2 * Copyright (C) 2007-2011 Tobias Brunner
3 * Copyright (C) 2007-2010 Martin Willi
4 * Hochschule fuer Technik Rapperswil
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 #include "task_manager_v2.h"
21 #include <collections/array.h>
23 #include <sa/ikev2/tasks/ike_init.h>
24 #include <sa/ikev2/tasks/ike_natd.h>
25 #include <sa/ikev2/tasks/ike_mobike.h>
26 #include <sa/ikev2/tasks/ike_auth.h>
27 #include <sa/ikev2/tasks/ike_auth_lifetime.h>
28 #include <sa/ikev2/tasks/ike_cert_pre.h>
29 #include <sa/ikev2/tasks/ike_cert_post.h>
30 #include <sa/ikev2/tasks/ike_rekey.h>
31 #include <sa/ikev2/tasks/ike_reauth.h>
32 #include <sa/ikev2/tasks/ike_delete.h>
33 #include <sa/ikev2/tasks/ike_config.h>
34 #include <sa/ikev2/tasks/ike_dpd.h>
35 #include <sa/ikev2/tasks/ike_vendor.h>
36 #include <sa/ikev2/tasks/child_create.h>
37 #include <sa/ikev2/tasks/child_rekey.h>
38 #include <sa/ikev2/tasks/child_delete.h>
39 #include <encoding/payloads/delete_payload.h>
40 #include <encoding/payloads/unknown_payload.h>
41 #include <processing/jobs/retransmit_job.h>
42 #include <processing/jobs/delete_ike_sa_job.h>
45 #include <sa/ikev2/tasks/ike_me.h>
48 typedef struct exchange_t exchange_t
;
51 * An exchange in the air, used do detect and handle retransmission
56 * Message ID used for this transaction
61 * generated packet for retransmission
66 typedef struct private_task_manager_t private_task_manager_t
;
69 * private data of the task manager
71 struct private_task_manager_t
{
76 task_manager_v2_t
public;
79 * associated IKE_SA we are serving
84 * Exchange we are currently handling as responder
88 * Message ID of the exchange
93 * packet for retransmission
100 * Exchange we are currently handling as initiator
104 * Message ID of the exchange
109 * how many times we have retransmitted so far
114 * packet for retransmission
119 * type of the initated exchange
121 exchange_type_t type
;
126 * Array of queued tasks not yet in action
128 array_t
*queued_tasks
;
131 * Array of active tasks, initiated by ourselve
133 array_t
*active_tasks
;
136 * Array of tasks initiated by peer
138 array_t
*passive_tasks
;
141 * the task manager has been reset
146 * Number of times we retransmit messages before giving up
148 u_int retransmit_tries
;
151 * Retransmission timeout
153 double retransmit_timeout
;
156 * Base to calculate retransmission timeout
158 double retransmit_base
;
161 METHOD(task_manager_t
, flush_queue
, void,
162 private_task_manager_t
*this, task_queue_t queue
)
169 case TASK_QUEUE_ACTIVE
:
170 array
= this->active_tasks
;
172 case TASK_QUEUE_PASSIVE
:
173 array
= this->passive_tasks
;
175 case TASK_QUEUE_QUEUED
:
176 array
= this->queued_tasks
;
181 while (array_remove(array
, ARRAY_TAIL
, &task
))
187 METHOD(task_manager_t
, flush
, void,
188 private_task_manager_t
*this)
190 flush_queue(this, TASK_QUEUE_QUEUED
);
191 flush_queue(this, TASK_QUEUE_PASSIVE
);
192 flush_queue(this, TASK_QUEUE_ACTIVE
);
196 * move a task of a specific type from the queue to the active list
198 static bool activate_task(private_task_manager_t
*this, task_type_t type
)
200 enumerator_t
*enumerator
;
204 enumerator
= array_create_enumerator(this->queued_tasks
);
205 while (enumerator
->enumerate(enumerator
, (void**)&task
))
207 if (task
->get_type(task
) == type
)
209 DBG2(DBG_IKE
, " activating %N task", task_type_names
, type
);
210 array_remove_at(this->queued_tasks
, enumerator
);
211 array_insert(this->active_tasks
, ARRAY_TAIL
, task
);
216 enumerator
->destroy(enumerator
);
220 METHOD(task_manager_t
, retransmit
, status_t
,
221 private_task_manager_t
*this, u_int32_t message_id
)
223 if (this->initiating
.packet
&& message_id
== this->initiating
.mid
)
227 enumerator_t
*enumerator
;
230 ike_mobike_t
*mobike
= NULL
;
232 /* check if we are retransmitting a MOBIKE routability check */
233 enumerator
= array_create_enumerator(this->active_tasks
);
234 while (enumerator
->enumerate(enumerator
, (void*)&task
))
236 if (task
->get_type(task
) == TASK_IKE_MOBIKE
)
238 mobike
= (ike_mobike_t
*)task
;
239 if (!mobike
->is_probing(mobike
))
246 enumerator
->destroy(enumerator
);
250 if (this->initiating
.retransmitted
<= this->retransmit_tries
)
252 timeout
= (u_int32_t
)(this->retransmit_timeout
* 1000.0 *
253 pow(this->retransmit_base
, this->initiating
.retransmitted
));
257 DBG1(DBG_IKE
, "giving up after %d retransmits",
258 this->initiating
.retransmitted
- 1);
259 charon
->bus
->alert(charon
->bus
, ALERT_RETRANSMIT_SEND_TIMEOUT
,
260 this->initiating
.packet
);
264 if (this->initiating
.retransmitted
)
266 DBG1(DBG_IKE
, "retransmit %d of request with message ID %d",
