denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

removed NAT_TRAVERSAL and VIRTUAL_IP compile options

Browse Source
This commit is contained in:
Andreas Steffen
2006-07-07 05:50:02 +00:00
parent ad3dab0520
commit dc33fee770
21 changed files with 197 additions and 481 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pluto/Makefile.am
+1 -1
View File
@@ -24,7 +24,7 @@ _pluto_adns_SOURCES = adns.c adns.h
INCLUDES = -I$(top_srcdir)/src/libfreeswan -I$(top_srcdir)/src/libcrypto -I$(top_srcdir)/src/whack INCLUDES = -I$(top_srcdir)/src/libfreeswan -I$(top_srcdir)/src/libcrypto -I$(top_srcdir)/src/whack
AM_CFLAGS = -DIPSEC_DIR=\"${ipsecdir}\" -DIPSEC_CONFDIR=\"${confdir}\" -DIPSEC_PIDDIR=\"${piddir}\" \ AM_CFLAGS = -DIPSEC_DIR=\"${ipsecdir}\" -DIPSEC_CONFDIR=\"${confdir}\" -DIPSEC_PIDDIR=\"${piddir}\" \
-DDEBUG -DKERNEL26_SUPPORT -DKERNEL26_HAS_KAME_DUPLICATES -DNAT_TRAVERSAL -DVIRTUAL_IP -DPLUTO \ -DDEBUG -DKERNEL26_SUPPORT -DKERNEL26_HAS_KAME_DUPLICATES -DPLUTO \
-DVENDORID -DSHARED_SECRETS_FILE=\"${confdir}/ipsec.secrets\" -DTHREADS -DKLIPS -DVENDORID -DSHARED_SECRETS_FILE=\"${confdir}/ipsec.secrets\" -DTHREADS -DKLIPS
pluto_LDADD = $(top_srcdir)/src/libfreeswan/libfreeswan.a $(top_srcdir)/src/libcrypto/libcrypto.a -lgmp -lresolv -lpthread pluto_LDADD = $(top_srcdir)/src/libfreeswan/libfreeswan.a $(top_srcdir)/src/libcrypto/libcrypto.a -lgmp -lresolv -lpthread
_pluto_adns_LDADD = -lresolv $(top_srcdir)/src/libfreeswan/libfreeswan.a _pluto_adns_LDADD = -lresolv $(top_srcdir)/src/libfreeswan/libfreeswan.a
src/pluto/connections.c
+25 -80
View File
@@ -58,13 +58,8 @@
#include "whack.h" #include "whack.h"
#include "alg_info.h" #include "alg_info.h"
#include "ike_alg.h" #include "ike_alg.h"
#ifdef NAT_TRAVERSAL
#include "nat_traversal.h" #include "nat_traversal.h"
#endif
#ifdef VIRTUAL_IP
#include "virtual.h" #include "virtual.h"
#endif
static void flush_pending_by_connection(struct connection *c); /* forward */ static void flush_pending_by_connection(struct connection *c); /* forward */
@@ -114,8 +109,8 @@ find_host_pair(const ip_address *myaddr, u_int16_t myport
if (hisaddr == NULL) if (hisaddr == NULL)
hisaddr = aftoinfo(addrtypeof(myaddr))->any; hisaddr = aftoinfo(addrtypeof(myaddr))->any;
#ifdef NAT_TRAVERSAL if (nat_traversal_enabled)
if (nat_traversal_enabled) { {
/** /**
* port is not relevant in host_pair. with nat_traversal we * port is not relevant in host_pair. with nat_traversal we
* always use pluto_port (500) * always use pluto_port (500)
@@ -123,7 +118,6 @@ find_host_pair(const ip_address *myaddr, u_int16_t myport
myport = pluto_port; myport = pluto_port;
hisport = pluto_port; hisport = pluto_port;
} }
#endif
for (prev = NULL, p = host_pairs; p != NULL; prev = p, p = p->next) for (prev = NULL, p = host_pairs; p != NULL; prev = p, p = p->next)
{ {
@@ -149,17 +143,17 @@ find_host_pair_connections(const ip_address *myaddr, u_int16_t myport
{ {
struct host_pair *hp = find_host_pair(myaddr, myport, hisaddr, hisport); struct host_pair *hp = find_host_pair(myaddr, myport, hisaddr, hisport);
#ifdef NAT_TRAVERSAL if (nat_traversal_enabled && hp && hisaddr)
if (nat_traversal_enabled && hp && hisaddr) { {
struct connection *c; struct connection *c;
for (c = hp->connections; c != NULL; c = c->hp_next) {
if ((c->spd.this.host_port==myport) && (c->spd.that.host_port==hisport)) for (c = hp->connections; c != NULL; c = c->hp_next)
{
if (c->spd.this.host_port == myport && c->spd.that.host_port == hisport)
return c; return c;
} }
return NULL; return NULL;
} }
#endif
return hp == NULL? NULL : hp->connections; return hp == NULL? NULL : hp->connections;
} }
@@ -177,13 +171,8 @@ connect_to_host_pair(struct connection *c)
hp = alloc_thing(struct host_pair, "host_pair"); hp = alloc_thing(struct host_pair, "host_pair");
hp->me.addr = c->spd.this.host_addr; hp->me.addr = c->spd.this.host_addr;
hp->him.addr = c->spd.that.host_addr; hp->him.addr = c->spd.that.host_addr;
#ifdef NAT_TRAVERSAL
hp->me.port = nat_traversal_enabled ? pluto_port : c->spd.this.host_port; hp->me.port = nat_traversal_enabled ? pluto_port : c->spd.this.host_port;
hp->him.port = nat_traversal_enabled ? pluto_port : c->spd.that.host_port; hp->him.port = nat_traversal_enabled ? pluto_port : c->spd.that.host_port;
#else
hp->me.port = c->spd.this.host_port;
hp->him.port = c->spd.that.host_port;
#endif
hp->initial_connection_sent = FALSE; hp->initial_connection_sent = FALSE;
hp->connections = NULL; hp->connections = NULL;
hp->pending = NULL; hp->pending = NULL;
@@ -333,9 +322,8 @@ delete_connection(struct connection *c, bool relations)
} }
} }
#ifdef VIRTUAL_IP if (c->kind != CK_GOING_AWAY)
if (c->kind != CK_GOING_AWAY) pfreeany(c->spd.that.virt); pfreeany(c->spd.that.virt);
#endif
#ifdef DEBUG #ifdef DEBUG
cur_debugging = old_cur_debugging; cur_debugging = old_cur_debugging;
@@ -573,12 +561,10 @@ format_end(char *buf
client[0] = '\0'; client[0] = '\0';
#ifdef VIRTUAL_IP
if (is_virtual_end(this) && isanyaddr(&this->host_addr)) if (is_virtual_end(this) && isanyaddr(&this->host_addr))
{ {
host = "%virtual"; host = "%virtual";
} }
#endif
/* [client===] */ /* [client===] */
if (this->has_client) if (this->has_client)
@@ -915,14 +901,14 @@ check_connection_end(const whack_end_t *this, const whack_end_t *that
return FALSE; return FALSE;
} }
} }
#ifdef VIRTUAL_IP
if (this->virt && (!isanyaddr(&this->host_addr) || this->has_client)) if (this->virt && (!isanyaddr(&this->host_addr) || this->has_client))
{ {
loglog(RC_CLASH, loglog(RC_CLASH,
"virtual IP must only be used with %%any and without client"); "virtual IP must only be used with %%any and without client");
return FALSE; return FALSE;
} }
#endif
return TRUE; /* happy */ return TRUE; /* happy */
} }
@@ -1125,7 +1111,6 @@ add_connection(const whack_message_t *wm)
c->gw_info = NULL; c->gw_info = NULL;
#ifdef VIRTUAL_IP
passert(!(wm->left.virt && wm->right.virt)); passert(!(wm->left.virt && wm->right.virt));
if (wm->left.virt || wm->right.virt) if (wm->left.virt || wm->right.virt)
{ {
@@ -1135,7 +1120,6 @@ add_connection(const whack_message_t *wm)
if (c->spd.that.virt) if (c->spd.that.virt)
