use MOBIKE enabled DPD if we are NATed

update SAs if we detect changes in NAT mappings

src/charon/sa/tasks/ike_mobike.c

@@ -434,7 +434,7 @@ static status_t process_i(private_ike_mobike_t *this, message_t *message)
 			return SUCCESS;
 		}
 		if (this->cookie2.ptr)
-		{	/* check cookie if we included none */
+		{	/* check cookie if we included one */
 			chunk_t cookie2;
 			
 			cookie2 = this->cookie2;
@@ -455,6 +455,13 @@ static status_t process_i(private_ike_mobike_t *this, message_t *message)
 		if (this->natd)
 		{
 			this->natd->task.process(&this->natd->task, message);
+			if (this->natd->has_mapping_changed(this->natd))
+			{
+				/* force an update if mappings have changed */
+				this->update = this->check = TRUE;
+				DBG1(DBG_IKE, "detected changes in NAT mappings, "
+					 "initiating MOBIKE update");
+			}
 		}
 		if (this->update)
 		{
@@ -506,6 +513,20 @@ static void roam(private_ike_mobike_t *this, bool address)
 							this->ike_sa->get_pending_updates(this->ike_sa) + 1);
 }
 
+/**
+ * Implementation of ike_mobike_t.dpd
+ */
+static void dpd(private_ike_mobike_t *this)
+{
+	if (!this->natd)
+	{
+		this->natd = ike_natd_create(this->ike_sa, this->initiator);
+	}
+	this->address = FALSE;
+	this->ike_sa->set_pending_updates(this->ike_sa, 
+							this->ike_sa->get_pending_updates(this->ike_sa) + 1);
+}
+
 /**
  * Implementation of ike_mobike_t.is_probing.
  */
@@ -556,6 +577,7 @@ ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator)
 	private_ike_mobike_t *this = malloc_thing(private_ike_mobike_t);
 
 	this->public.roam = (void(*)(ike_mobike_t*,bool))roam;
+	this->public.dpd = (void(*)(ike_mobike_t*))dpd;
 	this->public.transmit = (void(*)(ike_mobike_t*,packet_t*))transmit;
 	this->public.is_probing = (bool(*)(ike_mobike_t*))is_probing;
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;

src/charon/sa/tasks/ike_mobike.h

@@ -54,6 +54,11 @@ struct ike_mobike_t {
 	 */
 	void (*roam)(ike_mobike_t *this, bool address);
 	
+	/**
+	 * Use the task for a DPD check which detects changes in NAT mappings.
+	 */
+	void (*dpd)(ike_mobike_t *this);
+	
 	/**
 	 * Transmision hook, called by task manager.
 	 *

src/charon/sa/tasks/ike_natd.c

@@ -72,6 +72,11 @@ struct private_ike_natd_t {
 	 * Have we found a matching destination address NAT hash?
 	 */
 	bool dst_matched;
+	
+	/**
+	 * whether NAT mappings for our NATed address has changed
+	 */
+	bool mapping_changed;
 };
 
 
@@ -192,15 +197,24 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
 			case NAT_DETECTION_DESTINATION_IP:
 			{
 				this->dst_seen = TRUE;
+				hash = notify->get_notification_data(notify);
 				if (!this->dst_matched)
 				{
-					hash = notify->get_notification_data(notify);
 					DBG3(DBG_IKE, "received dst_hash %B", &hash);
 					if (chunk_equals(hash, dst_hash))
 					{
 						this->dst_matched = TRUE;
 					}
 				}
+				/* RFC4555 says we should also compare against IKE_SA_INIT
+				 * NATD payloads, but this does not work: We are running
+				 * there at port 500, but use 4500 afterwards... */
+				if (message->get_exchange_type(message) == INFORMATIONAL &&
+					this->initiator && !this->dst_matched)
+				{
+					this->mapping_changed = this->ike_sa->has_mapping_changed(
+															this->ike_sa, hash);
+				}
 				break;
 			}
 			case NAT_DETECTION_SOURCE_IP:
@@ -415,6 +429,15 @@ static void migrate(private_ike_natd_t *this, ike_sa_t *ike_sa)
 	this->dst_seen = FALSE;
 	this->src_matched = FALSE;
 	this->dst_matched = FALSE;
+	this->mapping_changed = FALSE;
+}
+
+/**
+ * Implementation of ike_natd_t.has_mapping_changed
+ */
+static bool has_mapping_changed(private_ike_natd_t *this)
+{
+	return this->mapping_changed;
 }
 
 /**
@@ -448,6 +471,8 @@ ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 	}
 	
+	this->public.has_mapping_changed = (bool(*)(ike_natd_t*))has_mapping_changed;
+	
 	this->ike_sa = ike_sa;
 	this->initiator = initiator;
 	this->hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
@@ -455,6 +480,7 @@ ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
 	this->dst_seen = FALSE;
 	this->src_matched = FALSE;
 	this->dst_matched = FALSE;
+	this->mapping_changed = FALSE;
 	
 	return &this->public;
 }

src/charon/sa/tasks/ike_natd.h

@@ -38,6 +38,15 @@ struct ike_natd_t {
 	 * Implements the task_t interface
 	 */
 	task_t task;
+	
+	/**
+	 * Check if the NAT mapping has changed for our address.
+	 *
+	 * MOBIKE uses NAT payloads in DPD to detect changes in the NAT mappings.
+	 *
+	 * @return 	TRUE if mappings have changed
+	 */
+	bool (*has_mapping_changed)(ike_natd_t *this);
 };
 
 /**