From b0b0c9137d7bfd7afe54f64e49bc45d317a8e101 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 28 Sep 2015 17:30:36 +0200 Subject: [PATCH 1/5] ikev1: Drop TRANSACTION/QUICK_MODE requests until we received the last AM message --- src/libcharon/sa/ikev1/task_manager_v1.c | 32 ++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c index e1747d2c6..1a6f868dd 100644 --- a/src/libcharon/sa/ikev1/task_manager_v1.c +++ b/src/libcharon/sa/ikev1/task_manager_v1.c @@ -934,6 +934,28 @@ static bool have_quick_mode_task(private_task_manager_t *this, u_int32_t mid) return found; } +/** + * Check if we still have an aggressive mode task queued + */ +static bool have_aggressive_mode_task(private_task_manager_t *this) +{ + enumerator_t *enumerator; + task_t *task; + bool found = FALSE; + + enumerator = this->passive_tasks->create_enumerator(this->passive_tasks); + while (enumerator->enumerate(enumerator, &task)) + { + if (task->get_type(task) == TASK_AGGRESSIVE_MODE) + { + found = TRUE; + break; + } + } + enumerator->destroy(enumerator); + return found; +} + /** * handle an incoming request message */ @@ -1340,6 +1362,16 @@ METHOD(task_manager_t, process_message, status_t, } } + /* drop XAuth/Mode Config/Quick Mode messages until we received the last + * Aggressive Mode message */ + if (have_aggressive_mode_task(this) && + msg->get_exchange_type(msg) != AGGRESSIVE) + { + DBG1(DBG_IKE, "ignoring %N request while phase 1 is incomplete", + exchange_type_names, msg->get_exchange_type(msg)); + return FAILED; + } + if (msg->get_exchange_type(msg) == TRANSACTION && this->active_tasks->get_count(this->active_tasks)) { /* main mode not yet complete, queue XAuth/Mode config tasks */ From 3f56f73159d1e53004358f3f02d1a0c2fd67839f Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 28 Sep 2015 17:33:46 +0200 Subject: [PATCH 2/5] ikev1: Extract queueing of TRANSACTIONAL requests when MM is not complete yet --- src/libcharon/sa/ikev1/task_manager_v1.c | 44 +++++++++++++++--------- 1 file changed, 27 insertions(+), 17 deletions(-) diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c index 1a6f868dd..0b329e03a 100644 --- a/src/libcharon/sa/ikev1/task_manager_v1.c +++ b/src/libcharon/sa/ikev1/task_manager_v1.c @@ -1262,6 +1262,29 @@ static status_t parse_message(private_task_manager_t *this, message_t *msg) return status; } +/** + * Queue the given message if possible + */ +static status_t queue_message(private_task_manager_t *this, message_t *msg) +{ + if (this->queued) + { + DBG1(DBG_IKE, "ignoring %N request, queue full", + exchange_type_names, msg->get_exchange_type(msg)); + return FAILED; + } + this->queued = message_create_from_packet(msg->get_packet(msg)); + if (this->queued->parse_header(this->queued) != SUCCESS) + { + this->queued->destroy(this->queued); + this->queued = NULL; + return FAILED; + } + DBG1(DBG_IKE, "queueing %N request as tasks still active", + exchange_type_names, msg->get_exchange_type(msg)); + return SUCCESS; +} + METHOD(task_manager_t, process_message, status_t, private_task_manager_t *this, message_t *msg) { @@ -1372,25 +1395,12 @@ METHOD(task_manager_t, process_message, status_t, return FAILED; } + /* queue XAuth/Mode Config messages unless the Main Mode exchange we + * initiated is complete */ if (msg->get_exchange_type(msg) == TRANSACTION && this->active_tasks->get_count(this->active_tasks)) - { /* main mode not yet complete, queue XAuth/Mode config tasks */ - if (this->queued) - { - DBG1(DBG_IKE, "ignoring additional %N request, queue full", - exchange_type_names, TRANSACTION); - return SUCCESS; - } - this->queued = message_create_from_packet(msg->get_packet(msg)); - if (this->queued->parse_header(this->queued) != SUCCESS) - { - this->queued->destroy(this->queued); - this->queued = NULL; - return FAILED; - } - DBG1(DBG_IKE, "queueing %N request as tasks still active", - exchange_type_names, TRANSACTION); - return SUCCESS; + { + return queue_message(this, msg); } msg->set_request(msg, TRUE); From 3805880c8aa015b3cdbfcdac82dd4b9049317e9b Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 28 Sep 2015 17:35:30 +0200 Subject: [PATCH 3/5] ikev1: Handle queued TRANSACTION messages only after processing replies --- src/libcharon/sa/ikev1/task_manager_v1.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c index 0b329e03a..a027b749e 100644 --- a/src/libcharon/sa/ikev1/task_manager_v1.c +++ b/src/libcharon/sa/ikev1/task_manager_v1.c @@ -1167,7 +1167,8 @@ static status_t process_response(private_task_manager_t *this, this->initiating.type = EXCHANGE_TYPE_UNDEFINED; clear_packets(this->initiating.packets); - if (this->queued && this->active_tasks->get_count(this->active_tasks) == 0) + if (this->queued && !this->active_tasks->get_count(this->active_tasks) && + this->queued->get_exchange_type(this->queued) == TRANSACTION) { queued = this->queued; this->queued = NULL; From 1c8dfa30d01875f1df43aff6db75f3e188829b4f Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 28 Sep 2015 17:37:42 +0200 Subject: [PATCH 4/5] ikev1: Queue INFORMATIONAL request if AM is not complete yet --- src/libcharon/sa/ikev1/task_manager_v1.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c index a027b749e..5b0438ffa 100644 --- a/src/libcharon/sa/ikev1/task_manager_v1.c +++ b/src/libcharon/sa/ikev1/task_manager_v1.c @@ -1387,13 +1387,20 @@ METHOD(task_manager_t, process_message, status_t, } /* drop XAuth/Mode Config/Quick Mode messages until we received the last - * Aggressive Mode message */ - if (have_aggressive_mode_task(this) && - msg->get_exchange_type(msg) != AGGRESSIVE) + * Aggressive Mode message. since Informational messages are not + * retransmitted we queue them. */ + if (have_aggressive_mode_task(this)) { - DBG1(DBG_IKE, "ignoring %N request while phase 1 is incomplete", - exchange_type_names, msg->get_exchange_type(msg)); - return FAILED; + if (msg->get_exchange_type(msg) == INFORMATIONAL_V1) + { + return queue_message(this, msg); + } + else if (msg->get_exchange_type(msg) != AGGRESSIVE) + { + DBG1(DBG_IKE, "ignoring %N request while phase 1 is incomplete", + exchange_type_names, msg->get_exchange_type(msg)); + return FAILED; + } } /* queue XAuth/Mode Config messages unless the Main Mode exchange we From 25863fe1c7570a5abb833dc35c9d2c2a71a2bce7 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 28 Sep 2015 17:39:54 +0200 Subject: [PATCH 5/5] ikev1: Handle queued INFORMATIONAL message after receiving the last AM request --- src/libcharon/sa/ikev1/task_manager_v1.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c index 5b0438ffa..a839f51e7 100644 --- a/src/libcharon/sa/ikev1/task_manager_v1.c +++ b/src/libcharon/sa/ikev1/task_manager_v1.c @@ -1095,6 +1095,22 @@ static status_t process_request(private_task_manager_t *this, * the same message again. */ clear_packets(this->responding.packets); } + if (this->queued && + this->queued->get_exchange_type(this->queued) == INFORMATIONAL_V1) + { + message_t *queued; + status_t status; + + queued = this->queued; + this->queued = NULL; + status = this->public.task_manager.process_message( + &this->public.task_manager, queued); + queued->destroy(queued); + if (status == DESTROY_ME) + { + return status; + } + } if (this->passive_tasks->get_count(this->passive_tasks) == 0 && this->queued_tasks->get_count(this->queued_tasks) > 0) {