[apple/ipsec.git] / ipsec-tools / racoon / nattraversal.c

/*
 * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
 * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include "config.h"

#include <sys/types.h>
#include <sys/param.h>

#include <netinet/udp.h>

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <ctype.h>

#include "var.h"
#include "misc.h"
#include "vmbuf.h"
#include "plog.h"
#include "debug.h"

#include "localconf.h"
#include "remoteconf.h"
#include "sockmisc.h"
#include "isakmp_var.h"
#include "isakmp.h"
#include "oakley.h"
#include "ipsec_doi.h"
#include "vendorid.h"
#include "handler.h"
#include "crypto_openssl.h"
#include "schedule.h"
#include "nattraversal.h"
#include "grabmyaddr.h"
#include "ike_session.h"

struct natt_ka_addrs {
  struct sockaddr	*src;
  struct sockaddr	*dst;
  unsigned		in_use;

  TAILQ_ENTRY(natt_ka_addrs) chain;
};

static TAILQ_HEAD(_natt_ka_addrs, natt_ka_addrs) ka_tree;

/*
 * check if the given vid is NAT-T.
 */
int
natt_vendorid (int vid)
{
  return (
#ifdef ENABLE_NATT_00
	  vid == VENDORID_NATT_00 ||
#endif
#ifdef ENABLE_NATT_01
	  vid == VENDORID_NATT_01 ||
#endif
#ifdef ENABLE_NATT_02
	  vid == VENDORID_NATT_02 ||
	  vid == VENDORID_NATT_02_N ||
#endif
#ifdef ENABLE_NATT_03
	  vid == VENDORID_NATT_03 ||
#endif
#ifdef ENABLE_NATT_04
	  vid == VENDORID_NATT_04 ||
#endif
#ifdef ENABLE_NATT_05
	  vid == VENDORID_NATT_05 ||
#endif
#ifdef ENABLE_NATT_06
	  vid == VENDORID_NATT_06 ||
#endif
#ifdef ENABLE_NATT_07
	  vid == VENDORID_NATT_07 ||
#endif
#ifdef ENABLE_NATT_08
	  vid == VENDORID_NATT_08 ||
#endif
#ifdef ENABLE_NATT_APPLE
	  vid == VENDORID_NATT_APPLE ||
#endif
	  /* Always enable NATT RFC if ENABLE_NATT
	   */
	  vid == VENDORID_NATT_RFC);
}

vchar_t *
natt_hash_addr (struct ph1handle *iph1, struct sockaddr *addr)
{
  vchar_t *natd;
  vchar_t *buf;
  char *ptr;
  void *addr_ptr, *addr_port;
  size_t buf_size, addr_size;

  plog (LLV_INFO, LOCATION, addr, "Hashing %s with algo #%d %s\n",
	saddr2str(addr), iph1->approval->hashtype, 
	(iph1->rmconf->nat_traversal == NATT_FORCE)?"(NAT-T forced)":"");
  
  if (addr->sa_family == AF_INET) {
    addr_size = sizeof (struct in_addr);	/* IPv4 address */
    addr_ptr = &((struct sockaddr_in *)addr)->sin_addr;
    addr_port = &((struct sockaddr_in *)addr)->sin_port;
  }
  else if (addr->sa_family == AF_INET6) {
    addr_size = sizeof (struct in6_addr);	/* IPv6 address */
    addr_ptr = &((struct sockaddr_in6 *)addr)->sin6_addr;
    addr_port = &((struct sockaddr_in6 *)addr)->sin6_port;
  }
  else {
    plog (LLV_ERROR, LOCATION, addr, "Unsupported address family #0x%x\n", addr->sa_family);
    return NULL;
  }

  buf_size = 2 * sizeof (cookie_t);	/* CKY-I + CKY+R */
  buf_size += addr_size + 2;	/* Address + Port */
  
  if ((buf = vmalloc (buf_size)) == NULL)
    return NULL;

  ptr = buf->v;
  
  /* Copy-in CKY-I */
  memcpy (ptr, iph1->index.i_ck, sizeof (cookie_t));
  ptr += sizeof (cookie_t);
  
  /* Copy-in CKY-I */
  memcpy (ptr, iph1->index.r_ck, sizeof (cookie_t));
  ptr += sizeof (cookie_t);
  
  /* Copy-in Address (or zeroes if NATT_FORCE) */
  if (iph1->rmconf->nat_traversal == NATT_FORCE)
    memset (ptr, 0, addr_size);
  else
    memcpy (ptr, addr_ptr, addr_size);
  ptr += addr_size;

  /* Copy-in Port number */
  memcpy (ptr, addr_port, 2);

  natd = oakley_hash (buf, iph1);
  vfree(buf);

  return natd;
}

int 
natt_compare_addr_hash (struct ph1handle *iph1, vchar_t *natd_received,
			int natd_seq)
{
  vchar_t *natd_computed;
  u_int32_t flag;
  int verified = 0;

  if (iph1->rmconf->nat_traversal == NATT_FORCE)
    return verified;

