[apple/ipsec.git] / ipsec-tools / racoon / nattraversal.c

/*
 * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
 * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "config.h"

#include <sys/types.h>
#include <sys/param.h>

#include <netinet/udp.h>

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <ctype.h>

#include "var.h"
#include "misc.h"
#include "vmbuf.h"
#include "plog.h"
#include "debug.h"

#include "localconf.h"
#include "remoteconf.h"
#include "sockmisc.h"
#include "isakmp_var.h"
#include "isakmp.h"
#include "oakley.h"
#include "ipsec_doi.h"
#include "vendorid.h"
#include "handler.h"
#include "crypto_openssl.h"
#include "schedule.h"
#include "nattraversal.h"
#include "grabmyaddr.h"
#include "ike_session.h"

struct natt_ka_addrs {
  struct sockaddr_storage	*src;
  struct sockaddr_storage	*dst;
  unsigned		in_use;

  TAILQ_ENTRY(natt_ka_addrs) chain;
};

/*
 * check if the given vid is NAT-T.
 */
int
natt_vendorid (int vid)
{
  return (
#ifdef ENABLE_NATT_00
	  vid == VENDORID_NATT_00 ||
#endif
#ifdef ENABLE_NATT_01
	  vid == VENDORID_NATT_01 ||
#endif
#ifdef ENABLE_NATT_02
	  vid == VENDORID_NATT_02 ||
	  vid == VENDORID_NATT_02_N ||
#endif
#ifdef ENABLE_NATT_03
	  vid == VENDORID_NATT_03 ||
#endif
#ifdef ENABLE_NATT_04
	  vid == VENDORID_NATT_04 ||
#endif
#ifdef ENABLE_NATT_05
	  vid == VENDORID_NATT_05 ||
#endif
#ifdef ENABLE_NATT_06
	  vid == VENDORID_NATT_06 ||
#endif
#ifdef ENABLE_NATT_07
	  vid == VENDORID_NATT_07 ||
#endif
#ifdef ENABLE_NATT_08
	  vid == VENDORID_NATT_08 ||
#endif
#ifdef ENABLE_NATT_APPLE
	  vid == VENDORID_NATT_APPLE ||
#endif
	  /* Always enable NATT RFC if ENABLE_NATT
	   */
	  vid == VENDORID_NATT_RFC);
}

vchar_t *
natt_hash_addr (struct ph1handle *iph1, struct sockaddr_storage *addr)
{
  vchar_t *natd;
  vchar_t *buf;
  char *ptr;
  void *addr_ptr, *addr_port;
  size_t buf_size, addr_size;

  plog (LLV_INFO, LOCATION, addr, "Hashing %s with algo #%d %s\n",
	saddr2str((struct sockaddr *)addr), iph1->approval->hashtype, 
	(iph1->rmconf->nat_traversal == NATT_FORCE)?"(NAT-T forced)":"");
  
  if (addr->ss_family == AF_INET) {
    addr_size = sizeof (struct in_addr);	/* IPv4 address */
    addr_ptr = &((struct sockaddr_in *)addr)->sin_addr;
    addr_port = &((struct sockaddr_in *)addr)->sin_port;
  }
  else if (addr->ss_family == AF_INET6) {
    addr_size = sizeof (struct in6_addr);	/* IPv6 address */
    addr_ptr = &((struct sockaddr_in6 *)addr)->sin6_addr;
    addr_port = &((struct sockaddr_in6 *)addr)->sin6_port;
  }
  else {
    plog (LLV_ERROR, LOCATION, addr, "Unsupported address family #0x%x\n", addr->ss_family);
    return NULL;
  }

  buf_size = 2 * sizeof (cookie_t);	/* CKY-I + CKY+R */
  buf_size += addr_size + 2;	/* Address + Port */
  
  if ((buf = vmalloc (buf_size)) == NULL)
    return NULL;

  ptr = buf->v;
  
  /* Copy-in CKY-I */
  memcpy (ptr, iph1->index.i_ck, sizeof (cookie_t));
  ptr += sizeof (cookie_t);
  
  /* Copy-in CKY-I */
  memcpy (ptr, iph1->index.r_ck, sizeof (cookie_t));
  ptr += sizeof (cookie_t);
  
  /* Copy-in Address (or zeroes if NATT_FORCE) */
  if (iph1->rmconf->nat_traversal == NATT_FORCE)
    memset (ptr, 0, addr_size);
  else
    memcpy (ptr, addr_ptr, addr_size);
  ptr += addr_size;

  /* Copy-in Port number */
  memcpy (ptr, addr_port, 2);

  natd = oakley_hash (buf, iph1);
  vfree(buf);

  return natd;
}

int 
natt_compare_addr_hash (struct ph1handle *iph1, vchar_t *natd_received,
			int natd_seq)
{
  vchar_t *natd_computed;
  u_int32_t flag;
  int verified = 0;

  if (iph1->rmconf->nat_traversal == NATT_FORCE)
    return verified;

