ipsec-326.tar.gz

[apple/ipsec.git] / ipsec-tools / racoon / ipsec_doi.c

diff --git a/ipsec-tools/racoon/ipsec_doi.c b/ipsec-tools/racoon/ipsec_doi.c
index 8fe1460b81510892746a85bf33216dcdbae96280..1b556579d2a0576de770896921aa534803cfbb9f 100644 (file)
--- a/ipsec-tools/racoon/ipsec_doi.c
+++ b/ipsec-tools/racoon/ipsec_doi.c
@@ -86,7 +86,6 @@
 #ifdef ENABLE_NATT
 #include "nattraversal.h"
 #endif
 #ifdef ENABLE_NATT
 #include "nattraversal.h"
 #endif

-#include "ikev2_rfc.h"

 
 #ifdef ENABLE_HYBRID
 static int switch_authmethod(int);
 
 #ifdef ENABLE_HYBRID
 static int switch_authmethod(int);


@@ -372,7 +371,6 @@ get_ph1approvalx(p, proposal, sap, check_level)
                    tsap->encklen == s->encklen &&
                        tsap->version == s->version) {
                        switch(check_level) {
                    tsap->encklen == s->encklen &&
                        tsap->version == s->version) {
                        switch(check_level) {

-                       case PROP_CHECK_IKEV2:

                        case PROP_CHECK_OBEY:
                                goto found;
                                break;
                        case PROP_CHECK_OBEY:
                                goto found;
                                break;


@@ -1074,11 +1072,17 @@ get_ph2approvalx(iph2, pp)
        }
        /* no proposal matching */
 err:
        }
        /* no proposal matching */
 err:

-       flushsaprop(pr0);
+       if (pr0 != NULL) {
+               flushsaprop(pr0);
+               pr0 = NULL;
+       }

        return NULL;
 
 found:
        return NULL;
 
 found:

-       flushsaprop(pr0);
+       if (pr0 != NULL) {
+               flushsaprop(pr0);
+               pr0 = NULL;
+       }

        plog(ASL_LEVEL_DEBUG, "matched\n");
        iph2->approval = pr;
 
        plog(ASL_LEVEL_DEBUG, "matched\n");
        iph2->approval = pr;
 


@@ -2567,8 +2571,6 @@ ipsecdoi_setph1proposal (phase1_handle_t *iph1)
                (ALIGNED_CAST(struct ipsecdoi_sa_b *)mysa->v)->sit = htonl(props->rmconf->sittype);
         
                (void)setph1prop(iph1, mysa->v + sizeof(struct ipsecdoi_sa_b));
                (ALIGNED_CAST(struct ipsecdoi_sa_b *)mysa->v)->sit = htonl(props->rmconf->sittype);
         
                (void)setph1prop(iph1, mysa->v + sizeof(struct ipsecdoi_sa_b));

-       } else {
-               (void)setph1prop(iph1, mysa->v);

        }
     
        return mysa;
        }
     
        return mysa;


@@ -2579,7 +2581,6 @@ setph1prop (phase1_handle_t *iph1,
                        caddr_t buf)
 {
     struct isakmpsa *props = iph1->rmconf->proposal;
                        caddr_t buf)
 {
     struct isakmpsa *props = iph1->rmconf->proposal;

-    unsigned int version = iph1->version;

     
        struct isakmp_pl_p *prop = NULL;
        struct isakmpsa *s = NULL;
     
        struct isakmp_pl_p *prop = NULL;
        struct isakmpsa *s = NULL;


@@ -2587,10 +2588,7 @@ setph1prop (phase1_handle_t *iph1,
        u_int8_t *np_t; /* pointer next trns type in previous header */
        int trns_num;
        caddr_t p = buf;
        u_int8_t *np_t; /* pointer next trns type in previous header */
        int trns_num;
        caddr_t p = buf;

-       u_int16_t tmplen;

     int spi_size = 0;
     int spi_size = 0;

-    cookie_t *my_cookie = (iph1->side == INITIATOR) ? &iph1->index.i_ck : &iph1->index.r_ck;
-    

 
        proplen = sizeof(*prop) + spi_size;
        if (buf) {
 
        proplen = sizeof(*prop) + spi_size;
        if (buf) {


@@ -2965,7 +2963,6 @@ setph2proposal0(iph2, pp, pr)
        return p;
 }
 
        return p;
 }
 

-

 /*
  * create phase2 proposal from policy configuration.
  * NOT INCLUDING isakmp general header of SA payload.
 /*
  * create phase2 proposal from policy configuration.
  * NOT INCLUDING isakmp general header of SA payload.


