2 * Copyright (C) 2007-2018 Tobias Brunner
3 * Copyright (C) 2007-2010 Martin Willi
4 * HSR Hochschule fuer Technik Rapperswil
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 #include "task_manager_v2.h"
21 #include <collections/array.h>
23 #include <sa/ikev2/tasks/ike_init.h>
24 #include <sa/ikev2/tasks/ike_natd.h>
25 #include <sa/ikev2/tasks/ike_mobike.h>
26 #include <sa/ikev2/tasks/ike_auth.h>
27 #include <sa/ikev2/tasks/ike_auth_lifetime.h>
28 #include <sa/ikev2/tasks/ike_cert_pre.h>
29 #include <sa/ikev2/tasks/ike_cert_post.h>
30 #include <sa/ikev2/tasks/ike_rekey.h>
31 #include <sa/ikev2/tasks/ike_reauth.h>
32 #include <sa/ikev2/tasks/ike_reauth_complete.h>
33 #include <sa/ikev2/tasks/ike_redirect.h>
34 #include <sa/ikev2/tasks/ike_delete.h>
35 #include <sa/ikev2/tasks/ike_config.h>
36 #include <sa/ikev2/tasks/ike_dpd.h>
37 #include <sa/ikev2/tasks/ike_mid_sync.h>
38 #include <sa/ikev2/tasks/ike_vendor.h>
39 #include <sa/ikev2/tasks/ike_verify_peer_cert.h>
40 #include <sa/ikev2/tasks/child_create.h>
41 #include <sa/ikev2/tasks/child_rekey.h>
42 #include <sa/ikev2/tasks/child_delete.h>
43 #include <encoding/payloads/delete_payload.h>
44 #include <encoding/payloads/unknown_payload.h>
45 #include <processing/jobs/retransmit_job.h>
46 #include <processing/jobs/delete_ike_sa_job.h>
47 #include <processing/jobs/initiate_tasks_job.h>
50 #include <sa/ikev2/tasks/ike_me.h>
53 typedef struct private_task_manager_t private_task_manager_t
;
54 typedef struct queued_task_t queued_task_t
;
57 * private data of the task manager
59 struct private_task_manager_t
{
64 task_manager_v2_t
public;
67 * associated IKE_SA we are serving
72 * Exchange we are currently handling as responder
76 * Message ID of the exchange
81 * packet(s) for retransmission
86 * Helper to defragment the request
93 * Exchange we are currently handling as initiator
97 * Message ID of the exchange
102 * how many times we have retransmitted so far
107 * packet(s) for retransmission
112 * type of the initated exchange
114 exchange_type_t type
;
117 * TRUE if exchange was deferred because no path was available
122 * Helper to defragment the response
129 * Array of queued tasks not yet in action
131 array_t
*queued_tasks
;
134 * Array of active tasks, initiated by ourselves
136 array_t
*active_tasks
;
139 * Array of tasks initiated by peer
141 array_t
*passive_tasks
;
144 * the task manager has been reset
149 * Number of times we retransmit messages before giving up
151 u_int retransmit_tries
;
154 * Retransmission timeout
156 double retransmit_timeout
;
159 * Base to calculate retransmission timeout
161 double retransmit_base
;
164 * Jitter to apply to calculated retransmit timeout (in percent)
166 u_int retransmit_jitter
;
169 * Limit retransmit timeout to this value
171 uint32_t retransmit_limit
;
174 * Use make-before-break instead of break-before-make reauth?
176 bool make_before_break
;
182 struct queued_task_t
{
190 * Time before which the task is not to be initiated
196 * Reset retransmission packet list
198 static void clear_packets(array_t
*array
)
202 while (array_remove(array
, ARRAY_TAIL
, &packet
))
204 packet
->destroy(packet
);
208 METHOD(task_manager_t
, flush_queue
, void,
209 private_task_manager_t
*this, task_queue_t queue
)
216 case TASK_QUEUE_ACTIVE
:
217 array
= this->active_tasks
;
219 case TASK_QUEUE_PASSIVE
:
220 array
= this->passive_tasks
;
222 case TASK_QUEUE_QUEUED
:
223 array
= this->queued_tasks
;
228 while (array_remove(array
, ARRAY_TAIL
, &task
))
230 if (queue
== TASK_QUEUE_QUEUED
)
232 queued_task_t
*queued
= (queued_task_t
*)task
;
240 METHOD(task_manager_t
, flush
, void,
241 private_task_manager_t
*this)
243 flush_queue(this, TASK_QUEUE_QUEUED
);
244 flush_queue(this, TASK_QUEUE_PASSIVE
);
245 flush_queue(this, TASK_QUEUE_ACTIVE
);
249 * Move a task of a specific type from the queue to the active list, if it is
252 static bool activate_task(private_task_manager_t
*this, task_type_t type
)
254 enumerator_t
*enumerator
;
255 queued_task_t
*queued
;
259 time_monotonic(&now
);
261 enumerator
= array_create_enumerator(this->queued_tasks
);
262 while (enumerator
->enumerate(enumerator
, (void**)&queued
))
264 if (queued
->task
->get_type(queued
->task
) == type
&&
265 !timercmp(&now
, &queued
->time
, <))
267 DBG2(DBG_IKE
, " activating %N task", task_type_names
, type
);
268 array_remove_at(this->queued_tasks
, enumerator
);
269 array_insert(this->active_tasks
, ARRAY_TAIL
, queued
->task
);
275 enumerator
->destroy(enumerator
);
280 * Send packets in the given array (they get cloned). Optionally, the
281 * source and destination addresses are changed before sending it.
