]>
Commit | Line | Data |
---|---|---|
7ba38761 | 1 | /* |
a79d5103 | 2 | * Copyright (C) 2006-2018 Tobias Brunner |
d5cc1758 | 3 | * Copyright (C) 2006 Daniel Roethlisberger |
a44bb934 | 4 | * Copyright (C) 2005-2009 Martin Willi |
c71d53ba | 5 | * Copyright (C) 2005 Jan Hutter |
208678e6 | 6 | * HSR Hochschule fuer Technik Rapperswil |
7ba38761 JH |
7 | * |
8 | * This program is free software; you can redistribute it and/or modify it | |
9 | * under the terms of the GNU General Public License as published by the | |
10 | * Free Software Foundation; either version 2 of the License, or (at your | |
11 | * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, but | |
14 | * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY | |
15 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License | |
16 | * for more details. | |
17 | */ | |
1396815a | 18 | |
05db0f97 VR |
19 | /* |
20 | * Copyright (c) 2014 Volker RĂ¼melin | |
21 | * | |
22 | * Permission is hereby granted, free of charge, to any person obtaining a copy | |
23 | * of this software and associated documentation files (the "Software"), to deal | |
24 | * in the Software without restriction, including without limitation the rights | |
25 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | |
26 | * copies of the Software, and to permit persons to whom the Software is | |
27 | * furnished to do so, subject to the following conditions: | |
28 | * | |
29 | * The above copyright notice and this permission notice shall be included in | |
30 | * all copies or substantial portions of the Software. | |
31 | * | |
32 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
33 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
34 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | |
35 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |
36 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | |
37 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN | |
38 | * THE SOFTWARE. | |
39 | */ | |
40 | ||
5113680f | 41 | #include <string.h> |
c60c7694 | 42 | #include <sys/stat.h> |
db97fd82 | 43 | #include <errno.h> |
e13389a7 | 44 | #include <time.h> |
7ba38761 | 45 | |
88878242 MW |
46 | #include "ike_sa.h" |
47 | ||
db7ef624 | 48 | #include <library.h> |
c5f7146b | 49 | #include <daemon.h> |
893da041 | 50 | #include <collections/array.h> |
c60c7694 | 51 | #include <utils/lexparser.h> |
e0fe7651 MW |
52 | #include <processing/jobs/retransmit_job.h> |
53 | #include <processing/jobs/delete_ike_sa_job.h> | |
54 | #include <processing/jobs/send_dpd_job.h> | |
55 | #include <processing/jobs/send_keepalive_job.h> | |
56 | #include <processing/jobs/rekey_ike_sa_job.h> | |
60c82591 | 57 | #include <processing/jobs/retry_initiate_job.h> |
b1f2f05c | 58 | #include <sa/ikev2/tasks/ike_auth_lifetime.h> |
f20e00fe | 59 | #include <sa/ikev2/tasks/ike_reauth_complete.h> |
71c70705 | 60 | #include <sa/ikev2/tasks/ike_redirect.h> |
1b9c1ae0 | 61 | #include <credentials/sets/auth_cfg_wrapper.h> |
7ba38761 | 62 | |
dc04b7c7 | 63 | #ifdef ME |
15a682f4 | 64 | #include <sa/ikev2/tasks/ike_me.h> |
38951252 | 65 | #include <processing/jobs/initiate_mediation_job.h> |
d5cc1758 | 66 | #endif |
c60c7694 | 67 | |
a985db3f | 68 | ENUM(ike_sa_state_names, IKE_CREATED, IKE_DESTROYING, |
60356f33 MW |
69 | "CREATED", |
70 | "CONNECTING", | |
71 | "ESTABLISHED", | |
c610f424 | 72 | "PASSIVE", |
60356f33 | 73 | "REKEYING", |
bb389973 | 74 | "REKEYED", |
60356f33 | 75 | "DELETING", |
a985db3f | 76 | "DESTROYING", |
60356f33 | 77 | ); |
7ba38761 | 78 | |
aad398a7 | 79 | typedef struct private_ike_sa_t private_ike_sa_t; |
7f56b494 | 80 | typedef struct attribute_entry_t attribute_entry_t; |
aad398a7 JH |
81 | |
82 | /** | |
83 | * Private data of an ike_sa_t object. | |
84 | */ | |
85 | struct private_ike_sa_t { | |
7daf5226 | 86 | |
aad398a7 | 87 | /** |
3dd3c5f3 | 88 | * Public members |
2f89902d | 89 | */ |
3dd3c5f3 | 90 | ike_sa_t public; |
7daf5226 | 91 | |
aad398a7 | 92 | /** |
a374d1ee | 93 | * Identifier for the current IKE_SA. |
aad398a7 JH |
94 | */ |
95 | ike_sa_id_t *ike_sa_id; | |
7daf5226 | 96 | |
0b611540 TB |
97 | /** |
98 | * IKE version of this SA. | |
99 | */ | |
100 | ike_version_t version; | |
101 | ||
c60c7694 MW |
102 | /** |
103 | * unique numerical ID for this IKE_SA. | |
104 | */ | |
b12c53ce | 105 | uint32_t unique_id; |
7daf5226 | 106 | |
aad398a7 | 107 | /** |
8dfbe71b | 108 | * Current state of the IKE_SA |
aad398a7 | 109 | */ |
7f56b494 | 110 | ike_sa_state_t state; |
7daf5226 | 111 | |
a9428251 | 112 | /** |
e0fe7651 | 113 | * IKE configuration used to set up this IKE_SA |
a9428251 | 114 | */ |
e0fe7651 | 115 | ike_cfg_t *ike_cfg; |
7daf5226 | 116 | |
c60c7694 MW |
117 | /** |
118 | * Peer and authentication information to establish IKE_SA. | |
119 | */ | |
e0fe7651 | 120 | peer_cfg_t *peer_cfg; |
7daf5226 | 121 | |
552cc11b | 122 | /** |
893da041 | 123 | * currently used authentication ruleset, local |
552cc11b | 124 | */ |
a44bb934 | 125 | auth_cfg_t *my_auth; |
7daf5226 | 126 | |
44ce7493 | 127 | /** |
893da041 | 128 | * currently used authentication constraints, remote |
44ce7493 | 129 | */ |
893da041 | 130 | auth_cfg_t *other_auth; |
44ce7493 MW |
131 | |
132 | /** | |
893da041 | 133 | * Array of completed local authentication rounds (as auth_cfg_t) |
44ce7493 | 134 | */ |
893da041 | 135 | array_t *my_auths; |
44ce7493 | 136 | |
552cc11b | 137 | /** |
893da041 | 138 | * Array of completed remote authentication rounds (as auth_cfg_t) |
552cc11b | 139 | */ |
893da041 | 140 | array_t *other_auths; |
7daf5226 | 141 | |
5dffdea1 MW |
142 | /** |
143 | * Selected IKE proposal | |
144 | */ | |
145 | proposal_t *proposal; | |
7daf5226 | 146 | |
c60c7694 MW |
147 | /** |
148 | * Juggles tasks to process messages | |
149 | */ | |
150 | task_manager_t *task_manager; | |
7daf5226 | 151 | |
8dfbe71b MW |
152 | /** |
153 | * Address of local host | |
154 | */ | |
155 | host_t *my_host; | |
7daf5226 | 156 | |
8dfbe71b MW |
157 | /** |
158 | * Address of remote host | |
159 | */ | |
160 | host_t *other_host; | |
7daf5226 | 161 | |
dc04b7c7 | 162 | #ifdef ME |
22452f70 TB |
163 | /** |
164 | * Are we mediation server | |
165 | */ | |
166 | bool is_mediation_server; | |
7daf5226 | 167 | |
d5cc1758 TB |
168 | /** |
169 | * Server reflexive host | |
170 | */ | |
171 | host_t *server_reflexive_host; | |
7daf5226 | 172 | |
9c2a905d TB |
173 | /** |
174 | * Connect ID | |
175 | */ | |
176 | chunk_t connect_id; | |
dc04b7c7 | 177 | #endif /* ME */ |
7daf5226 | 178 | |
8dfbe71b MW |
179 | /** |
180 | * Identification used for us | |
181 | */ | |
182 | identification_t *my_id; | |
7daf5226 | 183 | |
a9428251 | 184 | /** |
8dfbe71b | 185 | * Identification used for other |
a9428251 | 186 | */ |
8dfbe71b | 187 | identification_t *other_id; |
7daf5226 | 188 | |
3b04350a MW |
189 | /** |
190 | * set of extensions the peer supports | |
191 | */ | |
192 | ike_extension_t extensions; | |
7daf5226 | 193 | |
17d92e97 MW |
194 | /** |
195 | * set of condition flags currently enabled for this IKE_SA | |
196 | */ | |
197 | ike_condition_t conditions; | |
7daf5226 | 198 | |
aad398a7 | 199 | /** |
893da041 | 200 | * Array containing the child sa's of the current IKE_SA. |
aad398a7 | 201 | */ |
893da041 | 202 | array_t *child_sas; |
7daf5226 | 203 | |
bc997f65 | 204 | /** |
6a4ff35c | 205 | * keymat of this IKE_SA |
bc997f65 | 206 | */ |
6a4ff35c | 207 | keymat_t *keymat; |
7daf5226 | 208 | |
3dd3c5f3 | 209 | /** |
101d26ba | 210 | * Virtual IPs on local host |
3dd3c5f3 | 211 | */ |
893da041 | 212 | array_t *my_vips; |
7daf5226 | 213 | |
c60c7694 | 214 | /** |
101d26ba | 215 | * Virtual IPs on remote host |
c60c7694 | 216 | */ |
893da041 | 217 | array_t *other_vips; |
7daf5226 | 218 | |
31e5d441 | 219 | /** |
7f56b494 | 220 | * List of configuration attributes (attribute_entry_t) |
31e5d441 | 221 | */ |
893da041 | 222 | array_t *attributes; |
7daf5226 | 223 | |
17d92e97 | 224 | /** |
94bbc602 | 225 | * list of peer's addresses, additional ones transmitted via MOBIKE |
17d92e97 | 226 | */ |
893da041 | 227 | array_t *peer_addresses; |
7daf5226 | 228 | |
9d9a772e MW |
229 | /** |
230 | * previously value of received DESTINATION_IP hash | |
231 | */ | |
232 | chunk_t nat_detection_dest; | |
7daf5226 | 233 | |
3dfecde4 AS |
234 | /** |
235 | * NAT keep alive interval | |
236 | */ | |
b12c53ce | 237 | uint32_t keepalive_interval; |
7daf5226 | 238 | |
efd7fa7b TB |
239 | /** |
240 | * The schedueld keep alive job, if any | |
241 | */ | |
242 | send_keepalive_job_t *keepalive_job; | |
243 | ||
60c82591 TB |
244 | /** |
245 | * interval for retries during initiation (e.g. if DNS resolution failed), | |
246 | * 0 to disable (default) | |
247 | */ | |
b12c53ce | 248 | uint32_t retry_initiate_interval; |
60c82591 | 249 | |
77e42826 TB |
250 | /** |
251 | * TRUE if a retry_initiate_job has been queued | |
252 | */ | |
253 | bool retry_initiate_queued; | |
254 | ||
1396815a | 255 | /** |
fe04e93a | 256 | * Timestamps for this IKE_SA |
1396815a | 257 | */ |
b12c53ce | 258 | uint32_t stats[STAT_MAX]; |
7daf5226 | 259 | |
fdb9b2bd MW |
260 | /** |
261 | * how many times we have retried so far (keyingtries) | |
262 | */ | |
b12c53ce | 263 | uint32_t keyingtry; |
7daf5226 | 264 | |
d487b4b7 AS |
265 | /** |
266 | * local host address to be used for IKE, set via MIGRATE kernel message | |
267 | */ | |
268 | host_t *local_host; | |
7daf5226 | 269 | |
d487b4b7 AS |
270 | /** |
271 | * remote host address to be used for IKE, set via MIGRATE kernel message | |
272 | */ | |
273 | host_t *remote_host; | |
b24b73b7 MW |
274 | |
275 | /** | |
276 | * Flush auth configs once established? | |
277 | */ | |
278 | bool flush_auth_cfg; | |
40bab9a1 TB |
279 | |
280 | /** | |
281 | * Maximum length of a single fragment, 0 for address-specific defaults | |
282 | */ | |
283 | size_t fragment_size; | |
489d154e TB |
284 | |
285 | /** | |
286 | * Whether to follow IKEv2 redirects | |
287 | */ | |
288 | bool follow_redirects; | |
e4af6e6b TB |
289 | |
290 | /** | |
291 | * Original gateway address from which we got redirected | |
292 | */ | |
293 | host_t *redirected_from; | |
c6ebd033 TB |
294 | |
295 | /** | |
296 | * Timestamps of redirect attempts to handle loops | |
297 | */ | |
298 | array_t *redirected_at; | |
aad398a7 JH |
299 | }; |
300 | ||
7f56b494 MW |
301 | /** |
302 | * Entry to maintain install configuration attributes during IKE_SA lifetime | |
303 | */ | |
304 | struct attribute_entry_t { | |
305 | /** handler used to install this attribute */ | |
306 | attribute_handler_t *handler; | |
307 | /** attribute type */ | |
308 | configuration_attribute_type_t type; | |
309 | /** attribute data */ | |
310 | chunk_t data; | |
311 | }; | |
312 | ||
0b2abb8c | 313 | /** |
3dd3c5f3 | 314 | * get the time of the latest traffic processed by the kernel |
0b2abb8c | 315 | */ |
c60c7694 | 316 | static time_t get_use_time(private_ike_sa_t* this, bool inbound) |
3a8f9f44 | 317 | { |
6e10aead | 318 | enumerator_t *enumerator; |
3dd3c5f3 | 319 | child_sa_t *child_sa; |
c3a78360 | 320 | time_t use_time, current; |
7daf5226 | 321 | |
c60c7694 MW |
322 | if (inbound) |
323 | { | |
85ac2fa5 | 324 | use_time = this->stats[STAT_INBOUND]; |
c60c7694 MW |
325 | } |
326 | else | |
327 | { | |
85ac2fa5 | 328 | use_time = this->stats[STAT_OUTBOUND]; |
c60c7694 | 329 | } |
893da041 MW |
330 | |
331 | enumerator = array_create_enumerator(this->child_sas); | |
6e10aead MW |
332 | while (enumerator->enumerate(enumerator, &child_sa)) |
333 | { | |
d954a208 | 334 | child_sa->get_usestats(child_sa, inbound, ¤t, NULL, NULL); |
c3a78360 | 335 | use_time = max(use_time, current); |
6e10aead MW |
336 | } |
337 | enumerator->destroy(enumerator); | |
7daf5226 | 338 | |
6e10aead | 339 | return use_time; |
a9428251 JH |
340 | } |
341 | ||
b12c53ce | 342 | METHOD(ike_sa_t, get_unique_id, uint32_t, |
8bced61b | 343 | private_ike_sa_t *this) |
aad398a7 | 344 | { |
c60c7694 | 345 | return this->unique_id; |
aad398a7 JH |
346 | } |
347 | ||
8bced61b MW |
348 | METHOD(ike_sa_t, get_name, char*, |
349 | private_ike_sa_t *this) | |
0fdc3c7f | 350 | { |
e0fe7651 | 351 | if (this->peer_cfg) |
c60c7694 | 352 | { |
e0fe7651 | 353 | return this->peer_cfg->get_name(this->peer_cfg); |
c60c7694 MW |
354 | } |
355 | return "(unnamed)"; | |
0fdc3c7f JH |
356 | } |
357 | ||
b12c53ce | 358 | METHOD(ike_sa_t, get_statistic, uint32_t, |
8bced61b | 359 | private_ike_sa_t *this, statistic_t kind) |
a3ce4bc2 | 360 | { |
85ac2fa5 | 361 | if (kind < STAT_MAX) |
a3ce4bc2 | 362 | { |
85ac2fa5 | 363 | return this->stats[kind]; |
a3ce4bc2 | 364 | } |
ee614711 | 365 | return 0; |
a3ce4bc2 MW |
366 | } |
367 | ||
44ff1153 | 368 | METHOD(ike_sa_t, set_statistic, void, |
b12c53ce | 369 | private_ike_sa_t *this, statistic_t kind, uint32_t value) |
44ff1153 TB |
370 | { |
371 | if (kind < STAT_MAX) | |
372 | { | |
373 | this->stats[kind] = value; | |
374 | } | |
375 | } | |
376 | ||
8bced61b MW |
377 | METHOD(ike_sa_t, get_my_host, host_t*, |
378 | private_ike_sa_t *this) | |
8dfbe71b | 379 | { |
e0fe7651 | 380 | return this->my_host; |
8dfbe71b MW |
381 | } |
382 | ||
8bced61b MW |
383 | METHOD(ike_sa_t, set_my_host, void, |
384 | private_ike_sa_t *this, host_t *me) | |
8dfbe71b | 385 | { |
e0fe7651 MW |
386 | DESTROY_IF(this->my_host); |
387 | this->my_host = me; | |
8dfbe71b MW |
388 | } |
389 | ||
8bced61b MW |
390 | METHOD(ike_sa_t, get_other_host, host_t*, |
391 | private_ike_sa_t *this) | |
397f3448 | 392 | { |
e0fe7651 | 393 | return this->other_host; |
c60c7694 MW |
394 | } |
395 | ||
8bced61b MW |
396 | METHOD(ike_sa_t, set_other_host, void, |
397 | private_ike_sa_t *this, host_t *other) | |
c60c7694 | 398 | { |
e0fe7651 MW |
399 | DESTROY_IF(this->other_host); |
400 | this->other_host = other; | |
397f3448 MW |
401 | } |
402 | ||
e4af6e6b TB |
403 | METHOD(ike_sa_t, get_redirected_from, host_t*, |
404 | private_ike_sa_t *this) | |
405 | { | |
406 | return this->redirected_from; | |
407 | } | |
408 | ||
8bced61b MW |
409 | METHOD(ike_sa_t, get_peer_cfg, peer_cfg_t*, |
410 | private_ike_sa_t *this) | |
8dfbe71b | 411 | { |
e0fe7651 | 412 | return this->peer_cfg; |
8dfbe71b MW |
413 | } |
414 | ||
8bced61b MW |
415 | METHOD(ike_sa_t, set_peer_cfg, void, |
416 | private_ike_sa_t *this, peer_cfg_t *peer_cfg) | |
fe04e93a | 417 | { |
e0fe7651 | 418 | peer_cfg->get_ref(peer_cfg); |
dbd21695 | 419 | DESTROY_IF(this->peer_cfg); |
e0fe7651 | 420 | this->peer_cfg = peer_cfg; |
7daf5226 | 421 | |
e0fe7651 MW |
422 | if (this->ike_cfg == NULL) |
423 | { | |
424 | this->ike_cfg = peer_cfg->get_ike_cfg(peer_cfg); | |
425 | this->ike_cfg->get_ref(this->ike_cfg); | |
426 | } | |
552cc11b MW |
427 | } |
428 | ||
8bced61b MW |
429 | METHOD(ike_sa_t, get_auth_cfg, auth_cfg_t*, |
430 | private_ike_sa_t *this, bool local) | |
552cc11b | 431 | { |
a44bb934 MW |
432 | if (local) |
433 | { | |
434 | return this->my_auth; | |
435 | } | |
552cc11b MW |
436 | return this->other_auth; |
437 | } | |
438 | ||
8bced61b MW |
439 | METHOD(ike_sa_t, add_auth_cfg, void, |
440 | private_ike_sa_t *this, bool local, auth_cfg_t *cfg) | |
44ce7493 MW |
441 | { |
442 | if (local) | |
443 | { | |
893da041 | 444 | array_insert(this->my_auths, ARRAY_TAIL, cfg); |
