2 * Copyright (C) 2007-2016 Tobias Brunner
3 * Copyright (C) 2007-2010 Martin Willi
4 * HSR Hochschule fuer Technik Rapperswil
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 #include "task_manager_v2.h"
21 #include <collections/array.h>
23 #include <sa/ikev2/tasks/ike_init.h>
24 #include <sa/ikev2/tasks/ike_natd.h>
25 #include <sa/ikev2/tasks/ike_mobike.h>
26 #include <sa/ikev2/tasks/ike_auth.h>
27 #include <sa/ikev2/tasks/ike_auth_lifetime.h>
28 #include <sa/ikev2/tasks/ike_cert_pre.h>
29 #include <sa/ikev2/tasks/ike_cert_post.h>
30 #include <sa/ikev2/tasks/ike_rekey.h>
31 #include <sa/ikev2/tasks/ike_reauth.h>
32 #include <sa/ikev2/tasks/ike_reauth_complete.h>
33 #include <sa/ikev2/tasks/ike_redirect.h>
34 #include <sa/ikev2/tasks/ike_delete.h>
35 #include <sa/ikev2/tasks/ike_config.h>
36 #include <sa/ikev2/tasks/ike_dpd.h>
37 #include <sa/ikev2/tasks/ike_mid_sync.h>
38 #include <sa/ikev2/tasks/ike_vendor.h>
39 #include <sa/ikev2/tasks/ike_verify_peer_cert.h>
40 #include <sa/ikev2/tasks/child_create.h>
41 #include <sa/ikev2/tasks/child_rekey.h>
42 #include <sa/ikev2/tasks/child_delete.h>
43 #include <encoding/payloads/delete_payload.h>
44 #include <encoding/payloads/unknown_payload.h>
45 #include <processing/jobs/retransmit_job.h>
46 #include <processing/jobs/delete_ike_sa_job.h>
47 #include <processing/jobs/initiate_tasks_job.h>
50 #include <sa/ikev2/tasks/ike_me.h>
53 typedef struct private_task_manager_t private_task_manager_t
;
54 typedef struct queued_task_t queued_task_t
;
57 * private data of the task manager
59 struct private_task_manager_t
{
64 task_manager_v2_t
public;
67 * associated IKE_SA we are serving
72 * Exchange we are currently handling as responder
76 * Message ID of the exchange
81 * packet(s) for retransmission
86 * Helper to defragment the request
93 * Exchange we are currently handling as initiator
97 * Message ID of the exchange
102 * how many times we have retransmitted so far
107 * packet(s) for retransmission
112 * type of the initated exchange
114 exchange_type_t type
;
117 * TRUE if exchange was deferred because no path was available
122 * Helper to defragment the response
129 * Array of queued tasks not yet in action
131 array_t
*queued_tasks
;
134 * Array of active tasks, initiated by ourselve
136 array_t
*active_tasks
;
139 * Array of tasks initiated by peer
141 array_t
*passive_tasks
;
144 * the task manager has been reset
149 * Number of times we retransmit messages before giving up
151 u_int retransmit_tries
;
154 * Retransmission timeout
156 double retransmit_timeout
;
159 * Base to calculate retransmission timeout
161 double retransmit_base
;
164 * Use make-before-break instead of break-before-make reauth?
166 bool make_before_break
;
172 struct queued_task_t
{
180 * Time before which the task is not to be initiated
186 * Reset retransmission packet list
188 static void clear_packets(array_t
*array
)
192 while (array_remove(array
, ARRAY_TAIL
, &packet
))
194 packet
->destroy(packet
);
198 METHOD(task_manager_t
, flush_queue
, void,
199 private_task_manager_t
*this, task_queue_t queue
)
206 case TASK_QUEUE_ACTIVE
:
207 array
= this->active_tasks
;
209 case TASK_QUEUE_PASSIVE
:
210 array
= this->passive_tasks
;
212 case TASK_QUEUE_QUEUED
:
213 array
= this->queued_tasks
;
218 while (array_remove(array
, ARRAY_TAIL
, &task
))
220 if (queue
== TASK_QUEUE_QUEUED
)
222 queued_task_t
*queued
= (queued_task_t
*)task
;
230 METHOD(task_manager_t
, flush
, void,
231 private_task_manager_t
*this)
233 flush_queue(this, TASK_QUEUE_QUEUED
);
234 flush_queue(this, TASK_QUEUE_PASSIVE
);
235 flush_queue(this, TASK_QUEUE_ACTIVE
);
239 * Move a task of a specific type from the queue to the active list, if it is
242 static bool activate_task(private_task_manager_t
*this, task_type_t type
)
244 enumerator_t
*enumerator
;
245 queued_task_t
*queued
;
249 time_monotonic(&now
);
251 enumerator
= array_create_enumerator(this->queued_tasks
);
252 while (enumerator
->enumerate(enumerator
, (void**)&queued
))
254 if (queued
->task
->get_type(queued
->task
) == type
&&
255 !timercmp(&now
, &queued
->time
, <))
257 DBG2(DBG_IKE
, " activating %N task", task_type_names
, type
);
258 array_remove_at(this->queued_tasks
, enumerator
);
259 array_insert(this->active_tasks
, ARRAY_TAIL
, queued
->task
);
265 enumerator
->destroy(enumerator
);
270 * Send packets in the given array (they get cloned). Optionally, the
271 * source and destination addresses are changed before sending it.
