{
int so;
int bufsiz = 0; /* Max allowed by default */
- const unsigned long newbufk = 1536;
+ const unsigned long newbufk = 2176;
unsigned long oldmax;
size_t oldmaxsize = sizeof(oldmax);
unsigned long newmax = newbufk * (1024 + 128);
}
if (error) {
- u_int32_t address;
- if (iph1->remote->ss_family == AF_INET)
- address = ((struct sockaddr_in *)iph1->remote)->sin_addr.s_addr;
- else {
- address = 0;
- }
- vpncontrol_notify_ike_failed(error, FROM_LOCAL, address, 0, NULL);
+ vpncontrol_notify_ike_failed(error, FROM_LOCAL, iph1_get_remote_v4_address(iph1), 0, NULL);
}
return error;
phase1_handle_t *p = NULL;
LIST_FOREACH(p, &session->ph1tree, ph1ofsession_chain) {
- if (FSM_STATE_IS_EXPIRED(p->status))
+ if (FSM_STATE_IS_EXPIRED(p->status)) {
continue;
- if (cmpsaddrwop(remote, p->remote) == 0)
+ }
+ if (remote->ss_family == AF_INET &&
+ p->nat64_prefix.length) {
+ struct in_addr address;
+ nw_nat64_extract_v4(&p->nat64_prefix, &((struct sockaddr_in6 *)p->remote)->sin6_addr, &address);
+ if (((struct sockaddr_in *)remote)->sin_addr.s_addr == address.s_addr) {
+ return p;
+ }
+ } else if (cmpsaddrwop(remote, p->remote) == 0) {
return p;
+ }
}
return NULL;
// do the ike_session last
ike_session_sweep_sleepwake();
}
+
+uint32_t
+iph1_get_remote_v4_address(phase1_handle_t *iph1)
+{
+ uint32_t address = 0;
+ if (iph1->remote->ss_family == AF_INET) {
+ address = ((struct sockaddr_in *)iph1->remote)->sin_addr.s_addr;
+ } else if (iph1->remote->ss_family == AF_INET6 &&
+ iph1->nat64_prefix.length) {
+ if (!nw_nat64_extract_v4(&iph1->nat64_prefix, &((struct sockaddr_in6 *)iph1->remote)->sin6_addr, (struct in_addr *)&address)) {
+ plog(ASL_LEVEL_ERR, "Failed to extract IPv4 from Phase 1 IPv6 address.\n");
+ }
+ } else {
+ plog(ASL_LEVEL_ERR, "Failed to get IPv4 address for Phase 1 (family=%u, NAT64Prefix=%u)\n",
+ iph1->remote->ss_family,
+ iph1->nat64_prefix.length);
+ }
+ return address;
+}
+
+uint32_t
+iph2_get_remote_v4_address(phase2_handle_t *iph2)
+{
+ uint32_t address = 0;
+ if (iph2->dst->ss_family == AF_INET) {
+ address = ((struct sockaddr_in *)iph2->dst)->sin_addr.s_addr;
+ } else if (iph2->dst->ss_family == AF_INET6 &&
+ iph2->nat64_prefix.length) {
+ if (!nw_nat64_extract_v4(&iph2->nat64_prefix, &((struct sockaddr_in6 *)iph2->dst)->sin6_addr, (struct in_addr *)&address)) {
+ plog(ASL_LEVEL_ERR, "Failed to extract IPv4 from Phase 2 IPv6 address.\n");
+ }
+ } else {
+ plog(ASL_LEVEL_ERR, "Failed to get IPv4 address for Phase 2 (family=%u, NAT64Prefix=%u)\n",
+ iph2->dst->ss_family,
+ iph2->nat64_prefix.length);
+ }
+ return address;
+}
#include <sys/socket.h>
#include <schedule.h>
+#include <network/nat64.h>
/* About address semantics in each case.
* initiator(addr=I) responder(addr=R)
int status; /* status of this SA */
int side; /* INITIATOR or RESPONDER */
int started_by_api; /* connection started by VPNControl API */
-
- struct sockaddr_storage *remote; /* remote address to negosiate ph1 */
- struct sockaddr_storage *local; /* local address to negosiate ph1 */
+
+ nw_nat64_prefix_t nat64_prefix; /* nat64 prefix to apply to addresses. */
+ struct sockaddr_storage *remote; /* remote address to negotiate ph1 */
+ struct sockaddr_storage *local; /* local address to negotiate ph1 */
/* XXX copy from rmconf due to anonymous configuration.
* If anonymous will be forbidden, we do delete them. */
struct phase2handle {
struct sockaddr_storage *src; /* my address of SA. */
struct sockaddr_storage *dst; /* peer's address of SA. */
-
+ nw_nat64_prefix_t nat64_prefix; /* nat64 prefix to apply to addresses. */
+
/*
* copy ip address from ID payloads when ID type is ip address.
* In other case, they must be null.
