]>
Commit | Line | Data |
---|---|---|
17d92e97 MW |
1 | /* |
2 | * Copyright (C) 2007 Martin Willi | |
3 | * Hochschule fuer Technik Rapperswil | |
4 | * | |
5 | * This program is free software; you can redistribute it and/or modify it | |
6 | * under the terms of the GNU General Public License as published by the | |
7 | * Free Software Foundation; either version 2 of the License, or (at your | |
8 | * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. | |
9 | * | |
10 | * This program is distributed in the hope that it will be useful, but | |
11 | * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY | |
12 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License | |
13 | * for more details. | |
552cc11b MW |
14 | * |
15 | * $Id$ | |
17d92e97 MW |
16 | */ |
17 | ||
18 | #include "ike_mobike.h" | |
19 | ||
20 | #include <string.h> | |
21 | ||
22 | #include <daemon.h> | |
4cb9d7a7 | 23 | #include <sa/tasks/ike_natd.h> |
17d92e97 MW |
24 | #include <encoding/payloads/notify_payload.h> |
25 | ||
26 | ||
27 | typedef struct private_ike_mobike_t private_ike_mobike_t; | |
28 | ||
29 | /** | |
30 | * Private members of a ike_mobike_t task. | |
31 | */ | |
32 | struct private_ike_mobike_t { | |
33 | ||
34 | /** | |
35 | * Public methods and task_t interface. | |
36 | */ | |
37 | ike_mobike_t public; | |
38 | ||
39 | /** | |
40 | * Assigned IKE_SA. | |
41 | */ | |
42 | ike_sa_t *ike_sa; | |
43 | ||
44 | /** | |
45 | * Are we the initiator? | |
46 | */ | |
47 | bool initiator; | |
48 | ||
49 | /** | |
3bc62fe7 | 50 | * cookie2 value to verify new addresses |
17d92e97 | 51 | */ |
3bc62fe7 | 52 | chunk_t cookie2; |
17d92e97 MW |
53 | |
54 | /** | |
3bc62fe7 | 55 | * NAT discovery reusing the IKE_NATD task |
17d92e97 | 56 | */ |
3bc62fe7 | 57 | ike_natd_t *natd; |
4cb9d7a7 MW |
58 | |
59 | /** | |
3bc62fe7 | 60 | * use task to update addresses |
4cb9d7a7 | 61 | */ |
5474dc65 MW |
62 | bool update; |
63 | ||
64 | /** | |
65 | * do routability check | |
66 | */ | |
67 | bool check; | |
4cb9d7a7 MW |
68 | |
69 | /** | |
3bc62fe7 | 70 | * include address list update |
4cb9d7a7 | 71 | */ |
3bc62fe7 | 72 | bool address; |
17d92e97 MW |
73 | }; |
74 | ||
75 | /** | |
76 | * flush the IKE_SAs list of additional addresses | |
77 | */ | |
78 | static void flush_additional_addresses(private_ike_mobike_t *this) | |
79 | { | |
80 | iterator_t *iterator; | |
81 | host_t *host; | |
82 | ||
83 | iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa); | |
84 | while (iterator->iterate(iterator, (void**)&host)) | |
85 | { | |
86 | iterator->remove(iterator); | |
87 | host->destroy(host); | |
88 | } | |
89 | iterator->destroy(iterator); | |
90 | } | |
91 | ||
92 | ||
93 | /** | |
94 | * read notifys from message and evaluate them | |
95 | */ | |
96 | static void process_payloads(private_ike_mobike_t *this, message_t *message) | |
97 | { | |
98 | iterator_t *iterator; | |
99 | payload_t *payload; | |
100 | bool first = TRUE; | |
101 | ||
102 | iterator = message->get_payload_iterator(message); | |
103 | while (iterator->iterate(iterator, (void**)&payload)) | |
104 | { | |
105 | int family = AF_INET; | |
106 | notify_payload_t *notify; | |
107 | chunk_t data; | |
108 | host_t *host; | |
109 | ||
110 | if (payload->get_type(payload) != NOTIFY) | |
111 | { | |
112 | continue; | |
113 | } | |
114 | notify = (notify_payload_t*)payload; | |
115 | switch (notify->get_notify_type(notify)) | |
116 | { | |
117 | case MOBIKE_SUPPORTED: | |
118 | { | |
bcac22f3 | 119 | DBG1(DBG_IKE, "peer supports MOBIKE"); |