273 static void send_packets(private_task_manager_t
*this, array_t
*packets
,
274 host_t
*src
, host_t
*dst
)
276 packet_t
*packet
, *clone
;
279 for (i
= 0; i
< array_count(packets
); i
++)
281 array_get(packets
, i
, &packet
);
282 clone
= packet
->clone(packet
);
285 clone
->set_source(clone
, src
->clone(src
));
289 clone
->set_destination(clone
, dst
->clone(dst
));
291 charon
->sender
->send(charon
->sender
, clone
);
296 * Generates the given message and stores packet(s) in the given array
298 static bool generate_message(private_task_manager_t
*this, message_t
*message
,
301 enumerator_t
*fragments
;
304 if (this->ike_sa
->generate_message_fragmented(this->ike_sa
, message
,
305 &fragments
) != SUCCESS
)
309 while (fragments
->enumerate(fragments
, &fragment
))
311 array_insert_create(packets
, ARRAY_TAIL
, fragment
);
313 fragments
->destroy(fragments
);
314 array_compress(*packets
);
318 METHOD(task_manager_t
, retransmit
, status_t
,
319 private_task_manager_t
*this, uint32_t message_id
)
321 if (message_id
== this->initiating
.mid
&&
322 array_count(this->initiating
.packets
))
326 enumerator_t
*enumerator
;
329 ike_mobike_t
*mobike
= NULL
;
331 array_get(this->initiating
.packets
, 0, &packet
);
333 /* check if we are retransmitting a MOBIKE routability check */
334 if (this->initiating
.type
== INFORMATIONAL
)
336 enumerator
= array_create_enumerator(this->active_tasks
);
337 while (enumerator
->enumerate(enumerator
, (void*)&task
))
339 if (task
->get_type(task
) == TASK_IKE_MOBIKE
)
341 mobike
= (ike_mobike_t
*)task
;
345 enumerator
->destroy(enumerator
);
348 if (!mobike
|| !mobike
->is_probing(mobike
))
350 if (this->initiating
.retransmitted
<= this->retransmit_tries
)
352 timeout
= (uint32_t)(this->retransmit_timeout
* 1000.0 *
353 pow(this->retransmit_base
, this->initiating
.retransmitted
));
357 DBG1(DBG_IKE
, "giving up after %d retransmits",
358 this->initiating
.retransmitted
- 1);
359 charon
->bus
->alert(charon
->bus
, ALERT_RETRANSMIT_SEND_TIMEOUT
,
364 if (this->initiating
.retransmitted
)
366 DBG1(DBG_IKE
, "retransmit %d of request with message ID %d",
367 this->initiating
.retransmitted
, message_id
);
368 charon
->bus
->alert(charon
->bus
, ALERT_RETRANSMIT_SEND
, packet
,
369 this->initiating
.retransmitted
);
373 send_packets(this, this->initiating
.packets
,
374 this->ike_sa
->get_my_host(this->ike_sa
),
375 this->ike_sa
->get_other_host(this->ike_sa
));
379 if (!mobike
->transmit(mobike
, packet
))
381 DBG1(DBG_IKE
, "no route found to reach peer, MOBIKE update "
383 this->ike_sa
->set_condition(this->ike_sa
, COND_STALE
, TRUE
);
384 this->initiating
.deferred
= TRUE
;
387 else if (mobike
->is_probing(mobike
))
389 timeout
= ROUTEABILITY_CHECK_INTERVAL
;
394 { /* for routeability checks, we use a more aggressive behavior */
395 if (this->initiating
.retransmitted
<= ROUTEABILITY_CHECK_TRIES
)
397 timeout
= ROUTEABILITY_CHECK_INTERVAL
;
401 DBG1(DBG_IKE
, "giving up after %d path probings",
402 this->initiating
.retransmitted
- 1);
406 if (this->initiating
.retransmitted
)
408 DBG1(DBG_IKE
, "path probing attempt %d",
409 this->initiating
.retransmitted
);
411 /* TODO-FRAG: presumably these small packets are not fragmented,
412 * we should maybe ensure this is the case when generating them */
413 if (!mobike
->transmit(mobike
, packet
))
415 DBG1(DBG_IKE
, "no route found to reach peer, path probing "
417 this->ike_sa
->set_condition(this->ike_sa
, COND_STALE
, TRUE
);
418 this->initiating
.deferred
= TRUE
;
423 this->initiating
.retransmitted
++;
424 job
= (job_t
*)retransmit_job_create(this->initiating
.mid
,
425 this->ike_sa
->get_id(this->ike_sa
));
426 lib
->scheduler
->schedule_job_ms(lib
->scheduler
, job
, timeout
);
431 METHOD(task_manager_t
, initiate
, status_t
,
432 private_task_manager_t
*this)
434 enumerator_t
*enumerator
;
438 exchange_type_t exchange
= 0;
440 if (this->initiating
.type
!= EXCHANGE_TYPE_UNDEFINED
)
442 DBG2(DBG_IKE
, "delaying task initiation, %N exchange in progress",
443 exchange_type_names
, this->initiating
.type
);
444 /* do not initiate if we already have a message in the air */
445 if (this->initiating
.deferred
)
446 { /* re-initiate deferred exchange */
447 this->initiating
.deferred
= FALSE
;
448 this->initiating
.retransmitted
= 0;
449 return retransmit(this, this->initiating
.mid
);
454 if (array_count(this->active_tasks
) == 0)
456 DBG2(DBG_IKE
, "activating new tasks");
457 switch (this->ike_sa
->get_state(this->ike_sa
))
460 activate_task(this, TASK_IKE_VENDOR
);
461 if (activate_task(this, TASK_IKE_INIT
))
463 this->initiating
.mid
= 0;
464 exchange
= IKE_SA_INIT
;
465 activate_task(this, TASK_IKE_NATD
);
466 activate_task(this, TASK_IKE_CERT_PRE
);
468 /* this task has to be activated before the TASK_IKE_AUTH
469 * task, because that task pregenerates the packet after
470 * which no payloads can be added to the message anymore.
472 activate_task(this, TASK_IKE_ME
);
474 activate_task(this, TASK_IKE_AUTH
);
475 activate_task(this, TASK_IKE_CERT_POST
);
476 activate_task(this, TASK_IKE_CONFIG
);
477 activate_task(this, TASK_CHILD_CREATE
);
478 activate_task(this, TASK_IKE_AUTH_LIFETIME
);
479 activate_task(this, TASK_IKE_MOBIKE
);
482 case IKE_ESTABLISHED
:
483 if (activate_task(this, TASK_IKE_MOBIKE
))
485 exchange
= INFORMATIONAL
;
488 if (activate_task(this, TASK_IKE_DELETE
))
490 exchange
= INFORMATIONAL
;
493 if (activate_task(this, TASK_IKE_REDIRECT
))
495 exchange
= INFORMATIONAL
;
498 if (activate_task(this, TASK_CHILD_DELETE
))
500 exchange
= INFORMATIONAL
;
503 if (activate_task(this, TASK_IKE_REAUTH
))
505 exchange
= INFORMATIONAL
;
508 if (activate_task(this, TASK_CHILD_CREATE
))
510 exchange
= CREATE_CHILD_SA
;
513 if (activate_task(this, TASK_CHILD_REKEY
))
515 exchange
= CREATE_CHILD_SA
;
518 if (activate_task(this, TASK_IKE_REKEY
))
520 exchange
= CREATE_CHILD_SA
;
523 if (activate_task(this, TASK_IKE_DPD
))
525 exchange
= INFORMATIONAL
;
528 if (activate_task(this, TASK_IKE_AUTH_LIFETIME
))
530 exchange
= INFORMATIONAL
;
534 if (activate_task(this, TASK_IKE_ME
))
536 exchange
= ME_CONNECT
;
540 if (activate_task(this, TASK_IKE_REAUTH_COMPLETE
))
542 exchange
= INFORMATIONAL
;
545 if (activate_task(this, TASK_IKE_VERIFY_PEER_CERT
))
547 exchange
= INFORMATIONAL
;
552 if (activate_task(this, TASK_IKE_DELETE
))
554 exchange
= INFORMATIONAL
;
564 DBG2(DBG_IKE
, "reinitiating already active tasks");
565 enumerator
= array_create_enumerator(this->active_tasks
);
566 while (enumerator
->enumerate(enumerator
, &task
))
568 DBG2(DBG_IKE
, " %N task", task_type_names
, task
->get_type(task
));
569 switch (task
->get_type(task
))
572 exchange
= IKE_SA_INIT
;
577 case TASK_CHILD_CREATE
:
578 case TASK_CHILD_REKEY
:
580 exchange
= CREATE_CHILD_SA
;
582 case TASK_IKE_MOBIKE
:
583 exchange
= INFORMATIONAL
;
590 enumerator
->destroy(enumerator
);
595 DBG2(DBG_IKE
, "nothing to initiate");
596 /* nothing to do yet... */
600 me
= this->ike_sa
->get_my_host(this->ike_sa
);
601 other
= this->ike_sa
->get_other_host(this->ike_sa
);
603 message
