filtering out non matching path probing pairs explicitly
[strongswan.git] / src / charon / sa / tasks / ike_mobike.c
1 /*
2 * Copyright (C) 2007 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 *
15 * $Id$
16 */
17
18 #include "ike_mobike.h"
19
20 #include <string.h>
21
22 #include <daemon.h>
23 #include <sa/tasks/ike_natd.h>
24 #include <encoding/payloads/notify_payload.h>
25
26 #define COOKIE2_SIZE 16
27
28 typedef struct private_ike_mobike_t private_ike_mobike_t;
29
30 /**
31 * Private members of a ike_mobike_t task.
32 */
33 struct private_ike_mobike_t {
34
35 /**
36 * Public methods and task_t interface.
37 */
38 ike_mobike_t public;
39
40 /**
41 * Assigned IKE_SA.
42 */
43 ike_sa_t *ike_sa;
44
45 /**
46 * Are we the initiator?
47 */
48 bool initiator;
49
50 /**
51 * cookie2 value to verify new addresses
52 */
53 chunk_t cookie2;
54
55 /**
56 * NAT discovery reusing the IKE_NATD task
57 */
58 ike_natd_t *natd;
59
60 /**
61 * use task to update addresses
62 */
63 bool update;
64
65 /**
66 * do routability check
67 */
68 bool check;
69
70 /**
71 * include address list update
72 */
73 bool address;
74 };
75
76 /**
77 * flush the IKE_SAs list of additional addresses
78 */
79 static void flush_additional_addresses(private_ike_mobike_t *this)
80 {
81 iterator_t *iterator;
82 host_t *host;
83
84 iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa);
85 while (iterator->iterate(iterator, (void**)&host))
86 {
87 iterator->remove(iterator);
88 host->destroy(host);
89 }
90 iterator->destroy(iterator);
91 }
92
93
94 /**
95 * read notifys from message and evaluate them
96 */
97 static void process_payloads(private_ike_mobike_t *this, message_t *message)
98 {
99 iterator_t *iterator;
100 payload_t *payload;
101 bool first = TRUE;
102
103 iterator = message->get_payload_iterator(message);
104 while (iterator->iterate(iterator, (void**)&payload))
105 {
106 int family = AF_INET;
107 notify_payload_t *notify;
108 chunk_t data;
109 host_t *host;
110
111 if (payload->get_type(payload) != NOTIFY)
112 {
113 continue;
114 }
115 notify = (notify_payload_t*)payload;
116 switch (notify->get_notify_type(notify))
117 {
118 case MOBIKE_SUPPORTED:
119 {
120 DBG1(DBG_IKE, "peer supports MOBIKE");
121 this->ike_sa->enable_extension(this->ike_sa, EXT_MOBIKE);
122 break;
123 }
124 case COOKIE2:
125 {
126 chunk_free(&this->cookie2);
127 this->cookie2 = chunk_clone(notify->get_notification_data(notify));
128 break;
129 }
130 case ADDITIONAL_IP6_ADDRESS:
131 {
132 family = AF_INET6;
133 /* fall through */
134 }
135 case ADDITIONAL_IP4_ADDRESS:
136 {
137 if (first)
138 { /* an ADDITIONAL_*_ADDRESS means replace, so flush once */
139 flush_additional_addresses(this);
140 first = FALSE;
141 }
142 data = notify->get_notification_data(notify);
143 host = host_create_from_chunk(family, data, 0);
144 DBG2(DBG_IKE, "got additional MOBIKE peer address: %H", host);
145 this->ike_sa->add_additional_address(this->ike_sa, host);
146 break;
147 }
148 case UPDATE_SA_ADDRESSES:
149 {
150 this->update = TRUE;
151 break;
152 }
153 case NO_ADDITIONAL_ADDRESSES:
154 {
155 flush_additional_addresses(this);
156 break;
157 }
158 case NAT_DETECTION_SOURCE_IP:
159 case NAT_DETECTION_DESTINATION_IP:
160 {
161 /* NAT check in this MOBIKE exchange, create subtask for it */
162 if (this->natd == NULL)
163 {
164 this->natd = ike_natd_create(this->ike_sa, this->initiator);
165 }
