, remove it */
723 this->active_tasks->remove_at(this->active_tasks, enumerator);
724 if (task->get_type(task) == TASK_AGGRESSIVE_MODE ||
725 task->get_type(task) == TASK_QUICK_MODE)
726 { /* last message of three message exchange */
727 keep = TRUE;
728 }
729 task->destroy(task);
730 continue;
731 case NEED_MORE:
732 expect_response = TRUE;
733 /* processed, but task needs another exchange */
734 continue;
735 case ALREADY_DONE:
736 cancelled = TRUE;
737 break;
738 case FAILED:
739 default:
740 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
741 {
742 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
743 }
744 /* FALL */
745 case DESTROY_ME:
746 /* critical failure, destroy IKE_SA */
747 enumerator->destroy(enumerator);
748 message->destroy(message);
749 flush(this);
750 return DESTROY_ME;
751 }
752 break;
753 }
754 enumerator->destroy(enumerator);
755
756 if (this->active_tasks->get_count(this->active_tasks) == 0 &&
757 (exchange == QUICK_MODE || exchange == AGGRESSIVE))
758 { /* tasks completed, no exchange active anymore */
759 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
760 }
761 if (cancelled)
762 {
763 message->destroy(message);
764 return initiate(this);
765 }
766
767 DESTROY_IF(this->initiating.packet);
768 status = this->ike_sa->generate_message(this->ike_sa, message,
769 &this->initiating.packet);
770 if (status != SUCCESS)
771 {
772 /* message generation failed. There is nothing more to do than to
773 * close the SA */
774 message->destroy(message);
775 flush(this);
776 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
777 return DESTROY_ME;
778 }
779
780 this->initiating.seqnr++;
781 if (expect_response)
782 {
783 message->destroy(message);
784 return retransmit(this, this->initiating.seqnr);
785 }
786 if (keep)
787 { /* keep the packet for retransmission, the responder might request it */
788 send_packet(this, TRUE,
789 this->initiating.packet->clone(this->initiating.packet));
790 }
791 else
792 {
793 send_packet(this, TRUE, this->initiating.packet);
794 this->initiating.packet = NULL;
795 }
796 message->destroy(message);
797
798 if (exchange == INFORMATIONAL_V1)
799 {
800 switch (this->ike_sa->get_state(this->ike_sa))
801 {
802 case IKE_CONNECTING:
803 /* close after sending an INFORMATIONAL when unestablished */
804 return FAILED;
805 case IKE_DELETING:
806 /* close after sending a DELETE */
807 return DESTROY_ME;
808 default:
809 break;
810 }
811 }
812 return initiate(this);
813 }
814
815 /**
816 * build a response depending on the "passive" task list
817 */
818 static status_t build_response(private_task_manager_t *this, message_t *request)
819 {
820 enumerator_t *enumerator;
821 task_t *task;
822 message_t *message;
823 host_t *me, *other;
824 bool delete = FALSE, cancelled = FALSE, expect_request = FALSE;
825 status_t status;
826
827 me = request->get_destination(request);
828 other = request->get_source(request);
829
830 message = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
831 message->set_exchange_type(message, request->get_exchange_type(request));
832 /* send response along the path the request came in */
833 message->set_source(message, me->clone(me));
834 message->set_destination(message, other->clone(other));
835 message->set_message_id(message, request->get_message_id(request));
836 message->set_request(message, FALSE);
837
838 this->responding.mid = request->get_message_id(request);
839 this->responding.retransmitted = 0;
840 this->responding.seqnr++;
841
842 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
843 while (enumerator->enumerate(enumerator, (void*)&task))
844 {
845 switch (task->build(task, message))
846 {
847 case SUCCESS:
848 /* task completed, remove it */
849 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
850 task->destroy(task);
851 continue;
852 case NEED_MORE:
853 /* processed, but task needs another exchange */
854 if (task->get_type(task) == TASK_QUICK_MODE ||
855 task->get_type(task) == TASK_AGGRESSIVE_MODE)
856 { /* we rely on initiator retransmission, except for
857 * three-message exchanges */
858 expect_request = TRUE;
859 }
860 continue;
861 case ALREADY_DONE:
862 cancelled = TRUE;
863 break;
864 case FAILED:
865 default:
866 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
867 /* FALL */
868 case DESTROY_ME:
869 /* destroy IKE_SA, but SEND response first */
870 delete = TRUE;
871 break;
872 }
873 break;
874 }
875 enumerator->destroy(enumerator);
876
877 DESTROY_IF(this->responding.packet);
878 this->responding.packet = NULL;
879 if (cancelled)
880 {
881 message->destroy(message);
882 return initiate(this);
883 }
884 status = this->ike_sa->generate_message(this->ike_sa, message,
885 &this->responding.packet);
886 message->destroy(message);
887 if (status != SUCCESS)
888 {
889 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
890 return DESTROY_ME;
891 }
892
893 if (expect_request && !delete)
894 {
895 return retransmit(this, this->responding.seqnr);
896 }
897 send_packet(this, FALSE,
898 this->responding.packet->clone(this->responding.packet));
899 if (delete)
900 {
901 return DESTROY_ME;
902 }
903 return SUCCESS;
904 }
905
906 /**
907 * Send a notify in a separate INFORMATIONAL exchange back to the sender.