283 static void send_packets(private_task_manager_t
*this, array_t
*packets
,
284 host_t
*src
, host_t
*dst
)
286 packet_t
*packet
, *clone
;
289 for (i
= 0; i
< array_count(packets
); i
++)
291 array_get(packets
, i
, &packet
);
292 clone
= packet
->clone(packet
);
295 clone
->set_source(clone
, src
->clone(src
));
299 clone
->set_destination(clone
, dst
->clone(dst
));
301 charon
->sender
->send(charon
->sender
, clone
);
306 * Generates the given message and stores packet(s) in the given array
308 static bool generate_message(private_task_manager_t
*this, message_t
*message
,
311 enumerator_t
*fragments
;
314 if (this->ike_sa
->generate_message_fragmented(this->ike_sa
, message
,
315 &fragments
) != SUCCESS
)
319 while (fragments
->enumerate(fragments
, &fragment
))
321 array_insert_create(packets
, ARRAY_TAIL
, fragment
);
323 fragments
->destroy(fragments
);
324 array_compress(*packets
);
328 METHOD(task_manager_t
, retransmit
, status_t
,
329 private_task_manager_t
*this, uint32_t message_id
)
331 if (message_id
== this->initiating
.mid
&&
332 array_count(this->initiating
.packets
))
334 uint32_t timeout
, max_jitter
;
336 enumerator_t
*enumerator
;
339 ike_mobike_t
*mobike
= NULL
;
341 array_get(this->initiating
.packets
, 0, &packet
);
343 /* check if we are retransmitting a MOBIKE routability check */
344 if (this->initiating
.type
== INFORMATIONAL
)
346 enumerator
= array_create_enumerator(this->active_tasks
);
347 while (enumerator
->enumerate(enumerator
, (void*)&task
))
349 if (task
->get_type(task
) == TASK_IKE_MOBIKE
)
351 mobike
= (ike_mobike_t
*)task
;
355 enumerator
->destroy(enumerator
);
358 if (!mobike
|| !mobike
->is_probing(mobike
))
360 if (this->initiating
.retransmitted
<= this->retransmit_tries
)
362 timeout
= (uint32_t)(this->retransmit_timeout
* 1000.0 *
363 pow(this->retransmit_base
, this->initiating
.retransmitted
));
365 if (this->retransmit_limit
)
367 timeout
= min(timeout
, this->retransmit_limit
);
369 if (this->retransmit_jitter
)
371 max_jitter
= (timeout
/ 100.0) * this->retransmit_jitter
;
372 timeout
-= max_jitter
* (random() / (RAND_MAX
+ 1.0));
377 DBG1(DBG_IKE
, "giving up after %d retransmits",
378 this->initiating
.retransmitted
- 1);
379 charon
->bus
->alert(charon
->bus
, ALERT_RETRANSMIT_SEND_TIMEOUT
,
384 if (this->initiating
.retransmitted
)
386 DBG1(DBG_IKE
, "retransmit %d of request with message ID %d",
387 this->initiating
.retransmitted
, message_id
);
388 charon
->bus
->alert(charon
->bus
, ALERT_RETRANSMIT_SEND
, packet
,
389 this->initiating
.retransmitted
);
393 send_packets(this, this->initiating
.packets
,
394 this->ike_sa
->get_my_host(this->ike_sa
),
395 this->ike_sa
->get_other_host(this->ike_sa
));
399 if (!mobike
->transmit(mobike
, packet
))
401 DBG1(DBG_IKE
, "no route found to reach peer, MOBIKE update "
403 this->ike_sa
->set_condition(this->ike_sa
, COND_STALE
, TRUE
);
404 this->initiating
.deferred
= TRUE
;
407 else if (mobike
->is_probing(mobike
))
409 timeout
= ROUTEABILITY_CHECK_INTERVAL
;
414 { /* for routeability checks, we use a more aggressive behavior */
415 if (this->initiating
.retransmitted
<= ROUTEABILITY_CHECK_TRIES
)
417 timeout
= ROUTEABILITY_CHECK_INTERVAL
;
421 DBG1(DBG_IKE
, "giving up after %d path probings",
422 this->initiating
.retransmitted
- 1);
426 if (this->initiating
.retransmitted
)
428 DBG1(DBG_IKE
, "path probing attempt %d",
429 this->initiating
.retransmitted
);
431 /* TODO-FRAG: presumably these small packets are not fragmented,
432 * we should maybe ensure this is the case when generating them */
433 if (!mobike
->transmit(mobike
, packet
))
435 DBG1(DBG_IKE
, "no route found to reach peer, path probing "
437 this->ike_sa
->set_condition(this->ike_sa
, COND_STALE
, TRUE
);
438 this->initiating
.deferred
= TRUE
;
443 this->initiating
.retransmitted
++;
444 job
= (job_t
*)retransmit_job_create(this->initiating
.mid
,
445 this->ike_sa
->get_id(this->ike_sa
));
446 lib
->scheduler
->schedule_job_ms(lib
->scheduler
, job
, timeout
);
451 METHOD(task_manager_t
, initiate
, status_t
,
452 private_task_manager_t
*this)
454 enumerator_t
*enumerator
;
458 exchange_type_t exchange
= 0;
460 if (this->initiating
.type
!= EXCHANGE_TYPE_UNDEFINED
)
462 DBG2(DBG_IKE
, "delaying task initiation, %N exchange in progress",
463 exchange_type_names
, this->initiating
.type
);
464 /* do not initiate if we already have a message in the air */
465 if (this->initiating
.deferred
)
466 { /* re-initiate deferred exchange */
467 this->initiating
.deferred
= FALSE
;
468 this->initiating
.retransmitted
= 0;
469 return retransmit(this, this->initiating
.mid
);
474 if (array_count(this->active_tasks
) == 0)
476 DBG2(DBG_IKE
, "activating new tasks");
477 switch (this->ike_sa
->get_state(this->ike_sa
))
480 activate_task(this, TASK_IKE_VENDOR
);
481 if (activate_task(this, TASK_IKE_INIT
))
483 this->initiating
.mid
= 0;
484 exchange
= IKE_SA_INIT
;
485 activate_task(this, TASK_IKE_NATD
);
486 activate_task(this, TASK_IKE_CERT_PRE
);
488 /* this task has to be activated before the TASK_IKE_AUTH
489 * task, because that task pregenerates the packet after
490 * which no payloads can be added to the message anymore.
492 activate_task(this, TASK_IKE_ME
);
494 activate_task(this, TASK_IKE_AUTH
);
495 activate_task(this, TASK_IKE_CERT_POST
);
496 activate_task(this, TASK_IKE_CONFIG
);
497 activate_task(this, TASK_CHILD_CREATE
);
498 activate_task(this, TASK_IKE_AUTH_LIFETIME
);
499 activate_task(this, TASK_IKE_MOBIKE
);
502 case IKE_ESTABLISHED
:
503 if (activate_task(this, TASK_IKE_MOBIKE
))
505 exchange
= INFORMATIONAL
;
508 if (activate_task(this, TASK_IKE_DELETE
))
510 exchange
= INFORMATIONAL
;
513 if (activate_task(this, TASK_IKE_REDIRECT
))
515 exchange
= INFORMATIONAL
;
518 if (activate_task(this, TASK_CHILD_DELETE
))
520 exchange
= INFORMATIONAL
;
523 if (activate_task(this, TASK_IKE_REAUTH
))
525 exchange
= INFORMATIONAL
;
528 if (activate_task(this, TASK_CHILD_CREATE
))
530 exchange
= CREATE_CHILD_SA
;
533 if (activate_task(this, TASK_CHILD_REKEY
))
535 exchange
= CREATE_CHILD_SA
;
538 if (activate_task(this, TASK_IKE_REKEY
))
540 exchange
= CREATE_CHILD_SA
;
543 if (activate_task(this, TASK_IKE_DPD
))
545 exchange
= INFORMATIONAL
;
548 if (activate_task(this, TASK_IKE_AUTH_LIFETIME
))
550 exchange
= INFORMATIONAL
;
554 if (activate_task(this, TASK_IKE_ME
))
556 exchange
= ME_CONNECT
;
560 if (activate_task(this, TASK_IKE_REAUTH_COMPLETE
))
562 exchange
= INFORMATIONAL
;
565 if (activate_task(this, TASK_IKE_VERIFY_PEER_CERT
))
567 exchange
= INFORMATIONAL
;
572 if (activate_task(this, TASK_IKE_DELETE
))
574 exchange
= INFORMATIONAL
;
584 DBG2(DBG_IKE
, "reinitiating already active tasks");
585 enumerator
= array_create_enumerator(this->active_tasks
);
586 while (enumerator
->enumerate(enumerator
, &task
))
588 DBG2(DBG_IKE
, " %N task", task_type_names
, task
->get_type(task
));
589 switch (task
->get_type(task
))
592 exchange
= IKE_SA_INIT
;
597 case TASK_CHILD_CREATE
:
598 case TASK_CHILD_REKEY
:
600 exchange
= CREATE_CHILD_SA
;
602 case TASK_IKE_MOBIKE
:
603 exchange
= INFORMATIONAL
;
610 enumerator
->destroy(enumerator
);
615 DBG2(DBG_IKE
, "nothing to initiate");
616 /* nothing to do yet... */
620 me
= this->ike_sa
->get_my_host(this->ike_sa
);
621 other