	/* old APPLE version sends natd payload in the wrong order */
  if (iph1->natt_options->version == VENDORID_NATT_APPLE) {
	  if (natd_seq == 0) {
		natd_computed = natt_hash_addr (iph1, iph1->remote);
		flag = NAT_DETECTED_PEER;
	  }
	  else {
		natd_computed = natt_hash_addr (iph1, iph1->local);
		flag = NAT_DETECTED_ME;
	  }
	} else
	{
		if (natd_seq == 0) {
			natd_computed = natt_hash_addr (iph1, iph1->local);
			flag = NAT_DETECTED_ME;
		}
		else {
			natd_computed = natt_hash_addr (iph1, iph1->remote);
			flag = NAT_DETECTED_PEER;
		}
	}

  if (natd_received->l == natd_computed->l &&
      memcmp (natd_received->v, natd_computed->v, natd_received->l) == 0) {
    iph1->natt_flags &= ~flag;
    verified = 1;
  }

    if (iph1->parent_session)
        iph1->parent_session->natt_flags = iph1->natt_flags;

  vfree (natd_computed);

  return verified;
}

int
natt_udp_encap (int encmode)
{
  return (encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC || 
	  encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC ||
	  encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT ||
	  encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT);
}

int
natt_fill_options (struct ph1natt_options *opts, int version)
{
  if (! opts)
    return -1;

  opts->version = version;

  switch (version) {
    case VENDORID_NATT_02:
    case VENDORID_NATT_02_N:
    case VENDORID_NATT_03:
      opts->float_port = lcconf->port_isakmp_natt;
      opts->payload_nat_d = ISAKMP_NPTYPE_NATD_DRAFT;
      opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_DRAFT;
      opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT;
      opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT;
      opts->encaps_type = UDP_ENCAP_ESPINUDP;
      break;
    case VENDORID_NATT_04:
    case VENDORID_NATT_05:
    case VENDORID_NATT_06:
    case VENDORID_NATT_07:
    case VENDORID_NATT_08:
	case VENDORID_NATT_APPLE:
      opts->float_port = lcconf->port_isakmp_natt;
      opts->payload_nat_d = ISAKMP_NPTYPE_NATD_BADDRAFT;
      opts->payload_nat_oa = ISAKMP_NPTYPE_NONE;
      opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
      opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
      opts->encaps_type = UDP_ENCAP_ESPINUDP;
      break;
    case VENDORID_NATT_RFC:
      opts->float_port = lcconf->port_isakmp_natt;
      opts->payload_nat_d = ISAKMP_NPTYPE_NATD_RFC;
      opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_RFC;
      opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
      opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
      opts->encaps_type = UDP_ENCAP_ESPINUDP;
	  break;
    default:
      plog(LLV_ERROR, LOCATION, NULL, 
	   "unsupported NAT-T version: %s\n",
	   vid_string_by_id(version));
      return -1;
  }
 
  opts->mode_udp_diff = opts->mode_udp_tunnel - IPSECDOI_ATTR_ENC_MODE_TUNNEL;

  return 0;
}

int
create_natoa_payloads(struct ph2handle *iph2, vchar_t **natoa_i, vchar_t **natoa_r)
{
	int natoa_type = 0;
	vchar_t		*i;
	vchar_t		*r;
	u_int8_t	*p;
	struct sockaddr_storage *i_addr;
	struct sockaddr_storage *r_addr;
	size_t		i_size;
	size_t		r_size;
	
	*natoa_i = *natoa_r = NULL;
	

	/* create natoa payloads if natt being used */
	/* don't send if type == apple				*/
	if (!iph2->ph1->natt_options)
		return 0;

	natoa_type = iph2->ph1->natt_options->payload_nat_oa;
	if (natoa_type == 0)
		return 0;

	if (iph2->side == INITIATOR) {
		i_addr = iph2->src;
		r_addr = iph2->dst;
	} else {
		i_addr = iph2->dst;
		r_addr = iph2->src;
	}

	switch (i_addr->ss_family) {
		case AF_INET:
			i_size = sizeof(in_addr_t);
			break;
#ifdef INET6
		case AF_INET6:
			i_size = sizeof(struct in6_addr);
			break;
#endif
		default:
			plog(LLV_ERROR, LOCATION, NULL,
				 "invalid address family: %d\n", i_addr->ss_family);
			return -1;		
	}

	switch (r_addr->ss_family) {
		case AF_INET:
			r_size = sizeof(in_addr_t);
			break;
#ifdef INET6
		case AF_INET6:
			r_size = sizeof(struct in6_addr);
			break;
#endif
		default:
			plog(LLV_ERROR, LOCATION, NULL,
				 "invalid address family: %d\n", r_addr->ss_family);
			return -1;		
	}

	i = vmalloc(sizeof(struct isakmp_pl_natoa) + i_size - sizeof(struct isakmp_gen));
	if (i == NULL) {
		plog(LLV_ERROR, LOCATION, NULL,
			 "failed to get buffer for natoa payload.\n");
		return -1;
	}
	r = vmalloc(sizeof(struct isakmp_pl_natoa) + r_size - sizeof(struct isakmp_gen));
	if (r == NULL) {
		vfree(i);
		plog(LLV_ERROR, LOCATION, NULL,
			"failed to get buffer for natoa payload.\n");
		return -1;
	}
	