17d92e97 MW |
120 | this->ike_sa->enable_extension(this->ike_sa, EXT_MOBIKE); |
121 | break; | |
122 | } | |
123 | case ADDITIONAL_IP6_ADDRESS: | |
124 | { | |
125 | family = AF_INET6; | |
126 | /* fall through */ | |
127 | } | |
128 | case ADDITIONAL_IP4_ADDRESS: | |
129 | { | |
130 | if (first) | |
131 | { /* an ADDITIONAL_*_ADDRESS means replace, so flush once */ | |
132 | flush_additional_addresses(this); | |
4cb9d7a7 | 133 | first = FALSE; |
17d92e97 MW |
134 | } |
135 | data = notify->get_notification_data(notify); | |
136 | host = host_create_from_chunk(family, data, 0); | |
137 | DBG2(DBG_IKE, "got additional MOBIKE peer address: %H", host); | |
138 | this->ike_sa->add_additional_address(this->ike_sa, host); | |
139 | break; | |
140 | } | |
3bc62fe7 MW |
141 | case UPDATE_SA_ADDRESSES: |
142 | { | |
5474dc65 | 143 | this->update = TRUE; |
3bc62fe7 MW |
144 | break; |
145 | } | |
17d92e97 MW |
146 | case NO_ADDITIONAL_ADDRESSES: |
147 | { | |
148 | flush_additional_addresses(this); | |
149 | break; | |
150 | } | |
fc2d1c42 MW |
151 | case NAT_DETECTION_SOURCE_IP: |
152 | case NAT_DETECTION_DESTINATION_IP: | |
153 | { | |
154 | /* NAT check in this MOBIKE exchange, create subtask for it */ | |
155 | if (this->natd == NULL) | |
156 | { | |
157 | this->natd = ike_natd_create(this->ike_sa, this->initiator); | |
158 | } | |
159 | break; | |
160 | } | |
17d92e97 MW |
161 | default: |
162 | break; | |
163 | } | |
164 | } | |
165 | iterator->destroy(iterator); | |
166 | } | |
167 | ||
168 | /** | |
169 | * Add ADDITIONAL_*_ADDRESS notifys depending on our address list | |
170 | */ | |
171 | static void build_address_list(private_ike_mobike_t *this, message_t *message) | |
172 | { | |
173 | iterator_t *iterator; | |
174 | host_t *host, *me; | |
175 | notify_type_t type; | |
176 | bool additional = FALSE; | |
177 | ||
178 | me = this->ike_sa->get_my_host(this->ike_sa); | |
179 | iterator = charon->kernel_interface->create_address_iterator( | |
180 | charon->kernel_interface); | |
181 | while (iterator->iterate(iterator, (void**)&host)) | |
182 | { | |
183 | if (me->ip_equals(me, host)) | |
184 | { /* "ADDITIONAL" means do not include IKE_SAs host */ | |
185 | continue; | |
186 | } | |
187 | switch (host->get_family(host)) | |
188 | { | |
189 | case AF_INET: | |
190 | type = ADDITIONAL_IP4_ADDRESS; | |
191 | break; | |
192 | case AF_INET6: | |
193 | type = ADDITIONAL_IP6_ADDRESS; | |
194 | break; | |
195 | default: | |
196 | continue; | |
197 | } | |
198 | message->add_notify(message, FALSE, type, host->get_address(host)); | |
199 | additional = TRUE; | |
200 | } | |
201 | if (!additional) | |
202 | { | |
203 | message->add_notify(message, FALSE, NO_ADDITIONAL_ADDRESSES, chunk_empty); | |
204 | } | |
205 | iterator->destroy(iterator); | |
206 | } | |
207 | ||
3bc62fe7 MW |
208 | /** |
209 | * update addresses of associated CHILD_SAs | |
210 | */ | |
211 | static void update_children(private_ike_mobike_t *this) | |
212 | { | |
213 | iterator_t *iterator; | |
214 | child_sa_t *child_sa; | |
215 | ||
216 | iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa); | |
217 | while (iterator->iterate(iterator, (void**)&child_sa)) | |
218 | { | |
219 | child_sa->update_hosts(child_sa, | |
220 | this->ike_sa->get_my_host(this->ike_sa), | |
221 | this->ike_sa->get_other_host(this->ike_sa), | |
222 | this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY)); | |
223 | } | |
224 | iterator->destroy(iterator); | |
225 | } | |
226 | ||
5474dc65 MW |
227 | /** |