44ce7493 MW |
445 | } |
446 | else | |
447 | { | |
893da041 | 448 | array_insert(this->other_auths, ARRAY_TAIL, cfg); |
44ce7493 MW |
449 | } |
450 | } | |
451 | ||
8bced61b MW |
452 | METHOD(ike_sa_t, create_auth_cfg_enumerator, enumerator_t*, |
453 | private_ike_sa_t *this, bool local) | |
44ce7493 MW |
454 | { |
455 | if (local) | |
456 | { | |
893da041 | 457 | return array_create_enumerator(this->my_auths); |
44ce7493 | 458 | } |
893da041 | 459 | return array_create_enumerator(this->other_auths); |
44ce7493 MW |
460 | } |
461 | ||
e41adf5f TB |
462 | /** |
463 | * Flush the stored authentication round information | |
464 | */ | |
465 | static void flush_auth_cfgs(private_ike_sa_t *this) | |
466 | { | |
467 | auth_cfg_t *cfg; | |
468 | ||
469 | this->my_auth->purge(this->my_auth, FALSE); | |
470 | this->other_auth->purge(this->other_auth, FALSE); | |
471 | ||
472 | while (array_remove(this->my_auths, ARRAY_TAIL, &cfg)) | |
473 | { | |
474 | cfg->destroy(cfg); | |
475 | } | |
476 | while (array_remove(this->other_auths, ARRAY_TAIL, &cfg)) | |
477 | { | |
478 | cfg->destroy(cfg); | |
479 | } | |
480 | } | |
481 | ||
1b9c1ae0 TB |
482 | METHOD(ike_sa_t, verify_peer_certificate, bool, |
483 | private_ike_sa_t *this) | |
484 | { | |
485 | enumerator_t *e1, *e2, *certs; | |
486 | auth_cfg_t *cfg, *cfg_done; | |
487 | certificate_t *peer, *cert; | |
488 | public_key_t *key; | |
489 | auth_cfg_t *auth; | |
490 | auth_cfg_wrapper_t *wrapper; | |
491 | time_t not_before, not_after; | |
492 | bool valid = TRUE, found; | |
493 | ||
494 | if (this->state != IKE_ESTABLISHED) | |
495 | { | |
496 | DBG1(DBG_IKE, "unable to verify peer certificate in state %N", | |
497 | ike_sa_state_names, this->state); | |
498 | return FALSE; | |
499 | } | |
500 | ||
e41adf5f TB |
501 | if (!this->flush_auth_cfg && |
502 | lib->settings->get_bool(lib->settings, | |
1b9c1ae0 | 503 | "%s.flush_auth_cfg", FALSE, lib->ns)) |
e41adf5f | 504 | { /* we can do this check only once if auth configs are flushed */ |
1b9c1ae0 TB |
505 | DBG1(DBG_IKE, "unable to verify peer certificate as authentication " |
506 | "information has been flushed"); | |
507 | return FALSE; | |
508 | } | |
e41adf5f TB |
509 | this->public.set_condition(&this->public, COND_ONLINE_VALIDATION_SUSPENDED, |
510 | FALSE); | |
1b9c1ae0 TB |
511 | |
512 | e1 = this->peer_cfg->create_auth_cfg_enumerator(this->peer_cfg, FALSE); | |
513 | e2 = array_create_enumerator(this->other_auths); | |
514 | while (e1->enumerate(e1, &cfg)) | |
515 | { | |
516 | if (!e2->enumerate(e2, &cfg_done)) | |
517 | { /* this should not happen as the authentication should never have | |
518 | * succeeded */ | |
519 | valid = FALSE; | |
520 | break; | |
521 | } | |
522 | if ((uintptr_t)cfg_done->get(cfg_done, | |
523 | AUTH_RULE_AUTH_CLASS) != AUTH_CLASS_PUBKEY) | |
524 | { | |
525 | continue; | |
526 | } | |
527 | peer = cfg_done->get(cfg_done, AUTH_RULE_SUBJECT_CERT); | |
528 | if (!peer) | |
529 | { | |
530 | DBG1(DBG_IKE, "no subject certificate found, skipping certificate " | |
531 | "verification"); | |
532 | continue; | |
533 | } | |
534 | if (!peer->get_validity(peer, NULL, ¬_before, ¬_after)) | |
535 | { | |
1b9c1ae0 TB |
536 | DBG1(DBG_IKE, "peer certificate invalid (valid from %T to %T)", |
537 | ¬_before, FALSE, ¬_after, FALSE); | |
538 | valid = FALSE; | |
539 | break; | |
540 | } | |
541 | key = peer->get_public_key(peer); | |
542 | if (!key) | |
543 | { | |
544 | DBG1(DBG_IKE, "unable to retrieve public key, skipping certificate " | |
545 | "verification"); | |
546 | continue; | |
547 | } | |
548 | DBG1(DBG_IKE, "verifying peer certificate"); | |
549 | /* serve received certificates */ | |
550 | wrapper = auth_cfg_wrapper_create(cfg_done); | |
551 | lib->credmgr->add_local_set(lib->credmgr, &wrapper->set, FALSE); | |
552 | certs = lib->credmgr->create_trusted_enumerator(lib->credmgr, | |
553 | key->get_type(key), peer->get_subject(peer), TRUE); | |
554 | key->destroy(key); | |
555 | ||
556 | found = FALSE; | |
557 | while (certs->enumerate(certs, &cert, &auth)) | |
558 | { | |
559 | if (peer->equals(peer, cert)) | |
560 | { | |
561 | cfg_done->add(cfg_done, AUTH_RULE_CERT_VALIDATION_SUSPENDED, | |
562 | FALSE); | |
563 | cfg_done->merge(cfg_done, auth, FALSE); | |
564 | valid = cfg_done->complies(cfg_done, cfg, TRUE); | |
565 | found = TRUE; | |
566 | break; | |
567 | } | |
568 | } | |
569 | certs->destroy(certs); | |
570 | lib->credmgr->remove_local_set(lib->credmgr, &wrapper->set); | |
571 | wrapper->destroy(wrapper); | |
572 | if (!found || !valid) | |
573 | { | |
574 | valid = FALSE; | |
575 | break; | |
576 | } | |
577 | } | |
578 | e1->destroy(e1); | |
579 | e2->destroy(e2); | |
1b9c1ae0 | 580 | |
e41adf5f | 581 | if (this->flush_auth_cfg) |
44ce7493 | 582 | { |
e41adf5f TB |
583 | this->flush_auth_cfg = FALSE; |
584 | flush_auth_cfgs(this); | |
44ce7493 | 585 | } |
e41adf5f | 586 | return valid; |
44ce7493 MW |
587 | } |
588 | ||
8bced61b MW |
589 | METHOD(ike_sa_t, get_proposal, proposal_t*, |
590 | private_ike_sa_t *this) | |
5dffdea1 MW |
591 | { |
592 | return this->proposal; | |
593 | } | |
594 | ||
8bced61b MW |
595 | METHOD(ike_sa_t, set_proposal, void, |
596 | private_ike_sa_t *this, proposal_t *proposal) | |
5dffdea1 MW |
597 | { |
598 | DESTROY_IF(this->proposal); | |
599 | this->proposal = proposal->clone(proposal); | |
600 | } | |
601 | ||
8bced61b | 602 | METHOD(ike_sa_t, set_message_id, void, |
b12c53ce | 603 | private_ike_sa_t *this, bool initiate, uint32_t mid) |
b09ca747 MW |
604 | { |
605 | if (initiate) | |
606 | { | |
f1f09810 | 607 | this->task_manager->reset(this->task_manager, mid, UINT_MAX); |
b09ca747 MW |
608 | } |
609 | else | |
610 | { | |
f1f09810 | 611 | this->task_manager->reset(this->task_manager, UINT_MAX, mid); |
b09ca747 MW |
612 | } |
613 | } | |
614 | ||
347c403c TB |
615 | METHOD(ike_sa_t, get_message_id, uint32_t, |
616 | private_ike_sa_t *this, bool initiate) | |
617 | { | |
618 | return this->task_manager->get_mid(this->task_manager, initiate); | |
619 | } | |
620 | ||
8bced61b | 621 | METHOD(ike_sa_t, send_keepalive, void, |
efd7fa7b | 622 | private_ike_sa_t *this, bool scheduled) |
2b3100b5 | 623 | { |
2b3100b5 | 624 | time_t last_out, now, diff; |
7daf5226 | 625 | |
efd7fa7b TB |
626 | if (scheduled) |
627 | { | |
628 | this->keepalive_job = NULL; | |
629 | } | |
34f7d3b7 TB |
630 | if (!this->keepalive_interval || this->state == IKE_PASSIVE) |
631 | { /* keepalives disabled either by configuration or for passive IKE_SAs */ | |
632 | return; | |
633 | } | |
634 | if (!(this->conditions & COND_NAT_HERE) || (this->conditions & COND_STALE)) | |
635 | { /* disable keepalives if we are not NATed anymore, or the SA is stale */ | |
3d928c9f MW |
636 | return; |
637 | } | |
7daf5226 | 638 | |
2b3100b5 | 639 | last_out = get_use_time(this, FALSE); |
6180a558 | 640 | now = time_monotonic(NULL); |
7daf5226 | 641 | |
2b3100b5 | 642 | diff = now - last_out; |
7daf5226 | 643 | |
3dfecde4 | 644 | if (diff >= this->keepalive_interval) |
2b3100b5 MW |
645 | { |
646 | packet_t *packet; | |
647 | chunk_t data; | |
7daf5226 | 648 | |
2b3100b5 MW |
649 | packet = packet_create(); |
650 | packet->set_source(packet, this->my_host->clone(this->my_host)); | |
651 | packet->set_destination(packet, this->other_host->clone(this->other_host)); | |
652 | data.ptr = malloc(1); | |
653 | data.ptr[0] = 0xFF; | |
654 | data.len = 1; | |
655 | packet->set_data(packet, data); | |
f3fefb18 | 656 | DBG1(DBG_IKE, "sending keep alive to %#H", this->other_host); |
75f83163 | 657 | charon->sender->send_no_marker(charon->sender, packet); |
2b3100b5 MW |
658 | diff = 0; |
659 | } | |
efd7fa7b TB |
660 | if (!this->keepalive_job) |
661 | { | |
662 | this->keepalive_job = send_keepalive_job_create(this->ike_sa_id); | |
663 | lib->scheduler->schedule_job(lib->scheduler, (job_t*)this->keepalive_job, | |
664 | this->keepalive_interval - diff); | |
665 | } | |
2b3100b5 MW |
666 | } |
667 | ||
8bced61b MW |
668 | METHOD(ike_sa_t, get_ike_cfg, ike_cfg_t*, |
669 | private_ike_sa_t *this) | |
8dfbe71b | 670 | { |
e0fe7651 | 671 | return this->ike_cfg; |
8dfbe71b | 672 | } |
5b97779f | 673 | |
8bced61b MW |
674 | METHOD(ike_sa_t, set_ike_cfg, void, |
675 | private_ike_sa_t *this, ike_cfg_t *ike_cfg) | |
fe04e93a | 676 | { |
054ee5e7 | 677 | DESTROY_IF(this->ike_cfg); |
e0fe7651 MW |
678 | ike_cfg->get_ref(ike_cfg); |
679 | this->ike_cfg = ike_cfg; | |
fe04e93a | 680 | } |
4a035181 | 681 | |
8bced61b MW |
682 | METHOD(ike_sa_t, enable_extension, void, |
683 | private_ike_sa_t *this, ike_extension_t extension) | |
2b3100b5 MW |
684 | { |
685 | this->extensions |= extension; | |
686 | } | |
687 | ||
8bced61b MW |
688 | METHOD(ike_sa_t, supports_extension, bool, |
689 | private_ike_sa_t *this, ike_extension_t extension) | |
2b3100b5 MW |
690 | { |
691 | return (this->extensions & extension) != FALSE; | |
692 | } | |
693 | ||
8bced61b MW |
694 | METHOD(ike_sa_t, has_condition, bool, |
695 | private_ike_sa_t *this, ike_condition_t condition) | |
2b3100b5 MW |
696 | { |
697 | return (this->conditions & condition) != FALSE; | |
698 | } | |
699 | ||
8bced61b MW |
700 | METHOD(ike_sa_t, set_condition, void, |
701 | private_ike_sa_t *this, ike_condition_t condition, bool enable) | |
2b3100b5 MW |
702 | { |
703 | if (has_condition(this, condition) != enable) | |
704 | { | |
705 | if (enable) | |
706 | { | |
fc2d1c42 | 707 | this->conditions |= condition; |
2b3100b5 MW |
708 | switch (condition) |
709 | { | |
2b3100b5 MW |
710 | case COND_NAT_HERE: |
711 | DBG1(DBG_IKE, "local host is behind NAT, sending keep alives"); | |
712 | this->conditions |= COND_NAT_ANY; | |
efd7fa7b | 713 | send_keepalive(this, FALSE); |
2b3100b5 MW |
714 | break; |
715 | case COND_NAT_THERE: | |
716 | DBG1(DBG_IKE, "remote host is behind NAT"); | |
717 | this->conditions |= COND_NAT_ANY; | |
718 | break; | |
9dae1bed | 719 | case COND_NAT_FAKE: |
f53b74c9 | 720 | DBG1(DBG_IKE, "faking NAT situation to enforce UDP encapsulation"); |
9dae1bed MW |
721 | this->conditions |= COND_NAT_ANY; |
722 | break; | |
2b3100b5 MW |
723 | default: |
724 | break; | |
725 | } | |
2b3100b5 MW |
726 | } |
727 | else | |
728 | { | |
fc2d1c42 | 729 | this->conditions &= ~condition; |
2b3100b5 MW |
730 | switch (condition) |
731 | { | |
fc2d1c42 MW |
732 | case COND_NAT_HERE: |
733 | case COND_NAT_THERE: | |
f9056115 TB |
734 | DBG1(DBG_IKE, "%s host is not behind NAT anymore", |
735 | condition == COND_NAT_HERE ? "local" : "remote"); | |
736 | /* fall-through */ | |
737 | case COND_NAT_FAKE: | |
fc2d1c42 MW |
738 | set_condition(this, COND_NAT_ANY, |
739 | has_condition(this, COND_NAT_HERE) || | |
9dae1bed MW |
740 | has_condition(this, COND_NAT_THERE) || |
741 | has_condition(this, COND_NAT_FAKE)); | |
fc2d1c42 | 742 | break; |
34f7d3b7 | 743 | case COND_STALE: |
efd7fa7b | 744 | send_keepalive(this, FALSE); |
34f7d3b7 | 745 | break; |
2b3100b5 MW |
746 | default: |
747 | break; | |
748 | } | |
2b3100b5 MW |
749 | } |
750 | } | |
751 | } | |
fe04e93a | 752 | |
8bced61b MW |
753 | METHOD(ike_sa_t, send_dpd, status_t, |
754 | private_ike_sa_t *this) | |
fdb9b2bd | 755 | { |
6554b5e4 | 756 | job_t *job; |
fdb9b2bd | 757 | time_t diff, delay; |
bcf8cdd5 | 758 | bool task_queued = FALSE; |
7daf5226 | 759 | |
916cdca8 MW |
760 | if (this->state == IKE_PASSIVE) |
761 | { | |
762 | return INVALID_STATE; | |
763 | } | |
f15c85a4 TB |
764 | if (this->version == IKEV1 && this->state == IKE_REKEYING) |
765 | { /* don't send DPDs for rekeyed IKEv1 SAs */ | |
766 | return SUCCESS; | |
767 | } | |
96926b00 | 768 | delay = this->peer_cfg->get_dpd(this->peer_cfg); |
fdb9b2bd MW |
769 | if (this->task_manager->busy(this->task_manager)) |
770 | { | |
771 | /* an exchange is in the air, no need to start a DPD check */ | |
772 | diff = 0; | |
773 | } | |
774 | else | |
775 | { | |
776 | /* check if there was any inbound traffic */ | |
777 | time_t last_in, now; | |
778 | last_in = get_use_time(this, TRUE); | |
6180a558 | 779 | now = time_monotonic(NULL); |
fdb9b2bd | 780 | diff = now - last_in; |
6c2d466b | 781 | if (!delay || diff >= delay) |
fdb9b2bd | 782 | { |
bcf8cdd5 | 783 | /* too long ago, initiate dead peer detection */ |
fdb9b2bd | 784 | DBG1(DBG_IKE, "sending DPD request"); |
244d715d | 785 | this->task_manager->queue_dpd(this->task_manager); |
bcf8cdd5 | 786 | task_queued = TRUE; |
244d715d | 787 | diff = 0; |
fdb9b2bd MW |
788 | } |
789 | } | |
790 | /* recheck in "interval" seconds */ | |
6c2d466b MW |
791 | if (delay) |
792 | { | |
793 | job = (job_t*)send_dpd_job_create(this->ike_sa_id); | |
794 | lib->scheduler->schedule_job(lib->scheduler, job, delay - diff); | |
795 | } | |
bcf8cdd5 TB |
796 | if (task_queued) |
797 | { | |
798 | return this->task_manager->initiate(this->task_manager); | |
799 | } | |
800 | return SUCCESS; | |
fdb9b2bd MW |
801 | } |
802 | ||
8bced61b MW |
803 | METHOD(ike_sa_t, get_state, ike_sa_state_t, |
804 | private_ike_sa_t *this) | |
fdb9b2bd MW |
805 | { |
806 | return this->state; | |
807 | } | |
808 | ||
8bced61b MW |
809 | METHOD(ike_sa_t, set_state, void, |
810 | private_ike_sa_t *this, ike_sa_state_t state) | |
fdb9b2bd | 811 | { |
edaba56e | 812 | bool trigger_dpd = FALSE, keepalives = FALSE; |
85dd6a8d | 813 | |
98ba96f1 | 814 | DBG2(DBG_IKE, "IKE_SA %s[%d] state change: %N => %N", |
51c8f826 | 815 | get_name(this), this->unique_id, |
fdb9b2bd MW |
816 | ike_sa_state_names, this->state, |
817 | ike_sa_state_names, state); | |
7daf5226 | 818 | |
0f33e826 | 819 | switch (state) |
fdb9b2bd | 820 | { |
0f33e826 | 821 | case IKE_ESTABLISHED: |
fdb9b2bd | 822 | { |
405cc1d9 MW |
823 | if (this->state == IKE_CONNECTING || |
824 | this->state == IKE_PASSIVE) | |
0f33e826 MW |
825 | { |
826 | job_t *job; | |
b12c53ce | 827 | uint32_t t; |
7daf5226 | 828 | |
ee614711 | 829 | /* calculate rekey, reauth and lifetime */ |
6180a558 | 830 | this->stats[STAT_ESTABLISHED] = time_monotonic(NULL); |
7daf5226 | 831 | |
ee614711 MW |
832 | /* schedule rekeying if we have a time which is smaller than |
833 | * an already scheduled rekeying */ | |
d08269c7 | 834 | t = this->peer_cfg->get_rekey_time(this->peer_cfg, TRUE); |
484a06bc | 835 | if (t && (this->stats[STAT_REKEY] == 0 || |
85ac2fa5 | 836 | (this->stats[STAT_REKEY] > t + this->stats[STAT_ESTABLISHED]))) |
0f33e826 | 837 | { |
85ac2fa5 | 838 | this->stats[STAT_REKEY] = t + this->stats[STAT_ESTABLISHED]; |
ee614711 | 839 | job = (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, FALSE); |
bb381e26 | 840 | lib->scheduler->schedule_job(lib->scheduler, job, t); |
ee614711 | 841 | DBG1(DBG_IKE, "scheduling rekeying in %ds", t); |
0f33e826 | 842 | } |
d08269c7 | 843 | t = this->peer_cfg->get_reauth_time(this->peer_cfg, TRUE); |
484a06bc | 844 | if (t && (this->stats[STAT_REAUTH] == 0 || |
85ac2fa5 | 845 | (this->stats[STAT_REAUTH] > t + this->stats[STAT_ESTABLISHED]))) |
ee614711 | 846 | { |
85ac2fa5 | 847 | this->stats[STAT_REAUTH] = t + this->stats[STAT_ESTABLISHED]; |
ee614711 | 848 | job = (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE); |
bb381e26 | 849 | lib->scheduler->schedule_job(lib->scheduler, job, t); |
ee614711 MW |
850 | DBG1(DBG_IKE, "scheduling reauthentication in %ds", t); |