	/* copy src address */
	p = (__typeof__(p))i->v;
	
	switch (i_addr->ss_family) {
		case AF_INET:
			*p = IPSECDOI_ID_IPV4_ADDR;
			bcopy(&(((struct sockaddr_in *)i_addr)->sin_addr.s_addr), p + sizeof(u_int32_t), i_size);
			break;
#ifdef INET6
		case AF_INET6:
			*p = IPSECDOI_ID_IPV6_ADDR;
			bcopy(&(((struct sockaddr_in6 *)i_addr)->sin6_addr), p + sizeof(u_int32_t), i_size);
			break;
#endif
	}

	/* copy dst address */
	p = (__typeof__(p))r->v;
	
	switch (r_addr->ss_family) {
		case AF_INET:
			*p = IPSECDOI_ID_IPV4_ADDR;
			bcopy(&(((struct sockaddr_in *)r_addr)->sin_addr.s_addr), p + sizeof(u_int32_t), r_size);
			break;
#ifdef INET6
		case AF_INET6:
			*p = IPSECDOI_ID_IPV6_ADDR;
			bcopy(&(((struct sockaddr_in6 *)r_addr)->sin6_addr), p + sizeof(u_int32_t), r_size);
			break;
#endif
	}
	
	*natoa_i = i;
	*natoa_r = r;
	return natoa_type;
}	

struct sockaddr_storage *
process_natoa_payload(vchar_t *buf)
{
	struct sockaddr_storage      *saddr = NULL;
	struct ipsecdoi_id_b *id_b = ALIGNED_CAST(struct ipsecdoi_id_b *)buf->v;

	switch (id_b->type) {
		case IPSECDOI_ID_IPV4_ADDR:
			saddr = racoon_malloc(sizeof(struct sockaddr_in));
			if (!saddr) {
				plog(LLV_ERROR, LOCATION, NULL,
					 "error allocating addr for NAT-OA payload\n");
				return NULL;
			}
			saddr->ss_len = sizeof(struct sockaddr_in);
			saddr->ss_family = AF_INET;
			((struct sockaddr_in *)saddr)->sin_port = IPSEC_PORT_ANY;
			memcpy(&((struct sockaddr_in *)saddr)->sin_addr,
				   buf->v + sizeof(*id_b), sizeof(struct in_addr));
			break;
#ifdef INET6
		case IPSECDOI_ID_IPV6_ADDR:
			saddr = racoon_malloc(sizeof(struct sockaddr_in6));
			if (!saddr) {
				plog(LLV_ERROR, LOCATION, NULL,
					 "error allocating addr for NAT-OA payload\n");
				return NULL;
			}
			saddr->ss_len = sizeof(struct sockaddr_in6);
			saddr->ss_family = AF_INET6;
			((struct sockaddr_in6 *)saddr)->sin6_port = IPSEC_PORT_ANY;
			memcpy(&((struct sockaddr_in6 *)saddr)->sin6_addr,
				   buf->v + sizeof(*id_b), sizeof(struct in6_addr));
			break;
#endif
		default:
			plog(LLV_ERROR, LOCATION, NULL,
				 "invalid NAT-OA payload %d\n", id_b->type);
			return NULL;
	}
	return saddr;
}

void
natt_float_ports (struct ph1handle *iph1)
{
	
	if (! (iph1->natt_flags & NAT_DETECTED) )
		return;
	if (! iph1->natt_options->float_port){
		/* Drafts 00 / 01, just schedule keepalive */
		return;
	}
	
	/*
	 * Only switch ports if port == isakmp port.
	 * In the case where ports are set from policy or from
	 * remote config we could be talking to a device behind
	 * a nat using the translated port.
	 */
	if (*get_port_ptr(iph1->local) == htons(lcconf->port_isakmp))
		set_port (iph1->local, iph1->natt_options->float_port);
	if (*get_port_ptr(iph1->remote) == htons(lcconf->port_isakmp))
		set_port (iph1->remote, iph1->natt_options->float_port);
	iph1->natt_flags |= NAT_PORTS_CHANGED | NAT_ADD_NON_ESP_MARKER;

	ike_session_ikev1_float_ports(iph1);
}

void
natt_handle_vendorid (struct ph1handle *iph1, int vid_numeric)
{
  int version;

  if (! iph1->natt_options)
    iph1->natt_options = racoon_calloc (1, sizeof (*iph1->natt_options));

  if (! iph1->natt_options) {
    plog (LLV_ERROR, LOCATION, NULL,
	  "Allocating memory for natt_options failed!\n");
    return;
  }