c->spd.that.has_client = TRUE; c->spd.that.has_client = TRUE;
} }
#endif
unshare_connection_strings(c); unshare_connection_strings(c);
(void)orient(c); (void)orient(c);
@@ -1220,13 +1204,11 @@ add_group_instance(struct connection *group, const ip_subnet *target)
t->spd.reqid = gen_reqid(); t->spd.reqid = gen_reqid();
#ifdef VIRTUAL_IP
if (t->spd.that.virt) if (t->spd.that.virt)
{ {
DBG_log("virtual_ip not supported in group instance"); DBG_log("virtual_ip not supported in group instance");
t->spd.that.virt = NULL; t->spd.that.virt = NULL;
} }
#endif
/* add to connections list */ /* add to connections list */
t->ac_next = connections; t->ac_next = connections;
@@ -1268,9 +1250,7 @@ remove_group_instance(const struct connection *group USED_BY_DEBUG
*/ */
static struct connection * static struct connection *
instantiate(struct connection *c, const ip_address *him instantiate(struct connection *c, const ip_address *him
#ifdef NAT_TRAVERSAL
, u_int16_t his_port , u_int16_t his_port
#endif
, const struct id *his_id) , const struct id *his_id)
{ {
struct connection *d; struct connection *d;
@@ -1295,9 +1275,9 @@ instantiate(struct connection *c, const ip_address *him
passert(oriented(*d)); passert(oriented(*d));
d->spd.that.host_addr = *him; d->spd.that.host_addr = *him;
setportof(htons(c->spd.that.port), &d->spd.that.host_addr); setportof(htons(c->spd.that.port), &d->spd.that.host_addr);
#ifdef NAT_TRAVERSAL
if (his_port) d->spd.that.host_port = his_port; if (his_port) d->spd.that.host_port = his_port;
#endif
default_end(&d->spd.that, &d->spd.this.host_addr); default_end(&d->spd.that, &d->spd.this.host_addr);
/* We cannot guess what our next_hop should be, but if it was /* We cannot guess what our next_hop should be, but if it was
@@ -1327,23 +1307,11 @@ instantiate(struct connection *c, const ip_address *him
} }
struct connection * struct connection *
rw_instantiate(struct connection *c rw_instantiate(struct connection *c, const ip_address *him, u_int16_t his_port
, const ip_address *him , const ip_subnet *his_net, const struct id *his_id)
#ifdef NAT_TRAVERSAL
, u_int16_t his_port
#endif
#ifdef VIRTUAL_IP
, const ip_subnet *his_net
#endif
, const struct id *his_id)
{ {
#ifdef NAT_TRAVERSAL
struct connection *d = instantiate(c, him, his_port, his_id); struct connection *d = instantiate(c, him, his_port, his_id);
#else
struct connection *d = instantiate(c, him, his_id);
#endif
#ifdef VIRTUAL_IP
if (d && his_net && is_virtual_connection(c)) if (d && his_net && is_virtual_connection(c))
{ {
d->spd.that.client = *his_net; d->spd.that.client = *his_net;
@@ -1351,7 +1319,6 @@ rw_instantiate(struct connection *c
if (subnetishost(his_net) && addrinsubnet(him, his_net)) if (subnetishost(his_net) && addrinsubnet(him, his_net))
d->spd.that.has_client = FALSE; d->spd.that.has_client = FALSE;
} }
#endif
if (d->policy & POLICY_OPPO) if (d->policy & POLICY_OPPO)
{ {
@@ -1374,11 +1341,7 @@ oppo_instantiate(struct connection *c
, const ip_address *our_client USED_BY_DEBUG , const ip_address *our_client USED_BY_DEBUG
, const ip_address *peer_client) , const ip_address *peer_client)
{ {
#ifdef NAT_TRAVERSAL
struct connection *d = instantiate(c, him, 0, his_id); struct connection *d = instantiate(c, him, 0, his_id);
#else
struct connection *d = instantiate(c, him, his_id);
#endif
passert(d->spd.next == NULL); passert(d->spd.next == NULL);
@@ -1510,13 +1473,12 @@ fmt_conn_instance(const struct connection *c, char buf[CONN_INST_BUF])
{ {
*p++ = ' '; *p++ = ' ';
addrtot(&c->spd.that.host_addr, 0, p, ADDRTOT_BUF); addrtot(&c->spd.that.host_addr, 0, p, ADDRTOT_BUF);
#ifdef NAT_TRAVERSAL #
if (c->spd.that.host_port != pluto_port) if (c->spd.that.host_port != pluto_port)
{ {
p += strlen(p); p += strlen(p);
sprintf(p, ":%d", c->spd.that.host_port); sprintf(p, ":%d", c->spd.that.host_port);
} }
#endif
} }
} }
} }
@@ -1775,9 +1737,9 @@ orient(struct connection *c)
*/ */
for (p = interfaces; p != NULL; p = p->next) for (p = interfaces; p != NULL; p = p->next)
{ {
#ifdef NAT_TRAVERSAL if (p->ike_float)
if (p->ike_float) continue; continue;
#endif
for (;;) for (;;)
{ {
/* check if this interface matches this end */ /* check if this interface matches this end */
@@ -3083,18 +3045,11 @@ ISAKMP_SA_established(struct connection *c, so_serial_t serial)
{ {
struct connection *next = d->ac_next; /* might move underneath us */ struct connection *next = d->ac_next; /* might move underneath us */
#ifdef NAT_TRAVERSAL
if (d->kind >= CK_PERMANENT if (d->kind >= CK_PERMANENT
&& same_id(&c->spd.this.id, &d->spd.this.id) && same_id(&c->spd.this.id, &d->spd.this.id)
&& same_id(&c->spd.that.id, &d->spd.that.id) && same_id(&c->spd.that.id, &d->spd.that.id)
&& (!sameaddr(&c->spd.that.host_addr, &d->spd.that.host_addr) || && (!sameaddr(&c->spd.that.host_addr, &d->spd.that.host_addr) ||
(c->spd.that.host_port != d->spd.that.host_port))) (c->spd.that.host_port != d->spd.that.host_port)))
#else
if (d->kind >= CK_PERMANENT
&& same_id(&c->spd.this.id, &d->spd.this.id)
&& same_id(&c->spd.that.id, &d->spd.that.id)
&& !sameaddr(&c->spd.that.host_addr, &d->spd.that.host_addr))
#endif
{ {
release_connection(d, FALSE); release_connection(d, FALSE);
} }
@@ -3418,11 +3373,11 @@ refine_host_connection(const struct state *st, const struct id *peer_id
if (d->policy & POLICY_GROUP) if (d->policy & POLICY_GROUP)
continue; continue;
#ifdef NAT_TRAVERSAL
if (c->spd.that.host_port != d->spd.that.host_port if (c->spd.that.host_port != d->spd.that.host_port
&& d->kind == CK_INSTANCE) && d->kind == CK_INSTANCE)
{
continue; continue;
#endif }
/* authentication used must fit policy of this connection */ /* authentication used must fit policy of this connection */
if ((d->policy & auth_policy) == LEMPTY) if ((d->policy & auth_policy) == LEMPTY)
@@ -3490,7 +3445,6 @@ refine_host_connection(const struct state *st, const struct id *peer_id
} }
} }
#ifdef VIRTUAL_IP
/** /**
* With virtual addressing, we must not allow someone to use an already * With virtual addressing, we must not allow someone to use an already
* used (by another id) addr/net. * used (by another id) addr/net.
