]> git.saurik.com Git - apple/ipsec.git/blob - ipsec-tools/racoon/nattraversal.c
a9c02b12b206cfc855f98fcddf47490348c8b73f
[apple/ipsec.git] / ipsec-tools / racoon / nattraversal.c
1 /*
2 * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
3 * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of the project nor the names of its contributors
15 * may be used to endorse or promote products derived from this software
16 * without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 */
30
31 #include "config.h"
32
33 #include <sys/types.h>
34 #include <sys/param.h>
35
36 #ifdef __linux__
37 #include <linux/udp.h>
38 #endif
39 #if defined(__NetBSD__) || defined (__FreeBSD__)
40 #include <netinet/udp.h>
41 #endif
42
43 #include <stdlib.h>
44 #include <stdio.h>
45 #include <string.h>
46 #include <errno.h>
47 #include <ctype.h>
48
49 #include "var.h"
50 #include "misc.h"
51 #include "vmbuf.h"
52 #include "plog.h"
53 #include "debug.h"
54
55 #include "localconf.h"
56 #include "remoteconf.h"
57 #include "sockmisc.h"
58 #include "isakmp_var.h"
59 #include "isakmp.h"
60 #include "oakley.h"
61 #include "ipsec_doi.h"
62 #include "vendorid.h"
63 #include "handler.h"
64 #include "crypto_openssl.h"
65 #include "schedule.h"
66 #include "nattraversal.h"
67 #include "grabmyaddr.h"
68
69 struct natt_ka_addrs {
70 struct sockaddr *src;
71 struct sockaddr *dst;
72 unsigned in_use;
73
74 TAILQ_ENTRY(natt_ka_addrs) chain;
75 };
76
77 static TAILQ_HEAD(_natt_ka_addrs, natt_ka_addrs) ka_tree;
78
79 /*
80 * check if the given vid is NAT-T.
81 */
82 int
83 natt_vendorid (int vid)
84 {
85 return (
86 #ifdef ENABLE_NATT_00
87 vid == VENDORID_NATT_00 ||
88 #endif
89 #ifdef ENABLE_NATT_01
90 vid == VENDORID_NATT_01 ||
91 #endif
92 #ifdef ENABLE_NATT_02
93 vid == VENDORID_NATT_02 ||
94 vid == VENDORID_NATT_02_N ||
95 #endif
96 #ifdef ENABLE_NATT_03
97 vid == VENDORID_NATT_03 ||
98 #endif
99 #ifdef ENABLE_NATT_04
100 vid == VENDORID_NATT_04 ||
101 #endif
102 #ifdef ENABLE_NATT_05
103 vid == VENDORID_NATT_05 ||
104 #endif
105 #ifdef ENABLE_NATT_06
106 vid == VENDORID_NATT_06 ||
107 #endif
108 #ifdef ENABLE_NATT_07
109 vid == VENDORID_NATT_07 ||
110 #endif
111 #ifdef ENABLE_NATT_08
112 vid == VENDORID_NATT_08 ||
113 #endif
114 #ifdef ENABLE_NATT_APPLE
115 vid == VENDORID_NATT_APPLE ||
116 #endif
117 /* Always enable NATT RFC if ENABLE_NATT
118 */
119 vid == VENDORID_NATT_RFC);
120 }
121
122 vchar_t *
123 natt_hash_addr (struct ph1handle *iph1, struct sockaddr *addr)
124 {
125 vchar_t *natd;
126 vchar_t *buf;
127 char *ptr;
128 void *addr_ptr, *addr_port;
129 size_t buf_size, addr_size;
130
131 plog (LLV_INFO, LOCATION, addr, "Hashing %s with algo #%d %s\n",
132 saddr2str(addr), iph1->approval->hashtype,
133 (iph1->rmconf->nat_traversal == NATT_FORCE)?"(NAT-T forced)":"");
134
135 if (addr->sa_family == AF_INET) {
136 addr_size = sizeof (struct in_addr); /* IPv4 address */
137 addr_ptr = &((struct sockaddr_in *)addr)->sin_addr;
138 addr_port = &((struct sockaddr_in *)addr)->sin_port;
139 }
140 else if (addr->sa_family == AF_INET6) {
141 addr_size = sizeof (struct in6_addr); /* IPv6 address */
142 addr_ptr = &((struct sockaddr_in6 *)addr)->sin6_addr;
143 addr_port = &((struct sockaddr_in6 *)addr)->sin6_port;
144 }
145 else {
146 plog (LLV_ERROR, LOCATION, addr, "Unsupported address family #0x%x\n", addr->sa_family);
147 return NULL;
148 }
149
150 buf_size = 2 * sizeof (cookie_t); /* CKY-I + CKY+R */
151 buf_size += addr_size + 2; /* Address + Port */
152
153 if ((buf = vmalloc (buf_size)) == NULL)
154 return NULL;
155
156 ptr = buf->v;
157
158 /* Copy-in CKY-I */
