src/charon/sa/tasks/ike_mobike.c

   1 /**
   2  * @file ike_mobike.c
   3  *
   4  * @brief Implementation of the ike_mobike task.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2007 Martin Willi
  10  * Hochschule fuer Technik Rapperswil
  11  *
  12  * This program is free software; you can redistribute it and/or modify it
  13  * under the terms of the GNU General Public License as published by the
  14  * Free Software Foundation; either version 2 of the License, or (at your
  15  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  16  *
  17  * This program is distributed in the hope that it will be useful, but
  18  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  19  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  20  * for more details.
  21  */
  22
  23 #include "ike_mobike.h"
  24
  25 #include <string.h>
  26
  27 #include <daemon.h>
  28 #include <sa/tasks/ike_natd.h>
  29 #include <encoding/payloads/notify_payload.h>
  30
  31
  32 typedef struct private_ike_mobike_t private_ike_mobike_t;
  33
  34 /**
  35  * Private members of a ike_mobike_t task.
  36  */
  37 struct private_ike_mobike_t {
  38
  39         /**
  40          * Public methods and task_t interface.
  41          */
  42         ike_mobike_t public;
  43
  44         /**
  45          * Assigned IKE_SA.
  46          */
  47         ike_sa_t *ike_sa;
  48
  49         /**
  50          * Are we the initiator?
  51          */
  52         bool initiator;
  53
  54         /**
  55          * cookie2 value to verify new addresses
  56          */
  57         chunk_t cookie2;
  58
  59         /**
  60          * NAT discovery reusing the IKE_NATD task
  61          */
  62         ike_natd_t *natd;
  63
  64         /**
  65          * use task to update addresses
  66          */
  67         bool update;
  68
  69         /**
  70          * do routability check
  71          */
  72         bool check;
  73
  74         /**
  75          * include address list update
  76          */
  77         bool address;
  78 };
  79
  80 /**
  81  * flush the IKE_SAs list of additional addresses
  82  */
  83 static void flush_additional_addresses(private_ike_mobike_t *this)
  84 {
  85         iterator_t *iterator;
  86         host_t *host;
  87
  88         iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa);
  89         while (iterator->iterate(iterator, (void**)&host))
  90         {
  91                 iterator->remove(iterator);
  92                 host->destroy(host);
  93         }
  94         iterator->destroy(iterator);
  95 }
  96
  97
  98 /**
  99  * read notifys from message and evaluate them
 100  */
 101 static void process_payloads(private_ike_mobike_t *this, message_t *message)
 102 {
 103         iterator_t *iterator;
 104         payload_t *payload;
 105         bool first = TRUE;
 106
 107         iterator = message->get_payload_iterator(message);
 108         while (iterator->iterate(iterator, (void**)&payload))
 109         {
 110                 int family = AF_INET;
 111                 notify_payload_t *notify;
 112                 chunk_t data;
 113                 host_t *host;
 114
 115                 if (payload->get_type(payload) != NOTIFY)
 116                 {
 117                         continue;
 118                 }
 119                 notify = (notify_payload_t*)payload;
 120                 switch (notify->get_notify_type(notify))
 121                 {
 122                         case MOBIKE_SUPPORTED:
 123                         {
 124                                 DBG1(DBG_IKE, "peer supports MOBIKE");
 125                                 this->ike_sa->enable_extension(this->ike_sa, EXT_MOBIKE);
 126                                 break;
 127                         }
 128                         case ADDITIONAL_IP6_ADDRESS:
 129                         {
 130                                 family = AF_INET6;
 131                                 /* fall through */
 132                         }
 133                         case ADDITIONAL_IP4_ADDRESS:
 134                         {
 135                                 if (first)
 136                                 {       /* an ADDITIONAL_*_ADDRESS means replace, so flush once */
 137                                         flush_additional_addresses(this);
 138                                         first = FALSE;
 139                                 }
 140                                 data = notify->get_notification_data(notify);
 141                                 host = host_create_from_chunk(family, data, 0);
 142                                 DBG2(DBG_IKE, "got additional MOBIKE peer address: %H", host);
 143                                 this->ike_sa->add_additional_address(this->ike_sa, host);
 144                                 break;
 145                         }
 146                         case UPDATE_SA_ADDRESSES:
 147                         {
 148                                 this->update = TRUE;