267 this->initiating
.retransmitted
, message_id
);
268 charon
->bus
->alert(charon
->bus
, ALERT_RETRANSMIT_SEND
,
269 this->initiating
.packet
);
271 packet
= this->initiating
.packet
->clone(this->initiating
.packet
);
272 charon
->sender
->send(charon
->sender
, packet
);
275 { /* for routeability checks, we use a more aggressive behavior */
276 if (this->initiating
.retransmitted
<= ROUTEABILITY_CHECK_TRIES
)
278 timeout
= ROUTEABILITY_CHECK_INTERVAL
;
282 DBG1(DBG_IKE
, "giving up after %d path probings",
283 this->initiating
.retransmitted
- 1);
287 if (this->initiating
.retransmitted
)
289 DBG1(DBG_IKE
, "path probing attempt %d",
290 this->initiating
.retransmitted
);
292 mobike
->transmit(mobike
, this->initiating
.packet
);
295 this->initiating
.retransmitted
++;
296 job
= (job_t
*)retransmit_job_create(this->initiating
.mid
,
297 this->ike_sa
->get_id(this->ike_sa
));
298 lib
->scheduler
->schedule_job_ms(lib
->scheduler
, job
, timeout
);
303 METHOD(task_manager_t
, initiate
, status_t
,
304 private_task_manager_t
*this)
306 enumerator_t
*enumerator
;
311 exchange_type_t exchange
= 0;
313 if (this->initiating
.type
!= EXCHANGE_TYPE_UNDEFINED
)
315 DBG2(DBG_IKE
, "delaying task initiation, %N exchange in progress",
316 exchange_type_names
, this->initiating
.type
);
317 /* do not initiate if we already have a message in the air */
321 if (array_count(this->active_tasks
) == 0)
323 DBG2(DBG_IKE
, "activating new tasks");
324 switch (this->ike_sa
->get_state(this->ike_sa
))
327 activate_task(this, TASK_IKE_VENDOR
);
328 if (activate_task(this, TASK_IKE_INIT
))
330 this->initiating
.mid
= 0;
331 exchange
= IKE_SA_INIT
;
332 activate_task(this, TASK_IKE_NATD
);
333 activate_task(this, TASK_IKE_CERT_PRE
);
335 /* this task has to be activated before the TASK_IKE_AUTH
336 * task, because that task pregenerates the packet after
337 * which no payloads can be added to the message anymore.
339 activate_task(this, TASK_IKE_ME
);
341 activate_task(this, TASK_IKE_AUTH
);
342 activate_task(this, TASK_IKE_CERT_POST
);
343 activate_task(this, TASK_IKE_CONFIG
);
344 activate_task(this, TASK_CHILD_CREATE
);
345 activate_task(this, TASK_IKE_AUTH_LIFETIME
);
346 activate_task(this, TASK_IKE_MOBIKE
);
349 case IKE_ESTABLISHED
:
350 if (activate_task(this, TASK_CHILD_CREATE
))
352 exchange
= CREATE_CHILD_SA
;
355 if (activate_task(this, TASK_CHILD_DELETE
))
357 exchange
= INFORMATIONAL
;
360 if (activate_task(this, TASK_CHILD_REKEY
))
362 exchange
= CREATE_CHILD_SA
;
365 if (activate_task(this, TASK_IKE_DELETE
))
367 exchange
= INFORMATIONAL
;
370 if (activate_task(this, TASK_IKE_REKEY
))
372 exchange
= CREATE_CHILD_SA
;
375 if (activate_task(this, TASK_IKE_REAUTH
))
377 exchange
= INFORMATIONAL
;
380 if (activate_task(this, TASK_IKE_MOBIKE
))
382 exchange
= INFORMATIONAL
;
385 if (activate_task(this, TASK_IKE_DPD
))
387 exchange
= INFORMATIONAL
;
390 if (activate_task(this, TASK_IKE_AUTH_LIFETIME
))
392 exchange
= INFORMATIONAL
;
396 if (activate_task(this, TASK_IKE_ME
))
398 exchange
= ME_CONNECT
;
403 if (activate_task(this, TASK_IKE_DELETE
))
405 exchange
= INFORMATIONAL
;
415 DBG2(DBG_IKE
, "reinitiating already active tasks");
416 enumerator
= array_create_enumerator(this->active_tasks
);
417 while (enumerator
->enumerate(enumerator
, &task
))
419 DBG2(DBG_IKE
, " %N task", task_type_names
, task
->get_type(task
));
420 switch (task
->get_type(task
))
423 exchange
= IKE_SA_INIT
;
428 case TASK_CHILD_CREATE
:
429 case TASK_CHILD_REKEY
:
431 exchange
= CREATE_CHILD_SA
;
433 case TASK_IKE_MOBIKE
:
434 exchange
= INFORMATIONAL
;
441 enumerator
->destroy(enumerator
);
446 DBG2(DBG_IKE
, "nothing to initiate");
447 /* nothing to do yet... */
451 me
= this->ike_sa
->get_my_host(this->ike_sa
);
452 other
= this->ike_sa
->get_other_host(this->ike_sa
);
454 message
= message_create(IKEV2_MAJOR_VERSION
, IKEV2_MINOR_VERSION
);
455 message
->set_message_id(message
, this->initiating
.mid
);
456 message
->set_source(message
, me
->clone(me
));
457 message
->set_destination(message
, other
->clone(other
));
458 message
->set_exchange_type(message
, exchange
);
459 this->initiating
.type
= exchange
;
460 this->initiating
.retransmitted
= 0;
462 enumerator
= array_create_enumerator(this->active_tasks
);
463 while (enumerator
->enumerate(enumerator
, &task
))
465 switch (task
->build(task
, message
))
468 /* task completed, remove it */
469 array_remove_at(this->active_tasks
, enumerator
);
473 /* processed, but task needs another exchange */
477 this->initiating
.type
= EXCHANGE_TYPE_UNDEFINED
;
478 if (this->ike_sa
->get_state(this->ike_sa
) != IKE_CONNECTING