= message_create(IKEV2_MAJOR_VERSION
, IKEV2_MINOR_VERSION
);
604 message
->set_message_id(message
, this->initiating
.mid
);
605 message
->set_source(message
, me
->clone(me
));
606 message
->set_destination(message
, other
->clone(other
));
607 message
->set_exchange_type(message
, exchange
);
608 this->initiating
.type
= exchange
;
609 this->initiating
.retransmitted
= 0;
610 this->initiating
.deferred
= FALSE
;
612 enumerator
= array_create_enumerator(this->active_tasks
);
613 while (enumerator
->enumerate(enumerator
, &task
))
615 switch (task
->build(task
, message
))
618 /* task completed, remove it */
619 array_remove_at(this->active_tasks
, enumerator
);
623 /* processed, but task needs another exchange */
627 this->initiating
.type
= EXCHANGE_TYPE_UNDEFINED
;
628 if (this->ike_sa
->get_state(this->ike_sa
) != IKE_CONNECTING
&&
629 this->ike_sa
->get_state(this->ike_sa
) != IKE_REKEYED
)
631 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
635 /* critical failure, destroy IKE_SA */
636 enumerator
->destroy(enumerator
);
637 message
->destroy(message
);
642 enumerator
->destroy(enumerator
);
644 /* update exchange type if a task changed it */
645 this->initiating
.type
= message
->get_exchange_type(message
);
646 if (this->initiating
.type
== EXCHANGE_TYPE_UNDEFINED
)
648 message
->destroy(message
);
649 return initiate(this);
652 if (!generate_message(this, message
, &this->initiating
.packets
))
654 /* message generation failed. There is nothing more to do than to
656 message
->destroy(message
);
658 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
661 message
->destroy(message
);
663 array_compress(this->active_tasks
);
664 array_compress(this->queued_tasks
);
666 return retransmit(this, this->initiating
.mid
);
670 * handle an incoming response message
672 static status_t
process_response(private_task_manager_t
*this,
675 enumerator_t
*enumerator
;
678 if (message
->get_exchange_type(message
) != this->initiating
.type
)
680 DBG1(DBG_IKE
, "received %N response, but expected %N",
681 exchange_type_names
, message
->get_exchange_type(message
),
682 exchange_type_names
, this->initiating
.type
);
683 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
687 enumerator
= array_create_enumerator(this->active_tasks
);
688 while (enumerator
->enumerate(enumerator
, &task
))
690 if (!task
->pre_process
)
694 switch (task
->pre_process(task
, message
))
700 /* just ignore the message */
701 DBG1(DBG_IKE
, "ignore invalid %N response",
702 exchange_type_names
, message
->get_exchange_type(message
));
703 enumerator
->destroy(enumerator
);
706 /* critical failure, destroy IKE_SA */
707 enumerator
->destroy(enumerator
);
711 enumerator
->destroy(enumerator
);
713 if (this->initiating
.retransmitted
> 1)
715 packet_t
*packet
= NULL
;
716 array_get(this->initiating
.packets
, 0, &packet
);
717 charon
->bus
->alert(charon
->bus
, ALERT_RETRANSMIT_SEND_CLEARED
, packet
);
720 /* catch if we get resetted while processing */
722 enumerator
= array_create_enumerator(this->active_tasks
);
723 while (enumerator
->enumerate(enumerator
, &task
))
725 switch (task
->process(task
, message
))
728 /* task completed, remove it */
729 array_remove_at(this->active_tasks
, enumerator
);
733 /* processed, but task needs another exchange */
737 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
740 /* critical failure, destroy IKE_SA */
741 array_remove_at(this->active_tasks
, enumerator
);
742 enumerator
->destroy(enumerator
);
747 { /* start all over again if we were reset */
749 enumerator
->destroy(enumerator
);
750 return initiate(this);
753 enumerator
->destroy(enumerator
);
755 this->initiating
.mid
++;
756 this->initiating
.type
= EXCHANGE_TYPE_UNDEFINED
;
757 clear_packets(this->initiating
.packets
);
759 array_compress(this->active_tasks
);
761 return initiate(this);
765 * handle exchange collisions
767 static bool handle_collisions(private_task_manager_t
*this, task_t
*task
)
769 enumerator_t
*enumerator
;
773 type
= task
->get_type(task
);
775 /* do we have to check */
776 if (type
== TASK_IKE_REKEY
|| type
== TASK_CHILD_REKEY
||
777 type
== TASK_CHILD_DELETE
|| type
== TASK_IKE_DELETE
)
779 /* find an exchange collision, and notify these tasks */
780 enumerator
= array_create_enumerator(this->active_tasks
);
781 while (enumerator
->enumerate(enumerator
, &active
))
783 switch (active
->get_type(active
))
786 if (type
== TASK_IKE_REKEY
|| type
== TASK_IKE_DELETE
)
788 ike_rekey_t
*rekey
= (ike_rekey_t
*)active
;
789 rekey
->collide(rekey
, task
);
793 case TASK_CHILD_REKEY
:
794 if (type
== TASK_CHILD_REKEY
|| type
== TASK_CHILD_DELETE
)
796 child_rekey_t
*rekey
= (child_rekey_t
*)active
;
797 rekey
->collide(rekey
, task
);
804 enumerator
->destroy(enumerator
);
807 enumerator
->destroy(enumerator
);
813 * build a response depending on the "passive" task list
815 static status_t
build_response(private_task_manager_t
*this, message_t
*request
)
817 enumerator_t
*enumerator
;
821 bool delete = FALSE
, hook
= FALSE
;
822 ike_sa_id_t
*id
= NULL
;
823 uint64_t responder_spi
= 0;
826 me
= request
->get_destination(request
);
827 other
= request
->get_source(request
);
829 message
= message_create(IKEV2_MAJOR_VERSION
, IKEV2_MINOR_VERSION
);
830 message
->set_exchange_type(message
, request
->get_exchange_type(request
));
831 /* send response along the path the request came in */
832 message
->set_source(message
, me
->clone(me
));
833 message
->set_destination(message
, other
->clone(other
));
834 message
->set_message_id(message
, this->responding
.mid
);
835 message
->set_request(message
, FALSE
);
837 enumerator
= array_create_enumerator(this->passive_tasks
);
838 while (enumerator
->enumerate(enumerator
, (void*)&task
))
840 switch (task
->build(task
, message
))
843 /* task completed, remove it */
844 array_remove_at(this->passive_tasks
, enumerator
);
845 if (!handle_collisions(this, task
))
851 /* processed, but task needs another exchange */
852 if (handle_collisions(this, task
))
854 array_remove_at(this->passive_tasks
, enumerator
);
862 /* destroy IKE_SA, but SEND response first */
863 if (handle_collisions(this, task
))
865 array_remove_at(this->passive_tasks
, enumerator
);
875 enumerator
->destroy(enumerator
);
877 /* RFC 5996, section 2.6 mentions that in the event of a failure during
878 * IKE_SA_INIT the responder's SPI will be 0 in the response, while it
879 * actually explicitly allows it to be non-zero. Since we use the responder
880 * SPI to create hashes in the IKE_SA manager we can only set the SPI to
881 * zero temporarily, otherwise checking the SA in would fail. */
882 if (delete && request
->get_exchange_type(request
) == IKE_SA_INIT
)
884 id
= this->ike_sa
->get_id(this->ike_sa
);
885 responder_spi
= id
->get_responder_spi(id
);
886 id
->set_responder_spi(id
, 0);
889 /* message complete, send it */
890 clear_packets(this->responding
.packets
);
891 result
= generate_message(this, message
, &this->responding
.packets
);
892 message
->destroy(message
);
895 id
->set_responder_spi(id