@@ -3528,7 +3482,6 @@ is_virtual_net_used(const ip_subnet *peer_net, const struct id *peer_id)
} }
return FALSE; /* you can safely use it */ return FALSE; /* you can safely use it */
} }
#endif
/* find_client_connection: given a connection suitable for ISAKMP /* find_client_connection: given a connection suitable for ISAKMP
* (i.e. the hosts match), find a one suitable for IPSEC * (i.e. the hosts match), find a one suitable for IPSEC
@@ -3646,18 +3599,12 @@ fc_try(const struct connection *c
} }
else else
{ {
#ifdef VIRTUAL_IP if (!samesubnet(&sr->that.client, peer_net) && !is_virtual_connection(d))
if ((!samesubnet(&sr->that.client, peer_net)) && (!is_virtual_connection(d)))
#else
if (!samesubnet(&sr->that.client, peer_net))
#endif
continue; continue;
#ifdef VIRTUAL_IP
if (is_virtual_connection(d) if (is_virtual_connection(d)
&& ( (!is_virtual_net_allowed(d, peer_net, &c->spd.that.host_addr)) && (!is_virtual_net_allowed(d, peer_net, &c->spd.that.host_addr)
|| is_virtual_net_used(peer_net, peer_id?peer_id:&c->spd.that.id))) || is_virtual_net_used(peer_net, peer_id?peer_id:&c->spd.that.id)))
continue; continue;
#endif
} }
} }
else else
@@ -4296,13 +4243,11 @@ update_pending(struct state *os, struct state *ns)
{ {
if (p->isakmp_sa == os) if (p->isakmp_sa == os)
p->isakmp_sa = ns; p->isakmp_sa = ns;
#ifdef NAT_TRAVERSAL
if (p->connection->spd.this.host_port != ns->st_connection->spd.this.host_port) if (p->connection->spd.this.host_port != ns->st_connection->spd.this.host_port)
{ {
p->connection->spd.this.host_port = ns->st_connection->spd.this.host_port; p->connection->spd.this.host_port = ns->st_connection->spd.this.host_port;
p->connection->spd.that.host_port = ns->st_connection->spd.that.host_port; p->connection->spd.that.host_port = ns->st_connection->spd.that.host_port;
} }
#endif
} }
} }
src/pluto/connections.h
+4 -15
View File
@@ -126,9 +126,7 @@ typedef unsigned long policy_prio_t;
#define POLICY_PRIO_BUF (3+1+3+1) #define POLICY_PRIO_BUF (3+1+3+1)
extern void fmt_policy_prio(policy_prio_t pp, char buf[POLICY_PRIO_BUF]); extern void fmt_policy_prio(policy_prio_t pp, char buf[POLICY_PRIO_BUF]);
#ifdef VIRTUAL_IP
struct virtual_t; struct virtual_t;
#endif
struct end { struct end {
struct id id; struct id id;
@@ -151,9 +149,7 @@ struct end {
chunk_t ca; /* CA distinguished name */ chunk_t ca; /* CA distinguished name */
struct ietfAttrList *groups;/* access control groups */ struct ietfAttrList *groups;/* access control groups */
smartcard_t *sc; /* smartcard reader and key info */ smartcard_t *sc; /* smartcard reader and key info */
#ifdef VIRTUAL_IP
struct virtual_t *virt; struct virtual_t *virt;
#endif
bool modecfg; /* this end: request local address from server */ bool modecfg; /* this end: request local address from server */
/* that end: give local addresses to clients */ /* that end: give local addresses to clients */
bool hostaccess; /* allow access to host via iptables INPUT/OUTPUT */ bool hostaccess; /* allow access to host via iptables INPUT/OUTPUT */
@@ -305,12 +301,8 @@ struct gw_info; /* forward declaration of tag (defined in dnskey.h) */
struct alg_info; /* forward declaration of tag (defined in alg_info.h) */ struct alg_info; /* forward declaration of tag (defined in alg_info.h) */
extern struct connection *rw_instantiate(struct connection *c extern struct connection *rw_instantiate(struct connection *c
, const ip_address *him , const ip_address *him
#ifdef NAT_TRAVERSAL
, u_int16_t his_port , u_int16_t his_port
#endif
#ifdef VIRTUAL_IP
, const ip_subnet *his_net , const ip_subnet *his_net
#endif
, const struct id *his_id); , const struct id *his_id);
extern struct connection *oppo_instantiate(struct connection *c extern struct connection *oppo_instantiate(struct connection *c
@@ -366,12 +358,9 @@ extern struct connection *eclipsed(struct connection *c, struct spd_route **);
extern void show_connections_status(bool all, const char *name); extern void show_connections_status(bool all, const char *name);
extern int connection_compare(const struct connection *ca extern int connection_compare(const struct connection *ca
, const struct connection *cb); , const struct connection *cb);
#ifdef NAT_TRAVERSAL extern void update_host_pair(const char *why, struct connection *c
void , const ip_address *myaddr, u_int16_t myport
update_host_pair(const char *why, struct connection *c, , const ip_address *hisaddr, u_int16_t hisport);
const ip_address *myaddr, u_int16_t myport ,
const ip_address *hisaddr, u_int16_t hisport);
#endif /* NAT_TRAVERSAL */
#endif /* _CONNECTIONS_H */ #endif /* _CONNECTIONS_H */
src/pluto/demux.c
+31 -71
View File
@@ -142,9 +142,7 @@
#include "timer.h" #include "timer.h"
#include "whack.h" /* requires connections.h */ #include "whack.h" /* requires connections.h */
#include "server.h" #include "server.h"
#ifdef NAT_TRAVERSAL
#include "nat_traversal.h" #include "nat_traversal.h"
#endif
#include "vendor.h" #include "vendor.h"
#include "modecfg.h" #include "modecfg.h"
@@ -273,11 +271,7 @@ static const struct state_microcode state_microcode_table[] = {
*/ */
{ STATE_MAIN_R1, STATE_MAIN_R2 { STATE_MAIN_R1, STATE_MAIN_R2
, SMF_PSK_AUTH | SMF_DS_AUTH | SMF_REPLY , SMF_PSK_AUTH | SMF_DS_AUTH | SMF_REPLY
#ifdef NAT_TRAVERSAL
, P(KE) | P(NONCE), P(VID) | P(CR) | P(NATD_RFC), PT(KE) , P(KE) | P(NONCE), P(VID) | P(CR) | P(NATD_RFC), PT(KE)
#else
, P(KE) | P(NONCE), P(VID) | P(CR), PT(KE)
#endif
, EVENT_RETRANSMIT, main_inI2_outR2 }, , EVENT_RETRANSMIT, main_inI2_outR2 },
{ STATE_MAIN_R1, STATE_UNDEFINED { STATE_MAIN_R1, STATE_UNDEFINED
@@ -302,11 +296,7 @@ static const struct state_microcode state_microcode_table[] = {
*/ */
{ STATE_MAIN_I2, STATE_MAIN_I3 { STATE_MAIN_I2, STATE_MAIN_I3
, SMF_PSK_AUTH | SMF_DS_AUTH | SMF_INITIATOR | SMF_OUTPUT_ENCRYPTED | SMF_REPLY , SMF_PSK_AUTH | SMF_DS_AUTH | SMF_INITIATOR | SMF_OUTPUT_ENCRYPTED | SMF_REPLY
#ifdef NAT_TRAVERSAL
, P(KE) | P(NONCE), P(VID) | P(CR) | P(NATD_RFC), PT(ID) , P(KE) | P(NONCE), P(VID) | P(CR) | P(NATD_RFC), PT(ID)
#else
, P(KE) | P(NONCE), P(VID) | P(CR), PT(ID)
#endif
, EVENT_RETRANSMIT, main_inR2_outI3 }, , EVENT_RETRANSMIT, main_inR2_outI3 },
{ STATE_MAIN_I2, STATE_UNDEFINED { STATE_MAIN_I2, STATE_UNDEFINED
@@ -397,11 +387,7 @@ static const struct state_microcode state_microcode_table[] = {
*/ */
{ STATE_QUICK_R0, STATE_QUICK_R1 { STATE_QUICK_R0, STATE_QUICK_R1
, SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY , SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY
#ifdef NAT_TRAVERSAL
, P(HASH) | P(SA) | P(NONCE), /* P(SA) | */ P(KE) | P(ID) | P(NATOA_RFC), PT(NONE) , P(HASH) | P(SA) | P(NONCE), /* P(SA) | */ P(KE) | P(ID) | P(NATOA_RFC), PT(NONE)
#else
, P(HASH) | P(SA) | P(NONCE), /* P(SA) | */ P(KE) | P(ID), PT(NONE)
#endif
, EVENT_RETRANSMIT, quick_inI1_outR1 }, , EVENT_RETRANSMIT, quick_inI1_outR1 },
/* STATE_QUICK_I1: /* STATE_QUICK_I1:
@@ -412,11 +398,7 @@ static const struct state_microcode state_microcode_table[] = {
*/ */
{ STATE_QUICK_I1, STATE_QUICK_I2 { STATE_QUICK_I1, STATE_QUICK_I2
, SMF_ALL_AUTH | SMF_INITIATOR | SMF_ENCRYPTED | SMF_REPLY , SMF_ALL_AUTH | SMF_INITIATOR | SMF_ENCRYPTED | SMF_REPLY
#ifdef NAT_TRAVERSAL
, P(HASH) | P(SA) | P(NONCE), /* P(SA) | */ P(KE) | P(ID) | P(NATOA_RFC), PT(HASH) , P(HASH) | P(SA) | P(NONCE), /* P(SA) | */ P(KE) | P(ID) | P(NATOA_RFC), PT(HASH)
#else
, P(HASH) | P(SA) | P(NONCE), /* P(SA) | */ P(KE) | P(ID), PT(HASH)
#endif
, EVENT_SA_REPLACE, quick_inR1_outI2 }, , EVENT_SA_REPLACE, quick_inR1_outI2 },
/* STATE_QUICK_R1: HDR*, HASH(3) --> done /* STATE_QUICK_R1: HDR*, HASH(3) --> done
@@ -744,7 +726,6 @@ check_msg_errqueue(const struct iface *ifp, short interest)
/* note dirty trick to suppress ~ at start of format /* note dirty trick to suppress ~ at start of format
* if we know what state to blame. * if we know what state to blame.
