/* return values:
* 1 = ICE completed, interfaces selected
* 0 = packet processed
* -1 = generic error, process packet as normal
* -2 = role conflict
*/
int ice_request(struct packet_stream *ps, struct sockaddr_in6 *src, struct in6_addr *dst,
struct stun_attrs *attrs)
{
struct call_media *media = ps->media;
struct ice_agent *ag;
struct interface_address *ifa;
const char *err;
struct ice_candidate *cand;
struct ice_candidate_pair *pair;
int ret;
__DBG("received ICE request from %s on %s", smart_ntop_port_buf(src), smart_ntop_buf(dst));
ag = media->ice_agent;
if (!ag)
return -1;
atomic64_set(&ag->last_activity, poller_now);
ifa = get_interface_from_address(ag->local_interface, dst);
err = "ICE/STUN binding request received on unknown local interface address";
if (!ifa)
goto err;
/* determine candidate pair */
mutex_lock(&ag->lock);
cand = __cand_lookup(ag, src, ps->component);
if (!cand)
pair = __learned_candidate(ag, ps, src, ifa, attrs->priority, attrs->use);
else
pair = __pair_lookup(ag, cand, ifa);
err = "Failed to determine ICE candidate from STUN request";
if (!pair)
goto err_unlock;
mutex_unlock(&ag->lock);
/* determine role conflict */
if (attrs->controlling && AGENT_ISSET(ag, CONTROLLING)) {
if (tie_breaker >= attrs->tiebreaker)
return -2;
else
__role_change(ag, 0);
}
else if (attrs->controlled && !AGENT_ISSET(ag, CONTROLLING)) {
if (tie_breaker >= attrs->tiebreaker)
__role_change(ag, 1);
else
return -2;
}
if (PAIR_ISSET(pair, SUCCEEDED))
;
else
__trigger_check(pair);
ret = 0;
if (attrs->use && !PAIR_SET(pair, NOMINATED)) {
ilog(LOG_DEBUG, "ICE pair "PAIR_FORMAT" has been nominated by peer", PAIR_FMT(pair));
mutex_lock(&ag->lock);
g_tree_insert(ag->nominated_pairs, pair, pair);
if (PAIR_ISSET(pair, SUCCEEDED)) {
PAIR_SET(pair, VALID);
g_tree_insert(ag->valid_pairs, pair, pair);
}
if (!AGENT_ISSET(ag, CONTROLLING))
ret = __check_valid(ag);
mutex_unlock(&ag->lock);
}
return ret;
err_unlock:
mutex_unlock(&ag->lock);
err:
ilog(LOG_NOTICE, "%s (from %s on interface %s)", err, smart_ntop_port_buf(src), smart_ntop_buf(dst));
return 0;
}
/* call is locked in R */
int ice_response(struct packet_stream *ps, struct sockaddr_in6 *src, struct in6_addr *dst,
struct stun_attrs *attrs, u_int32_t transaction[3])
{
struct ice_candidate_pair *pair, *opair;
struct ice_agent *ag;
struct call_media *media = ps->media;
const char *err;
unsigned int component;
struct ice_candidate *cand;
struct interface_address *ifa;
int ret, was_ctl;
__DBG("received ICE response from %s on %s", smart_ntop_port_buf(src), smart_ntop_buf(dst));
ag = media->ice_agent;
if (!ag)
return -1;
atomic64_set(&ag->last_activity, poller_now);
mutex_lock(&ag->lock);
pair = g_hash_table_lookup(ag->transaction_hash, transaction);
err = "ICE/STUN response with unknown transaction received";
if (!pair)
goto err_unlock;
was_ctl = pair->was_controlling;
mutex_unlock(&ag->lock);
ifa = pair->local_address;
ilog(LOG_DEBUG, "Received ICE/STUN response code %u for candidate pair "PAIR_FORMAT" from %s to %s",
attrs->error_code, PAIR_FMT(pair),
smart_ntop_ep_buf(&pair->remote_candidate->endpoint),
smart_ntop_buf(&ifa->addr));
/* verify endpoints */
err = "ICE/STUN response received, but source address didn't match remote candidate address";
if (memcmp(&src->sin6_addr, &pair->remote_candidate->endpoint.ip46, sizeof(src->sin6_addr)))
goto err;
if (ntohs(src->sin6_port) != pair->remote_candidate->endpoint.port)
goto err;
err = "ICE/STUN response received, but destination address didn't match local interface address";
if (memcmp(dst, &ifa->addr, sizeof(*dst)))
goto err;
if (pair->packet_stream != ps)
goto err;
PAIR_CLEAR(pair, IN_PROGRESS);
ret = 0;
/* handle all errors */
if (attrs->error_code) {
err = "ICE/STUN error received";
if (attrs->error_code != 487)
goto err;
__role_change(ag, !was_ctl);
__trigger_check(pair);
goto out;
}
/* we don't discover peer reflexive here (RFC 5245 7.1.3.2.1) as we don't expect to be behind NAT */
/* we also skip parts of 7.1.3.2.2 as we don't do server reflexive */
mutex_lock(&ag->lock);
/* check if we're in the final (controlling) phase */
