1773f6b54de4d2f74db22aec4cf3c7b37395a931
[strongswan.git] / src / libcharon / sa / tasks / ike_mobike.c
1 /*
2 * Copyright (C) 2007 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "ike_mobike.h"
17
18 #include <string.h>
19
20 #include <hydra.h>
21 #include <daemon.h>
22 #include <sa/tasks/ike_natd.h>
23 #include <encoding/payloads/notify_payload.h>
24
25 #define COOKIE2_SIZE 16
26 #define MAX_ADDITIONAL_ADDRS 8
27
28 typedef struct private_ike_mobike_t private_ike_mobike_t;
29
30 /**
31 * Private members of a ike_mobike_t task.
32 */
33 struct private_ike_mobike_t {
34
35 /**
36 * Public methods and task_t interface.
37 */
38 ike_mobike_t public;
39
40 /**
41 * Assigned IKE_SA.
42 */
43 ike_sa_t *ike_sa;
44
45 /**
46 * Are we the initiator?
47 */
48 bool initiator;
49
50 /**
51 * cookie2 value to verify new addresses
52 */
53 chunk_t cookie2;
54
55 /**
56 * NAT discovery reusing the IKE_NATD task
57 */
58 ike_natd_t *natd;
59
60 /**
61 * use task to update addresses
62 */
63 bool update;
64
65 /**
66 * do routability check
67 */
68 bool check;
69
70 /**
71 * include address list update
72 */
73 bool address;
74
75 /**
76 * additional addresses got updated
77 */
78 bool addresses_updated;
79 };
80
81 /**
82 * flush the IKE_SAs list of additional addresses
83 */
84 static void flush_additional_addresses(private_ike_mobike_t *this)
85 {
86 iterator_t *iterator;
87 host_t *host;
88
89 iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa);
90 while (iterator->iterate(iterator, (void**)&host))
91 {
92 iterator->remove(iterator);
93 host->destroy(host);
94 }
95 iterator->destroy(iterator);
96 }
97
98
99 /**
100 * read notifys from message and evaluate them
101 */
102 static void process_payloads(private_ike_mobike_t *this, message_t *message)
103 {
104 enumerator_t *enumerator;
105 payload_t *payload;
106 bool first = TRUE;
107
108 enumerator = message->create_payload_enumerator(message);
109 while (enumerator->enumerate(enumerator, &payload))
110 {
111 int family = AF_INET;
112 notify_payload_t *notify;
113 chunk_t data;
114 host_t *host;
115
116 if (payload->get_type(payload) != NOTIFY)
117 {
118 continue;
119 }
120 notify = (notify_payload_t*)payload;
121 switch (notify->get_notify_type(notify))
122 {
123 case MOBIKE_SUPPORTED:
124 {
125 peer_cfg_t *peer_cfg;
126
127 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
128 if (!this->initiator &&
129 peer_cfg && !peer_cfg->use_mobike(peer_cfg))
130 {
131 DBG1(DBG_IKE, "peer supports MOBIKE, but disabled in config");
132 }
133 else
134 {
135 DBG1(DBG_IKE, "peer supports MOBIKE");
136 this->ike_sa->enable_extension(this->ike_sa, EXT_MOBIKE);
137 }
138 break;
139 }
140 case COOKIE2:
141 {
142 chunk_free(&this->cookie2);
143 this->cookie2 = chunk_clone(notify->get_notification_data(notify));
144 break;
145 }
146 case ADDITIONAL_IP6_ADDRESS:
147 {
148 family = AF_INET6;
149 /* fall through */
150 }
151 case ADDITIONAL_IP4_ADDRESS:
152 {
153 if (first)
154 { /* an ADDITIONAL_*_ADDRESS means replace, so flush once */
155 flush_additional_addresses(this);
156 first = FALSE;
157 }
158 data = notify->get_notification_data(notify);
159 host = host_create_from_chunk(family, data, 0);
160 DBG2(DBG_IKE, "got additional MOBIKE peer address: %H", host);