= this->ike_sa
->get_other_host(this->ike_sa
);
623 message
= message_create(IKEV2_MAJOR_VERSION
, IKEV2_MINOR_VERSION
);
624 message
->set_message_id(message
, this->initiating
.mid
);
625 message
->set_source(message
, me
->clone(me
));
626 message
->set_destination(message
, other
->clone(other
));
627 message
->set_exchange_type(message
, exchange
);
628 this->initiating
.type
= exchange
;
629 this->initiating
.retransmitted
= 0;
630 this->initiating
.deferred
= FALSE
;
632 enumerator
= array_create_enumerator(this->active_tasks
);
633 while (enumerator
->enumerate(enumerator
, &task
))
635 switch (task
->build(task
, message
))
638 /* task completed, remove it */
639 array_remove_at(this->active_tasks
, enumerator
);
643 /* processed, but task needs another exchange */
647 this->initiating
.type
= EXCHANGE_TYPE_UNDEFINED
;
648 if (this->ike_sa
->get_state(this->ike_sa
) != IKE_CONNECTING
&&
649 this->ike_sa
->get_state(this->ike_sa
) != IKE_REKEYED
)
651 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
655 /* critical failure, destroy IKE_SA */
656 enumerator
->destroy(enumerator
);
657 message
->destroy(message
);
662 enumerator
->destroy(enumerator
);
664 /* update exchange type if a task changed it */
665 this->initiating
.type
= message
->get_exchange_type(message
);
666 if (this->initiating
.type
== EXCHANGE_TYPE_UNDEFINED
)
668 message
->destroy(message
);
669 return initiate(this);
672 if (!generate_message(this, message
, &this->initiating
.packets
))
674 /* message generation failed. There is nothing more to do than to
676 message
->destroy(message
);
678 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
681 message
->destroy(message
);
683 array_compress(this->active_tasks
);
684 array_compress(this->queued_tasks
);
686 return retransmit(this, this->initiating
.mid
);
690 * handle an incoming response message
692 static status_t
process_response(private_task_manager_t
*this,
695 enumerator_t
*enumerator
;
698 if (message
->get_exchange_type(message
) != this->initiating
.type
)
700 DBG1(DBG_IKE
, "received %N response, but expected %N",
701 exchange_type_names
, message
->get_exchange_type(message
),
702 exchange_type_names
, this->initiating
.type
);
703 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
707 enumerator
= array_create_enumerator(this->active_tasks
);
708 while (enumerator
->enumerate(enumerator
, &task
))
710 if (!task
->pre_process
)
714 switch (task
->pre_process(task
, message
))
720 /* just ignore the message */
721 DBG1(DBG_IKE
, "ignore invalid %N response",
722 exchange_type_names
, message
->get_exchange_type(message
));
723 enumerator
->destroy(enumerator
);
726 /* critical failure, destroy IKE_SA */
727 enumerator
->destroy(enumerator
);
731 enumerator
->destroy(enumerator
);
733 if (this->initiating
.retransmitted
> 1)
735 packet_t
*packet
= NULL
;
736 array_get(this->initiating
.packets
, 0, &packet
);
737 charon
->bus
->alert(charon
->bus
, ALERT_RETRANSMIT_SEND_CLEARED
, packet
);
740 /* catch if we get resetted while processing */
742 enumerator
= array_create_enumerator(this->active_tasks
);
743 while (enumerator
->enumerate(enumerator
, &task
))
745 switch (task
->process(task
, message
))
748 /* task completed, remove it */
749 array_remove_at(this->active_tasks
, enumerator
);
753 /* processed, but task needs another exchange */
757 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
760 /* critical failure, destroy IKE_SA */
761 array_remove_at(this->active_tasks
, enumerator
);
762 enumerator
->destroy(enumerator
);
767 { /* start all over again if we were reset */
769 enumerator
->destroy(enumerator
);
770 return initiate(this);
773 enumerator
->destroy(enumerator
);
775 this->initiating
.mid
++;
776 this->initiating
.type
= EXCHANGE_TYPE_UNDEFINED
;
777 clear_packets(this->initiating
.packets
);
779 array_compress(this->active_tasks
);
781 return initiate(this);
785 * handle exchange collisions
787 static bool handle_collisions(private_task_manager_t
*this, task_t
*task
)
789 enumerator_t
*enumerator
;
793 type
= task
->get_type(task
);
795 /* do we have to check */
796 if (type
== TASK_IKE_REKEY
|| type
== TASK_CHILD_REKEY
||
797 type
== TASK_CHILD_DELETE
|| type
== TASK_IKE_DELETE
)
799 /* find an exchange collision, and notify these tasks */
800 enumerator
= array_create_enumerator(this->active_tasks
);
801 while (enumerator
->enumerate(enumerator
, &active
))
803 switch (active
->get_type(active
))
806 if (type
== TASK_IKE_REKEY
|| type
== TASK_IKE_DELETE
)
808 ike_rekey_t
*rekey
= (ike_rekey_t
*)active
;
809 rekey
->collide(rekey
, task
);
813 case TASK_CHILD_REKEY
:
814 if (type
== TASK_CHILD_REKEY
|| type
== TASK_CHILD_DELETE
)
816 child_rekey_t
*rekey
= (child_rekey_t
*)active
;
817 rekey
->collide(rekey
, task
);
824 enumerator
->destroy(enumerator
);
827 enumerator
->destroy(enumerator
);
833 * build a response depending on the "passive" task list
835 static status_t
build_response(private_task_manager_t
*this, message_t
*request
)
837 enumerator_t
*enumerator
;
841 bool delete = FALSE
, hook
= FALSE
, mid_sync
= FALSE
;
842 ike_sa_id_t
*id
= NULL
;
843 uint64_t responder_spi
= 0;
846 me
= request
->get_destination(request
);
847 other
= request
->get_source(request
);
849 message
= message_create(IKEV2_MAJOR_VERSION
, IKEV2_MINOR_VERSION
);
850 message
->set_exchange_type(message
, request
->get_exchange_type(request
));
851 /* send response along the path the request came in */
852 message
->set_source(message
, me
->clone(me
));
853 message
->set_destination(message
, other
->clone(other
));
854 message
->set_message_id(message
, this->responding
.mid
);
855 message
->set_request(message
, FALSE
);
857 enumerator
= array_create_enumerator(this->passive_tasks
);
858 while (enumerator
->enumerate(enumerator
, (void*)&task
))
860 if (task
->get_type(task
) == TASK_IKE_MID_SYNC
)
864 switch (task
->build(task
, message
))
867 /* task completed, remove it */
868 array_remove_at(this->passive_tasks
, enumerator
);
869 if (!handle_collisions(this, task
))
875 /* processed, but task needs another exchange */
876 if (handle_collisions(this, task
))
878 array_remove_at(this->passive_tasks
, enumerator
);
886 /* destroy IKE_SA, but SEND response first */
887 if (handle_collisions(this, task
))
889 array_remove_at(this->passive_tasks
, enumerator
);
899 enumerator
->destroy(enumerator
);
901 /* RFC 5996, section 2.6 mentions that in the event of a failure during
902 * IKE_SA_INIT the responder's SPI will be 0 in the response, while it
903 * actually explicitly allows it to be non-zero. Since we use the responder
904 * SPI to create hashes in the IKE_SA manager we can only set the SPI to
905 * zero temporarily, otherwise checking the SA in would fail. */
906 if (delete && request
->get_exchange_type(request
) == IKE_SA_INIT
)
908 id
= this->ike_sa
->get_id(this->ike_sa
);
909 responder_spi
= id
->get_responder_spi(id
);
910 id
->set_responder_spi(id
, 0);
913 /* message complete, send it */
914 clear_packets(this->responding
.packets
);
915 result
= generate_message(this, message
, &this->responding
.packets
);
916 message
->destroy(message
);
919 id
->set_responder_spi(id
, responder_spi
);
923 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
927 send_packets(this, this->responding