228 | * Implementation of ike_mobike_t.transmit | |
229 | */ | |
230 | static void transmit(private_ike_mobike_t *this, packet_t *packet) | |
231 | { | |
232 | host_t *me, *other, *me_old, *other_old; | |
233 | iterator_t *iterator; | |
234 | packet_t *copy; | |
235 | ||
236 | if (!this->check) | |
237 | { | |
238 | return; | |
239 | } | |
240 | ||
241 | me_old = this->ike_sa->get_my_host(this->ike_sa); | |
242 | other_old = this->ike_sa->get_other_host(this->ike_sa); | |
243 | ||
244 | me = charon->kernel_interface->get_source_addr( | |
245 | charon->kernel_interface, other_old); | |
246 | if (me) | |
247 | { | |
248 | me->set_port(me, me->ip_equals(me, me_old) ? | |
249 | me_old->get_port(me_old) : IKEV2_NATT_PORT); | |
250 | packet->set_source(packet, me); | |
251 | } | |
252 | ||
253 | iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa); | |
254 | while (iterator->iterate(iterator, (void**)&other)) | |
255 | { | |
256 | me = charon->kernel_interface->get_source_addr( | |
257 | charon->kernel_interface, other); | |
258 | if (me) | |
259 | { | |
260 | /* reuse port for an active address, 4500 otherwise */ | |
261 | me->set_port(me, me->ip_equals(me, me_old) ? | |
262 | me_old->get_port(me_old) : IKEV2_NATT_PORT); | |
263 | other = other->clone(other); | |
264 | other->set_port(other, other->ip_equals(other, other_old) ? | |
265 | other_old->get_port(other_old) : IKEV2_NATT_PORT); | |
d9d69536 | 266 | DBG1(DBG_IKE, "checking path %#H - %#H", me, other); |
5474dc65 MW |
267 | copy = packet->clone(packet); |
268 | copy->set_source(copy, me); | |
269 | copy->set_destination(copy, other); | |
270 | charon->sender->send(charon->sender, copy); | |
271 | } | |
272 | } | |
273 | iterator->destroy(iterator); | |
d9d69536 MW |
274 | me = packet->get_source(packet); |
275 | other = packet->get_destination(packet); | |
276 | DBG1(DBG_IKE, "checking path %#H - %#H", me, other); | |
5474dc65 MW |
277 | } |
278 | ||
17d92e97 MW |
279 | /** |
280 | * Implementation of task_t.process for initiator | |
281 | */ | |
282 | static status_t build_i(private_ike_mobike_t *this, message_t *message) | |
283 | { | |
284 | if (message->get_exchange_type(message) == IKE_AUTH && | |
b8249ff5 | 285 | message->get_payload(message, ID_INITIATOR)) |
4cb9d7a7 | 286 | { |
17d92e97 MW |
287 | message->add_notify(message, FALSE, MOBIKE_SUPPORTED, chunk_empty); |
288 | build_address_list(this, message); | |
289 | } | |
c8739590 | 290 | else if (message->get_exchange_type(message) == INFORMATIONAL) |
3bc62fe7 | 291 | { |
5474dc65 | 292 | if (this->update) |
fc2d1c42 | 293 | { |
3bc62fe7 | 294 | message->add_notify(message, FALSE, UPDATE_SA_ADDRESSES, chunk_empty); |
5474dc65 | 295 | update_children(this); |
fc2d1c42 | 296 | } |
3bc62fe7 MW |
297 | if (this->address) |
298 | { | |
299 | build_address_list(this, message); | |
300 | } | |
5474dc65 MW |
301 | if (this->natd) |
302 | { | |
303 | this->natd->task.build(&this->natd->task, message); | |
304 | } | |
4cb9d7a7 | 305 | } |
17d92e97 MW |
306 | return NEED_MORE; |
307 | } | |
308 | ||
309 | /** | |
310 | * Implementation of task_t.process for responder | |
311 | */ | |
312 | static status_t process_r(private_ike_mobike_t *this, message_t *message) | |
4cb9d7a7 | 313 | { |
fc2d1c42 | 314 | if (message->get_exchange_type(message) == IKE_AUTH && |
b8249ff5 | 315 | message->get_payload(message, ID_INITIATOR)) |
4cb9d7a7 MW |
316 | { |
317 | process_payloads(this, message); | |
318 | } | |
fc2d1c42 MW |
319 | else if (message->get_exchange_type(message) == INFORMATIONAL) |
