denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for draft-ietf-ipsec-nat-t-ike-03 and earlier

Browse Source 
This adds support for early versions of the draft that eventually
resulted in RFC 3947.
This commit is contained in:
Volker Rümelin
2012-12-19 11:03:42 +01:00
committed by Tobias Brunner
parent ecdd5aedac
commit 0ff8d20a89
14 changed files with 316 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/encoding/message.c
+12
View File
@@ -437,6 +437,7 @@ static payload_rule_t id_prot_i_rules[] = {
{VENDOR_ID_V1, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
{CERTIFICATE_REQUEST_V1, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
{NAT_D_V1, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{NAT_D_DRAFT_00_03_V1, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{ID_V1, 0, 1, TRUE, FALSE},
{CERTIFICATE_V1, 0, 2, TRUE, FALSE},
{SIGNATURE_V1, 0, 1, TRUE, FALSE},
@@ -459,6 +460,7 @@ static payload_order_t id_prot_i_order[] = {
{NOTIFY_V1, 0},
{VENDOR_ID_V1, 0},
{NAT_D_V1, 0},
{NAT_D_DRAFT_00_03_V1, 0},
};
/**
@@ -473,6 +475,7 @@ static payload_rule_t id_prot_r_rules[] = {
{VENDOR_ID_V1, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
{CERTIFICATE_REQUEST_V1, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
{NAT_D_V1, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{NAT_D_DRAFT_00_03_V1, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{ID_V1, 0, 1, TRUE, FALSE},
{CERTIFICATE_V1, 0, 2, TRUE, FALSE},
{SIGNATURE_V1, 0, 1, TRUE, FALSE},
@@ -495,6 +498,7 @@ static payload_order_t id_prot_r_order[] = {
{NOTIFY_V1, 0},
{VENDOR_ID_V1, 0},
{NAT_D_V1, 0},
{NAT_D_DRAFT_00_03_V1, 0},
};
/**
@@ -509,6 +513,7 @@ static payload_rule_t aggressive_i_rules[] = {
{VENDOR_ID_V1, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
{CERTIFICATE_REQUEST_V1, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
{NAT_D_V1, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{NAT_D_DRAFT_00_03_V1, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{ID_V1, 0, 1, FALSE, FALSE},
{CERTIFICATE_V1, 0, 1, TRUE, FALSE},
{SIGNATURE_V1, 0, 1, TRUE, FALSE},
@@ -526,6 +531,7 @@ static payload_order_t aggressive_i_order[] = {
{ID_V1, 0},
{CERTIFICATE_V1, 0},
{NAT_D_V1, 0},
{NAT_D_DRAFT_00_03_V1, 0},
{SIGNATURE_V1, 0},
{HASH_V1, 0},
{CERTIFICATE_REQUEST_V1, 0},
@@ -545,6 +551,7 @@ static payload_rule_t aggressive_r_rules[] = {
{VENDOR_ID_V1, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
{CERTIFICATE_REQUEST_V1, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