, responder_spi
);
899 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
903 send_packets(this, this->responding
.packets
, NULL
, NULL
);
908 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
913 array_compress(this->passive_tasks
);
919 * handle an incoming request message
921 static status_t
process_request(private_task_manager_t
*this,
924 enumerator_t
*enumerator
;
927 notify_payload_t
*notify
;
928 delete_payload_t
*delete;
929 ike_sa_state_t state
;
931 if (array_count(this->passive_tasks
) == 0)
932 { /* create tasks depending on request type, if not already some queued */
933 state
= this->ike_sa
->get_state(this->ike_sa
);
934 switch (message
->get_exchange_type(message
))
938 task
= (task_t
*)ike_vendor_create(this->ike_sa
, FALSE
);
939 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
940 task
= (task_t
*)ike_init_create(this->ike_sa
, FALSE
, NULL
);
941 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
942 task
= (task_t
*)ike_natd_create(this->ike_sa
, FALSE
);
943 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
944 task
= (task_t
*)ike_cert_pre_create(this->ike_sa
, FALSE
);
945 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
947 task
= (task_t
*)ike_me_create(this->ike_sa
, FALSE
);
948 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
950 task
= (task_t
*)ike_auth_create(this->ike_sa
, FALSE
);
951 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
952 task
= (task_t
*)ike_cert_post_create(this->ike_sa
, FALSE
);
953 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
954 task
= (task_t
*)ike_config_create(this->ike_sa
, FALSE
);
955 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
956 task
= (task_t
*)child_create_create(this->ike_sa
, NULL
, FALSE
,
958 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
959 task
= (task_t
*)ike_auth_lifetime_create(this->ike_sa
, FALSE
);
960 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
961 task
= (task_t
*)ike_mobike_create(this->ike_sa
, FALSE
);
962 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
965 case CREATE_CHILD_SA
:
966 { /* FIXME: we should prevent this on mediation connections */
967 bool notify_found
= FALSE
, ts_found
= FALSE
;
969 if (state
== IKE_CREATED
||
970 state
== IKE_CONNECTING
)
972 DBG1(DBG_IKE
, "received CREATE_CHILD_SA request for "
973 "unestablished IKE_SA, rejected");
977 enumerator
= message
->create_payload_enumerator(message
);
978 while (enumerator
->enumerate(enumerator
, &payload
))
980 switch (payload
->get_type(payload
))
983 { /* if we find a rekey notify, its CHILD_SA rekeying */
984 notify
= (notify_payload_t
*)payload
;
985 if (notify
->get_notify_type(notify
) == REKEY_SA
&&
986 (notify
->get_protocol_id(notify
) == PROTO_AH
||
987 notify
->get_protocol_id(notify
) == PROTO_ESP
))
993 case PLV2_TS_INITIATOR
:
994 case PLV2_TS_RESPONDER
:
995 { /* if we don't find a TS, its IKE rekeying */
1003 enumerator
->destroy(enumerator
);
1009 task
= (task_t
*)child_rekey_create(this->ike_sa
,
1014 task
= (task_t
*)child_create_create(this->ike_sa
, NULL
,
1020 task
= (task_t
*)ike_rekey_create(this->ike_sa
, FALSE
);
1022 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
1027 enumerator
= message
->create_payload_enumerator(message
);
1028 while (enumerator
->enumerate(enumerator
, &payload
))
1030 switch (payload
->get_type(payload
))
1034 notify
= (notify_payload_t
*)payload
;
1035 if (state
== IKE_REKEYED
)
1037 DBG1(DBG_IKE
, "received unexpected notify %N "
1038 "for rekeyed IKE_SA, ignored",
1040 notify
->get_notify_type(notify
));
1043 switch (notify
->get_notify_type(notify
))
1045 case ADDITIONAL_IP4_ADDRESS
:
1046 case ADDITIONAL_IP6_ADDRESS
:
1047 case NO_ADDITIONAL_ADDRESSES
:
1048 case UPDATE_SA_ADDRESSES
:
1049 case NO_NATS_ALLOWED
:
1050 case UNACCEPTABLE_ADDRESSES
:
1051 case UNEXPECTED_NAT_DETECTED
:
1053 case NAT_DETECTION_SOURCE_IP
:
1054 case NAT_DETECTION_DESTINATION_IP
:
1055 task
= (task_t
*)ike_mobike_create(
1056 this->ike_sa
, FALSE
);
1059 task
= (task_t
*)ike_auth_lifetime_create(
1060 this->ike_sa
, FALSE
);
1062 case AUTHENTICATION_FAILED
:
1063 /* initiator failed to authenticate us.
1064 * We use ike_delete to handle this, which
1065 * invokes all the required hooks. */
1066 task
= (task_t
*)ike_delete_create(
1067 this->ike_sa
, FALSE
);
1070 task
= (task_t
*)ike_redirect_create(
1071 this->ike_sa
, NULL
);
1073 case IKEV2_MESSAGE_ID_SYNC
:
1074 task
= (task_t
*)ike_mid_sync_create(
1084 delete = (delete_payload_t
*)payload
;
1085 if (delete->get_protocol_id(delete) == PROTO_IKE
)
1087 task
= (task_t
*)ike_delete_create(this->ike_sa
,
1092 task
= (task_t
*)child_delete_create(this->ike_sa
,
1093 PROTO_NONE
, 0, FALSE
);
1105 enumerator
->destroy(enumerator
);
1109 task
= (task_t
*)ike_dpd_create(FALSE
);
1111 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
1117 task
= (task_t
*)ike_me_create(this->ike_sa
, FALSE
);
1118 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
1126 enumerator
= array_create_enumerator(this->passive_tasks
);
1127 while (enumerator
->enumerate(enumerator
, &task
))
1129 if (!task
->pre_process
)
1133 switch (task
->pre_process(task
, message
))
1139 /* just ignore the message */
1140 DBG1(DBG_IKE
, "ignore invalid %N request",
1141 exchange_type_names
, message
->get_exchange_type(message
));
1142 enumerator
->destroy(enumerator
);
1143 switch (message
->get_exchange_type(message
))
1146 /* no point in keeping the SA when it was created with
1147 * an invalid IKE_SA_INIT message */
1150 /* remove tasks we queued for this request */
1151 flush_queue(this, TASK_QUEUE_PASSIVE
);
1157 /* critical failure, destroy IKE_SA */
1158 enumerator
->destroy(enumerator
);
1162 enumerator
->destroy(enumerator
);
1164 /* let the tasks process the message */
1165 enumerator
= array_create_enumerator(this->passive_tasks
);
1166 while (enumerator
->enumerate(enumerator
, (void*)&task
))
1168 switch (task
->process(task
, message
))
1171 /* task completed, remove it */
1172 array_remove_at(this->passive_tasks
, enumerator
);
1173 task
->destroy(task
);
1176 /* processed, but task needs at least another call to build() */
1180 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
1183 /* critical failure, destroy IKE_SA */
1184 array_remove_at(this->passive_tasks
, enumerator
);
1185 enumerator
->destroy(enumerator
);
1186 task
->destroy(task
);
1190 enumerator
->destroy(enumerator
);
1192 return build_response(this, message
);
1195 METHOD(task_manager_t
, incr_mid
, void,
1196 private_task_manager_t
*this, bool initiate
)
1200 this->initiating
.mid
++;
1204 this->responding
.mid
++;
1208 METHOD(task_manager_t
, get_mid
, uint32_t,
1209 private_task_manager_t
*this, bool initiate
)
1211 return initiate
? this->initiating
.mid
: this->responding
.mid
;
1215 * Handle the given IKE fragment, if it is one.
1217 * Returns SUCCESS if the message is not a fragment, and NEED_MORE if it was
1218 * handled properly. Error states are returned if the fragment was invalid or
1219 * the reassembled message could not have been processed properly.