extern void sweep_sleepwake (void);
+extern uint32_t iph1_get_remote_v4_address(phase1_handle_t *iph1);
+
+extern uint32_t iph2_get_remote_v4_address(phase2_handle_t *iph2);
+
#endif /* _HANDLER_H */
}
}
+void
+ike_session_purge_ph1s_by_session (ike_session_t *session)
+{
+ phase1_handle_t *iph1;
+ phase1_handle_t *next_iph1 = NULL;
+
+ LIST_FOREACH_SAFE(iph1, &session->ph1tree, ph1ofsession_chain, next_iph1) {
+ plog(ASL_LEVEL_DEBUG, "deleteallph1 of given session: got a ph1 handler...\n");
+
+ vpncontrol_notify_ike_failed(VPNCTL_NTYPE_NO_PROPOSAL_CHOSEN, FROM_REMOTE,
+ iph1_get_remote_v4_address(iph1), 0, NULL);
+
+ ike_session_unlink_phase1(iph1);
+ }
+}
+
void
ike_session_purge_ph2s_by_ph1 (phase1_handle_t *iph1)
{
extern void ike_session_stopped_by_controller (ike_session_t *, const char *);
extern void ike_sessions_stopped_by_controller (struct sockaddr_storage *, int, const char *);
extern void ike_session_purge_ph2s_by_ph1 (phase1_handle_t *);
+extern void ike_session_purge_ph1s_by_session (ike_session_t *session);
extern phase1_handle_t * ike_session_get_established_ph1 (ike_session_t *);
extern phase1_handle_t * ike_session_get_established_or_negoing_ph1 (ike_session_t *);
extern void ike_session_update_ph2_ports (phase2_handle_t *);
vchar_t *ret = NULL;
struct ipsecdoi_id_b id_b;
vchar_t *ident = NULL;
+ struct sockaddr_in v4_address;
struct sockaddr_storage *ipid = NULL;
/* init */
if (ipid == NULL)
ipid = iph1->local;
+ {
+ if (ipid->ss_family == AF_INET6 &&
+ iph1->nat64_prefix.length) {
+ memset(&v4_address, 0, sizeof(v4_address));
+ v4_address.sin_len = sizeof(struct sockaddr_in);
+ v4_address.sin_family = AF_INET;
+ v4_address.sin_port = ((struct sockaddr_in6 *)ipid)->sin6_port;
+ v4_address.sin_addr.s_addr = 0;
+
+ ipid = ALIGNED_CAST(struct sockaddr_storage *)&v4_address;
+ }
+ }
+
/* use IP address */
switch (ipid->ss_family) {
case AF_INET:
return -1;
}
- iph2->id = ipsecdoi_sockaddr2id(&sp->spidx.src,
- sp->spidx.prefs, sp->spidx.ul_proto);
+ struct sockaddr_in local_v4_address;
+ struct sockaddr_storage *srcaddr = &sp->spidx.src;
+ u_int8_t prefs = sp->spidx.prefs;
+ if (sp->spidx.dst.ss_family == AF_INET6 &&
+ iph2->nat64_prefix.length) {
+ memset(&local_v4_address, 0, sizeof(local_v4_address));
+ local_v4_address.sin_len = sizeof(struct sockaddr_in);
+ local_v4_address.sin_family = AF_INET;
+ local_v4_address.sin_port = ((struct sockaddr_in6 *)&sp->spidx.src)->sin6_port;
+ local_v4_address.sin_addr.s_addr = 0;
+
+ srcaddr = ALIGNED_CAST(struct sockaddr_storage *)&local_v4_address;
+ prefs = 32;
+ }
+ iph2->id = ipsecdoi_sockaddr2id(srcaddr,
+ prefs, sp->spidx.ul_proto);
if (iph2->id == NULL) {
plog(ASL_LEVEL_ERR,
"failed to get ID for %s\n",
s_ipsecdoi_ident((ALIGNED_CAST(struct ipsecdoi_id_b *)iph2->id->v)->type));
/* remote side */
- iph2->id_p = ipsecdoi_sockaddr2id(&sp->spidx.dst,
- sp->spidx.prefd, sp->spidx.ul_proto);
+ struct sockaddr_in v4_address;
+ struct sockaddr_storage *dstaddr = &sp->spidx.dst;
+ u_int8_t prefd = sp->spidx.prefd;
+ if (sp->spidx.dst.ss_family == AF_INET6 &&
+ iph2->nat64_prefix.length) {
+ memset(&v4_address, 0, sizeof(v4_address));
+ v4_address.sin_len = sizeof(struct sockaddr_in);
+ v4_address.sin_family = AF_INET;
+ v4_address.sin_port = ((struct sockaddr_in6 *)&sp->spidx.dst)->sin6_port;
+ nw_nat64_extract_v4(&iph2->nat64_prefix, &((struct sockaddr_in6 *)&sp->spidx.dst)->sin6_addr, &v4_address.sin_addr);
+
+ dstaddr = ALIGNED_CAST(struct sockaddr_storage *)&v4_address;
+ prefd = 32;
+ }
+ iph2->id_p = ipsecdoi_sockaddr2id(dstaddr,
+ prefd, sp->spidx.ul_proto);
if (iph2->id_p == NULL) {
plog(ASL_LEVEL_ERR,
"failed to get ID for %s\n",
VPTRINIT(iph2->id);
return -1;
}
- plogdump(ASL_LEVEL_DEBUG, iph2->id->v, iph2->id->l, "use remote ID type %s\n",
+ plogdump(ASL_LEVEL_DEBUG, iph2->id_p->v, iph2->id_p->l, "use remote ID type %s\n",
s_ipsecdoi_ident((ALIGNED_CAST(struct ipsecdoi_id_b *)iph2->id_p->v)->type));
return 0;
/* new negotiation of phase 1 for initiator */
int
ikev1_ph1begin_i(ike_session_t *session, struct remoteconf *rmconf, struct sockaddr_storage *remote,
- struct sockaddr_storage *local, int started_by_api)
+ struct sockaddr_storage *local, int started_by_api, nw_nat64_prefix_t *nat64_prefix)
{
phase1_handle_t *iph1;
retain_rmconf(iph1->rmconf);
iph1->side = INITIATOR;