161 this->ike_sa->add_additional_address(this->ike_sa, host);
162 this->addresses_updated = TRUE;
163 break;
164 }
165 case UPDATE_SA_ADDRESSES:
166 {
167 this->update = TRUE;
168 break;
169 }
170 case NO_ADDITIONAL_ADDRESSES:
171 {
172 flush_additional_addresses(this);
173 this->addresses_updated = TRUE;
174 break;
175 }
176 case NAT_DETECTION_SOURCE_IP:
177 case NAT_DETECTION_DESTINATION_IP:
178 {
179 /* NAT check in this MOBIKE exchange, create subtask for it */
180 if (this->natd == NULL)
181 {
182 this->natd = ike_natd_create(this->ike_sa, this->initiator);
183 }
184 break;
185 }
186 default:
187 break;
188 }
189 }
190 enumerator->destroy(enumerator);
191 }
192
193 /**
194 * Add ADDITIONAL_*_ADDRESS notifys depending on our address list
195 */
196 static void build_address_list(private_ike_mobike_t *this, message_t *message)
197 {
198 enumerator_t *enumerator;
199 host_t *host, *me;
200 notify_type_t type;
201 int added = 0;
202
203 me = this->ike_sa->get_my_host(this->ike_sa);
204 enumerator = hydra->kernel_interface->create_address_enumerator(
205 hydra->kernel_interface, FALSE, FALSE);
206 while (enumerator->enumerate(enumerator, (void**)&host))
207 {
208 if (me->ip_equals(me, host))
209 { /* "ADDITIONAL" means do not include IKE_SAs host */
210 continue;
211 }
212 switch (host->get_family(host))
213 {
214 case AF_INET:
215 type = ADDITIONAL_IP4_ADDRESS;
216 break;
217 case AF_INET6:
218 type = ADDITIONAL_IP6_ADDRESS;
219 break;
220 default:
221 continue;
222 }
223 message->add_notify(message, FALSE, type, host->get_address(host));
224 if (++added >= MAX_ADDITIONAL_ADDRS)
225 { /* limit number of notifys, some implementations do not like too
226 * many of them (f.e. strongSwan ;-) */
227 break;
228 }
229 }
230 if (!added)
231 {
232 message->add_notify(message, FALSE, NO_ADDITIONAL_ADDRESSES, chunk_empty);
233 }
234 enumerator->destroy(enumerator);
235 }
236
237 /**
238 * build a cookie and add it to the message
239 */
240 static void build_cookie(private_ike_mobike_t *this, message_t *message)
241 {
242 rng_t *rng;
243
244 chunk_free(&this->cookie2);
245 rng = lib->crypto->create_rng(lib->crypto, RNG_STRONG);
246 if (rng)
247 {
248 rng->allocate_bytes(rng, COOKIE2_SIZE, &this->cookie2);
249 rng->destroy(rng);
250 message->add_notify(message, FALSE, COOKIE2, this->cookie2);
251 }
252 }
253
254 /**
255 * update addresses of associated CHILD_SAs
256 */
257 static void update_children(private_ike_mobike_t *this)
258 {
259 iterator_t *iterator;
260 child_sa_t *child_sa;
261
262 iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa);
263 while (iterator->iterate(iterator, (void**)&child_sa))
264 {
265 if (child_sa->update(child_sa,
266 this->ike_sa->get_my_host(this->ike_sa),
267 this->ike_sa->get_other_host(this->ike_sa),
268 this->ike_sa->get_virtual_ip(this->ike_sa, TRUE),
269 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY)) == NOT_SUPPORTED)
270 {
271 this->ike_sa->rekey_child_sa(this->ike_sa,
272 child_sa->get_protocol(child_sa),
273 child_sa->get_spi(child_sa, TRUE));
274 }
275 }
276 iterator->destroy(iterator);
277 }
278
279 /**
280 * Apply the port of the old host, if its ip equals the new, use port otherwise.