	/* old APPLE version sends natd payload in the wrong order */
  if (iph1->natt_options->version == VENDORID_NATT_APPLE) {
	  if (natd_seq == 0) {
		natd_computed = natt_hash_addr (iph1, iph1->remote);
		flag = NAT_DETECTED_PEER;
	  }
	  else {
		natd_computed = natt_hash_addr (iph1, iph1->local);
		flag = NAT_DETECTED_ME;
	  }
	} else
	{
		if (natd_seq == 0) {
			natd_computed = natt_hash_addr (iph1, iph1->local);
			flag = NAT_DETECTED_ME;
		}
		else {
			natd_computed = natt_hash_addr (iph1, iph1->remote);
			flag = NAT_DETECTED_PEER;
		}
	}

  if (natd_received->l == natd_computed->l &&
      memcmp (natd_received->v, natd_computed->v, natd_received->l) == 0) {
    iph1->natt_flags &= ~flag;
    verified = 1;
  }

    if (iph1->parent_session)
        iph1->parent_session->natt_flags = iph1->natt_flags;

  vfree (natd_computed);

  return verified;
}

int
natt_udp_encap (int encmode)
{
  return (encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC || 
	  encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC ||
	  encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT ||
	  encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT);
}

int
natt_fill_options (struct ph1natt_options *opts, int version)
{
  if (! opts)
    return -1;

  opts->version = version;

  switch (version) {
    case VENDORID_NATT_02:
    case VENDORID_NATT_02_N:
    case VENDORID_NATT_03:
      opts->float_port = lcconf->port_isakmp_natt;
      opts->payload_nat_d = ISAKMP_NPTYPE_NATD_DRAFT;
      opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_DRAFT;
      opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT;
      opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT;
      opts->encaps_type = UDP_ENCAP_ESPINUDP;
      break;
    case VENDORID_NATT_04:
    case VENDORID_NATT_05:
    case VENDORID_NATT_06:
    case VENDORID_NATT_07:
    case VENDORID_NATT_08:
	case VENDORID_NATT_APPLE:
      opts->float_port = lcconf->port_isakmp_natt;
      opts->payload_nat_d = ISAKMP_NPTYPE_NATD_BADDRAFT;
      opts->payload_nat_oa = ISAKMP_NPTYPE_NONE;
      opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
      opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
      opts->encaps_type = UDP_ENCAP_ESPINUDP;
      break;
    case VENDORID_NATT_RFC:
      opts->float_port = lcconf->port_isakmp_natt;
      opts->payload_nat_d = ISAKMP_NPTYPE_NATD_RFC;
      opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_RFC;
      opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
      opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
      opts->encaps_type = UDP_ENCAP_ESPINUDP;
	  break;
    default:
      plog(LLV_ERROR, LOCATION, NULL, 
	   "unsupported NAT-T version: %s\n",
	   vid_string_by_id(version));
      return -1;
  }
 
  opts->mode_udp_diff = opts->mode_udp_tunnel - IPSECDOI_ATTR_ENC_MODE_TUNNEL;

  return 0;
}

int
create_natoa_payloads(struct ph2handle *iph2, vchar_t **natoa_i, vchar_t **natoa_r)
{
	int natoa_type = 0;
	vchar_t		*i;
	vchar_t		*r;
	u_int8_t	*p;
	struct sockaddr *i_addr;
	struct sockaddr *r_addr;
	size_t		i_size;
	size_t		r_size;
	
	*natoa_i = *natoa_r = NULL;
	

	/* create natoa payloads if natt being used */
	/* don't send if type == apple				*/
	if (!iph2->ph1->natt_options)
		return 0;

	natoa_type = iph2->ph1->natt_options->payload_nat_oa;
	if (natoa_type == 0)
		return 0;

	if (iph2->side == INITIATOR) {
		i_addr = iph2->src;
		r_addr = iph2->dst;
	} else {
		i_addr = iph2->dst;
		r_addr = iph2->src;
	}

	switch (i_addr->sa_family) {
		case AF_INET:
			i_size = sizeof(in_addr_t);
			break;
#ifdef INET6
		case AF_INET6:
			i_size = sizeof(struct in6_addr);
			break;
#endif
		default:
			plog(LLV_ERROR, LOCATION, NULL,
				 "invalid address family: %d\n", i_addr->sa_family);
			return -1;		
	}

	switch (r_addr->sa_family) {
		case AF_INET:
			r_size = sizeof(in_addr_t);
			break;
#ifdef INET6
		case AF_INET6:
			r_size = sizeof(struct in6_addr);
			break;
#endif
		default:
			plog(LLV_ERROR, LOCATION, NULL,
				 "invalid address family: %d\n", r_addr->sa_family);
			return -1;		
	}

	i = vmalloc(sizeof(struct isakmp_pl_natoa) + i_size - sizeof(struct isakmp_gen));
	if (i == NULL) {
		plog(LLV_ERROR, LOCATION, NULL,
			 "failed to get buffer for natoa payload.\n");
		return -1;
	}
	r = vmalloc(sizeof(struct isakmp_pl_natoa) + r_size - sizeof(struct isakmp_gen));
	if (r == NULL) {
		vfree(i);
		plog(LLV_ERROR, LOCATION, NULL,
			"failed to get buffer for natoa payload.\n");
		return -1;
	}
	