 149                                 break;
 150                         }
 151                         case NO_ADDITIONAL_ADDRESSES:
 152                         {
 153                                 flush_additional_addresses(this);
 154                                 break;
 155                         }
 156                         case NAT_DETECTION_SOURCE_IP:
 157                         case NAT_DETECTION_DESTINATION_IP:
 158                         {
 159                                 /* NAT check in this MOBIKE exchange, create subtask for it */
 160                                 if (this->natd == NULL)
 161                                 {
 162                                         this->natd = ike_natd_create(this->ike_sa, this->initiator);
 163                                 }
 164                                 break;
 165                         }
 166                         default:
 167                                 break;
 168                 }
 169         }
 170         iterator->destroy(iterator);
 171 }
 172
 173 /**
 174  * Add ADDITIONAL_*_ADDRESS notifys depending on our address list
 175  */
 176 static void build_address_list(private_ike_mobike_t *this, message_t *message)
 177 {
 178         iterator_t *iterator;
 179         host_t *host, *me;
 180         notify_type_t type;
 181         bool additional = FALSE;
 182
 183         me = this->ike_sa->get_my_host(this->ike_sa);
 184         iterator = charon->kernel_interface->create_address_iterator(
 185                                                                                                 charon->kernel_interface);
 186         while (iterator->iterate(iterator, (void**)&host))
 187         {
 188                 if (me->ip_equals(me, host))
 189                 {       /* "ADDITIONAL" means do not include IKE_SAs host */
 190                         continue;
 191                 }
 192                 switch (host->get_family(host))
 193                 {
 194                         case AF_INET:
 195                                 type = ADDITIONAL_IP4_ADDRESS;
 196                                 break;
 197                         case AF_INET6:
 198                                 type = ADDITIONAL_IP6_ADDRESS;
 199                                 break;
 200                         default:
 201                                 continue;
 202                 }
 203                 message->add_notify(message, FALSE, type, host->get_address(host));
 204                 additional = TRUE;
 205         }
 206         if (!additional)
 207         {
 208                 message->add_notify(message, FALSE, NO_ADDITIONAL_ADDRESSES, chunk_empty);
 209         }
 210         iterator->destroy(iterator);
 211 }
 212
 213 /**
 214  * update addresses of associated CHILD_SAs
 215  */
 216 static void update_children(private_ike_mobike_t *this)
 217 {
 218         iterator_t *iterator;
 219         child_sa_t *child_sa;
 220
 221         iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa);
 222         while (iterator->iterate(iterator, (void**)&child_sa))
 223         {
 224                 child_sa->update_hosts(child_sa,
 225                                                 this->ike_sa->get_my_host(this->ike_sa),
 226                                                 this->ike_sa->get_other_host(this->ike_sa),
 227                                                 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
 228         }
 229         iterator->destroy(iterator);
 230 }
 231
 232 /**
 233  * Implementation of ike_mobike_t.transmit
 234  */
 235 static void transmit(private_ike_mobike_t *this, packet_t *packet)
 236 {
 237         host_t *me, *other, *me_old, *other_old;
 238         iterator_t *iterator;
 239         packet_t *copy;
 240
 241         if (!this->check)
 242         {
 243                 return;
 244         }
 245
 246         me_old = this->ike_sa->get_my_host(this->ike_sa);
 247         other_old = this->ike_sa->get_other_host(this->ike_sa);
 248
 249         me = charon->kernel_interface->get_source_addr(
 250                                                                                 charon->kernel_interface, other_old);
 251         if (me)
 252         {
 253                 me->set_port(me, me->ip_equals(me, me_old) ?
 254                                          me_old->get_port(me_old) : IKEV2_NATT_PORT);
 255                 packet->set_source(packet, me);
 256         }
 257
 258         iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa);
 259         while (iterator->iterate(iterator, (void**)&other))
 260         {
 261                 me = charon->kernel_interface->get_source_addr(
 262                                                                                         charon->kernel_interface, other);
 263                 if (me)
 264                 {
 265                         /* reuse port for an active address, 4500 otherwise */
 266                         me->set_port(me, me->ip_equals(me, me_old) ?