)
480 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
484 /* critical failure, destroy IKE_SA */
485 enumerator
->destroy(enumerator
);
486 message
->destroy(message
);
491 enumerator
->destroy(enumerator
);
493 /* update exchange type if a task changed it */
494 this->initiating
.type
= message
->get_exchange_type(message
);
496 status
= this->ike_sa
->generate_message(this->ike_sa
, message
,
497 &this->initiating
.packet
);
498 if (status
!= SUCCESS
)
500 /* message generation failed. There is nothing more to do than to
502 message
->destroy(message
);
504 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
507 message
->destroy(message
);
509 array_compress(this->active_tasks
);
510 array_compress(this->queued_tasks
);
512 return retransmit(this, this->initiating
.mid
);
516 * handle an incoming response message
518 static status_t
process_response(private_task_manager_t
*this,
521 enumerator_t
*enumerator
;
524 if (message
->get_exchange_type(message
) != this->initiating
.type
)
526 DBG1(DBG_IKE
, "received %N response, but expected %N",
527 exchange_type_names
, message
->get_exchange_type(message
),
528 exchange_type_names
, this->initiating
.type
);
529 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
533 /* catch if we get resetted while processing */
535 enumerator
= array_create_enumerator(this->active_tasks
);
536 while (enumerator
->enumerate(enumerator
, &task
))
538 switch (task
->process(task
, message
))
541 /* task completed, remove it */
542 array_remove_at(this->active_tasks
, enumerator
);
546 /* processed, but task needs another exchange */
550 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
553 /* critical failure, destroy IKE_SA */
554 array_remove_at(this->active_tasks
, enumerator
);
555 enumerator
->destroy(enumerator
);
560 { /* start all over again if we were reset */
562 enumerator
->destroy(enumerator
);
563 return initiate(this);
566 enumerator
->destroy(enumerator
);
568 this->initiating
.mid
++;
569 this->initiating
.type
= EXCHANGE_TYPE_UNDEFINED
;
570 this->initiating
.packet
->destroy(this->initiating
.packet
);
571 this->initiating
.packet
= NULL
;
573 array_compress(this->active_tasks
);
575 return initiate(this);
579 * handle exchange collisions
581 static bool handle_collisions(private_task_manager_t
*this, task_t
*task
)
583 enumerator_t
*enumerator
;
587 type
= task
->get_type(task
);
589 /* do we have to check */
590 if (type
== TASK_IKE_REKEY
|| type
== TASK_CHILD_REKEY
||
591 type
== TASK_CHILD_DELETE
|| type
== TASK_IKE_DELETE
||
592 type
== TASK_IKE_REAUTH
)
594 /* find an exchange collision, and notify these tasks */
595 enumerator
= array_create_enumerator(this->active_tasks
);
596 while (enumerator
->enumerate(enumerator
, &active
))
598 switch (active
->get_type(active
))
601 if (type
== TASK_IKE_REKEY
|| type
== TASK_IKE_DELETE
||
602 type
== TASK_IKE_REAUTH
)
604 ike_rekey_t
*rekey
= (ike_rekey_t
*)active
;
605 rekey
->collide(rekey
, task
);
609 case TASK_CHILD_REKEY
:
610 if (type
== TASK_CHILD_REKEY
|| type
== TASK_CHILD_DELETE
)
612 child_rekey_t
*rekey
= (child_rekey_t
*)active
;
613 rekey
->collide(rekey
, task
);
620 enumerator
->destroy(enumerator
);
623 enumerator
->destroy(enumerator
);
629 * build a response depending on the "passive" task list
631 static status_t
build_response(private_task_manager_t
*this, message_t
*request
)
633 enumerator_t
*enumerator
;
637 bool delete = FALSE
, hook
= FALSE
;
638 ike_sa_id_t
*id
= NULL
;
639 u_int64_t responder_spi
;
642 me
= request
->get_destination(request
);
643 other
= request
->get_source(request
);
645 message
= message_create(IKEV2_MAJOR_VERSION
, IKEV2_MINOR_VERSION
);
646 message
->set_exchange_type(message
, request
->get_exchange_type(request
));
647 /* send response along the path the request came in */
648 message
->set_source(message
, me
->clone(me
));
649 message
->set_destination(message
, other
->clone(other
));
650 message
->set_message_id(message
, this->responding
.mid
);
651 message
->set_request(message
, FALSE
);
653 enumerator
= array_create_enumerator(this->passive_tasks
);
654 while (enumerator
->enumerate(enumerator
, (void*)&task
))
656 switch (task
->build(task
, message
))
659 /* task completed, remove it */
660 array_remove_at(this->passive_tasks
, enumerator
);
661 if (!handle_collisions(this, task
))
667 /* processed, but task needs another exchange */
668 if (handle_collisions(this, task
))
670 array_remove_at(this->passive_tasks
, enumerator
);
678 /* destroy IKE_SA, but SEND response first */
687 enumerator
->destroy(enumerator
);
689 /* RFC 5996, section 2.6 mentions that in the event of a failure during