	/* copy src address */
	p = (__typeof__(p))i->v;
	
	switch (i_addr->sa_family) {
		case AF_INET:
			*p = IPSECDOI_ID_IPV4_ADDR;
			bcopy(&(((struct sockaddr_in *)i_addr)->sin_addr.s_addr), p + sizeof(u_int32_t), i_size);
			break;
#ifdef INET6
		case AF_INET6:
			*p = IPSECDOI_ID_IPV6_ADDR;
			bcopy(&(((struct sockaddr_in6 *)i_addr)->sin6_addr), p + sizeof(u_int32_t), i_size);
			break;
#endif
	}

	/* copy dst address */
	p = (__typeof__(p))r->v;
	
	switch (r_addr->sa_family) {
		case AF_INET:
			*p = IPSECDOI_ID_IPV4_ADDR;
			bcopy(&(((struct sockaddr_in *)r_addr)->sin_addr.s_addr), p + sizeof(u_int32_t), r_size);
			break;
#ifdef INET6
		case AF_INET6:
			*p = IPSECDOI_ID_IPV6_ADDR;
			bcopy(&(((struct sockaddr_in6 *)r_addr)->sin6_addr), p + sizeof(u_int32_t), r_size);
			break;
#endif
	}
	
	*natoa_i = i;
	*natoa_r = r;
	return natoa_type;
}	

struct sockaddr *
process_natoa_payload(vchar_t *buf)
{
	struct sockaddr      *saddr = NULL;
	struct ipsecdoi_id_b *id_b = (struct ipsecdoi_id_b *)buf->v;

	switch (id_b->type) {
		case IPSECDOI_ID_IPV4_ADDR:
			saddr = racoon_malloc(sizeof(struct sockaddr_in));
			if (!saddr) {
				plog(LLV_ERROR, LOCATION, NULL,
					 "error allocating addr for NAT-OA payload\n");
				return NULL;
			}
			saddr->sa_len = sizeof(struct sockaddr_in);
			saddr->sa_family = AF_INET;
			((struct sockaddr_in *)saddr)->sin_port = IPSEC_PORT_ANY;
			memcpy(&((struct sockaddr_in *)saddr)->sin_addr,
				   buf->v + sizeof(*id_b), sizeof(struct in_addr));
			break;
#ifdef INET6
		case IPSECDOI_ID_IPV6_ADDR:
			saddr = racoon_malloc(sizeof(struct sockaddr_in6));
			if (!saddr) {
				plog(LLV_ERROR, LOCATION, NULL,
					 "error allocating addr for NAT-OA payload\n");
				return NULL;
			}
			saddr->sa_len = sizeof(struct sockaddr_in6);
			saddr->sa_family = AF_INET6;
			((struct sockaddr_in6 *)saddr)->sin6_port = IPSEC_PORT_ANY;
			memcpy(&((struct sockaddr_in6 *)saddr)->sin6_addr,
				   buf->v + sizeof(*id_b), sizeof(struct in6_addr));
			break;
#endif
		default:
			plog(LLV_ERROR, LOCATION, NULL,
				 "invalid NAT-OA payload %d\n", id_b->type);
			return NULL;
	}
	return saddr;
}

void
natt_float_ports (struct ph1handle *iph1)
{
	
	if (! (iph1->natt_flags & NAT_DETECTED) )
		return;
	if (! iph1->natt_options->float_port){
		/* Drafts 00 / 01, just schedule keepalive */
		return;
	}
	
	/*
	 * Only switch ports if port == isakmp port.
	 * In the case where ports are set from policy or from
	 * remote config we could be talking to a device behind
	 * a nat using the translated port.
	 */
	if (*get_port_ptr(iph1->local) == htons(lcconf->port_isakmp))
		set_port (iph1->local, iph1->natt_options->float_port);
	if (*get_port_ptr(iph1->remote) == htons(lcconf->port_isakmp))
		set_port (iph1->remote, iph1->natt_options->float_port);
	iph1->natt_flags |= NAT_PORTS_CHANGED | NAT_ADD_NON_ESP_MARKER;

	ike_session_ikev1_float_ports(iph1);
}

void
natt_handle_vendorid (struct ph1handle *iph1, int vid_numeric)
{
  int version;

  if (! iph1->natt_options)
    iph1->natt_options = racoon_calloc (1, sizeof (*iph1->natt_options));

  if (! iph1->natt_options) {
    plog (LLV_ERROR, LOCATION, NULL,
	  "Allocating memory for natt_options failed!\n");
    return;
  }