166 break;
167 }
168 default:
169 break;
170 }
171 }
172 iterator->destroy(iterator);
173 }
174
175 /**
176 * Add ADDITIONAL_*_ADDRESS notifys depending on our address list
177 */
178 static void build_address_list(private_ike_mobike_t *this, message_t *message)
179 {
180 iterator_t *iterator;
181 host_t *host, *me;
182 notify_type_t type;
183 bool additional = FALSE;
184
185 me = this->ike_sa->get_my_host(this->ike_sa);
186 iterator = charon->kernel_interface->create_address_iterator(
187 charon->kernel_interface);
188 while (iterator->iterate(iterator, (void**)&host))
189 {
190 if (me->ip_equals(me, host))
191 { /* "ADDITIONAL" means do not include IKE_SAs host */
192 continue;
193 }
194 switch (host->get_family(host))
195 {
196 case AF_INET:
197 type = ADDITIONAL_IP4_ADDRESS;
198 break;
199 case AF_INET6:
200 type = ADDITIONAL_IP6_ADDRESS;
201 break;
202 default:
203 continue;
204 }
205 message->add_notify(message, FALSE, type, host->get_address(host));
206 additional = TRUE;
207 }
208 if (!additional)
209 {
210 message->add_notify(message, FALSE, NO_ADDITIONAL_ADDRESSES, chunk_empty);
211 }
212 iterator->destroy(iterator);
213 }
214
215 /**
216 * build a cookie and add it to the message
217 */
218 static void build_cookie(private_ike_mobike_t *this, message_t *message)
219 {
220 rng_t *rng;
221
222 chunk_free(&this->cookie2);
223 rng = lib->crypto->create_rng(lib->crypto, RNG_STRONG);
224 if (rng)
225 {
226 rng->allocate_bytes(rng, COOKIE2_SIZE, &this->cookie2);
227 rng->destroy(rng);
228 message->add_notify(message, FALSE, COOKIE2, this->cookie2);
229 }
230 }
231
232 /**
233 * update addresses of associated CHILD_SAs
234 */
235 static void update_children(private_ike_mobike_t *this)
236 {
237 iterator_t *iterator;
238 child_sa_t *child_sa;
239
240 iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa);
241 while (iterator->iterate(iterator, (void**)&child_sa))
242 {
243 child_sa->update_hosts(child_sa,
244 this->ike_sa->get_my_host(this->ike_sa),
245 this->ike_sa->get_other_host(this->ike_sa),
246 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
247 }
248 iterator->destroy(iterator);
249 }
250
251 /**
252 * Implementation of ike_mobike_t.transmit
253 */
254 static void transmit(private_ike_mobike_t *this, packet_t *packet)
255 {
256 host_t *me, *other, *me_old, *other_old;
257 iterator_t *iterator;
258 packet_t *copy;
259
260 if (!this->check)
261 {
262 return;
263 }
264
265 me_old = this->ike_sa->get_my_host(this->ike_sa);
266 other_old = this->ike_sa->get_other_host(this->ike_sa);
267
268 me = charon->kernel_interface->get_source_addr(
269 charon->kernel_interface, other_old);
270 if (me)
271 {
272 me->set_port(me, me->ip_equals(me, me_old) ?
273 me_old->get_port(me_old) : IKEV2_NATT_PORT);
274 packet->set_source(packet, me);
275 }
276
277 iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa);
278 while (iterator->iterate(iterator, (void**)&other))
279 {
280 me = charon->kernel_interface->get_source_addr(
281 charon->kernel_interface, other);
282 if (me)
283 {
284 if (me->get_family(me) != other->get_family(other))
285 {
286 me->destroy(me);
287 continue;
288 }
289 /* reuse port for an active address, 4500 otherwise */
290 me->set_port(me, me->ip_equals(me, me_old) ?
291 me_old->get_port(me_old) : IKEV2_NATT_PORT);
292 other = other->clone(other);
293 other->set_port(other, other->ip_equals(other, other_old) ?