  // stick to the version we already selected on a previous phase1
  version = ike_session_get_natt_version(iph1);
  if (version) {
    vid_numeric = version;
  }

  if (iph1->natt_options->version < vid_numeric)
    if (natt_fill_options (iph1->natt_options, vid_numeric) == 0)
      iph1->natt_flags |= NAT_ANNOUNCED;
}

static struct remoteconf *
natt_enabled_in_rmconf_stub (struct remoteconf *rmconf, void *data)
{
  return (rmconf->nat_traversal ? rmconf : NULL);
}

int
natt_enabled_in_rmconf ()
{
  return foreachrmconf (natt_enabled_in_rmconf_stub, NULL) != NULL;
}


struct payload_list *
isakmp_plist_append_natt_vids (struct payload_list *plist, vchar_t *vid_natt[MAX_NATT_VID_COUNT]){
	int i, vid_natt_i = 0;

	if(vid_natt == NULL)
		return NULL;

	for (i = 0; i < MAX_NATT_VID_COUNT; i++)
		vid_natt[i]=NULL;
	
	/* Puts the olders VIDs last, as some implementations may choose the first
	 * NATT VID given
	 */

	/* Always set RFC VID
	 */
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_RFC)) != NULL)
		vid_natt_i++;
#ifdef ENABLE_NATT_APPLE
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_APPLE)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_08
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_08)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_07
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_07)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_06
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_06)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_05
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_05)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_04
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_04)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_03
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_03)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_02
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02)) != NULL)
		vid_natt_i++;
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02_N)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_01
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_01)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_00
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_00)) != NULL)
		vid_natt_i++;
#endif
	/* set VID payload for NAT-T */
	for (i = 0; i < vid_natt_i; i++)
		plist = isakmp_plist_append(plist, vid_natt[i], ISAKMP_NPTYPE_VID);
	