159 memcpy (ptr, iph1->index.i_ck, sizeof (cookie_t));
160 ptr += sizeof (cookie_t);
161
162 /* Copy-in CKY-I */
163 memcpy (ptr, iph1->index.r_ck, sizeof (cookie_t));
164 ptr += sizeof (cookie_t);
165
166 /* Copy-in Address (or zeroes if NATT_FORCE) */
167 if (iph1->rmconf->nat_traversal == NATT_FORCE)
168 memset (ptr, 0, addr_size);
169 else
170 memcpy (ptr, addr_ptr, addr_size);
171 ptr += addr_size;
172
173 /* Copy-in Port number */
174 memcpy (ptr, addr_port, 2);
175
176 natd = oakley_hash (buf, iph1);
177 vfree(buf);
178
179 return natd;
180 }
181
182 int
183 natt_compare_addr_hash (struct ph1handle *iph1, vchar_t *natd_received,
184 int natd_seq)
185 {
186 vchar_t *natd_computed;
187 u_int32_t flag;
188 int verified = 0;
189
190 if (iph1->rmconf->nat_traversal == NATT_FORCE)
191 return verified;
192
193 #ifdef __APPLE__
194 /* old APPLE version sends natd payload in the wrong order */
195 if (iph1->natt_options->version == VENDORID_NATT_APPLE) {
196 if (natd_seq == 0) {
197 natd_computed = natt_hash_addr (iph1, iph1->remote);
198 flag = NAT_DETECTED_PEER;
199 }
200 else {
201 natd_computed = natt_hash_addr (iph1, iph1->local);
202 flag = NAT_DETECTED_ME;
203 }
204 } else
205 #endif
206 {
207 if (natd_seq == 0) {
208 natd_computed = natt_hash_addr (iph1, iph1->local);
209 flag = NAT_DETECTED_ME;
210 }
211 else {
212 natd_computed = natt_hash_addr (iph1, iph1->remote);
213 flag = NAT_DETECTED_PEER;
214 }
215 }
216
217 if (natd_received->l == natd_computed->l &&
218 memcmp (natd_received->v, natd_computed->v, natd_received->l) == 0) {
219 iph1->natt_flags &= ~flag;
220 verified = 1;
221 }
222
223 vfree (natd_computed);
224
225 return verified;
226 }
227
228 int
229 natt_udp_encap (int encmode)
230 {
231 return (encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC ||
232 encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC ||
233 encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT ||
234 encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT);
235 }
236
237 int
238 natt_fill_options (struct ph1natt_options *opts, int version)
239 {
240 if (! opts)
241 return -1;
242
243 opts->version = version;
244
245 switch (version) {
246 #ifndef __APPLE__
247 case VENDORID_NATT_00:
248 case VENDORID_NATT_01:
249 opts->float_port = 0; /* No port floating for those drafts */
250 opts->payload_nat_d = ISAKMP_NPTYPE_NATD_DRAFT;
251 opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_DRAFT;
252 opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT;
253 opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT;
254 opts->encaps_type = UDP_ENCAP_ESPINUDP_NON_IKE;
255 break;
256 #endif
257
258 case VENDORID_NATT_02:
259 case VENDORID_NATT_02_N:
260 case VENDORID_NATT_03:
261 opts->float_port = lcconf->port_isakmp_natt;
262 opts->payload_nat_d = ISAKMP_NPTYPE_NATD_DRAFT;
263 opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_DRAFT;
264 opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT;
265 opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT;
266 opts->encaps_type = UDP_ENCAP_ESPINUDP;
267 break;
268 case VENDORID_NATT_04:
269 case VENDORID_NATT_05:
270 case VENDORID_NATT_06:
271 case VENDORID_NATT_07:
272 case VENDORID_NATT_08:
273 #ifdef __APPLE__
274 case VENDORID_NATT_APPLE:
275 opts->float_port = lcconf->port_isakmp_natt;
276 opts->payload_nat_d = ISAKMP_NPTYPE_NATD_BADDRAFT;
277 opts->payload_nat_oa = ISAKMP_NPTYPE_NONE;
278 opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
279 opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
280 opts->encaps_type = UDP_ENCAP_ESPINUDP;
281 break;
282 #endif