851 | } | |
852 | t = this->peer_cfg->get_over_time(this->peer_cfg); | |
85ac2fa5 | 853 | if (this->stats[STAT_REKEY] || this->stats[STAT_REAUTH]) |
0f33e826 | 854 | { |
85ac2fa5 | 855 | if (this->stats[STAT_REAUTH] == 0) |
ee614711 | 856 | { |
85ac2fa5 | 857 | this->stats[STAT_DELETE] = this->stats[STAT_REKEY]; |
ee614711 | 858 | } |
85ac2fa5 | 859 | else if (this->stats[STAT_REKEY] == 0) |
ee614711 | 860 | { |
85ac2fa5 | 861 | this->stats[STAT_DELETE] = this->stats[STAT_REAUTH]; |
ee614711 MW |
862 | } |
863 | else | |
864 | { | |
85ac2fa5 MW |
865 | this->stats[STAT_DELETE] = min(this->stats[STAT_REKEY], |
866 | this->stats[STAT_REAUTH]); | |
ee614711 | 867 | } |
85ac2fa5 MW |
868 | this->stats[STAT_DELETE] += t; |
869 | t = this->stats[STAT_DELETE] - this->stats[STAT_ESTABLISHED]; | |
0f33e826 | 870 | job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE); |
bb381e26 | 871 | lib->scheduler->schedule_job(lib->scheduler, job, t); |
ee614711 | 872 | DBG1(DBG_IKE, "maximum IKE_SA lifetime %ds", t); |
0f33e826 | 873 | } |
85dd6a8d | 874 | trigger_dpd = this->peer_cfg->get_dpd(this->peer_cfg); |
b76e96e2 MW |
875 | if (trigger_dpd) |
876 | { | |
877 | /* Some peers delay the DELETE after rekeying an IKE_SA. | |
878 | * If this delay is longer than our DPD delay, we would | |
879 | * send a DPD request here. The IKE_SA is not ready to do | |
880 | * so yet, so prevent that. */ | |
881 | this->stats[STAT_INBOUND] = this->stats[STAT_ESTABLISHED]; | |
882 | } | |
edaba56e TE |
883 | if (this->state == IKE_PASSIVE) |
884 | { | |
885 | keepalives = TRUE; | |
886 | } | |
e4af6e6b TB |
887 | DESTROY_IF(this->redirected_from); |
888 | this->redirected_from = NULL; | |
0f33e826 MW |
889 | } |
890 | break; | |
fdb9b2bd | 891 | } |
0f33e826 MW |
892 | default: |
893 | break; | |
fdb9b2bd | 894 | } |
a985db3f | 895 | charon->bus->ike_state_change(charon->bus, &this->public, state); |
fdb9b2bd | 896 | this->state = state; |
85dd6a8d MW |
897 | |
898 | if (trigger_dpd) | |
899 | { | |
f98af1dd MW |
900 | if (supports_extension(this, EXT_DPD)) |
901 | { | |
902 | send_dpd(this); | |
903 | } | |
904 | else | |
905 | { | |
906 | DBG1(DBG_IKE, "DPD not supported by peer, disabled"); | |
907 | } | |
85dd6a8d | 908 | } |
edaba56e TE |
909 | if (keepalives) |
910 | { | |
efd7fa7b | 911 | send_keepalive(this, FALSE); |
edaba56e | 912 | } |
fdb9b2bd MW |
913 | } |
914 | ||
8bced61b | 915 | METHOD(ike_sa_t, reset, void, |
c3539961 | 916 | private_ike_sa_t *this, bool new_spi) |
fdb9b2bd | 917 | { |
c3539961 TB |
918 | /* reset the initiator SPI if requested */ |
919 | if (new_spi) | |
920 | { | |
921 | charon->ike_sa_manager->new_initiator_spi(charon->ike_sa_manager, | |
922 | &this->public); | |
923 | } | |
924 | /* the responder ID is reset, as peer may choose another one */ | |
fdb9b2bd MW |
925 | if (this->ike_sa_id->is_initiator(this->ike_sa_id)) |
926 | { | |
927 | this->ike_sa_id->set_responder_spi(this->ike_sa_id, 0); | |
928 | } | |
7daf5226 | 929 | |
fdb9b2bd | 930 | set_state(this, IKE_CREATED); |
7daf5226 | 931 | |
550d9085 MW |
932 | flush_auth_cfgs(this); |
933 | ||
934 | this->keymat->destroy(this->keymat); | |
4b64a1a1 TB |
935 | this->keymat = keymat_create(this->version, |
936 | this->ike_sa_id->is_initiator(this->ike_sa_id)); | |
550d9085 | 937 | |
b09ca747 | 938 | this->task_manager->reset(this->task_manager, 0, 0); |
d9fe0ec7 | 939 | this->task_manager->queue_ike(this->task_manager); |
fdb9b2bd MW |
940 | } |
941 | ||
8bced61b MW |
942 | METHOD(ike_sa_t, get_keymat, keymat_t*, |
943 | private_ike_sa_t *this) | |
6a4ff35c MW |
944 | { |
945 | return this->keymat; | |
946 | } | |
947 | ||
101d26ba | 948 | METHOD(ike_sa_t, add_virtual_ip, void, |
8bced61b | 949 | private_ike_sa_t *this, bool local, host_t *ip) |
c532d646 MW |
950 | { |
951 | if (local) | |
952 | { | |
b185cdd1 MW |
953 | char *iface; |
954 | ||
8394ea2a TB |
955 | if (charon->kernel->get_interface(charon->kernel, this->my_host, |
956 | &iface)) | |
c532d646 | 957 | { |
b185cdd1 | 958 | DBG1(DBG_IKE, "installing new virtual IP %H", ip); |
8394ea2a TB |
959 | if (charon->kernel->add_ip(charon->kernel, ip, -1, |
960 | iface) == SUCCESS) | |
b185cdd1 | 961 | { |
893da041 | 962 | array_insert_create(&this->my_vips, ARRAY_TAIL, ip->clone(ip)); |
b185cdd1 MW |
963 | } |
964 | else | |
965 | { | |
966 | DBG1(DBG_IKE, "installing virtual IP %H failed", ip); | |
967 | } | |
968 | free(iface); | |
c532d646 MW |
969 | } |
970 | else | |
971 | { | |
b185cdd1 | 972 | DBG1(DBG_IKE, "looking up interface for virtual IP %H failed", ip); |
c532d646 MW |
973 | } |
974 | } | |
975 | else | |
976 | { | |
893da041 | 977 | array_insert_create(&this->other_vips, ARRAY_TAIL, ip->clone(ip)); |
c532d646 MW |
978 | } |
979 | } | |
980 | ||
d2e8f20d TB |
981 | |
982 | METHOD(ike_sa_t, clear_virtual_ips, void, | |
983 | private_ike_sa_t *this, bool local) | |
984 | { | |
893da041 | 985 | array_t *vips; |
d2e8f20d TB |
986 | host_t *vip; |
987 | ||
893da041 MW |
988 | vips = local ? this->my_vips : this->other_vips; |
989 | if (!local && array_count(vips)) | |
12fa1784 AS |
990 | { |
991 | charon->bus->assign_vips(charon->bus, &this->public, FALSE); | |
992 | } | |
893da041 | 993 | while (array_remove(vips, ARRAY_HEAD, &vip)) |
d2e8f20d TB |
994 | { |
995 | if (local) | |
996 | { | |
8394ea2a | 997 | charon->kernel->del_ip(charon->kernel, vip, -1, TRUE); |
d2e8f20d TB |
998 | } |
999 | vip->destroy(vip); | |
1000 | } | |
1001 | } | |
1002 | ||
101d26ba | 1003 | METHOD(ike_sa_t, create_virtual_ip_enumerator, enumerator_t*, |
8bced61b | 1004 | private_ike_sa_t *this, bool local) |
c532d646 MW |
1005 | { |
1006 | if (local) | |
1007 | { | |
893da041 | 1008 | return array_create_enumerator(this->my_vips); |
c532d646 | 1009 | } |
893da041 | 1010 | return array_create_enumerator(this->other_vips); |
c532d646 MW |
1011 | } |
1012 | ||
94bbc602 | 1013 | METHOD(ike_sa_t, add_peer_address, void, |
8bced61b | 1014 | private_ike_sa_t *this, host_t *host) |
c532d646 | 1015 | { |
893da041 | 1016 | array_insert_create(&this->peer_addresses, ARRAY_TAIL, host); |
c532d646 | 1017 | } |
7daf5226 | 1018 | |
94bbc602 | 1019 | METHOD(ike_sa_t, create_peer_address_enumerator, enumerator_t*, |
8bced61b | 1020 | private_ike_sa_t *this) |
c532d646 | 1021 | { |
893da041 | 1022 | if (this->peer_addresses) |
12715f19 | 1023 | { |
893da041 | 1024 | return array_create_enumerator(this->peer_addresses); |
12715f19 TB |
1025 | } |
1026 | /* in case we don't have MOBIKE */ | |
1027 | return enumerator_create_single(this->other_host, NULL); | |
572abc6c TB |
1028 | } |
1029 | ||
94bbc602 | 1030 | METHOD(ike_sa_t, clear_peer_addresses, void, |
572abc6c TB |
1031 | private_ike_sa_t *this) |
1032 | { | |
893da041 MW |
1033 | array_destroy_offset(this->peer_addresses, offsetof(host_t, destroy)); |
1034 | this->peer_addresses = NULL; | |
c532d646 | 1035 | } |
9d9a772e | 1036 | |
8bced61b MW |
1037 | METHOD(ike_sa_t, has_mapping_changed, bool, |
1038 | private_ike_sa_t *this, chunk_t hash) | |
9d9a772e MW |
1039 | { |
1040 | if (this->nat_detection_dest.ptr == NULL) | |
1041 | { | |
1042 | this->nat_detection_dest = chunk_clone(hash); | |
1043 | return FALSE; | |
1044 | } | |
1045 | if (chunk_equals(hash, this->nat_detection_dest)) | |
1046 | { | |
1047 | return FALSE; | |
1048 | } | |
1049 | free(this->nat_detection_dest.ptr); | |
1050 | this->nat_detection_dest = chunk_clone(hash); | |
1051 | return TRUE; | |
1052 | } | |
1053 | ||
277f02ce TB |
1054 | METHOD(ike_sa_t, float_ports, void, |
1055 | private_ike_sa_t *this) | |
1056 | { | |
85bfab62 TB |
1057 | /* even if the remote port is not 500 (e.g. because the response was natted) |
1058 | * we switch the remote port if we used port 500 */ | |
1059 | if (this->other_host->get_port(this->other_host) == IKEV2_UDP_PORT || | |
1060 | this->my_host->get_port(this->my_host) == IKEV2_UDP_PORT) | |
1061 | { | |
1062 | this->other_host->set_port(this->other_host, IKEV2_NATT_PORT); | |
1063 | } | |
b223d517 TB |
1064 | if (this->my_host->get_port(this->my_host) == |
1065 | charon->socket->get_port(charon->socket, FALSE)) | |
277f02ce | 1066 | { |
b223d517 TB |
1067 | this->my_host->set_port(this->my_host, |
1068 | charon->socket->get_port(charon->socket, TRUE)); | |
277f02ce | 1069 | } |
277f02ce TB |
1070 | } |
1071 | ||
8bced61b | 1072 | METHOD(ike_sa_t, update_hosts, void, |
2082417d | 1073 | private_ike_sa_t *this, host_t *me, host_t *other, bool force) |
0fdc3c7f | 1074 | { |
2b3100b5 | 1075 | bool update = FALSE; |
7daf5226 | 1076 | |
2b3100b5 | 1077 | if (me == NULL) |
8dfbe71b | 1078 | { |
2b3100b5 | 1079 | me = this->my_host; |
8dfbe71b | 1080 | } |
2b3100b5 | 1081 | if (other == NULL) |
3dd3c5f3 | 1082 | { |
2b3100b5 | 1083 | other = this->other_host; |
3dd3c5f3 | 1084 | } |
7daf5226 | 1085 | |
2b3100b5 MW |
1086 | /* apply hosts on first received message */ |
1087 | if (this->my_host->is_anyaddr(this->my_host) || | |
1088 | this->other_host->is_anyaddr(this->other_host)) | |
3dd3c5f3 | 1089 | { |
2b3100b5 MW |
1090 | set_my_host(this, me->clone(me)); |
1091 | set_other_host(this, other->clone(other)); | |
1092 | update = TRUE; | |
3dd3c5f3 MW |
1093 | } |
1094 | else | |
1095 | { | |
2b3100b5 | 1096 | /* update our address in any case */ |
21dd4c4b | 1097 | if (force && !me->equals(me, this->my_host)) |
3dd3c5f3 | 1098 | { |
e1fe2781 | 1099 | charon->bus->ike_update(charon->bus, &this->public, TRUE, me); |
2b3100b5 MW |
1100 | set_my_host(this, me->clone(me)); |
1101 | update = TRUE; | |
3dd3c5f3 | 1102 | } |
7daf5226 | 1103 | |
472156ee TB |
1104 | if (!other->equals(other, this->other_host) && |
1105 | (force || has_condition(this, COND_NAT_THERE))) | |
3dd3c5f3 | 1106 | { |
472156ee TB |
1107 | /* only update other's address if we are behind a static NAT, |
1108 | * which we assume is the case if we are not initiator */ | |
1109 | if (force || | |
1110 | (!has_condition(this, COND_NAT_HERE) || | |
1111 | !has_condition(this, COND_ORIGINAL_INITIATOR))) | |
2b3100b5 | 1112 | { |
e1fe2781 | 1113 | charon->bus->ike_update(charon->bus, &this->public, FALSE, other); |
2b3100b5 MW |
1114 | set_other_host(this, other->clone(other)); |
1115 | update = TRUE; | |
1116 | } | |
3dd3c5f3 MW |
1117 | } |
1118 | } | |
7daf5226 | 1119 | |
2b3100b5 MW |
1120 | /* update all associated CHILD_SAs, if required */ |
1121 | if (update) | |
3dd3c5f3 | 1122 | { |
e2630434 | 1123 | enumerator_t *enumerator; |
2b3100b5 | 1124 | child_sa_t *child_sa; |
893da041 | 1125 | linked_list_t *vips; |
7daf5226 | 1126 | |
893da041 MW |
1127 | vips = linked_list_create_from_enumerator( |
1128 | array_create_enumerator(this->my_vips)); | |
1129 | ||
1130 | enumerator = array_create_enumerator(this->child_sas); | |
1131 | while (enumerator->enumerate(enumerator, &child_sa)) | |
2b3100b5 | 1132 | { |
38227d0e MW |
1133 | charon->child_sa_manager->remove(charon->child_sa_manager, child_sa); |
1134 | charon->child_sa_manager->add(charon->child_sa_manager, | |
1135 | child_sa, &this->public); | |
1136 | ||
893da041 MW |
1137 | if (child_sa->update(child_sa, this->my_host, this->other_host, |
1138 | vips, has_condition(this, COND_NAT_ANY)) == NOT_SUPPORTED) | |
ea625fab TB |
1139 | { |
1140 | this->public.rekey_child_sa(&this->public, | |
1141 | child_sa->get_protocol(child_sa), | |
1142 | child_sa->get_spi(child_sa, TRUE)); | |
1143 | } | |
38227d0e | 1144 | |
2b3100b5 | 1145 | } |
e2630434 | 1146 | enumerator->destroy(enumerator); |
893da041 MW |
1147 | |
1148 | vips->destroy(vips); | |
3dd3c5f3 | 1149 | } |
8d77edde MW |
1150 | } |
1151 | ||
5b15bd5f MW |
1152 | /** |
1153 | * Set configured DSCP value on packet | |
1154 | */ | |
1155 | static void set_dscp(private_ike_sa_t *this, packet_t *packet) | |
1156 | { | |
1157 | ike_cfg_t *ike_cfg; | |
1158 | ||
1159 | /* prefer IKE config on peer_cfg, as its selection is more accurate | |
1160 | * then the initial IKE config */ | |
1161 | if (this->peer_cfg) | |
1162 | { | |
1163 | ike_cfg = this->peer_cfg->get_ike_cfg(this->peer_cfg); | |
1164 | } | |
1165 | else | |
1166 | { | |
1167 | ike_cfg = this->ike_cfg; | |
1168 | } | |
1169 | if (ike_cfg) | |
1170 | { | |
1171 | packet->set_dscp(packet, ike_cfg->get_dscp(ike_cfg)); | |
1172 | } | |
1173 | } | |
1174 | ||
8bced61b MW |
1175 | METHOD(ike_sa_t, generate_message, status_t, |
1176 | private_ike_sa_t *this, message_t *message, packet_t **packet) | |
8d77edde | 1177 | { |
47b8f6ef MW |
1178 | status_t status; |
1179 | ||
9ca5d028 | 1180 | if (message->is_encoded(message)) |
5b15bd5f | 1181 | { /* already encoded in task, but set DSCP value */ |
9ca5d028 | 1182 | *packet = message->get_packet(message); |
5b15bd5f | 1183 | set_dscp(this, *packet); |
9ca5d028 MW |
1184 | return SUCCESS; |
1185 | } | |
6180a558 | 1186 | this->stats[STAT_OUTBOUND] = time_monotonic(NULL); |
c60c7694 | 1187 | message->set_ike_sa_id(message, this->ike_sa_id); |
47b8f6ef MW |
1188 | charon->bus->message(charon->bus, message, FALSE, TRUE); |
1189 | status = message->generate(message, this->keymat, packet); | |
1190 | if (status == SUCCESS) | |
c60c7694 | 1191 | { |
5b15bd5f | 1192 | set_dscp(this, *packet); |
47b8f6ef | 1193 | charon->bus->message(charon->bus, message, FALSE, FALSE); |
b9d9f188 | 1194 | } |
47b8f6ef | 1195 | return status; |
3dd3c5f3 MW |
1196 | } |
1197 | ||
525cc46c TB |
1198 | CALLBACK(filter_fragments, bool, |
1199 | private_ike_sa_t *this, enumerator_t *orig, va_list args) | |
40bab9a1 | 1200 | { |
525cc46c TB |
1201 | packet_t *fragment, **packet; |
1202 | ||
1203 | VA_ARGS_VGET(args, packet); | |
1204 | ||
1205 | if (orig->enumerate(orig, &fragment)) | |
1206 | { | |
1207 | *packet = fragment->clone(fragment); | |
1208 | set_dscp(this, *packet); | |
1209 | return TRUE; | |
1210 | } | |
1211 | return FALSE; | |
40bab9a1 TB |
1212 | } |
1213 | ||
1214 | METHOD(ike_sa_t, generate_message_fragmented, status_t, | |
1215 | private_ike_sa_t *this, message_t *message, enumerator_t **packets) | |
1216 | { | |
1217 | enumerator_t *fragments; | |
1218 | packet_t *packet; | |
1219 | status_t status; | |
1220 | bool use_frags = FALSE; | |
e35bb6e9 | 1221 | bool pre_generated = FALSE; |
40bab9a1 | 1222 | |
1446fd8a | 1223 | if (this->ike_cfg) |
40bab9a1 TB |
1224 | { |
1225 | switch (this->ike_cfg->fragmentation(this->ike_cfg)) | |
1226 | { | |
1227 | case FRAGMENTATION_FORCE: | |
1228 | use_frags = TRUE; | |
1229 | break; | |
1230 | case FRAGMENTATION_YES: | |
1231 | use_frags = supports_extension(this, EXT_IKE_FRAGMENTATION); | |
05db0f97 VR |
1232 | if (use_frags && this->version == IKEV1 && |
1233 | supports_extension(this, EXT_MS_WINDOWS)) | |
1234 | { | |
1235 | /* It seems Windows 7 and 8 peers only accept proprietary | |
1236 | * fragmented messages if they expect certificates. */ | |
1237 | use_frags = message->get_payload(message, | |
1238 | PLV1_CERTIFICATE) != NULL; | |
1239 | } | |
40bab9a1 TB |
1240 | break; |
1241 | default: | |
1242 | break; | |
1243 | } | |
1244 | } | |
1245 | if (!use_frags) | |
1246 | { | |
1247 | status = generate_message(this, message, &packet); | |
1248 | if (status != SUCCESS) | |
1249 | { | |
1250 | return status; | |
1251 | } | |
1252 | *packets = enumerator_create_single(packet, NULL); | |