320 | { | |
321 | process_payloads(this, message); | |
5474dc65 | 322 | if (this->update) |
3bc62fe7 MW |
323 | { |
324 | host_t *me, *other; | |
325 | ||
326 | me = message->get_destination(message); | |
327 | other = message->get_source(message); | |
328 | this->ike_sa->set_my_host(this->ike_sa, me->clone(me)); | |
329 | this->ike_sa->set_other_host(this->ike_sa, other->clone(other)); | |
330 | } | |
331 | ||
fc2d1c42 MW |
332 | if (this->natd) |
333 | { | |
334 | this->natd->task.process(&this->natd->task, message); | |
335 | } | |
336 | } | |
17d92e97 MW |
337 | return NEED_MORE; |
338 | } | |
339 | ||
340 | /** | |
341 | * Implementation of task_t.build for responder | |
342 | */ | |
343 | static status_t build_r(private_ike_mobike_t *this, message_t *message) | |
344 | { | |
345 | if (message->get_exchange_type(message) == IKE_AUTH && | |
b8249ff5 | 346 | this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED) |
17d92e97 MW |
347 | { |
348 | if (this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE)) | |
349 | { | |
350 | message->add_notify(message, FALSE, MOBIKE_SUPPORTED, chunk_empty); | |
351 | build_address_list(this, message); | |
352 | } | |
353 | return SUCCESS; | |
354 | } | |
2b3100b5 MW |
355 | else if (message->get_exchange_type(message) == INFORMATIONAL) |
356 | { | |
fc2d1c42 MW |
357 | if (this->natd) |
358 | { | |
359 | this->natd->task.build(&this->natd->task, message); | |
360 | } | |
5474dc65 | 361 | if (this->update) |
3bc62fe7 MW |
362 | { |
363 | update_children(this); | |
364 | } | |
2b3100b5 MW |
365 | return SUCCESS; |
366 | } | |
17d92e97 MW |
367 | return NEED_MORE; |
368 | } | |
369 | ||
370 | /** | |
371 | * Implementation of task_t.process for initiator | |
372 | */ | |
373 | static status_t process_i(private_ike_mobike_t *this, message_t *message) | |
374 | { | |
375 | if (message->get_exchange_type(message) == IKE_AUTH && | |
b8249ff5 | 376 | this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED) |
17d92e97 MW |
377 | { |
378 | process_payloads(this, message); | |
379 | return SUCCESS; | |
380 | } | |
2b3100b5 MW |
381 | else if (message->get_exchange_type(message) == INFORMATIONAL) |
382 | { | |
3bc62fe7 MW |
383 | u_int32_t updates = this->ike_sa->get_pending_updates(this->ike_sa) - 1; |
384 | this->ike_sa->set_pending_updates(this->ike_sa, updates); | |
385 | if (updates > 0) | |
386 | { | |
387 | /* newer update queued, ignore this one */ | |
388 | return SUCCESS; | |
389 | } | |
fc2d1c42 MW |
390 | process_payloads(this, message); |
391 | if (this->natd) | |
392 | { | |
393 | this->natd->task.process(&this->natd->task, message); | |
394 | } | |
5474dc65 | 395 | if (this->update) |
3bc62fe7 MW |
396 | { |
397 | /* update again, as NAT state may have changed */ | |
398 | update_children(this); | |
399 | } | |
5474dc65 MW |
400 | if (this->check) |
401 | { | |
402 | host_t *me_new, *me_old, *other_new, *other_old; | |
403 | ||
404 | me_new = message->get_destination(message); | |
405 | other_new = message->get_source(message); | |
406 | me_old = this->ike_sa->get_my_host(this->ike_sa); | |
407 | other_old = this->ike_sa->get_other_host(this->ike_sa); | |
408 | ||
409 | if (!me_new->equals(me_new, me_old)) | |
410 | { | |
411 | this->update = TRUE; | |
412 | this->ike_sa->set_my_host(this->ike_sa, me_new->clone(me_new)); | |
413 | } | |
414 | if (!other_new->equals(other_new, other_old)) | |
415 | { | |
416 | this->update = TRUE; | |
417 | this->ike_sa->set_other_host(this->ike_sa, other_new->clone(other_new)); | |
418 | } | |