  // stick to the version we already selected on a previous phase1
  version = ike_session_get_natt_version(iph1);
  if (version) {
    vid_numeric = version;
  }

  if (iph1->natt_options->version < vid_numeric)
    if (natt_fill_options (iph1->natt_options, vid_numeric) == 0)
      iph1->natt_flags |= NAT_ANNOUNCED;
}

static struct remoteconf *
natt_enabled_in_rmconf_stub (struct remoteconf *rmconf, void *data)
{
  return (rmconf->nat_traversal ? rmconf : NULL);
}

int
natt_enabled_in_rmconf ()
{
  return foreachrmconf (natt_enabled_in_rmconf_stub, NULL) != NULL;
}


struct payload_list *
isakmp_plist_append_natt_vids (struct payload_list *plist, vchar_t *vid_natt[MAX_NATT_VID_COUNT]){
	int i, vid_natt_i = 0;

	if(vid_natt == NULL)
		return NULL;

	for (i = 0; i < MAX_NATT_VID_COUNT; i++)
		vid_natt[i]=NULL;
	
	/* Puts the olders VIDs last, as some implementations may choose the first
	 * NATT VID given
	 */

	/* Always set RFC VID
	 */
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_RFC)) != NULL)
		vid_natt_i++;
#ifdef ENABLE_NATT_APPLE
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_APPLE)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_08
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_08)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_07
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_07)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_06
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_06)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_05
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_05)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_04
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_04)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_03
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_03)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_02
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02)) != NULL)
		vid_natt_i++;
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02_N)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_01
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_01)) != NULL)
		vid_natt_i++;
#endif
#ifdef ENABLE_NATT_00
	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_00)) != NULL)
		vid_natt_i++;
#endif
	/* set VID payload for NAT-T */
	for (i = 0; i < vid_natt_i; i++)
		plist = isakmp_plist_append(plist, vid_natt[i], ISAKMP_NPTYPE_VID);
	