.packets
, NULL
, NULL
);
932 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
938 /* we don't want to resend messages to sync MIDs if requests with the
939 * previous MID arrive */
940 clear_packets(this->responding
.packets
);
941 /* avoid increasing the expected message ID after handling a message
942 * to sync MIDs with MID 0 */
946 array_compress(this->passive_tasks
);
952 * handle an incoming request message
954 static status_t
process_request(private_task_manager_t
*this,
957 enumerator_t
*enumerator
;
960 notify_payload_t
*notify
;
961 delete_payload_t
*delete;
962 ike_sa_state_t state
;
964 if (array_count(this->passive_tasks
) == 0)
965 { /* create tasks depending on request type, if not already some queued */
966 state
= this->ike_sa
->get_state(this->ike_sa
);
967 switch (message
->get_exchange_type(message
))
971 task
= (task_t
*)ike_vendor_create(this->ike_sa
, FALSE
);
972 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
973 task
= (task_t
*)ike_init_create(this->ike_sa
, FALSE
, NULL
);
974 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
975 task
= (task_t
*)ike_natd_create(this->ike_sa
, FALSE
);
976 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
977 task
= (task_t
*)ike_cert_pre_create(this->ike_sa
, FALSE
);
978 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
980 task
= (task_t
*)ike_me_create(this->ike_sa
, FALSE
);
981 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
983 task
= (task_t
*)ike_auth_create(this->ike_sa
, FALSE
);
984 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
985 task
= (task_t
*)ike_cert_post_create(this->ike_sa
, FALSE
);
986 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
987 task
= (task_t
*)ike_config_create(this->ike_sa
, FALSE
);
988 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
989 task
= (task_t
*)child_create_create(this->ike_sa
, NULL
, FALSE
,
991 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
992 task
= (task_t
*)ike_auth_lifetime_create(this->ike_sa
, FALSE
);
993 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
994 task
= (task_t
*)ike_mobike_create(this->ike_sa
, FALSE
);
995 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
998 case CREATE_CHILD_SA
:
999 { /* FIXME: we should prevent this on mediation connections */
1000 bool notify_found
= FALSE
, ts_found
= FALSE
;
1002 if (state
== IKE_CREATED
||
1003 state
== IKE_CONNECTING
)
1005 DBG1(DBG_IKE
, "received CREATE_CHILD_SA request for "
1006 "unestablished IKE_SA, rejected");
1010 enumerator
= message
->create_payload_enumerator(message
);
1011 while (enumerator
->enumerate(enumerator
, &payload
))
1013 switch (payload
->get_type(payload
))
1016 { /* if we find a rekey notify, its CHILD_SA rekeying */
1017 notify
= (notify_payload_t
*)payload
;
1018 if (notify
->get_notify_type(notify
) == REKEY_SA
&&
1019 (notify
->get_protocol_id(notify
) == PROTO_AH
||
1020 notify
->get_protocol_id(notify
) == PROTO_ESP
))
1022 notify_found
= TRUE
;
1026 case PLV2_TS_INITIATOR
:
1027 case PLV2_TS_RESPONDER
:
1028 { /* if we don't find a TS, its IKE rekeying */
1036 enumerator
->destroy(enumerator
);
1042 task
= (task_t
*)child_rekey_create(this->ike_sa
,
1047 task
= (task_t
*)child_create_create(this->ike_sa
, NULL
,
1053 task
= (task_t
*)ike_rekey_create(this->ike_sa
, FALSE
);
1055 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
1060 enumerator
= message
->create_payload_enumerator(message
);
1061 while (enumerator
->enumerate(enumerator
, &payload
))
1063 switch (payload
->get_type(payload
))
1067 notify
= (notify_payload_t
*)payload
;
1068 if (state
== IKE_REKEYED
)
1070 DBG1(DBG_IKE
, "received unexpected notify %N "
1071 "for rekeyed IKE_SA, ignored",
1073 notify
->get_notify_type(notify
));
1076 switch (notify
->get_notify_type(notify
))
1078 case ADDITIONAL_IP4_ADDRESS
:
1079 case ADDITIONAL_IP6_ADDRESS
:
1080 case NO_ADDITIONAL_ADDRESSES
:
1081 case UPDATE_SA_ADDRESSES
:
1082 case NO_NATS_ALLOWED
:
1083 case UNACCEPTABLE_ADDRESSES
:
1084 case UNEXPECTED_NAT_DETECTED
:
1086 case NAT_DETECTION_SOURCE_IP
:
1087 case NAT_DETECTION_DESTINATION_IP
:
1088 task
= (task_t
*)ike_mobike_create(
1089 this->ike_sa
, FALSE
);
1092 task
= (task_t
*)ike_auth_lifetime_create(
1093 this->ike_sa
, FALSE
);
1095 case AUTHENTICATION_FAILED
:
1096 /* initiator failed to authenticate us.
1097 * We use ike_delete to handle this, which
1098 * invokes all the required hooks. */
1099 task
= (task_t
*)ike_delete_create(
1100 this->ike_sa
, FALSE
);
1103 task
= (task_t
*)ike_redirect_create(
1104 this->ike_sa
, NULL
);
1106 case IKEV2_MESSAGE_ID_SYNC
:
1107 task
= (task_t
*)ike_mid_sync_create(
1117 delete = (delete_payload_t
*)payload
;
1118 if (delete->get_protocol_id(delete) == PROTO_IKE
)
1120 task
= (task_t
*)ike_delete_create(this->ike_sa
,
1125 task
= (task_t
*)child_delete_create(this->ike_sa
,
1126 PROTO_NONE
, 0, FALSE
);
1138 enumerator
->destroy(enumerator
);
1142 task
= (task_t
*)ike_dpd_create(FALSE
);
1144 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
1150 task
= (task_t
*)ike_me_create(this->ike_sa
, FALSE
);
1151 array_insert(this->passive_tasks
, ARRAY_TAIL
, task
);
1159 enumerator
= array_create_enumerator(this->passive_tasks
);
1160 while (enumerator
->enumerate(enumerator
, &task
))
1162 if (!task
->pre_process
)
1166 switch (task
->pre_process(task
, message
))
1172 /* just ignore the message */
1173 DBG1(DBG_IKE
, "ignore invalid %N request",
1174 exchange_type_names
, message
->get_exchange_type(message
));
1175 enumerator
->destroy(enumerator
);
1176 switch (message
->get_exchange_type(message
))
1179 /* no point in keeping the SA when it was created with
1180 * an invalid IKE_SA_INIT message */
1183 /* remove tasks we queued for this request */
1184 flush_queue(this, TASK_QUEUE_PASSIVE
);
1190 /* critical failure, destroy IKE_SA */
1191 enumerator
->destroy(enumerator
);
1195 enumerator
->destroy(enumerator
);
1197 /* let the tasks process the message */
1198 enumerator
= array_create_enumerator(this->passive_tasks
);
1199 while (enumerator
->enumerate(enumerator
, (void*)&task
))
1201 switch (task
->process(task
, message
))
1204 /* task completed, remove it */
1205 array_remove_at(this->passive_tasks
, enumerator
);
1206 task
->destroy(task
);
1209 /* processed, but task needs at least another call to build() */
1213 charon
->bus
->ike_updown(charon
->bus
, this->ike_sa
, FALSE
);
1216 /* critical failure, destroy IKE_SA */
1217 array_remove_at(this->passive_tasks
, enumerator
);
1218 enumerator
->destroy(enumerator
);
1219 task
->destroy(task
);
1223 enumerator
->destroy(enumerator
);
1225 return build_response(this, message
);
1228 METHOD(task_manager_t
, incr_mid
, void,
1229 private_task_manager_t
*this, bool initiate
)
1233 this->initiating
.mid
++;
1237 this->responding
.mid
++;
1241 METHOD(task_manager_t
, get_mid
, uint32_t,
1242 private_task_manager_t
*this, bool initiate
)
1244 return initiate
? this->initiating
.mid
: this->responding
.mid
;
1248 * Handle the given IKE fragment, if it is one.
1250 * Returns SUCCESS if the message is not a fragment, and NEED_MORE if it was
1251 * handled properly. Error states are returned if the fragment was invalid or
1252 * the reassembled message could not have been processed properly.