908 * The notify protocol_id is set to ISAKMP
909 */
910 static void send_notify(private_task_manager_t *this, message_t *request,
911 notify_type_t type)
912 {
913 message_t *response;
914 packet_t *packet;
915 host_t *me, *other;
916 u_int32_t mid;
917
918 if (request->get_exchange_type(request) == INFORMATIONAL_V1)
919 { /* don't respond to INFORMATIONAL requests to avoid a notify war */
920 DBG1(DBG_IKE, "ignore malformed INFORMATIONAL request");
921 return;
922 }
923 if (!this->rng->get_bytes(this->rng, sizeof(mid), (void*)&mid))
924 {
925 DBG1(DBG_IKE, "failed to allocate message ID");
926 return;
927 }
928 response = message_create(IKEV1_MAJOR_VERSION, IKEV1_MINOR_VERSION);
929 response->set_exchange_type(response, INFORMATIONAL_V1);
930 response->set_request(response, TRUE);
931 response->set_message_id(response, mid);
932 response->add_payload(response, (payload_t*)
933 notify_payload_create_from_protocol_and_type(NOTIFY_V1,
934 PROTO_IKE, type));
935
936 me = this->ike_sa->get_my_host(this->ike_sa);
937 if (me->is_anyaddr(me))
938 {
939 me = request->get_destination(request);
940 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
941 }
942 other = this->ike_sa->get_other_host(this->ike_sa);
943 if (other->is_anyaddr(other))
944 {
945 other = request->get_source(request);
946 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
947 }
948 response->set_source(response, me->clone(me));
949 response->set_destination(response, other->clone(other));
950 if (this->ike_sa->generate_message(this->ike_sa, response,
951 &packet) == SUCCESS)
952 {
953 send_packet(this, TRUE, packet);
954 }
955 response->destroy(response);
956 }
957
958 /**
959 * Process a DPD request/response
960 */
961 static bool process_dpd(private_task_manager_t *this, message_t *message)
962 {
963 notify_payload_t *notify;
964 notify_type_t type;
965 u_int32_t seq;
966 chunk_t data;
967
968 type = DPD_R_U_THERE;
969 notify = message->get_notify(message, type);
970 if (!notify)
971 {
972 type = DPD_R_U_THERE_ACK;
973 notify = message->get_notify(message, type);
974 }
975 if (!notify)
976 {
977 return FALSE;
978 }
979 data = notify->get_notification_data(notify);
980 if (data.len != 4)
981 {
982 return FALSE;
983 }
984 seq = untoh32(data.ptr);
985
986 if (type == DPD_R_U_THERE)
987 {
988 if (this->dpd_recv == 0 || seq == this->dpd_recv)
989 { /* check sequence validity */
990 this->dpd_recv = seq + 1;
991 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
992 time_monotonic(NULL));
993 }
994 /* but respond anyway */
995 this->ike_sa->queue_task(this->ike_sa,
996 &isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE_ACK, seq)->task);
997 }
998 else /* DPD_R_U_THERE_ACK */
999 {
1000 if (seq == this->dpd_send - 1)
1001 {
1002 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1003 time_monotonic(NULL));
1004 }
1005 else
1006 {
1007 DBG1(DBG_IKE, "received invalid DPD sequence number %u "
1008 "(expected %u), ignored", seq, this->dpd_send - 1);
1009 }
1010 }
1011 return TRUE;
1012 }
1013
1014 /**
1015 * handle an incoming request message
1016 */
1017 static status_t process_request(private_task_manager_t *this,
1018 message_t *message)
1019 {
1020 enumerator_t *enumerator;
1021 task_t *task = NULL;
1022 bool send_response = FALSE, dpd = FALSE;
1023
1024 if (message->get_exchange_type(message) == INFORMATIONAL_V1 ||
1025 this->passive_tasks->get_count(this->passive_tasks) == 0)
1026 { /* create tasks depending on request type, if not already some queued */
1027 switch (message->get_exchange_type(message))
1028 {
1029 case ID_PROT:
1030 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
1031 this->passive_tasks->insert_last(this->passive_tasks, task);
1032 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
1033 this->passive_tasks->insert_last(this->passive_tasks, task);
1034 task = (task_t *)main_mode_create(this->ike_sa, FALSE);
1035 this->passive_tasks->insert_last(this->passive_tasks, task);
1036 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
1037 this->passive_tasks->insert_last(this->passive_tasks, task);
1038 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
1039 this->passive_tasks->insert_last(this->passive_tasks, task);
1040 break;
1041 case AGGRESSIVE:
1042 task = (task_t *)isakmp_vendor_create(this->ike_sa, FALSE);
1043 this->passive_tasks->insert_last(this->passive_tasks, task);
1044 task = (task_t*)isakmp_cert_pre_create(this->ike_sa, FALSE);
1045 this->passive_tasks->insert_last(this->passive_tasks, task);
1046 task = (task_t *)aggressive_mode_create(this->ike_sa, FALSE);
1047 this->passive_tasks->insert_last(this->passive_tasks, task);
1048 task = (task_t*)isakmp_cert_post_create(this->ike_sa, FALSE);
1049 this->passive_tasks->insert_last(this->passive_tasks, task);
1050 task = (task_t *)isakmp_natd_create(this->ike_sa, FALSE);
1051 this->passive_tasks->insert_last(this->passive_tasks, task);
1052 this->frag.exchange = AGGRESSIVE;
1053 break;
1054 case QUICK_MODE:
1055 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1056 {
1057 DBG1(DBG_IKE, "received quick mode request for "
1058 "unestablished IKE_SA, ignored");
1059 return FAILED;
1060 }
1061 task = (task_t *)quick_mode_create(this->ike_sa, NULL,
1062 NULL, NULL);
1063 this->passive_tasks->insert_last(this->passive_tasks, task);
1064 break;
1065 case INFORMATIONAL_V1:
1066 if (process_dpd(this, message))
1067 {
1068 dpd = TRUE;
1069 }
1070 else
1071 {
1072 task = (task_t *)informational_create(this->ike_sa, NULL);
1073 this->passive_tasks->insert_first(this->passive_tasks, task);
1074 }
1075 break;
1076 case TRANSACTION:
1077 if (this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING)
1078 {
1079 task = (task_t *)mode_config_create(this->ike_sa, FALSE);
1080 }
1081 else
1082 {
1083 task = (task_t *)xauth_create(this->ike_sa, FALSE);
1084 }
1085 this->passive_tasks->insert_last(this->passive_tasks, task);
1086 break;
1087 default:
1088 return FAILED;
1089 }
1090 }
1091 if (dpd)
1092 {
1093 return initiate(this);
1094 }
1095 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND, time_monotonic(NULL));
1096
1097 /* let the tasks process the message */
1098 enumerator = this->passive_tasks->create_enumerator(this->passive_tasks);
1099 while (enumerator->enumerate(enumerator, (void*)&task))
1100 {
1101 switch (task->process(task, message))
1102 {
1103 case SUCCESS:
1104 /* task completed, remove it */
1105 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1106 task->destroy(task);
1107 continue;
1108 case NEED_MORE:
1109 /* processed, but task needs at least another call to build() */
1110 send_response = TRUE;
1111 continue;
1112 case ALREADY_DONE:
1113 send_response = FALSE;
1114 break;
1115 case FAILED:
1116 default:
1117 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1118 /* FALL */
1119 case DESTROY_ME:
1120 /* critical failure, destroy IKE_SA */
1121 this->passive_tasks->remove_at(this->passive_tasks, enumerator);
1122 enumerator->destroy(enumerator);
1123 task->destroy(task);
1124 return DESTROY_ME;
1125 }
1126 break;
1127 }
1128 enumerator->destroy(enumerator);
1129
1130 if (send_response)
1131 {
1132 if (build_response(this, message) != SUCCESS)
1133 {
1134 return DESTROY_ME;
1135 }
1136 }
1137 else
1138 { /* We don't send a response, so don't retransmit one if we get
1139 * the same message again. */
1140 DESTROY_IF(this->responding.packet);
1141 this->responding.packet = NULL;
1142 }
1143 if (this->passive_tasks->get_count(this->passive_tasks) == 0 &&
1144 this->queued_tasks->get_count(this->queued_tasks) > 0)
1145 {
1146 /* passive tasks completed, check if an active task has been queued,
1147 * such as XAUTH or modeconfig push */
1148 return initiate(this);
1149 }
1150 return SUCCESS;
1151 }
1152
1153 /**
1154 * handle an incoming response message
1155 */
1156 static status_t process_response(private_task_manager_t *this,
1157 message_t *message)
1158 {
1159 enumerator_t *enumerator;
1160 message_t *queued;
1161 status_t status;
1162 task_t *task;
1163
1164 if (message->get_exchange_type(message) != this->initiating.type)
1165 {
1166 DBG1(DBG_IKE, "received %N response, but expected %N",
1167 exchange_type_names, message->get_exchange_type(message),
1168 exchange_type_names, this->initiating.type);
1169 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1170 return DESTROY_ME;
1171 }
1172
1173 enumerator = this->active_tasks->create_enumerator(this->active_tasks);
1174 while (enumerator->enumerate(enumerator, (void*)&task))
1175 {
1176 switch (task->process(task, message))
1177 {
1178 case SUCCESS:
1179 /* task completed, remove it */
1180 this->active_tasks->remove_at(this->active_tasks, enumerator);
1181 task->destroy(task);
1182 continue;
1183 case NEED_MORE:
1184 /* processed, but task needs another exchange */
1185 continue;
1186 case ALREADY_DONE:
1187 break;
1188 case FAILED:
1189 default:
1190 charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
1191 /* FALL */
1192 case DESTROY_ME:
1193 /* critical failure, destroy IKE_SA */
1194 this->active_tasks->remove_at(this->active_tasks, enumerator);
1195 enumerator->destroy(enumerator);
1196 task->destroy(task);
1197 return DESTROY_ME;
1198 }
1199 break;
1200 }
1201 enumerator->destroy(enumerator);
1202
1203 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1204 DESTROY_IF(this->initiating.packet);
1205 this->initiating.packet = NULL;
1206
1207 if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0)
1208 {
1209 queued = this->queued;
1210 this->queued = NULL;
1211 status = this->public.task_manager.process_message(
1212 &this->public.task_manager, queued);
1213 queued->destroy(queued);
1214 if (status == DESTROY_ME)
1215 {
1216 return status;
1217 }
1218 }
1219
1220 return initiate(this);
1221 }
1222
1223 static status_t handle_fragment(private_task_manager_t *this, message_t *msg)
1224 {
1225 fragment_payload_t *payload;
1226 enumerator_t *enumerator;
1227 fragment_t *fragment;
1228 status_t status = SUCCESS;
1229 chunk_t data;
1230 u_int8_t num;