	return plist;
}
Commit	Line	Data
52b7d2ce A	1	/*
	2	* Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
	3	* Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
	4	* All rights reserved.
	5	*
	6	* Redistribution and use in source and binary forms, with or without
	7	* modification, are permitted provided that the following conditions
	8	* are met:
	9	* 1. Redistributions of source code must retain the above copyright
	10	* notice, this list of conditions and the following disclaimer.
	11	* 2. Redistributions in binary form must reproduce the above copyright
	12	* notice, this list of conditions and the following disclaimer in the
	13	* documentation and/or other materials provided with the distribution.
	14	* 3. Neither the name of the project nor the names of its contributors
	15	* may be used to endorse or promote products derived from this software
	16	* without specific prior written permission.
	17	*
	18	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	19	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	20	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	21	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	22	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	23	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	24	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	25	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	26	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	27	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	28	* SUCH DAMAGE.
	29	*/
	30
	31	#include "config.h"
	32
	33	#include <sys/types.h>
	34	#include <sys/param.h>
	35
52b7d2ce	36	#include <netinet/udp.h>
52b7d2ce A	37
	38	#include <stdlib.h>
	39	#include <stdio.h>
	40	#include <string.h>
	41	#include <errno.h>
	42	#include <ctype.h>
	43
	44	#include "var.h"
	45	#include "misc.h"
	46	#include "vmbuf.h"
	47	#include "plog.h"
	48	#include "debug.h"
	49
	50	#include "localconf.h"
	51	#include "remoteconf.h"
	52	#include "sockmisc.h"
	53	#include "isakmp_var.h"
	54	#include "isakmp.h"
	55	#include "oakley.h"
	56	#include "ipsec_doi.h"
	57	#include "vendorid.h"
	58	#include "handler.h"
	59	#include "crypto_openssl.h"
	60	#include "schedule.h"
	61	#include "nattraversal.h"
	62	#include "grabmyaddr.h"
d1e348cf	63	#include "ike_session.h"
52b7d2ce A	64
	65	struct natt_ka_addrs {
	66	struct sockaddr *src;
	67	struct sockaddr *dst;
	68	unsigned in_use;
	69
	70	TAILQ_ENTRY(natt_ka_addrs) chain;
	71	};
	72
	73	static TAILQ_HEAD(_natt_ka_addrs, natt_ka_addrs) ka_tree;
	74
	75	/*
	76	* check if the given vid is NAT-T.
	77	*/
	78	int
	79	natt_vendorid (int vid)
	80	{
	81	return (
	82	#ifdef ENABLE_NATT_00
	83	vid == VENDORID_NATT_00 \|\|
	84	#endif
	85	#ifdef ENABLE_NATT_01
	86	vid == VENDORID_NATT_01 \|\|
	87	#endif
	88	#ifdef ENABLE_NATT_02
	89	vid == VENDORID_NATT_02 \|\|
	90	vid == VENDORID_NATT_02_N \|\|
	91	#endif
	92	#ifdef ENABLE_NATT_03
	93	vid == VENDORID_NATT_03 \|\|
	94	#endif
	95	#ifdef ENABLE_NATT_04
	96	vid == VENDORID_NATT_04 \|\|
	97	#endif
	98	#ifdef ENABLE_NATT_05
	99	vid == VENDORID_NATT_05 \|\|
	100	#endif
	101	#ifdef ENABLE_NATT_06
	102	vid == VENDORID_NATT_06 \|\|
	103	#endif
	104	#ifdef ENABLE_NATT_07
	105	vid == VENDORID_NATT_07 \|\|
	106	#endif
	107	#ifdef ENABLE_NATT_08
	108	vid == VENDORID_NATT_08 \|\|
	109	#endif
	110	#ifdef ENABLE_NATT_APPLE
	111	vid == VENDORID_NATT_APPLE \|\|
	112	#endif
	113	/* Always enable NATT RFC if ENABLE_NATT
	114	*/
	115	vid == VENDORID_NATT_RFC);
	116	}
	117
	118	vchar_t *
	119	natt_hash_addr (struct ph1handle iph1, struct sockaddr addr)
	120	{
	121	vchar_t *natd;
	122	vchar_t *buf;
	123	char *ptr;
	124	void addr_ptr, addr_port;
	125	size_t buf_size, addr_size;
	126
	127	plog (LLV_INFO, LOCATION, addr, "Hashing %s with algo #%d %s\n",
128	saddr2str(addr), iph1->approval->hashtype,
129	(iph1->rmconf->nat_traversal == NATT_FORCE)?"(NAT-T forced)":"");
130
131	if (addr->sa_family == AF_INET) {
132	addr_size = sizeof (struct in_addr); /* IPv4 address */
133	addr_ptr = &((struct sockaddr_in *)addr)->sin_addr;
134	addr_port = &((struct sockaddr_in *)addr)->sin_port;
135	}
136	else if (addr->sa_family == AF_INET6) {
137	addr_size = sizeof (struct in6_addr); /* IPv6 address */
138	addr_ptr = &((struct sockaddr_in6 *)addr)->sin6_addr;
139	addr_port = &((struct sockaddr_in6 *)addr)->sin6_port;
140	}
141	else {