1221 static status_t
handle_fragment(private_task_manager_t
*this,
1222 message_t
**defrag
, message_t
*msg
)
1224 message_t
*reassembled
;
1227 if (!msg
->get_payload(msg
, PLV2_FRAGMENT
))
1233 *defrag
= message_create_defrag(msg
);
1239 status
= (*defrag
)->add_fragment(*defrag
, msg
);
1240 if (status
== SUCCESS
)
1242 /* reinject the reassembled message */
1243 reassembled
= *defrag
;
1245 status
= this->ike_sa
->process_message(this->ike_sa
, reassembled
);
1246 if (status
== SUCCESS
)
1248 /* avoid processing the last fragment */
1251 reassembled
->destroy(reassembled
);
1257 * Send a notify back to the sender
1259 static void send_notify_response(private_task_manager_t
*this,
1260 message_t
*request
, notify_type_t type
,
1263 message_t
*response
;
1267 response
= message_create(IKEV2_MAJOR_VERSION
, IKEV2_MINOR_VERSION
);
1268 response
->set_exchange_type(response
, request
->get_exchange_type(request
));
1269 response
->set_request(response
, FALSE
);
1270 response
->set_message_id(response
, request
->get_message_id(request
));
1271 response
->add_notify(response
, FALSE
, type
, data
);
1272 me
= this->ike_sa
->get_my_host(this->ike_sa
);
1273 if (me
->is_anyaddr(me
))
1275 me
= request
->get_destination(request
);
1276 this->ike_sa
->set_my_host(this->ike_sa
, me
->clone(me
));
1278 other
= this->ike_sa
->get_other_host(this->ike_sa
);
1279 if (other
->is_anyaddr(other
))
1281 other
= request
->get_source(request
);
1282 this->ike_sa
->set_other_host(this->ike_sa
, other
->clone(other
));
1284 response
->set_source(response
, me
->clone(me
));
1285 response
->set_destination(response
, other
->clone(other
));
1286 if (this->ike_sa
->generate_message(this->ike_sa
, response
,
1287 &packet
) == SUCCESS
)
1289 charon
->sender
->send(charon
->sender
, packet
);
1291 response
->destroy(response
);
1295 * Parse the given message and verify that it is valid.
1297 static status_t
parse_message(private_task_manager_t
*this, message_t
*msg
)
1302 status
= msg
->parse_body(msg
, this->ike_sa
->get_keymat(this->ike_sa
));
1304 if (status
== SUCCESS
)
1305 { /* check for unsupported critical payloads */
1306 enumerator_t
*enumerator
;
1307 unknown_payload_t
*unknown
;
1310 enumerator
= msg
->create_payload_enumerator(msg
);
1311 while (enumerator
->enumerate(enumerator
, &payload
))
1313 if (payload
->get_type(payload
) == PL_UNKNOWN
)
1315 unknown
= (unknown_payload_t
*)payload
;
1316 if (unknown
->is_critical(unknown
))
1318 type
= unknown
->get_type(unknown
);
1319 DBG1(DBG_ENC
, "payload type %N is not supported, "
1320 "but its critical!", payload_type_names
, type
);
1321 status
= NOT_SUPPORTED
;
1326 enumerator
->destroy(enumerator
);
1329 if (status
!= SUCCESS
)
1331 bool is_request
= msg
->get_request(msg
);
1336 DBG1(DBG_IKE
, "critical unknown payloads found");
1339 send_notify_response(this, msg
,
1340 UNSUPPORTED_CRITICAL_PAYLOAD
,
1341 chunk_from_thing(type
));
1342 incr_mid(this, FALSE
);
1346 DBG1(DBG_IKE
, "message parsing failed");
1349 send_notify_response(this, msg
,
1350 INVALID_SYNTAX
, chunk_empty
);
1351 incr_mid(this, FALSE
);
1355 DBG1(DBG_IKE
, "message verification failed");
1358 send_notify_response(this, msg
,
1359 INVALID_SYNTAX
, chunk_empty
);
1360 incr_mid(this, FALSE
);
1364 DBG1(DBG_IKE
, "integrity check failed");
1368 DBG1(DBG_IKE
, "found encrypted message, but no keys available");
1372 DBG1(DBG_IKE
, "%N %s with message ID %d processing failed",
1373 exchange_type_names
, msg
->get_exchange_type(msg
),
1374 is_request
? "request" : "response",
1375 msg
->get_message_id(msg
));
1377 charon
->bus
->alert(charon
->bus
, ALERT_PARSE_ERROR_BODY
, msg
, status
);
1379 if (this->ike_sa
->get_state(this->ike_sa
) == IKE_CREATED
)
1380 { /* invalid initiation attempt, close SA */
1388 * Check if a message with message ID 0 might be used to synchronize the
1391 static bool is_mid_sync(private_task_manager_t
*this, message_t
*msg
)
1393 enumerator_t
*enumerator
;
1394 notify_payload_t
*notify
;
1396 bool found
= FALSE
, other
= FALSE
;
1398 if (msg
->get_exchange_type(msg
) == INFORMATIONAL
&&
1399 this->ike_sa
->get_state(this->ike_sa
) == IKE_ESTABLISHED
&&
1400 this->ike_sa
->supports_extension(this->ike_sa
,
1401 EXT_IKE_MESSAGE_ID_SYNC
))
1403 enumerator
= msg
->create_payload_enumerator(msg
);
1404 while (enumerator
->enumerate(enumerator
, &payload
))
1406 if (payload
->get_type(payload
) == PLV2_NOTIFY
)
1408 notify
= (notify_payload_t
*)payload
;
1409 switch (notify
->get_notify_type(notify
))
1411 case IKEV2_MESSAGE_ID_SYNC
:
1412 case IPSEC_REPLAY_COUNTER_SYNC
:
1422 enumerator
->destroy(enumerator
);
1424 return found
&& !other
;
1427 METHOD(task_manager_t
, process_message
, status_t
,
1428 private_task_manager_t
*this, message_t
*msg
)
1433 bool schedule_delete_job
= FALSE
;
1434 ike_sa_state_t state
;
1435 exchange_type_t type
;
1437 charon
->bus
->message(charon
->bus
, msg
, TRUE
, FALSE
);
1438 status
= parse_message(this, msg
);
1439 if (status
!= SUCCESS
)
1444 me
= msg
->get_destination(msg
);
1445 other
= msg
->get_source(msg
);
1447 /* if this IKE_SA is virgin, we check for a config */
1448 if (this->ike_sa
->get_ike_cfg(this->ike_sa
) == NULL
)
1452 ike_cfg
= charon
->backends
->get_ike_cfg(charon
->backends
,
1454 if (ike_cfg
== NULL
)
1456 /* no config found for these hosts, destroy */
1457 DBG1(DBG_IKE
, "no IKE config found for %H...%H, sending %N",
1458 me
, other
, notify_type_names
, NO_PROPOSAL_CHOSEN
);
1459 send_notify_response(this, msg
,
1460 NO_PROPOSAL_CHOSEN
, chunk_empty
);
1463 this->ike_sa
->set_ike_cfg(this->ike_sa
, ike_cfg
);
1464 ike_cfg
->destroy(ike_cfg
);
1465 /* add a timeout if peer does not establish it completely */
1466 schedule_delete_job
= TRUE
;
1468 this->ike_sa
->set_statistic(this->ike_sa
, STAT_INBOUND
,
1469 time_monotonic(NULL
));
1471 mid