690 * IKE_SA_INIT the responder's SPI will be 0 in the response, while it
691 * actually explicitly allows it to be non-zero. Since we use the responder
692 * SPI to create hashes in the IKE_SA manager we can only set the SPI to
693 * zero temporarily, otherwise checking the SA in would fail. */
694 if (delete && request
->get_exchange_type(request
) == IKE_SA_INIT
)
696 id
= this->ike_sa
->get_id(this->ike_sa
);
697 responder_spi
= id
->get_responder_spi(id
);
698 id
->set_responder_spi(id
, 0);
701 /* message complete, send it */
702 DESTROY_IF(this->responding
.packet
);
703 this->responding
.packet
= NULL
;
704 status
= this->ike_sa
->generate_message(this->ike_sa
, message
,
705 &this->responding
.packet
);
706 message
->destroy(message
);
709 id
->set_responder_spi(id
, responder_spi
);
711 if (status
!= SUCCESS
)
713 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
717 charon
->sender
->send(charon
->sender
,
718 this->responding
.packet
->clone(this->responding
.packet
));
723 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
728 array_compress(this->passive_tasks
);
734 * handle an incoming request message
736 static status_t
process_request(private_task_manager_t
*this,
739 enumerator_t
*enumerator
;
742 notify_payload_t
*notify
;
743 delete_payload_t
*delete;
745 if (array_count(this->passive_tasks
) == 0)
746 { /* create tasks depending on request type, if not already some queued */
747 switch (message
->get_exchange_type(message
))
751 task
= (task_t
*)ike_vendor_create(this->ike_sa
, FALSE
);
752 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
753 task
= (task_t
*)ike_init_create(this->ike_sa
, FALSE
, NULL
);
754 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
755 task
= (task_t
*)ike_natd_create(this->ike_sa
, FALSE
);
756 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
757 task
= (task_t
*)ike_cert_pre_create(this->ike_sa
, FALSE
);
758 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
760 task
= (task_t
*)ike_me_create(this->ike_sa
, FALSE
);
761 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
763 task
= (task_t
*)ike_auth_create(this->ike_sa
, FALSE
);
764 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
765 task
= (task_t
*)ike_cert_post_create(this->ike_sa
, FALSE
);
766 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
767 task
= (task_t
*)ike_config_create(this->ike_sa
, FALSE
);
768 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
769 task
= (task_t
*)child_create_create(this->ike_sa
, NULL
, FALSE
,
771 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
772 task
= (task_t
*)ike_auth_lifetime_create(this->ike_sa
, FALSE
);
773 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
774 task
= (task_t
*)ike_mobike_create(this->ike_sa
, FALSE
);
775 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
778 case CREATE_CHILD_SA
:
779 { /* FIXME: we should prevent this on mediation connections */
780 bool notify_found
= FALSE
, ts_found
= FALSE
;
781 enumerator
= message
->create_payload_enumerator(message
);
782 while (enumerator
->enumerate(enumerator
, &payload
))
784 switch (payload
->get_type(payload
))
787 { /* if we find a rekey notify, its CHILD_SA rekeying */
788 notify
= (notify_payload_t
*)payload
;
789 if (notify
->get_notify_type(notify
) == REKEY_SA
&&
790 (notify
->get_protocol_id(notify
) == PROTO_AH
||
791 notify
->get_protocol_id(notify
) == PROTO_ESP
))
797 case TRAFFIC_SELECTOR_INITIATOR
:
798 case TRAFFIC_SELECTOR_RESPONDER
:
799 { /* if we don't find a TS, its IKE rekeying */
807 enumerator
->destroy(enumerator
);
813 task
= (task_t
*)child_rekey_create(this->ike_sa
,
818 task
= (task_t
*)child_create_create(this->ike_sa
, NULL
,
824 task
= (task_t
*)ike_rekey_create(this->ike_sa
, FALSE
);
826 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
831 enumerator
= message
->create_payload_enumerator(message
);
832 while (enumerator
->enumerate(enumerator
, &payload
))
834 switch (payload
->get_type(payload
))
838 notify
= (notify_payload_t
*)payload
;
839 switch (notify
->get_notify_type(notify
))
841 case ADDITIONAL_IP4_ADDRESS
:
842 case ADDITIONAL_IP6_ADDRESS
:
843 case NO_ADDITIONAL_ADDRESSES
:
844 case UPDATE_SA_ADDRESSES
:
845 case NO_NATS_ALLOWED
:
846 case UNACCEPTABLE_ADDRESSES
:
847 case UNEXPECTED_NAT_DETECTED
:
849 case NAT_DETECTION_SOURCE_IP
:
850 case NAT_DETECTION_DESTINATION_IP
:
851 task
= (task_t
*)ike_mobike_create(
852 this->ike_sa
, FALSE
);
855 task
= (task_t
*)ike_auth_lifetime_create(
856 this->ike_sa
, FALSE
);
858 case AUTHENTICATION_FAILED
:
859 /* initiator failed to authenticate us.