{NAT_D_V1, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{NAT_D_DRAFT_00_03_V1, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{ID_V1, 0, 1, FALSE, FALSE},
{CERTIFICATE_V1, 0, 1, FALSE, FALSE},
{SIGNATURE_V1, 0, 1, FALSE, FALSE},
@@ -562,6 +569,7 @@ static payload_order_t aggressive_r_order[] = {
{ID_V1, 0},
{CERTIFICATE_V1, 0},
{NAT_D_V1, 0},
{NAT_D_DRAFT_00_03_V1, 0},
{SIGNATURE_V1, 0},
{HASH_V1, 0},
{CERTIFICATE_REQUEST_V1, 0},
@@ -624,6 +632,7 @@ static payload_rule_t quick_mode_i_rules[] = {
{KEY_EXCHANGE_V1, 0, 1, TRUE, FALSE},
{ID_V1, 0, 2, TRUE, FALSE},
{NAT_OA_V1, 0, 2, TRUE, FALSE},
{NAT_OA_DRAFT_00_03_V1, 0, 2, TRUE, FALSE},
};
/**
@@ -639,6 +648,7 @@ static payload_order_t quick_mode_i_order[] = {
{KEY_EXCHANGE_V1, 0},
{ID_V1, 0},
{NAT_OA_V1, 0},
{NAT_OA_DRAFT_00_03_V1, 0},
};
/**
@@ -654,6 +664,7 @@ static payload_rule_t quick_mode_r_rules[] = {
{KEY_EXCHANGE_V1, 0, 1, TRUE, FALSE},
{ID_V1, 0, 2, TRUE, FALSE},
{NAT_OA_V1, 0, 2, TRUE, FALSE},
{NAT_OA_DRAFT_00_03_V1, 0, 2, TRUE, FALSE},
};
/**
@@ -669,6 +680,7 @@ static payload_order_t quick_mode_r_order[] = {
{KEY_EXCHANGE_V1, 0},
{ID_V1, 0},
{NAT_OA_V1, 0},
{NAT_OA_DRAFT_00_03_V1, 0},
};
/**
src/libcharon/encoding/payloads/id_payload.c
+3 -2
View File
@@ -165,7 +165,7 @@ METHOD(payload_t, verify, status_t,
{
bool bad_length = FALSE;
if (this->type == NAT_OA_V1 &&
if ((this->type == NAT_OA_V1 || this->type == NAT_OA_DRAFT_00_03_V1) &&
this->id_type != ID_IPV4_ADDR && this->id_type != ID_IPV6_ADDR)
{
DBG1(DBG_ENC, "invalid ID type %N for %N payload", id_type_names,
@@ -195,7 +195,8 @@ METHOD(payload_t, verify, status_t,
METHOD(payload_t, get_encoding_rules, int,
private_id_payload_t *this, encoding_rule_t **rules)
{
if (this->type == ID_V1 || this->type == NAT_OA_V1)
if (this->type == ID_V1 ||
this->type == NAT_OA_V1 || this->type == NAT_OA_DRAFT_00_03_V1)
{
*rules = encodings_v1;
return countof(encodings_v1);
src/libcharon/encoding/payloads/payload.c
+23 -30
View File
@@ -79,20 +79,15 @@ ENUM_NEXT(payload_type_names, SECURITY_ASSOCIATION, GENERIC_SECURE_PASSWORD_METH
#ifdef ME
ENUM_NEXT(payload_type_names, ID_PEER, ID_PEER, GENERIC_SECURE_PASSWORD_METHOD,
"ID_PEER");
ENUM_NEXT(payload_type_names, HEADER, ENCRYPTED_V1, ID_PEER,
"HEADER",
"PROPOSAL_SUBSTRUCTURE",
"PROPOSAL_SUBSTRUCTURE_V1",
"TRANSFORM_SUBSTRUCTURE",
"TRANSFORM_SUBSTRUCTURE_V1",
"TRANSFORM_ATTRIBUTE",
"TRANSFORM_ATTRIBUTE_V1",
"TRAFFIC_SELECTOR_SUBSTRUCTURE",
"CONFIGURATION_ATTRIBUTE",
"CONFIGURATION_ATTRIBUTE_V1",
"ENCRYPTED_V1");
ENUM_NEXT(payload_type_names, NAT_D_DRAFT_00_03_V1, NAT_OA_DRAFT_00_03_V1, ID_PEER,
"NAT_D_DRAFT_V1",
"NAT_OA_DRAFT_V1");
#else