419 | if (this->update) | |
420 | { | |
421 | /* start the update with the same task */ | |
422 | this->check = FALSE; | |
423 | this->address = FALSE; | |
12fa4387 | 424 | this->natd = ike_natd_create(this->ike_sa, this->initiator); |
5474dc65 MW |
425 | this->ike_sa->set_pending_updates(this->ike_sa, 1); |
426 | return NEED_MORE; | |
427 | } | |
428 | } | |
2b3100b5 MW |
429 | return SUCCESS; |
430 | } | |
17d92e97 MW |
431 | return NEED_MORE; |
432 | } | |
433 | ||
434 | /** | |
435 | * Implementation of ike_mobike_t.roam. | |
436 | */ | |
3bc62fe7 | 437 | static void roam(private_ike_mobike_t *this, bool address) |
17d92e97 | 438 | { |
5474dc65 | 439 | this->check = TRUE; |
3bc62fe7 MW |
440 | this->address = address; |
441 | this->ike_sa->set_pending_updates(this->ike_sa, | |
442 | this->ike_sa->get_pending_updates(this->ike_sa) + 1); | |
17d92e97 MW |
443 | } |
444 | ||
f215e919 MW |
445 | /** |
446 | * Implementation of ike_mobike_t.is_probing. | |
447 | */ | |
448 | static bool is_probing(private_ike_mobike_t *this) | |
449 | { | |
450 | return this->check; | |
451 | } | |
452 | ||
17d92e97 MW |
453 | /** |
454 | * Implementation of task_t.get_type | |
455 | */ | |
456 | static task_type_t get_type(private_ike_mobike_t *this) | |
457 | { | |
458 | return IKE_MOBIKE; | |
459 | } | |
460 | ||
461 | /** | |
462 | * Implementation of task_t.migrate | |
463 | */ | |
464 | static void migrate(private_ike_mobike_t *this, ike_sa_t *ike_sa) | |
465 | { | |
4cb9d7a7 | 466 | chunk_free(&this->cookie2); |
17d92e97 | 467 | this->ike_sa = ike_sa; |
4cb9d7a7 MW |
468 | if (this->natd) |
469 | { | |
470 | this->natd->task.migrate(&this->natd->task, ike_sa); | |
471 | } | |
17d92e97 MW |
472 | } |
473 | ||
474 | /** | |
475 | * Implementation of task_t.destroy | |
476 | */ | |
477 | static void destroy(private_ike_mobike_t *this) | |
478 | { | |
4cb9d7a7 MW |
479 | chunk_free(&this->cookie2); |
480 | if (this->natd) | |
481 | { | |
482 | this->natd->task.destroy(&this->natd->task); | |
483 | } | |
17d92e97 MW |
484 | free(this); |
485 | } | |
486 | ||
487 | /* | |
488 | * Described in header. | |
489 | */ | |
490 | ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator) | |
491 | { | |
492 | private_ike_mobike_t *this = malloc_thing(private_ike_mobike_t); | |
493 | ||
3bc62fe7 | 494 | this->public.roam = (void(*)(ike_mobike_t*,bool))roam; |
5474dc65 | 495 | this->public.transmit = (void(*)(ike_mobike_t*,packet_t*))transmit; |
f215e919 | 496 | this->public.is_probing = (bool(*)(ike_mobike_t*))is_probing; |
17d92e97 MW |
497 | this->public.task.get_type = (task_type_t(*)(task_t*))get_type; |
498 | this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate; | |
499 | this->public.task.destroy = (void(*)(task_t*))destroy; | |
500 | ||
501 | if (initiator) | |
502 | { | |
503 | this->public.task.build = (status_t(*)(task_t*,message_t*))build_i; | |
504 | this->public.task.process = (status_t(*)(task_t*,message_t*))process_i; | |
505 | } | |
506 | else | |
507 | { | |
508 | this->public.task.build = (status_t(*)(task_t*,message_t*))build_r; | |
509 | this->public.task.process = (status_t(*)(task_t*,message_t*))process_r; | |
510 | } | |
511 | ||
512 | this->ike_sa = ike_sa; | |
513 | this->initiator = initiator; | |
5474dc65 MW |
514 | this->update = FALSE; |
515 | this->check = FALSE; | |
3bc62fe7 | 516 | this->address = TRUE; |
4cb9d7a7 MW |
517 | this->cookie2 = chunk_empty; |
518 | this->natd = NULL; | |
17d92e97 MW |
519 | |
520 | return &this->public; | |
521 | } | |
522 |