1254 static status_t
handle_fragment(private_task_manager_t
*this,
1255 message_t
**defrag
, message_t
*msg
)
1257 message_t
*reassembled
;
1260 if (!msg
->get_payload(msg
, PLV2_FRAGMENT
))
1266 *defrag
= message_create_defrag(msg
);
1272 status
= (*defrag
)->add_fragment(*defrag
, msg
);
1273 if (status
== SUCCESS
)
1275 /* reinject the reassembled message */
1276 reassembled
= *defrag
;
1278 status
= this->ike_sa
->process_message(this->ike_sa
, reassembled
);
1279 if (status
== SUCCESS
)
1281 /* avoid processing the last fragment */
1284 reassembled
->destroy(reassembled
);
1290 * Send a notify back to the sender
1292 static void send_notify_response(private_task_manager_t
*this,
1293 message_t
*request
, notify_type_t type
,
1296 message_t
*response
;
1300 response
= message_create(IKEV2_MAJOR_VERSION
, IKEV2_MINOR_VERSION
);
1301 response
->set_exchange_type(response
, request
->get_exchange_type(request
));
1302 response
->set_request(response
, FALSE
);
1303 response
->set_message_id(response
, request
->get_message_id(request
));
1304 response
->add_notify(response
, FALSE
, type
, data
);
1305 me
= this->ike_sa
->get_my_host(this->ike_sa
);
1306 if (me
->is_anyaddr(me
))
1308 me
= request
->get_destination(request
);
1309 this->ike_sa
->set_my_host(this->ike_sa
, me
->clone(me
));
1311 other
= this->ike_sa
->get_other_host(this->ike_sa
);
1312 if (other
->is_anyaddr(other
))
1314 other
= request
->get_source(request
);
1315 this->ike_sa
->set_other_host(this->ike_sa
, other
->clone(other
));
1317 response
->set_source(response
, me
->clone(me
));
1318 response
->set_destination(response
, other
->clone(other
));
1319 if (this->ike_sa
->generate_message(this->ike_sa
, response
,
1320 &packet
) == SUCCESS
)
1322 charon
->sender
->send(charon
->sender
, packet
);
1324 response
->destroy(response
);
1328 * Parse the given message and verify that it is valid.
1330 static status_t
parse_message(private_task_manager_t
*this, message_t
*msg
)
1335 status
= msg
->parse_body(msg
, this->ike_sa
->get_keymat(this->ike_sa
));
1337 if (status
== SUCCESS
)
1338 { /* check for unsupported critical payloads */
1339 enumerator_t
*enumerator
;
1340 unknown_payload_t
*unknown
;
1343 enumerator
= msg
->create_payload_enumerator(msg
);
1344 while (enumerator
->enumerate(enumerator
, &payload
))
1346 if (payload
->get_type(payload
) == PL_UNKNOWN
)
1348 unknown
= (unknown_payload_t
*)payload
;
1349 if (unknown
->is_critical(unknown
))
1351 type
= unknown
->get_type(unknown
);
1352 DBG1(DBG_ENC
, "payload type %N is not supported, "
1353 "but its critical!", payload_type_names
, type
);
1354 status
= NOT_SUPPORTED
;
1359 enumerator
->destroy(enumerator
);
1362 if (status
!= SUCCESS
)
1364 bool is_request
= msg
->get_request(msg
);
1369 DBG1(DBG_IKE
, "critical unknown payloads found");
1372 send_notify_response(this, msg
,
1373 UNSUPPORTED_CRITICAL_PAYLOAD
,
1374 chunk_from_thing(type
));
1375 incr_mid(this, FALSE
);
1379 DBG1(DBG_IKE
, "message parsing failed");
1382 send_notify_response(this, msg
,
1383 INVALID_SYNTAX
, chunk_empty
);
1384 incr_mid(this, FALSE
);
1388 DBG1(DBG_IKE
, "message verification failed");
1391 send_notify_response(this, msg
,
1392 INVALID_SYNTAX
, chunk_empty
);
1393 incr_mid(this, FALSE
);
1397 DBG1(DBG_IKE
, "integrity check failed");
1401 DBG1(DBG_IKE
, "found encrypted message, but no keys available");
1405 DBG1(DBG_IKE
, "%N %s with message ID %d processing failed",
1406 exchange_type_names
, msg
->get_exchange_type(msg
),
1407 is_request
? "request" : "response",
1408 msg
->get_message_id(msg
));
1410 charon
->bus
->alert(charon
->bus
, ALERT_PARSE_ERROR_BODY
, msg
, status
);
1412 if (this->ike_sa
->get_state(this->ike_sa
) == IKE_CREATED
)
1413 { /* invalid initiation attempt, close SA */
1421 * Check if a message with message ID 0 looks like it is used to synchronize
1424 static bool looks_like_mid_sync(private_task_manager_t
*this, message_t
*msg
,
1427 enumerator_t
*enumerator
;
1428 notify_payload_t
*notify
;
1430 bool found
= FALSE
, other
= FALSE
;
1432 if (msg
->get_exchange_type(msg
) == INFORMATIONAL
)
1434 enumerator
= msg
->create_payload_enumerator(msg
);
1435 while (enumerator
->enumerate(enumerator
, &payload
))
1437 if (payload
->get_type(payload
) == PLV2_NOTIFY
)
1439 notify
= (notify_payload_t
*)payload
;
1440 switch (notify
->get_notify_type(notify
))
1442 case IKEV2_MESSAGE_ID_SYNC
:
1443 case IPSEC_REPLAY_COUNTER_SYNC
:
1456 enumerator
->destroy(enumerator
);
1458 return found
&& !other
;
1462 * Check if a message with message ID 0 looks like it is used to synchronize
1463 * the message IDs and we are prepared to process it.
1465 * Note: This is not called if the responder never sent a message before (i.e.
1468 static bool is_mid_sync(private_task_manager_t
*this, message_t
*msg
)
1470 if (this->ike_sa
->get_state(this->ike_sa
) == IKE_ESTABLISHED
&&
1471 this->ike_sa
->supports_extension(this->ike_sa
,
1472 EXT_IKE_MESSAGE_ID_SYNC
))
1474 return looks_like_mid_sync(this, msg
, TRUE
);
1479 METHOD(task_manager_t
, process_message
, status_t
,
1480 private_task_manager_t
*this, message_t
*msg
)
1485 bool schedule_delete_job
= FALSE
;
1486 ike_sa_state_t state
;
1487 exchange_type_t type
;
1489 charon
->bus
->message(charon
->bus
, msg
, TRUE
, FALSE
);
1490 status
= parse_message(this, msg
);
1491 if (status
!= SUCCESS
)
1496 me
= msg
->get_destination(msg
);
1497 other
= msg
->get_source(msg
);
1499 /* if this IKE_SA is virgin, we check for a config */
1500 if (this->ike_sa
->get_ike_cfg(this->ike_sa
) == NULL
)
1504 ike_cfg
= charon
->backends
->get_ike_cfg(charon
->backends
,
1506 if (ike_cfg
== NULL
)
1508 /* no config found for these hosts, destroy */
1509 DBG1(DBG_IKE
, "no IKE config found for %H...%H, sending %N",
1510 me
, other
, notify_type_names
, NO_PROPOSAL_CHOSEN
);
1511 send_notify_response(this, msg
,
1512 NO_PROPOSAL_CHOSEN
, chunk_empty
);
1515 this->ike_sa
->set_ike_cfg(this->ike_sa
, ike_cfg
);
1516 ike_cfg
->destroy(ike_cfg
);
1517 /* add a timeout if peer does not establish it completely */
1518 schedule_delete_job
= TRUE
;
1520 this->ike_sa