iph1->started_by_api = started_by_api;
+ if (nat64_prefix != NULL) {
+ memcpy(&iph1->nat64_prefix, nat64_prefix, sizeof(*nat64_prefix));
+ }
iph1->version = ISAKMP_VERSION_NUMBER_IKEV1;
iph1->msgid = 0;
iph1->flags = 0;
#endif
iph2->is_dying = 0;
+ memcpy(&iph2->nat64_prefix, &iph1->nat64_prefix, sizeof(iph2->nat64_prefix));
fsm_set_state(&iph2->status, IKEV1_STATE_QUICK_I_START);
IPSECLOGASLMSG("IPSec Phase 2 started (Initiated by me).\n");
if (ike_session_link_ph2_to_ph1(iph1, iph2))
return -1;
iph2->is_dying = 0;
+ memcpy(&iph2->nat64_prefix, &iph1->nat64_prefix, sizeof(iph2->nat64_prefix));
plog(ASL_LEVEL_DEBUG, "===\n");
{
/* receive my interface address on inbound packets. */
switch (p->addr->ss_family) {
- case AF_INET:
+ case AF_INET: {
+ int ifindex = if_nametoindex(p->ifname);
+ if (ifindex != 0 &&
+ setsockopt(p->sock, IPPROTO_IP,
+ IP_BOUND_IF, &ifindex, sizeof(ifindex)) < 0) {
+ plog(ASL_LEVEL_ERR,
+ "setsockopt IP_BOUND_IF (%s)\n",
+ strerror(errno));
+ goto err_and_next;
+ }
if (setsockopt(p->sock, IPPROTO_IP,
IP_RECVDSTADDR,
(const void *)&yes, sizeof(yes)) < 0) {
goto err_and_next;
}
break;
+ }
#ifdef INET6
- case AF_INET6:
+ case AF_INET6: {
#ifdef INET6_ADVAPI
pktinfo = IPV6_RECVPKTINFO;
#else
pktinfo = IPV6_RECVDSTADDR;
#endif
+ int ifindex = if_nametoindex(p->ifname);
+ if (ifindex != 0 &&
+ setsockopt(p->sock, IPPROTO_IPV6,
+ IPV6_BOUND_IF, &ifindex, sizeof(ifindex)) < 0) {
+ plog(ASL_LEVEL_ERR,
+ "setsockopt IPV6_BOUND_IF (%s)\n",
+ strerror(errno));
+ goto err_and_next;
+ }
if (setsockopt(p->sock, IPPROTO_IPV6, pktinfo,
(const void *)&yes, sizeof(yes)) < 0)
{
goto err_and_next;
}
break;
+ }
#endif
}
plog(ASL_LEVEL_DEBUG, "Begin Phase 1 rekey.\n");
/* start phase 1 negotiation as a initiator. */
- if (ikev1_ph1begin_i(iph1->parent_session, rmconf, iph1->remote, iph1->local, 0) < 0) {
+ if (ikev1_ph1begin_i(iph1->parent_session, rmconf, iph1->remote, iph1->local, 0, &iph1->nat64_prefix) < 0) {
plog(ASL_LEVEL_DEBUG, "Phase 1 rekey Failed.\n");
}
iph1->is_rekey = TRUE;
plog(ASL_LEVEL_DEBUG, "begin Phase 1 rekey retry.\n");
/* start phase 1 negotiation as a initiator. */
- if (ikev1_ph1begin_i(iph1->parent_session, rmconf, iph1->remote, iph1->local, 0) < 0) {
+ if (ikev1_ph1begin_i(iph1->parent_session, rmconf, iph1->remote, iph1->local, 0, &iph1->nat64_prefix) < 0) {
plog(ASL_LEVEL_DEBUG, "Phase 1 rekey retry Failed.\n");
return -1;
}
return 0;
}
- if (ikev1_ph1begin_i(iph2->parent_session, rmconf, iph2->dst, iph2->src, 0) < 0) {
+ if (ikev1_ph1begin_i(iph2->parent_session, rmconf, iph2->dst, iph2->src, 0, &iph2->nat64_prefix) < 0) {
plog(ASL_LEVEL_INFO,
"Request for Phase 1 failed. Will try later.\n");
}
struct remoteconf *rmconf = getrmconf(iph2->dst);
/* start phase 1 negotiation as a initiator. */
if (rmconf) {
- if (ikev1_ph1begin_i(iph2->parent_session, rmconf, iph2->dst, iph2->src, 0) < 0) {
+ if (ikev1_ph1begin_i(iph2->parent_session, rmconf, iph2->dst, iph2->src, 0, iph1 != NULL ? &iph1->nat64_prefix : NULL) < 0) {
plog(ASL_LEVEL_DEBUG, "CHKPH1THERE: no established/negoing ph1 handler found... failed to initiate new one\n");
}
} else if (rmconf == NULL) {
u_int8_t np;
int encrypted;
int flag = 0;
+ int disconnect = 0;
plog(ASL_LEVEL_DEBUG, "receive Information.\n");
(iph1->side == RESPONDER && iph1->status == IKEV1_STATE_AGG_R_MSG3RCVD))) {
break;
}
+ /*FALLTHRU*/
case ISAKMP_ETYPE_IDENT:
if (!FSM_STATE_IS_ESTABLISHED(iph1->status) &&
((iph1->side == INITIATOR && (iph1->status == IKEV1_STATE_IDENT_I_MSG5SENT
}
/*FALLTHRU*/
default:
+ if ((np == ISAKMP_NPTYPE_NONE) &&
+ !FSM_STATE_IS_ESTABLISHED(iph1->status) &&
+ (iph1->side == INITIATOR && (iph1->status == IKEV1_STATE_AGG_I_MSG1SENT))) {
+ // proposal rejected by peer, terminate now.
+ disconnect = 1;
+ }
+
plog(ASL_LEVEL_ERR,
- "%s message must be encrypted\n",
- s_isakmp_nptype(np));
+ "%s message must be encrypted, status 0x%x, side %d\n",
+ s_isakmp_nptype(np), iph1->status, iph1->side);
error = 0;
goto end;
}
/* Handled above */
break;
case ISAKMP_NPTYPE_N:
+ if ((ntohs(((struct isakmp_pl_n *)pa->ptr)->type) == ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN) &&
+ !FSM_STATE_IS_ESTABLISHED(iph1->status) &&
+ (iph1->side == INITIATOR && (iph1->status == IKEV1_STATE_AGG_I_MSG1SENT))) {
+ // proposal rejected by peer, terminate now.