142	plog (LLV_ERROR, LOCATION, addr, "Unsupported address family #0x%x\n", addr->sa_family);
143	return NULL;
144	}
145
146	buf_size = 2 * sizeof (cookie_t); /* CKY-I + CKY+R */
147	buf_size += addr_size + 2; /* Address + Port */
148
149	if ((buf = vmalloc (buf_size)) == NULL)
150	return NULL;
151
152	ptr = buf->v;
153
154	/* Copy-in CKY-I */
155	memcpy (ptr, iph1->index.i_ck, sizeof (cookie_t));
156	ptr += sizeof (cookie_t);
157
158	/* Copy-in CKY-I */
159	memcpy (ptr, iph1->index.r_ck, sizeof (cookie_t));
160	ptr += sizeof (cookie_t);
161
162	/* Copy-in Address (or zeroes if NATT_FORCE) */
163	if (iph1->rmconf->nat_traversal == NATT_FORCE)
164	memset (ptr, 0, addr_size);
165	else
166	memcpy (ptr, addr_ptr, addr_size);
167	ptr += addr_size;
168
169	/* Copy-in Port number */
170	memcpy (ptr, addr_port, 2);
171
172	natd = oakley_hash (buf, iph1);
173	vfree(buf);
174
175	return natd;
176	}
177
178	int
179	natt_compare_addr_hash (struct ph1handle iph1, vchar_t natd_received,
180	int natd_seq)
181	{
182	vchar_t *natd_computed;
183	u_int32_t flag;
184	int verified = 0;
185
186	if (iph1->rmconf->nat_traversal == NATT_FORCE)
187	return verified;
188
52b7d2ce A	189	/* old APPLE version sends natd payload in the wrong order */
	190	if (iph1->natt_options->version == VENDORID_NATT_APPLE) {
	191	if (natd_seq == 0) {
	192	natd_computed = natt_hash_addr (iph1, iph1->remote);
	193	flag = NAT_DETECTED_PEER;
	194	}
	195	else {
	196	natd_computed = natt_hash_addr (iph1, iph1->local);
	197	flag = NAT_DETECTED_ME;
	198	}
	199	} else
52b7d2ce A	200	{
	201	if (natd_seq == 0) {
	202	natd_computed = natt_hash_addr (iph1, iph1->local);
	203	flag = NAT_DETECTED_ME;
	204	}
	205	else {
	206	natd_computed = natt_hash_addr (iph1, iph1->remote);
	207	flag = NAT_DETECTED_PEER;
	208	}
	209	}
	210
	211	if (natd_received->l == natd_computed->l &&
	212	memcmp (natd_received->v, natd_computed->v, natd_received->l) == 0) {
	213	iph1->natt_flags &= ~flag;
	214	verified = 1;
	215	}
	216
d1e348cf A	217	if (iph1->parent_session)
	218	iph1->parent_session->natt_flags = iph1->natt_flags;
	219
52b7d2ce A	220	vfree (natd_computed);
	221
	222	return verified;
	223	}
	224
	225	int
	226	natt_udp_encap (int encmode)
	227	{
	228	return (encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC \|\|
	229	encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC \|\|
	230	encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT \|\|
	231	encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT);
	232	}
	233
	234	int
	235	natt_fill_options (struct ph1natt_options *opts, int version)
	236	{
	237	if (! opts)
	238	return -1;
	239
	240	opts->version = version;
	241
	242	switch (version) {
52b7d2ce A	243	case VENDORID_NATT_02:
	244	case VENDORID_NATT_02_N:
	245	case VENDORID_NATT_03:
	246	opts->float_port = lcconf->port_isakmp_natt;
	247	opts->payload_nat_d = ISAKMP_NPTYPE_NATD_DRAFT;
	248	opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_DRAFT;
	249	opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT;
	250	opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT;
	251	opts->encaps_type = UDP_ENCAP_ESPINUDP;
	252	break;
	253	case VENDORID_NATT_04:
	254	case VENDORID_NATT_05:
	255	case VENDORID_NATT_06:
	256	case VENDORID_NATT_07:
	257	case VENDORID_NATT_08:
52b7d2ce A	258	case VENDORID_NATT_APPLE:
	259	opts->float_port = lcconf->port_isakmp_natt;
	260	opts->payload_nat_d = ISAKMP_NPTYPE_NATD_BADDRAFT;
	261	opts->payload_nat_oa = ISAKMP_NPTYPE_NONE;
	262	opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
	263	opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
	264	opts->encaps_type = UDP_ENCAP_ESPINUDP;
	265	break;
52b7d2ce A	266	case VENDORID_NATT_RFC:
	267	opts->float_port = lcconf->port_isakmp_natt;
	268	opts->payload_nat_d = ISAKMP_NPTYPE_NATD_RFC;
	269	opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_RFC;
	270	opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
	271	opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
	272	opts->encaps_type = UDP_ENCAP_ESPINUDP;
	273	break;
	274	default:
	275	plog(LLV_ERROR, LOCATION, NULL,
	276	"unsupported NAT-T version: %s\n",
	277	vid_string_by_id(version));
	278	return -1;
	279	}
	280
	281	opts->mode_udp_diff = opts->mode_udp_tunnel - IPSECDOI_ATTR_ENC_MODE_TUNNEL;
	282
	283	return 0;
	284	}
	285
d1e348cf	286	int