ENUM_NEXT(payload_type_names, HEADER, ENCRYPTED_V1, GENERIC_SECURE_PASSWORD_METHOD,
ENUM_NEXT(payload_type_names, NAT_D_DRAFT_00_03_V1, NAT_OA_DRAFT_00_03_V1, GENERIC_SECURE_PASSWORD_METHOD,
"NAT_D_DRAFT_V1",
"NAT_OA_DRAFT_V1");
#endif /* ME */
ENUM_NEXT(payload_type_names, HEADER, ENCRYPTED_V1, NAT_OA_DRAFT_00_03_V1,
"HEADER",
"PROPOSAL_SUBSTRUCTURE",
"PROPOSAL_SUBSTRUCTURE_V1",
@@ -104,7 +99,6 @@ ENUM_NEXT(payload_type_names, HEADER, ENCRYPTED_V1, GENERIC_SECURE_PASSWORD_METH
"CONFIGURATION_ATTRIBUTE",
"CONFIGURATION_ATTRIBUTE_V1",
"ENCRYPTED_V1");
#endif /* ME */
ENUM_END(payload_type_names, ENCRYPTED_V1);
/* short forms of payload names */
@@ -147,23 +141,17 @@ ENUM_NEXT(payload_type_short_names, SECURITY_ASSOCIATION, GENERIC_SECURE_PASSWOR
"EAP",
"GSPM");
#ifdef ME
ENUM_NEXT(payload_type_short_names, ID_PEER, ID_PEER,
GENERIC_SECURE_PASSWORD_METHOD,
ENUM_NEXT(payload_type_short_names, ID_PEER, ID_PEER, GENERIC_SECURE_PASSWORD_METHOD,
"IDp");
ENUM_NEXT(payload_type_short_names, HEADER, ENCRYPTED_V1, ID_PEER,
"HDR",
"PROP",
"PROP",
"TRANS",
"TRANS",
"TRANSATTR",
"TRANSATTR",
"TSSUB",
"CATTR",
"CATTR",
"E");
ENUM_NEXT(payload_type_short_names, NAT_D_DRAFT_00_03_V1, NAT_OA_DRAFT_00_03_V1, ID_PEER,
"NAT-D",
"NAT-OA");
#else
ENUM_NEXT(payload_type_short_names, HEADER, ENCRYPTED_V1, GENERIC_SECURE_PASSWORD_METHOD,
ENUM_NEXT(payload_type_short_names, NAT_D_DRAFT_00_03_V1, NAT_OA_DRAFT_00_03_V1, GENERIC_SECURE_PASSWORD_METHOD,
"NAT-D",
"NAT-OA");
#endif /* ME */
ENUM_NEXT(payload_type_short_names, HEADER, ENCRYPTED_V1, NAT_OA_DRAFT_00_03_V1,
"HDR",
"PROP",
"PROP",
@@ -175,7 +163,6 @@ ENUM_NEXT(payload_type_short_names, HEADER, ENCRYPTED_V1, GENERIC_SECURE_PASSWOR
"CATTR",
"CATTR",
"E");
#endif /* ME */
ENUM_END(payload_type_short_names, ENCRYPTED_V1);
/*
@@ -206,6 +193,7 @@ payload_t *payload_create(payload_type_t type)
case ID_RESPONDER:
case ID_V1:
case NAT_OA_V1:
case NAT_OA_DRAFT_00_03_V1:
#ifdef ME
case ID_PEER:
#endif /* ME */
@@ -239,6 +227,7 @@ payload_t *payload_create(payload_type_t type)
case HASH_V1:
case SIGNATURE_V1:
case NAT_D_V1:
case NAT_D_DRAFT_00_03_V1:
return (payload_t*)hash_payload_create(type);
case CONFIGURATION:
case CONFIGURATION_V1:
@@ -283,6 +272,10 @@ bool payload_is_known(payload_type_t type)
return TRUE;
}
#endif
if (type >= NAT_D_DRAFT_00_03_V1 && type <= NAT_OA_DRAFT_00_03_V1)
{
return TRUE;
}
return FALSE;
}
src/libcharon/encoding/payloads/payload.h
+11 -1
View File
@@ -123,7 +123,7 @@ enum payload_type_t {
NAT_D_V1 = 20,
/**
* NAT original address payload (NAT-OA)
* NAT original address payload (NAT-OA).