+ disconnect = 1;
+ plog(ASL_LEVEL_ERR,
+ "%s message with %s notification receveid, status 0x%x, side %d\n",
+ s_isakmp_nptype(np), s_isakmp_notify_msg(ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN), iph1->status, iph1->side);
+ break;
+ }
error = isakmp_info_recv_n(iph1,
(struct isakmp_pl_n *)pa->ptr,
msgid, encrypted);
vfree(msg);
if (pbuf != NULL)
vfree(pbuf);
+ if (disconnect) {
+ ike_session_t *session = NULL;
+
+ if (session = iph1->parent_session) {
+ gettimeofday(&session->stop_timestamp, NULL);
+ if (!session->term_reason) {
+ session->term_reason = ike_session_stopped_by_peer;
+ }
+ ike_session_purge_ph1s_by_session(session);
+ }
+ }
return error;
}
static void
isakmp_info_vpncontrol_notify_ike_failed (phase1_handle_t *iph1, int isakmp_info_initiator, int type, vchar_t *data)
{
- u_int32_t address;
+ u_int32_t address = iph1_get_remote_v4_address(iph1);
u_int32_t fail_reason;
/* notify the API that we have received the delete */
- if (iph1->remote->ss_family == AF_INET)
- address = ((struct sockaddr_in *)(iph1->remote))->sin_addr.s_addr;
- else
- address = 0;
-
+
if (isakmp_info_initiator == FROM_REMOTE) {
int premature = oakley_find_status_in_certchain(iph1->cert, CERT_STATUS_PREMATURE);
int expired = oakley_find_status_in_certchain(iph1->cert, CERT_STATUS_EXPIRED);
"LOAD-BALANCE notification ignored - we are not the initiator.\n");
return 0;
}
- if (iph1->remote->ss_family != AF_INET) {
- plog(ASL_LEVEL_DEBUG,
- "LOAD-BALANCE notification ignored - only supported for IPv4.\n");
- return 0;
- }
if (!encrypted) {
plog(ASL_LEVEL_DEBUG,
"LOAD-BALANCE notification ignored - not protected.\n");
plog(ASL_LEVEL_DEBUG,
"Invalid length of payload\n");
return -1;
- }
+ }
+
vpncontrol_notify_ike_failed(ISAKMP_NTYPE_LOAD_BALANCE, FROM_REMOTE,
- ((struct sockaddr_in*)iph1->remote)->sin_addr.s_addr, 4, (u_int8_t*)(&(n->address)));
+ iph1_get_remote_v4_address(iph1), 4, (u_int8_t*)(&(n->address)));
plog(ASL_LEVEL_NOTICE,
"Received LOAD_BALANCE notification.\n");
}
if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) {
- u_int32_t address;
-
IPSECSESSIONTRACEREVENT(iph1->parent_session,
IPSECSESSIONEVENTCODE_IKEV1_DPD_MAX_RETRANSMIT,
CONSTSTR("DPD maximum retransmits"),
CONSTSTR("maxed-out of DPD requests without receiving an ack"));
- if (iph1->remote->ss_family == AF_INET)
- address = ((struct sockaddr_in *)iph1->remote)->sin_addr.s_addr;
- else
- address = 0;
- (void)vpncontrol_notify_ike_failed(VPNCTL_NTYPE_PEER_DEAD, FROM_LOCAL, address, 0, NULL);
+ (void)vpncontrol_notify_ike_failed(VPNCTL_NTYPE_PEER_DEAD, FROM_LOCAL, iph1_get_remote_v4_address(iph1), 0, NULL);
purge_remote(iph1);
plog(ASL_LEVEL_DEBUG,
#include "vmbuf.h"
#include "racoon_types.h"
#include <schedule.h>
+#include <network/nat64.h>
#define PORT_ISAKMP 500
#define PORT_ISAKMP_NATT 4500
extern void isakmp_handler (int);
extern int ikev1_ph1begin_i (ike_session_t *session, struct remoteconf *, struct sockaddr_storage *,
- struct sockaddr_storage *, int);
+ struct sockaddr_storage *, int, nw_nat64_prefix_t *);
extern int get_sainfo_r (phase2_handle_t *);
extern int get_proposal_r (phase2_handle_t *);
CONSTSTR("Xauth Failed (status not ok)"));
plog(ASL_LEVEL_ERR,
"Xauth authentication failed\n");
-
+
vpncontrol_notify_ike_failed(VPNCTL_NTYPE_AUTHENTICATION_FAILED, FROM_LOCAL,
- ((struct sockaddr_in*)iph1->remote)->sin_addr.s_addr, 0, NULL);
+ iph1_get_remote_v4_address(iph1), 0, NULL);
iph1->mode_cfg->flags |= ISAKMP_CFG_DELETE_PH1;
#include <vproc.h>
#endif
#include <dispatch/dispatch.h>
+#include <network/nat64.h>
#include "vmbuf.h"
#include "ipsec_doi.h"
struct bound_addr {
LIST_ENTRY(bound_addr) chain;
u_int32_t address;
+ nw_nat64_prefix_t nat64_prefix;
vchar_t *user_id;
vchar_t *user_pw;
vchar_t *version; /* our version string - if present */
int premature = oakley_find_status_in_certchain(iph1->cert, CERT_STATUS_PREMATURE);
int expired = oakley_find_status_in_certchain(iph1->cert, CERT_STATUS_EXPIRED);
if (premature || expired) {
- u_int32_t address;
u_int32_t fail_reason;
- if (iph1->remote->ss_family == AF_INET)
- address = ((struct sockaddr_in *)(iph1->remote))->sin_addr.s_addr;
- else
- address = 0;
if (premature) {