52b7d2ce A	287	create_natoa_payloads(struct ph2handle iph2, vchar_t natoa_i, vchar_t *natoa_r)
	288	{
	289	int natoa_type = 0;
52b7d2ce A	290	vchar_t *i;
	291	vchar_t *r;
	292	u_int8_t *p;
d1e348cf A	293	struct sockaddr *i_addr;
	294	struct sockaddr *r_addr;
	295	size_t i_size;
	296	size_t r_size;
52b7d2ce A	297
	298	natoa_i = natoa_r = NULL;
	299
	300
	301	/* create natoa payloads if natt being used */
	302	/* don't send if type == apple */
d1e348cf A	303	if (!iph2->ph1->natt_options)
	304	return 0;
	305
	306	natoa_type = iph2->ph1->natt_options->payload_nat_oa;
52b7d2ce A	307	if (natoa_type == 0)
52b7d2ce A	308	return 0;
d1e348cf A	309
	310	if (iph2->side == INITIATOR) {
	311	i_addr = iph2->src;
	312	r_addr = iph2->dst;
	313	} else {
	314	i_addr = iph2->dst;
	315	r_addr = iph2->src;
	316	}
	317
	318	switch (i_addr->sa_family) {
52b7d2ce	319	case AF_INET:
d1e348cf	320	i_size = sizeof(in_addr_t);
52b7d2ce A	321	break;
	322	#ifdef INET6
	323	case AF_INET6:
d1e348cf	324	i_size = sizeof(struct in6_addr);
52b7d2ce A	325	break;
	326	#endif
	327	default:
	328	plog(LLV_ERROR, LOCATION, NULL,
d1e348cf	329	"invalid address family: %d\n", i_addr->sa_family);
52b7d2ce A	330	return -1;
52b7d2ce A	331	}
d1e348cf A	332
d1e348cf A	333	switch (r_addr->sa_family) {
52b7d2ce	334	case AF_INET:
d1e348cf	335	r_size = sizeof(in_addr_t);
52b7d2ce A	336	break;
	337	#ifdef INET6
	338	case AF_INET6:
d1e348cf	339	r_size = sizeof(struct in6_addr);
52b7d2ce A	340	break;
	341	#endif
	342	default:
	343	plog(LLV_ERROR, LOCATION, NULL,
d1e348cf	344	"invalid address family: %d\n", r_addr->sa_family);
52b7d2ce A	345	return -1;
	346	}
	347
d1e348cf A	348	i = vmalloc(sizeof(struct isakmp_pl_natoa) + i_size - sizeof(struct isakmp_gen));
	349	if (i == NULL) {
	350	plog(LLV_ERROR, LOCATION, NULL,
	351	"failed to get buffer for natoa payload.\n");
	352	return -1;
	353	}
	354	r = vmalloc(sizeof(struct isakmp_pl_natoa) + r_size - sizeof(struct isakmp_gen));
	355	if (r == NULL) {
	356	vfree(i);
52b7d2ce A	357	plog(LLV_ERROR, LOCATION, NULL,
	358	"failed to get buffer for natoa payload.\n");
	359	return -1;
	360	}
	361
	362	/* copy src address */
d1e348cf	363	p = (__typeof__(p))i->v;
52b7d2ce	364
d1e348cf	365	switch (i_addr->sa_family) {
52b7d2ce A	366	case AF_INET:
52b7d2ce A	367	*p = IPSECDOI_ID_IPV4_ADDR;
d1e348cf	368	bcopy(&(((struct sockaddr_in *)i_addr)->sin_addr.s_addr), p + sizeof(u_int32_t), i_size);
52b7d2ce A	369	break;
	370	#ifdef INET6
	371	case AF_INET6:
	372	*p = IPSECDOI_ID_IPV6_ADDR;
d1e348cf	373	bcopy(&(((struct sockaddr_in6 *)i_addr)->sin6_addr), p + sizeof(u_int32_t), i_size);
52b7d2ce A	374	break;
	375	#endif
	376	}
	377
	378	/* copy dst address */
d1e348cf	379	p = (__typeof__(p))r->v;
52b7d2ce	380
d1e348cf	381	switch (r_addr->sa_family) {
52b7d2ce A	382	case AF_INET:
52b7d2ce A	383	*p = IPSECDOI_ID_IPV4_ADDR;
d1e348cf	384	bcopy(&(((struct sockaddr_in *)r_addr)->sin_addr.s_addr), p + sizeof(u_int32_t), r_size);
52b7d2ce A	385	break;
	386	#ifdef INET6
	387	case AF_INET6:
	388	*p = IPSECDOI_ID_IPV6_ADDR;
d1e348cf	389	bcopy(&(((struct sockaddr_in6 *)r_addr)->sin6_addr), p + sizeof(u_int32_t), r_size);
52b7d2ce A	390	break;
	391	#endif
	392	}
	393
	394	*natoa_i = i;
	395	*natoa_r = r;
	396	return natoa_type;
	397	}
d1e348cf A	398
	399	struct sockaddr *
	400	process_natoa_payload(vchar_t *buf)
	401	{
	402	struct sockaddr *saddr = NULL;
	403	struct ipsecdoi_id_b id_b = (struct ipsecdoi_id_b )buf->v;
	404
	405	switch (id_b->type) {
	406	case IPSECDOI_ID_IPV4_ADDR:
	407	saddr = racoon_malloc(sizeof(struct sockaddr_in));
	408	if (!saddr) {
	409	plog(LLV_ERROR, LOCATION, NULL,
	410	"error allocating addr for NAT-OA payload\n");
	411	return NULL;
	412	}
	413	saddr->sa_len = sizeof(struct sockaddr_in);
	414	saddr->sa_family = AF_INET;
	415	((struct sockaddr_in *)saddr)->sin_port = IPSEC_PORT_ANY;
	416	memcpy(&((struct sockaddr_in *)saddr)->sin_addr,
	417	buf->v + sizeof(*id_b), sizeof(struct in_addr));
	418	break;
	419	#ifdef INET6
	420	case IPSECDOI_ID_IPV6_ADDR:
	421	saddr = racoon_malloc(sizeof(struct sockaddr_in6));
	422	if (!saddr) {
	423	plog(LLV_ERROR, LOCATION, NULL,
	424	"error allocating addr for NAT-OA payload\n");
	425	return NULL;
	426	}
	427	saddr->sa_len = sizeof(struct sockaddr_in6);
	428	saddr->sa_family = AF_INET6;
	429	((struct sockaddr_in6 *)saddr)->sin6_port = IPSEC_PORT_ANY;
	430	memcpy(&((struct sockaddr_in6 *)saddr)->sin6_addr,