1253 | return SUCCESS; | |
1254 | } | |
1255 | ||
e35bb6e9 | 1256 | pre_generated = message->is_encoded(message); |
40bab9a1 TB |
1257 | this->stats[STAT_OUTBOUND] = time_monotonic(NULL); |
1258 | message->set_ike_sa_id(message, this->ike_sa_id); | |
e35bb6e9 TB |
1259 | if (!pre_generated) |
1260 | { | |
1261 | charon->bus->message(charon->bus, message, FALSE, TRUE); | |
1262 | } | |
40bab9a1 TB |
1263 | status = message->fragment(message, this->keymat, this->fragment_size, |
1264 | &fragments); | |
1265 | if (status == SUCCESS) | |
1266 | { | |
e35bb6e9 TB |
1267 | if (!pre_generated) |
1268 | { | |
1269 | charon->bus->message(charon->bus, message, FALSE, FALSE); | |
1270 | } | |
525cc46c | 1271 | *packets = enumerator_create_filter(fragments, filter_fragments, |
40bab9a1 TB |
1272 | this, NULL); |
1273 | } | |
1274 | return status; | |
1275 | } | |
1276 | ||
8bced61b MW |
1277 | METHOD(ike_sa_t, set_kmaddress, void, |
1278 | private_ike_sa_t *this, host_t *local, host_t *remote) | |
d487b4b7 AS |
1279 | { |
1280 | DESTROY_IF(this->local_host); | |
1281 | DESTROY_IF(this->remote_host); | |
1282 | this->local_host = local->clone(local); | |
1283 | this->remote_host = remote->clone(remote); | |
1284 | } | |
1285 | ||
dc04b7c7 | 1286 | #ifdef ME |
8bced61b MW |
1287 | METHOD(ike_sa_t, act_as_mediation_server, void, |
1288 | private_ike_sa_t *this) | |
22452f70 TB |
1289 | { |
1290 | charon->mediation_manager->update_sa_id(charon->mediation_manager, | |
1291 | this->other_id, this->ike_sa_id); | |
1292 | this->is_mediation_server = TRUE; | |
1293 | } | |
1294 | ||
8bced61b MW |
1295 | METHOD(ike_sa_t, get_server_reflexive_host, host_t*, |
1296 | private_ike_sa_t *this) | |
d5cc1758 TB |
1297 | { |
1298 | return this->server_reflexive_host; | |
1299 | } | |
1300 | ||
8bced61b MW |
1301 | METHOD(ike_sa_t, set_server_reflexive_host, void, |
1302 | private_ike_sa_t *this, host_t *host) | |
d5cc1758 TB |
1303 | { |
1304 | DESTROY_IF(this->server_reflexive_host); | |
1305 | this->server_reflexive_host = host; | |
1306 | } | |
1307 | ||
8bced61b MW |
1308 | METHOD(ike_sa_t, get_connect_id, chunk_t, |
1309 | private_ike_sa_t *this) | |
9c2a905d TB |
1310 | { |
1311 | return this->connect_id; | |
1312 | } | |
1313 | ||
8bced61b MW |
1314 | METHOD(ike_sa_t, respond, status_t, |
1315 | private_ike_sa_t *this, identification_t *peer_id, chunk_t connect_id) | |
d5cc1758 | 1316 | { |
dc04b7c7 TB |
1317 | ike_me_t *task = ike_me_create(&this->public, TRUE); |
1318 | task->respond(task, peer_id, connect_id); | |
d5cc1758 TB |
1319 | this->task_manager->queue_task(this->task_manager, (task_t*)task); |
1320 | return this->task_manager->initiate(this->task_manager); | |
1321 | } | |
1322 | ||
8bced61b MW |
1323 | METHOD(ike_sa_t, callback, status_t, |
1324 | private_ike_sa_t *this, identification_t *peer_id) | |
d5cc1758 | 1325 | { |
dc04b7c7 | 1326 | ike_me_t *task = ike_me_create(&this->public, TRUE); |
d5cc1758 TB |
1327 | task->callback(task, peer_id); |
1328 | this->task_manager->queue_task(this->task_manager, (task_t*)task); | |
1329 | return this->task_manager->initiate(this->task_manager); | |
1330 | } | |
1331 | ||
8bced61b MW |
1332 | METHOD(ike_sa_t, relay, status_t, |
1333 | private_ike_sa_t *this, identification_t *requester, chunk_t connect_id, | |
1334 | chunk_t connect_key, linked_list_t *endpoints, bool response) | |
d5cc1758 | 1335 | { |
dc04b7c7 TB |
1336 | ike_me_t *task = ike_me_create(&this->public, TRUE); |
1337 | task->relay(task, requester, connect_id, connect_key, endpoints, response); | |
d5cc1758 TB |
1338 | this->task_manager->queue_task(this->task_manager, (task_t*)task); |
1339 | return this->task_manager->initiate(this->task_manager); | |
1340 | } | |
1341 | ||
8bced61b MW |
1342 | METHOD(ike_sa_t, initiate_mediation, status_t, |
1343 | private_ike_sa_t *this, peer_cfg_t *mediated_cfg) | |
d5cc1758 | 1344 | { |
dc04b7c7 | 1345 | ike_me_t *task = ike_me_create(&this->public, TRUE); |
d5cc1758 TB |
1346 | task->connect(task, mediated_cfg->get_peer_id(mediated_cfg)); |
1347 | this->task_manager->queue_task(this->task_manager, (task_t*)task); | |
1348 | return this->task_manager->initiate(this->task_manager); | |
1349 | } | |
1350 | ||
8bced61b MW |
1351 | METHOD(ike_sa_t, initiate_mediated, status_t, |
1352 | private_ike_sa_t *this, host_t *me, host_t *other, chunk_t connect_id) | |
d5cc1758 | 1353 | { |
471f9230 TB |
1354 | set_my_host(this, me->clone(me)); |
1355 | set_other_host(this, other->clone(other)); | |
4a6474c2 | 1356 | chunk_free(&this->connect_id); |
9c2a905d | 1357 | this->connect_id = chunk_clone(connect_id); |
d5cc1758 TB |
1358 | return this->task_manager->initiate(this->task_manager); |
1359 | } | |
dc04b7c7 | 1360 | #endif /* ME */ |
d5cc1758 | 1361 | |
5a22a021 MW |
1362 | /** |
1363 | * Resolve DNS host in configuration | |
1364 | */ | |
1365 | static void resolve_hosts(private_ike_sa_t *this) | |
1366 | { | |
1367 | host_t *host; | |
0edce687 | 1368 | int family = AF_UNSPEC; |
bf92887a TB |
1369 | |
1370 | switch (charon->socket->supported_families(charon->socket)) | |
1371 | { | |
1372 | case SOCKET_FAMILY_IPV4: | |
1373 | family = AF_INET; | |
1374 | break; | |
1375 | case SOCKET_FAMILY_IPV6: | |
1376 | family = AF_INET6; | |
1377 | break; | |
1378 | case SOCKET_FAMILY_BOTH: | |
1379 | case SOCKET_FAMILY_NONE: | |
1380 | break; | |
1381 | } | |
7daf5226 | 1382 | |
a11048ad TB |
1383 | /* if an IP address is set locally, use the same family to resolve remote */ |
1384 | if (family == AF_UNSPEC && !this->remote_host) | |
1385 | { | |
1386 | if (this->local_host) | |
1387 | { | |
1388 | family = this->local_host->get_family(this->local_host); | |
1389 | } | |
1390 | else | |
1391 | { | |
1392 | family = ike_cfg_get_family(this->ike_cfg, TRUE); | |
1393 | } | |
1394 | } | |
1395 | ||
d487b4b7 AS |
1396 | if (this->remote_host) |
1397 | { | |
1398 | host = this->remote_host->clone(this->remote_host); | |
1399 | host->set_port(host, IKEV2_UDP_PORT); | |
1400 | } | |
1401 | else | |
1402 | { | |
0edce687 | 1403 | host = this->ike_cfg->resolve_other(this->ike_cfg, family); |
d487b4b7 | 1404 | } |
5a22a021 MW |
1405 | if (host) |
1406 | { | |
6f7a3b33 TB |
1407 | if (!host->is_anyaddr(host) || |
1408 | this->other_host->is_anyaddr(this->other_host)) | |
1409 | { /* don't set to %any if we currently have an address, but the | |
1410 | * address family might have changed */ | |
1411 | set_other_host(this, host); | |
1412 | } | |
faebdeac | 1413 | else |
2d14cb4d TB |
1414 | { /* reuse the original port as some implementations might not like |
1415 | * initial IKE messages on other ports */ | |
1416 | this->other_host->set_port(this->other_host, host->get_port(host)); | |
faebdeac TB |
1417 | host->destroy(host); |
1418 | } | |
5a22a021 | 1419 | } |
7daf5226 | 1420 | |
d487b4b7 | 1421 | if (this->local_host) |
e7991a2e | 1422 | { |
d487b4b7 | 1423 | host = this->local_host->clone(this->local_host); |
b223d517 | 1424 | host->set_port(host, charon->socket->get_port(charon->socket, FALSE)); |
d487b4b7 AS |
1425 | } |
1426 | else | |
1427 | { | |
c6a8990b MW |
1428 | /* use same address family as for other */ |
1429 | if (!this->other_host->is_anyaddr(this->other_host)) | |
1430 | { | |
1431 | family = this->other_host->get_family(this->other_host); | |
1432 | } | |
0edce687 | 1433 | host = this->ike_cfg->resolve_me(this->ike_cfg, family); |
7daf5226 | 1434 | |
d487b4b7 AS |
1435 | if (host && host->is_anyaddr(host) && |
1436 | !this->other_host->is_anyaddr(this->other_host)) | |
5353f22e | 1437 | { |
d487b4b7 | 1438 | host->destroy(host); |
8394ea2a TB |
1439 | host = charon->kernel->get_source_addr(charon->kernel, |
1440 | this->other_host, NULL); | |
d487b4b7 AS |
1441 | if (host) |
1442 | { | |
cc2eadde | 1443 | host->set_port(host, this->ike_cfg->get_my_port(this->ike_cfg)); |
d487b4b7 | 1444 | } |
9717826f MW |
1445 | else |
1446 | { /* fallback to address family specific %any(6), if configured */ | |
0edce687 | 1447 | host = this->ike_cfg->resolve_me(this->ike_cfg, family); |
9717826f | 1448 | } |
5353f22e | 1449 | } |
e7991a2e | 1450 | } |
5a22a021 MW |
1451 | if (host) |
1452 | { | |
e7991a2e | 1453 | set_my_host(this, host); |
5a22a021 MW |
1454 | } |
1455 | } | |
1456 | ||
8bced61b | 1457 | METHOD(ike_sa_t, initiate, status_t, |
b12c53ce | 1458 | private_ike_sa_t *this, child_cfg_t *child_cfg, uint32_t reqid, |
8bced61b | 1459 | traffic_selector_t *tsi, traffic_selector_t *tsr) |
aad398a7 | 1460 | { |
60c82591 TB |
1461 | bool defer_initiate = FALSE; |
1462 | ||
c60c7694 | 1463 | if (this->state == IKE_CREATED) |
c0593835 | 1464 | { |
a994050e MW |
1465 | if (this->my_host->is_anyaddr(this->my_host) || |
1466 | this->other_host->is_anyaddr(this->other_host)) | |
1467 | { | |
1468 | resolve_hosts(this); | |
1469 | } | |
7daf5226 | 1470 | |
d5cc1758 | 1471 | if (this->other_host->is_anyaddr(this->other_host) |
dc04b7c7 | 1472 | #ifdef ME |
d5cc1758 | 1473 | && !this->peer_cfg->get_mediated_by(this->peer_cfg) |
dc04b7c7 | 1474 | #endif /* ME */ |
d5cc1758 | 1475 | ) |
128ca073 | 1476 | { |
0edce687 MW |
1477 | char *addr; |
1478 | ||
be8af56e | 1479 | addr = this->ike_cfg->get_other_addr(this->ike_cfg); |
53d2164c | 1480 | if (!this->retry_initiate_interval) |
60c82591 | 1481 | { |
53d2164c TB |
1482 | DBG1(DBG_IKE, "unable to resolve %s, initiate aborted", |
1483 | addr); | |
60c82591 TB |
1484 | DESTROY_IF(child_cfg); |
1485 | charon->bus->alert(charon->bus, ALERT_PEER_ADDR_FAILED); | |
1486 | return DESTROY_ME; | |
1487 | } | |
1488 | DBG1(DBG_IKE, "unable to resolve %s, retrying in %ds", | |
1489 | addr, this->retry_initiate_interval); | |
1490 | defer_initiate = TRUE; | |
128ca073 | 1491 | } |
7daf5226 | 1492 | |
faf9569f | 1493 | set_condition(this, COND_ORIGINAL_INITIATOR, TRUE); |
a60daa07 | 1494 | this->task_manager->queue_ike(this->task_manager); |
d5cc1758 TB |
1495 | } |
1496 | ||
dc04b7c7 | 1497 | #ifdef ME |
4a6474c2 | 1498 | if (this->peer_cfg->is_mediation(this->peer_cfg)) |
f967db31 TB |
1499 | { |
1500 | if (this->state == IKE_ESTABLISHED) | |
1501 | { | |
484a06bc TB |
1502 | /* mediation connection is already established, retrigger state |
1503 | * change to notify bus listeners */ | |
f967db31 TB |
1504 | DBG1(DBG_IKE, "mediation connection is already up"); |
1505 | set_state(this, IKE_ESTABLISHED); | |
1506 | } | |
c3f803c4 | 1507 | DESTROY_IF(child_cfg); |
d5cc1758 TB |
1508 | } |
1509 | else | |
dc04b7c7 | 1510 | #endif /* ME */ |
9c64f214 | 1511 | if (child_cfg) |
d5cc1758 | 1512 | { |
38951252 | 1513 | /* normal IKE_SA with CHILD_SA */ |
fe43d9a2 MW |
1514 | this->task_manager->queue_child(this->task_manager, child_cfg, reqid, |
1515 | tsi, tsr); | |
4a6474c2 TB |
1516 | #ifdef ME |
1517 | if (this->peer_cfg->get_mediated_by(this->peer_cfg)) | |
1518 | { | |
1519 | /* mediated connection, initiate mediation process */ | |
1520 | job_t *job = (job_t*)initiate_mediation_job_create(this->ike_sa_id); | |
bb381e26 | 1521 | lib->processor->queue_job(lib->processor, job); |
4a6474c2 TB |
1522 | return SUCCESS; |
1523 | } | |
1524 | #endif /* ME */ | |
c60c7694 | 1525 | } |
7daf5226 | 1526 | |
60c82591 TB |
1527 | if (defer_initiate) |
1528 | { | |
77e42826 TB |
1529 | if (!this->retry_initiate_queued) |
1530 | { | |
1531 | job_t *job = (job_t*)retry_initiate_job_create(this->ike_sa_id); | |
1532 | lib->scheduler->schedule_job(lib->scheduler, (job_t*)job, | |
1533 | this->retry_initiate_interval); | |
1534 | this->retry_initiate_queued = TRUE; | |
1535 | } | |
60c82591 TB |
1536 | return SUCCESS; |
1537 | } | |
77e42826 | 1538 | this->retry_initiate_queued = FALSE; |
c60c7694 | 1539 | return this->task_manager->initiate(this->task_manager); |
aad398a7 JH |
1540 | } |
1541 | ||
77e42826 TB |
1542 | METHOD(ike_sa_t, retry_initiate, status_t, |
1543 | private_ike_sa_t *this) | |
1544 | { | |
1545 | if (this->retry_initiate_queued) | |
1546 | { | |
1547 | this->retry_initiate_queued = FALSE; | |
1548 | return initiate(this, NULL, 0, NULL, NULL); | |
1549 | } | |
1550 | return SUCCESS; | |
1551 | } | |
1552 | ||
8bced61b MW |
1553 | METHOD(ike_sa_t, process_message, status_t, |
1554 | private_ike_sa_t *this, message_t *message) | |
98f97433 MW |
1555 | { |
1556 | status_t status; | |
7daf5226 | 1557 | |
c610f424 MW |
1558 | if (this->state == IKE_PASSIVE) |
1559 | { /* do not handle messages in passive state */ | |
1560 | return FAILED; | |
1561 | } | |
448e2e29 | 1562 | if (message->get_major_version(message) != this->version) |
98f97433 | 1563 | { |
448e2e29 | 1564 | DBG1(DBG_IKE, "ignoring %N IKEv%u exchange on %N SA", |
98f97433 | 1565 | exchange_type_names, message->get_exchange_type(message), |
448e2e29 MW |
1566 | message->get_major_version(message), |
1567 | ike_version_names, this->version); | |
1568 | /* TODO-IKEv1: fall back to IKEv1 if we receive an IKEv1 | |
1569 | * INVALID_MAJOR_VERSION on an IKEv2 SA. */ | |
1570 | return FAILED; | |
98f97433 | 1571 | } |
68c6863b | 1572 | status = this->task_manager->process_message(this->task_manager, message); |
b24b73b7 | 1573 | if (this->flush_auth_cfg && this->state == IKE_ESTABLISHED) |
98f97433 | 1574 | { |
e41adf5f TB |
1575 | /* authentication completed but if the online validation is suspended we |
1576 | * need the auth cfgs until we did the delayed verification, we flush | |
1577 | * them afterwards */ | |
1578 | if (!has_condition(this, COND_ONLINE_VALIDATION_SUSPENDED)) | |
1579 | { | |
1580 | this->flush_auth_cfg = FALSE; | |
1581 | flush_auth_cfgs(this); | |
1582 | } | |
98f97433 | 1583 | } |
44ce7493 | 1584 | return status; |
98f97433 | 1585 | } |
8dfbe71b | 1586 | |
8bced61b MW |
1587 | METHOD(ike_sa_t, get_id, ike_sa_id_t*, |
1588 | private_ike_sa_t *this) | |
0df63d6b | 1589 | { |
8dfbe71b | 1590 | return this->ike_sa_id; |
0df63d6b JH |
1591 | } |
1592 | ||
0b611540 TB |
1593 | METHOD(ike_sa_t, get_version, ike_version_t, |
1594 | private_ike_sa_t *this) | |
1595 | { | |
1596 | return this->version; | |
1597 | } | |
1598 | ||
8bced61b MW |
1599 | METHOD(ike_sa_t, get_my_id, identification_t*, |
1600 | private_ike_sa_t *this) | |
0fdc3c7f | 1601 | { |
8dfbe71b | 1602 | return this->my_id; |
8d68033e JH |
1603 | } |
1604 | ||
8bced61b MW |
1605 | METHOD(ike_sa_t, set_my_id, void, |
1606 | private_ike_sa_t *this, identification_t *me) | |
8d68033e | 1607 | { |
c0593835 | 1608 | DESTROY_IF(this->my_id); |
8dfbe71b | 1609 | this->my_id = me; |
0fdc3c7f JH |
1610 | } |
1611 | ||
8bced61b MW |
1612 | METHOD(ike_sa_t, get_other_id, identification_t*, |
1613 | private_ike_sa_t *this) | |
30b5b412 | 1614 | { |
8dfbe71b | 1615 | return this->other_id; |
3dd3c5f3 | 1616 | } |
8dfbe71b | 1617 | |
8bced61b MW |
1618 | METHOD(ike_sa_t, get_other_eap_id, identification_t*, |
1619 | private_ike_sa_t *this) | |
045833c7 MW |
1620 | { |
1621 | identification_t *id = NULL, *current; | |
1622 | enumerator_t *enumerator; | |
1623 | auth_cfg_t *cfg; | |
1624 | ||
893da041 | 1625 | enumerator = array_create_enumerator(this->other_auths); |
045833c7 MW |
1626 | while (enumerator->enumerate(enumerator, &cfg)) |
1627 | { | |
1628 | /* prefer EAP-Identity of last round */ | |
1629 | current = cfg->get(cfg, AUTH_RULE_EAP_IDENTITY); | |