860 * We use ike_delete to handle this, which
861 * invokes all the required hooks. */
862 task
= (task_t
*)ike_delete_create(
863 this->ike_sa
, FALSE
);
871 delete = (delete_payload_t
*)payload
;
872 if (delete->get_protocol_id(delete) == PROTO_IKE
)
874 task
= (task_t
*)ike_delete_create(this->ike_sa
,
879 task
= (task_t
*)child_delete_create(this->ike_sa
,
880 PROTO_NONE
, 0, FALSE
);
892 enumerator
->destroy(enumerator
);
896 task
= (task_t
*)ike_dpd_create(FALSE
);
898 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
904 task
= (task_t
*)ike_me_create(this->ike_sa
, FALSE
);
905 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
913 /* let the tasks process the message */
914 enumerator
= array_create_enumerator(this->passive_tasks
);
915 while (enumerator
->enumerate(enumerator
, (void*)&task
))
917 switch (task
->process(task
, message
))
920 /* task completed, remove it */
921 array_remove_at(this->passive_tasks
, enumerator
);
925 /* processed, but task needs at least another call to build() */
929 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
932 /* critical failure, destroy IKE_SA */
933 array_remove_at(this->passive_tasks
, enumerator
);
934 enumerator
->destroy(enumerator
);
939 enumerator
->destroy(enumerator
);
941 return build_response(this, message
);
944 METHOD(task_manager_t
, incr_mid
, void,
945 private_task_manager_t
*this, bool initiate
)
949 this->initiating
.mid
++;
953 this->responding
.mid
++;
958 * Send a notify back to the sender
960 static void send_notify_response(private_task_manager_t
*this,
961 message_t
*request
, notify_type_t type
,
968 response
= message_create(IKEV2_MAJOR_VERSION
, IKEV2_MINOR_VERSION
);
969 response
->set_exchange_type(response
, request
->get_exchange_type(request
));
970 response
->set_request(response
, FALSE
);
971 response
->set_message_id(response
, request
->get_message_id(request
));
972 response
->add_notify(response
, FALSE
, type
, data
);
973 me
= this->ike_sa
->get_my_host(this->ike_sa
);
974 if (me
->is_anyaddr(me
))
976 me
= request
->get_destination(request
);
977 this->ike_sa
->set_my_host(this->ike_sa
, me
->clone(me
));
979 other
= this->ike_sa
->get_other_host(this->ike_sa
);
980 if (other
->is_anyaddr(other
))
982 other
= request
->get_source(request
);
983 this->ike_sa
->set_other_host(this->ike_sa
, other
->clone(other
));
985 response
->set_source(response
, me
->clone(me
));
986 response
->set_destination(response
, other
->clone(other
));
987 if (this->ike_sa
->generate_message(this->ike_sa
, response
,
990 charon
->sender
->send(charon
->sender
, packet
);
992 response
->destroy(response
);
996 * Parse the given message and verify that it is valid.
998 static status_t
parse_message(private_task_manager_t
*this, message_t
*msg
)
1003 status
= msg
->parse_body(msg
, this->ike_sa
->get_keymat(this->ike_sa
));
1005 if (status
== SUCCESS
)
1006 { /* check for unsupported critical payloads */
1007 enumerator_t
*enumerator
;
1008 unknown_payload_t
*unknown
;
1011 enumerator
= msg
->create_payload_enumerator(msg
);
1012 while (enumerator
->enumerate(enumerator
, &payload
))
1014 unknown
= (unknown_payload_t
*)payload
;
1015 type
= payload
->get_type(payload
);
1016 if (!payload_is_known(type
) &&
1017 unknown
->is_critical(unknown
))
1019 DBG1(DBG_ENC
, "payload type %N is not supported, "
1020 "but its critical!", payload_type_names
, type
);
1021 status
= NOT_SUPPORTED
;
1025 enumerator
->destroy(enumerator
);
1028 if (status
!= SUCCESS
)
1030 bool is_request
= msg
->get_request(msg
);
1035 DBG1(DBG_IKE
, "critical unknown payloads found");
1038 send_notify_response(this, msg
,
1039 UNSUPPORTED_CRITICAL_PAYLOAD
,
1040 chunk_from_thing(type
));
1041 incr_mid(this, FALSE
);
1045 DBG1(DBG_IKE
, "message parsing failed");
1048 send_notify_response(this, msg
,
1049 INVALID_SYNTAX
, chunk_empty
);
1050 incr_mid(this, FALSE
);
1054 DBG1(DBG_IKE
, "message verification failed");
1057 send_notify_response(this, msg
,
1058 INVALID_SYNTAX
, chunk_empty
);
1059 incr_mid(this, FALSE
);
1063 DBG1(DBG_IKE
, "integrity check failed");
1067 DBG1(DBG_IKE
, "found encrypted message, but no keys available");
1071 DBG1(DBG_IKE
, "%N %s with message ID %d processing failed",
1072 exchange_type_names
, msg
->get_exchange_type(msg
),
1073 is_request
? "request" : "response",
1074 msg
->get_message_id(msg
));
1076 charon
->bus
->alert(charon
->bus
, ALERT_PARSE_ERROR_BODY
, msg
, status
);
1078 if (this->ike_sa
->get_state(this->ike_sa
) == IKE_CREATED
)
1079 { /* invalid initiation attempt, close SA */