281 */
282 static void apply_port(host_t *host, host_t *old, u_int16_t port)
283 {
284 if (host->ip_equals(host, old))
285 {
286 port = old->get_port(old);
287 }
288 else if (port == IKEV2_UDP_PORT)
289 {
290 port = IKEV2_NATT_PORT;
291 }
292 host->set_port(host, port);
293 }
294
295 METHOD(ike_mobike_t, transmit, void,
296 private_ike_mobike_t *this, packet_t *packet)
297 {
298 host_t *me, *other, *me_old, *other_old;
299 iterator_t *iterator;
300 ike_cfg_t *ike_cfg;
301 packet_t *copy;
302
303 if (!this->check)
304 {
305 return;
306 }
307
308 me_old = this->ike_sa->get_my_host(this->ike_sa);
309 other_old = this->ike_sa->get_other_host(this->ike_sa);
310 ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
311
312 me = hydra->kernel_interface->get_source_addr(
313 hydra->kernel_interface, other_old, NULL);
314 if (me)
315 {
316 apply_port(me, me_old, ike_cfg->get_my_port(ike_cfg));
317 DBG1(DBG_IKE, "checking original path %#H - %#H", me, other_old);
318 copy = packet->clone(packet);
319 copy->set_source(copy, me);
320 charon->sender->send(charon->sender, copy);
321 }
322
323 iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa);
324 while (iterator->iterate(iterator, (void**)&other))
325 {
326 me = hydra->kernel_interface->get_source_addr(
327 hydra->kernel_interface, other, NULL);
328 if (me)
329 {
330 if (me->get_family(me) != other->get_family(other))
331 {
332 me->destroy(me);
333 continue;
334 }
335 /* reuse port for an active address, 4500 otherwise */
336 apply_port(me, me_old, ike_cfg->get_my_port(ike_cfg));
337 other = other->clone(other);
338 apply_port(other, other_old, ike_cfg->get_other_port(ike_cfg));
339 DBG1(DBG_IKE, "checking path %#H - %#H", me, other);
340 copy = packet->clone(packet);
341 copy->set_source(copy, me);
342 copy->set_destination(copy, other);
343 charon->sender->send(charon->sender, copy);
344 }
345 }
346 iterator->destroy(iterator);
347 }
348
349 METHOD(task_t, build_i, status_t,
350 private_ike_mobike_t *this, message_t *message)
351 {
352 if (message->get_exchange_type(message) == IKE_AUTH &&
353 message->get_message_id(message) == 1)
354 { /* only in first IKE_AUTH */
355 message->add_notify(message, FALSE, MOBIKE_SUPPORTED, chunk_empty);
356 build_address_list(this, message);
357 }
358 else if (message->get_exchange_type(message) == INFORMATIONAL)
359 {
360 host_t *old, *new;
361
362 /* we check if the existing address is still valid */
363 old = message->get_source(message);
364 new = hydra->kernel_interface->get_source_addr(hydra->kernel_interface,
365 message->get_destination(message), old);
366 if (new)
367 {
368 if (!new->ip_equals(new, old))
369 {
370 new->set_port(new, old->get_port(old));
371 message->set_source(message, new);
372 }
373 else
374 {
375 new->destroy(new);
376 }
377 }
378 if (this->update)
379 {
380 message->add_notify(message, FALSE, UPDATE_SA_ADDRESSES,
381 chunk_empty);
382 build_cookie(this, message);
383 update_children(this);
384 }
385 if (this->address)
386 {
387 build_address_list(this, message);
388 }
389 if (this->natd)
390 {
391 this->natd->task.build(&this->natd->task, message);
392 }
393 }
394 return NEED_MORE;
395 }
396
397 METHOD(task_t, process_r, status_t,
398 private_ike_mobike_t *this, message_t *message)
399 {
400 if (message->get_exchange_type(message) == IKE_AUTH &&
401 message->get_message_id(message) == 1)
402 { /* only first IKE_AUTH */