294 other_old->get_port(other_old) : IKEV2_NATT_PORT);
295 DBG1(DBG_IKE, "checking path %#H - %#H", me, other);
296 copy = packet->clone(packet);
297 copy->set_source(copy, me);
298 copy->set_destination(copy, other);
299 charon->sender->send(charon->sender, copy);
300 }
301 }
302 iterator->destroy(iterator);
303 me = packet->get_source(packet);
304 other = packet->get_destination(packet);
305 DBG1(DBG_IKE, "checking path %#H - %#H", me, other);
306 }
307
308 /**
309 * Implementation of task_t.process for initiator
310 */
311 static status_t build_i(private_ike_mobike_t *this, message_t *message)
312 {
313 if (message->get_exchange_type(message) == IKE_AUTH &&
314 message->get_payload(message, ID_INITIATOR))
315 {
316 message->add_notify(message, FALSE, MOBIKE_SUPPORTED, chunk_empty);
317 build_address_list(this, message);
318 }
319 else if (message->get_exchange_type(message) == INFORMATIONAL)
320 {
321 if (this->update)
322 {
323 message->add_notify(message, FALSE, UPDATE_SA_ADDRESSES, chunk_empty);
324 build_cookie(this, message);
325 update_children(this);
326 }
327 if (this->address)
328 {
329 build_address_list(this, message);
330 }
331 if (this->natd)
332 {
333 this->natd->task.build(&this->natd->task, message);
334 }
335 }
336 return NEED_MORE;
337 }
338
339 /**
340 * Implementation of task_t.process for responder
341 */
342 static status_t process_r(private_ike_mobike_t *this, message_t *message)
343 {
344 if (message->get_exchange_type(message) == IKE_AUTH &&
345 message->get_payload(message, ID_INITIATOR))
346 {
347 process_payloads(this, message);
348 }
349 else if (message->get_exchange_type(message) == INFORMATIONAL)
350 {
351 process_payloads(this, message);
352 if (this->update)
353 {
354 host_t *me, *other;
355
356 me = message->get_destination(message);
357 other = message->get_source(message);
358 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
359 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
360 }
361
362 if (this->natd)
363 {
364 this->natd->task.process(&this->natd->task, message);
365 }
366 }
367 return NEED_MORE;
368 }
369
370 /**
371 * Implementation of task_t.build for responder
372 */
373 static status_t build_r(private_ike_mobike_t *this, message_t *message)
374 {
375 if (message->get_exchange_type(message) == IKE_AUTH &&
376 this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
377 {
378 if (this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
379 {
380 message->add_notify(message, FALSE, MOBIKE_SUPPORTED, chunk_empty);
381 build_address_list(this, message);
382 }
383 return SUCCESS;
384 }
385 else if (message->get_exchange_type(message) == INFORMATIONAL)
386 {
387 if (this->natd)
388 {
389 this->natd->task.build(&this->natd->task, message);
390 }
391 if (this->cookie2.ptr)
392 {
393 message->add_notify(message, FALSE, COOKIE2, this->cookie2);
394 chunk_free(&this->cookie2);
395 }
396 if (this->update)
397 {
398 update_children(this);
399 }
400 return SUCCESS;
401 }
402 return NEED_MORE;
403 }
404
405 /**
406 * Implementation of task_t.process for initiator
407 */
408 static status_t process_i(private_ike_mobike_t *this, message_t *message)
409 {
410 if (message->get_exchange_type(message) == IKE_AUTH &&
411 this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
412 {
413 process_payloads(this, message);
414 return SUCCESS;
415 }
416 else if (message->get_exchange_type(message) == INFORMATIONAL)
417 {
418 u_int32_t updates = this->ike_sa->get_pending_updates(this->ike_sa) - 1;
419 this->ike_sa->set_pending_updates(this->ike_sa, updates);
420 if (updates > 0)
421 {
422 /* newer update queued, ignore this one */
423 return SUCCESS;
424 }
425 if (this->cookie2.ptr)
426 { /* check cookie if we included none */
427 chunk_t cookie2;
428