*/ */
#ifdef NAT_TRAVERSAL
if ((packet_len == 1) && (buffer[0] = 0xff) if ((packet_len == 1) && (buffer[0] = 0xff)
#ifdef DEBUG #ifdef DEBUG
&& ((cur_debugging & DBG_NATT) == 0) && ((cur_debugging & DBG_NATT) == 0)
@@ -755,7 +736,6 @@ check_msg_errqueue(const struct iface *ifp, short interest)
*/ */
} }
else else
#endif
plog((sender != NULL) + "~" plog((sender != NULL) + "~"
"ERROR: asynchronous network error report on %s" "ERROR: asynchronous network error report on %s"
"%s" "%s"
@@ -793,24 +773,19 @@ check_msg_errqueue(const struct iface *ifp, short interest)
#endif /* defined(IP_RECVERR) && defined(MSG_ERRQUEUE) */ #endif /* defined(IP_RECVERR) && defined(MSG_ERRQUEUE) */
bool bool
#ifdef NAT_TRAVERSAL
_send_packet(struct state *st, const char *where, bool verbose)
#else
send_packet(struct state *st, const char *where) send_packet(struct state *st, const char *where)
#endif
{ {
struct connection *c = st->st_connection; struct connection *c = st->st_connection;
int port_buf; int port_buf;
bool err; bool err;
#ifdef NAT_TRAVERSAL
u_int8_t ike_pkt[MAX_OUTPUT_UDP_SIZE]; u_int8_t ike_pkt[MAX_OUTPUT_UDP_SIZE];
u_int8_t *ptr; u_int8_t *ptr;
unsigned long len; unsigned long len;
if ((c->interface->ike_float == TRUE) && (st->st_tpacket.len != 1)) { if (c->interface->ike_float && st->st_tpacket.len != 1)
if ((unsigned long) st->st_tpacket.len > {
(MAX_OUTPUT_UDP_SIZE-sizeof(u_int32_t))) { if ((unsigned long) st->st_tpacket.len > (MAX_OUTPUT_UDP_SIZE-sizeof(u_int32_t)))
{
DBG_log("send_packet(): really too big"); DBG_log("send_packet(): really too big");
return FALSE; return FALSE;
} }
@@ -821,11 +796,11 @@ send_packet(struct state *st, const char *where)
(unsigned long)st->st_tpacket.len); (unsigned long)st->st_tpacket.len);
len = (unsigned long) st->st_tpacket.len + sizeof(u_int32_t); len = (unsigned long) st->st_tpacket.len + sizeof(u_int32_t);
} }
else { else
{
ptr = st->st_tpacket.ptr; ptr = st->st_tpacket.ptr;
len = (unsigned long) st->st_tpacket.len; len = (unsigned long) st->st_tpacket.len;
} }
#endif
DBG(DBG_RAW, DBG(DBG_RAW,
{ {
@@ -850,28 +825,19 @@ send_packet(struct state *st, const char *where)
(void) check_msg_errqueue(c->interface, POLLOUT); (void) check_msg_errqueue(c->interface, POLLOUT);
#endif /* defined(IP_RECVERR) && defined(MSG_ERRQUEUE) */ #endif /* defined(IP_RECVERR) && defined(MSG_ERRQUEUE) */
#ifdef NAT_TRAVERSAL
err = sendto(c->interface->fd err = sendto(c->interface->fd
, ptr, len, 0 , ptr, len, 0
, sockaddrof(&c->spd.that.host_addr) , sockaddrof(&c->spd.that.host_addr)
, sockaddrlenof(&c->spd.that.host_addr)) != (ssize_t)len; , sockaddrlenof(&c->spd.that.host_addr)) != (ssize_t)len;
#else
err = sendto(c->interface->fd
, st->st_tpacket.ptr, st->st_tpacket.len, 0
, sockaddrof(&c->spd.that.host_addr)
, sockaddrlenof(&c->spd.that.host_addr)) != (ssize_t)st->st_tpacket.len;
#endif
/* restore port */ /* restore port */
setportof(port_buf, &c->spd.that.host_addr); setportof(port_buf, &c->spd.that.host_addr);
if (err) if (err)
{ {
#ifdef NAT_TRAVERSAL /* do not log NAT-T Keep Alive packets */
/* do not log NAT-T Keep Alive packets */ if (streq(where, "NAT-T Keep Alive"))
if (!verbose) return FALSE;
return FALSE;
#endif
log_errno((e, "sendto on %s to %s:%u failed in %s" log_errno((e, "sendto on %s to %s:%u failed in %s"
, c->interface->rname , c->interface->rname
, ip_str(&c->spd.that.host_addr) , ip_str(&c->spd.that.host_addr)
@@ -1141,16 +1107,19 @@ read_packet(struct msg_digest *md)
cur_from = &md->sender; cur_from = &md->sender;
cur_from_port = md->sender_port; cur_from_port = md->sender_port;
#ifdef NAT_TRAVERSAL if (ifp->ike_float == TRUE)
if (ifp->ike_float == TRUE) { {
u_int32_t non_esp; u_int32_t non_esp;
if (packet_len < (int)sizeof(u_int32_t)) {
if (packet_len < (int)sizeof(u_int32_t))
{
plog("recvfrom %s:%u too small packet (%d)" plog("recvfrom %s:%u too small packet (%d)"
, ip_str(cur_from), (unsigned) cur_from_port, packet_len); , ip_str(cur_from), (unsigned) cur_from_port, packet_len);
return FALSE; return FALSE;
} }
memcpy(&non_esp, buffer, sizeof(u_int32_t)); memcpy(&non_esp, buffer, sizeof(u_int32_t));
if (non_esp != 0) { if (non_esp != 0)
{
plog("recvfrom %s:%u has no Non-ESP marker" plog("recvfrom %s:%u has no Non-ESP marker"
, ip_str(cur_from), (unsigned) cur_from_port); , ip_str(cur_from), (unsigned) cur_from_port);
return FALSE; return FALSE;
@@ -1161,7 +1130,6 @@ read_packet(struct msg_digest *md)
pfree(buffer); pfree(buffer);
buffer = buffer_nat; buffer = buffer_nat;
} }
#endif
/* Clone actual message contents /* Clone actual message contents
* and set up md->packet_pbs to describe it. * and set up md->packet_pbs to describe it.
@@ -1180,21 +1148,20 @@ read_packet(struct msg_digest *md)
DBG(DBG_RAW, DBG(DBG_RAW,
DBG_dump("", md->packet_pbs.start, pbs_room(&md->packet_pbs))); DBG_dump("", md->packet_pbs.start, pbs_room(&md->packet_pbs)));
#ifdef NAT_TRAVERSAL if ((pbs_room(&md->packet_pbs)==1) && (md->packet_pbs.start[0]==0xff))
if ((pbs_room(&md->packet_pbs)==1) && (md->packet_pbs.start[0]==0xff)) { {
/** /**
* NAT-T Keep-alive packets should be discared by kernel ESPinUDP * NAT-T Keep-alive packets should be discared by kernel ESPinUDP
* layer. But boggus keep-alive packets (sent with a non-esp marker) * layer. But boggus keep-alive packets (sent with a non-esp marker)
* can reach this point. Complain and discard them. * can reach this point. Complain and discard them.