283 case VENDORID_NATT_RFC:
284 opts->float_port = lcconf->port_isakmp_natt;
285 opts->payload_nat_d = ISAKMP_NPTYPE_NATD_RFC;
286 opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_RFC;
287 opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
288 opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
289 opts->encaps_type = UDP_ENCAP_ESPINUDP;
290 break;
291 default:
292 plog(LLV_ERROR, LOCATION, NULL,
293 "unsupported NAT-T version: %s\n",
294 vid_string_by_id(version));
295 return -1;
296 }
297
298 opts->mode_udp_diff = opts->mode_udp_tunnel - IPSECDOI_ATTR_ENC_MODE_TUNNEL;
299
300 return 0;
301 }
302
303 #ifdef NOT_NOW
304 static int
305 create_natoa_payloads(struct ph2handle *iph2, vchar_t **natoa_i, vchar_t **natoa_r)
306 {
307 int natoa_type = 0;
308 int natt_type;
309 vchar_t *i;
310 vchar_t *r;
311 u_int8_t *p;
312 size_t src_size;
313 size_t dst_size;
314
315 *natoa_i = *natoa_r = NULL;
316
317
318 /* create natoa payloads if natt being used */
319 /* don't send if type == apple */
320 if ((natt_type = natd_hasnat(iph2->ph1)) != 0)
321 if (natt_type == natt_type_rfc)
322 natoa_type = ISAKMP_NPTYPE_NATOA_RFC;
323 else if (natt_type == natt_type_02 || natt_type == natt_type_02N)
324 natoa_type = ISAKMP_NPTYPE_NATOA_DRAFT;
325
326 if (natoa_type == 0)
327 return 0;
328
329 switch (iph2->src->sa_family) {
330 case AF_INET:
331 src_size = sizeof(in_addr_t);
332 break;
333 #ifdef INET6
334 case AF_INET6:
335 src_size = sizeof(struct in6_addr);
336 break;
337 #endif
338 default:
339 plog(LLV_ERROR, LOCATION, NULL,
340 "invalid address family: %d\n", iph2->src->sa_family);
341 return -1;
342 }
343
344 switch (iph2->dst->sa_family) {
345 case AF_INET:
346 dst_size = sizeof(in_addr_t);
347 break;
348 #ifdef INET6
349 case AF_INET6:
350 dst_size = sizeof(struct in6_addr);
351 break;
352 #endif
353 default:
354 plog(LLV_ERROR, LOCATION, NULL,
355 "invalid address family: %d\n", iph2->dst->sa_family);
356 return -1;
357 }
358
359 i = vmalloc(sizeof(struct isakmp_pl_natoa) + src_size - sizeof(struct isakmp_gen));
360 r = vmalloc(sizeof(struct isakmp_pl_natoa) + dst_size - sizeof(struct isakmp_gen));
361 if (i == NULL || r == NULL) {
362 plog(LLV_ERROR, LOCATION, NULL,
363 "failed to get buffer for natoa payload.\n");
364 return -1;
365 }
366
367 /* copy src address */
368 p = i->v;
369
370 switch (iph2->src->sa_family) {
371 case AF_INET:
372 *p = IPSECDOI_ID_IPV4_ADDR;
373 bcopy(&(((struct sockaddr_in *)iph2->src)->sin_addr.s_addr), p + sizeof(u_int32_t), src_size);
374 break;
375 #ifdef INET6
376 case AF_INET6:
377 *p = IPSECDOI_ID_IPV6_ADDR;
378 bcopy(&(((struct sockaddr_in6 *)iph2->src)->sin6_addr), p + sizeof(u_int32_t), src_size);
379 break;
380 #endif
381 }
382
383 /* copy dst address */
384 p = r->v;
385
386 switch (iph2->dst->sa_family) {
387 case AF_INET:
388 *p = IPSECDOI_ID_IPV4_ADDR;
389 bcopy(&(((struct sockaddr_in *)iph2->dst)->sin_addr.s_addr), p + sizeof(u_int32_t), dst_size);
390 break;
391 #ifdef INET6
392 case AF_INET6:
393 *p = IPSECDOI_ID_IPV6_ADDR;
394 bcopy(&(((struct sockaddr_in6 *)iph2->dst)->sin6_addr), p + sizeof(u_int32_t), dst_size);
395 break;
396 #endif
397 }
398
399 *natoa_i = i;
400 *natoa_r = r;
401 return natoa_type;
402 }
403 #endif
404
405
406 void
407 natt_float_ports (struct ph1handle *iph1)
408 {
409
410 if (! (iph1->natt_flags && NAT_DETECTED) )
411 return;
412 if (! iph1->natt_options->float_port){
413 /* Drafts 00 / 01, just schedule keepalive */
414 #ifndef __APPLE__
415 natt_keepalive_add_ph1 (iph1);
416 #endif
417 return;
418 }
419
420 /*
421 * Only switch ports if port == isakmp port.