403 process_payloads(this, message);
404 }
405 else if (message->get_exchange_type(message) == INFORMATIONAL)
406 {
407 process_payloads(this, message);
408 if (this->update)
409 {
410 host_t *me, *other;
411
412 me = message->get_destination(message);
413 other = message->get_source(message);
414 this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
415 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
416 }
417
418 if (this->natd)
419 {
420 this->natd->task.process(&this->natd->task, message);
421 }
422 if (this->addresses_updated && this->ike_sa->has_condition(this->ike_sa,
423 COND_ORIGINAL_INITIATOR))
424 {
425 host_t *other = message->get_source(message);
426 host_t *other_old = this->ike_sa->get_other_host(this->ike_sa);
427 if (!other->equals(other, other_old))
428 {
429 DBG1(DBG_IKE, "remote address changed from %H to %H", other_old,
430 other);
431 this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
432 this->update = TRUE;
433 }
434 }
435 }
436 return NEED_MORE;
437 }
438
439 METHOD(task_t, build_r, status_t,
440 private_ike_mobike_t *this, message_t *message)
441 {
442 if (message->get_exchange_type(message) == IKE_AUTH &&
443 this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
444 {
445 if (this->ike_sa->supports_extension(this->ike_sa, EXT_MOBIKE))
446 {
447 message->add_notify(message, FALSE, MOBIKE_SUPPORTED, chunk_empty);
448 build_address_list(this, message);
449 }
450 return SUCCESS;
451 }
452 else if (message->get_exchange_type(message) == INFORMATIONAL)
453 {
454 if (this->natd)
455 {
456 this->natd->task.build(&this->natd->task, message);
457 }
458 if (this->cookie2.ptr)
459 {
460 message->add_notify(message, FALSE, COOKIE2, this->cookie2);
461 chunk_free(&this->cookie2);
462 }
463 if (this->update)
464 {
465 update_children(this);
466 }
467 return SUCCESS;
468 }
469 return NEED_MORE;
470 }
471
472 METHOD(task_t, process_i, status_t,
473 private_ike_mobike_t *this, message_t *message)
474 {
475 if (message->get_exchange_type(message) == IKE_AUTH &&
476 this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
477 {
478 process_payloads(this, message);
479 return SUCCESS;
480 }
481 else if (message->get_exchange_type(message) == INFORMATIONAL)
482 {
483 u_int32_t updates = this->ike_sa->get_pending_updates(this->ike_sa) - 1;
484 this->ike_sa->set_pending_updates(this->ike_sa, updates);
485 if (updates > 0)
486 {
487 /* newer update queued, ignore this one */
488 return SUCCESS;
489 }
490 if (this->cookie2.ptr)
491 { /* check cookie if we included one */
492 chunk_t cookie2;
493
494 cookie2 = this->cookie2;
495 this->cookie2 = chunk_empty;
496 process_payloads(this, message);
497 if (!chunk_equals(cookie2, this->cookie2))
498 {
499 chunk_free(&cookie2);
500 DBG1(DBG_IKE, "COOKIE2 mismatch, closing IKE_SA");
501 return FAILED;
502 }
503 chunk_free(&cookie2);
504 }
505 else
506 {
507 process_payloads(this, message);
508 }
509 if (this->natd)
510 {
511 this->natd->task.process(&this->natd->task, message);
512 if (this->natd->has_mapping_changed(this->natd))
513 {
514 /* force an update if mappings have changed */
515 this->update = this->check = TRUE;
516 DBG1(DBG_IKE, "detected changes in NAT mappings, "
517 "initiating MOBIKE update");
518 }
519 }
520 if (this->update)
521 {
522 /* update again, as NAT state may have changed */
523 update_children(this);
524 }