= msg
->get_message_id(msg
);
1472 if (msg
->get_request(msg
))
1474 if (mid
== this->responding
.mid
|| (mid
== 0 && is_mid_sync(this, msg
)))
1476 /* reject initial messages if not received in specific states,
1477 * after rekeying we only expect a DELETE in an INFORMATIONAL */
1478 type
= msg
->get_exchange_type(msg
);
1479 state
= this->ike_sa
->get_state(this->ike_sa
);
1480 if ((type
== IKE_SA_INIT
&& state
!= IKE_CREATED
) ||
1481 (type
== IKE_AUTH
&& state
!= IKE_CONNECTING
) ||
1482 (state
== IKE_REKEYED
&& type
!= INFORMATIONAL
))
1484 DBG1(DBG_IKE
, "ignoring %N in IKE_SA state %N",
1485 exchange_type_names
, type
, ike_sa_state_names
, state
);
1488 if (!this->ike_sa
->supports_extension(this->ike_sa
, EXT_MOBIKE
))
1489 { /* with MOBIKE, we do no implicit updates */
1490 this->ike_sa
->update_hosts(this->ike_sa
, me
, other
, mid
== 1);
1492 status
= handle_fragment(this, &this->responding
.defrag
, msg
);
1493 if (status
!= SUCCESS
)
1497 charon
->bus
->message(charon
->bus
, msg
, TRUE
, TRUE
);
1498 if (msg
->get_exchange_type(msg
) == EXCHANGE_TYPE_UNDEFINED
)
1499 { /* ignore messages altered to EXCHANGE_TYPE_UNDEFINED */
1502 switch (process_request(this, msg
))
1505 this->responding
.mid
++;
1514 else if ((mid
== this->responding
.mid
- 1) &&
1515 array_count(this->responding
.packets
))
1517 status
= handle_fragment(this, &this->responding
.defrag
, msg
);
1518 if (status
!= SUCCESS
)
1522 DBG1(DBG_IKE
, "received retransmit of request with ID %d, "
1523 "retransmitting response", mid
);
1524 charon
->bus
->alert(charon
->bus
, ALERT_RETRANSMIT_RECEIVE
, msg
);
1525 send_packets(this, this->responding
.packets
,
1526 msg
->get_destination(msg
), msg
->get_source(msg
));
1530 DBG1(DBG_IKE
, "received message ID %d, expected %d, ignored",
1531 mid
, this->responding
.mid
);
1536 if (mid
== this->initiating
.mid
)
1538 if (this->ike_sa
->get_state(this->ike_sa
) == IKE_CREATED
||
1539 this->ike_sa
->get_state(this->ike_sa
) == IKE_CONNECTING
||
1540 msg
->get_exchange_type(msg
) != IKE_SA_INIT
)
1541 { /* only do updates based on verified messages (or initial ones) */
1542 if (!this->ike_sa
->supports_extension(this->ike_sa
, EXT_MOBIKE
))
1543 { /* with MOBIKE, we do no implicit updates. we force an
1544 * update of the local address on IKE_SA_INIT, but never
1545 * for the remote address */
1546 this->ike_sa
->update_hosts(this->ike_sa
, me
, NULL
, mid
== 0);
1547 this->ike_sa
->update_hosts(this->ike_sa
, NULL
, other
, FALSE
);
1550 status
= handle_fragment(this, &this->initiating
.defrag
, msg
);
1551 if (status
!= SUCCESS
)
1555 charon
->bus
->message(charon
->bus
, msg
, TRUE
, TRUE
);
1556 if (msg
->get_exchange_type(msg
) == EXCHANGE_TYPE_UNDEFINED
)
1557 { /* ignore messages altered to EXCHANGE_TYPE_UNDEFINED */
1560 if (process_response(this, msg
) != SUCCESS
)
1568 DBG1(DBG_IKE
, "received message ID %d, expected %d, ignored",
1569 mid
, this->initiating
.mid
);
1574 if (schedule_delete_job
)
1576 ike_sa_id_t
*ike_sa_id
;
1579 ike_sa_id
= this->ike_sa
->get_id(this->ike_sa
);
1580 job
= (job_t
*)delete_ike_sa_job_create(ike_sa_id
, FALSE
);
1581 lib
->scheduler
->schedule_job(lib
->scheduler
, job
,
1582 lib
->settings
->get_int(lib
->settings
,
1583 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT
,
1589 METHOD(task_manager_t
, queue_task_delayed
, void,
1590 private_task_manager_t
*this, task_t
*task
, uint32_t delay
)
1592 enumerator_t
*enumerator
;
1593 queued_task_t
*queued
;
1596 if (task
->get_type(task
) == TASK_IKE_MOBIKE
)
1597 { /* there is no need to queue more than one mobike task */
1598 enumerator
= array_create_enumerator(this->queued_tasks
);
1599 while (enumerator
->enumerate(enumerator
, &queued
))
1601 if (queued
->task
->get_type(queued
->task
) == TASK_IKE_MOBIKE
)
1603 enumerator
->destroy(enumerator
);
1604 task
->destroy(task
);
1608 enumerator
->destroy(enumerator
);
1610 time_monotonic(&time
);
1615 DBG2(DBG_IKE
, "queueing %N task (delayed by %us)", task_type_names
,
1616 task
->get_type(task
), delay
);
1617 time
.tv_sec
+= delay
;
1619 job
= (job_t
*)initiate_tasks_job_create(
1620 this->ike_sa
->get_id(this->ike_sa
));
1621 lib
->scheduler
->schedule_job_tv(lib
->scheduler
, job
, time
);
1625 DBG2(DBG_IKE
, "queueing %N task", task_type_names
,
1626 task
->get_type(task
));
1632 array_insert(this->queued_tasks
, ARRAY_TAIL
, queued
);
1635 METHOD(task_manager_t
, queue_task
, void,
1636 private_task_manager_t
*this, task_t
*task
)
1638 queue_task_delayed(this, task
, 0);
1642 * Check if a given task has been queued already
1644 static bool has_queued(private_task_manager_t
*this, task_type_t type
)
1646 enumerator_t
*enumerator
;
1648 queued_task_t
*queued
;
1650 enumerator
= array_create_enumerator(this->queued_tasks
);
1651 while (enumerator
->enumerate(enumerator
, &queued
))
1653 if (queued
->task
->get_type(queued
->task
) == type
)
1659 enumerator
->destroy(enumerator
);
1663 METHOD(task_manager_t
, queue_ike
, void,
1664 private_task_manager_t
*this)
1666 if (!has_queued(this, TASK_IKE_VENDOR
))
1668 queue_task(this, (task_t
*)ike_vendor_create(this->ike_sa
, TRUE
));
1670 if (!has_queued(this, TASK_IKE_INIT
))
1672 queue_task(this, (task_t
*)ike_init_create(this->ike_sa
, TRUE
, NULL
));
1674 if (!has_queued(this, TASK_IKE_NATD
))
1676 queue_task(this, (task_t
*)ike_natd_create(this->ike_sa
, TRUE
));
1678 if (!has_queued(this, TASK_IKE_CERT_PRE
))
1680 queue_task(this, (task_t
*)ike_cert_pre_create(this->ike_sa
, TRUE
));
1682 if (!has_queued(this, TASK_IKE_AUTH
))
1684 queue_task(this, (task_t
*)ike_auth_create(this->ike_sa
, TRUE
));
1686 if (!has_queued(this, TASK_IKE_CERT_POST
))
1688 queue_task(this, (task_t
*)ike_cert_post_create(this->ike_sa
, TRUE
));
1690 if (!has_queued(this, TASK_IKE_CONFIG
))
1692 queue_task(this, (task_t