*/
NAT_OA_V1 = 21,
@@ -220,6 +220,16 @@ enum payload_type_t {
ID_PEER = 128,
#endif /* ME */
/**
* NAT discovery payload (NAT-D) (drafts).
*/
NAT_D_DRAFT_00_03_V1 = 130,
/**
* NAT original address payload (NAT-OA) (drafts).
*/
NAT_OA_DRAFT_00_03_V1 = 131,
/**
* Header has a value of PRIVATE USE space.
*
src/libcharon/encoding/payloads/proposal_substructure.c
+27 -7
View File
@@ -253,6 +253,8 @@ typedef enum {
IKEV1_ENCAP_TRANSPORT = 2,
IKEV1_ENCAP_UDP_TUNNEL = 3,
IKEV1_ENCAP_UDP_TRANSPORT = 4,
IKEV1_ENCAP_UDP_TUNNEL_DRAFT_00_03 = 61443,
IKEV1_ENCAP_UDP_TRANSPORT_DRAFT_00_03 = 61444,
} ikev1_esp_encap_t;
/**
@@ -810,14 +812,30 @@ static u_int16_t get_ikev1_auth(auth_method_t method)
/**
* Get IKEv1 encapsulation mode
*/
static u_int16_t get_ikev1_mode(ipsec_mode_t mode, bool udp)
static u_int16_t get_ikev1_mode(ipsec_mode_t mode, encap_t udp)
{
switch (mode)
{
case MODE_TUNNEL:
return udp ? IKEV1_ENCAP_UDP_TUNNEL : IKEV1_ENCAP_TUNNEL;
switch (udp)
{
case ENCAP_UDP:
return IKEV1_ENCAP_UDP_TUNNEL;
case ENCAP_UDP_DRAFT_00_03:
return IKEV1_ENCAP_UDP_TUNNEL_DRAFT_00_03;
default:
return IKEV1_ENCAP_TUNNEL;
}
case MODE_TRANSPORT:
return udp ? IKEV1_ENCAP_UDP_TRANSPORT : IKEV1_ENCAP_TRANSPORT;
switch (udp)
{
case ENCAP_UDP:
return IKEV1_ENCAP_UDP_TRANSPORT;
case ENCAP_UDP_DRAFT_00_03:
return IKEV1_ENCAP_UDP_TRANSPORT_DRAFT_00_03;
default:
return IKEV1_ENCAP_TRANSPORT;
}
default:
return IKEV1_ENCAP_TUNNEL;
}
@@ -1125,9 +1143,11 @@ METHOD(proposal_substructure_t, get_encap_mode, ipsec_mode_t,
case IKEV1_ENCAP_TUNNEL:
return MODE_TUNNEL;
case IKEV1_ENCAP_UDP_TRANSPORT:
case IKEV1_ENCAP_UDP_TRANSPORT_DRAFT_00_03:
*udp = TRUE;
return MODE_TRANSPORT;
case IKEV1_ENCAP_UDP_TUNNEL:
case IKEV1_ENCAP_UDP_TUNNEL_DRAFT_00_03:
*udp = TRUE;
return MODE_TUNNEL;
default:
@@ -1263,7 +1283,7 @@ static void set_from_proposal_v1_ike(private_proposal_substructure_t *this,
*/
static void set_from_proposal_v1_esp(private_proposal_substructure_t *this,
proposal_t *proposal, u_int32_t lifetime, u_int64_t lifebytes,
ipsec_mode_t mode, bool udp, int number)
ipsec_mode_t mode, encap_t udp, int number)
{
transform_substructure_t *transform = NULL;
u_int16_t alg, key_size;
@@ -1459,7 +1479,7 @@ proposal_substructure_t *proposal_substructure_create_from_proposal_v2(
*/
proposal_substructure_t *proposal_substructure_create_from_proposal_v1(