fail_reason = VPNCTL_NTYPE_LOCAL_CERT_PREMATURE;
} else {
fail_reason = VPNCTL_NTYPE_LOCAL_CERT_EXPIRED;
}
- vpncontrol_notify_ike_failed(fail_reason, notify_initiator, address, 0, NULL);
+ vpncontrol_notify_ike_failed(fail_reason, notify_initiator, iph1_get_remote_v4_address(iph1), 0, NULL);
return -1;
}
#endif /* TARGET_OS_EMBEDDED */
#ifdef ENABLE_VPNCONTROL_PORT
{
- u_int32_t address;
-
- if (iph2->dst->ss_family == AF_INET)
- address = ((struct sockaddr_in *)iph2->dst)->sin_addr.s_addr;
- else
- address = 0;
vpncontrol_notify_phase_change(0, FROM_LOCAL, NULL, iph2);
}
#endif
iph2->satype = msg->sadb_msg_satype;
iph2->seq = msg->sadb_msg_seq;
+ vpncontrol_set_nat64_prefix(&iph2->nat64_prefix);
/* set end addresses of SA */
// Wcast_align fix (void*) - mhp contains pointers to aligned structs in malloc'd msg buffer
iph2->src = dupsaddr(ALIGNED_CAST(struct sockaddr_storage *)PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]));
#include "nattraversal.h"
#include "isakmp_frag.h"
#include "genlist.h"
+#include "vpn_control_var.h"
static TAILQ_HEAD(_rmtree, remoteconf) rmtree;
getrmconf(remote)
struct sockaddr_storage *remote;
{
- return getrmconf_strict(remote, 1);
+ struct remoteconf *rmconf = getrmconf_strict(remote, 1);
+ if (rmconf != NULL) {
+ return rmconf;
+ }
+ if (remote->ss_family == AF_INET6) {
+ struct sockaddr_in v4dst;
+ v4dst.sin_family = AF_INET;
+ v4dst.sin_len = sizeof(struct sockaddr_in);
+ v4dst.sin_port = 0;
+
+ nw_nat64_prefix_t nat64_prefix;
+ if (vpncontrol_set_nat64_prefix(&nat64_prefix)) {
+ nw_nat64_extract_v4(&nat64_prefix, &((struct sockaddr_in6 *)remote)->sin6_addr, &v4dst.sin_addr);
+
+ rmconf = getrmconf(ALIGNED_CAST(struct sockaddr_storage *)&v4dst);
+ if (rmconf != NULL) {
+ return rmconf;
+ }
+ }
+ }
+
+ return NULL;
}
struct remoteconf *
getlocaladdr(struct sockaddr *remote)
{
struct sockaddr_storage *local;
- u_int local_len = sizeof(struct sockaddr);
+ u_int local_len = sizeof(struct sockaddr_storage);
int s; /* for dummy connection */
/* allocate buffer */
goto out;
((struct sockaddr_in *)(dst))->sin_len = sizeof(struct sockaddr_in);
((struct sockaddr_in *)(dst))->sin_family = AF_INET;
- ((struct sockaddr_in *)(dst))->sin_port = 500;
+ ((struct sockaddr_in *)(dst))->sin_port = PORT_ISAKMP;
((struct sockaddr_in *)(dst))->sin_addr.s_addr = srv->address;
/* find appropreate configuration */
plog(ASL_LEVEL_ERR, "cannot get local address\n");
goto out1;
}
-
+
+ if (srv->nat64_prefix.length > 0) {
+ memset(dst, 0, sizeof(*dst));
+ ((struct sockaddr_in6 *)(dst))->sin6_len = sizeof(struct sockaddr_in6);
+ ((struct sockaddr_in6 *)(dst))->sin6_family = AF_INET6;
+ ((struct sockaddr_in6 *)(dst))->sin6_port = PORT_ISAKMP;
+ nw_nat64_synthesize_v6(&srv->nat64_prefix, (struct in_addr *)&srv->address, &((struct sockaddr_in6 *)(dst))->sin6_addr);
+ }
+
/* get remote IP address and port number. */
if ((remote = dupsaddr(dst)) == NULL) {
plog(ASL_LEVEL_ERR,
IPSECLOGASLMSG("IPSec connecting to server %s\n",
saddrwop2str((struct sockaddr *)remote));
- if (ikev1_ph1begin_i(NULL, rmconf, remote, local, oper) < 0)
+ if (ikev1_ph1begin_i(NULL, rmconf, remote, local, oper, &srv->nat64_prefix) < 0)
goto out1;
error = 0;
saddr.sin_addr.s_addr = addr->address;
saddr.sin_port = 0;
saddr.sin_family = AF_INET;
- ph1 = ike_session_getph1bydstaddrwop(NULL, (struct sockaddr_storage *)(&saddr));
+ ph1 = ike_session_getph1bydstaddrwop(NULL, ALIGNED_CAST(struct sockaddr_storage *)(&saddr));
if (ph1 == NULL) {
plog(ASL_LEVEL_ERR,
"Cannot start Phase 2 - no Phase 1 found.\n");
*msg = NULL;
msize = 0;
- if (((struct sockaddr_in *)iph1->local)->sin_family != AF_INET) {
+ /*if (((struct sockaddr_in *)iph1->local)->sin_family != AF_INET) {
plog(ASL_LEVEL_ERR,
"IPv6 not supported for mode config.\n");
return -1;
- }
+ }*/
if (iph1->mode_cfg->attr_list == NULL)
return 1; /* haven't received configuration yet */
(*msg)->hdr.flags = htons(VPNCTL_FLAG_MODECFG_USED);
params = (struct vpnctl_modecfg_params *)(*msg + 1);
- params->outer_local_addr = ((struct sockaddr_in *)iph1->local)->sin_addr.s_addr;
+ if (((struct sockaddr_in *)iph1->local)->sin_family == AF_INET) {
