denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

further mobike improvements, regarding to NAT-T

Browse Source
This commit is contained in:
Martin Willi
2007-06-27 13:10:55 +00:00
parent 6fa8bd61c1
commit fc2d1c420f
9 changed files with 83 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/tasks/ike_mobike.c
+37 -6
View File
@@ -143,6 +143,16 @@ static void process_payloads(private_ike_mobike_t *this, message_t *message)
flush_additional_addresses(this);
break;
}
case NAT_DETECTION_SOURCE_IP:
case NAT_DETECTION_DESTINATION_IP:
{
/* NAT check in this MOBIKE exchange, create subtask for it */
if (this->natd == NULL)
{
this->natd = ike_natd_create(this->ike_sa, this->initiator);
}
break;
}
default:
break;
}
@@ -205,10 +215,12 @@ static status_t build_i(private_ike_mobike_t *this, message_t *message)
{ /* address change */
message->add_notify(message, FALSE, UPDATE_SA_ADDRESSES, chunk_empty);
build_address_list(this, message);
/* TODO: NAT discovery */
/* set new addresses */
this->ike_sa->update_hosts(this->ike_sa, this->me, this->other);
if (this->natd)
{
this->natd->task.build(&this->natd->task, message);
}
}
return NEED_MORE;
@@ -219,13 +231,19 @@ static status_t build_i(private_ike_mobike_t *this, message_t *message)
*/
static status_t process_r(private_ike_mobike_t *this, message_t *message)
{
if ((message->get_exchange_type(message) == IKE_AUTH &&
message->get_payload(message, SECURITY_ASSOCIATION)) ||
message->get_exchange_type(message) == INFORMATIONAL)
if (message->get_exchange_type(message) == IKE_AUTH &&
message->get_payload(message, SECURITY_ASSOCIATION))
{
process_payloads(this, message);
}
else if (message->get_exchange_type(message) == INFORMATIONAL)
{
process_payloads(this, message);
if (this->natd)
{
this->natd->task.process(&this->natd->task, message);
}
}
return NEED_MORE;
}
@@ -246,6 +264,10 @@ static status_t build_r(private_ike_mobike_t *this, message_t *message)
}
else if (message->get_exchange_type(message) == INFORMATIONAL)
{
if (this->natd)
{
this->natd->task.build(&this->natd->task, message);
}
return SUCCESS;
}
return NEED_MORE;
@@ -260,10 +282,16 @@ static status_t process_i(private_ike_mobike_t *this, message_t *message)
message->get_payload(message, SECURITY_ASSOCIATION))
{
process_payloads(this, message);
return SUCCESS;
}
else if (message->get_exchange_type(message) == INFORMATIONAL)
{
process_payloads(this, message);
if (this->natd)
{
this->natd->task.process(&this->natd->task, message);
}
return SUCCESS;
}
return NEED_MORE;
@@ -276,6 +304,9 @@ static void roam(private_ike_mobike_t *this, host_t *me, host_t *other)
{
this->me = me;
this->other = other;
/* include NAT detection when roaming */
this->natd = ike_natd_create(this->ike_sa, this->initiator);
}
/**
src/charon/sa/tasks/ike_natd.c
+12 -12
View File
@@ -204,15 +204,11 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
if (this->src_seen && this->dst_seen)
{
this->ike_sa->enable_extension(this->ike_sa, EXT_NATT);
if (!this->dst_matched)
{
this->ike_sa->set_condition(this->ike_sa, COND_NAT_HERE, TRUE);
}
if (!this->src_matched)
{
this->ike_sa->set_condition(this->ike_sa, COND_NAT_THERE, TRUE);
}
this->ike_sa->set_condition(this->ike_sa, COND_NAT_HERE,
!this->dst_matched);
this->ike_sa->set_condition(this->ike_sa, COND_NAT_THERE,
!this->src_matched);
}
}
@@ -222,8 +218,11 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
static status_t process_i(private_ike_natd_t *this, message_t *message)
{
process_payloads(this, message);
if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
/* if peer supports NAT-T, we switch to port 4500 even
* if no NAT is detected. MOBIKE requires this. */
if (message->get_exchange_type(message) == IKE_SA_INIT &&
this->ike_sa->supports_extension(this->ike_sa, EXT_NATT))
{
host_t *me, *other;
@@ -297,7 +296,8 @@ static status_t build_r(private_ike_natd_t *this, message_t *message)
host_t *me, *other;
/* only add notifies on successfull responses. */
if (message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
if (message->get_exchange_type(message) == IKE_SA_INIT &&
message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
{
return SUCCESS;
}