proposal_t *proposal, u_int32_t lifetime, u_int64_t lifebytes,
auth_method_t auth, ipsec_mode_t mode, bool udp)
auth_method_t auth, ipsec_mode_t mode, encap_t udp)
{
private_proposal_substructure_t *this;
@@ -1487,7 +1507,7 @@ proposal_substructure_t *proposal_substructure_create_from_proposal_v1(
*/
proposal_substructure_t *proposal_substructure_create_from_proposals_v1(
linked_list_t *proposals, u_int32_t lifetime, u_int64_t lifebytes,
auth_method_t auth, ipsec_mode_t mode, bool udp)
auth_method_t auth, ipsec_mode_t mode, encap_t udp)
{
private_proposal_substructure_t *this = NULL;
enumerator_t *enumerator;
@@ -1531,7 +1551,7 @@ proposal_substructure_t *proposal_substructure_create_from_proposals_v1(
*/
proposal_substructure_t *proposal_substructure_create_for_ipcomp_v1(
u_int32_t lifetime, u_int64_t lifebytes, u_int16_t cpi,
ipsec_mode_t mode, bool udp, u_int8_t proposal_number)
ipsec_mode_t mode, encap_t udp, u_int8_t proposal_number)
{
private_proposal_substructure_t *this;
transform_substructure_t *transform;
src/libcharon/encoding/payloads/proposal_substructure.h
+16 -6
View File
@@ -23,6 +23,7 @@
#ifndef PROPOSAL_SUBSTRUCTURE_H_
#define PROPOSAL_SUBSTRUCTURE_H_
typedef enum encap_t encap_t;
typedef struct proposal_substructure_t proposal_substructure_t;
#include <library.h>
@@ -33,6 +34,15 @@ typedef struct proposal_substructure_t proposal_substructure_t;
#include <kernel/kernel_ipsec.h>
#include <sa/authenticator.h>
/**
* Encap type for proposal substructure
*/
enum encap_t {
ENCAP_NONE = 0,
ENCAP_UDP,
ENCAP_UDP_DRAFT_00_03,
};
/**
* Class representing an IKEv1/IKEv2 proposal substructure.
*/
@@ -179,12 +189,12 @@ proposal_substructure_t *proposal_substructure_create_from_proposal_v2(
* @param lifebytes lifebytes, in bytes
* @param auth authentication method to use, or AUTH_NONE
* @param mode IPsec encapsulation mode, TRANSPORT or TUNNEL
* @param udp TRUE to use UDP encapsulation
* @param udp ENCAP_UDP to use UDP encapsulation
* @return proposal_substructure_t object PROPOSAL_SUBSTRUCTURE_V1
*/
proposal_substructure_t *proposal_substructure_create_from_proposal_v1(
proposal_t *proposal, u_int32_t lifetime, u_int64_t lifebytes,
auth_method_t auth, ipsec_mode_t mode, bool udp);
auth_method_t auth, ipsec_mode_t mode, encap_t udp);
/**
* Creates an IKEv1 proposal_substructure_t from a list of proposal_t.