	431	buf->v + sizeof(*id_b), sizeof(struct in6_addr));
	432	break;
	433	#endif
	434	default:
	435	plog(LLV_ERROR, LOCATION, NULL,
	436	"invalid NAT-OA payload %d\n", id_b->type);
	437	return NULL;
	438	}
	439	return saddr;
	440	}
52b7d2ce A	441
	442	void
	443	natt_float_ports (struct ph1handle *iph1)
	444	{
	445
47612122	446	if (! (iph1->natt_flags & NAT_DETECTED) )
52b7d2ce A	447	return;
	448	if (! iph1->natt_options->float_port){
	449	/* Drafts 00 / 01, just schedule keepalive */
52b7d2ce A	450	return;
	451	}
	452
	453	/*
	454	* Only switch ports if port == isakmp port.
	455	* In the case where ports are set from policy or from
	456	* remote config we could be talking to a device behind
	457	* a nat using the translated port.
	458	*/
	459	if (*get_port_ptr(iph1->local) == htons(lcconf->port_isakmp))
	460	set_port (iph1->local, iph1->natt_options->float_port);
	461	if (*get_port_ptr(iph1->remote) == htons(lcconf->port_isakmp))
	462	set_port (iph1->remote, iph1->natt_options->float_port);
	463	iph1->natt_flags \|= NAT_PORTS_CHANGED \| NAT_ADD_NON_ESP_MARKER;
	464
d1e348cf	465	ike_session_ikev1_float_ports(iph1);
52b7d2ce A	466	}
	467
	468	void
	469	natt_handle_vendorid (struct ph1handle *iph1, int vid_numeric)
	470	{
80318cb7 A	471	int version;
80318cb7 A	472
52b7d2ce A	473	if (! iph1->natt_options)
	474	iph1->natt_options = racoon_calloc (1, sizeof (*iph1->natt_options));
	475
	476	if (! iph1->natt_options) {
	477	plog (LLV_ERROR, LOCATION, NULL,
	478	"Allocating memory for natt_options failed!\n");
	479	return;
	480	}
80318cb7 A	481
	482	// stick to the version we already selected on a previous phase1
	483	version = ike_session_get_natt_version(iph1);
	484	if (version) {
	485	vid_numeric = version;
	486	}
	487
52b7d2ce A	488	if (iph1->natt_options->version < vid_numeric)
	489	if (natt_fill_options (iph1->natt_options, vid_numeric) == 0)
	490	iph1->natt_flags \|= NAT_ANNOUNCED;
	491	}
	492
52b7d2ce A	493	static struct remoteconf *
	494	natt_enabled_in_rmconf_stub (struct remoteconf rmconf, void data)
	495	{
	496	return (rmconf->nat_traversal ? rmconf : NULL);
	497	}
	498
	499	int
	500	natt_enabled_in_rmconf ()
	501	{
	502	return foreachrmconf (natt_enabled_in_rmconf_stub, NULL) != NULL;
	503	}
	504
	505
	506	struct payload_list *
	507	isakmp_plist_append_natt_vids (struct payload_list plist, vchar_t vid_natt[MAX_NATT_VID_COUNT]){
	508	int i, vid_natt_i = 0;
	509
	510	if(vid_natt == NULL)
	511	return NULL;
	512
	513	for (i = 0; i < MAX_NATT_VID_COUNT; i++)
	514	vid_natt[i]=NULL;
	515
	516	/* Puts the olders VIDs last, as some implementations may choose the first
	517	* NATT VID given
	518	*/
	519
	520	/* Always set RFC VID
	521	*/
	522	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_RFC)) != NULL)
	523	vid_natt_i++;
	524	#ifdef ENABLE_NATT_APPLE
	525	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_APPLE)) != NULL)
	526	vid_natt_i++;
	527	#endif
	528	#ifdef ENABLE_NATT_08
	529	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_08)) != NULL)
	530	vid_natt_i++;
	531	#endif
	532	#ifdef ENABLE_NATT_07
	533	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_07)) != NULL)
	534	vid_natt_i++;
	535	#endif
	536	#ifdef ENABLE_NATT_06
	537	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_06)) != NULL)
	538	vid_natt_i++;
	539	#endif
	540	#ifdef ENABLE_NATT_05
	541	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_05)) != NULL)
	542	vid_natt_i++;
	543	#endif
	544	#ifdef ENABLE_NATT_04
	545	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_04)) != NULL)
	546	vid_natt_i++;
	547	#endif
	548	#ifdef ENABLE_NATT_03
	549	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_03)) != NULL)
	550	vid_natt_i++;
	551	#endif
	552	#ifdef ENABLE_NATT_02
	553	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02)) != NULL)
	554	vid_natt_i++;
	555	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02_N)) != NULL)
	556	vid_natt_i++;
557	#endif
558	#ifdef ENABLE_NATT_01
559	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_01)) != NULL)
560	vid_natt_i++;
561	#endif
562	#ifdef ENABLE_NATT_00
563	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_00)) != NULL)
564	vid_natt_i++;
565	#endif
566	/* set VID payload for NAT-T */
567	for (i = 0; i < vid_natt_i; i++)
568	plist = isakmp_plist_append(plist, vid_natt[i], ISAKMP_NPTYPE_VID);
569
570	return plist;
571	}