 267                                                  me_old->get_port(me_old) : IKEV2_NATT_PORT);
 268                         other = other->clone(other);
 269                         other->set_port(other, other->ip_equals(other, other_old) ?
 270                                                         other_old->get_port(other_old) : IKEV2_NATT_PORT);
 271                         copy = packet->clone(packet);
 272                         copy->set_source(copy, me);
 273                         copy->set_destination(copy, other);
 274                         charon->sender->send(charon->sender, copy);
 275                 }
 276         }
 277         iterator->destroy(iterator);
 278 }
 279
 280 /**
 281  * Implementation of task_t.process for initiator
 282  */
 283 static status_t build_i(private_ike_mobike_t *this, message_t *message)
 284 {
 285         if (message->get_exchange_type(message) == IKE_AUTH &&
 286                 message->get_payload(message, SECURITY_ASSOCIATION))
 287         {
 288                 message->add_notify(message, FALSE, MOBIKE_SUPPORTED, chunk_empty);
 289                 build_address_list(this, message);
 290         }
 291         else if (message->get_exchange_type(message) == INFORMATIONAL)
 292         {
 293                 if (this->update)
 294                 {
 295                         message->add_notify(message, FALSE, UPDATE_SA_ADDRESSES, chunk_empty);
 296                         update_children(this);
 297                 }
 298                 if (this->address)
 299                 {
 300                         build_address_list(this, message);
 301                 }
 302                 if (this->natd)
 303                 {
 304                         this->natd->task.build(&this->natd->task, message);
 305                 }
 306         }
 307         return NEED_MORE;
 308 }
 309
 310 /**
 311  * Implementation of task_t.process for responder
 312  */
 313 static status_t process_r(private_ike_mobike_t *this, message_t *message)
 314 {
 315         if (message->get_exchange_type(message) == IKE_AUTH &&
 316                 message->get_payload(message, SECURITY_ASSOCIATION))
 317         {
 318                 process_payloads(this, message);
 319         }
 320         else if (message->get_exchange_type(message) == INFORMATIONAL)
 321         {
 322                 process_payloads(this, message);
 323                 if (this->update)
 324                 {
 325                         host_t *me, *other;
 326
 327                         me = message->get_destination(message);
 328                         other = message->get_source(message);
 329                         this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
 330                         this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
 331                 }
 332
 333                 if (this->natd)
 334                 {
 335                         this->natd->task.process(&this->natd->task, message);
 336                 }
 337         }
 338         return NEED_MORE;
 339 }
 340
 341 /**
 342  * Implementation of task_t.build for responder
 343  */
 344 static status_t build_r(private_ike_mobike_t *this, message_t *message)
 345 {
 346         if (message->get_exchange_type(message) == IKE_AUTH &&
 347                 message->get_payload(message, SECURITY_ASSOCIATION))
 348         {
 349                 if (this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
 350                 {
 351                         message->add_notify(message, FALSE, MOBIKE_SUPPORTED, chunk_empty);
 352                         build_address_list(this, message);
 353                 }
 354                 return SUCCESS;
 355         }
 356         else if (message->get_exchange_type(message) == INFORMATIONAL)
 357         {
 358                 if (this->natd)
 359                 {
 360                         this->natd->task.build(&this->natd->task, message);
 361                 }
 362                 if (this->update)
 363                 {
 364                         update_children(this);
 365                 }
 366                 return SUCCESS;
 367         }
 368         return NEED_MORE;
 369 }
 370
 371 /**
 372  * Implementation of task_t.process for initiator
 373  */
 374 static status_t process_i(private_ike_mobike_t *this, message_t *message)
 375 {
 376         if (message->get_exchange_type(message) == IKE_AUTH &&
 377                 message->get_payload(message, SECURITY_ASSOCIATION))
 378         {
 379                 process_payloads(this, message);
 380                 return SUCCESS;
 381         }
 382         else if (message->get_exchange_type(message) == INFORMATIONAL)
 383         {
 384                 u_int32_t updates = this->ike_sa->get_pending_updates(this->ike_sa) - 1;
 385                 this->ike_sa->set_pending_updates(this->ike_sa, updates);