->set_statistic(this->ike_sa
, STAT_INBOUND
,
1521 time_monotonic(NULL
));
1523 mid
= msg
->get_message_id(msg
);
1524 if (msg
->get_request(msg
))
1526 if (mid
== this->responding
.mid
|| (mid
== 0 && is_mid_sync(this, msg
)))
1528 /* reject initial messages if not received in specific states,
1529 * after rekeying we only expect a DELETE in an INFORMATIONAL */
1530 type
= msg
->get_exchange_type(msg
);
1531 state
= this->ike_sa
->get_state(this->ike_sa
);
1532 if ((type
== IKE_SA_INIT
&& state
!= IKE_CREATED
) ||
1533 (type
== IKE_AUTH
&& state
!= IKE_CONNECTING
) ||
1534 (state
== IKE_REKEYED
&& type
!= INFORMATIONAL
))
1536 DBG1(DBG_IKE
, "ignoring %N in IKE_SA state %N",
1537 exchange_type_names
, type
, ike_sa_state_names
, state
);
1540 if (!this->ike_sa
->supports_extension(this->ike_sa
, EXT_MOBIKE
))
1541 { /* with MOBIKE, we do no implicit updates */
1542 this->ike_sa
->update_hosts(this->ike_sa
, me
, other
, mid
== 1);
1544 status
= handle_fragment(this, &this->responding
.defrag
, msg
);
1545 if (status
!= SUCCESS
)
1549 charon
->bus
->message(charon
->bus
, msg
, TRUE
, TRUE
);
1550 if (msg
->get_exchange_type(msg
) == EXCHANGE_TYPE_UNDEFINED
)
1551 { /* ignore messages altered to EXCHANGE_TYPE_UNDEFINED */
1554 switch (process_request(this, msg
))
1557 this->responding
.mid
++;
1566 else if ((mid
== this->responding
.mid
- 1) &&
1567 array_count(this->responding
.packets
) &&
1568 !(mid
== 0 && looks_like_mid_sync(this, msg
, FALSE
)))
1570 status
= handle_fragment(this, &this->responding
.defrag
, msg
);
1571 if (status
!= SUCCESS
)
1575 DBG1(DBG_IKE
, "received retransmit of request with ID %d, "
1576 "retransmitting response", mid
);
1577 charon
->bus
->alert(charon
->bus
, ALERT_RETRANSMIT_RECEIVE
, msg
);
1578 send_packets(this, this->responding
.packets
,
1579 msg
->get_destination(msg
), msg
->get_source(msg
));
1583 DBG1(DBG_IKE
, "received message ID %d, expected %d, ignored",
1584 mid
, this->responding
.mid
);
1589 if (mid
== this->initiating
.mid
)
1591 if (this->ike_sa
->get_state(this->ike_sa
) == IKE_CREATED
||
1592 this->ike_sa
->get_state(this->ike_sa
) == IKE_CONNECTING
||
1593 msg
->get_exchange_type(msg
) != IKE_SA_INIT
)
1594 { /* only do updates based on verified messages (or initial ones) */
1595 if (!this->ike_sa
->supports_extension(this->ike_sa
, EXT_MOBIKE
))
1596 { /* with MOBIKE, we do no implicit updates. we force an
1597 * update of the local address on IKE_SA_INIT, but never
1598 * for the remote address */
1599 this->ike_sa
->update_hosts(this->ike_sa
, me
, NULL
, mid
== 0);
1600 this->ike_sa
->update_hosts(this->ike_sa
, NULL
, other
, FALSE
);
1603 status
= handle_fragment(this, &this->initiating
.defrag
, msg
);
1604 if (status
!= SUCCESS
)
1608 charon
->bus
->message(charon
->bus
, msg
, TRUE
, TRUE
);
1609 if (msg
->get_exchange_type(msg
) == EXCHANGE_TYPE_UNDEFINED
)
1610 { /* ignore messages altered to EXCHANGE_TYPE_UNDEFINED */
1613 if (process_response(this, msg
) != SUCCESS
)
1621 DBG1(DBG_IKE
, "received message ID %d, expected %d, ignored",
1622 mid
, this->initiating
.mid
);
1627 if (schedule_delete_job
)
1629 ike_sa_id_t
*ike_sa_id
;
1632 ike_sa_id
= this->ike_sa
->get_id(this->ike_sa
);
1633 job
= (job_t
*)delete_ike_sa_job_create(ike_sa_id
, FALSE
);
1634 lib
->scheduler
->schedule_job(lib
->scheduler
, job
,
1635 lib
->settings
->get_int(lib
->settings
,
1636 "%s.half_open_timeout", HALF_OPEN_IKE_SA_TIMEOUT
,
1642 METHOD(task_manager_t
, queue_task_delayed
, void,
1643 private_task_manager_t
*this, task_t
*task
, uint32_t delay
)
1645 queued_task_t
*queued
;
1648 time_monotonic(&time
);
1653 DBG2(DBG_IKE
, "queueing %N task (delayed by %us)", task_type_names
,
1654 task
->get_type(task
), delay
);
1655 time
.tv_sec
+= delay
;
1657 job
= (job_t
*)initiate_tasks_job_create(
1658 this->ike_sa
->get_id(this->ike_sa
));
1659 lib
->scheduler
->schedule_job_tv(lib
->scheduler
, job
, time
);
1663 DBG2(DBG_IKE
, "queueing %N task", task_type_names
,
1664 task
->get_type(task
));
1670 array_insert(this->queued_tasks
, ARRAY_TAIL
, queued
);
1673 METHOD(task_manager_t
, queue_task
, void,
1674 private_task_manager_t
*this, task_t
*task
)
1676 queue_task_delayed(this, task
, 0);
1680 * Check if a given task has been queued already
1682 static bool has_queued(private_task_manager_t
*this, task_type_t type
)
1684 enumerator_t
*enumerator
;
1686 queued_task_t
*queued
;
1688 enumerator
= array_create_enumerator(this->queued_tasks
);
1689 while (enumerator
->enumerate(enumerator
, &queued
))
1691 if (queued
->task
->get_type(queued
->task
) == type
)
1697 enumerator
->destroy(enumerator
);
1701 METHOD(task_manager_t
, queue_ike
, void,
1702 private_task_manager_t
*this)
1704 if (!has_queued(this, TASK_IKE_VENDOR
))
1706 queue_task(this, (task_t
*)ike_vendor_create(this->ike_sa
, TRUE
));
1708 if (!has_queued(this, TASK_IKE_INIT
))
1710 queue_task(this, (task_t
*)ike_init_create(this->ike_sa
, TRUE
, NULL
));
1712 if (!has_queued(this, TASK_IKE_NATD
))
1714 queue_task(this, (task_t
*)ike_natd_create(this->ike_sa
, TRUE
));
1716 if (!has_queued(this, TASK_IKE_CERT_PRE
))
1718 queue_task(this, (task_t
*)ike_cert_pre_create(this->ike_sa
, TRUE
));
1720 if (!has_queued(this, TASK_IKE_AUTH
))
1722 queue_task(this, (task_t
*)ike_auth_create(this->ike_sa
, TRUE
));
1724 if (!has_queued(this, TASK_IKE_CERT_POST
))
1726 queue_task(this, (task_t
*)ike_cert_post_create(this->ike_sa
, TRUE
));
1728 if (!has_queued(this, TASK_IKE_CONFIG
))
1730 queue_task(this, (task_t
*)ike_config_create(this->ike_sa
, TRUE
));
1732 if (!has_queued(this, TASK_IKE_AUTH_LIFETIME
))
1734 queue_task(this, (task_t
*)ike_auth_lifetime_create(this->ike_sa
, TRUE
));
1736 if (!has_queued(this, TASK_IKE_MOBIKE
))
1738 peer_cfg_t
*peer_cfg
;
1740 peer_cfg
= this->ike_sa
->get_peer_cfg(this->ike_sa
);
1741 if (peer_cfg
->use_mobike(peer_cfg
))
1743 queue_task(this, (task_t
*)ike_mobike_create(this->ike_sa
, TRUE
));
1747 if (!has_queued(this, TASK_IKE_ME
))
1749 queue_task(this, (task_t
*)ike_me_create(this->ike_sa
, TRUE
));
1754 METHOD(task_manager_t
, queue_ike_rekey
, void,
1755 private_task_manager_t
*this)