*/ */
DBG(DBG_NATT, DBG(DBG_NATT,
DBG_log("NAT-T keep-alive (boggus ?) should not reach this point. " DBG_log("NAT-T keep-alive (boggus ?) should not reach this point. "
"Ignored. Sender: %s:%u", ip_str(cur_from), "Ignored. Sender: %s:%u", ip_str(cur_from),
(unsigned) cur_from_port); (unsigned) cur_from_port);
); )
return FALSE; return FALSE;
} }
#endif
#define IKEV2_VERSION_OFFSET 17 #define IKEV2_VERSION_OFFSET 17
#define IKEV2_VERSION 0x20 #define IKEV2_VERSION 0x20
@@ -1809,12 +1776,12 @@ process_packet(struct msg_digest **mdp)
return; return;
} }
#ifdef NAT_TRAVERSAL
switch (np) switch (np)
{ {
case ISAKMP_NEXT_NATD_RFC: case ISAKMP_NEXT_NATD_RFC:
case ISAKMP_NEXT_NATOA_RFC: case ISAKMP_NEXT_NATOA_RFC:
if ((!st) || (!(st->nat_traversal & NAT_T_WITH_RFC_VALUES))) { if (!st || !(st->nat_traversal & NAT_T_WITH_RFC_VALUES))
{
/* /*
* don't accept NAT-D/NAT-OA reloc directly in message, unless * don't accept NAT-D/NAT-OA reloc directly in message, unless
* we're using NAT-T RFC * we're using NAT-T RFC
@@ -1823,7 +1790,6 @@ process_packet(struct msg_digest **mdp)
} }
break; break;
} }
#endif
if (sd == NULL) if (sd == NULL)
{ {
@@ -1834,7 +1800,6 @@ process_packet(struct msg_digest **mdp)
sd = IS_PHASE1(from_state) sd = IS_PHASE1(from_state)
? &isakmp_identification_desc : &isakmp_ipsec_identification_desc; ? &isakmp_identification_desc : &isakmp_ipsec_identification_desc;
break; break;
#ifdef NAT_TRAVERSAL
case ISAKMP_NEXT_NATD_DRAFTS: case ISAKMP_NEXT_NATD_DRAFTS:
np = ISAKMP_NEXT_NATD_RFC; /* NAT-D relocated */ np = ISAKMP_NEXT_NATD_RFC; /* NAT-D relocated */
sd = payload_descs[np]; sd = payload_descs[np];
@@ -1843,7 +1808,6 @@ process_packet(struct msg_digest **mdp)
np = ISAKMP_NEXT_NATOA_RFC; /* NAT-OA relocated */ np = ISAKMP_NEXT_NATOA_RFC; /* NAT-OA relocated */
sd = payload_descs[np]; sd = payload_descs[np];
break; break;
#endif
default: default:
loglog(RC_LOG_SERIOUS, "%smessage ignored because it contains an unknown or" loglog(RC_LOG_SERIOUS, "%smessage ignored because it contains an unknown or"
" unexpected payload type (%s) at the outermost level" " unexpected payload type (%s) at the outermost level"
@@ -2107,10 +2071,8 @@ complete_state_transition(struct msg_digest **mdp, stf_status result)
clonetochunk(st->st_tpacket, md->reply.start clonetochunk(st->st_tpacket, md->reply.start
, pbs_offset(&md->reply), "reply packet"); , pbs_offset(&md->reply), "reply packet");
#ifdef NAT_TRAVERSAL
if (nat_traversal_enabled) if (nat_traversal_enabled)
nat_traversal_change_port_lookup(md, md->st); nat_traversal_change_port_lookup(md, md->st);
#endif
/* actually send the packet /* actually send the packet
* Note: this is a great place to implement "impairments" * Note: this is a great place to implement "impairments"
@@ -2293,7 +2255,6 @@ complete_state_transition(struct msg_digest **mdp, stf_status result)
/* advance b to end of string */ /* advance b to end of string */
b = b + strlen(b); b = b + strlen(b);
#ifdef NAT_TRAVERSAL
if (st->nat_traversal) if (st->nat_traversal)
{ {
char oa[ADDRTOT_BUF]; char oa[ADDRTOT_BUF];
@@ -2304,7 +2265,6 @@ complete_state_transition(struct msg_digest **mdp, stf_status result)
ini = " "; ini = " ";
fin = "}"; fin = "}";
} }
#endif
/* advance b to end of string */ /* advance b to end of string */
b = b + strlen(b); b = b + strlen(b);
src/pluto/demux.h
-7
View File
@@ -18,12 +18,7 @@
struct state; /* forward declaration of tag */ struct state; /* forward declaration of tag */
extern void init_demux(void); extern void init_demux(void);
#ifdef NAT_TRAVERSAL
#define send_packet(st,wh) _send_packet(st,wh,TRUE)
extern bool _send_packet(struct state *st, const char *where, bool verbose);
#else
extern bool send_packet(struct state *st, const char *where); extern bool send_packet(struct state *st, const char *where);
#endif
extern void comm_handle(const struct iface *ifp); extern void comm_handle(const struct iface *ifp);
extern u_int8_t reply_buffer[MAX_OUTPUT_UDP_SIZE]; extern u_int8_t reply_buffer[MAX_OUTPUT_UDP_SIZE];
@@ -74,9 +69,7 @@ struct msg_digest {
digest[PAYLIMIT], digest[PAYLIMIT],
*digest_roof, *digest_roof,
*chain[ISAKMP_NEXT_ROOF]; *chain[ISAKMP_NEXT_ROOF];
#ifdef NAT_TRAVERSAL
unsigned short nat_traversal_vid; unsigned short nat_traversal_vid;
#endif
}; };
extern void release_md(struct msg_digest *md); extern void release_md(struct msg_digest *md);
src/pluto/ipsec_doi.c
+18 -87
View File
@@ -67,12 +67,8 @@
#include "alg_info.h" #include "alg_info.h"
#include "ike_alg.h" #include "ike_alg.h"
#include "kernel_alg.h" #include "kernel_alg.h"
#ifdef NAT_TRAVERSAL
#include "nat_traversal.h" #include "nat_traversal.h"
#endif
#ifdef VIRTUAL_IP
#include "virtual.h" #include "virtual.h"
#endif
/* /*
* are we sending Pluto's Vendor ID? * are we sending Pluto's Vendor ID?