@@ -3007,16 +3004,14 @@ ipsecdoi_setph2proposal(phase2_handle_t *iph2, int return_sa)
        for (a = proposal; a; a = a->next) {
                for (b = a->head; b; b = b->next) {
             if (b->proto_id == IPSECDOI_PROTO_IPCOMP) {
        for (a = proposal; a; a = a->next) {
                for (b = a->head; b; b = b->next) {
             if (b->proto_id == IPSECDOI_PROTO_IPCOMP) {

-                // %%%%% todo - IKEv2 uses ipcomp notification

                 // skip this - not specified in the SA
                 // Need to set this in iph2 ???
                 continue;
             }
             // IKEv1 sends encode mode in SA - uses diferent codes when NATT being used
                 // skip this - not specified in the SA
                 // Need to set this in iph2 ???
                 continue;
             }
             // IKEv1 sends encode mode in SA - uses diferent codes when NATT being used

-            // IKEv2 does not send encode mode in SA

 #ifdef ENABLE_NATT
             if (iph2->ph1->natt_flags & NAT_DETECTED) {
 #ifdef ENABLE_NATT
             if (iph2->ph1->natt_flags & NAT_DETECTED) {

-                plog (ASL_LEVEL_INFO, "NAT detected -> UDP encapsulation\n");
+                plog (ASL_LEVEL_NOTICE, "NAT detected -> UDP encapsulation\n");

                 b->udp_encap = 1;
                 if (iph2->version == ISAKMP_VERSION_NUMBER_IKEV1) {
                     int udp_diff = iph2->ph1->natt_options->mode_udp_diff;
                 b->udp_encap = 1;
                 if (iph2->version == ISAKMP_VERSION_NUMBER_IKEV1) {
                     int udp_diff = iph2->ph1->natt_options->mode_udp_diff;


@@ -3672,6 +3667,7 @@ ipsecdoi_setid1(iph1)
        vchar_t *ret = NULL;
        struct ipsecdoi_id_b id_b;
        vchar_t *ident = NULL;
        vchar_t *ret = NULL;
        struct ipsecdoi_id_b id_b;
        vchar_t *ident = NULL;

+       struct sockaddr_in v4_address;

        struct sockaddr_storage *ipid = NULL;
 
        /* init */
        struct sockaddr_storage *ipid = NULL;
 
        /* init */


@@ -3753,6 +3749,19 @@ ipsecdoi_setid1(iph1)
                if (ipid == NULL)
                        ipid = iph1->local;
 
                if (ipid == NULL)
                        ipid = iph1->local;
 

+               {
+                       if (ipid->ss_family == AF_INET6 &&
+                               iph1->nat64_prefix.length) {
+                               memset(&v4_address, 0, sizeof(v4_address));
+                               v4_address.sin_len = sizeof(struct sockaddr_in);
+                               v4_address.sin_family = AF_INET;
+                               v4_address.sin_port = ((struct sockaddr_in6 *)ipid)->sin6_port;
+                               v4_address.sin_addr.s_addr = 0;
+
+                               ipid = ALIGNED_CAST(struct sockaddr_storage *)&v4_address;
+                       }
+               }
+

                /* use IP address */
                switch (ipid->ss_family) {
                case AF_INET:
                /* use IP address */
                switch (ipid->ss_family) {
                case AF_INET:


@@ -3981,8 +3990,22 @@ ipsecdoi_setid2(iph2)
                return -1;
        }
 
                return -1;
        }
 

-       iph2->id = ipsecdoi_sockaddr2id(&sp->spidx.src,
-                                       sp->spidx.prefs, sp->spidx.ul_proto);
+       struct sockaddr_in local_v4_address;
+       struct sockaddr_storage *srcaddr = &sp->spidx.src;
+       u_int8_t prefs = sp->spidx.prefs;
+       if (sp->spidx.dst.ss_family == AF_INET6 &&
+               iph2->nat64_prefix.length) {
+               memset(&local_v4_address, 0, sizeof(local_v4_address));
+               local_v4_address.sin_len = sizeof(struct sockaddr_in);
+               local_v4_address.sin_family = AF_INET;
+               local_v4_address.sin_port = ((struct sockaddr_in6 *)&sp->spidx.src)->sin6_port;
+               local_v4_address.sin_addr.s_addr = 0;
+
+               srcaddr = ALIGNED_CAST(struct sockaddr_storage *)&local_v4_address;
+               prefs = 32;
+       }
+       iph2->id = ipsecdoi_sockaddr2id(srcaddr,
+                                       prefs, sp->spidx.ul_proto);

        if (iph2->id == NULL) {
                plog(ASL_LEVEL_ERR, 
                        "failed to get ID for %s\n",
        if (iph2->id == NULL) {
                plog(ASL_LEVEL_ERR, 
                        "failed to get ID for %s\n",


@@ -4005,8 +4028,22 @@ ipsecdoi_setid2(iph2)
                         s_ipsecdoi_ident((ALIGNED_CAST(struct ipsecdoi_id_b *)iph2->id->v)->type));
 
        /* remote side */
                         s_ipsecdoi_ident((ALIGNED_CAST(struct ipsecdoi_id_b *)iph2->id->v)->type));
 