422 * In the case where ports are set from policy or from
423 * remote config we could be talking to a device behind
424 * a nat using the translated port.
425 */
426 if (*get_port_ptr(iph1->local) == htons(lcconf->port_isakmp))
427 set_port (iph1->local, iph1->natt_options->float_port);
428 if (*get_port_ptr(iph1->remote) == htons(lcconf->port_isakmp))
429 set_port (iph1->remote, iph1->natt_options->float_port);
430 iph1->natt_flags |= NAT_PORTS_CHANGED | NAT_ADD_NON_ESP_MARKER;
431
432
433 #ifndef __APPLE__
434 natt_keepalive_add_ph1 (iph1);
435 #endif
436 }
437
438 void
439 natt_handle_vendorid (struct ph1handle *iph1, int vid_numeric)
440 {
441 if (! iph1->natt_options)
442 iph1->natt_options = racoon_calloc (1, sizeof (*iph1->natt_options));
443
444 if (! iph1->natt_options) {
445 plog (LLV_ERROR, LOCATION, NULL,
446 "Allocating memory for natt_options failed!\n");
447 return;
448 }
449
450 if (iph1->natt_options->version < vid_numeric)
451 if (natt_fill_options (iph1->natt_options, vid_numeric) == 0)
452 iph1->natt_flags |= NAT_ANNOUNCED;
453 }
454
455 #ifndef __APPLE__
456 /* NAT keepalive functions */
457 static void
458 natt_keepalive_send (void *param)
459 {
460 struct natt_ka_addrs *ka, *next = NULL;
461 char keepalive_packet[] = { 0xff };
462 size_t len;
463 int s;
464
465 for (ka = TAILQ_FIRST(&ka_tree); ka; ka = next) {
466 next = TAILQ_NEXT(ka, chain);
467
468 s = getsockmyaddr(ka->src);
469 if (s == -1) {
470 TAILQ_REMOVE (&ka_tree, ka, chain);
471 racoon_free (ka);
472 continue;
473 }
474 plog (LLV_DEBUG, LOCATION, NULL, "KA: %s\n",
475 saddr2str_fromto("%s->%s", ka->src, ka->dst));
476 len = sendfromto(s, keepalive_packet, sizeof (keepalive_packet),
477 ka->src, ka->dst, 1);
478 if (len == -1)
479 plog(LLV_ERROR, LOCATION, NULL, "KA: sendfromto failed: %s\n",
480 strerror (errno));
481 }
482
483 sched_new (lcconf->natt_ka_interval, natt_keepalive_send, NULL);
484 }
485
486 void
487 natt_keepalive_init (void)
488 {
489 TAILQ_INIT(&ka_tree);
490
491 /* To disable sending KAs set natt_ka_interval=0 */
492 if (lcconf->natt_ka_interval > 0)
493 sched_new (lcconf->natt_ka_interval, natt_keepalive_send, NULL);
494 }
495
496 int
497 natt_keepalive_add (struct sockaddr *src, struct sockaddr *dst)
498 {
499 struct natt_ka_addrs *ka = NULL, *new_addr;
500
501 TAILQ_FOREACH (ka, &ka_tree, chain) {
502 if (cmpsaddrstrict(ka->src, src) == 0 &&
503 cmpsaddrstrict(ka->dst, dst) == 0) {
504 ka->in_use++;
505 plog (LLV_INFO, LOCATION, NULL, "KA found: %s (in_use=%u)\n",
506 saddr2str_fromto("%s->%s", src, dst), ka->in_use);
507 return 0;
508 }
509 }
510
511 plog (LLV_INFO, LOCATION, NULL, "KA list add: %s\n", saddr2str_fromto("%s->%s", src, dst));
512
513 new_addr = (struct natt_ka_addrs *)racoon_malloc(sizeof(*new_addr));
514 if (! new_addr) {
515 plog (LLV_ERROR, LOCATION, NULL, "Can't allocate new KA list item\n");
516 return -1;
517 }
518
519 new_addr->src = dupsaddr(src);
520 new_addr->dst = dupsaddr(dst);
521 new_addr->in_use = 1;
522 TAILQ_INSERT_TAIL(&ka_tree, new_addr, chain);
523
524 return 0;
525 }
526
527 int
528 natt_keepalive_add_ph1 (struct ph1handle *iph1)
529 {
530 int ret = 0;
531
532 /* Should only the NATed host send keepalives?