+ params->outer_local_addr = ((struct sockaddr_in *)iph1->local)->sin_addr.s_addr;
+ }
params->outer_remote_port = htons(0);
params->outer_local_port = htons(0);
ifname_len = strlen(myaddr->ifname);
saddr.sin_addr.s_addr = address;
saddr.sin_port = 0;
saddr.sin_family = AF_INET;
- iph1 = ike_session_getph1bydstaddrwop(NULL, (struct sockaddr_storage *)(&saddr));
+ iph1 = ike_session_getph1bydstaddrwop(NULL, ALIGNED_CAST(struct sockaddr_storage *)(&saddr));
if (iph1 == NULL) {
plog(ASL_LEVEL_ERR,
"Cannot reply to xauth request - no ph1 found.\n");
}
}
break;
-
+
+ case VPNCTL_CMD_SET_NAT64_PREFIX:
+ {
+ struct vpnctl_cmd_set_nat64_prefix *pkt = ALIGNED_CAST(struct vpnctl_cmd_set_nat64_prefix *)combuf;
+ struct bound_addr *addr;
+ struct bound_addr *t_addr;
+
+ plog(ASL_LEVEL_DEBUG,
+ "received set v6 prefix of len %u command on vpn control socket, adding to all addresses.\n", pkt->nat64_prefix.length);
+ LIST_FOREACH_SAFE(addr, &elem->bound_addresses, chain, t_addr) {
+ memcpy(&addr->nat64_prefix, &pkt->nat64_prefix, sizeof(addr->nat64_prefix));
+ }
+ }
+ break;
+
case VPNCTL_CMD_CONNECT:
{
struct vpnctl_cmd_connect *pkt = ALIGNED_CAST(struct vpnctl_cmd_connect *)combuf;
daddr.sin_port = 0;
daddr.sin_family = AF_INET;
- error = vpn_assert((struct sockaddr_storage *)&saddr, (struct sockaddr_storage *)&daddr);
+ error = vpn_assert(ALIGNED_CAST(struct sockaddr_storage *)&saddr, ALIGNED_CAST(struct sockaddr_storage *)&daddr);
break;
// }
// }
return 0;
}
+bool
+vpncontrol_set_nat64_prefix(nw_nat64_prefix_t *prefix)
+{
+ struct vpnctl_socket_elem *sock_elem;
+ struct bound_addr *bound_addr;
+
+ LIST_FOREACH(sock_elem, &lcconf->vpnctl_comm_socks, chain) {
+ LIST_FOREACH(bound_addr, &sock_elem->bound_addresses, chain) {
+ if (bound_addr->nat64_prefix.length != 0) {
+ memcpy(prefix, &bound_addr->nat64_prefix, sizeof(*prefix));
+ return true;
+ }
+ }
+ }
+ return false;
+}
+
int
vpncontrol_notify_need_authinfo(phase1_handle_t *iph1, void* attr_list, size_t attr_len)
{
return -1;
}
msg->hdr.flags = 0;
-
- if (iph1->remote->ss_family == AF_INET)
- address = ((struct sockaddr_in *)iph1->remote)->sin_addr.s_addr;
- else
- goto end; // for now
+
+ address = iph1_get_remote_v4_address(iph1);
+ if (address == 0) {
+ goto end;
+ }
msg->hdr.cookie = msg->hdr.reserved = msg->hdr.result = 0;
msg->hdr.len = htons((msg_size) - sizeof(struct vpnctl_hdr));
} else {
msg->hdr.msg_type = htons(VPNCTL_STATUS_NEED_REAUTHINFO);
}
- msg->address = address;
+ msg->address = iph1_get_remote_v4_address(iph1);
ptr = msg + 1;
memcpy(ptr, attr_list, attr_len);
return -1;
}
if (iph1) {
- if (iph1->remote->ss_family == AF_INET)
- address = ((struct sockaddr_in *)iph1->remote)->sin_addr.s_addr;
- else
- goto end; // for now
+ address = iph1_get_remote_v4_address(iph1);
+ if (address == 0) {
+ plog(ASL_LEVEL_ERR, "bad address for ph1 status change.\n");
+ goto end;
+ }
msg->hdr.msg_type = htons(start ?
(from == FROM_LOCAL ? VPNCTL_STATUS_PH1_START_US : VPNCTL_STATUS_PH1_START_PEER)
: VPNCTL_STATUS_PH1_ESTABLISHED);
// TODO: indicate version
} else {
- if (iph2->dst->ss_family == AF_INET)
- address = ((struct sockaddr_in *)iph2->dst)->sin_addr.s_addr;
- else
- goto end; // for now
+ address = iph2_get_remote_v4_address(iph2);
+ if (address == 0) {
+ plog(ASL_LEVEL_ERR, "bad address for ph2 status change.\n");
+ goto end;
+ }
msg->hdr.msg_type = htons(start ? VPNCTL_STATUS_PH2_START : VPNCTL_STATUS_PH2_ESTABLISHED);
// TODO: indicate version
}
int
vpncontrol_notify_peer_resp_ph1 (u_int16_t notify_code, phase1_handle_t *iph1)
{
- u_int32_t address;
- int rc;
-
if (iph1 && iph1->parent_session && iph1->parent_session->controller_awaiting_peer_resp) {
- if (iph1->remote->ss_family == AF_INET)
- address = ((struct sockaddr_in *)iph1->remote)->sin_addr.s_addr;
- else
- address = 0;
+ int rc;
+ if ((rc = vpncontrol_notify_peer_resp(notify_code, iph1_get_remote_v4_address(iph1))) == 0) {
+ iph1->parent_session->controller_awaiting_peer_resp = 0;
+ }
+ return rc;
} else {
return 0;
}
-
- if ((rc = vpncontrol_notify_peer_resp(notify_code, address)) == 0) {
- iph1->parent_session->controller_awaiting_peer_resp = 0;
- }
- return rc;
}
int
vpncontrol_notify_peer_resp_ph2 (u_int16_t notify_code, phase2_handle_t *iph2)