1630 | if (!current || current->get_type(current) == ID_ANY) | |
beab4a90 MW |
1631 | { |
1632 | current = cfg->get(cfg, AUTH_RULE_XAUTH_IDENTITY); | |
1633 | } | |
1634 | if (!current || current->get_type(current) == ID_ANY) | |
045833c7 MW |
1635 | { |
1636 | current = cfg->get(cfg, AUTH_RULE_IDENTITY); | |
1637 | } | |
1638 | if (current && current->get_type(current) != ID_ANY) | |
1639 | { | |
1640 | id = current; | |
1641 | continue; | |
1642 | } | |
1643 | } | |
1644 | enumerator->destroy(enumerator); | |
1645 | if (id) | |
1646 | { | |
1647 | return id; | |
1648 | } | |
1649 | return this->other_id; | |
1650 | } | |
1651 | ||
8bced61b MW |
1652 | METHOD(ike_sa_t, set_other_id, void, |
1653 | private_ike_sa_t *this, identification_t *other) | |
3dd3c5f3 | 1654 | { |
c0593835 | 1655 | DESTROY_IF(this->other_id); |
8dfbe71b | 1656 | this->other_id = other; |
30b5b412 MW |
1657 | } |
1658 | ||
8bced61b MW |
1659 | METHOD(ike_sa_t, add_child_sa, void, |
1660 | private_ike_sa_t *this, child_sa_t *child_sa) | |
32b6500f | 1661 | { |
893da041 | 1662 | array_insert_create(&this->child_sas, ARRAY_TAIL, child_sa); |
38227d0e MW |
1663 | charon->child_sa_manager->add(charon->child_sa_manager, |
1664 | child_sa, &this->public); | |
32b6500f MW |
1665 | } |
1666 | ||
8bced61b | 1667 | METHOD(ike_sa_t, get_child_sa, child_sa_t*, |
b12c53ce | 1668 | private_ike_sa_t *this, protocol_id_t protocol, uint32_t spi, bool inbound) |
695723d4 | 1669 | { |
e2630434 | 1670 | enumerator_t *enumerator; |
695723d4 | 1671 | child_sa_t *current, *found = NULL; |
7daf5226 | 1672 | |
893da041 | 1673 | enumerator = array_create_enumerator(this->child_sas); |
e2630434 | 1674 | while (enumerator->enumerate(enumerator, (void**)¤t)) |
c60c7694 | 1675 | { |
698d7749 | 1676 | if (current->get_spi(current, inbound) == spi && |
191a26a6 | 1677 | current->get_protocol(current) == protocol) |
695723d4 MW |
1678 | { |
1679 | found = current; | |
1680 | } | |
1681 | } | |
e2630434 | 1682 | enumerator->destroy(enumerator); |
695723d4 | 1683 | return found; |
8d77edde MW |
1684 | } |
1685 | ||
4bbce1ef | 1686 | METHOD(ike_sa_t, get_child_count, int, |
8bced61b | 1687 | private_ike_sa_t *this) |
3183006d | 1688 | { |
893da041 | 1689 | return array_count(this->child_sas); |
4bbce1ef TB |
1690 | } |
1691 | ||
38227d0e MW |
1692 | /** |
1693 | * Private data of a create_child_sa_enumerator() | |
1694 | */ | |
1695 | typedef struct { | |
1696 | /** implements enumerator */ | |
1697 | enumerator_t public; | |
1698 | /** inner array enumerator */ | |
1699 | enumerator_t *inner; | |
1700 | /** current item */ | |
1701 | child_sa_t *current; | |
1702 | } child_enumerator_t; | |
1703 | ||
1704 | METHOD(enumerator_t, child_enumerate, bool, | |
95a63bf2 | 1705 | child_enumerator_t *this, va_list args) |
38227d0e | 1706 | { |
95a63bf2 TB |
1707 | child_sa_t **child_sa; |
1708 | ||
1709 | VA_ARGS_VGET(args, child_sa); | |
38227d0e MW |
1710 | if (this->inner->enumerate(this->inner, &this->current)) |
1711 | { | |
1712 | *child_sa = this->current; | |
1713 | return TRUE; | |
1714 | } | |
1715 | return FALSE; | |
1716 | } | |
1717 | ||
1718 | METHOD(enumerator_t, child_enumerator_destroy, void, | |
1719 | child_enumerator_t *this) | |
1720 | { | |
1721 | this->inner->destroy(this->inner); | |
1722 | free(this); | |
1723 | } | |
1724 | ||
4bbce1ef TB |
1725 | METHOD(ike_sa_t, create_child_sa_enumerator, enumerator_t*, |
1726 | private_ike_sa_t *this) | |
1727 | { | |
38227d0e MW |
1728 | child_enumerator_t *enumerator; |
1729 | ||
1730 | INIT(enumerator, | |
1731 | .public = { | |
95a63bf2 TB |
1732 | .enumerate = enumerator_enumerate_default, |
1733 | .venumerate = _child_enumerate, | |
38227d0e MW |
1734 | .destroy = _child_enumerator_destroy, |
1735 | }, | |
1736 | .inner = array_create_enumerator(this->child_sas), | |
1737 | ); | |
1738 | return &enumerator->public; | |
4bbce1ef TB |
1739 | } |
1740 | ||
1741 | METHOD(ike_sa_t, remove_child_sa, void, | |
1742 | private_ike_sa_t *this, enumerator_t *enumerator) | |
1743 | { | |
38227d0e MW |
1744 | child_enumerator_t *ce = (child_enumerator_t*)enumerator; |
1745 | ||
1746 | charon->child_sa_manager->remove(charon->child_sa_manager, ce->current); | |
1747 | array_remove_at(this->child_sas, ce->inner); | |
3183006d MW |
1748 | } |
1749 | ||
8bced61b | 1750 | METHOD(ike_sa_t, rekey_child_sa, status_t, |
b12c53ce | 1751 | private_ike_sa_t *this, protocol_id_t protocol, uint32_t spi) |
8d77edde | 1752 | { |
916cdca8 MW |
1753 | if (this->state == IKE_PASSIVE) |
1754 | { | |
1755 | return INVALID_STATE; | |
1756 | } | |
463a73cc | 1757 | this->task_manager->queue_child_rekey(this->task_manager, protocol, spi); |
394eb35b | 1758 | return this->task_manager->initiate(this->task_manager); |
698d7749 MW |
1759 | } |
1760 | ||
8bced61b | 1761 | METHOD(ike_sa_t, delete_child_sa, status_t, |
b12c53ce | 1762 | private_ike_sa_t *this, protocol_id_t protocol, uint32_t spi, bool expired) |
698d7749 | 1763 | { |
916cdca8 MW |
1764 | if (this->state == IKE_PASSIVE) |
1765 | { | |
1766 | return INVALID_STATE; | |
1767 | } | |
3a925f74 MW |
1768 | this->task_manager->queue_child_delete(this->task_manager, |
1769 | protocol, spi, expired); | |
394eb35b | 1770 | return this->task_manager->initiate(this->task_manager); |
698d7749 MW |
1771 | } |
1772 | ||
8bced61b | 1773 | METHOD(ike_sa_t, destroy_child_sa, status_t, |
b12c53ce | 1774 | private_ike_sa_t *this, protocol_id_t protocol, uint32_t spi) |
698d7749 | 1775 | { |
e2630434 | 1776 | enumerator_t *enumerator; |
698d7749 MW |
1777 | child_sa_t *child_sa; |
1778 | status_t status = NOT_FOUND; | |
7daf5226 | 1779 | |
38227d0e | 1780 | enumerator = create_child_sa_enumerator(this); |
e2630434 | 1781 | while (enumerator->enumerate(enumerator, (void**)&child_sa)) |
698d7749 MW |
1782 | { |
1783 | if (child_sa->get_protocol(child_sa) == protocol && | |
1784 | child_sa->get_spi(child_sa, TRUE) == spi) | |
1785 | { | |
38227d0e | 1786 | remove_child_sa(this, enumerator); |
698d7749 | 1787 | child_sa->destroy(child_sa); |
698d7749 MW |
1788 | status = SUCCESS; |
1789 | break; | |
1790 | } | |
8d77edde | 1791 | } |
e2630434 | 1792 | enumerator->destroy(enumerator); |
698d7749 | 1793 | return status; |
8d77edde MW |
1794 | } |
1795 | ||
8bced61b | 1796 | METHOD(ike_sa_t, delete_, status_t, |
a79d5103 | 1797 | private_ike_sa_t *this, bool force) |
6fe03b0a | 1798 | { |
a79d5103 TB |
1799 | status_t status = DESTROY_ME; |
1800 | ||
6fe03b0a MW |
1801 | switch (this->state) |
1802 | { | |
3a0b67bc | 1803 | case IKE_ESTABLISHED: |
ebc6445d TB |
1804 | case IKE_REKEYING: |
1805 | if (time_monotonic(NULL) >= this->stats[STAT_DELETE] && | |
1806 | !(this->version == IKEV1 && this->state == IKE_REKEYING)) | |
1807 | { /* IKE_SA hard lifetime hit, ignored for reauthenticated | |
1808 | * IKEv1 SAs */ | |
c45cf904 MW |
1809 | charon->bus->alert(charon->bus, ALERT_IKE_SA_EXPIRED); |
1810 | } | |
3ed148b3 | 1811 | this->task_manager->queue_ike_delete(this->task_manager); |
a79d5103 TB |
1812 | status = this->task_manager->initiate(this->task_manager); |
1813 | break; | |
98f97433 | 1814 | case IKE_CREATED: |
a985db3f | 1815 | DBG1(DBG_IKE, "deleting unestablished IKE_SA"); |
98f97433 | 1816 | break; |
c610f424 MW |
1817 | case IKE_PASSIVE: |
1818 | break; | |
6fe03b0a | 1819 | default: |
a79d5103 TB |
1820 | DBG1(DBG_IKE, "destroying IKE_SA in state %N without notification", |
1821 | ike_sa_state_names, this->state); | |
1822 | force = TRUE; | |
c60c7694 | 1823 | break; |
6fe03b0a | 1824 | } |
a79d5103 TB |
1825 | |
1826 | if (force) | |
1827 | { | |
1828 | status = DESTROY_ME; | |
1829 | ||
1830 | if (this->version == IKEV2) | |
1831 | { /* for IKEv1 we trigger this in the ISAKMP delete task */ | |
1832 | switch (this->state) | |
1833 | { | |
1834 | case IKE_ESTABLISHED: | |
1835 | case IKE_REKEYING: | |
1836 | case IKE_DELETING: | |
1837 | charon->bus->ike_updown(charon->bus, &this->public, FALSE); | |
1838 | default: | |
1839 | break; | |
1840 | } | |
1841 | } | |
1842 | } | |
1843 | return status; | |
6fe03b0a MW |
1844 | } |
1845 | ||
8bced61b MW |
1846 | METHOD(ike_sa_t, rekey, status_t, |
1847 | private_ike_sa_t *this) | |
fe04e93a | 1848 | { |
916cdca8 MW |
1849 | if (this->state == IKE_PASSIVE) |
1850 | { | |
1851 | return INVALID_STATE; | |
1852 | } | |
dab60d64 | 1853 | this->task_manager->queue_ike_rekey(this->task_manager); |
c60c7694 | 1854 | return this->task_manager->initiate(this->task_manager); |
fe04e93a MW |
1855 | } |
1856 | ||
8bced61b MW |
1857 | METHOD(ike_sa_t, reauth, status_t, |
1858 | private_ike_sa_t *this) | |
6fe03b0a | 1859 | { |
916cdca8 MW |
1860 | if (this->state == IKE_PASSIVE) |
1861 | { | |
1862 | return INVALID_STATE; | |
1863 | } | |
34e402ef TB |
1864 | if (this->state == IKE_CONNECTING) |
1865 | { | |
1866 | DBG0(DBG_IKE, "reinitiating IKE_SA %s[%d]", | |
1867 | get_name(this), this->unique_id); | |
c3539961 | 1868 | reset(this, TRUE); |
34e402ef TB |
1869 | return this->task_manager->initiate(this->task_manager); |
1870 | } | |
ee614711 MW |
1871 | /* we can't reauthenticate as responder when we use EAP or virtual IPs. |
1872 | * If the peer does not support RFC4478, there is no way to keep the | |
1873 | * IKE_SA up. */ | |
faf9569f | 1874 | if (!has_condition(this, COND_ORIGINAL_INITIATOR)) |
ee614711 MW |
1875 | { |
1876 | DBG1(DBG_IKE, "initiator did not reauthenticate as requested"); | |
893da041 | 1877 | if (array_count(this->other_vips) != 0 || |
7e9e1f96 | 1878 | has_condition(this, COND_XAUTH_AUTHENTICATED) || |
78abba42 TB |
1879 | has_condition(this, COND_EAP_AUTHENTICATED) |
1880 | #ifdef ME | |
484a06bc | 1881 | /* as mediation server we too cannot reauth the IKE_SA */ |
78abba42 TB |
1882 | || this->is_mediation_server |
1883 | #endif /* ME */ | |
1884 | ) | |
ee614711 | 1885 | { |
e9fcf1c6 | 1886 | time_t del, now; |
7daf5226 | 1887 | |
e9fcf1c6 MW |
1888 | del = this->stats[STAT_DELETE]; |
1889 | now = time_monotonic(NULL); | |
fbaf5cd2 MW |
1890 | DBG1(DBG_IKE, "IKE_SA %s[%d] will timeout in %V", |
1891 | get_name(this), this->unique_id, &now, &del); | |
ee614711 MW |
1892 | return FAILED; |
1893 | } | |
1894 | else | |
1895 | { | |
fbaf5cd2 MW |
1896 | DBG0(DBG_IKE, "reauthenticating IKE_SA %s[%d] actively", |
1897 | get_name(this), this->unique_id); | |
ee614711 MW |
1898 | } |
1899 | } | |
fbaf5cd2 MW |
1900 | else |
1901 | { | |
1902 | DBG0(DBG_IKE, "reauthenticating IKE_SA %s[%d]", | |
1903 | get_name(this), this->unique_id); | |
1904 | } | |
873b63b7 | 1905 | set_condition(this, COND_REAUTHENTICATING, TRUE); |
cedb412e | 1906 | this->task_manager->queue_ike_reauth(this->task_manager); |
26424f03 | 1907 | return this->task_manager->initiate(this->task_manager); |
6fe03b0a | 1908 | } |
face844a | 1909 | |
68db844f TB |
1910 | /** |
1911 | * Check if tasks to create CHILD_SAs are queued in the given queue | |
1912 | */ | |
1913 | static bool is_child_queued(private_ike_sa_t *this, task_queue_t queue) | |
1914 | { | |
1915 | enumerator_t *enumerator; | |
1916 | task_t *task; | |
1917 | bool found = FALSE; | |
1918 | ||
1919 | enumerator = this->task_manager->create_task_enumerator(this->task_manager, | |
1920 | queue); | |
1921 | while (enumerator->enumerate(enumerator, &task)) | |
1922 | { | |
1923 | if (task->get_type(task) == TASK_CHILD_CREATE || | |
1924 | task->get_type(task) == TASK_QUICK_MODE) | |
1925 | { | |
1926 | found = TRUE; | |
1927 | break; | |
1928 | } | |
1929 | } | |
1930 | enumerator->destroy(enumerator); | |
1931 | return found; | |
1932 | } | |
1933 | ||
f20e00fe TB |
1934 | /** |
1935 | * Reestablish CHILD_SAs and migrate queued tasks. | |
1936 | * | |
1937 | * If force is true all SAs are restarted, otherwise their close/dpd_action | |
1938 | * is followed. | |
1939 | */ | |
1940 | static status_t reestablish_children(private_ike_sa_t *this, ike_sa_t *new, | |
1941 | bool force) | |
1942 | { | |
1943 | enumerator_t *enumerator; | |
1944 | child_sa_t *child_sa; | |
1945 | child_cfg_t *child_cfg; | |
1946 | action_t action; | |
1947 | status_t status = FAILED; | |
1948 | ||
1949 | /* handle existing CHILD_SAs */ | |
1950 | enumerator = create_child_sa_enumerator(this); | |
1951 | while (enumerator->enumerate(enumerator, (void**)&child_sa)) | |
1952 | { | |
a747ad73 TB |
1953 | switch (child_sa->get_state(child_sa)) |
1954 | { | |
1955 | case CHILD_REKEYED: | |
1956 | case CHILD_DELETED: | |
1957 | /* ignore CHILD_SAs in these states */ | |
1958 | continue; | |
1959 | default: | |
1960 | break; | |
1961 | } | |
f20e00fe TB |
1962 | if (force) |
1963 | { | |
a1620c16 | 1964 | action = ACTION_RESTART; |
f20e00fe TB |
1965 | } |
1966 | else | |
1967 | { /* only restart CHILD_SAs that are configured accordingly */ | |
1968 | if (this->state == IKE_DELETING) | |
1969 | { | |
1970 | action = child_sa->get_close_action(child_sa); | |
1971 | } | |
1972 | else | |
1973 | { | |
1974 | action = child_sa->get_dpd_action(child_sa); | |
1975 | } | |
1976 | } | |
1977 | switch (action) | |
1978 | { | |
1979 | case ACTION_RESTART: | |
1980 | child_cfg = child_sa->get_config(child_sa); | |
1981 | DBG1(DBG_IKE, "restarting CHILD_SA %s", | |
1982 | child_cfg->get_name(child_cfg)); | |
1983 | child_cfg->get_ref(child_cfg); | |
1984 | status = new->initiate(new, child_cfg, | |
1985 | child_sa->get_reqid(child_sa), NULL, NULL); | |
1986 | break; | |
1987 | default: | |
1988 | continue; | |
1989 | } | |
1990 | if (status == DESTROY_ME) | |
1991 | { | |
1992 | break; | |
1993 | } | |
1994 | } | |
1995 | enumerator->destroy(enumerator); | |
1996 | /* adopt any active or queued CHILD-creating tasks */ | |
1997 | if (status != DESTROY_ME) | |
1998 | { | |
1999 | task_manager_t *other_tasks = ((private_ike_sa_t*)new)->task_manager; | |
2000 | other_tasks->adopt_child_tasks(other_tasks, this->task_manager); | |
2001 | if (new->get_state(new) == IKE_CREATED) | |
2002 | { | |
2003 | status = new->initiate(new, NULL, 0, NULL, NULL); | |
2004 | } | |
2005 | } | |
2006 | return status; | |
2007 | } | |
2008 | ||
8bced61b MW |
2009 | METHOD(ike_sa_t, reestablish, status_t, |
2010 | private_ike_sa_t *this) | |
96926b00 MW |
2011 | { |
2012 | ike_sa_t *new; | |
2013 | host_t *host; | |
348af092 | 2014 | action_t action; |
e2630434 | 2015 | enumerator_t *enumerator; |
96926b00 | 2016 | child_sa_t *child_sa; |
cf76c429 | 2017 | bool restart = FALSE; |
96926b00 | 2018 | status_t status = FAILED; |
7daf5226 | 2019 | |
873b63b7 | 2020 | if (has_condition(this, COND_REAUTHENTICATING)) |
23470d84 | 2021 | { /* only reauthenticate if we have children */ |
893da041 | 2022 | if (array_count(this->child_sas) == 0 |
23470d84 TB |
2023 | #ifdef ME |
2024 | /* allow reauth of mediation connections without CHILD_SAs */ | |
2025 | && !this->peer_cfg->is_mediation(this->peer_cfg) | |
2026 | #endif /* ME */ | |
2027 | ) | |
348af092 | 2028 | { |
23470d84 TB |
2029 | DBG1(DBG_IKE, "unable to reauthenticate IKE_SA, no CHILD_SA " |
2030 | "to recreate"); | |
348af092 MW |
2031 | } |
2032 | else | |
2033 | { | |
23470d84 | 2034 | restart = TRUE; |
348af092 | 2035 | } |
23470d84 TB |
2036 | } |
2037 | else | |
2038 | { /* check if we have children to keep up at all */ | |