1087 METHOD(task_manager_t
, process_message
, status_t
,
1088 private_task_manager_t
*this, message_t
*msg
)
1093 bool schedule_delete_job
= FALSE
;
1095 charon
->bus
->message(charon
->bus
, msg
, TRUE
, FALSE
);
1096 status
= parse_message(this, msg
);
1097 if (status
!= SUCCESS
)
1102 me
= msg
->get_destination(msg
);
1103 other
= msg
->get_source(msg
);
1105 /* if this IKE_SA is virgin, we check for a config */
1106 if (this->ike_sa
->get_ike_cfg(this->ike_sa
) == NULL
)
1110 ike_cfg
= charon
->backends
->get_ike_cfg(charon
->backends
,
1112 if (ike_cfg
== NULL
)
1114 /* no config found for these hosts, destroy */
1115 DBG1(DBG_IKE
, "no IKE config found for %H...%H, sending %N",
1116 me
, other
, notify_type_names
, NO_PROPOSAL_CHOSEN
);
1117 send_notify_response(this, msg
,
1118 NO_PROPOSAL_CHOSEN
, chunk_empty
);
1121 this->ike_sa
->set_ike_cfg(this->ike_sa
, ike_cfg
);
1122 ike_cfg
->destroy(ike_cfg
);
1123 /* add a timeout if peer does not establish it completely */
1124 schedule_delete_job
= TRUE
;
1126 this->ike_sa
->set_statistic(this->ike_sa
, STAT_INBOUND
,
1127 time_monotonic(NULL
));
1129 mid
= msg
->get_message_id(msg
);
1130 if (msg
->get_request(msg
))
1132 if (mid
== this->responding
.mid
)
1134 /* reject initial messages once established */
1135 if (msg
->get_exchange_type(msg
) == IKE_SA_INIT
||
1136 msg
->get_exchange_type(msg
) == IKE_AUTH
)
1138 if (this->ike_sa
->get_state(this->ike_sa
) != IKE_CREATED
&&
1139 this->ike_sa
->get_state(this->ike_sa
) != IKE_CONNECTING
)
1141 DBG1(DBG_IKE
, "ignoring %N in established IKE_SA state",
1142 exchange_type_names
, msg
->get_exchange_type(msg
));
1146 if (!this->ike_sa
->supports_extension(this->ike_sa
, EXT_MOBIKE
))
1147 { /* with MOBIKE, we do no implicit updates */
1148 this->ike_sa
->update_hosts(this->ike_sa
, me
, other
, mid
== 1);
1150 charon
->bus
->message(charon
->bus
, msg
, TRUE
, TRUE
);
1151 if (msg
->get_exchange_type(msg
) == EXCHANGE_TYPE_UNDEFINED
)
1152 { /* ignore messages altered to EXCHANGE_TYPE_UNDEFINED */
1155 if (process_request(this, msg
) != SUCCESS
)
1160 this->responding
.mid
++;
1162 else if ((mid
== this->responding
.mid
- 1) && this->responding
.packet
)
1167 DBG1(DBG_IKE
, "received retransmit of request with ID %d, "
1168 "retransmitting response", mid
);
1169 charon
->bus
->alert(charon
->bus
, ALERT_RETRANSMIT_RECEIVE
, msg
);
1170 clone
= this->responding
.packet
->clone(this->responding
.packet
);
1171 host
= msg
->get_destination(msg
);
1172 clone
->set_source(clone
, host
->clone(host
));
1173 host
= msg
->get_source(msg
);
1174 clone
->set_destination(clone
, host
->clone(host
));
1175 charon
->sender
->send(charon
->sender
, clone
);
1179 DBG1(DBG_IKE
, "received message ID %d, expected %d. Ignored",
1180 mid
, this->responding
.mid
);
1181 if (msg
->get_exchange_type(msg
) == IKE_SA_INIT
)
1182 { /* clean up IKE_SA state if IKE_SA_INIT has invalid msg ID */
1189 if (mid
== this->initiating
.mid
)
1191 if (this->ike_sa
->get_state(this->ike_sa
) == IKE_CREATED
||
1192 this->ike_sa
->get_state(this->ike_sa
) == IKE_CONNECTING
||
1193 msg
->get_exchange_type(msg
) != IKE_SA_INIT
)
1194 { /* only do updates based on verified messages (or initial ones) */
1195 if (!this->ike_sa
->supports_extension(this->ike_sa
, EXT_MOBIKE
))
1196 { /* with MOBIKE, we do no implicit updates. we force an
1197 * update of the local address on IKE_SA_INIT, but never
1198 * for the remote address */
1199 this->ike_sa
->update_hosts(this->ike_sa
, me
, NULL
, mid
== 0);
1200 this->ike_sa
->update_hosts(this->ike_sa
, NULL
, other
, FALSE
);
1203 charon
->bus
->message(charon
->bus
, msg
, TRUE
, TRUE
);
1204 if (msg
->get_exchange_type(msg
) == EXCHANGE_TYPE_UNDEFINED
)
1205 { /* ignore messages altered to EXCHANGE_TYPE_UNDEFINED */
1208 if (process_response(this, msg
) != SUCCESS
)
1216 DBG1(DBG_IKE
, "received message ID %d, expected %d. Ignored",
1217 mid
, this->initiating
.mid
);
1222 if (schedule_delete_job
)
1224 ike_sa_id_t
*ike_sa_id
;
1227 ike_sa_id
= this->ike_sa
->get_id(this->ike_sa
);
1228 job
= (job_t
*)delete_ike_sa_job_create(ike_sa_id
, FALSE
);
1229 lib
->scheduler
->schedule_job(lib
->scheduler
, job
,
1230 lib
->settings
->get_int(lib
->settings
,
1231 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT
,
1237 METHOD(task_manager_t
, queue_task
, void,
1238 private_task_manager_t
*this, task_t
*task
)
1240 if (task
->get_type(task
) == TASK_IKE_MOBIKE
)
1241 { /* there is no need to queue more than one mobike task */
1242 enumerator_t
