aboutsummaryrefslogtreecommitdiffstats
path: root/src/charon/sa/tasks/ike_natd.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/charon/sa/tasks/ike_natd.c')
-rw-r--r--src/charon/sa/tasks/ike_natd.c70
1 files changed, 35 insertions, 35 deletions
diff --git a/src/charon/sa/tasks/ike_natd.c b/src/charon/sa/tasks/ike_natd.c
index f3a70c742..9121fe2ea 100644
--- a/src/charon/sa/tasks/ike_natd.c
+++ b/src/charon/sa/tasks/ike_natd.c
@@ -30,47 +30,47 @@ typedef struct private_ike_natd_t private_ike_natd_t;
* Private members of a ike_natd_t task.
*/
struct private_ike_natd_t {
-
+
/**
* Public methods and task_t interface.
*/
ike_natd_t public;
-
+
/**
* Assigned IKE_SA.
*/
ike_sa_t *ike_sa;
-
+
/**
* Are we the initiator?
*/
bool initiator;
-
+
/**
* Hasher used to build NAT detection hashes
*/
hasher_t *hasher;
-
+
/**
* Did we process any NAT detection notifys for a source address?
*/
bool src_seen;
-
+
/**
* Did we process any NAT detection notifys for a destination address?
*/
bool dst_seen;
-
+
/**
* Have we found a matching source address NAT hash?
*/
bool src_matched;
-
+
/**
* Have we found a matching destination address NAT hash?
*/
bool dst_matched;
-
+
/**
* whether NAT mappings for our NATed address has changed
*/
@@ -88,7 +88,7 @@ static chunk_t generate_natd_hash(private_ike_natd_t *this,
chunk_t natd_hash;
u_int64_t spi_i, spi_r;
u_int16_t port;
-
+
/* prepare all required chunks */
spi_i = ike_sa_id->get_initiator_spi(ike_sa_id);
spi_r = ike_sa_id->get_responder_spi(ike_sa_id);
@@ -100,13 +100,13 @@ static chunk_t generate_natd_hash(private_ike_natd_t *this,
port_chunk.ptr = (void*)&port;
port_chunk.len = sizeof(port);
addr_chunk = host->get_address(host);
-
+
/* natd_hash = SHA1( spi_i | spi_r | address | port ) */
natd_chunk = chunk_cat("cccc", spi_i_chunk, spi_r_chunk, addr_chunk, port_chunk);
this->hasher->allocate_hash(this->hasher, natd_chunk, &natd_hash);
DBG3(DBG_IKE, "natd_chunk %B", &natd_chunk);
DBG3(DBG_IKE, "natd_hash %B", &natd_hash);
-
+
chunk_free(&natd_chunk);
return natd_hash;
}
@@ -118,7 +118,7 @@ static chunk_t generate_natd_hash_faked(private_ike_natd_t *this)
{
rng_t *rng;
chunk_t chunk;
-
+
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng)
{
@@ -140,7 +140,7 @@ static notify_payload_t *build_natd_payload(private_ike_natd_t *this,
notify_payload_t *notify;
ike_sa_id_t *ike_sa_id;
ike_cfg_t *config;
-
+
ike_sa_id = this->ike_sa->get_id(this->ike_sa);
config = this->ike_sa->get_ike_cfg(this->ike_sa);
if (config->force_encap(config) && type == NAT_DETECTION_SOURCE_IP)
@@ -155,7 +155,7 @@ static notify_payload_t *build_natd_payload(private_ike_natd_t *this,
notify->set_notify_type(notify, type);
notify->set_notification_data(notify, hash);
chunk_free(&hash);
-
+
return notify;
}
@@ -171,17 +171,17 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
ike_sa_id_t *ike_sa_id;
host_t *me, *other;
ike_cfg_t *config;
-
+
/* Precompute NAT-D hashes for incoming NAT notify comparison */
ike_sa_id = message->get_ike_sa_id(message);
me = message->get_destination(message);
other = message->get_source(message);
dst_hash = generate_natd_hash(this, ike_sa_id, me);
src_hash = generate_natd_hash(this, ike_sa_id, other);
-
+
DBG3(DBG_IKE, "precalculated src_hash %B", &src_hash);
DBG3(DBG_IKE, "precalculated dst_hash %B", &dst_hash);
-
+
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
@@ -234,10 +234,10 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
}
}
enumerator->destroy(enumerator);
-
+
chunk_free(&src_hash);
chunk_free(&dst_hash);
-
+
if (this->src_seen && this->dst_seen)