893da041 | 2039 | enumerator = array_create_enumerator(this->child_sas); |
23470d84 | 2040 | while (enumerator->enumerate(enumerator, (void**)&child_sa)) |
cadb5d16 | 2041 | { |
a747ad73 TB |
2042 | switch (child_sa->get_state(child_sa)) |
2043 | { | |
2044 | case CHILD_REKEYED: | |
2045 | case CHILD_DELETED: | |
2046 | /* ignore CHILD_SAs in these states */ | |
2047 | continue; | |
2048 | default: | |
2049 | break; | |
2050 | } | |
23470d84 TB |
2051 | if (this->state == IKE_DELETING) |
2052 | { | |
2053 | action = child_sa->get_close_action(child_sa); | |
2054 | } | |
2055 | else | |
2056 | { | |
2057 | action = child_sa->get_dpd_action(child_sa); | |
2058 | } | |
2059 | switch (action) | |
2060 | { | |
2061 | case ACTION_RESTART: | |
2062 | restart = TRUE; | |
2063 | break; | |
2064 | case ACTION_ROUTE: | |
2065 | charon->traps->install(charon->traps, this->peer_cfg, | |
24fa1bb0 | 2066 | child_sa->get_config(child_sa)); |
23470d84 TB |
2067 | break; |
2068 | default: | |
2069 | break; | |
2070 | } | |
cadb5d16 | 2071 | } |
23470d84 | 2072 | enumerator->destroy(enumerator); |
68db844f | 2073 | /* check if we have tasks that recreate children */ |
07a9d5c9 TB |
2074 | if (!restart) |
2075 | { | |
2076 | restart = is_child_queued(this, TASK_QUEUE_ACTIVE) || | |
2077 | is_child_queued(this, TASK_QUEUE_QUEUED); | |
2078 | } | |
cadb5d16 | 2079 | #ifdef ME |
23470d84 TB |
2080 | /* mediation connections have no children, keep them up anyway */ |
2081 | if (this->peer_cfg->is_mediation(this->peer_cfg)) | |
2082 | { | |
2083 | restart = TRUE; | |
2084 | } | |
cadb5d16 | 2085 | #endif /* ME */ |
23470d84 | 2086 | } |
cf76c429 | 2087 | if (!restart) |
cadb5d16 MW |
2088 | { |
2089 | return FAILED; | |
2090 | } | |
7daf5226 | 2091 | |
cadb5d16 | 2092 | /* check if we are able to reestablish this IKE_SA */ |
faf9569f | 2093 | if (!has_condition(this, COND_ORIGINAL_INITIATOR) && |
893da041 | 2094 | (array_count(this->other_vips) != 0 || |
96926b00 MW |
2095 | has_condition(this, COND_EAP_AUTHENTICATED) |
2096 | #ifdef ME | |
2097 | || this->is_mediation_server | |
2098 | #endif /* ME */ | |
2099 | )) | |
2100 | { | |
68447302 | 2101 | DBG1(DBG_IKE, "unable to reestablish IKE_SA due to asymmetric setup"); |
96926b00 MW |
2102 | return FAILED; |
2103 | } | |
7daf5226 | 2104 | |
0b611540 TB |
2105 | new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager, |
2106 | this->version, TRUE); | |
3d54ae94 MW |
2107 | if (!new) |
2108 | { | |
2109 | return FAILED; | |
2110 | } | |
96926b00 MW |
2111 | new->set_peer_cfg(new, this->peer_cfg); |
2112 | host = this->other_host; | |
2113 | new->set_other_host(new, host->clone(host)); | |
2114 | host = this->my_host; | |
2115 | new->set_my_host(new, host->clone(host)); | |
614359a7 | 2116 | charon->bus->ike_reestablish_pre(charon->bus, &this->public, new); |
7505fb8d TB |
2117 | if (!has_condition(this, COND_REAUTHENTICATING)) |
2118 | { /* reauthenticate to the same addresses, but resolve hosts if | |
2119 | * reestablishing (old addresses serve as fallback) */ | |
2120 | resolve_hosts((private_ike_sa_t*)new); | |
2121 | } | |
96926b00 | 2122 | /* if we already have a virtual IP, we reuse it */ |
893da041 | 2123 | enumerator = array_create_enumerator(this->my_vips); |
101d26ba | 2124 | while (enumerator->enumerate(enumerator, &host)) |
96926b00 | 2125 | { |
101d26ba | 2126 | new->add_virtual_ip(new, TRUE, host); |
96926b00 | 2127 | } |
101d26ba | 2128 | enumerator->destroy(enumerator); |
7daf5226 | 2129 | |
96926b00 | 2130 | #ifdef ME |
96926b00 MW |
2131 | if (this->peer_cfg->is_mediation(this->peer_cfg)) |
2132 | { | |
a13c013b | 2133 | status = new->initiate(new, NULL, 0, NULL, NULL); |
96926b00 | 2134 | } |
cadb5d16 | 2135 | else |
96926b00 | 2136 | #endif /* ME */ |
96926b00 | 2137 | { |
f20e00fe TB |
2138 | status = reestablish_children(this, new, |
2139 | has_condition(this, COND_REAUTHENTICATING)); | |
96926b00 | 2140 | } |
7daf5226 | 2141 | |
cadb5d16 | 2142 | if (status == DESTROY_ME) |
96926b00 | 2143 | { |
614359a7 TB |
2144 | charon->bus->ike_reestablish_post(charon->bus, &this->public, new, |
2145 | FALSE); | |
cadb5d16 | 2146 | charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new); |
04d6583e | 2147 | status = FAILED; |
96926b00 MW |
2148 | } |
2149 | else | |
2150 | { | |
614359a7 TB |
2151 | charon->bus->ike_reestablish_post(charon->bus, &this->public, new, |
2152 | TRUE); | |
cadb5d16 | 2153 | charon->ike_sa_manager->checkin(charon->ike_sa_manager, new); |
04d6583e | 2154 | status = SUCCESS; |
96926b00 | 2155 | } |
04d6583e MW |
2156 | charon->bus->set_sa(charon->bus, &this->public); |
2157 | return status; | |
96926b00 MW |
2158 | } |
2159 | ||
f20e00fe TB |
2160 | /** |
2161 | * Resolve the given gateway ID | |
2162 | */ | |
2163 | static host_t *resolve_gateway_id(identification_t *gateway) | |
c126ddd0 TB |
2164 | { |
2165 | char gw[BUF_LEN]; | |
f20e00fe | 2166 | host_t *addr; |
c126ddd0 | 2167 | |
f20e00fe TB |
2168 | snprintf(gw, sizeof(gw), "%Y", gateway); |
2169 | gw[sizeof(gw)-1] = '\0'; | |
2170 | addr = host_create_from_dns(gw, AF_UNSPEC, IKEV2_UDP_PORT); | |
2171 | if (!addr) | |
2172 | { | |
2173 | DBG1(DBG_IKE, "unable to resolve gateway ID '%Y', redirect failed", | |
2174 | gateway); | |
2175 | } | |
2176 | return addr; | |
2177 | } | |
2178 | ||
2179 | /** | |
2180 | * Redirect the current SA to the given target host | |
2181 | */ | |
2182 | static bool redirect_established(private_ike_sa_t *this, identification_t *to) | |
2183 | { | |
2184 | private_ike_sa_t *new_priv; | |
2185 | ike_sa_t *new; | |
2186 | host_t *other; | |
c6ebd033 | 2187 | time_t redirect; |
f20e00fe TB |
2188 | |
2189 | new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager, | |
2190 | this->version, TRUE); | |
2191 | if (!new) | |
489d154e | 2192 | { |
489d154e TB |
2193 | return FALSE; |
2194 | } | |
f20e00fe TB |
2195 | new_priv = (private_ike_sa_t*)new; |
2196 | new->set_peer_cfg(new, this->peer_cfg); | |
2197 | new_priv->redirected_from = this->other_host->clone(this->other_host); | |
2198 | charon->bus->ike_reestablish_pre(charon->bus, &this->public, new); | |
2199 | other = resolve_gateway_id(to); | |
2200 | if (other) | |
2201 | { | |
2202 | set_my_host(new_priv, this->my_host->clone(this->my_host)); | |
2203 | /* this allows us to force the remote address while we still properly | |
2204 | * resolve the local address */ | |
2205 | new_priv->remote_host = other; | |
2206 | resolve_hosts(new_priv); | |
c6ebd033 TB |
2207 | new_priv->redirected_at = array_create(sizeof(time_t), MAX_REDIRECTS); |
2208 | while (array_remove(this->redirected_at, ARRAY_HEAD, &redirect)) | |
2209 | { | |
2210 | array_insert(new_priv->redirected_at, ARRAY_TAIL, &redirect); | |
2211 | } | |
f20e00fe TB |
2212 | if (reestablish_children(this, new, TRUE) != DESTROY_ME) |
2213 | { | |
2214 | #ifdef USE_IKEV2 | |
2215 | new->queue_task(new, (task_t*)ike_reauth_complete_create(new, | |
2216 | this->ike_sa_id)); | |
2217 | #endif | |
2218 | charon->bus->ike_reestablish_post(charon->bus, &this->public, new, | |
2219 | TRUE); | |
2220 | charon->ike_sa_manager->checkin(charon->ike_sa_manager, new); | |
2221 | charon->bus->set_sa(charon->bus, &this->public); | |
2222 | return TRUE; | |
2223 | } | |
2224 | } | |
2225 | charon->bus->ike_reestablish_post(charon->bus, &this->public, new, | |
2226 | FALSE); | |
2227 | charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new); | |
2228 | charon->bus->set_sa(charon->bus, &this->public); | |
2229 | return FALSE; | |
2230 | } | |
c126ddd0 | 2231 | |
f20e00fe TB |
2232 | /** |
2233 | * Redirect the current connecting SA to the given target host | |
2234 | */ | |
2235 | static bool redirect_connecting(private_ike_sa_t *this, identification_t *to) | |
2236 | { | |
2237 | host_t *other; | |
2238 | ||
2239 | other = resolve_gateway_id(to); | |
c126ddd0 TB |
2240 | if (!other) |
2241 | { | |
c126ddd0 TB |
2242 | return FALSE; |
2243 | } | |
c3539961 | 2244 | reset(this, TRUE); |
f20e00fe TB |
2245 | DESTROY_IF(this->redirected_from); |
2246 | this->redirected_from = this->other_host->clone(this->other_host); | |
2247 | DESTROY_IF(this->remote_host); | |
2248 | /* this allows us to force the remote address while we still properly | |
2249 | * resolve the local address */ | |
2250 | this->remote_host = other; | |
2251 | resolve_hosts(this); | |
2252 | return TRUE; | |
2253 | } | |
2254 | ||
c6ebd033 TB |
2255 | /** |
2256 | * Check if the current redirect exceeds the limits for redirects | |
2257 | */ | |
2258 | static bool redirect_count_exceeded(private_ike_sa_t *this) | |
2259 | { | |
2260 | time_t now, redirect; | |
2261 | ||
2262 | now = time_monotonic(NULL); | |
2263 | /* remove entries outside the defined period */ | |
2264 | while (array_get(this->redirected_at, ARRAY_HEAD, &redirect) && | |
2265 | now - redirect >= REDIRECT_LOOP_DETECT_PERIOD) | |
2266 | { | |
2267 | array_remove(this->redirected_at, ARRAY_HEAD, NULL); | |
2268 | } | |
2269 | if (array_count(this->redirected_at) < MAX_REDIRECTS) | |
2270 | { | |
2271 | if (!this->redirected_at) | |
2272 | { | |
2273 | this->redirected_at = array_create(sizeof(time_t), MAX_REDIRECTS); | |
2274 | } | |
2275 | array_insert(this->redirected_at, ARRAY_TAIL, &now); | |
2276 | return FALSE; | |
2277 | } | |
2278 | return TRUE; | |
2279 | } | |
2280 | ||
f20e00fe TB |
2281 | METHOD(ike_sa_t, handle_redirect, bool, |
2282 | private_ike_sa_t *this, identification_t *gateway) | |
2283 | { | |
2284 | DBG1(DBG_IKE, "redirected to %Y", gateway); | |
2285 | if (!this->follow_redirects) | |
2286 | { | |
2287 | DBG1(DBG_IKE, "server sent REDIRECT even though we disabled it"); | |
2288 | return FALSE; | |
2289 | } | |
c6ebd033 TB |
2290 | if (redirect_count_exceeded(this)) |
2291 | { | |
2292 | DBG1(DBG_IKE, "only %d redirects are allowed within %d seconds", | |
2293 | MAX_REDIRECTS, REDIRECT_LOOP_DETECT_PERIOD); | |
2294 | return FALSE; | |
2295 | } | |
f20e00fe | 2296 | |
c126ddd0 TB |
2297 | switch (this->state) |
2298 | { | |
2299 | case IKE_CONNECTING: | |
f20e00fe TB |
2300 | return redirect_connecting(this, gateway); |
2301 | case IKE_ESTABLISHED: | |
2302 | return redirect_established(this, gateway); | |
c126ddd0 TB |
2303 | default: |
2304 | DBG1(DBG_IKE, "unable to handle redirect for IKE_SA in state %N", | |
2305 | ike_sa_state_names, this->state); | |
c126ddd0 TB |
2306 | return FALSE; |
2307 | } | |
2308 | } | |
2309 | ||
71c70705 TB |
2310 | METHOD(ike_sa_t, redirect, status_t, |
2311 | private_ike_sa_t *this, identification_t *gateway) | |
2312 | { | |
2313 | switch (this->state) | |
2314 | { | |
2315 | case IKE_CONNECTING: | |
2316 | case IKE_ESTABLISHED: | |
2317 | case IKE_REKEYING: | |
2318 | if (has_condition(this, COND_REDIRECTED)) | |
2319 | { /* IKE_SA already got redirected */ | |
2320 | return SUCCESS; | |
2321 | } | |
2322 | if (has_condition(this, COND_ORIGINAL_INITIATOR)) | |
2323 | { | |
2324 | DBG1(DBG_IKE, "unable to redirect IKE_SA as initiator"); | |
2325 | return FAILED; | |
2326 | } | |
2327 | if (this->version == IKEV1) | |
2328 | { | |
2329 | DBG1(DBG_IKE, "unable to redirect IKEv1 SA"); | |
2330 | return FAILED; | |
2331 | } | |
2332 | if (!supports_extension(this, EXT_IKE_REDIRECTION)) | |
2333 | { | |
2334 | DBG1(DBG_IKE, "client does not support IKE redirection"); | |
2335 | return FAILED; | |
2336 | } | |
2337 | #ifdef USE_IKEV2 | |
2338 | this->task_manager->queue_task(this->task_manager, | |
2339 | (task_t*)ike_redirect_create(&this->public, gateway)); | |
2340 | #endif | |
2341 | return this->task_manager->initiate(this->task_manager); | |
2342 | default: | |
2343 | DBG1(DBG_IKE, "unable to redirect IKE_SA in state %N", | |
2344 | ike_sa_state_names, this->state); | |
2345 | return INVALID_STATE; | |
2346 | } | |
2347 | } | |
2348 | ||
8bced61b | 2349 | METHOD(ike_sa_t, retransmit, status_t, |
b12c53ce | 2350 | private_ike_sa_t *this, uint32_t message_id) |
96926b00 | 2351 | { |
916cdca8 MW |
2352 | if (this->state == IKE_PASSIVE) |
2353 | { | |
2354 | return INVALID_STATE; | |
2355 | } | |
6180a558 | 2356 | this->stats[STAT_OUTBOUND] = time_monotonic(NULL); |
96926b00 MW |
2357 | if (this->task_manager->retransmit(this->task_manager, message_id) != SUCCESS) |
2358 | { | |
2359 | /* send a proper signal to brief interested bus listeners */ | |
2360 | switch (this->state) | |
2361 | { | |
2362 | case IKE_CONNECTING: | |
2363 | { | |
d9c1dae2 | 2364 | /* retry IKE_SA_INIT/Main Mode if we have multiple keyingtries */ |
b12c53ce | 2365 | uint32_t tries = this->peer_cfg->get_keyingtries(this->peer_cfg); |
1d6dc627 TB |
2366 | charon->bus->alert(charon->bus, ALERT_PEER_INIT_UNREACHABLE, |
2367 | this->keyingtry); | |
96926b00 MW |
2368 | this->keyingtry++; |
2369 | if (tries == 0 || tries > this->keyingtry) | |
2370 | { | |
a985db3f MW |
2371 | DBG1(DBG_IKE, "peer not responding, trying again (%d/%d)", |
2372 | this->keyingtry + 1, tries); | |
c3539961 | 2373 | reset(this, TRUE); |
4d7a2128 | 2374 | resolve_hosts(this); |
96926b00 MW |
2375 | return this->task_manager->initiate(this->task_manager); |
2376 | } | |
a985db3f | 2377 | DBG1(DBG_IKE, "establishing IKE_SA failed, peer not responding"); |
ebc6defa TB |
2378 | |
2379 | if (this->version == IKEV1 && array_count(this->child_sas)) | |
2380 | { | |
eb822106 TB |
2381 | enumerator_t *enumerator; |
2382 | child_sa_t *child_sa; | |
2383 | ||
ebc6defa TB |
2384 | /* if reauthenticating an IKEv1 SA failed (assumed for an SA |
2385 | * in this state with CHILD_SAs), try again from scratch */ | |
2386 | DBG1(DBG_IKE, "reauthentication failed, trying to " | |
2387 | "reestablish IKE_SA"); | |
2388 | reestablish(this); | |
eb822106 TB |
2389 | /* trigger down events for the CHILD_SAs, as no down event |
2390 | * is triggered below for IKE SAs in this state */ | |
2391 | enumerator = array_create_enumerator(this->child_sas); | |
2392 | while (enumerator->enumerate(enumerator, &child_sa)) | |
2393 | { | |
2394 | if (child_sa->get_state(child_sa) != CHILD_REKEYED && | |
2395 | child_sa->get_state(child_sa) != CHILD_DELETED) | |
2396 | { | |
2397 | charon->bus->child_updown(charon->bus, child_sa, | |
2398 | FALSE); | |
2399 | } | |
2400 | } | |
2401 | enumerator->destroy(enumerator); | |
ebc6defa | 2402 | } |
96926b00 MW |
2403 | break; |
2404 | } | |
96926b00 | 2405 | case IKE_DELETING: |
a985db3f | 2406 | DBG1(DBG_IKE, "proper IKE_SA delete failed, peer not responding"); |
10f8834b TB |
2407 | if (has_condition(this, COND_REAUTHENTICATING) && |
2408 | !lib->settings->get_bool(lib->settings, | |
2409 | "%s.make_before_break", FALSE, lib->ns)) | |
74571430 TB |
2410 | { |
2411 | DBG1(DBG_IKE, "delete during reauthentication failed, " | |
2412 | "trying to reestablish IKE_SA anyway"); | |
2413 | reestablish(this); | |
2414 | } | |
96926b00 | 2415 | break; |
348af092 | 2416 | case IKE_REKEYING: |
a985db3f | 2417 | DBG1(DBG_IKE, "rekeying IKE_SA failed, peer not responding"); |
348af092 | 2418 | /* FALL */ |
96926b00 | 2419 | default: |
348af092 | 2420 | reestablish(this); |
96926b00 MW |
2421 | break; |
2422 | } | |
bb389973 TB |
2423 | if (this->state != IKE_CONNECTING && |
2424 | this->state != IKE_REKEYED) | |
3babde90 TB |
2425 | { |
2426 | charon->bus->ike_updown(charon->bus, &this->public, FALSE); | |