525 if (this->check)
526 {
527 host_t *me_new, *me_old, *other_new, *other_old;
528
529 me_new = message->get_destination(message);
530 other_new = message->get_source(message);
531 me_old = this->ike_sa->get_my_host(this->ike_sa);
532 other_old = this->ike_sa->get_other_host(this->ike_sa);
533
534 if (!me_new->equals(me_new, me_old))
535 {
536 this->update = TRUE;
537 this->ike_sa->set_my_host(this->ike_sa, me_new->clone(me_new));
538 }
539 if (!other_new->equals(other_new, other_old))
540 {
541 this->update = TRUE;
542 this->ike_sa->set_other_host(this->ike_sa, other_new->clone(other_new));
543 }
544 if (this->update)
545 {
546 if (!this->ike_sa->has_condition(this->ike_sa,
547 COND_ORIGINAL_INITIATOR))
548 {
549 update_children(this);
550 return SUCCESS;
551 }
552 /* original initiator starts the update with the same task */
553 this->check = FALSE;
554 this->address = FALSE;
555 if (this->natd)
556 {
557 this->natd->task.destroy(&this->natd->task);
558 }
559 this->natd = ike_natd_create(this->ike_sa, this->initiator);
560 this->ike_sa->set_pending_updates(this->ike_sa, 1);
561 return NEED_MORE;
562 }
563 }
564 return SUCCESS;
565 }
566 return NEED_MORE;
567 }
568
569 METHOD(ike_mobike_t, addresses, void,
570 private_ike_mobike_t *this)
571 {
572 this->address = TRUE;
573 this->ike_sa->set_pending_updates(this->ike_sa,
574 this->ike_sa->get_pending_updates(this->ike_sa) + 1);
575 }
576
577 METHOD(ike_mobike_t, roam, void,
578 private_ike_mobike_t *this, bool address)
579 {
580 this->check = TRUE;
581 this->address = address;
582 this->ike_sa->set_pending_updates(this->ike_sa,
583 this->ike_sa->get_pending_updates(this->ike_sa) + 1);
584 }
585
586 METHOD(ike_mobike_t, dpd, void,
587 private_ike_mobike_t *this)
588 {
589 if (!this->natd)
590 {
591 this->natd = ike_natd_create(this->ike_sa, this->initiator);
592 }
593 this->ike_sa->set_pending_updates(this->ike_sa,
594 this->ike_sa->get_pending_updates(this->ike_sa) + 1);
595 }
596
597 METHOD(ike_mobike_t, is_probing, bool,
598 private_ike_mobike_t *this)
599 {
600 return this->check;
601 }
602
603 METHOD(task_t, get_type, task_type_t,
604 private_ike_mobike_t *this)
605 {
606 return IKE_MOBIKE;
607 }
608
609 METHOD(task_t, migrate, void,
610 private_ike_mobike_t *this, ike_sa_t *ike_sa)
611 {
612 chunk_free(&this->cookie2);
613 this->ike_sa = ike_sa;
614 if (this->natd)
615 {
616 this->natd->task.migrate(&this->natd->task, ike_sa);
617 }
618 }
619
620 METHOD(task_t, destroy, void,
621 private_ike_mobike_t *this)
622 {
623 chunk_free(&this->cookie2);
624 if (this->natd)
625 {
626 this->natd->task.destroy(&this->natd->task);
627 }
628 free(this);
629 }
630
631 /*
632 * Described in header.
633 */
634 ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator)
635 {
636 private_ike_mobike_t *this;
637
638 INIT(this,
639 .public = {
640 .task = {
641 .get_type = _get_type,
642 .migrate = _migrate,
643 .destroy = _destroy,
644 },
645 .addresses = _addresses,
646 .roam = _roam,
647 .dpd = _dpd,
648 .transmit = _transmit,
649 .is_probing = _is_probing,
650 },
651 .ike_sa = ike_sa,
652 .initiator = initiator,
653 );
654
655 if (initiator)
656 {
657 this->public.task.build = _build_i;
658 this->public.task.process = _process_i;
659 }
660 else
661 {
662 this->public.task.build = _build_r;
663 this->public.task.process = _process_r;
664 }
665
666 return &this->public;
667 }
668