{
this->ike_sa->enable_extension(this->ike_sa, EXT_NATT);
@@ -261,7 +261,7 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
static status_t process_i(private_ike_natd_t *this, message_t *message)
{
process_payloads(this, message);
-
+
if (message->get_exchange_type(message) == IKE_SA_INIT)
{
peer_cfg_t *peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
@@ -275,7 +275,7 @@ static status_t process_i(private_ike_natd_t *this, message_t *message)
return SUCCESS;
}
#endif /* ME */
-
+
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY) ||
#ifdef ME
/* if we are on a mediation connection we switch to port 4500 even
@@ -288,7 +288,7 @@ static status_t process_i(private_ike_natd_t *this, message_t *message)
this->ike_sa->supports_extension(this->ike_sa, EXT_NATT)))
{
host_t *me, *other;
-
+
/* do not switch if we have a custom port from mobike/NAT */
me = this->ike_sa->get_my_host(this->ike_sa);
if (me->get_port(me) == IKEV2_UDP_PORT)
@@ -302,7 +302,7 @@ static status_t process_i(private_ike_natd_t *this, message_t *message)
}
}
}
-
+
return SUCCESS;
}
@@ -314,18 +314,18 @@ static status_t build_i(private_ike_natd_t *this, message_t *message)
notify_payload_t *notify;
enumerator_t *enumerator;
host_t *host;
-
+
if (this->hasher == NULL)
{
DBG1(DBG_IKE, "unable to build NATD payloads, SHA1 not supported");
return NEED_MORE;
}
-
+
/* destination is always set */
host = message->get_destination(message);
notify = build_natd_payload(this, NAT_DETECTION_DESTINATION_IP, host);
message->add_payload(message, (payload_t*)notify);
-
+
/* source may be any, we have 3 possibilities to get our source address:
* 1. It is defined in the config => use the one of the IKE_SA
* 2. We do a routing lookup in the kernel interface
@@ -374,7 +374,7 @@ static status_t build_r(private_ike_natd_t *this, message_t *message)
{
notify_payload_t *notify;
host_t *me, *other;
-
+
/* only add notifies on successfull responses. */
if (message->get_exchange_type(message) == IKE_SA_INIT &&
message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
@@ -389,12 +389,12 @@ static status_t build_r(private_ike_natd_t *this, message_t *message)
DBG1(DBG_IKE, "unable to build NATD payloads, SHA1 not supported");
return SUCCESS;
}
-
+
/* initiator seems to support NAT detection, add response */
me = message->get_source(message);
notify = build_natd_payload(this, NAT_DETECTION_SOURCE_IP, me);
message->add_payload(message, (payload_t*)notify);
-
+
other = message->get_destination(message);
notify = build_natd_payload(this, NAT_DETECTION_DESTINATION_IP, other);
message->add_payload(message, (payload_t*)notify);
@@ -408,7 +408,7 @@ static status_t build_r(private_ike_natd_t *this, message_t *message)
static status_t process_r(private_ike_natd_t *this, message_t *message)
{
process_payloads(this, message);
-
+
return NEED_MORE;
}
@@ -460,7 +460,7 @@ ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
this->public.task.destroy = (void(*)(task_t*))destroy;
-
+
if (initiator)
{
this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -471,9 +471,9 @@ ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
}
-
+
this->public.has_mapping_changed = (bool(*)(ike_natd_t*))has_mapping_changed;
-
+
this->ike_sa = ike_sa;
this->initiator = initiator;
this->hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
@@ -482,6 +482,6 @@ ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
this->src_matched = FALSE;
this->dst_matched = FALSE;
this->mapping_changed = FALSE;
-
+
return &this->public;
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-28 13:56:56 +0000