@@ -769,10 +765,10 @@ accept_delete(struct state *st, struct msg_digest *md, struct payload_digest *p)
oldc = cur_connection; oldc = cur_connection;
set_cur_connection(dst->st_connection); set_cur_connection(dst->st_connection);
#ifdef NAT_TRAVERSAL
if (nat_traversal_enabled) if (nat_traversal_enabled)
nat_traversal_change_port_lookup(md, dst); nat_traversal_change_port_lookup(md, dst);
#endif
loglog(RC_LOG_SERIOUS, "received Delete SA payload: " loglog(RC_LOG_SERIOUS, "received Delete SA payload: "
"deleting ISAKMP State #%lu", dst->st_serialno); "deleting ISAKMP State #%lu", dst->st_serialno);
delete_state(dst); delete_state(dst);
@@ -806,10 +802,9 @@ accept_delete(struct state *st, struct msg_digest *md, struct payload_digest *p)
oldc = cur_connection; oldc = cur_connection;
set_cur_connection(rc); set_cur_connection(rc);
#ifdef NAT_TRAVERSAL
if (nat_traversal_enabled) if (nat_traversal_enabled)
nat_traversal_change_port_lookup(md, dst); nat_traversal_change_port_lookup(md, dst);
#endif
if (rc->newest_ipsec_sa == dst->st_serialno if (rc->newest_ipsec_sa == dst->st_serialno
&& (rc->policy & POLICY_UP)) && (rc->policy & POLICY_UP))
{ {
@@ -902,10 +897,8 @@ main_outI1(int whack_sock, struct connection *c, struct state *predecessor
vids_to_send++; vids_to_send++;
/* always send DPD Vendor ID */ /* always send DPD Vendor ID */
vids_to_send++; vids_to_send++;
#ifdef NAT_TRAVERSAL
if (nat_traversal_enabled) if (nat_traversal_enabled)
vids_to_send++; vids_to_send++;
#endif
get_cookie(TRUE, st->st_icookie, COOKIE_SIZE, &c->spd.that.host_addr); get_cookie(TRUE, st->st_icookie, COOKIE_SIZE, &c->spd.that.host_addr);
@@ -1004,7 +997,6 @@ main_outI1(int whack_sock, struct connection *c, struct state *predecessor
} }
} }
#ifdef NAT_TRAVERSAL
if (nat_traversal_enabled) if (nat_traversal_enabled)
{ {
/* Add supported NAT-Traversal VID */ /* Add supported NAT-Traversal VID */
@@ -1015,7 +1007,6 @@ main_outI1(int whack_sock, struct connection *c, struct state *predecessor
return STF_INTERNAL_ERROR; return STF_INTERNAL_ERROR;
} }
} }
#endif
close_message(&rbody); close_message(&rbody);
close_output_pbs(&reply); close_output_pbs(&reply);
@@ -2043,7 +2034,6 @@ quick_outI1(int whack_sock
, replacing , replacing
, isakmp_sa->st_serialno); , isakmp_sa->st_serialno);
#ifdef NAT_TRAVERSAL
if (isakmp_sa->nat_traversal & NAT_T_DETECTED) if (isakmp_sa->nat_traversal & NAT_T_DETECTED)
{ {
/* Duplicate nat_traversal status in new state */ /* Duplicate nat_traversal status in new state */
@@ -2066,7 +2056,6 @@ quick_outI1(int whack_sock
np = (st->nat_traversal & NAT_T_WITH_RFC_VALUES) ? np = (st->nat_traversal & NAT_T_WITH_RFC_VALUES) ?
ISAKMP_NEXT_NATOA_RFC : ISAKMP_NEXT_NATOA_DRAFTS; ISAKMP_NEXT_NATOA_RFC : ISAKMP_NEXT_NATOA_DRAFTS;
} }
#endif
/* set up reply */ /* set up reply */
init_pbs(&reply, reply_buffer, sizeof(reply_buffer), "reply packet"); init_pbs(&reply, reply_buffer, sizeof(reply_buffer), "reply packet");
@@ -2162,7 +2151,6 @@ quick_outI1(int whack_sock
} }
} }
#ifdef NAT_TRAVERSAL
/* Send NAT-OA if our address is NATed */ /* Send NAT-OA if our address is NATed */
if (send_natoa) if (send_natoa)
{ {
@@ -2172,7 +2160,6 @@ quick_outI1(int whack_sock
return STF_INTERNAL_ERROR; return STF_INTERNAL_ERROR;
} }
} }
#endif
/* finish computing HASH(1), inserting it in output */ /* finish computing HASH(1), inserting it in output */
(void) quick_mode_hash12(r_hashval, r_hash_start, rbody.cur (void) quick_mode_hash12(r_hashval, r_hash_start, rbody.cur
@@ -2341,7 +2328,6 @@ decode_peer_id(struct msg_digest *md, struct id *peer)
* Besides, there is no good reason for allowing these to be * Besides, there is no good reason for allowing these to be
* other than 0 in Phase 1. * other than 0 in Phase 1.
*/ */
#ifdef NAT_TRAVERSAL
if ((st->nat_traversal & NAT_T_WITH_PORT_FLOATING) if ((st->nat_traversal & NAT_T_WITH_PORT_FLOATING)
&& id->isaid_doi_specific_a == IPPROTO_UDP && id->isaid_doi_specific_a == IPPROTO_UDP
&& (id->isaid_doi_specific_b == 0 || id->isaid_doi_specific_b == NAT_T_IKE_FLOAT_PORT)) && (id->isaid_doi_specific_b == 0 || id->isaid_doi_specific_b == NAT_T_IKE_FLOAT_PORT))
@@ -2350,10 +2336,8 @@ decode_peer_id(struct msg_digest *md, struct id *peer)
"accepted with port_floating NAT-T", "accepted with port_floating NAT-T",
id->isaid_doi_specific_a, id->isaid_doi_specific_b); id->isaid_doi_specific_a, id->isaid_doi_specific_b);
} }
else else if (!(id->isaid_doi_specific_a == 0 && id->isaid_doi_specific_b == 0)
#endif && !(id->isaid_doi_specific_a == IPPROTO_UDP && id->isaid_doi_specific_b == IKE_UDP_PORT))
if (!(id->isaid_doi_specific_a == 0 && id->isaid_doi_specific_b == 0)
&& !(id->isaid_doi_specific_a == IPPROTO_UDP && id->isaid_doi_specific_b == IKE_UDP_PORT))
{ {
loglog(RC_LOG_SERIOUS, "protocol/port in Phase 1 ID Payload must be 0/0 or %d/%d" loglog(RC_LOG_SERIOUS, "protocol/port in Phase 1 ID Payload must be 0/0 or %d/%d"
" but are %d/%d" " but are %d/%d"
@@ -2527,14 +2511,8 @@ switch_connection(struct msg_digest *md, struct id *peer, bool initiator)
if (r->kind == CK_TEMPLATE) if (r->kind == CK_TEMPLATE)
{ {
/* instantiate it, filling in peer's ID */ /* instantiate it, filling in peer's ID */
r = rw_instantiate(r, &c->spd.that.host_addr, r = rw_instantiate(r, &c->spd.that.host_addr
#ifdef NAT_TRAVERSAL , c->spd.that.host_port, NULL, peer);
c->spd.that.host_port,
#endif
#ifdef VIRTUAL_IP
NULL,
#endif
peer);
} }
/* copy certificate request info */ /* copy certificate request info */
@@ -2984,13 +2962,11 @@ main_inI1_outR1(struct msg_digest *md)
RETURN_STF_FAILURE(preparse_isakmp_sa_body(&sa_pd->payload.sa RETURN_STF_FAILURE(preparse_isakmp_sa_body(&sa_pd->payload.sa
, &sa_pd->pbs, &ipsecdoisit, &proposal_pbs, &proposal)); , &sa_pd->pbs, &ipsecdoisit, &proposal_pbs, &proposal));
#ifdef NAT_TRAVERSAL
if (c == NULL && md->iface->ike_float) if (c == NULL && md->iface->ike_float)
{ {
c = find_host_connection(&md->iface->addr, NAT_T_IKE_FLOAT_PORT c = find_host_connection(&md->iface->addr, NAT_T_IKE_FLOAT_PORT
, &md->sender, md->sender_port, LEMPTY); , &md->sender, md->sender_port, LEMPTY);
} }
#endif
if (c == NULL) if (c == NULL)
{ {
@@ -3061,14 +3037,7 @@ main_inI1_outR1(struct msg_digest *md)
/* Create a temporary connection that is a copy of this one. /* Create a temporary connection that is a copy of this one.
* His ID isn't declared yet. * His ID isn't declared yet.
*/ */
c = rw_instantiate(c, &md->sender, c = rw_instantiate(c, &md->sender, md->sender_port, NULL, NULL);
#ifdef NAT_TRAVERSAL
md->sender_port,
#endif
#ifdef VIRTUAL_IP
NULL,
#endif
NULL);
} }
} }
@@ -3115,10 +3084,8 @@ main_inI1_outR1(struct msg_digest *md)
vids_to_send++; vids_to_send++;
/* always send DPD Vendor ID */ /* always send DPD Vendor ID */
vids_to_send++; vids_to_send++;
#ifdef NAT_TRAVERSAL
if (md->nat_traversal_vid && nat_traversal_enabled) if (md->nat_traversal_vid && nat_traversal_enabled)
vids_to_send++; vids_to_send++;
#endif
/* HDR out. /* HDR out.