1231
1232 payload = (fragment_payload_t*)msg->get_payload(msg, FRAGMENT_V1);
1233 if (!payload)
1234 {
1235 return FAILED;
1236 }
1237
1238 if (this->frag.id != payload->get_id(payload))
1239 {
1240 clear_fragments(this, payload->get_id(payload));
1241 this->frag.list = linked_list_create();
1242 }
1243
1244 num = payload->get_number(payload);
1245 if (!this->frag.last && payload->is_last(payload))
1246 {
1247 this->frag.last = num;
1248 }
1249
1250 enumerator = this->frag.list->create_enumerator(this->frag.list);
1251 while (enumerator->enumerate(enumerator, &fragment))
1252 {
1253 if (fragment->num == num)
1254 { /* ignore a duplicate fragment */
1255 DBG1(DBG_IKE, "received duplicate fragment #%hhu", num);
1256 enumerator->destroy(enumerator);
1257 return NEED_MORE;
1258 }
1259 if (fragment->num > num)
1260 {
1261 break;
1262 }
1263 }
1264
1265 data = payload->get_data(payload);
1266 this->frag.len += data.len;
1267 if (this->frag.len > this->frag.max_packet)
1268 {
1269 DBG1(DBG_IKE, "fragmented IKE message is too large");
1270 enumerator->destroy(enumerator);
1271 clear_fragments(this, 0);
1272 return FAILED;
1273 }
1274
1275 INIT(fragment,
1276 .num = num,
1277 .data = chunk_clone(data),
1278 );
1279
1280 this->frag.list->insert_before(this->frag.list, enumerator, fragment);
1281 enumerator->destroy(enumerator);
1282
1283 if (this->frag.list->get_count(this->frag.list) == this->frag.last)
1284 {
1285 message_t *message;
1286 packet_t *pkt;
1287 host_t *src, *dst;
1288 bio_writer_t *writer;
1289
1290 writer = bio_writer_create(this->frag.len);
1291 DBG1(DBG_IKE, "received fragment #%hhu, reassembling fragmented IKE "
1292 "message", num);
1293 enumerator = this->frag.list->create_enumerator(this->frag.list);
1294 while (enumerator->enumerate(enumerator, &fragment))
1295 {
1296 writer->write_data(writer, fragment->data);
1297 }
1298 enumerator->destroy(enumerator);
1299
1300 src = msg->get_source(msg);
1301 dst = msg->get_destination(msg);
1302 pkt = packet_create_from_data(src->clone(src), dst->clone(dst),
1303 writer->extract_buf(writer));
1304 writer->destroy(writer);
1305
1306 message = message_create_from_packet(pkt);
1307 if (message->parse_header(message) != SUCCESS)
1308 {
1309 DBG1(DBG_IKE, "failed to parse header of reassembled IKE message");
1310 message->destroy(message);
1311 status = FAILED;
1312 }
1313 else
1314 {
1315 lib->processor->queue_job(lib->processor,
1316 (job_t*)process_message_job_create(message));
1317 status = NEED_MORE;
1318
1319 }
1320 clear_fragments(this, 0);
1321 }
1322 else
1323 { /* there are some fragments missing */
1324 DBG1(DBG_IKE, "received fragment #%hhu, waiting for complete IKE "
1325 "message", num);
1326 status = NEED_MORE;
1327 }
1328 return status;
1329 }
1330
1331 /**
1332 * Parse the given message and verify that it is valid.
1333 */
1334 static status_t parse_message(private_task_manager_t *this, message_t *msg)
1335 {
1336 status_t status;
1337
1338 status = msg->parse_body(msg, this->ike_sa->get_keymat(this->ike_sa));
1339
1340 if (status != SUCCESS)
1341 {
1342 switch (status)
1343 {
1344 case NOT_SUPPORTED:
1345 DBG1(DBG_IKE, "unsupported exchange type");
1346 send_notify(this, msg, INVALID_EXCHANGE_TYPE);
1347 break;
1348 case PARSE_ERROR:
1349 DBG1(DBG_IKE, "message parsing failed");
1350 send_notify(this, msg, PAYLOAD_MALFORMED);
1351 break;
1352 case VERIFY_ERROR:
1353 DBG1(DBG_IKE, "message verification failed");
1354 send_notify(this, msg, PAYLOAD_MALFORMED);
1355 break;
1356 case FAILED:
1357 DBG1(DBG_IKE, "integrity check failed");
1358 send_notify(this, msg, INVALID_HASH_INFORMATION);
1359 break;
1360 case INVALID_STATE:
1361 DBG1(DBG_IKE, "found encrypted message, but no keys available");
1362 send_notify(this, msg, PAYLOAD_MALFORMED);
1363 default:
1364 break;
1365 }
1366 DBG1(DBG_IKE, "%N %s with message ID %u processing failed",
1367 exchange_type_names, msg->get_exchange_type(msg),
1368 msg->get_request(msg) ? "request" : "response",
1369 msg->get_message_id(msg));
1370
1371 charon->bus->alert(charon->bus, ALERT_PARSE_ERROR_BODY, msg, status);
1372
1373 if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED)
1374 { /* invalid initiation attempt, close SA */
1375 return DESTROY_ME;
1376 }
1377 }
1378
1379 if (msg->get_first_payload_type(msg) == FRAGMENT_V1)
1380 {
1381 return handle_fragment(this, msg);
1382 }
1383 return status;
1384 }
1385
1386 METHOD(task_manager_t, process_message, status_t,
1387 private_task_manager_t *this, message_t *msg)
1388 {
1389 u_int32_t hash, mid, i;
1390 host_t *me, *other;
1391 status_t status;
1392
1393 /* TODO-IKEv1: update hosts more selectively */
1394 me = msg->get_destination(msg);
1395 other = msg->get_source(msg);
1396 mid = msg->get_message_id(msg);
1397 hash = chunk_hash(msg->get_packet_data(msg));
1398 for (i = 0; i < MAX_OLD_HASHES; i++)
1399 {
1400 if (this->initiating.old_hashes[i] == hash)
1401 {
1402 if (this->initiating.packet &&
1403 i == (this->initiating.old_hash_pos % MAX_OLD_HASHES) &&