{
- u_int32_t address;
- int rc;
-
if (iph2 && iph2->parent_session && iph2->parent_session->controller_awaiting_peer_resp) {
- if (iph2->dst->ss_family == AF_INET)
- address = ((struct sockaddr_in *)iph2->dst)->sin_addr.s_addr;
- else
- address = 0;
+ int rc;
+ if ((rc = vpncontrol_notify_peer_resp(notify_code, iph2_get_remote_v4_address(iph2))) == 0) {
+ iph2->parent_session->controller_awaiting_peer_resp = 0;
+ }
+ return rc;
} else {
return 0;
}
-
- if ((rc = vpncontrol_notify_peer_resp(notify_code, address)) == 0) {
- iph2->parent_session->controller_awaiting_peer_resp = 0;
- }
- return rc;
}
int
#include "algorithm_types.h"
#include <net/if.h>
+#include <network/nat64.h>
#define VPNCONTROLSOCK_PATH ADMINPORTDIR "/vpncontrol.sock"
#define VPNCTL_CMD_START_DPD 0x0015
#define VPNCTL_CMD_ASSERT 0x0016
#define VPNCTL_CMD_RECONNECT 0x0017
+#define VPNCTL_CMD_SET_NAT64_PREFIX 0x0018
#define VPNCTL_STATUS_IKE_FAILED 0x8001
#define VPNCTL_STATUS_PH1_START_US 0x8011
#define VPNCTL_STATUS_PH1_START_PEER 0x8012
/* connect to specified address */
-struct vpnctl_cmd_connect{
+struct vpnctl_cmd_connect {
struct vpnctl_hdr hdr;
u_int32_t address;
};
+struct vpnctl_cmd_set_nat64_prefix {
+ struct vpnctl_hdr hdr;
+ nw_nat64_prefix_t nat64_prefix;
+};
+
struct vpnctl_sa_selector {
u_int32_t src_tunnel_address;
u_int32_t src_tunnel_mask;
extern int vpncontrol_notify_peer_resp_ph1 (u_int16_t, phase1_handle_t*);
extern int vpncontrol_notify_peer_resp_ph2 (u_int16_t, phase2_handle_t*);
extern int vpn_assert (struct sockaddr_storage *, struct sockaddr_storage *);
+extern bool vpncontrol_set_nat64_prefix(nw_nat64_prefix_t *prefix);
#endif /* _VPN_CONTROL_VAR_H */
buildSettings = {
ALTERNATE_GROUP = "$(inherited)";
ALTERNATE_MODE = "";
- ALTERNATE_OWNER = "$(inherited)";
ARCHS = "$(ARCHS_STANDARD_32_64_BIT)";
COPY_PHASE_STRIP = NO;
CURRENT_PROJECT_VERSION = "$(CURRENT_PROJECT_VERSION)";
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/lib;
LEXFLAGS = "$(LEXFLAGS) -P__libipsec";
PRODUCT_NAME = ipsec.A;
buildSettings = {
ALTERNATE_GROUP = "$(inherited)";
ALTERNATE_MODE = "";
- ALTERNATE_OWNER = "$(inherited)";
ARCHS = "$(ARCHS_STANDARD_32_64_BIT)";
COPY_PHASE_STRIP = NO;
CURRENT_PROJECT_VERSION = "$(CURRENT_PROJECT_VERSION)";
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/lib;
LEXFLAGS = "$(LEXFLAGS) -P__libipsec";
PRODUCT_NAME = ipsec.A;
buildSettings = {
ALTERNATE_GROUP = "$(inherited)";
ALTERNATE_MODE = "";
- ALTERNATE_OWNER = "$(inherited)";
ARCHS = "$(ARCHS_STANDARD_32_64_BIT)";
COPY_PHASE_STRIP = NO;
CURRENT_PROJECT_VERSION = "$(CURRENT_PROJECT_VERSION)";
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/lib;
LEXFLAGS = "$(LEXFLAGS) -P__libipsec";
PRODUCT_NAME = ipsec.A;
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
LEXFLAGS = "";
OTHER_CFLAGS = (
OTHER_LDFLAGS = "";
OTHER_REZFLAGS = "";
PRODUCT_NAME = racoon;
+ SDKROOT = macosx.internal;
SECTORDER_FLAGS = "";
SKIP_INSTALL = YES;
WARNING_CFLAGS = (
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
OTHER_CFLAGS = (
"$(OTHER_CFLAGS_QUOTED_1)",
OTHER_LDFLAGS = "";
OTHER_REZFLAGS = "";
PRODUCT_NAME = racoon;
+ SDKROOT = macosx.internal;
SECTORDER_FLAGS = "";
WARNING_CFLAGS = (
"-Wmost",
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
OTHER_CFLAGS = (
"$(OTHER_CFLAGS_QUOTED_1)",
OTHER_LDFLAGS = "";
OTHER_REZFLAGS = "";
PRODUCT_NAME = racoon;
+ SDKROOT = macosx.internal;
SECTORDER_FLAGS = "";
WARNING_CFLAGS = (
"-Wmost",
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
LIBRARY_SEARCH_PATHS = "";
MACH_O_TYPE = mh_execute;
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
LIBRARY_SEARCH_PATHS = "";
MACH_O_TYPE = mh_execute;
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
LIBRARY_SEARCH_PATHS = "";
MACH_O_TYPE = mh_execute;
buildSettings = {
ARCHS = "$(ARCHS_STANDARD_64_BIT)";
PRODUCT_NAME = "$(TARGET_NAME)";
+ SDKROOT = macosx.internal;
};
name = Development;
};
buildSettings = {
ARCHS = "$(ARCHS_STANDARD_64_BIT)";
PRODUCT_NAME = "$(TARGET_NAME)";
+ SDKROOT = macosx.internal;
};
name = Deployment;
};
buildSettings = {
ARCHS = "$(ARCHS_STANDARD_64_BIT)";
PRODUCT_NAME = "$(TARGET_NAME)";