if (pair->was_nominated && PAIR_CLEAR(pair, TO_USE)) {
ilog(LOG_DEBUG, "Setting nominated ICE candidate pair "PAIR_FORMAT" as valid", PAIR_FMT(pair));
PAIR_SET(pair, VALID);
g_tree_insert(ag->valid_pairs, pair, pair);
ret = __check_valid(ag);
goto out_unlock;
}
if (PAIR_SET(pair, SUCCEEDED))
goto out_unlock;
ilog(LOG_DEBUG, "Setting ICE candidate pair "PAIR_FORMAT" as succeeded", PAIR_FMT(pair));
g_tree_insert(ag->succeeded_pairs, pair, pair);
if (!ag->start_nominating.tv_sec) {
if (__check_succeeded_complete(ag)) {
ag->start_nominating = g_now;
timeval_add_usec(&ag->start_nominating, 100000);
__agent_schedule_abs(ag, &ag->start_nominating);
}
}
/* now unfreeze all other pairs from the same foundation */
for (component = 1; component <= MAX_COMPONENTS; component++) {
if (component == ps->component)
continue;
cand = __foundation_lookup(ag, &pair->remote_candidate->foundation, component);
if (!cand)
continue;
opair = __pair_lookup(ag, cand, ifa);
if (!opair)
continue;
if (PAIR_ISSET(opair, FAILED))
continue;
if (!PAIR_CLEAR(opair, FROZEN))
continue;
ilog(LOG_DEBUG, "Unfreezing related ICE pair "PAIR_FORMAT, PAIR_FMT(opair));
}
/* if this was previously nominated by the peer, it's now valid */
if (PAIR_ISSET(pair, NOMINATED)) {
PAIR_SET(pair, VALID);
g_tree_insert(ag->valid_pairs, pair, pair);
if (!AGENT_ISSET(ag, CONTROLLING))
ret = __check_valid(ag);
}
out_unlock:
mutex_unlock(&ag->lock);
out:
return ret;
err_unlock:
mutex_unlock(&ag->lock);
err:
if (err)
ilog(LOG_NOTICE, "%s (from %s on interface %s)",
err, smart_ntop_port_buf(src), smart_ntop_buf(dst));
if (pair && attrs->error_code)
__fail_pair(pair);
return 0;
}
/* call must be locked R or W, agent must not be locked */
static void __do_ice_checks(struct ice_agent *ag) {
GList *l;
struct ice_candidate_pair *pair, *highest = NULL, *frozen = NULL, *valid;
struct packet_stream *ps;
GQueue retransmits = G_QUEUE_INIT;
struct timeval next_run = {0,0};
int have_more = 0;
if (!ag->pwd[0].s)
return;
__DBG("running checks, call "STR_FORMAT" tag "STR_FORMAT"", STR_FMT(&ag->call->callid),
STR_FMT(&ag->media->monologue->tag));
mutex_lock(&ag->lock);
/* check if we're done and should start nominating pairs */
if (AGENT_ISSET(ag, CONTROLLING) && !AGENT_ISSET(ag, NOMINATING) && ag->start_nominating.tv_sec) {
if (timeval_cmp(&g_now, &ag->start_nominating) >= 0)
__nominate_pairs(ag);
timeval_lowest(&next_run, &ag->start_nominating);
}
/* triggered checks are preferred */
pair = g_queue_pop_head(&ag->triggered);
if (pair) {
PAIR_CLEAR(pair, TRIGGERED);
next_run = g_now;
goto check;
}
/* find the highest-priority non-frozen non-in-progress pair */
for (l = ag->all_pairs_list.head; l; l = l->next) {
pair = l->data;
/* skip dead streams */
ps = pair->packet_stream;
if (!ps || !ps->sfd)
continue;
if (PAIR_ISSET(pair, FAILED))
continue;
if (PAIR_ISSET(pair, SUCCEEDED) && !PAIR_ISSET(pair, TO_USE))
continue;
valid = __get_pair_by_component(ag->valid_pairs, pair->remote_candidate->component_id);
if (PAIR_ISSET(pair, IN_PROGRESS)) {
/* handle retransmits */
/* but only if our priority is lower than any valid pair */
if (valid && valid->pair_priority > pair->pair_priority)
continue;
if (timeval_cmp(&pair->retransmit, &g_now) <= 0)
g_queue_push_tail(&retransmits, pair); /* can't run check directly
due to locks */
else
timeval_lowest(&next_run, &pair->retransmit);
continue;
}
/* don't do anything else if we already have a valid pair */
if (valid)
continue;
/* or if we're in or past the final phase */
if (AGENT_ISSET2(ag, NOMINATING, COMPLETED))
continue;
have_more = 1;
/* remember the first frozen pair in case we find nothing else */
if (PAIR_ISSET(pair, FROZEN)) {
if (!frozen)
frozen = pair;
continue;
}
if (!highest)
highest = pair;
}
if (highest)
pair = highest;
else if (frozen)
pair = frozen;
else
pair = NULL;
check:
mutex_unlock(&ag->lock);
if (pair)
__do_ice_check(pair);
while ((pair = g_queue_pop_head(&retransmits)))
__do_ice_check(pair);
/* determine when to run next */
if (have_more)
__agent_schedule(ag, 0);
else if (next_run.tv_sec)
__agent_schedule_abs(ag, &next_run); /* for retransmits */
}