1404 (msg->get_exchange_type(msg) == QUICK_MODE ||
1405 msg->get_exchange_type(msg) == AGGRESSIVE))
1406 {
1407 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1408 "resending last request", mid);
1409 send_packet(this, TRUE,
1410 this->initiating.packet->clone(this->initiating.packet));
1411 return SUCCESS;
1412 }
1413 DBG1(DBG_IKE, "received retransmit of response with ID %u, "
1414 "but next request already sent", mid);
1415 return SUCCESS;
1416 }
1417 }
1418
1419 if ((mid && mid == this->initiating.mid) ||
1420 (this->initiating.mid == 0 &&
1421 msg->get_exchange_type(msg) == this->initiating.type &&
1422 this->active_tasks->get_count(this->active_tasks)))
1423 {
1424 msg->set_request(msg, FALSE);
1425 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1426 status = parse_message(this, msg);
1427 if (status == NEED_MORE)
1428 {
1429 return SUCCESS;
1430 }
1431 if (status != SUCCESS)
1432 {
1433 return status;
1434 }
1435 this->ike_sa->set_statistic(this->ike_sa, STAT_INBOUND,
1436 time_monotonic(NULL));
1437 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1438 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1439 if (process_response(this, msg) != SUCCESS)
1440 {
1441 flush(this);
1442 return DESTROY_ME;
1443 }
1444 this->initiating.old_hashes[(++this->initiating.old_hash_pos) %
1445 MAX_OLD_HASHES] = hash;
1446 }
1447 else
1448 {
1449 if (hash == this->responding.hash)
1450 {
1451 if (this->responding.packet)
1452 {
1453 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1454 "retransmitting response", mid);
1455 send_packet(this, FALSE,
1456 this->responding.packet->clone(this->responding.packet));
1457 }
1458 else if (this->initiating.packet &&
1459 this->initiating.type == INFORMATIONAL_V1)
1460 {
1461 DBG1(DBG_IKE, "received retransmit of DPD request, "
1462 "retransmitting response");
1463 send_packet(this, TRUE,
1464 this->initiating.packet->clone(this->initiating.packet));
1465 }
1466 else
1467 {
1468 DBG1(DBG_IKE, "received retransmit of request with ID %u, "
1469 "but no response to retransmit", mid);
1470 }
1471 charon->bus->alert(charon->bus, ALERT_RETRANSMIT_RECEIVE, msg);
1472 return SUCCESS;
1473 }
1474
1475 /* reject Main/Agressive Modes once established */
1476 if (msg->get_exchange_type(msg) == ID_PROT ||
1477 msg->get_exchange_type(msg) == AGGRESSIVE)
1478 {
1479 if (this->ike_sa->get_state(this->ike_sa) != IKE_CREATED &&
1480 this->ike_sa->get_state(this->ike_sa) != IKE_CONNECTING &&
1481 msg->get_first_payload_type(msg) != FRAGMENT_V1)
1482 {
1483 DBG1(DBG_IKE, "ignoring %N in established IKE_SA state",
1484 exchange_type_names, msg->get_exchange_type(msg));
1485 return FAILED;
1486 }
1487 }
1488
1489 if (msg->get_exchange_type(msg) == TRANSACTION &&
1490 this->active_tasks->get_count(this->active_tasks))
1491 { /* main mode not yet complete, queue XAuth/Mode config tasks */
1492 if (this->queued)
1493 {
1494 DBG1(DBG_IKE, "ignoring additional %N request, queue full",
1495 exchange_type_names, TRANSACTION);
1496 return SUCCESS;
1497 }
1498 this->queued = message_create_from_packet(msg->get_packet(msg));
1499 if (this->queued->parse_header(this->queued) != SUCCESS)
1500 {
1501 this->queued->destroy(this->queued);
1502 this->queued = NULL;
1503 return FAILED;
1504 }
1505 DBG1(DBG_IKE, "queueing %N request as tasks still active",
1506 exchange_type_names, TRANSACTION);
1507 return SUCCESS;
1508 }
1509
1510 msg->set_request(msg, TRUE);
1511 charon->bus->message(charon->bus, msg, TRUE, FALSE);
1512 status = parse_message(this, msg);
1513 if (status == NEED_MORE)
1514 {
1515 return SUCCESS;
1516 }
1517 if (status != SUCCESS)
1518 {
1519 return status;
1520 }
1521 /* if this IKE_SA is virgin, we check for a config */
1522 if (this->ike_sa->get_ike_cfg(this->ike_sa) == NULL)
1523 {
1524 ike_sa_id_t *ike_sa_id;
1525 ike_cfg_t *ike_cfg;
1526 job_t *job;
1527
1528 ike_cfg = charon->backends->get_ike_cfg(charon->backends,
1529 me, other, IKEV1);
1530 if (ike_cfg == NULL)
1531 {
1532 /* no config found for these hosts, destroy */
1533 DBG1(DBG_IKE, "no IKE config found for %H...%H, sending %N",
1534 me, other, notify_type_names, NO_PROPOSAL_CHOSEN);
1535 send_notify(this, msg, NO_PROPOSAL_CHOSEN);
1536 return DESTROY_ME;
1537 }
1538 this->ike_sa->set_ike_cfg(this->ike_sa, ike_cfg);
1539 ike_cfg->destroy(ike_cfg);
1540 /* add a timeout if peer does not establish it completely */
1541 ike_sa_id = this->ike_sa->get_id(this->ike_sa);
1542 job = (job_t*)delete_ike_sa_job_create(ike_sa_id, FALSE);
1543 lib->scheduler->schedule_job(lib->scheduler, job,
1544 lib->settings->get_int(lib->settings,
1545 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT,
1546 charon->name));
1547 }
1548 this->ike_sa->update_hosts(this->ike_sa, me, other, TRUE);
1549 charon->bus->message(charon->bus, msg, TRUE, TRUE);
1550 if (process_request(this, msg) != SUCCESS)
1551 {
1552 flush(this);
1553 return DESTROY_ME;
1554 }
1555 this->responding.hash = hash;
1556 }
1557 return SUCCESS;
1558 }