533 If yes, add '(iph1->natt_flags & NAT_DETECTED_ME)'
534 to the following condition. */
535 if (iph1->natt_flags & NAT_DETECTED &&
536 ! (iph1->natt_flags & NAT_KA_QUEUED)) {
537 ret = natt_keepalive_add (iph1->local, iph1->remote);
538 if (ret == 0)
539 iph1->natt_flags |= NAT_KA_QUEUED;
540 }
541
542 return ret;
543 }
544
545 void
546 natt_keepalive_remove (struct sockaddr *src, struct sockaddr *dst)
547 {
548 struct natt_ka_addrs *ka, *next = NULL;
549
550 plog (LLV_INFO, LOCATION, NULL, "KA remove: %s\n", saddr2str_fromto("%s->%s", src, dst));
551
552 for (ka = TAILQ_FIRST(&ka_tree); ka; ka = next) {
553 next = TAILQ_NEXT(ka, chain);
554
555 plog (LLV_DEBUG, LOCATION, NULL, "KA tree dump: %s (in_use=%u)\n",
556 saddr2str_fromto("%s->%s", src, dst), ka->in_use);
557
558 if (cmpsaddrstrict(ka->src, src) == 0 &&
559 cmpsaddrstrict(ka->dst, dst) == 0 &&
560 -- ka->in_use <= 0) {
561
562 plog (LLV_DEBUG, LOCATION, NULL, "KA removing this one...\n");
563
564 TAILQ_REMOVE (&ka_tree, ka, chain);
565 racoon_free (ka);
566 /* Should we break here? Every pair of addresses should
567 be inserted only once, but who knows :-) Lets traverse
568 the whole list... */
569 }
570 }
571 }
572 #endif /* __APPLE__ */
573
574 static struct remoteconf *
575 natt_enabled_in_rmconf_stub (struct remoteconf *rmconf, void *data)
576 {
577 return (rmconf->nat_traversal ? rmconf : NULL);
578 }
579
580 int
581 natt_enabled_in_rmconf ()
582 {
583 return foreachrmconf (natt_enabled_in_rmconf_stub, NULL) != NULL;
584 }
585
586
587 struct payload_list *
588 isakmp_plist_append_natt_vids (struct payload_list *plist, vchar_t *vid_natt[MAX_NATT_VID_COUNT]){
589 int i, vid_natt_i = 0;
590
591 if(vid_natt == NULL)
592 return NULL;
593
594 for (i = 0; i < MAX_NATT_VID_COUNT; i++)
595 vid_natt[i]=NULL;
596
597 /* Puts the olders VIDs last, as some implementations may choose the first
598 * NATT VID given
599 */
600
601 /* Always set RFC VID
602 */
603 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_RFC)) != NULL)
604 vid_natt_i++;
605 #ifdef ENABLE_NATT_APPLE
606 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_APPLE)) != NULL)
607 vid_natt_i++;
608 #endif
609 #ifdef ENABLE_NATT_08
610 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_08)) != NULL)
611 vid_natt_i++;
612 #endif
613 #ifdef ENABLE_NATT_07
614 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_07)) != NULL)
615 vid_natt_i++;
616 #endif
617 #ifdef ENABLE_NATT_06
618 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_06)) != NULL)
619 vid_natt_i++;
620 #endif
621 #ifdef ENABLE_NATT_05
622 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_05)) != NULL)
623 vid_natt_i++;
624 #endif
625 #ifdef ENABLE_NATT_04
626 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_04)) != NULL)
627 vid_natt_i++;
628 #endif
629 #ifdef ENABLE_NATT_03
630 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_03)) != NULL)
631 vid_natt_i++;
632 #endif
633 #ifdef ENABLE_NATT_02
634 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02)) != NULL)
635 vid_natt_i++;
636 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02_N)) != NULL)
637 vid_natt_i++;
638 #endif
639 #ifdef ENABLE_NATT_01
640 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_01)) != NULL)
641 vid_natt_i++;
642 #endif
643 #ifdef ENABLE_NATT_00
644 if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_00)) != NULL)
645 vid_natt_i++;
646 #endif
647 /* set VID payload for NAT-T */
648 for (i = 0; i < vid_natt_i; i++)
649 plist = isakmp_plist_append(plist, vid_natt[i], ISAKMP_NPTYPE_VID);
650
651 return plist;
652 }