*enumerator
;
1245 enumerator
= array_create_enumerator(this->queued_tasks
);
1246 while (enumerator
->enumerate(enumerator
, ¤t
))
1248 if (current
->get_type(current
) == TASK_IKE_MOBIKE
)
1250 enumerator
->destroy(enumerator
);
1251 task
->destroy(task
);
1255 enumerator
->destroy(enumerator
);
1257 DBG2(DBG_IKE
, "queueing %N task", task_type_names
, task
->get_type(task
));
1258 array_insert(this->queued_tasks
, ARRAY_TAIL
, task
);
1262 * Check if a given task has been queued already
1264 static bool has_queued(private_task_manager_t
*this, task_type_t type
)
1266 enumerator_t
*enumerator
;
1270 enumerator
= array_create_enumerator(this->queued_tasks
);
1271 while (enumerator
->enumerate(enumerator
, &task
))
1273 if (task
->get_type(task
) == type
)
1279 enumerator
->destroy(enumerator
);
1283 METHOD(task_manager_t
, queue_ike
, void,
1284 private_task_manager_t
*this)
1286 if (!has_queued(this, TASK_IKE_VENDOR
))
1288 queue_task(this, (task_t
*)ike_vendor_create(this->ike_sa
, TRUE
));
1290 if (!has_queued(this, TASK_IKE_INIT
))
1292 queue_task(this, (task_t
*)ike_init_create(this->ike_sa
, TRUE
, NULL
));
1294 if (!has_queued(this, TASK_IKE_NATD
))
1296 queue_task(this, (task_t
*)ike_natd_create(this->ike_sa
, TRUE
));
1298 if (!has_queued(this, TASK_IKE_CERT_PRE
))
1300 queue_task(this, (task_t
*)ike_cert_pre_create(this->ike_sa
, TRUE
));
1302 if (!has_queued(this, TASK_IKE_AUTH
))
1304 queue_task(this, (task_t
*)ike_auth_create(this->ike_sa
, TRUE
));
1306 if (!has_queued(this, TASK_IKE_CERT_POST
))
1308 queue_task(this, (task_t
*)ike_cert_post_create(this->ike_sa
, TRUE
));
1310 if (!has_queued(this, TASK_IKE_CONFIG
))
1312 queue_task(this, (task_t
*)ike_config_create(this->ike_sa
, TRUE
));
1314 if (!has_queued(this, TASK_IKE_AUTH_LIFETIME
))
1316 queue_task(this, (task_t
*)ike_auth_lifetime_create(this->ike_sa
, TRUE
));
1318 if (!has_queued(this, TASK_IKE_MOBIKE
))
1320 peer_cfg_t
*peer_cfg
;
1322 peer_cfg
= this->ike_sa
->get_peer_cfg(this->ike_sa
);
1323 if (peer_cfg
->use_mobike(peer_cfg
))
1325 queue_task(this, (task_t
*)ike_mobike_create(this->ike_sa
, TRUE
));
1329 if (!has_queued(this, TASK_IKE_ME
))
1331 queue_task(this, (task_t
*)ike_me_create(this->ike_sa
, TRUE
));
1336 METHOD(task_manager_t
, queue_ike_rekey
, void,
1337 private_task_manager_t
*this)
1339 queue_task(this, (task_t
*)ike_rekey_create(this->ike_sa
, TRUE
));
1342 METHOD(task_manager_t
, queue_ike_reauth
, void,
1343 private_task_manager_t
*this)
1345 queue_task(this, (task_t
*)ike_reauth_create(this->ike_sa
));
1348 METHOD(task_manager_t
, queue_ike_delete
, void,
1349 private_task_manager_t
*this)
1351 queue_task(this, (task_t
*)ike_delete_create(this->ike_sa
, TRUE
));
1354 METHOD(task_manager_t
, queue_mobike
, void,
1355 private_task_manager_t
*this, bool roam
, bool address
)
1357 ike_mobike_t
*mobike
;
1359 mobike
= ike_mobike_create(this->ike_sa
, TRUE
);
1362 mobike
->roam(mobike
, address
);
1366 mobike
->addresses(mobike
);
1368 queue_task(this, &mobike
->task
);
1371 METHOD(task_manager_t
, queue_child
, void,
1372 private_task_manager_t
*this, child_cfg_t
*cfg
, u_int32_t reqid
,
1373 traffic_selector_t
*tsi
, traffic_selector_t
*tsr
)
1375 child_create_t
*task
;
1377 task
= child_create_create(this->ike_sa
, cfg
, FALSE
, tsi
, tsr
);
1380 task
->use_reqid(task
, reqid
);
1382 queue_task(this, &task
->task
);
1385 METHOD(task_manager_t
, queue_child_rekey
, void,
1386 private_task_manager_t
*this, protocol_id_t protocol
, u_int32_t spi
)
1388 queue_task(this, (task_t
*)child_rekey_create(this->ike_sa
, protocol
, spi
));
1391 METHOD(task_manager_t
, queue_child_delete
, void,
1392 private_task_manager_t
*this, protocol_id_t protocol
, u_int32_t spi
,
1395 queue_task(this, (task_t
*)child_delete_create(this->ike_sa
,
1396 protocol
, spi
, expired
));
1399 METHOD(task_manager_t
, queue_dpd
, void,
1400 private_task_manager_t
*this)
1402 ike_mobike_t
*mobike
;
1404 if (this->ike_sa
->supports_extension(this->ike_sa
, EXT_MOBIKE
) &&
1405 this->ike_sa
->has_condition(this->ike_sa
, COND_NAT_HERE
))
1407 /* use mobike enabled DPD to detect NAT mapping changes */
1408 mobike
= ike_mobike_create(this->ike_sa
, TRUE
);
1409 mobike
->dpd(mobike
);
1410 queue_task(this, &mobike
->task
);
1414 queue_task(this, (task_t
*)ike_dpd_create(TRUE
));
1418 METHOD(task_manager_t
, adopt_tasks
, void,
1419 private_task_manager_t
*this, task_manager_t
*other_public
)
1421 private_task_manager_t
*other
= (private_task_manager_t
*)other_public
;
1424 /* move queued tasks from other to this */