1559
1560 METHOD(task_manager_t, queue_task, void,
1561 private_task_manager_t *this, task_t *task)
1562 {
1563 DBG2(DBG_IKE, "queueing %N task", task_type_names, task->get_type(task));
1564 this->queued_tasks->insert_last(this->queued_tasks, task);
1565 }
1566
1567 /**
1568 * Check if a given task has been queued already
1569 */
1570 static bool has_queued(private_task_manager_t *this, task_type_t type)
1571 {
1572 enumerator_t *enumerator;
1573 bool found = FALSE;
1574 task_t *task;
1575
1576 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1577 while (enumerator->enumerate(enumerator, &task))
1578 {
1579 if (task->get_type(task) == type)
1580 {
1581 found = TRUE;
1582 break;
1583 }
1584 }
1585 enumerator->destroy(enumerator);
1586 return found;
1587 }
1588
1589 METHOD(task_manager_t, queue_ike, void,
1590 private_task_manager_t *this)
1591 {
1592 peer_cfg_t *peer_cfg;
1593
1594 if (!has_queued(this, TASK_ISAKMP_VENDOR))
1595 {
1596 queue_task(this, (task_t*)isakmp_vendor_create(this->ike_sa, TRUE));
1597 }
1598 if (!has_queued(this, TASK_ISAKMP_CERT_PRE))
1599 {
1600 queue_task(this, (task_t*)isakmp_cert_pre_create(this->ike_sa, TRUE));
1601 }
1602 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1603 if (peer_cfg->use_aggressive(peer_cfg))
1604 {
1605 if (!has_queued(this, TASK_AGGRESSIVE_MODE))
1606 {
1607 queue_task(this, (task_t*)aggressive_mode_create(this->ike_sa, TRUE));
1608 }
1609 this->frag.exchange = AGGRESSIVE;
1610 }
1611 else
1612 {
1613 if (!has_queued(this, TASK_MAIN_MODE))
1614 {
1615 queue_task(this, (task_t*)main_mode_create(this->ike_sa, TRUE));
1616 }
1617 }
1618 if (!has_queued(this, TASK_ISAKMP_CERT_POST))
1619 {
1620 queue_task(this, (task_t*)isakmp_cert_post_create(this->ike_sa, TRUE));
1621 }
1622 if (!has_queued(this, TASK_ISAKMP_NATD))
1623 {
1624 queue_task(this, (task_t*)isakmp_natd_create(this->ike_sa, TRUE));
1625 }
1626 }
1627
1628 METHOD(task_manager_t, queue_ike_reauth, void,
1629 private_task_manager_t *this)
1630 {
1631 enumerator_t *enumerator;
1632 child_sa_t *child_sa;
1633 ike_sa_t *new;
1634 host_t *host;
1635
1636 new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
1637 this->ike_sa->get_version(this->ike_sa), TRUE);
1638 if (!new)
1639 { /* shouldn't happen */
1640 return;
1641 }
1642
1643 new->set_peer_cfg(new, this->ike_sa->get_peer_cfg(this->ike_sa));
1644 host = this->ike_sa->get_other_host(this->ike_sa);
1645 new->set_other_host(new, host->clone(host));
1646 host = this->ike_sa->get_my_host(this->ike_sa);
1647 new->set_my_host(new, host->clone(host));
1648 enumerator = this->ike_sa->create_virtual_ip_enumerator(this->ike_sa, TRUE);
1649 while (enumerator->enumerate(enumerator, &host))
1650 {
1651 new->add_virtual_ip(new, TRUE, host);
1652 }
1653 enumerator->destroy(enumerator);
1654
1655 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1656 while (enumerator->enumerate(enumerator, &child_sa))
1657 {
1658 this->ike_sa->remove_child_sa(this->ike_sa, enumerator);
1659 new->add_child_sa(new, child_sa);
1660 }
1661 enumerator->destroy(enumerator);
1662
1663 if (!new->get_child_count(new))
1664 { /* check if a Quick Mode task is queued (UNITY_LOAD_BALANCE case) */
1665 task_t *task;
1666
1667 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1668 while (enumerator->enumerate(enumerator, &task))
1669 {
1670 if (task->get_type(task) == TASK_QUICK_MODE)
1671 {
1672 this->queued_tasks->remove_at(this->queued_tasks, enumerator);
1673 task->migrate(task, new);
1674 new->queue_task(new, task);
1675 }
1676 }
1677 enumerator->destroy(enumerator);
1678 }
1679
1680 if (new->initiate(new, NULL, 0, NULL, NULL) != DESTROY_ME)
1681 {
1682 charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
1683 this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
1684 }
1685 else
1686 {
1687 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
1688 DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
1689 }
1690 charon->bus->set_sa(charon->bus, this->ike_sa);
1691 }
1692
1693 METHOD(task_manager_t, queue_ike_rekey, void,
1694 private_task_manager_t *this)
1695 {
1696 queue_ike_reauth(this);
1697 }
1698
1699 METHOD(task_manager_t, queue_ike_delete, void,
1700 private_task_manager_t *this)
1701 {
1702 enumerator_t *enumerator;
1703 child_sa_t *child_sa;
1704
1705 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1706 while (enumerator->enumerate(enumerator, &child_sa))
1707 {
1708 queue_task(this, (task_t*)
1709 quick_delete_create(this->ike_sa, child_sa->get_protocol(child_sa),
1710 child_sa->get_spi(child_sa, TRUE), FALSE, FALSE));
1711 }
1712 enumerator->destroy(enumerator);
1713
1714 queue_task(this, (task_t*)isakmp_delete_create(this->ike_sa, TRUE));
1715 }
1716
1717 METHOD(task_manager_t, queue_mobike, void,
1718 private_task_manager_t *this, bool roam, bool address)
1719 {
1720 /* Not supported in IKEv1 */
1721 }
1722
1723 METHOD(task_manager_t, queue_child, void,
1724 private_task_manager_t *this, child_cfg_t *cfg, u_int32_t reqid,