@@ -194,12 +204,12 @@ proposal_substructure_t *proposal_substructure_create_from_proposal_v1(
* @param lifebytes lifebytes, in bytes
* @param auth authentication method to use, or AUTH_NONE
* @param mode IPsec encapsulation mode, TRANSPORT or TUNNEL
* @param udp TRUE to use UDP encapsulation
* @param udp ENCAP_UDP to use UDP encapsulation
* @return IKEv1 proposal_substructure_t PROPOSAL_SUBSTRUCTURE_V1
*/
proposal_substructure_t *proposal_substructure_create_from_proposals_v1(
linked_list_t *proposals, u_int32_t lifetime, u_int64_t lifebytes,
auth_method_t auth, ipsec_mode_t mode, bool udp);
auth_method_t auth, ipsec_mode_t mode, encap_t udp);
/**
* Creates an IKEv1 proposal_substructure_t for IPComp with the given
@@ -209,12 +219,12 @@ proposal_substructure_t *proposal_substructure_create_from_proposals_v1(
* @param lifebytes lifebytes, in bytes
* @param cpi the CPI to be used
* @param mode IPsec encapsulation mode, TRANSPORT or TUNNEL
* @param udp TRUE to use UDP encapsulation
* @param udp ENCAP_UDP to use UDP encapsulation
* @param proposal_number the proposal number of the proposal to be linked
* @return IKEv1 proposal_substructure_t PROPOSAL_SUBSTRUCTURE_V1
*/
proposal_substructure_t *proposal_substructure_create_for_ipcomp_v1(
u_int32_t lifetime, u_int64_t lifebytes, u_int16_t cpi,
ipsec_mode_t mode, bool udp, u_int8_t proposal_number);
ipsec_mode_t mode, encap_t udp, u_int8_t proposal_number);
#endif /** PROPOSAL_SUBSTRUCTURE_H_ @}*/
src/libcharon/encoding/payloads/sa_payload.c
+4 -4
View File
@@ -552,8 +552,8 @@ sa_payload_t *sa_payload_create_from_proposal_v2(proposal_t *proposal)
*/
sa_payload_t *sa_payload_create_from_proposals_v1(linked_list_t *proposals,
u_int32_t lifetime, u_int64_t lifebytes,
auth_method_t auth, ipsec_mode_t mode, bool udp,
u_int16_t cpi)
auth_method_t auth, ipsec_mode_t mode,
encap_t udp, u_int16_t cpi)
{
proposal_substructure_t *substruct;
private_sa_payload_t *this;
@@ -591,8 +591,8 @@ sa_payload_t *sa_payload_create_from_proposals_v1(linked_list_t *proposals,
*/
sa_payload_t *sa_payload_create_from_proposal_v1(proposal_t *proposal,
u_int32_t lifetime, u_int64_t lifebytes,
auth_method_t auth, ipsec_mode_t mode, bool udp,
u_int16_t cpi)
auth_method_t auth, ipsec_mode_t mode,
encap_t udp, u_int16_t cpi)
{
private_sa_payload_t *this;
linked_list_t *proposals;
src/libcharon/encoding/payloads/sa_payload.h
+4 -4
View File
@@ -133,13 +133,13 @@ sa_payload_t *sa_payload_create_from_proposal_v2(proposal_t *proposal);
* @param lifebytes lifebytes, in bytes
* @param auth authentication method to use, or AUTH_NONE
* @param mode IPsec encapsulation mode, TRANSPORT or TUNNEL
* @param udp TRUE to use UDP encapsulation
* @param udp ENCAP_UDP to use UDP encapsulation
* @param cpi CPI in case IPComp should be used
* @return sa_payload_t object
*/
sa_payload_t *sa_payload_create_from_proposals_v1(linked_list_t *proposals,
u_int32_t lifetime, u_int64_t lifebytes,
auth_method_t auth, ipsec_mode_t mode, bool udp,
auth_method_t auth, ipsec_mode_t mode, encap_t udp,
u_int16_t cpi);
/**
@@ -150,13 +150,13 @@ sa_payload_t *sa_payload_create_from_proposals_v1(linked_list_t *proposals,
* @param lifebytes lifebytes, in bytes
* @param auth authentication method to use, or AUTH_NONE
* @param mode IPsec encapsulation mode, TRANSPORT or TUNNEL
* @param udp TRUE to use UDP encapsulation
* @param udp ENCAP_UDP to use UDP encapsulation
* @param cpi CPI in case IPComp should be used
* @return sa_payload_t object
*/
sa_payload_t *sa_payload_create_from_proposal_v1(proposal_t *proposal,
u_int32_t lifetime, u_int64_t lifebytes,
auth_method_t auth, ipsec_mode_t mode, bool udp,
auth_method_t auth, ipsec_mode_t mode, encap_t udp,
u_int16_t cpi);
#endif /** SA_PAYLOAD_H_ @}*/