 386                 if (updates > 0)
 387                 {
 388                         /* newer update queued, ignore this one */
 389                         return SUCCESS;
 390                 }
 391                 process_payloads(this, message);
 392                 if (this->natd)
 393                 {
 394                         this->natd->task.process(&this->natd->task, message);
 395                 }
 396                 if (this->update)
 397                 {
 398                         /* update again, as NAT state may have changed */
 399                         update_children(this);
 400                 }
 401                 if (this->check)
 402                 {
 403                         host_t *me_new, *me_old, *other_new, *other_old;
 404
 405                         me_new = message->get_destination(message);
 406                         other_new = message->get_source(message);
 407                         me_old = this->ike_sa->get_my_host(this->ike_sa);
 408                         other_old = this->ike_sa->get_other_host(this->ike_sa);
 409
 410                         if (!me_new->equals(me_new, me_old))
 411                         {
 412                                 this->update = TRUE;
 413                                 this->ike_sa->set_my_host(this->ike_sa, me_new->clone(me_new));
 414                         }
 415                         if (!other_new->equals(other_new, other_old))
 416                         {
 417                                 this->update = TRUE;
 418                                 this->ike_sa->set_other_host(this->ike_sa, other_new->clone(other_new));
 419                         }
 420                         if (this->update)
 421                         {
 422                                 /* start the update with the same task */
 423                                 this->check = FALSE;
 424                                 this->address = FALSE;
 425                                 this->natd = ike_natd_create(this->ike_sa, this->initiator);
 426                                 this->ike_sa->set_pending_updates(this->ike_sa, 1);
 427                                 return NEED_MORE;
 428                         }
 429                 }
 430                 return SUCCESS;
 431         }
 432         return NEED_MORE;
 433 }
 434
 435 /**
 436  * Implementation of ike_mobike_t.roam.
 437  */
 438 static void roam(private_ike_mobike_t *this, bool address)
 439 {
 440         this->check = TRUE;
 441         this->address = address;
 442         this->ike_sa->set_pending_updates(this->ike_sa,
 443                                                         this->ike_sa->get_pending_updates(this->ike_sa) + 1);
 444 }
 445
 446 /**
 447  * Implementation of task_t.get_type
 448  */
 449 static task_type_t get_type(private_ike_mobike_t *this)
 450 {
 451         return IKE_MOBIKE;
 452 }
 453
 454 /**
 455  * Implementation of task_t.migrate
 456  */
 457 static void migrate(private_ike_mobike_t *this, ike_sa_t *ike_sa)
 458 {
 459         chunk_free(&this->cookie2);
 460         this->ike_sa = ike_sa;
 461         if (this->natd)
 462         {
 463                 this->natd->task.migrate(&this->natd->task, ike_sa);
 464         }
 465 }
 466
 467 /**
 468  * Implementation of task_t.destroy
 469  */
 470 static void destroy(private_ike_mobike_t *this)
 471 {
 472         chunk_free(&this->cookie2);
 473         if (this->natd)
 474         {
 475                 this->natd->task.destroy(&this->natd->task);
 476         }
 477         free(this);
 478 }
 479
 480 /*
 481  * Described in header.
 482  */
 483 ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator)
 484 {
 485         private_ike_mobike_t *this = malloc_thing(private_ike_mobike_t);
 486
 487         this->public.roam = (void(*)(ike_mobike_t*,bool))roam;
 488         this->public.transmit = (void(*)(ike_mobike_t*,packet_t*))transmit;
 489         this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 490         this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 491         this->public.task.destroy = (void(*)(task_t*))destroy;
 492
 493         if (initiator)
 494         {
 495                 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
 496                 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
 497         }
 498         else
 499         {
 500                 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 501                 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 502         }
 503
 504         this->ike_sa = ike_sa;
 505         this->initiator = initiator;
 506         this->update = FALSE;
 507         this->check = FALSE;
 508         this->address = TRUE;
 509         this->cookie2 = chunk_empty;
 510         this->natd = NULL;
 511
 512         return &this->public;
 513 }
 514