1725 traffic_selector_t *tsi, traffic_selector_t *tsr)
1726 {
1727 quick_mode_t *task;
1728
1729 task = quick_mode_create(this->ike_sa, cfg, tsi, tsr);
1730 task->use_reqid(task, reqid);
1731
1732 queue_task(this, &task->task);
1733 }
1734
1735 /**
1736 * Check if two CHILD_SAs have the same traffic selector
1737 */
1738 static bool have_equal_ts(child_sa_t *a, child_sa_t *b, bool local)
1739 {
1740 linked_list_t *list;
1741 traffic_selector_t *ts_a, *ts_b;
1742
1743 list = a->get_traffic_selectors(a, local);
1744 if (list->get_first(list, (void**)&ts_a) == SUCCESS)
1745 {
1746 list = b->get_traffic_selectors(b, local);
1747 if (list->get_first(list, (void**)&ts_b) == SUCCESS)
1748 {
1749 return ts_a->equals(ts_a, ts_b);
1750 }
1751 }
1752 return FALSE;
1753 }
1754
1755 /**
1756 * Check if a CHILD_SA is redundant and we should delete instead of rekey
1757 */
1758 static bool is_redundant(private_task_manager_t *this, child_sa_t *child_sa)
1759 {
1760 enumerator_t *enumerator;
1761 child_sa_t *current;
1762 bool redundant = FALSE;
1763
1764 enumerator = this->ike_sa->create_child_sa_enumerator(this->ike_sa);
1765 while (enumerator->enumerate(enumerator, &current))
1766 {
1767 if (current->get_state(current) == CHILD_INSTALLED &&
1768 streq(current->get_name(current), child_sa->get_name(child_sa)) &&
1769 have_equal_ts(current, child_sa, TRUE) &&
1770 have_equal_ts(current, child_sa, FALSE) &&
1771 current->get_lifetime(current, FALSE) >
1772 child_sa->get_lifetime(child_sa, FALSE))
1773 {
1774 DBG1(DBG_IKE, "deleting redundant CHILD_SA %s{%d}",
1775 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa));
1776 redundant = TRUE;
1777 break;
1778 }
1779 }
1780 enumerator->destroy(enumerator);
1781
1782 return redundant;
1783 }
1784
1785 /**
1786 * Get the first traffic selector of a CHILD_SA, local or remote
1787 */
1788 static traffic_selector_t* get_first_ts(child_sa_t *child_sa, bool local)
1789 {
1790 traffic_selector_t *ts = NULL;
1791 linked_list_t *list;
1792
1793 list = child_sa->get_traffic_selectors(child_sa, local);
1794 if (list->get_first(list, (void**)&ts) == SUCCESS)
1795 {
1796 return ts;
1797 }
1798 return NULL;
1799 }
1800
1801 METHOD(task_manager_t, queue_child_rekey, void,
1802 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
1803 {
1804 child_sa_t *child_sa;
1805 child_cfg_t *cfg;
1806 quick_mode_t *task;
1807
1808 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, TRUE);
1809 if (!child_sa)
1810 {
1811 child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
1812 }
1813 if (child_sa && child_sa->get_state(child_sa) == CHILD_INSTALLED)
1814 {
1815 if (is_redundant(this, child_sa))
1816 {
1817 queue_task(this, (task_t*)quick_delete_create(this->ike_sa,
1818 protocol, spi, FALSE, FALSE));
1819 }
1820 else
1821 {
1822 child_sa->set_state(child_sa, CHILD_REKEYING);
1823 cfg = child_sa->get_config(child_sa);
1824 task = quick_mode_create(this->ike_sa, cfg->get_ref(cfg),
1825 get_first_ts(child_sa, TRUE), get_first_ts(child_sa, FALSE));
1826 task->use_reqid(task, child_sa->get_reqid(child_sa));
1827 task->rekey(task, child_sa->get_spi(child_sa, TRUE));
1828
1829 queue_task(this, &task->task);
1830 }
1831 }
1832 }
1833
1834 METHOD(task_manager_t, queue_child_delete, void,
1835 private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
1836 bool expired)
1837 {
1838 queue_task(this, (task_t*)quick_delete_create(this->ike_sa, protocol,
1839 spi, FALSE, expired));
1840 }
1841
1842 METHOD(task_manager_t, queue_dpd, void,
1843 private_task_manager_t *this)
1844 {
1845 peer_cfg_t *peer_cfg;
1846 u_int32_t t, retransmit;
1847
1848 queue_task(this, (task_t*)isakmp_dpd_create(this->ike_sa, DPD_R_U_THERE,
1849 this->dpd_send++));
1850 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1851
1852 /* compute timeout in milliseconds */
1853 t = 1000 * peer_cfg->get_dpd_timeout(peer_cfg);
1854 if (t == 0)
1855 {
1856 /* use the same timeout as a retransmitting IKE message would have */
1857 for (retransmit = 0; retransmit <= this->retransmit_tries; retransmit++)
1858 {
1859 t += (u_int32_t)(this->retransmit_timeout * 1000.0 *
1860 pow(this->retransmit_base, retransmit));
1861 }
1862 }
1863
1864 /* schedule DPD timeout job */
1865 lib->scheduler->schedule_job_ms(lib->scheduler,
1866 (job_t*)dpd_timeout_job_create(this->ike_sa->get_id(this->ike_sa)), t);
1867 }
1868
1869 METHOD(task_manager_t, adopt_tasks, void,
1870 private_task_manager_t *this, task_manager_t *other_public)
1871 {
1872 private_task_manager_t *other = (private_task_manager_t*)other_public;
1873 task_t *task;
1874
1875 /* move queued tasks from other to this */
1876 while (other->queued_tasks->remove_last(other->queued_tasks,
1877 (void**)&task) == SUCCESS)
1878 {
1879 DBG2(DBG_IKE, "migrating %N task", task_type_names, task->get_type(task));
1880 task->migrate(task, this->ike_sa);
1881 this->queued_tasks->insert_first(this->queued_tasks, task);
1882 }
1883 }
1884
1885 METHOD(task_manager_t, busy, bool,
1886 private_task_manager_t *this)