	return plist;
}
Commit	Line	Data
52b7d2ce A	1	/*
	2	* Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
	3	* Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
	4	* All rights reserved.
	5	*
	6	* Redistribution and use in source and binary forms, with or without
	7	* modification, are permitted provided that the following conditions
	8	* are met:
	9	* 1. Redistributions of source code must retain the above copyright
	10	* notice, this list of conditions and the following disclaimer.
	11	* 2. Redistributions in binary form must reproduce the above copyright
	12	* notice, this list of conditions and the following disclaimer in the
	13	* documentation and/or other materials provided with the distribution.
	14	* 3. Neither the name of the project nor the names of its contributors
	15	* may be used to endorse or promote products derived from this software
	16	* without specific prior written permission.
	17	*
	18	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	19	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	20	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	21	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	22	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	23	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	24	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	25	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	26	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	27	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	28	* SUCH DAMAGE.
	29	*/
	30
	31	#include "config.h"
	32
	33	#include <sys/types.h>
	34	#include <sys/param.h>
	35
52b7d2ce	36	#include <netinet/udp.h>
52b7d2ce A	37
	38	#include <stdlib.h>
	39	#include <stdio.h>
	40	#include <string.h>
	41	#include <errno.h>
	42	#include <ctype.h>
	43
	44	#include "var.h"
	45	#include "misc.h"
	46	#include "vmbuf.h"
	47	#include "plog.h"
	48	#include "debug.h"
	49
	50	#include "localconf.h"
	51	#include "remoteconf.h"
	52	#include "sockmisc.h"
	53	#include "isakmp_var.h"
	54	#include "isakmp.h"
	55	#include "oakley.h"
	56	#include "ipsec_doi.h"
	57	#include "vendorid.h"
	58	#include "handler.h"
	59	#include "crypto_openssl.h"
	60	#include "schedule.h"
	61	#include "nattraversal.h"
	62	#include "grabmyaddr.h"
d1e348cf	63	#include "ike_session.h"
52b7d2ce A	64
52b7d2ce A	65	struct natt_ka_addrs {
85f41bec A	66	struct sockaddr_storage *src;
85f41bec A	67	struct sockaddr_storage *dst;
52b7d2ce A	68	unsigned in_use;
	69
	70	TAILQ_ENTRY(natt_ka_addrs) chain;
	71	};
	72
52b7d2ce A	73	/*
	74	* check if the given vid is NAT-T.
	75	*/
	76	int
	77	natt_vendorid (int vid)
	78	{
	79	return (
	80	#ifdef ENABLE_NATT_00
	81	vid == VENDORID_NATT_00 \|\|
	82	#endif
	83	#ifdef ENABLE_NATT_01
	84	vid == VENDORID_NATT_01 \|\|
	85	#endif
	86	#ifdef ENABLE_NATT_02
	87	vid == VENDORID_NATT_02 \|\|
	88	vid == VENDORID_NATT_02_N \|\|
	89	#endif
	90	#ifdef ENABLE_NATT_03
	91	vid == VENDORID_NATT_03 \|\|
	92	#endif
	93	#ifdef ENABLE_NATT_04
	94	vid == VENDORID_NATT_04 \|\|
	95	#endif
	96	#ifdef ENABLE_NATT_05
	97	vid == VENDORID_NATT_05 \|\|
	98	#endif
	99	#ifdef ENABLE_NATT_06
	100	vid == VENDORID_NATT_06 \|\|
	101	#endif
	102	#ifdef ENABLE_NATT_07
	103	vid == VENDORID_NATT_07 \|\|
	104	#endif
	105	#ifdef ENABLE_NATT_08
	106	vid == VENDORID_NATT_08 \|\|
	107	#endif
	108	#ifdef ENABLE_NATT_APPLE
	109	vid == VENDORID_NATT_APPLE \|\|
	110	#endif
	111	/* Always enable NATT RFC if ENABLE_NATT
	112	*/
	113	vid == VENDORID_NATT_RFC);
	114	}
	115
	116	vchar_t *
85f41bec	117	natt_hash_addr (struct ph1handle iph1, struct sockaddr_storage addr)
52b7d2ce A	118	{
	119	vchar_t *natd;
	120	vchar_t *buf;
	121	char *ptr;
	122	void addr_ptr, addr_port;
	123	size_t buf_size, addr_size;
	124
	125	plog (LLV_INFO, LOCATION, addr, "Hashing %s with algo #%d %s\n",
85f41bec	126	saddr2str((struct sockaddr *)addr), iph1->approval->hashtype,
52b7d2ce A	127	(iph1->rmconf->nat_traversal == NATT_FORCE)?"(NAT-T forced)":"");
52b7d2ce A	128
85f41bec	129	if (addr->ss_family == AF_INET) {
52b7d2ce A	130	addr_size = sizeof (struct in_addr); /* IPv4 address */
	131	addr_ptr = &((struct sockaddr_in *)addr)->sin_addr;
	132	addr_port = &((struct sockaddr_in *)addr)->sin_port;
	133	}
85f41bec	134	else if (addr->ss_family == AF_INET6) {
52b7d2ce A	135	addr_size = sizeof (struct in6_addr); /* IPv6 address */
	136	addr_ptr = &((struct sockaddr_in6 *)addr)->sin6_addr;
	137	addr_port = &((struct sockaddr_in6 *)addr)->sin6_port;
	138	}
