denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-natd: Queue DPD after faking local NAT to check if UDP-encap can be disabled

Browse Source
This commit is contained in:
Tobias Brunner
2022-02-15 16:09:26 +01:00
parent 90b1d09e42
commit 011de0fe0d
1 changed files with 27 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_natd.c
+27 -8
View File
@@ -22,7 +22,7 @@
#include <config/peer_cfg.h> #include <config/peer_cfg.h>
#include <crypto/hashers/hasher.h> #include <crypto/hashers/hasher.h>
#include <encoding/payloads/notify_payload.h> #include <encoding/payloads/notify_payload.h>
#include <sa/ikev2/tasks/ike_mobike.h>
typedef struct private_ike_natd_t private_ike_natd_t; typedef struct private_ike_natd_t private_ike_natd_t;
@@ -255,12 +255,19 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
{ {
this->ike_sa->enable_extension(this->ike_sa, EXT_NATT); this->ike_sa->enable_extension(this->ike_sa, EXT_NATT);
if (this->fake_no_source_ip && this->dst_matched) if (this->fake_no_source_ip)
{ /* after we faked a NAT, we now see that we are not behind one. {
* we still have to register this as NAT to enable UDP-encap but if (this->dst_matched)
* we do so as actual local NAT, so DPDs will contain NAT-D { /* after we faked a NAT, we now see that we are not behind one.
* payloads and we can remove this condition later via MOBIKE */ * we still have to register this as NAT to enable UDP-encap but
this->dst_matched = FALSE; * we do so as actual local NAT, so DPDs will contain NAT-D
* payloads and we can remove this condition later via MOBIKE */
this->dst_matched = FALSE;
}
else
{ /* we are behind a NAT anyway, so nothing special to be done */
this->fake_no_source_ip = FALSE;
}
} }
else if (this->initiator && this->dst_matched && else if (this->initiator && this->dst_matched &&
this->ike_sa->has_condition(this->ike_sa, COND_NAT_HERE)) this->ike_sa->has_condition(this->ike_sa, COND_NAT_HERE))
@@ -291,7 +298,10 @@ METHOD(task_t, process_i, status_t,
if (message->get_exchange_type(message) == IKE_SA_INIT) if (message->get_exchange_type(message) == IKE_SA_INIT)
{ {
peer_cfg_t *peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa); peer_cfg_t *peer_cfg;
ike_mobike_t *mobike;
peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY) || if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY) ||
(peer_cfg->use_mobike(peer_cfg) && (peer_cfg->use_mobike(peer_cfg) &&
this->ike_sa->supports_extension(this->ike_sa, EXT_NATT))) this->ike_sa->supports_extension(this->ike_sa, EXT_NATT)))
@@ -301,6 +311,15 @@ METHOD(task_t, process_i, status_t,
* to actually do the switch (other than a forced DPD) */ * to actually do the switch (other than a forced DPD) */
this->ike_sa->float_ports(this->ike_sa); this->ike_sa->float_ports(this->ike_sa);
} }
if (this->fake_no_source_ip)
{ /* the NAT-D payloads revealed that we are not behind a NAT, so
* queue a MOBIKE-enabled DPD to check if UDP-encap can actually be
* disabled once we know if MOBIKE is supported */
mobike = ike_mobike_create(this->ike_sa, TRUE);
mobike->dpd(mobike);
this->ike_sa->queue_task(this->ike_sa, &mobike->task);
}
} }
return SUCCESS; return SUCCESS;
} }