        /* remote side */

-       iph2->id_p = ipsecdoi_sockaddr2id(&sp->spidx.dst,
-                               sp->spidx.prefd, sp->spidx.ul_proto);
+       struct sockaddr_in v4_address;
+       struct sockaddr_storage *dstaddr = &sp->spidx.dst;
+       u_int8_t prefd = sp->spidx.prefd;
+       if (sp->spidx.dst.ss_family == AF_INET6 &&
+               iph2->nat64_prefix.length) {
+               memset(&v4_address, 0, sizeof(v4_address));
+               v4_address.sin_len = sizeof(struct sockaddr_in);
+               v4_address.sin_family = AF_INET;
+               v4_address.sin_port = ((struct sockaddr_in6 *)&sp->spidx.dst)->sin6_port;
+               nw_nat64_extract_v4(&iph2->nat64_prefix, &((struct sockaddr_in6 *)&sp->spidx.dst)->sin6_addr, &v4_address.sin_addr);
+
+               dstaddr = ALIGNED_CAST(struct sockaddr_storage *)&v4_address;
+               prefd = 32;
+       }
+       iph2->id_p = ipsecdoi_sockaddr2id(dstaddr,
+                                                                         prefd, sp->spidx.ul_proto);

        if (iph2->id_p == NULL) {
                plog(ASL_LEVEL_ERR, 
                        "failed to get ID for %s\n",
        if (iph2->id_p == NULL) {
                plog(ASL_LEVEL_ERR, 
                        "failed to get ID for %s\n",


@@ -4014,7 +4051,7 @@ ipsecdoi_setid2(iph2)
                VPTRINIT(iph2->id);
                return -1;
        }
                VPTRINIT(iph2->id);
                return -1;
        }

-       plogdump(ASL_LEVEL_DEBUG, iph2->id->v, iph2->id->l, "use remote ID type %s\n",
+       plogdump(ASL_LEVEL_DEBUG, iph2->id_p->v, iph2->id_p->l, "use remote ID type %s\n",

                         s_ipsecdoi_ident((ALIGNED_CAST(struct ipsecdoi_id_b *)iph2->id_p->v)->type));
 
        return 0;
                         s_ipsecdoi_ident((ALIGNED_CAST(struct ipsecdoi_id_b *)iph2->id_p->v)->type));
 
        return 0;


@@ -4045,9 +4082,13 @@ ipsecdoi_sockaddr2id(saddr, prefixlen, ul_proto)
                if (prefixlen == (sizeof(struct in_addr) << 3)) {
                        type = IPSECDOI_ID_IPV4_ADDR;
                        len2 = 0;
                if (prefixlen == (sizeof(struct in_addr) << 3)) {
                        type = IPSECDOI_ID_IPV4_ADDR;
                        len2 = 0;

-               } else {
+               } else if (prefixlen < (sizeof(struct in_addr) << 3)) {

                        type = IPSECDOI_ID_IPV4_ADDR_SUBNET;
                        len2 = sizeof(struct in_addr);
                        type = IPSECDOI_ID_IPV4_ADDR_SUBNET;
                        len2 = sizeof(struct in_addr);

+               } else {
+                       plog(ASL_LEVEL_ERR,
+                               "invalid prefix length: %d.\n", prefixlen);
+                       return NULL;

                }
                sa = (caddr_t)&((struct sockaddr_in *)(saddr))->sin_addr;
                port = ((struct sockaddr_in *)(saddr))->sin_port;
                }
                sa = (caddr_t)&((struct sockaddr_in *)(saddr))->sin_addr;
                port = ((struct sockaddr_in *)(saddr))->sin_port;


@@ -4058,9 +4099,13 @@ ipsecdoi_sockaddr2id(saddr, prefixlen, ul_proto)
                if (prefixlen == (sizeof(struct in6_addr) << 3)) {
                        type = IPSECDOI_ID_IPV6_ADDR;
                        len2 = 0;
                if (prefixlen == (sizeof(struct in6_addr) << 3)) {
                        type = IPSECDOI_ID_IPV6_ADDR;
                        len2 = 0;

-               } else {
+               } else if (prefixlen < (sizeof(struct in6_addr) << 3)) {

                        type = IPSECDOI_ID_IPV6_ADDR_SUBNET;
                        len2 = sizeof(struct in6_addr);
                        type = IPSECDOI_ID_IPV6_ADDR_SUBNET;
                        len2 = sizeof(struct in6_addr);

+               } else {
+                       plog(ASL_LEVEL_ERR,
+                               "invalid prefix length: %d.\n", prefixlen);
+                       return NULL;

                }
                sa = (caddr_t)&((struct sockaddr_in6 *)(saddr))->sin6_addr;
                port = ((struct sockaddr_in6 *)(saddr))->sin6_port;
                }
                sa = (caddr_t)&((struct sockaddr_in6 *)(saddr))->sin6_addr;
                port = ((struct sockaddr_in6 *)(saddr))->sin6_port;