	139	else {
85f41bec	140	plog (LLV_ERROR, LOCATION, addr, "Unsupported address family #0x%x\n", addr->ss_family);
52b7d2ce A	141	return NULL;
	142	}
	143
	144	buf_size = 2 * sizeof (cookie_t); /* CKY-I + CKY+R */
	145	buf_size += addr_size + 2; /* Address + Port */
	146
	147	if ((buf = vmalloc (buf_size)) == NULL)
	148	return NULL;
	149
	150	ptr = buf->v;
	151
	152	/* Copy-in CKY-I */
	153	memcpy (ptr, iph1->index.i_ck, sizeof (cookie_t));
	154	ptr += sizeof (cookie_t);
	155
	156	/* Copy-in CKY-I */
	157	memcpy (ptr, iph1->index.r_ck, sizeof (cookie_t));
	158	ptr += sizeof (cookie_t);
	159
	160	/* Copy-in Address (or zeroes if NATT_FORCE) */
	161	if (iph1->rmconf->nat_traversal == NATT_FORCE)
	162	memset (ptr, 0, addr_size);
	163	else
	164	memcpy (ptr, addr_ptr, addr_size);
	165	ptr += addr_size;
	166
	167	/* Copy-in Port number */
	168	memcpy (ptr, addr_port, 2);
	169
	170	natd = oakley_hash (buf, iph1);
	171	vfree(buf);
	172
	173	return natd;
	174	}
	175
	176	int
	177	natt_compare_addr_hash (struct ph1handle iph1, vchar_t natd_received,
	178	int natd_seq)
	179	{
	180	vchar_t *natd_computed;
	181	u_int32_t flag;
	182	int verified = 0;
	183
	184	if (iph1->rmconf->nat_traversal == NATT_FORCE)
	185	return verified;
	186
52b7d2ce A	187	/* old APPLE version sends natd payload in the wrong order */
	188	if (iph1->natt_options->version == VENDORID_NATT_APPLE) {
	189	if (natd_seq == 0) {
	190	natd_computed = natt_hash_addr (iph1, iph1->remote);
	191	flag = NAT_DETECTED_PEER;
	192	}
	193	else {
	194	natd_computed = natt_hash_addr (iph1, iph1->local);
	195	flag = NAT_DETECTED_ME;
	196	}
	197	} else
52b7d2ce A	198	{
	199	if (natd_seq == 0) {
	200	natd_computed = natt_hash_addr (iph1, iph1->local);
	201	flag = NAT_DETECTED_ME;
	202	}
	203	else {
	204	natd_computed = natt_hash_addr (iph1, iph1->remote);
	205	flag = NAT_DETECTED_PEER;
	206	}
	207	}
	208
	209	if (natd_received->l == natd_computed->l &&
	210	memcmp (natd_received->v, natd_computed->v, natd_received->l) == 0) {
	211	iph1->natt_flags &= ~flag;
	212	verified = 1;
	213	}
	214
d1e348cf A	215	if (iph1->parent_session)
	216	iph1->parent_session->natt_flags = iph1->natt_flags;
	217
52b7d2ce A	218	vfree (natd_computed);
	219
	220	return verified;
	221	}
	222
	223	int
	224	natt_udp_encap (int encmode)
	225	{
	226	return (encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC \|\|
	227	encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC \|\|
	228	encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT \|\|
	229	encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT);
	230	}
	231
	232	int
	233	natt_fill_options (struct ph1natt_options *opts, int version)
	234	{
	235	if (! opts)
	236	return -1;
	237
	238	opts->version = version;
	239
	240	switch (version) {
52b7d2ce A	241	case VENDORID_NATT_02:
	242	case VENDORID_NATT_02_N:
	243	case VENDORID_NATT_03:
	244	opts->float_port = lcconf->port_isakmp_natt;
	245	opts->payload_nat_d = ISAKMP_NPTYPE_NATD_DRAFT;
	246	opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_DRAFT;
	247	opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT;
	248	opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT;
	249	opts->encaps_type = UDP_ENCAP_ESPINUDP;
	250	break;
	251	case VENDORID_NATT_04:
	252	case VENDORID_NATT_05:
	253	case VENDORID_NATT_06:
	254	case VENDORID_NATT_07:
	255	case VENDORID_NATT_08:
52b7d2ce A	256	case VENDORID_NATT_APPLE:
	257	opts->float_port = lcconf->port_isakmp_natt;
	258	opts->payload_nat_d = ISAKMP_NPTYPE_NATD_BADDRAFT;
	259	opts->payload_nat_oa = ISAKMP_NPTYPE_NONE;
	260	opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
	261	opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
	262	opts->encaps_type = UDP_ENCAP_ESPINUDP;
	263	break;
52b7d2ce A	264	case VENDORID_NATT_RFC:
	265	opts->float_port = lcconf->port_isakmp_natt;
	266	opts->payload_nat_d = ISAKMP_NPTYPE_NATD_RFC;
	267	opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_RFC;
	268	opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
	269	opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
	270	opts->encaps_type = UDP_ENCAP_ESPINUDP;
	271	break;
	272	default:
	273	plog(LLV_ERROR, LOCATION, NULL,
	274	"unsupported NAT-T version: %s\n",
	275	vid_string_by_id(version));
	276	return -1;
	277	}
	278
	279	opts->mode_udp_diff = opts->mode_udp_tunnel - IPSECDOI_ATTR_ENC_MODE_TUNNEL;
	280
	281	return 0;
	282	}
	283
d1e348cf	284	int
52b7d2ce A	285	create_natoa_payloads(struct ph2handle iph2, vchar_t natoa_i, vchar_t *natoa_r)