* We can't leave this to comm_handle() because we must * We can't leave this to comm_handle() because we must
@@ -3189,11 +3156,6 @@ main_inI1_outR1(struct msg_digest *md)
} }
} }
#ifdef NAT_TRAVERSAL
DBG(DBG_CONTROLMORE,
DBG_log("sender checking NAT-t: %d and %d"
, nat_traversal_enabled, md->nat_traversal_vid)
)
if (md->nat_traversal_vid && nat_traversal_enabled) if (md->nat_traversal_vid && nat_traversal_enabled)
{ {
/* reply if NAT-Traversal draft is supported */ /* reply if NAT-Traversal draft is supported */
@@ -3206,7 +3168,6 @@ main_inI1_outR1(struct msg_digest *md)
return STF_INTERNAL_ERROR; return STF_INTERNAL_ERROR;
} }
} }
#endif
close_message(&md->rbody); close_message(&md->rbody);
@@ -3252,11 +3213,6 @@ main_inR1_outI2(struct msg_digest *md)
, &proposal_pbs, &proposal, NULL, st)); , &proposal_pbs, &proposal, NULL, st));
} }
#ifdef NAT_TRAVERSAL
DBG(DBG_CONTROLMORE,
DBG_log("sender checking NAT-t: %d and %d"
, nat_traversal_enabled, md->nat_traversal_vid)
)
if (nat_traversal_enabled && md->nat_traversal_vid) if (nat_traversal_enabled && md->nat_traversal_vid)
{ {
st->nat_traversal = nat_traversal_vid_to_method(md->nat_traversal_vid); st->nat_traversal = nat_traversal_vid_to_method(md->nat_traversal_vid);
@@ -3268,7 +3224,6 @@ main_inR1_outI2(struct msg_digest *md)
np = (st->nat_traversal & NAT_T_WITH_RFC_VALUES) ? np = (st->nat_traversal & NAT_T_WITH_RFC_VALUES) ?
ISAKMP_NEXT_NATD_RFC : ISAKMP_NEXT_NATD_DRAFTS; ISAKMP_NEXT_NATD_RFC : ISAKMP_NEXT_NATD_DRAFTS;
} }
#endif
/**************** build output packet HDR;KE;Ni ****************/ /**************** build output packet HDR;KE;Ni ****************/
@@ -3306,13 +3261,11 @@ main_inR1_outI2(struct msg_digest *md)
return STF_INTERNAL_ERROR; return STF_INTERNAL_ERROR;
#endif #endif
#ifdef NAT_TRAVERSAL
if (st->nat_traversal & NAT_T_WITH_NATD) if (st->nat_traversal & NAT_T_WITH_NATD)
{ {
if (!nat_traversal_add_natd(ISAKMP_NEXT_NONE, &md->rbody, md)) if (!nat_traversal_add_natd(ISAKMP_NEXT_NONE, &md->rbody, md))
return STF_INTERNAL_ERROR; return STF_INTERNAL_ERROR;
} }
#endif
/* finish message */ /* finish message */
close_message(&md->rbody); close_message(&md->rbody);
@@ -3353,11 +3306,6 @@ main_inI2_outR2(struct msg_digest *md)
/* Ni in */ /* Ni in */
RETURN_STF_FAILURE(accept_nonce(md, &st->st_ni, "Ni")); RETURN_STF_FAILURE(accept_nonce(md, &st->st_ni, "Ni"));
#ifdef NAT_TRAVERSAL
DBG(DBG_CONTROLMORE,
DBG_log("inI2: checking NAT-t: %d and %d"
, nat_traversal_enabled, st->nat_traversal)
)
if (st->nat_traversal & NAT_T_WITH_NATD) if (st->nat_traversal & NAT_T_WITH_NATD)
{ {
nat_traversal_natd_lookup(md); nat_traversal_natd_lookup(md);
@@ -3373,7 +3321,6 @@ main_inI2_outR2(struct msg_digest *md)
{ {
nat_traversal_new_ka_event(); nat_traversal_new_ka_event();
} }
#endif
/* decode certificate requests */ /* decode certificate requests */
st->st_connection->got_certrequest = FALSE; st->st_connection->got_certrequest = FALSE;
@@ -3450,13 +3397,11 @@ main_inI2_outR2(struct msg_digest *md)
} }
} }
#ifdef NAT_TRAVERSAL
if (st->nat_traversal & NAT_T_WITH_NATD) if (st->nat_traversal & NAT_T_WITH_NATD)
{ {
if (!nat_traversal_add_natd(ISAKMP_NEXT_NONE, &md->rbody, md)) if (!nat_traversal_add_natd(ISAKMP_NEXT_NONE, &md->rbody, md))
return STF_INTERNAL_ERROR; return STF_INTERNAL_ERROR;
} }
#endif
/* finish message */ /* finish message */
close_message(&md->rbody); close_message(&md->rbody);
@@ -3529,17 +3474,18 @@ main_inR2_outI3(struct msg_digest *md)
if (!generate_skeyids_iv(st)) if (!generate_skeyids_iv(st))
return STF_FAIL + AUTHENTICATION_FAILED; return STF_FAIL + AUTHENTICATION_FAILED;
#ifdef NAT_TRAVERSAL if (st->nat_traversal & NAT_T_WITH_NATD)
if (st->nat_traversal & NAT_T_WITH_NATD) { {
nat_traversal_natd_lookup(md); nat_traversal_natd_lookup(md);
} }
if (st->nat_traversal) { if (st->nat_traversal)
{
nat_traversal_show_result(st->nat_traversal, md->sender_port); nat_traversal_show_result(st->nat_traversal, md->sender_port);
} }
if (st->nat_traversal & NAT_T_WITH_KA) { if (st->nat_traversal & NAT_T_WITH_KA)
{
nat_traversal_new_ka_event(); nat_traversal_new_ka_event();
} }
#endif
/*************** build output packet HDR*;IDii;HASH/SIG_I ***************/ /*************** build output packet HDR*;IDii;HASH/SIG_I ***************/
/* ??? NOTE: this is almost the same as main_inI3_outR3's code */ /* ??? NOTE: this is almost the same as main_inI3_outR3's code */
@@ -4772,14 +4718,8 @@ quick_inI1_outR1_tail(struct verify_oppo_bundle *b
/* Plain Road Warrior: /* Plain Road Warrior:
* instantiate, carrying over authenticated peer ID * instantiate, carrying over authenticated peer ID
*/ */
p = rw_instantiate(p, &c->spd.that.host_addr, p = rw_instantiate(p, &c->spd.that.host_addr, md->sender_port
#ifdef NAT_TRAVERSAL , his_net, &c->spd.that.id);
md->sender_port,
#endif
#ifdef VIRTUAL_IP
his_net,
#endif
&c->spd.that.id);
} }
} }
#ifdef DEBUG #ifdef DEBUG
@@ -4802,8 +4742,6 @@ quick_inI1_outR1_tail(struct verify_oppo_bundle *b
p->spd.that.client = *his_net; p->spd.that.client = *his_net;
p->spd.that.has_client_wildcard = FALSE; p->spd.that.has_client_wildcard = FALSE;
} }
#ifdef VIRTUAL_IP
else if (is_virtual_connection(c)) else if (is_virtual_connection(c))
{ {
c->spd.that.client = *his_net; c->spd.that.client = *his_net;
@@ -4811,7 +4749,6 @@ quick_inI1_outR1_tail(struct verify_oppo_bundle *b
if (subnetishost(his_net) && addrinsubnet(&c->spd.that.host_addr, his_net)) if (subnetishost(his_net) && addrinsubnet(&c->spd.that.host_addr, his_net))
c->spd.that.has_client = FALSE; c->spd.that.has_client = FALSE;
} }
#endif
/* fill in the client's true port */ /* fill in the client's true port */
if (p->spd.that.has_port_wildcard) if (p->spd.that.has_port_wildcard)
@@ -4870,7 +4807,6 @@ quick_inI1_outR1_tail(struct verify_oppo_bundle *b
st->st_policy = (p1st->st_policy & POLICY_ISAKMP_MASK) st->st_policy = (p1st->st_policy & POLICY_ISAKMP_MASK)
| (c->policy & ~POLICY_ISAKMP_MASK); | (c->policy & ~POLICY_ISAKMP_MASK);
#ifdef NAT_TRAVERSAL
if (p1st->nat_traversal & NAT_T_DETECTED) if (p1st->nat_traversal & NAT_T_DETECTED)
{ {
st->nat_traversal = p1st->nat_traversal; st->nat_traversal = p1st->nat_traversal;
@@ -4880,12 +4816,11 @@ quick_inI1_outR1_tail(struct verify_oppo_bundle *b
{ {
st->nat_traversal = 0; st->nat_traversal = 0;
} }
if ((st->nat_traversal & NAT_T_DETECTED) && if ((st->nat_traversal & NAT_T_DETECTED)
(st->nat_traversal & NAT_T_WITH_NATOA)) && (st->nat_traversal & NAT_T_WITH_NATOA))
{ {
nat_traversal_natoa_lookup(md); nat_traversal_natoa_lookup(md);
} }
#endif
/* Start the output packet. /* Start the output packet.