*)ike_config_create(this->ike_sa
, TRUE
));
1694 if (!has_queued(this, TASK_IKE_AUTH_LIFETIME
))
1696 queue_task(this, (task_t
*)ike_auth_lifetime_create(this->ike_sa
, TRUE
));
1698 if (!has_queued(this, TASK_IKE_MOBIKE
))
1700 peer_cfg_t
*peer_cfg
;
1702 peer_cfg
= this->ike_sa
->get_peer_cfg(this->ike_sa
);
1703 if (peer_cfg
->use_mobike(peer_cfg
))
1705 queue_task(this, (task_t
*)ike_mobike_create(this->ike_sa
, TRUE
));
1709 if (!has_queued(this, TASK_IKE_ME
))
1711 queue_task(this, (task_t
*)ike_me_create(this->ike_sa
, TRUE
));
1716 METHOD(task_manager_t
, queue_ike_rekey
, void,
1717 private_task_manager_t
*this)
1719 queue_task(this, (task_t
*)ike_rekey_create(this->ike_sa
, TRUE
));
1723 * Start reauthentication using make-before-break
1725 static void trigger_mbb_reauth(private_task_manager_t
*this)
1727 enumerator_t
*enumerator
;
1728 child_sa_t
*child_sa
;
1732 queued_task_t
*queued
;
1734 new = charon
->ike_sa_manager
->checkout_new(charon
->ike_sa_manager
,
1735 this->ike_sa
->get_version(this->ike_sa
), TRUE
);
1737 { /* shouldn't happen */
1741 new->set_peer_cfg(new, this->ike_sa
->get_peer_cfg(this->ike_sa
));
1742 host
= this->ike_sa
->get_other_host(this->ike_sa
);
1743 new->set_other_host(new, host
->clone(host
));
1744 host
= this->ike_sa
->get_my_host(this->ike_sa
);
1745 new->set_my_host(new, host
->clone(host
));
1746 enumerator
= this->ike_sa
->create_virtual_ip_enumerator(this->ike_sa
, TRUE
);
1747 while (enumerator
->enumerate(enumerator
, &host
))
1749 new->add_virtual_ip(new, TRUE
, host
);
1751 enumerator
->destroy(enumerator
);
1753 enumerator
= this->ike_sa
->create_child_sa_enumerator(this->ike_sa
);
1754 while (enumerator
->enumerate(enumerator
, &child_sa
))
1756 cfg
= child_sa
->get_config(child_sa
);
1757 new->queue_task(new, &child_create_create(new, cfg
->get_ref(cfg
),
1758 FALSE
, NULL
, NULL
)->task
);
1760 enumerator
->destroy(enumerator
);
1762 enumerator
= array_create_enumerator(this->queued_tasks
);
1763 while (enumerator
->enumerate(enumerator
, &queued
))
1765 if (queued
->task
->get_type(queued
->task
) == TASK_CHILD_CREATE
)
1767 queued
->task
->migrate(queued
->task
, new);
1768 new->queue_task(new, queued
->task
);
1769 array_remove_at(this->queued_tasks
, enumerator
);
1773 enumerator
->destroy(enumerator
);
1775 /* suspend online revocation checking until the SA is established */
1776 new->set_condition(new, COND_ONLINE_VALIDATION_SUSPENDED
, TRUE
);
1778 if (new->initiate(new, NULL
, 0, NULL
, NULL
) != DESTROY_ME
)
1780 new->queue_task(new, (task_t
*)ike_verify_peer_cert_create(new));
1781 new->queue_task(new, (task_t
*)ike_reauth_complete_create(new,
1782 this->ike_sa
->get_id(this->ike_sa
)));
1783 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, new);
1787 charon
->ike_sa_manager
->checkin_and_destroy(charon
->ike_sa_manager
, new);
1788 DBG1(DBG_IKE
, "reauthenticating IKE_SA failed");
1790 charon
->bus
->set_sa(charon
->bus
, this->ike_sa
);
1793 METHOD(task_manager_t
, queue_ike_reauth
, void,
1794 private_task_manager_t
*this)
1796 if (this->make_before_break
)
1798 return trigger_mbb_reauth(this);
1800 queue_task(this, (task_t
*)ike_reauth_create(this->ike_sa
));
1803 METHOD(task_manager_t
, queue_ike_delete
, void,
1804 private_task_manager_t
*this)
1806 queue_task(this, (task_t
*)ike_delete_create(this->ike_sa
, TRUE
));
1809 METHOD(task_manager_t
, queue_mobike
, void,
1810 private_task_manager_t
*this, bool roam
, bool address
)
1812 ike_mobike_t
*mobike
;
1814 mobike
= ike_mobike_create(this->ike_sa
, TRUE
);
1817 enumerator_t
*enumerator
;
1820 mobike
->roam(mobike
, address
);
1822 /* enable path probing for a currently active MOBIKE task. This might
1823 * not be the case if an address appeared on a new interface while the
1824 * current address is not working but has not yet disappeared. */
1825 enumerator
= array_create_enumerator(this->active_tasks
);
1826 while (enumerator
->enumerate(enumerator
, ¤t
))
1828 if (current
->get_type(current
) == TASK_IKE_MOBIKE
)
1830 ike_mobike_t
*active
= (ike_mobike_t
*)current
;
1831 active
->enable_probing(active
);
1835 enumerator
->destroy(enumerator
);
1839 mobike
->addresses(mobike
);
1841 queue_task(this, &mobike
->task
);
1844 METHOD(task_manager_t
, queue_child
, void,
1845 private_task_manager_t
*this, child_cfg_t
*cfg
, uint32_t reqid
,
1846 traffic_selector_t
*tsi
, traffic_selector_t
*tsr
)
1848 child_create_t
*task
;
1850 task
= child_create_create(this->ike_sa
, cfg
, FALSE
, tsi
, tsr
);
1853 task
->use_reqid(task
, reqid
);
1855 queue_task(this, &task
->task
);
1858 METHOD(task_manager_t
, queue_child_rekey
, void,
1859 private_task_manager_t
*this, protocol_id_t protocol
, uint32_t spi
)
1861 queue_task(this, (task_t
*)child_rekey_create(this->ike_sa
, protocol
, spi
));
1864 METHOD(task_manager_t
, queue_child_delete
, void,
1865 private_task_manager_t
*this, protocol_id_t protocol
, uint32_t spi
,
1868 queue_task(this, (task_t
*)child_delete_create(this->ike_sa
,
1869 protocol
, spi
, expired
));
1872 METHOD(task_manager_t
, queue_dpd
, void,
1873 private_task_manager_t
*this)
1875 ike_mobike_t
*mobike
;
1877 if (this->ike_sa
->supports_extension(this->ike_sa
, EXT_MOBIKE
) &&
1878 this->ike_sa
->has_condition(this->ike_sa
, COND_NAT_HERE
))
1881 peer_cfg_t
*cfg
= this->ike_sa
->get_peer_cfg(this->ike_sa
);
1882 if (cfg
->get_peer_id(cfg
) ||
1883 this->ike_sa
->has_condition(this->ike_sa
, COND_ORIGINAL_INITIATOR
))
1885 if (this->ike_sa
->has_condition(this->ike_sa
, COND_ORIGINAL_INITIATOR
))
1888 /* use mobike enabled DPD to detect NAT mapping changes */
1889 mobike
= ike_mobike_create(this->ike_sa
, TRUE
);
1890 mobike
->dpd(mobike
);
1891 queue_task(this, &mobike
->task
);
1895 queue_task(this, (task_t
*)ike_dpd_create(TRUE
));
1898 METHOD(task_manager_t
, adopt_tasks
, void,
1899 private_task_manager_t