	286	{
	287	int natoa_type = 0;
52b7d2ce A	288	vchar_t *i;
	289	vchar_t *r;
	290	u_int8_t *p;
85f41bec A	291	struct sockaddr_storage *i_addr;
85f41bec A	292	struct sockaddr_storage *r_addr;
d1e348cf A	293	size_t i_size;
d1e348cf A	294	size_t r_size;
52b7d2ce A	295
	296	natoa_i = natoa_r = NULL;
	297
	298
	299	/* create natoa payloads if natt being used */
	300	/* don't send if type == apple */
d1e348cf A	301	if (!iph2->ph1->natt_options)
	302	return 0;
	303
	304	natoa_type = iph2->ph1->natt_options->payload_nat_oa;
52b7d2ce A	305	if (natoa_type == 0)
52b7d2ce A	306	return 0;
d1e348cf A	307
	308	if (iph2->side == INITIATOR) {
	309	i_addr = iph2->src;
	310	r_addr = iph2->dst;
	311	} else {
	312	i_addr = iph2->dst;
	313	r_addr = iph2->src;
	314	}
	315
85f41bec	316	switch (i_addr->ss_family) {
52b7d2ce	317	case AF_INET:
d1e348cf	318	i_size = sizeof(in_addr_t);
52b7d2ce A	319	break;
	320	#ifdef INET6
	321	case AF_INET6:
d1e348cf	322	i_size = sizeof(struct in6_addr);
52b7d2ce A	323	break;
	324	#endif
	325	default:
	326	plog(LLV_ERROR, LOCATION, NULL,
85f41bec	327	"invalid address family: %d\n", i_addr->ss_family);
52b7d2ce A	328	return -1;
52b7d2ce A	329	}
d1e348cf	330
85f41bec	331	switch (r_addr->ss_family) {
52b7d2ce	332	case AF_INET:
d1e348cf	333	r_size = sizeof(in_addr_t);
52b7d2ce A	334	break;
	335	#ifdef INET6
	336	case AF_INET6:
d1e348cf	337	r_size = sizeof(struct in6_addr);
52b7d2ce A	338	break;
	339	#endif
	340	default:
	341	plog(LLV_ERROR, LOCATION, NULL,
85f41bec	342	"invalid address family: %d\n", r_addr->ss_family);
52b7d2ce A	343	return -1;
	344	}
	345
d1e348cf A	346	i = vmalloc(sizeof(struct isakmp_pl_natoa) + i_size - sizeof(struct isakmp_gen));
	347	if (i == NULL) {
	348	plog(LLV_ERROR, LOCATION, NULL,
	349	"failed to get buffer for natoa payload.\n");
	350	return -1;
	351	}
	352	r = vmalloc(sizeof(struct isakmp_pl_natoa) + r_size - sizeof(struct isakmp_gen));
	353	if (r == NULL) {
	354	vfree(i);
52b7d2ce A	355	plog(LLV_ERROR, LOCATION, NULL,
	356	"failed to get buffer for natoa payload.\n");
	357	return -1;
	358	}
	359
	360	/* copy src address */
d1e348cf	361	p = (__typeof__(p))i->v;
52b7d2ce	362
85f41bec	363	switch (i_addr->ss_family) {
52b7d2ce A	364	case AF_INET:
52b7d2ce A	365	*p = IPSECDOI_ID_IPV4_ADDR;
d1e348cf	366	bcopy(&(((struct sockaddr_in *)i_addr)->sin_addr.s_addr), p + sizeof(u_int32_t), i_size);
52b7d2ce A	367	break;
	368	#ifdef INET6
	369	case AF_INET6:
	370	*p = IPSECDOI_ID_IPV6_ADDR;
d1e348cf	371	bcopy(&(((struct sockaddr_in6 *)i_addr)->sin6_addr), p + sizeof(u_int32_t), i_size);
52b7d2ce A	372	break;
	373	#endif
	374	}
	375
	376	/* copy dst address */
d1e348cf	377	p = (__typeof__(p))r->v;
52b7d2ce	378
85f41bec	379	switch (r_addr->ss_family) {
52b7d2ce A	380	case AF_INET:
52b7d2ce A	381	*p = IPSECDOI_ID_IPV4_ADDR;
d1e348cf	382	bcopy(&(((struct sockaddr_in *)r_addr)->sin_addr.s_addr), p + sizeof(u_int32_t), r_size);
52b7d2ce A	383	break;
	384	#ifdef INET6
	385	case AF_INET6:
	386	*p = IPSECDOI_ID_IPV6_ADDR;
d1e348cf	387	bcopy(&(((struct sockaddr_in6 *)r_addr)->sin6_addr), p + sizeof(u_int32_t), r_size);
52b7d2ce A	388	break;
	389	#endif
	390	}
	391
	392	*natoa_i = i;
	393	*natoa_r = r;
	394	return natoa_type;
	395	}
d1e348cf	396
85f41bec	397	struct sockaddr_storage *
d1e348cf A	398	process_natoa_payload(vchar_t *buf)
d1e348cf A	399	{
85f41bec A	400	struct sockaddr_storage *saddr = NULL;
85f41bec A	401	struct ipsecdoi_id_b id_b = ALIGNED_CAST(struct ipsecdoi_id_b )buf->v;
d1e348cf A	402
	403	switch (id_b->type) {
	404	case IPSECDOI_ID_IPV4_ADDR:
	405	saddr = racoon_malloc(sizeof(struct sockaddr_in));
	406	if (!saddr) {
	407	plog(LLV_ERROR, LOCATION, NULL,
	408	"error allocating addr for NAT-OA payload\n");
	409	return NULL;
	410	}
85f41bec A	411	saddr->ss_len = sizeof(struct sockaddr_in);
85f41bec A	412	saddr->ss_family = AF_INET;
d1e348cf A	413	((struct sockaddr_in *)saddr)->sin_port = IPSEC_PORT_ANY;
	414	memcpy(&((struct sockaddr_in *)saddr)->sin_addr,
	415	buf->v + sizeof(*id_b), sizeof(struct in_addr));
	416	break;
	417	#ifdef INET6
	418	case IPSECDOI_ID_IPV6_ADDR:
	419	saddr = racoon_malloc(sizeof(struct sockaddr_in6));
	420	if (!saddr) {
	421	plog(LLV_ERROR, LOCATION, NULL,
	422	"error allocating addr for NAT-OA payload\n");
	423	return NULL;
	424	}
85f41bec A	425	saddr->ss_len = sizeof(struct sockaddr_in6);
85f41bec A	426	saddr->ss_family = AF_INET6;
