denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Handle IKEv1 NAT-T vendor ID payload (only RFC 3947 for now).

Browse Source
This commit is contained in:
Tobias Brunner
2012-03-20 17:31:10 +01:00
parent 1e97783c99
commit 06d29be714
2 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ike_sa.h
+1 -1
View File
@@ -69,7 +69,7 @@ typedef struct ike_sa_t ike_sa_t;
enum ike_extension_t { enum ike_extension_t {
/** /**
* peer supports NAT traversal as specified in RFC4306 * peer supports NAT traversal as specified in RFC4306 or RFC3947
*/ */
EXT_NATT = (1<<0), EXT_NATT = (1<<0),
src/libcharon/sa/tasks/ike_vendor_v1.c
+18
View File
@@ -41,10 +41,22 @@ struct private_ike_vendor_v1_t {
bool initiator; bool initiator;
}; };
/**
* Indicate support for XAuth, MD5("draft-ietf-ipsra-isakmp-xauth-06.txt")
* Truncated to the first half.
*/
static chunk_t xauth6_vid = chunk_from_chars( static chunk_t xauth6_vid = chunk_from_chars(
0x09,0x00,0x26,0x89,0xdf,0xd6,0xb7,0x12 0x09,0x00,0x26,0x89,0xdf,0xd6,0xb7,0x12
); );
/**
* Indicate support for NAT-Traversal, MD5("RFC 3947")
*/
static chunk_t natt_vid = chunk_from_chars(
0x4a,0x13,0x1c,0x81,0x07,0x03,0x58,0x45,
0x5c,0x57,0x28,0xf2,0x0e,0x95,0x45,0x2f
);
/** /**
* strongSwan specific vendor ID without version, MD5("strongSwan") * strongSwan specific vendor ID without version, MD5("strongSwan")
*/ */
@@ -76,6 +88,7 @@ METHOD(task_t, build, status_t,
} }
add_vendor_id(this, message, xauth6_vid); add_vendor_id(this, message, xauth6_vid);
add_vendor_id(this, message, natt_vid);
return this->initiator ? NEED_MORE : SUCCESS; return this->initiator ? NEED_MORE : SUCCESS;
} }
@@ -107,6 +120,11 @@ METHOD(task_t, process, status_t,
DBG1(DBG_IKE, "received XAuth vendor id"); DBG1(DBG_IKE, "received XAuth vendor id");
this->ike_sa->enable_extension(this->ike_sa, EXT_XAUTH); this->ike_sa->enable_extension(this->ike_sa, EXT_XAUTH);
} }
else if (chunk_equals(data, natt_vid))
{
DBG1(DBG_IKE, "received NAT-T vendor id");
this->ike_sa->enable_extension(this->ike_sa, EXT_NATT);
}
else else
{ {
DBG1(DBG_ENC, "received unknown vendor id: %#B", &data); DBG1(DBG_ENC, "received unknown vendor id: %#B", &data);