*this, task_manager_t
*other_public
)
1901 private_task_manager_t
*other
= (private_task_manager_t
*)other_public
;
1902 queued_task_t
*queued
;
1905 time_monotonic(&now
);
1907 /* move queued tasks from other to this */
1908 while (array_remove(other
->queued_tasks
, ARRAY_TAIL
, &queued
))
1910 DBG2(DBG_IKE
, "migrating %N task", task_type_names
,
1911 queued
->task
->get_type(queued
->task
));
1912 queued
->task
->migrate(queued
->task
, this->ike_sa
);
1913 /* don't delay tasks on the new IKE_SA */
1915 array_insert(this->queued_tasks
, ARRAY_HEAD
, queued
);
1920 * Migrates child-creating tasks from other to this
1922 static void migrate_child_tasks(private_task_manager_t
*this,
1923 private_task_manager_t
*other
,
1926 enumerator_t
*enumerator
;
1932 case TASK_QUEUE_ACTIVE
:
1933 array
= other
->active_tasks
;
1935 case TASK_QUEUE_QUEUED
:
1936 array
= other
->queued_tasks
;
1942 enumerator
= array_create_enumerator(array
);
1943 while (enumerator
->enumerate(enumerator
, &task
))
1945 queued_task_t
*queued
= NULL
;
1947 if (queue
== TASK_QUEUE_QUEUED
)
1949 queued
= (queued_task_t
*)task
;
1950 task
= queued
->task
;
1952 if (task
->get_type(task
) == TASK_CHILD_CREATE
)
1954 array_remove_at(array
, enumerator
);
1955 task
->migrate(task
, this->ike_sa
);
1956 queue_task(this, task
);
1960 enumerator
->destroy(enumerator
);
1963 METHOD(task_manager_t
, adopt_child_tasks
, void,
1964 private_task_manager_t
*this, task_manager_t
*other_public
)
1966 private_task_manager_t
*other
= (private_task_manager_t
*)other_public
;
1968 /* move active child tasks from other to this */
1969 migrate_child_tasks(this, other
, TASK_QUEUE_ACTIVE
);
1970 /* do the same for queued tasks */
1971 migrate_child_tasks(this, other
, TASK_QUEUE_QUEUED
);
1974 METHOD(task_manager_t
, busy
, bool,
1975 private_task_manager_t
*this)
1977 return array_count(this->active_tasks
) > 0;
1980 METHOD(task_manager_t
, reset
, void,
1981 private_task_manager_t
*this, uint32_t initiate
, uint32_t respond
)
1983 enumerator_t
*enumerator
;
1984 queued_task_t
*queued
;
1988 /* reset message counters and retransmit packets */
1989 clear_packets(this->responding
.packets
);
1990 clear_packets(this->initiating
.packets
);
1991 DESTROY_IF(this->responding
.defrag
);
1992 DESTROY_IF(this->initiating
.defrag
);
1993 this->responding
.defrag
= NULL
;
1994 this->initiating
.defrag
= NULL
;
1995 if (initiate
!= UINT_MAX
)
1997 this->initiating
.mid
= initiate
;
1999 if (respond
!= UINT_MAX
)
2001 this->responding
.mid
= respond
;
2003 this->initiating
.type
= EXCHANGE_TYPE_UNDEFINED
;
2005 time_monotonic(&now
);
2006 /* reset queued tasks */
2007 enumerator
= array_create_enumerator(this->queued_tasks
);
2008 while (enumerator
->enumerate(enumerator
, &queued
))
2011 queued
->task
->migrate(queued
->task
, this->ike_sa
);
2013 enumerator
->destroy(enumerator
);
2015 /* reset active tasks */
2016 while (array_remove(this->active_tasks
, ARRAY_TAIL
, &task
))
2018 task
->migrate(task
, this->ike_sa
);
2023 array_insert(this->queued_tasks
, ARRAY_HEAD
, queued
);
2030 * Filter queued tasks
2032 static bool filter_queued(void *unused
, queued_task_t
**queued
, task_t
**task
)
2034 *task
= (*queued
)->task
;
2038 METHOD(task_manager_t
, create_task_enumerator
, enumerator_t
*,
2039 private_task_manager_t
*this, task_queue_t queue
)
2043 case TASK_QUEUE_ACTIVE
:
2044 return array_create_enumerator(this->active_tasks
);
2045 case TASK_QUEUE_PASSIVE
:
2046 return array_create_enumerator(this->passive_tasks
);
2047 case TASK_QUEUE_QUEUED
:
2048 return enumerator_create_filter(
2049 array_create_enumerator(this->queued_tasks
),
2050 (void*)filter_queued
, NULL
, NULL
);
2052 return enumerator_create_empty();
2056 METHOD(task_manager_t
, destroy
, void,
2057 private_task_manager_t
*this)
2061 array_destroy(this->active_tasks
);
2062 array_destroy(this->queued_tasks
);
2063 array_destroy(this->passive_tasks
);
2065 clear_packets(this->responding
.packets
);
2066 array_destroy(this->responding
.packets
);
2067 clear_packets(this->initiating
.packets
);
2068 array_destroy(this->initiating
.packets
);
2069 DESTROY_IF(this->responding
.defrag
);
2070 DESTROY_IF(this->initiating
.defrag
);
2077 task_manager_v2_t
*task_manager_v2_create(ike_sa_t
*ike_sa
)
2079 private_task_manager_t
*this;
2084 .process_message
= _process_message
,
2085 .queue_task
= _queue_task
,
2086 .queue_task_delayed
= _queue_task_delayed
,
2087 .queue_ike
= _queue_ike
,
2088 .queue_ike_rekey
= _queue_ike_rekey
,
2089 .queue_ike_reauth
= _queue_ike_reauth
,
2090 .queue_ike_delete
= _queue_ike_delete
,
2091 .queue_mobike
= _queue_mobike
,
2092 .queue_child
= _queue_child
,
2093 .queue_child_rekey
= _queue_child_rekey
,
2094 .queue_child_delete
= _queue_child_delete
,
2095 .queue_dpd
= _queue_dpd
,
2096 .initiate
= _initiate
,
2097 .retransmit
= _retransmit
,
2098 .incr_mid
= _incr_mid
,
2099 .get_mid
= _get_mid
,
2101 .adopt_tasks
= _adopt_tasks
,
2102 .adopt_child_tasks
= _adopt_child_tasks
,
2104 .create_task_enumerator
= _create_task_enumerator
,
2106 .flush_queue
= _flush_queue
,
2107 .destroy
= _destroy
,
2111 .initiating
.type
= EXCHANGE_TYPE_UNDEFINED
,
2112 .queued_tasks
= array_create(0, 0),
2113 .active_tasks
= array_create(0, 0),
2114 .passive_tasks
= array_create(0, 0),
2115 .retransmit_tries
= lib
->settings
->get_int(lib
->settings
,
2116 "%s.retransmit_tries", RETRANSMIT_TRIES
, lib
->ns
),
2117 .retransmit_timeout
= lib
->settings
->get_double(lib
->settings
,
2118 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT
, lib
->ns
),
2119 .retransmit_base
= lib
->settings
->get_double(lib
->settings
,
2120 "%s.retransmit_base", RETRANSMIT_BASE
, lib
->ns
),
2121 .make_before_break
= lib
->settings
->get_bool(lib
->settings
,
2122 "%s.make_before_break", FALSE
, lib
->ns
),
2125 return &this->public;