1757 queue_task(this, (task_t
*)ike_rekey_create(this->ike_sa
, TRUE
));
1761 * Start reauthentication using make-before-break
1763 static void trigger_mbb_reauth(private_task_manager_t
*this)
1765 enumerator_t
*enumerator
;
1766 child_sa_t
*child_sa
;
1771 queued_task_t
*queued
;
1772 bool children
= FALSE
;
1774 new = charon
->ike_sa_manager
->checkout_new(charon
->ike_sa_manager
,
1775 this->ike_sa
->get_version(this->ike_sa
), TRUE
);
1777 { /* shouldn't happen */
1781 peer
= this->ike_sa
->get_peer_cfg(this->ike_sa
);
1782 new->set_peer_cfg(new, peer
);
1783 host
= this->ike_sa
->get_other_host(this->ike_sa
);
1784 new->set_other_host(new, host
->clone(host
));
1785 host
= this->ike_sa
->get_my_host(this->ike_sa
);
1786 new->set_my_host(new, host
->clone(host
));
1787 enumerator
= this->ike_sa
->create_virtual_ip_enumerator(this->ike_sa
, TRUE
);
1788 while (enumerator
->enumerate(enumerator
, &host
))
1790 new->add_virtual_ip(new, TRUE
, host
);
1792 enumerator
->destroy(enumerator
);
1794 enumerator
= this->ike_sa
->create_child_sa_enumerator(this->ike_sa
);
1795 while (enumerator
->enumerate(enumerator
, &child_sa
))
1797 cfg
= child_sa
->get_config(child_sa
);
1798 new->queue_task(new, &child_create_create(new, cfg
->get_ref(cfg
),
1799 FALSE
, NULL
, NULL
)->task
);
1802 enumerator
->destroy(enumerator
);
1804 enumerator
= array_create_enumerator(this->queued_tasks
);
1805 while (enumerator
->enumerate(enumerator
, &queued
))
1807 if (queued
->task
->get_type(queued
->task
) == TASK_CHILD_CREATE
)
1809 queued
->task
->migrate(queued
->task
, new);
1810 new->queue_task(new, queued
->task
);
1811 array_remove_at(this->queued_tasks
, enumerator
);
1816 enumerator
->destroy(enumerator
);
1820 /* allow reauth of mediation connections without CHILD_SAs */
1821 && !peer
->is_mediation(peer
)
1825 charon
->ike_sa_manager
->checkin_and_destroy(charon
->ike_sa_manager
, new);
1826 DBG1(DBG_IKE
, "unable to reauthenticate IKE_SA, no CHILD_SA "
1831 /* suspend online revocation checking until the SA is established */
1832 new->set_condition(new, COND_ONLINE_VALIDATION_SUSPENDED
, TRUE
);
1834 if (new->initiate(new, NULL
, 0, NULL
, NULL
) != DESTROY_ME
)
1836 new->queue_task(new, (task_t
*)ike_verify_peer_cert_create(new));
1837 new->queue_task(new, (task_t
*)ike_reauth_complete_create(new,
1838 this->ike_sa
->get_id(this->ike_sa
)));
1839 charon
->ike_sa_manager
->checkin(charon
->ike_sa_manager
, new);
1843 charon
->ike_sa_manager
->checkin_and_destroy(charon
->ike_sa_manager
, new);
1844 DBG1(DBG_IKE
, "reauthenticating IKE_SA failed");
1846 charon
->bus
->set_sa(charon
->bus
, this->ike_sa
);
1849 METHOD(task_manager_t
, queue_ike_reauth
, void,
1850 private_task_manager_t
*this)
1852 if (this->make_before_break
)
1854 return trigger_mbb_reauth(this);
1856 queue_task(this, (task_t
*)ike_reauth_create(this->ike_sa
));
1859 METHOD(task_manager_t
, queue_ike_delete
, void,
1860 private_task_manager_t
*this)
1862 queue_task(this, (task_t
*)ike_delete_create(this->ike_sa
, TRUE
));
1866 * There is no need to queue more than one mobike task, so this either returns
1867 * an already queued task or queues one if there is none yet.
1869 static ike_mobike_t
*queue_mobike_task(private_task_manager_t
*this)
1871 enumerator_t
*enumerator
;
1872 queued_task_t
*queued
;
1873 ike_mobike_t
*mobike
= NULL
;
1875 enumerator
= array_create_enumerator(this->queued_tasks
);
1876 while (enumerator
->enumerate(enumerator
, &queued
))
1878 if (queued
->task
->get_type(queued
->task
) == TASK_IKE_MOBIKE
)
1880 mobike
= (ike_mobike_t
*)queued
->task
;
1884 enumerator
->destroy(enumerator
);
1888 mobike
= ike_mobike_create(this->ike_sa
, TRUE
);
1889 queue_task(this, &mobike
->task
);
1894 METHOD(task_manager_t
, queue_mobike
, void,
1895 private_task_manager_t
*this, bool roam
, bool address
)
1897 ike_mobike_t
*mobike
;
1899 mobike
= queue_mobike_task(this);
1902 enumerator_t
*enumerator
;
1905 mobike
->roam(mobike
, address
);
1907 /* enable path probing for a currently active MOBIKE task. This might
1908 * not be the case if an address appeared on a new interface while the
1909 * current address is not working but has not yet disappeared. */
1910 enumerator
= array_create_enumerator(this->active_tasks
);
1911 while (enumerator
->enumerate(enumerator
, ¤t
))
1913 if (current
->get_type(current
) == TASK_IKE_MOBIKE
)
1915 ike_mobike_t
*active
= (ike_mobike_t
*)current
;
1916 active
->enable_probing(active
);
1920 enumerator
->destroy(enumerator
);
1924 mobike
->addresses(mobike
);
1928 METHOD(task_manager_t
, queue_dpd
, void,
1929 private_task_manager_t
*this)
1931 ike_mobike_t
*mobike
;
1933 if (this->ike_sa
->supports_extension(this->ike_sa
, EXT_MOBIKE
) &&
1934 this->ike_sa
->has_condition(this->ike_sa
, COND_NAT_HERE
))
1937 peer_cfg_t
*cfg
= this->ike_sa
->get_peer_cfg(this->ike_sa
);
1938 if (cfg
->get_peer_id(cfg
) ||
1939 this->ike_sa
->has_condition(this->ike_sa
, COND_ORIGINAL_INITIATOR
))
1941 if (this->ike_sa
->has_condition(this->ike_sa
, COND_ORIGINAL_INITIATOR
))
1944 /* use mobike enabled DPD to detect NAT mapping changes */
1945 mobike
= queue_mobike_task(this);
1946 mobike
->dpd(mobike
);
1950 queue_task(this, (task_t
*)ike_dpd_create(TRUE
));
1953 METHOD(task_manager_t
, queue_child
, void,
1954 private_task_manager_t
*this, child_cfg_t
*cfg
, uint32_t reqid
,
1955 traffic_selector_t
*tsi
, traffic_selector_t
*tsr
)
1957 child_create_t
*task
;
1959 task
= child_create_create(this->ike_sa
, cfg
, FALSE
, tsi
, tsr
);
1962 task
->use_reqid(task
, reqid
);
1964 queue_task(this, &task
->task
);
1967 METHOD(task_manager_t
, queue_child_rekey
, void,
1968 private_task_manager_t
*this, protocol_id_t protocol
, uint32_t spi
)
1970 queue_task(this, (task_t
*)child_rekey_create(this->ike_sa
, protocol
, spi
));
1973 METHOD(task_manager_t
, queue_child_delete
, void,
1974 private_task_manager_t
*this, protocol_id_t protocol
, uint32_t spi
,
1977 queue_task(this, (task_t
*)child_delete_create(this->ike_sa
,
1978 protocol
, spi
, expired
));
1981 METHOD(task_manager_t
, adopt_tasks
, void,
1982 private_task_manager_t
*this, task_manager_t