1887 {
1888 return (this->active_tasks->get_count(this->active_tasks) > 0);
1889 }
1890
1891 METHOD(task_manager_t, incr_mid, void,
1892 private_task_manager_t *this, bool initiate)
1893 {
1894 }
1895
1896 METHOD(task_manager_t, reset, void,
1897 private_task_manager_t *this, u_int32_t initiate, u_int32_t respond)
1898 {
1899 enumerator_t *enumerator;
1900 task_t *task;
1901
1902 /* reset message counters and retransmit packets */
1903 DESTROY_IF(this->responding.packet);
1904 DESTROY_IF(this->initiating.packet);
1905 this->responding.packet = NULL;
1906 this->responding.seqnr = RESPONDING_SEQ;
1907 this->responding.retransmitted = 0;
1908 this->initiating.packet = NULL;
1909 this->initiating.mid = 0;
1910 this->initiating.seqnr = 0;
1911 this->initiating.retransmitted = 0;
1912 this->initiating.type = EXCHANGE_TYPE_UNDEFINED;
1913 clear_fragments(this, 0);
1914 if (initiate != UINT_MAX)
1915 {
1916 this->dpd_send = initiate;
1917 }
1918 if (respond != UINT_MAX)
1919 {
1920 this->dpd_recv = respond;
1921 }
1922
1923 /* reset queued tasks */
1924 enumerator = this->queued_tasks->create_enumerator(this->queued_tasks);
1925 while (enumerator->enumerate(enumerator, &task))
1926 {
1927 task->migrate(task, this->ike_sa);
1928 }
1929 enumerator->destroy(enumerator);
1930
1931 /* reset active tasks */
1932 while (this->active_tasks->remove_last(this->active_tasks,
1933 (void**)&task) == SUCCESS)
1934 {
1935 task->migrate(task, this->ike_sa);
1936 this->queued_tasks->insert_first(this->queued_tasks, task);
1937 }
1938 }
1939
1940 METHOD(task_manager_t, create_task_enumerator, enumerator_t*,
1941 private_task_manager_t *this, task_queue_t queue)
1942 {
1943 switch (queue)
1944 {
1945 case TASK_QUEUE_ACTIVE:
1946 return this->active_tasks->create_enumerator(this->active_tasks);
1947 case TASK_QUEUE_PASSIVE:
1948 return this->passive_tasks->create_enumerator(this->passive_tasks);
1949 case TASK_QUEUE_QUEUED:
1950 return this->queued_tasks->create_enumerator(this->queued_tasks);
1951 default:
1952 return enumerator_create_empty();
1953 }
1954 }
1955
1956 METHOD(task_manager_t, destroy, void,
1957 private_task_manager_t *this)
1958 {
1959 flush(this);
1960
1961 this->active_tasks->destroy(this->active_tasks);
1962 this->queued_tasks->destroy(this->queued_tasks);
1963 this->passive_tasks->destroy(this->passive_tasks);
1964 clear_fragments(this, 0);
1965
1966 DESTROY_IF(this->queued);
1967 DESTROY_IF(this->responding.packet);
1968 DESTROY_IF(this->initiating.packet);
1969 DESTROY_IF(this->rng);
1970 free(this);
1971 }
1972
1973 /*
1974 * see header file
1975 */
1976 task_manager_v1_t *task_manager_v1_create(ike_sa_t *ike_sa)
1977 {
1978 private_task_manager_t *this;
1979
1980 INIT(this,
1981 .public = {
1982 .task_manager = {
1983 .process_message = _process_message,
1984 .queue_task = _queue_task,
1985 .queue_ike = _queue_ike,
1986 .queue_ike_rekey = _queue_ike_rekey,
1987 .queue_ike_reauth = _queue_ike_reauth,
1988 .queue_ike_delete = _queue_ike_delete,
1989 .queue_mobike = _queue_mobike,
1990 .queue_child = _queue_child,
1991 .queue_child_rekey = _queue_child_rekey,
1992 .queue_child_delete = _queue_child_delete,
1993 .queue_dpd = _queue_dpd,
1994 .initiate = _initiate,
1995 .retransmit = _retransmit,
1996 .incr_mid = _incr_mid,
1997 .reset = _reset,
1998 .adopt_tasks = _adopt_tasks,
1999 .busy = _busy,
2000 .create_task_enumerator = _create_task_enumerator,
2001 .flush_queue = _flush_queue,
2002 .destroy = _destroy,
2003 },
2004 },
2005 .initiating = {
2006 .type = EXCHANGE_TYPE_UNDEFINED,
2007 },
2008 .responding = {
2009 .seqnr = RESPONDING_SEQ,
2010 },
2011 .frag = {
2012 .exchange = ID_PROT,
2013 .max_packet = lib->settings->get_int(lib->settings,
2014 "%s.max_packet", MAX_PACKET, charon->name),
2015 .size = lib->settings->get_int(lib->settings,
2016 "%s.fragment_size", MAX_FRAGMENT_SIZE, charon->name),
2017 },
2018 .ike_sa = ike_sa,
2019 .rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
2020 .queued_tasks = linked_list_create(),
2021 .active_tasks = linked_list_create(),
2022 .passive_tasks = linked_list_create(),
2023 .retransmit_tries = lib->settings->get_int(lib->settings,
2024 "%s.retransmit_tries", RETRANSMIT_TRIES, charon->name),
2025 .retransmit_timeout = lib->settings->get_double(lib->settings,
2026 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT, charon->name),
2027 .retransmit_base = lib->settings->get_double(lib->settings,
2028 "%s.retransmit_base", RETRANSMIT_BASE, charon->name),
2029 );
2030
2031 if (!this->rng)
2032 {
2033 DBG1(DBG_IKE, "no RNG found, unable to create IKE_SA");
2034 destroy(this);
2035 return NULL;
2036 }
2037 if (!this->rng->get_bytes(this->rng, sizeof(this->dpd_send),
2038 (void*)&this->dpd_send))
2039 {
2040 DBG1(DBG_IKE, "failed to allocate message ID, unable to create IKE_SA");
2041 destroy(this);
2042 return NULL;
2043 }
2044 this->dpd_send &= 0x7FFFFFFF;
2045
2046 return &this->public;
2047 }
Unnamed repository; edit this file 'description' to name the repository.