2427 | } | |
96926b00 MW |
2428 | return DESTROY_ME; |
2429 | } | |
2430 | return SUCCESS; | |
2431 | } | |
2432 | ||
a07b6973 | 2433 | METHOD(ike_sa_t, set_auth_lifetime, status_t, |
b12c53ce | 2434 | private_ike_sa_t *this, uint32_t lifetime) |
ee614711 | 2435 | { |
b12c53ce | 2436 | uint32_t diff, hard, soft, now; |
a07b6973 | 2437 | bool send_update; |
ee614711 | 2438 | |
bdcf4417 MW |
2439 | diff = this->peer_cfg->get_over_time(this->peer_cfg); |
2440 | now = time_monotonic(NULL); | |
2441 | hard = now + lifetime; | |
2442 | soft = hard - diff; | |
2443 | ||
a07b6973 MW |
2444 | /* check if we have to send an AUTH_LIFETIME to enforce the new lifetime. |
2445 | * We send the notify in IKE_AUTH if not yet ESTABLISHED. */ | |
b1f2f05c | 2446 | send_update = this->state == IKE_ESTABLISHED && this->version == IKEV2 && |
a07b6973 | 2447 | !has_condition(this, COND_ORIGINAL_INITIATOR) && |
893da041 | 2448 | (array_count(this->other_vips) != 0 || |
a07b6973 MW |
2449 | has_condition(this, COND_EAP_AUTHENTICATED)); |
2450 | ||
bdcf4417 | 2451 | if (lifetime < diff) |
ee614711 | 2452 | { |
bdcf4417 | 2453 | this->stats[STAT_REAUTH] = now; |
a07b6973 MW |
2454 | |
2455 | if (!send_update) | |
2456 | { | |
2457 | DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, " | |
2458 | "starting reauthentication", lifetime); | |
2459 | lib->processor->queue_job(lib->processor, | |
b9b8a98f | 2460 | (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE)); |
a07b6973 | 2461 | } |
ee614711 | 2462 | } |
85ac2fa5 | 2463 | else if (this->stats[STAT_REAUTH] == 0 || |
bdcf4417 | 2464 | this->stats[STAT_REAUTH] > soft) |
ee614711 | 2465 | { |
bdcf4417 | 2466 | this->stats[STAT_REAUTH] = soft; |
a07b6973 MW |
2467 | if (!send_update) |
2468 | { | |
2469 | DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, scheduling " | |
2470 | "reauthentication in %ds", lifetime, lifetime - diff); | |
2471 | lib->scheduler->schedule_job(lib->scheduler, | |
6554b5e4 | 2472 | (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE), |
bdcf4417 | 2473 | lifetime - diff); |
a07b6973 | 2474 | } |
3fd9c757 AS |
2475 | } |
2476 | else | |
2477 | { | |
6180a558 MW |
2478 | DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, " |
2479 | "reauthentication already scheduled in %ds", lifetime, | |
2480 | this->stats[STAT_REAUTH] - time_monotonic(NULL)); | |
a07b6973 | 2481 | send_update = FALSE; |
ee614711 | 2482 | } |
bdcf4417 MW |
2483 | /* give at least some seconds to reauthenticate */ |
2484 | this->stats[STAT_DELETE] = max(hard, now + 10); | |
a07b6973 | 2485 | |
2d39f79b | 2486 | #ifdef USE_IKEV2 |
a07b6973 MW |
2487 | if (send_update) |
2488 | { | |
2d39f79b TB |
2489 | ike_auth_lifetime_t *task; |
2490 | ||
a07b6973 MW |
2491 | task = ike_auth_lifetime_create(&this->public, TRUE); |
2492 | this->task_manager->queue_task(this->task_manager, &task->task); | |
2493 | return this->task_manager->initiate(this->task_manager); | |
2494 | } | |
2d39f79b | 2495 | #endif |
a07b6973 | 2496 | return SUCCESS; |
ee614711 MW |
2497 | } |
2498 | ||
bab56a4a TB |
2499 | /** |
2500 | * Check if the current combination of source and destination address is still | |
2501 | * valid. | |
2502 | */ | |
2503 | static bool is_current_path_valid(private_ike_sa_t *this) | |
2504 | { | |
2505 | bool valid = FALSE; | |
2506 | host_t *src; | |
597e8c9e MW |
2507 | |
2508 | if (supports_extension(this, EXT_MOBIKE) && | |
2509 | lib->settings->get_bool(lib->settings, | |
2510 | "%s.prefer_best_path", FALSE, lib->ns)) | |
2511 | { | |
2512 | /* check if the current path is the best path; migrate otherwise */ | |
2513 | src = charon->kernel->get_source_addr(charon->kernel, this->other_host, | |
2514 | NULL); | |
2515 | if (src) | |
2516 | { | |
2517 | valid = src->ip_equals(src, this->my_host); | |
2518 | src->destroy(src); | |
2519 | } | |
2520 | if (!valid) | |
2521 | { | |
2522 | DBG1(DBG_IKE, "old path is not preferred anymore"); | |
2523 | } | |
2524 | return valid; | |
2525 | } | |
8394ea2a TB |
2526 | src = charon->kernel->get_source_addr(charon->kernel, this->other_host, |
2527 | this->my_host); | |
bab56a4a TB |
2528 | if (src) |
2529 | { | |
2530 | if (src->ip_equals(src, this->my_host)) | |
2531 | { | |
2532 | valid = TRUE; | |
2533 | } | |
2534 | src->destroy(src); | |
2535 | } | |
597e8c9e MW |
2536 | if (!valid) |
2537 | { | |
2538 | DBG1(DBG_IKE, "old path is not available anymore, try to find another"); | |
2539 | } | |
bab56a4a TB |
2540 | return valid; |
2541 | } | |
2542 | ||
2543 | /** | |
2544 | * Check if we have any path avialable for this IKE SA. | |
2545 | */ | |
2546 | static bool is_any_path_valid(private_ike_sa_t *this) | |
2547 | { | |
2548 | bool valid = FALSE; | |
2549 | enumerator_t *enumerator; | |
ae9ce835 | 2550 | host_t *src = NULL, *addr; |
ff601341 TB |
2551 | int family = AF_UNSPEC; |
2552 | ||
2553 | switch (charon->socket->supported_families(charon->socket)) | |
2554 | { | |
2555 | case SOCKET_FAMILY_IPV4: | |
2556 | family = AF_INET; | |
2557 | break; | |
2558 | case SOCKET_FAMILY_IPV6: | |
2559 | family = AF_INET6; | |
2560 | break; | |
2561 | case SOCKET_FAMILY_BOTH: | |
2562 | case SOCKET_FAMILY_NONE: | |
2563 | break; | |
2564 | } | |
72b28112 | 2565 | |
12715f19 | 2566 | enumerator = create_peer_address_enumerator(this); |
72b28112 | 2567 | while (enumerator->enumerate(enumerator, &addr)) |
bab56a4a | 2568 | { |
ff601341 TB |
2569 | if (family != AF_UNSPEC && addr->get_family(addr) != family) |
2570 | { | |
2571 | continue; | |
2572 | } | |
72b28112 | 2573 | DBG1(DBG_IKE, "looking for a route to %H ...", addr); |
8394ea2a | 2574 | src = charon->kernel->get_source_addr(charon->kernel, addr, NULL); |
72b28112 | 2575 | if (src) |
bab56a4a | 2576 | { |
72b28112 | 2577 | break; |
bab56a4a | 2578 | } |
bab56a4a | 2579 | } |
72b28112 | 2580 | enumerator->destroy(enumerator); |
bab56a4a TB |
2581 | if (src) |
2582 | { | |
2583 | valid = TRUE; | |
2584 | src->destroy(src); | |
2585 | } | |
2586 | return valid; | |
2587 | } | |
2588 | ||
8bced61b MW |
2589 | METHOD(ike_sa_t, roam, status_t, |
2590 | private_ike_sa_t *this, bool address) | |
17d92e97 | 2591 | { |
011b1cca MW |
2592 | switch (this->state) |
2593 | { | |
2594 | case IKE_CREATED: | |
2595 | case IKE_DELETING: | |
7afd9d66 | 2596 | case IKE_DESTROYING: |
c610f424 | 2597 | case IKE_PASSIVE: |
bb389973 | 2598 | case IKE_REKEYED: |
011b1cca MW |
2599 | return SUCCESS; |
2600 | default: | |
2601 | break; | |
2602 | } | |
7daf5226 | 2603 | |
007a2701 TB |
2604 | if (!this->ike_cfg) |
2605 | { /* this is the case for new HA SAs not yet in state IKE_PASSIVE and | |
2606 | * without config assigned */ | |
2607 | return SUCCESS; | |
2608 | } | |
8929c700 TB |
2609 | if (this->version == IKEV1) |
2610 | { /* ignore roam events for IKEv1 where we don't have MOBIKE and would | |
2611 | * have to reestablish from scratch (reauth is not enough) */ | |
2612 | return SUCCESS; | |
2613 | } | |
007a2701 | 2614 | |
be27e768 TB |
2615 | /* ignore roam events if MOBIKE is not supported/enabled and the local |
2616 | * address is statically configured */ | |
8929c700 | 2617 | if (!supports_extension(this, EXT_MOBIKE) && |
be27e768 TB |
2618 | ike_cfg_has_address(this->ike_cfg, this->my_host, TRUE)) |
2619 | { | |
2620 | DBG2(DBG_IKE, "keeping statically configured path %H - %H", | |
2621 | this->my_host, this->other_host); | |
2622 | return SUCCESS; | |
2623 | } | |
2624 | ||
ce5b1708 | 2625 | /* keep existing path if possible */ |
bab56a4a | 2626 | if (is_current_path_valid(this)) |
face844a | 2627 | { |
bab56a4a TB |
2628 | DBG2(DBG_IKE, "keeping connection path %H - %H", |
2629 | this->my_host, this->other_host); | |
2630 | set_condition(this, COND_STALE, FALSE); | |
261b2572 TB |
2631 | |
2632 | if (supports_extension(this, EXT_MOBIKE) && address) | |
2633 | { /* if any addresses changed, send an updated list */ | |
2634 | DBG1(DBG_IKE, "sending address list update using MOBIKE"); | |
873df908 | 2635 | this->task_manager->queue_mobike(this->task_manager, FALSE, TRUE); |
261b2572 TB |
2636 | return this->task_manager->initiate(this->task_manager); |
2637 | } | |
bab56a4a | 2638 | return SUCCESS; |
7afd9d66 | 2639 | } |
261b2572 | 2640 | |
bab56a4a | 2641 | if (!is_any_path_valid(this)) |
7afd9d66 | 2642 | { |
bab56a4a TB |
2643 | DBG1(DBG_IKE, "no route found to reach %H, MOBIKE update deferred", |
2644 | this->other_host); | |
2645 | set_condition(this, COND_STALE, TRUE); | |
2646 | return SUCCESS; | |
17d92e97 | 2647 | } |
7afd9d66 | 2648 | set_condition(this, COND_STALE, FALSE); |
7daf5226 | 2649 | |
face844a MW |
2650 | /* update addresses with mobike, if supported ... */ |
2651 | if (supports_extension(this, EXT_MOBIKE)) | |
2652 | { | |
57744088 TB |
2653 | if (!has_condition(this, COND_ORIGINAL_INITIATOR)) |
2654 | { /* responder updates the peer about changed address config */ | |
2655 | DBG1(DBG_IKE, "sending address list update using MOBIKE, " | |
2656 | "implicitly requesting an address change"); | |
2657 | address = TRUE; | |
2658 | } | |
2659 | else | |
2660 | { | |
2661 | DBG1(DBG_IKE, "requesting address change using MOBIKE"); | |
2662 | } | |
873df908 | 2663 | this->task_manager->queue_mobike(this->task_manager, TRUE, address); |
face844a MW |
2664 | return this->task_manager->initiate(this->task_manager); |
2665 | } | |
57744088 | 2666 | |
96926b00 | 2667 | /* ... reauth if not */ |
57744088 TB |
2668 | if (!has_condition(this, COND_ORIGINAL_INITIATOR)) |
2669 | { /* responder does not reauthenticate */ | |
2670 | set_condition(this, COND_STALE, TRUE); | |
2671 | return SUCCESS; | |
2672 | } | |
2673 | DBG1(DBG_IKE, "reauthenticating IKE_SA due to address change"); | |
a46fe568 TB |
2674 | /* since our previous path is not valid anymore, try and find a new one */ |
2675 | resolve_hosts(this); | |
96926b00 | 2676 | return reauth(this); |
17d92e97 | 2677 | } |
6fe03b0a | 2678 | |
8bced61b MW |
2679 | METHOD(ike_sa_t, add_configuration_attribute, void, |
2680 | private_ike_sa_t *this, attribute_handler_t *handler, | |
2681 | configuration_attribute_type_t type, chunk_t data) | |
7f56b494 | 2682 | { |
893da041 MW |
2683 | attribute_entry_t entry = { |
2684 | .handler = handler, | |
2685 | .type = type, | |
2686 | .data = chunk_clone(data), | |
2687 | }; | |
2688 | array_insert(this->attributes, ARRAY_TAIL, &entry); | |
7f56b494 MW |
2689 | } |
2690 | ||
525cc46c TB |
2691 | CALLBACK(filter_attribute, bool, |
2692 | void *null, enumerator_t *orig, va_list args) | |
9d257034 | 2693 | { |
525cc46c TB |
2694 | attribute_entry_t *entry; |
2695 | configuration_attribute_type_t *type; | |
2696 | chunk_t *data; | |
2697 | bool *handled; | |
2698 | ||
2699 | VA_ARGS_VGET(args, type, data, handled); | |
2700 | ||
2701 | if (orig->enumerate(orig, &entry)) | |
2702 | { | |
2703 | *type = entry->type; | |
2704 | *data = entry->data; | |
2705 | *handled = entry->handler != NULL; | |
2706 | return TRUE; | |
2707 | } | |
2708 | return FALSE; | |
9d257034 MW |
2709 | } |
2710 | ||
2711 | METHOD(ike_sa_t, create_attribute_enumerator, enumerator_t*, | |
2712 | private_ike_sa_t *this) | |
2713 | { | |
2714 | return enumerator_create_filter(array_create_enumerator(this->attributes), | |
525cc46c | 2715 | filter_attribute, NULL, NULL); |
9d257034 MW |
2716 | } |
2717 | ||
ea340ee8 MW |
2718 | METHOD(ike_sa_t, create_task_enumerator, enumerator_t*, |
2719 | private_ike_sa_t *this, task_queue_t queue) | |
2720 | { | |
2721 | return this->task_manager->create_task_enumerator(this->task_manager, queue); | |
2722 | } | |
2723 | ||
b7160401 TB |
2724 | METHOD(ike_sa_t, remove_task, void, |
2725 | private_ike_sa_t *this, enumerator_t *enumerator) | |
2726 | { | |
2727 | return this->task_manager->remove_task(this->task_manager, enumerator); | |
2728 | } | |
2729 | ||
cbc1a20f MW |
2730 | METHOD(ike_sa_t, flush_queue, void, |
2731 | private_ike_sa_t *this, task_queue_t queue) | |
2732 | { | |
2733 | this->task_manager->flush_queue(this->task_manager, queue); | |
2734 | } | |
2735 | ||
69adeb5b MW |
2736 | METHOD(ike_sa_t, queue_task, void, |
2737 | private_ike_sa_t *this, task_t *task) | |
2738 | { | |
2739 | this->task_manager->queue_task(this->task_manager, task); | |
2740 | } | |
2741 | ||
208678e6 TB |
2742 | METHOD(ike_sa_t, queue_task_delayed, void, |
2743 | private_ike_sa_t *this, task_t *task, uint32_t delay) | |
2744 | { | |
2745 | this->task_manager->queue_task_delayed(this->task_manager, task, delay); | |
2746 | } | |
2747 | ||
00c889f4 TB |
2748 | METHOD(ike_sa_t, adopt_child_tasks, void, |
2749 | private_ike_sa_t *this, ike_sa_t *other_public) | |
2750 | { | |
2751 | private_ike_sa_t *other = (private_ike_sa_t*)other_public; | |
2752 | ||
2753 | this->task_manager->adopt_child_tasks(this->task_manager, | |
2754 | other->task_manager); | |
2755 | } | |
2756 | ||
713a1122 MW |
2757 | METHOD(ike_sa_t, inherit_pre, void, |
2758 | private_ike_sa_t *this, ike_sa_t *other_public) | |
2759 | { | |
2760 | private_ike_sa_t *other = (private_ike_sa_t*)other_public; | |
2761 | ||
2762 | /* apply config and hosts */ | |
2763 | set_peer_cfg(this, other->peer_cfg); | |
2764 | set_my_host(this, other->my_host->clone(other->my_host)); | |
2765 | set_other_host(this, other->other_host->clone(other->other_host)); | |
094963d1 MW |
2766 | |
2767 | /* apply extensions and conditions with a few exceptions */ | |
2768 | this->extensions = other->extensions; | |
2769 | this->conditions = other->conditions; | |
2770 | this->conditions &= ~COND_STALE; | |
2771 | this->conditions &= ~COND_REAUTHENTICATING; | |
713a1122 MW |
2772 | } |
2773 | ||
2774 | METHOD(ike_sa_t, inherit_post, void, | |
8bced61b | 2775 | private_ike_sa_t *this, ike_sa_t *other_public) |
3183006d | 2776 | { |
8bced61b | 2777 | private_ike_sa_t *other = (private_ike_sa_t*)other_public; |
c60c7694 | 2778 | child_sa_t *child_sa; |
5d6b9815 | 2779 | enumerator_t *enumerator; |
893da041 | 2780 | attribute_entry_t entry; |
5d6b9815 | 2781 | auth_cfg_t *cfg; |
101d26ba | 2782 | host_t *vip; |
7daf5226 | 2783 | |
c60c7694 MW |
2784 | /* apply hosts and ids */ |
2785 | this->my_host->destroy(this->my_host); | |
2786 | this->other_host->destroy(this->other_host); | |
2787 | this->my_id->destroy(this->my_id); | |
2788 | this->other_id->destroy(this->other_id); | |
2789 | this->my_host = other->my_host->clone(other->my_host); | |
2790 | this->other_host = other->other_host->clone(other->other_host); | |
2791 | this->my_id = other->my_id->clone(other->my_id); | |
2792 | this->other_id = other->other_id->clone(other->other_id); | |
7daf5226 | 2793 | |
101d26ba | 2794 | /* apply assigned virtual IPs... */ |
893da041 | 2795 | while (array_remove(other->my_vips, ARRAY_HEAD, &vip)) |
c60c7694 | 2796 | { |
893da041 | 2797 | array_insert_create(&this->my_vips, ARRAY_TAIL, vip); |
c60c7694 | 2798 | } |
893da041 | 2799 | while (array_remove(other->other_vips, ARRAY_HEAD, &vip)) |
c60c7694 | 2800 | { |
893da041 | 2801 | array_insert_create(&this->other_vips, ARRAY_TAIL, vip); |
c60c7694 | 2802 | } |
7daf5226 | 2803 | |
b8ecdfd8 MW |
2804 | /* MOBIKE additional addresses */ |
2805 | while (array_remove(other->peer_addresses, ARRAY_HEAD, &vip)) | |
2806 | { | |