*other_public
)
1984 private_task_manager_t
*other
= (private_task_manager_t
*)other_public
;
1985 queued_task_t
*queued
;
1988 time_monotonic(&now
);
1990 /* move queued tasks from other to this */
1991 while (array_remove(other
->queued_tasks
, ARRAY_TAIL
, &queued
))
1993 DBG2(DBG_IKE
, "migrating %N task", task_type_names
,
1994 queued
->task
->get_type(queued
->task
));
1995 queued
->task
->migrate(queued
->task
, this->ike_sa
);
1996 /* don't delay tasks on the new IKE_SA */
1998 array_insert(this->queued_tasks
, ARRAY_HEAD
, queued
);
2003 * Migrates child-creating tasks from other to this
2005 static void migrate_child_tasks(private_task_manager_t
*this,
2006 private_task_manager_t
*other
,
2009 enumerator_t
*enumerator
;
2015 case TASK_QUEUE_ACTIVE
:
2016 array
= other
->active_tasks
;
2018 case TASK_QUEUE_QUEUED
:
2019 array
= other
->queued_tasks
;
2025 enumerator
= array_create_enumerator(array
);
2026 while (enumerator
->enumerate(enumerator
, &task
))
2028 queued_task_t
*queued
= NULL
;
2030 if (queue
== TASK_QUEUE_QUEUED
)
2032 queued
= (queued_task_t
*)task
;
2033 task
= queued
->task
;
2035 if (task
->get_type(task
) == TASK_CHILD_CREATE
)
2037 array_remove_at(array
, enumerator
);
2038 task
->migrate(task
, this->ike_sa
);
2039 queue_task(this, task
);
2043 enumerator
->destroy(enumerator
);
2046 METHOD(task_manager_t
, adopt_child_tasks
, void,
2047 private_task_manager_t
*this, task_manager_t
*other_public
)
2049 private_task_manager_t
*other
= (private_task_manager_t
*)other_public
;
2051 /* move active child tasks from other to this */
2052 migrate_child_tasks(this, other
, TASK_QUEUE_ACTIVE
);
2053 /* do the same for queued tasks */
2054 migrate_child_tasks(this, other
, TASK_QUEUE_QUEUED
);
2057 METHOD(task_manager_t
, busy
, bool,
2058 private_task_manager_t
*this)
2060 return array_count(this->active_tasks
) > 0;
2063 METHOD(task_manager_t
, reset
, void,
2064 private_task_manager_t
*this, uint32_t initiate
, uint32_t respond
)
2066 enumerator_t
*enumerator
;
2067 queued_task_t
*queued
;
2071 /* reset message counters and retransmit packets */
2072 clear_packets(this->responding
.packets
);
2073 clear_packets(this->initiating
.packets
);
2074 DESTROY_IF(this->responding
.defrag
);
2075 DESTROY_IF(this->initiating
.defrag
);
2076 this->responding
.defrag
= NULL
;
2077 this->initiating
.defrag
= NULL
;
2078 if (initiate
!= UINT_MAX
)
2080 this->initiating
.mid
= initiate
;
2082 if (respond
!= UINT_MAX
)
2084 this->responding
.mid
= respond
;
2086 this->initiating
.type
= EXCHANGE_TYPE_UNDEFINED
;
2088 time_monotonic(&now
);
2089 /* reset queued tasks */
2090 enumerator
= array_create_enumerator(this->queued_tasks
);
2091 while (enumerator
->enumerate(enumerator
, &queued
))
2094 queued
->task
->migrate(queued
->task
, this->ike_sa
);
2096 enumerator
->destroy(enumerator
);
2098 /* reset active tasks */
2099 while (array_remove(this->active_tasks
, ARRAY_TAIL
, &task
))
2101 task
->migrate(task
, this->ike_sa
);
2106 array_insert(this->queued_tasks
, ARRAY_HEAD
, queued
);
2112 CALLBACK(filter_queued
, bool,
2113 void *unused
, enumerator_t
*orig
, va_list args
)
2115 queued_task_t
*queued
;
2118 VA_ARGS_VGET(args
, task
);
2120 if (orig
->enumerate(orig
, &queued
))
2122 *task
= queued
->task
;
2128 METHOD(task_manager_t
, create_task_enumerator
, enumerator_t
*,
2129 private_task_manager_t
*this, task_queue_t queue
)
2133 case TASK_QUEUE_ACTIVE
:
2134 return array_create_enumerator(this->active_tasks
);
2135 case TASK_QUEUE_PASSIVE
:
2136 return array_create_enumerator(this->passive_tasks
);
2137 case TASK_QUEUE_QUEUED
:
2138 return enumerator_create_filter(
2139 array_create_enumerator(this->queued_tasks
),
2140 filter_queued
, NULL
, NULL
);
2142 return enumerator_create_empty();
2146 METHOD(task_manager_t
, destroy
, void,
2147 private_task_manager_t
*this)
2151 array_destroy(this->active_tasks
);
2152 array_destroy(this->queued_tasks
);
2153 array_destroy(this->passive_tasks
);
2155 clear_packets(this->responding
.packets
);
2156 array_destroy(this->responding
.packets
);
2157 clear_packets(this->initiating
.packets
);
2158 array_destroy(this->initiating
.packets
);
2159 DESTROY_IF(this->responding
.defrag
);
2160 DESTROY_IF(this->initiating
.defrag
);
2167 task_manager_v2_t
*task_manager_v2_create(ike_sa_t
*ike_sa
)
2169 private_task_manager_t
*this;
2174 .process_message
= _process_message
,
2175 .queue_task
= _queue_task
,
2176 .queue_task_delayed
= _queue_task_delayed
,
2177 .queue_ike
= _queue_ike
,
2178 .queue_ike_rekey
= _queue_ike_rekey
,
2179 .queue_ike_reauth
= _queue_ike_reauth
,
2180 .queue_ike_delete
= _queue_ike_delete
,
2181 .queue_mobike
= _queue_mobike
,
2182 .queue_child
= _queue_child
,
2183 .queue_child_rekey
= _queue_child_rekey
,
2184 .queue_child_delete
= _queue_child_delete
,
2185 .queue_dpd
= _queue_dpd
,
2186 .initiate
= _initiate
,
2187 .retransmit
= _retransmit
,
2188 .incr_mid
= _incr_mid
,
2189 .get_mid
= _get_mid
,
2191 .adopt_tasks
= _adopt_tasks
,
2192 .adopt_child_tasks
= _adopt_child_tasks
,
2194 .create_task_enumerator
= _create_task_enumerator
,
2196 .flush_queue
= _flush_queue
,
2197 .destroy
= _destroy
,
2201 .initiating
.type
= EXCHANGE_TYPE_UNDEFINED
,
2202 .queued_tasks
= array_create(0, 0),
2203 .active_tasks
= array_create(0, 0),
2204 .passive_tasks
= array_create(0, 0),
2205 .retransmit_tries
= lib
->settings
->get_int(lib
->settings
,
2206 "%s.retransmit_tries", RETRANSMIT_TRIES
, lib
->ns
),
2207 .retransmit_timeout
= lib
->settings
->get_double(lib
->settings
,
2208 "%s.retransmit_timeout", RETRANSMIT_TIMEOUT
, lib
->ns
),
2209 .retransmit_base
= lib
->settings
->get_double(lib
->settings
,
2210 "%s.retransmit_base", RETRANSMIT_BASE
, lib
->ns
),
2211 .retransmit_jitter
= min(lib
->settings
->get_int(lib
->settings
,
2212 "%s.retransmit_jitter", 0, lib
->ns
), RETRANSMIT_JITTER_MAX
),
2213 .retransmit_limit
= lib
->settings
->get_int(lib
->settings
,
2214 "%s.retransmit_limit", 0, lib
->ns
) * 1000,
2215 .make_before_break
= lib
->settings
->get_bool(lib
->settings
,
2216 "%s.make_before_break", FALSE
, lib
->ns
),
2219 return &this->public;