1425 while (array_remove(other
->queued_tasks
, ARRAY_TAIL
, &task
))
1427 DBG2(DBG_IKE
, "migrating %N task", task_type_names
, task
->get_type(task
));
1428 task
->migrate(task
, this->ike_sa
);
1429 array_insert(this->queued_tasks
, ARRAY_HEAD
, task
);
1434 * Migrates child-creating tasks from src to dst
1436 static void migrate_child_tasks(private_task_manager_t
*this,
1437 array_t
*src
, array_t
*dst
)
1439 enumerator_t
*enumerator
;
1442 enumerator
= array_create_enumerator(src
);
1443 while (enumerator
->enumerate(enumerator
, &task
))
1445 if (task
->get_type(task
) == TASK_CHILD_CREATE
)
1447 array_remove_at(src
, enumerator
);
1448 task
->migrate(task
, this->ike_sa
);
1449 array_insert(dst
, ARRAY_TAIL
, task
);
1452 enumerator
->destroy(enumerator
);
1455 METHOD(task_manager_t
, adopt_child_tasks
, void,
1456 private_task_manager_t
*this, task_manager_t
*other_public
)
1458 private_task_manager_t
*other
= (private_task_manager_t
*)other_public
;
1460 /* move active child tasks from other to this */
1461 migrate_child_tasks(this, other
->active_tasks
, this->queued_tasks
);
1462 /* do the same for queued tasks */
1463 migrate_child_tasks(this, other
->queued_tasks
, this->queued_tasks
);
1466 METHOD(task_manager_t
, busy
, bool,
1467 private_task_manager_t
*this)
1469 return array_count(this->active_tasks
) > 0;
1472 METHOD(task_manager_t
, reset
, void,
1473 private_task_manager_t
*this, u_int32_t initiate
, u_int32_t respond
)
1475 enumerator_t
*enumerator
;
1478 /* reset message counters and retransmit packets */
1479 DESTROY_IF(this->responding
.packet
);
1480 DESTROY_IF(this->initiating
.packet
);
1481 this->responding
.packet
= NULL
;
1482 this->initiating
.packet
= NULL
;
1483 if (initiate
!= UINT_MAX
)
1485 this->initiating
.mid
= initiate
;
1487 if (respond
!= UINT_MAX
)
1489 this->responding
.mid
= respond
;
1491 this->initiating
.type
= EXCHANGE_TYPE_UNDEFINED
;
1493 /* reset queued tasks */
1494 enumerator
= array_create_enumerator(this->queued_tasks
);
1495 while (enumerator
->enumerate(enumerator
, &task
))
1497 task
->migrate(task
, this->ike_sa
);
1499 enumerator
->destroy(enumerator
);
1501 /* reset active tasks */
1502 while (array_remove(this->active_tasks
, ARRAY_TAIL
, &task
))
1504 task
->migrate(task
, this->ike_sa
);
1505 array_insert(this->queued_tasks
, ARRAY_HEAD
, task
);
1511 METHOD(task_manager_t
, create_task_enumerator
, enumerator_t
*,
1512 private_task_manager_t
*this, task_queue_t queue
)
1516 case TASK_QUEUE_ACTIVE
:
1517 return array_create_enumerator(this->active_tasks
);
1518 case TASK_QUEUE_PASSIVE
:
1519 return array_create_enumerator(this->passive_tasks
);
1520 case TASK_QUEUE_QUEUED
:
1521 return array_create_enumerator(this->queued_tasks
);
1523 return enumerator_create_empty();
1527 METHOD(task_manager_t
, destroy
, void,
1528 private_task_manager_t
*this)
1532 array_destroy(this->active_tasks
);
1533 array_destroy(this->queued_tasks
);
1534 array_destroy(this->passive_tasks
);
1536 DESTROY_IF(this->responding
.packet
);
1537 DESTROY_IF(this->initiating
.packet
);
1544 task_manager_v2_t
*task_manager_v2_create(ike_sa_t
*ike_sa
)
1546 private_task_manager_t
*this;
1551 .process_message
= _process_message
,
1552 .queue_task
= _queue_task
,
1553 .queue_ike
= _queue_ike
,
1554 .queue_ike_rekey
= _queue_ike_rekey
,
1555 .queue_ike_reauth
= _queue_ike_reauth
,
1556 .queue_ike_delete
= _queue_ike_delete
,
1557 .queue_mobike
= _queue_mobike
,
1558 .queue_child
= _queue_child
,
1559 .queue_child_rekey
= _queue_child_rekey
,
1560 .queue_child_delete
= _queue_child_delete
,
1561 .queue_dpd
= _queue_dpd
,
1562 .initiate
= _initiate
,
1563 .retransmit
= _retransmit
,
1564 .incr_mid
= _incr_mid
,
1566 .adopt_tasks
= _adopt_tasks
,
1567 .adopt_child_tasks
= _adopt_child_tasks
,
1569 .create_task_enumerator
= _create_task_enumerator
,
1571 .flush_queue
= _flush_queue
,
1572 .destroy
= _destroy
,
1576 .initiating
.type
= EXCHANGE_TYPE_UNDEFINED
,
1577 .queued_tasks
= array_create(0, 0),
1578 .active_tasks
= array_create(0, 0),
1579 .passive_tasks
= array_create(0, 0),
1580 .retransmit_tries
= lib
->settings
->get_int(lib
->settings
,
1581 "%s.retransmit_tries", RETRANSMIT_TRIES
, charon
->name
),
1582 .retransmit_timeout
= lib
->settings
->get_double(lib
->settings
,
1583 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT
, charon
->name
),
1584 .retransmit_base
= lib
->settings
->get_double(lib
->settings
,
1585 "%s.retransmit_base", RETRANSMIT_BASE
, charon
->name
),
1588 return &this->public;