429 cookie2 = this->cookie2;
430 this->cookie2 = chunk_empty;
431 process_payloads(this, message);
432 if (!chunk_equals(cookie2, this->cookie2))
433 {
434 chunk_free(&cookie2);
435 DBG1(DBG_IKE, "COOKIE2 mismatch, closing IKE_SA");
436 return FAILED;
437 }
438 chunk_free(&cookie2);
439 }
440 else
441 {
442 process_payloads(this, message);
443 }
444 if (this->natd)
445 {
446 this->natd->task.process(&this->natd->task, message);
447 }
448 if (this->update)
449 {
450 /* update again, as NAT state may have changed */
451 update_children(this);
452 }
453 if (this->check)
454 {
455 host_t *me_new, *me_old, *other_new, *other_old;
456
457 me_new = message->get_destination(message);
458 other_new = message->get_source(message);
459 me_old = this->ike_sa->get_my_host(this->ike_sa);
460 other_old = this->ike_sa->get_other_host(this->ike_sa);
461
462 if (!me_new->equals(me_new, me_old))
463 {
464 this->update = TRUE;
465 this->ike_sa->set_my_host(this->ike_sa, me_new->clone(me_new));
466 }
467 if (!other_new->equals(other_new, other_old))
468 {
469 this->update = TRUE;
470 this->ike_sa->set_other_host(this->ike_sa, other_new->clone(other_new));
471 }
472 if (this->update)
473 {
474 /* start the update with the same task */
475 this->check = FALSE;
476 this->address = FALSE;
477 this->natd = ike_natd_create(this->ike_sa, this->initiator);
478 this->ike_sa->set_pending_updates(this->ike_sa, 1);
479 return NEED_MORE;
480 }
481 }
482 return SUCCESS;
483 }
484 return NEED_MORE;
485 }
486
487 /**
488 * Implementation of ike_mobike_t.roam.
489 */
490 static void roam(private_ike_mobike_t *this, bool address)
491 {
492 this->check = TRUE;
493 this->address = address;
494 this->ike_sa->set_pending_updates(this->ike_sa,
495 this->ike_sa->get_pending_updates(this->ike_sa) + 1);
496 }
497
498 /**
499 * Implementation of ike_mobike_t.is_probing.
500 */
501 static bool is_probing(private_ike_mobike_t *this)
502 {
503 return this->check;
504 }
505
506 /**
507 * Implementation of task_t.get_type
508 */
509 static task_type_t get_type(private_ike_mobike_t *this)
510 {
511 return IKE_MOBIKE;
512 }
513
514 /**
515 * Implementation of task_t.migrate
516 */
517 static void migrate(private_ike_mobike_t *this, ike_sa_t *ike_sa)
518 {
519 chunk_free(&this->cookie2);
520 this->ike_sa = ike_sa;
521 if (this->natd)
522 {
523 this->natd->task.migrate(&this->natd->task, ike_sa);
524 }
525 }
526
527 /**
528 * Implementation of task_t.destroy
529 */
530 static void destroy(private_ike_mobike_t *this)
531 {
532 chunk_free(&this->cookie2);
533 if (this->natd)
534 {
535 this->natd->task.destroy(&this->natd->task);
536 }
537 free(this);
538 }
539
540 /*
541 * Described in header.
542 */
543 ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator)
544 {
545 private_ike_mobike_t *this = malloc_thing(private_ike_mobike_t);
546
547 this->public.roam = (void(*)(ike_mobike_t*,bool))roam;
548 this->public.transmit = (void(*)(ike_mobike_t*,packet_t*))transmit;
549 this->public.is_probing = (bool(*)(ike_mobike_t*))is_probing;
550 this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
551 this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
552 this->public.task.destroy = (void(*)(task_t*))destroy;
553
554 if (initiator)
555 {
556 this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
557 this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
558 }
559 else
560 {
561 this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
562 this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
563 }
564
565 this->ike_sa = ike_sa;
566 this->initiator = initiator;
567 this->update = FALSE;
568 this->check = FALSE;
569 this->address = TRUE;
570 this->cookie2 = chunk_empty;
571 this->natd = NULL;
572
573 return &this->public;
574 }
575