d1e348cf A	427	((struct sockaddr_in6 *)saddr)->sin6_port = IPSEC_PORT_ANY;
	428	memcpy(&((struct sockaddr_in6 *)saddr)->sin6_addr,
	429	buf->v + sizeof(*id_b), sizeof(struct in6_addr));
	430	break;
	431	#endif
	432	default:
	433	plog(LLV_ERROR, LOCATION, NULL,
	434	"invalid NAT-OA payload %d\n", id_b->type);
	435	return NULL;
	436	}
	437	return saddr;
	438	}
52b7d2ce A	439
	440	void
	441	natt_float_ports (struct ph1handle *iph1)
	442	{
	443
47612122	444	if (! (iph1->natt_flags & NAT_DETECTED) )
52b7d2ce A	445	return;
	446	if (! iph1->natt_options->float_port){
	447	/* Drafts 00 / 01, just schedule keepalive */
52b7d2ce A	448	return;
	449	}
	450
	451	/*
	452	* Only switch ports if port == isakmp port.
	453	* In the case where ports are set from policy or from
	454	* remote config we could be talking to a device behind
	455	* a nat using the translated port.
	456	*/
	457	if (*get_port_ptr(iph1->local) == htons(lcconf->port_isakmp))
	458	set_port (iph1->local, iph1->natt_options->float_port);
	459	if (*get_port_ptr(iph1->remote) == htons(lcconf->port_isakmp))
	460	set_port (iph1->remote, iph1->natt_options->float_port);
	461	iph1->natt_flags \|= NAT_PORTS_CHANGED \| NAT_ADD_NON_ESP_MARKER;
	462
d1e348cf	463	ike_session_ikev1_float_ports(iph1);
52b7d2ce A	464	}
	465
	466	void
	467	natt_handle_vendorid (struct ph1handle *iph1, int vid_numeric)
	468	{
80318cb7 A	469	int version;
80318cb7 A	470
52b7d2ce A	471	if (! iph1->natt_options)
	472	iph1->natt_options = racoon_calloc (1, sizeof (*iph1->natt_options));
	473
	474	if (! iph1->natt_options) {
	475	plog (LLV_ERROR, LOCATION, NULL,
	476	"Allocating memory for natt_options failed!\n");
	477	return;
	478	}
80318cb7 A	479
	480	// stick to the version we already selected on a previous phase1
	481	version = ike_session_get_natt_version(iph1);
	482	if (version) {
	483	vid_numeric = version;
	484	}
	485
52b7d2ce A	486	if (iph1->natt_options->version < vid_numeric)
	487	if (natt_fill_options (iph1->natt_options, vid_numeric) == 0)
	488	iph1->natt_flags \|= NAT_ANNOUNCED;
	489	}
	490
52b7d2ce A	491	static struct remoteconf *
	492	natt_enabled_in_rmconf_stub (struct remoteconf rmconf, void data)
	493	{
	494	return (rmconf->nat_traversal ? rmconf : NULL);
	495	}
	496
	497	int
	498	natt_enabled_in_rmconf ()
	499	{
	500	return foreachrmconf (natt_enabled_in_rmconf_stub, NULL) != NULL;
	501	}
	502
	503
	504	struct payload_list *
	505	isakmp_plist_append_natt_vids (struct payload_list plist, vchar_t vid_natt[MAX_NATT_VID_COUNT]){
	506	int i, vid_natt_i = 0;
	507
	508	if(vid_natt == NULL)
	509	return NULL;
	510
	511	for (i = 0; i < MAX_NATT_VID_COUNT; i++)
	512	vid_natt[i]=NULL;
	513
	514	/* Puts the olders VIDs last, as some implementations may choose the first
	515	* NATT VID given
	516	*/
	517
	518	/* Always set RFC VID
	519	*/
	520	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_RFC)) != NULL)
	521	vid_natt_i++;
	522	#ifdef ENABLE_NATT_APPLE
	523	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_APPLE)) != NULL)
	524	vid_natt_i++;
	525	#endif
	526	#ifdef ENABLE_NATT_08
	527	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_08)) != NULL)
	528	vid_natt_i++;
	529	#endif
	530	#ifdef ENABLE_NATT_07
	531	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_07)) != NULL)
	532	vid_natt_i++;
	533	#endif
	534	#ifdef ENABLE_NATT_06
	535	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_06)) != NULL)
	536	vid_natt_i++;
	537	#endif
	538	#ifdef ENABLE_NATT_05
	539	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_05)) != NULL)
	540	vid_natt_i++;
	541	#endif
	542	#ifdef ENABLE_NATT_04
	543	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_04)) != NULL)
	544	vid_natt_i++;
	545	#endif
	546	#ifdef ENABLE_NATT_03
	547	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_03)) != NULL)
	548	vid_natt_i++;
	549	#endif
	550	#ifdef ENABLE_NATT_02
	551	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02)) != NULL)
	552	vid_natt_i++;
	553	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02_N)) != NULL)
	554	vid_natt_i++;
555	#endif
556	#ifdef ENABLE_NATT_01
557	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_01)) != NULL)
558	vid_natt_i++;
559	#endif
560	#ifdef ENABLE_NATT_00
561	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_00)) != NULL)
562	vid_natt_i++;
563	#endif
564	/* set VID payload for NAT-T */
565	for (i = 0; i < vid_natt_i; i++)
566	plist = isakmp_plist_append(plist, vid_natt[i], ISAKMP_NPTYPE_VID);
567
568	return plist;
569	}