+ SDKROOT = macosx.internal;
};
name = Default;
};
isa = XCBuildConfiguration;
buildSettings = {
PRODUCT_NAME = "$(TARGET_NAME)";
+ SDKROOT = iphoneos.internal;
};
name = Development;
};
isa = XCBuildConfiguration;
buildSettings = {
PRODUCT_NAME = "$(TARGET_NAME)";
+ SDKROOT = iphoneos.internal;
};
name = Deployment;
};
isa = XCBuildConfiguration;
buildSettings = {
PRODUCT_NAME = "$(TARGET_NAME)";
+ SDKROOT = iphoneos.internal;
};
name = Default;
};
PRODUCT_NAME = "IPSec Embedded (Aggregate)";
SECTORDER_FLAGS = "";
SKIP_INSTALL = NO;
+ SUPPORTED_PLATFORMS = "iphonesimulator iphoneos";
WARNING_CFLAGS = (
"-Wmost",
"-Wno-four-char-constants",
PRODUCT_NAME = "IPSec Embedded (Aggregate)";
SECTORDER_FLAGS = "";
SKIP_INSTALL = NO;
+ SUPPORTED_PLATFORMS = "iphonesimulator iphoneos";
WARNING_CFLAGS = (
"-Wmost",
"-Wno-four-char-constants",
PRODUCT_NAME = "IPSec Embedded (Aggregate)";
SECTORDER_FLAGS = "";
SKIP_INSTALL = NO;
+ SUPPORTED_PLATFORMS = "iphonesimulator iphoneos";
WARNING_CFLAGS = (
"-Wmost",
"-Wno-four-char-constants",
buildSettings = {
ALTERNATE_GROUP = "$(inherited)";
ALTERNATE_MODE = "$(inherited)";
- ALTERNATE_OWNER = "$(inherited)";
- ARCHS = "$(ARCHS_STANDARD_32_BIT)";
CODE_SIGN_ENTITLEMENTS = "$(SRCROOT)/entitlements.plist";
CODE_SIGN_IDENTITY = "";
COPY_PHASE_STRIP = NO;
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
LEXFLAGS = "";
OTHER_CFLAGS = (
OTHER_LDFLAGS = "";
OTHER_REZFLAGS = "";
PRODUCT_NAME = racoon;
+ SDKROOT = iphoneos.internal;
SECTORDER_FLAGS = "";
SKIP_INSTALL = YES;
+ SUPPORTED_PLATFORMS = "iphonesimulator iphoneos";
WARNING_CFLAGS = (
"-Wmost",
"-Wno-four-char-constants",
buildSettings = {
ALTERNATE_GROUP = "$(inherited)";
ALTERNATE_MODE = "$(inherited)";
- ALTERNATE_OWNER = "$(inherited)";
- ARCHS = "$(ARCHS_STANDARD_32_BIT)";
CODE_SIGN_ENTITLEMENTS = "$(SRCROOT)/entitlements.plist";
CODE_SIGN_IDENTITY = "";
COPY_PHASE_STRIP = NO;
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
OTHER_CFLAGS = (
"$(OTHER_CFLAGS_QUOTED_1)",
OTHER_LDFLAGS = "";
OTHER_REZFLAGS = "";
PRODUCT_NAME = racoon;
+ SDKROOT = iphoneos.internal;
SECTORDER_FLAGS = "";
+ SUPPORTED_PLATFORMS = "iphonesimulator iphoneos";
WARNING_CFLAGS = (
"-Wmost",
"-Wno-four-char-constants",
buildSettings = {
ALTERNATE_GROUP = "$(inherited)";
ALTERNATE_MODE = "$(inherited)";
- ALTERNATE_OWNER = "$(inherited)";
- ARCHS = "$(ARCHS_STANDARD_32_BIT)";
CODE_SIGN_ENTITLEMENTS = "$(SRCROOT)/entitlements.plist";
CODE_SIGN_IDENTITY = "";
COPY_PHASE_STRIP = NO;
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
OTHER_CFLAGS = (
"$(OTHER_CFLAGS_QUOTED_1)",
OTHER_LDFLAGS = "";
OTHER_REZFLAGS = "";
PRODUCT_NAME = racoon;
+ SDKROOT = iphoneos.internal;
SECTORDER_FLAGS = "";
+ SUPPORTED_PLATFORMS = "iphonesimulator iphoneos";
WARNING_CFLAGS = (
"-Wmost",
"-Wno-four-char-constants",
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
LIBRARY_SEARCH_PATHS = "";
MACH_O_TYPE = mh_execute;
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
LIBRARY_SEARCH_PATHS = "";
MACH_O_TYPE = mh_execute;
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/sbin;
LIBRARY_SEARCH_PATHS = "";
MACH_O_TYPE = mh_execute;
buildSettings = {
ALTERNATE_GROUP = "$(inherited)";
ALTERNATE_MODE = "";
- ALTERNATE_OWNER = "$(inherited)";
ARCHS = "$(ARCHS_STANDARD_32_BIT)";
CODE_SIGN_IDENTITY = "";
COPY_PHASE_STRIP = NO;
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/lib;
LEXFLAGS = "$(LEXFLAGS) -P__libipsec";
PRODUCT_NAME = ipsec.A;
buildSettings = {
ALTERNATE_GROUP = "$(inherited)";
ALTERNATE_MODE = "";
- ALTERNATE_OWNER = "$(inherited)";
ARCHS = "$(ARCHS_STANDARD_32_BIT)";
CODE_SIGN_IDENTITY = "";
COPY_PHASE_STRIP = NO;
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/lib;
LEXFLAGS = "$(LEXFLAGS) -P__libipsec";
PRODUCT_NAME = ipsec.A;
buildSettings = {
ALTERNATE_GROUP = "$(inherited)";
ALTERNATE_MODE = "";
- ALTERNATE_OWNER = "$(inherited)";
ARCHS = "$(ARCHS_STANDARD_32_BIT)";
CODE_SIGN_IDENTITY = "";
COPY_PHASE_STRIP = NO;
);
INSTALL_GROUP = wheel;
INSTALL_MODE_FLAG = 555;
- INSTALL_OWNER = root;
INSTALL_PATH = /usr/lib;
LEXFLAGS = "$(LEXFLAGS) -P__libipsec";
PRODUCT_NAME = ipsec.A;
projects / apple / ipsec.git / commitdiff