2807 | array_insert_create(&this->peer_addresses, ARRAY_TAIL, vip); | |
2808 | } | |
2809 | ||
5d6b9815 | 2810 | /* authentication information */ |
893da041 | 2811 | enumerator = array_create_enumerator(other->my_auths); |
5d6b9815 MW |
2812 | while (enumerator->enumerate(enumerator, &cfg)) |
2813 | { | |
893da041 | 2814 | array_insert(this->my_auths, ARRAY_TAIL, cfg->clone(cfg)); |
5d6b9815 MW |
2815 | } |
2816 | enumerator->destroy(enumerator); | |
893da041 | 2817 | enumerator = array_create_enumerator(other->other_auths); |
5d6b9815 MW |
2818 | while (enumerator->enumerate(enumerator, &cfg)) |
2819 | { | |
893da041 | 2820 | array_insert(this->other_auths, ARRAY_TAIL, cfg->clone(cfg)); |
5d6b9815 MW |
2821 | } |
2822 | enumerator->destroy(enumerator); | |
2823 | ||
7f56b494 | 2824 | /* ... and configuration attributes */ |
893da041 | 2825 | while (array_remove(other->attributes, ARRAY_HEAD, &entry)) |
c60c7694 | 2826 | { |
893da041 | 2827 | array_insert(this->attributes, ARRAY_TAIL, &entry); |
c60c7694 | 2828 | } |
b0e40caa | 2829 | |
faf9569f | 2830 | /* inherit all conditions */ |
b0e40caa AS |
2831 | this->conditions = other->conditions; |
2832 | if (this->conditions & COND_NAT_HERE) | |
2833 | { | |
efd7fa7b | 2834 | send_keepalive(this, FALSE); |
b0e40caa | 2835 | } |
7daf5226 | 2836 | |
22452f70 TB |
2837 | #ifdef ME |
2838 | if (other->is_mediation_server) | |
2839 | { | |
2840 | act_as_mediation_server(this); | |
2841 | } | |
2842 | else if (other->server_reflexive_host) | |
2843 | { | |
2844 | this->server_reflexive_host = other->server_reflexive_host->clone( | |
2845 | other->server_reflexive_host); | |
2846 | } | |
2847 | #endif /* ME */ | |
b0e40caa | 2848 | |
c60c7694 | 2849 | /* adopt all children */ |
893da041 | 2850 | while (array_remove(other->child_sas, ARRAY_HEAD, &child_sa)) |
c60c7694 | 2851 | { |
38227d0e MW |
2852 | charon->child_sa_manager->remove(charon->child_sa_manager, child_sa); |
2853 | add_child_sa(this, child_sa); | |
c60c7694 | 2854 | } |
7daf5226 | 2855 | |
e23a59f6 MW |
2856 | /* move pending tasks to the new IKE_SA */ |
2857 | this->task_manager->adopt_tasks(this->task_manager, other->task_manager); | |
7daf5226 | 2858 | |
ee614711 | 2859 | /* reauthentication timeout survives a rekeying */ |
85ac2fa5 | 2860 | if (other->stats[STAT_REAUTH]) |
ee614711 | 2861 | { |
6180a558 | 2862 | time_t reauth, delete, now = time_monotonic(NULL); |
7daf5226 | 2863 | |
85ac2fa5 MW |
2864 | this->stats[STAT_REAUTH] = other->stats[STAT_REAUTH]; |
2865 | reauth = this->stats[STAT_REAUTH] - now; | |
ee614711 | 2866 | delete = reauth + this->peer_cfg->get_over_time(this->peer_cfg); |
85ac2fa5 | 2867 | this->stats[STAT_DELETE] = this->stats[STAT_REAUTH] + delete; |
ee614711 MW |
2868 | DBG1(DBG_IKE, "rescheduling reauthentication in %ds after rekeying, " |
2869 | "lifetime reduced to %ds", reauth, delete); | |
bb381e26 | 2870 | lib->scheduler->schedule_job(lib->scheduler, |
6554b5e4 | 2871 | (job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE), reauth); |
bb381e26 | 2872 | lib->scheduler->schedule_job(lib->scheduler, |
6554b5e4 | 2873 | (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE), delete); |
ee614711 | 2874 | } |
3183006d MW |
2875 | } |
2876 | ||
8bced61b MW |
2877 | METHOD(ike_sa_t, destroy, void, |
2878 | private_ike_sa_t *this) | |
60356f33 | 2879 | { |
893da041 | 2880 | attribute_entry_t entry; |
2b0c8ee3 | 2881 | child_sa_t *child_sa; |
101d26ba | 2882 | host_t *vip; |
7daf5226 | 2883 | |
65c907cd | 2884 | charon->bus->set_sa(charon->bus, &this->public); |
7daf5226 | 2885 | |
a985db3f | 2886 | set_state(this, IKE_DESTROYING); |
b1908994 TE |
2887 | if (this->task_manager) |
2888 | { | |
2889 | this->task_manager->flush(this->task_manager); | |
2890 | } | |
7daf5226 | 2891 | |
7f56b494 | 2892 | /* remove attributes first, as we pass the IKE_SA to the handler */ |
eef7427b | 2893 | charon->bus->handle_vips(charon->bus, &this->public, FALSE); |
893da041 | 2894 | while (array_remove(this->attributes, ARRAY_TAIL, &entry)) |
7f56b494 | 2895 | { |
5ae32210 MW |
2896 | if (entry.handler) |
2897 | { | |
75136327 | 2898 | charon->attributes->release(charon->attributes, entry.handler, |
a12f357b | 2899 | &this->public, entry.type, entry.data); |
5ae32210 | 2900 | } |
893da041 | 2901 | free(entry.data.ptr); |
7f56b494 | 2902 | } |
2b0c8ee3 MW |
2903 | /* uninstall CHILD_SAs before virtual IPs, otherwise we might kill |
2904 | * routes that the CHILD_SA tries to uninstall. */ | |
2905 | while (array_remove(this->child_sas, ARRAY_TAIL, &child_sa)) | |
2906 | { | |
38227d0e | 2907 | charon->child_sa_manager->remove(charon->child_sa_manager, child_sa); |
2b0c8ee3 MW |
2908 | child_sa->destroy(child_sa); |
2909 | } | |
893da041 | 2910 | while (array_remove(this->my_vips, ARRAY_TAIL, &vip)) |
c60c7694 | 2911 | { |
8394ea2a | 2912 | charon->kernel->del_ip(charon->kernel, vip, -1, TRUE); |
101d26ba | 2913 | vip->destroy(vip); |
c60c7694 | 2914 | } |
893da041 | 2915 | if (array_count(this->other_vips)) |
12fa1784 AS |
2916 | { |
2917 | charon->bus->assign_vips(charon->bus, &this->public, FALSE); | |
2918 | } | |
893da041 | 2919 | while (array_remove(this->other_vips, ARRAY_TAIL, &vip)) |
cdcfe777 | 2920 | { |
497ce2cf | 2921 | if (this->peer_cfg) |
cdcfe777 | 2922 | { |
28a3d5bf | 2923 | linked_list_t *pools; |
28a3d5bf | 2924 | |
28a3d5bf MW |
2925 | pools = linked_list_create_from_enumerator( |
2926 | this->peer_cfg->create_pool_enumerator(this->peer_cfg)); | |
75136327 | 2927 | charon->attributes->release_address(charon->attributes, |
a16058a4 | 2928 | pools, vip, &this->public); |
28a3d5bf | 2929 | pools->destroy(pools); |
cdcfe777 | 2930 | } |
101d26ba | 2931 | vip->destroy(vip); |
cdcfe777 | 2932 | } |
a3854d83 MW |
2933 | |
2934 | /* unset SA after here to avoid usage by the listeners */ | |
2935 | charon->bus->set_sa(charon->bus, NULL); | |
2936 | ||
2b0c8ee3 | 2937 | array_destroy(this->child_sas); |
b1908994 | 2938 | DESTROY_IF(this->task_manager); |
a3854d83 | 2939 | DESTROY_IF(this->keymat); |
893da041 MW |
2940 | array_destroy(this->attributes); |
2941 | array_destroy(this->my_vips); | |
2942 | array_destroy(this->other_vips); | |
2943 | array_destroy_offset(this->peer_addresses, offsetof(host_t, destroy)); | |
dc04b7c7 | 2944 | #ifdef ME |
22452f70 | 2945 | if (this->is_mediation_server) |
d5cc1758 | 2946 | { |
484a06bc TB |
2947 | charon->mediation_manager->remove(charon->mediation_manager, |
2948 | this->ike_sa_id); | |
d5cc1758 TB |
2949 | } |
2950 | DESTROY_IF(this->server_reflexive_host); | |
9c2a905d | 2951 | chunk_free(&this->connect_id); |
dc04b7c7 | 2952 | #endif /* ME */ |
9d9a772e | 2953 | free(this->nat_detection_dest.ptr); |
7daf5226 | 2954 | |
8dfbe71b MW |
2955 | DESTROY_IF(this->my_host); |
2956 | DESTROY_IF(this->other_host); | |
2957 | DESTROY_IF(this->my_id); | |
2958 | DESTROY_IF(this->other_id); | |
d487b4b7 AS |
2959 | DESTROY_IF(this->local_host); |
2960 | DESTROY_IF(this->remote_host); | |
e4af6e6b | 2961 | DESTROY_IF(this->redirected_from); |
c6ebd033 | 2962 | array_destroy(this->redirected_at); |
7daf5226 | 2963 | |
e0fe7651 MW |
2964 | DESTROY_IF(this->ike_cfg); |
2965 | DESTROY_IF(this->peer_cfg); | |
5dffdea1 | 2966 | DESTROY_IF(this->proposal); |
a44bb934 MW |
2967 | this->my_auth->destroy(this->my_auth); |
2968 | this->other_auth->destroy(this->other_auth); | |
893da041 MW |
2969 | array_destroy_offset(this->my_auths, offsetof(auth_cfg_t, destroy)); |
2970 | array_destroy_offset(this->other_auths, offsetof(auth_cfg_t, destroy)); | |
7daf5226 | 2971 | |
87a217f9 | 2972 | this->ike_sa_id->destroy(this->ike_sa_id); |
5113680f | 2973 | free(this); |
7ba38761 JH |
2974 | } |
2975 | ||
2976 | /* | |
39b2903f | 2977 | * Described in header. |
7ba38761 | 2978 | */ |
17ec1c74 MW |
2979 | ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id, bool initiator, |
2980 | ike_version_t version) | |
7ba38761 | 2981 | { |
8bced61b | 2982 | private_ike_sa_t *this; |
3568abe7 | 2983 | static refcount_t unique_id = 0; |
7daf5226 | 2984 | |
3d54ae94 MW |
2985 | if (version == IKE_ANY) |
2986 | { /* prefer IKEv2 if protocol not specified */ | |
2987 | #ifdef USE_IKEV2 | |
2988 | version = IKEV2; | |
2989 | #else | |
2990 | version = IKEV1; | |
2991 | #endif | |
2992 | } | |
2993 | ||
8bced61b MW |
2994 | INIT(this, |
2995 | .public = { | |
0b611540 | 2996 | .get_version = _get_version, |
8bced61b MW |
2997 | .get_state = _get_state, |
2998 | .set_state = _set_state, | |
2999 | .get_name = _get_name, | |
3000 | .get_statistic = _get_statistic, | |
44ff1153 | 3001 | .set_statistic = _set_statistic, |
8bced61b MW |
3002 | .process_message = _process_message, |
3003 | .initiate = _initiate, | |
77e42826 | 3004 | .retry_initiate = _retry_initiate, |
8bced61b MW |
3005 | .get_ike_cfg = _get_ike_cfg, |
3006 | .set_ike_cfg = _set_ike_cfg, | |
3007 | .get_peer_cfg = _get_peer_cfg, | |
3008 | .set_peer_cfg = _set_peer_cfg, | |
3009 | .get_auth_cfg = _get_auth_cfg, | |
3010 | .create_auth_cfg_enumerator = _create_auth_cfg_enumerator, | |
1b9c1ae0 | 3011 | .verify_peer_certificate = _verify_peer_certificate, |
8bced61b MW |
3012 | .add_auth_cfg = _add_auth_cfg, |
3013 | .get_proposal = _get_proposal, | |
3014 | .set_proposal = _set_proposal, | |
3015 | .get_id = _get_id, | |
3016 | .get_my_host = _get_my_host, | |
3017 | .set_my_host = _set_my_host, | |
3018 | .get_other_host = _get_other_host, | |
3019 | .set_other_host = _set_other_host, | |
3020 | .set_message_id = _set_message_id, | |
347c403c | 3021 | .get_message_id = _get_message_id, |
277f02ce | 3022 | .float_ports = _float_ports, |
8bced61b MW |
3023 | .update_hosts = _update_hosts, |
3024 | .get_my_id = _get_my_id, | |
3025 | .set_my_id = _set_my_id, | |
3026 | .get_other_id = _get_other_id, | |
3027 | .set_other_id = _set_other_id, | |
3028 | .get_other_eap_id = _get_other_eap_id, | |
3029 | .enable_extension = _enable_extension, | |
3030 | .supports_extension = _supports_extension, | |
3031 | .set_condition = _set_condition, | |
3032 | .has_condition = _has_condition, | |
94bbc602 TB |
3033 | .create_peer_address_enumerator = _create_peer_address_enumerator, |
3034 | .add_peer_address = _add_peer_address, | |
3035 | .clear_peer_addresses = _clear_peer_addresses, | |
8bced61b MW |
3036 | .has_mapping_changed = _has_mapping_changed, |
3037 | .retransmit = _retransmit, | |
3038 | .delete = _delete_, | |
3039 | .destroy = _destroy, | |
3040 | .send_dpd = _send_dpd, | |
3041 | .send_keepalive = _send_keepalive, | |
71c70705 | 3042 | .redirect = _redirect, |
c126ddd0 | 3043 | .handle_redirect = _handle_redirect, |
e4af6e6b | 3044 | .get_redirected_from = _get_redirected_from, |
8bced61b MW |
3045 | .get_keymat = _get_keymat, |
3046 | .add_child_sa = _add_child_sa, | |
3047 | .get_child_sa = _get_child_sa, | |
4bbce1ef TB |
3048 | .get_child_count = _get_child_count, |
3049 | .create_child_sa_enumerator = _create_child_sa_enumerator, | |
3050 | .remove_child_sa = _remove_child_sa, | |
8bced61b MW |
3051 | .rekey_child_sa = _rekey_child_sa, |
3052 | .delete_child_sa = _delete_child_sa, | |
3053 | .destroy_child_sa = _destroy_child_sa, | |
3054 | .rekey = _rekey, | |
3055 | .reauth = _reauth, | |
3056 | .reestablish = _reestablish, | |
3057 | .set_auth_lifetime = _set_auth_lifetime, | |
3058 | .roam = _roam, | |
713a1122 MW |
3059 | .inherit_pre = _inherit_pre, |
3060 | .inherit_post = _inherit_post, | |
8bced61b | 3061 | .generate_message = _generate_message, |
40bab9a1 | 3062 | .generate_message_fragmented = _generate_message_fragmented, |
8bced61b MW |
3063 | .reset = _reset, |
3064 | .get_unique_id = _get_unique_id, | |
101d26ba | 3065 | .add_virtual_ip = _add_virtual_ip, |
d2e8f20d | 3066 | .clear_virtual_ips = _clear_virtual_ips, |
101d26ba | 3067 | .create_virtual_ip_enumerator = _create_virtual_ip_enumerator, |
8bced61b | 3068 | .add_configuration_attribute = _add_configuration_attribute, |
9d257034 | 3069 | .create_attribute_enumerator = _create_attribute_enumerator, |
8bced61b | 3070 | .set_kmaddress = _set_kmaddress, |
ea340ee8 | 3071 | .create_task_enumerator = _create_task_enumerator, |
b7160401 | 3072 | .remove_task = _remove_task, |
cbc1a20f | 3073 | .flush_queue = _flush_queue, |
69adeb5b | 3074 | .queue_task = _queue_task, |
208678e6 | 3075 | .queue_task_delayed = _queue_task_delayed, |
00c889f4 | 3076 | .adopt_child_tasks = _adopt_child_tasks, |
dc04b7c7 | 3077 | #ifdef ME |
8bced61b MW |
3078 | .act_as_mediation_server = _act_as_mediation_server, |
3079 | .get_server_reflexive_host = _get_server_reflexive_host, | |
3080 | .set_server_reflexive_host = _set_server_reflexive_host, | |
3081 | .get_connect_id = _get_connect_id, | |
3082 | .initiate_mediation = _initiate_mediation, | |
3083 | .initiate_mediated = _initiate_mediated, | |
3084 | .relay = _relay, | |
3085 | .callback = _callback, | |
3086 | .respond = _respond, | |
dc04b7c7 | 3087 | #endif /* ME */ |
8bced61b MW |
3088 | }, |
3089 | .ike_sa_id = ike_sa_id->clone(ike_sa_id), | |
0b611540 | 3090 | .version = version, |
8bced61b MW |
3091 | .my_host = host_create_any(AF_INET), |
3092 | .other_host = host_create_any(AF_INET), | |
3093 | .my_id = identification_create_from_encoding(ID_ANY, chunk_empty), | |
3094 | .other_id = identification_create_from_encoding(ID_ANY, chunk_empty), | |
17ec1c74 | 3095 | .keymat = keymat_create(version, initiator), |
8bced61b MW |
3096 | .state = IKE_CREATED, |
3097 | .stats[STAT_INBOUND] = time_monotonic(NULL), | |
3098 | .stats[STAT_OUTBOUND] = time_monotonic(NULL), | |
3099 | .my_auth = auth_cfg_create(), | |
3100 | .other_auth = auth_cfg_create(), | |
893da041 MW |
3101 | .my_auths = array_create(0, 0), |
3102 | .other_auths = array_create(0, 0), | |
3103 | .attributes = array_create(sizeof(attribute_entry_t), 0), | |
3568abe7 | 3104 | .unique_id = ref_get(&unique_id), |
8bced61b | 3105 | .keepalive_interval = lib->settings->get_time(lib->settings, |
d223fe80 | 3106 | "%s.keep_alive", KEEPALIVE_INTERVAL, lib->ns), |
60c82591 | 3107 | .retry_initiate_interval = lib->settings->get_time(lib->settings, |
d223fe80 | 3108 | "%s.retry_initiate_interval", 0, lib->ns), |
b24b73b7 | 3109 | .flush_auth_cfg = lib->settings->get_bool(lib->settings, |
d223fe80 | 3110 | "%s.flush_auth_cfg", FALSE, lib->ns), |
40bab9a1 | 3111 | .fragment_size = lib->settings->get_int(lib->settings, |
0642f42b | 3112 | "%s.fragment_size", 1280, lib->ns), |
489d154e TB |
3113 | .follow_redirects = lib->settings->get_bool(lib->settings, |
3114 | "%s.follow_redirects", TRUE, lib->ns), | |
8bced61b | 3115 | ); |
4b64a1a1 | 3116 | |
11aadd77 MW |
3117 | if (version == IKEV2) |
3118 | { /* always supported with IKEv2 */ | |
3119 | enable_extension(this, EXT_DPD); | |
3120 | } | |
3121 | ||
5baaaa5e | 3122 | this->task_manager = task_manager_create(&this->public); |
b223d517 TB |
3123 | this->my_host->set_port(this->my_host, |
3124 | charon->socket->get_port(charon->socket, FALSE)); | |
7daf5226 | 3125 | |
3d54ae94 MW |
3126 | if (!this->task_manager || !this->keymat) |
3127 | { | |
3128 | DBG1(DBG_IKE, "IKE version %d not supported", this->version); | |
3129 | destroy(this); | |
3130 | return NULL; | |
3131 | } | |
3dd3c5f3 | 3132 | return &this->public; |
7ba38761 | 3133 | } |