* *
@@ -4973,7 +4908,6 @@ quick_inI1_outR1_tail(struct verify_oppo_bundle *b
p->isaiid_np = ISAKMP_NEXT_NONE; p->isaiid_np = ISAKMP_NEXT_NONE;
} }
#ifdef NAT_TRAVERSAL
if ((st->nat_traversal & NAT_T_WITH_NATOA) if ((st->nat_traversal & NAT_T_WITH_NATOA)
&& (st->nat_traversal & LELEM(NAT_TRAVERSAL_NAT_BHND_ME)) && (st->nat_traversal & LELEM(NAT_TRAVERSAL_NAT_BHND_ME))
&& (st->st_esp.attrs.encapsulation == ENCAPSULATION_MODE_TRANSPORT)) && (st->st_esp.attrs.encapsulation == ENCAPSULATION_MODE_TRANSPORT))
@@ -4992,7 +4926,6 @@ quick_inI1_outR1_tail(struct verify_oppo_bundle *b
addrtosubnet(&c->spd.that.host_addr, &c->spd.that.client); addrtosubnet(&c->spd.that.host_addr, &c->spd.that.client);
c->spd.that.has_client = FALSE; c->spd.that.has_client = FALSE;
} }
#endif
/* Compute reply HASH(2) and insert in output */ /* Compute reply HASH(2) and insert in output */
(void)quick_mode_hash12(r_hashval, r_hash_start, md->rbody.cur (void)quick_mode_hash12(r_hashval, r_hash_start, md->rbody.cur
@@ -5132,13 +5065,11 @@ quick_inR1_outI2(struct msg_digest *md)
} }
} }
#ifdef NAT_TRAVERSAL
if ((st->nat_traversal & NAT_T_DETECTED) if ((st->nat_traversal & NAT_T_DETECTED)
&& (st->nat_traversal & NAT_T_WITH_NATOA)) && (st->nat_traversal & NAT_T_WITH_NATOA))
{ {
nat_traversal_natoa_lookup(md); nat_traversal_natoa_lookup(md);
} }
#endif
/* ??? We used to copy the accepted proposal into the state, but it was /* ??? We used to copy the accepted proposal into the state, but it was
* never used. From sa_pd->pbs.start, length pbs_room(&sa_pd->pbs). * never used. From sa_pd->pbs.start, length pbs_room(&sa_pd->pbs).
src/pluto/kernel.c
+66 -70
View File
@@ -58,12 +58,7 @@
#include "server.h" #include "server.h"
#include "whack.h" /* for RC_LOG_SERIOUS */ #include "whack.h" /* for RC_LOG_SERIOUS */
#include "keys.h" #include "keys.h"
#ifdef NAT_TRAVERSAL
#include "packet.h" /* for pb_stream in nat_traversal.h */
#include "nat_traversal.h" #include "nat_traversal.h"
#endif
#include "alg_info.h" #include "alg_info.h"
#include "kernel_alg.h" #include "kernel_alg.h"
@@ -686,9 +681,7 @@ could_route(struct connection *c)
/* if routing would affect IKE messages, reject */ /* if routing would affect IKE messages, reject */
if (!no_klips if (!no_klips
#ifdef NAT_TRAVERSAL
&& c->spd.this.host_port != NAT_T_IKE_FLOAT_PORT && c->spd.this.host_port != NAT_T_IKE_FLOAT_PORT
#endif
&& c->spd.this.host_port != IKE_UDP_PORT && c->spd.this.host_port != IKE_UDP_PORT
&& addrinsubnet(&c->spd.that.host_addr, &c->spd.that.client)) && addrinsubnet(&c->spd.that.host_addr, &c->spd.that.client))
{ {
@@ -1860,19 +1853,19 @@ setup_half_ipsec_sa(struct state *st, bool inbound)
SADB_EALG_3DES_CBC, SADB_AALG_SHA1_HMAC }, SADB_EALG_3DES_CBC, SADB_AALG_SHA1_HMAC },
}; };
#ifdef NAT_TRAVERSAL
u_int8_t natt_type = 0; u_int8_t natt_type = 0;
u_int16_t natt_sport = 0, natt_dport = 0; u_int16_t natt_sport = 0;
u_int16_t natt_dport = 0;
ip_address natt_oa; ip_address natt_oa;
if (st->nat_traversal & NAT_T_DETECTED) { if (st->nat_traversal & NAT_T_DETECTED)
{
natt_type = (st->nat_traversal & NAT_T_WITH_PORT_FLOATING) ? natt_type = (st->nat_traversal & NAT_T_WITH_PORT_FLOATING) ?
ESPINUDP_WITH_NON_ESP : ESPINUDP_WITH_NON_IKE; ESPINUDP_WITH_NON_ESP : ESPINUDP_WITH_NON_IKE;
natt_sport = inbound? c->spd.that.host_port : c->spd.this.host_port; natt_sport = inbound? c->spd.that.host_port : c->spd.this.host_port;
natt_dport = inbound? c->spd.this.host_port : c->spd.that.host_port; natt_dport = inbound? c->spd.this.host_port : c->spd.that.host_port;
natt_oa = st->nat_oa; natt_oa = st->nat_oa;
} }
#endif
for (ei = esp_info; ; ei++) for (ei = esp_info; ; ei++)
{ {
@@ -1903,34 +1896,38 @@ setup_half_ipsec_sa(struct state *st, bool inbound)
} }
key_len = st->st_esp.attrs.key_len/8; key_len = st->st_esp.attrs.key_len/8;
if (key_len) { if (key_len)
/* XXX: must change to check valid _range_ key_len */ {
if (key_len > ei->enckeylen) { /* XXX: must change to check valid _range_ key_len */
loglog(RC_LOG_SERIOUS, "ESP transform %s passed key_len=%d > %d", if (key_len > ei->enckeylen)
enum_name(&esp_transformid_names, st->st_esp.attrs.transid), {
(int)key_len, (int)ei->enckeylen); loglog(RC_LOG_SERIOUS, "ESP transform %s passed key_len=%d > %d",
goto fail; enum_name(&esp_transformid_names, st->st_esp.attrs.transid),
} (int)key_len, (int)ei->enckeylen);
} else { goto fail;
key_len = ei->enckeylen; }
}
else
{
key_len = ei->enckeylen;
} }
/* Grrrrr.... f*cking 7 bits jurassic algos */ /* Grrrrr.... f*cking 7 bits jurassic algos */
/* 168 bits in kernel, need 192 bits for keymat_len */ /* 168 bits in kernel, need 192 bits for keymat_len */
if (ei->transid == ESP_3DES && key_len == 21) if (ei->transid == ESP_3DES && key_len == 21)
key_len = 24; key_len = 24;
/* 56 bits in kernel, need 64 bits for keymat_len */ /* 56 bits in kernel, need 64 bits for keymat_len */
if (ei->transid == ESP_DES && key_len == 7) if (ei->transid == ESP_DES && key_len == 7)
key_len = 8; key_len = 8;
/* divide up keying material */ /* divide up keying material */
/* passert(st->st_esp.keymat_len == ei->enckeylen + ei->authkeylen); */ /* passert(st->st_esp.keymat_len == ei->enckeylen + ei->authkeylen); */
DBG(DBG_KLIPS|DBG_CONTROL|DBG_PARSING, DBG(DBG_KLIPS|DBG_CONTROL|DBG_PARSING,
if(st->st_esp.keymat_len != key_len + ei->authkeylen) if(st->st_esp.keymat_len != key_len + ei->authkeylen)
DBG_log("keymat_len=%d key_len=%d authkeylen=%d", DBG_log("keymat_len=%d key_len=%d authkeylen=%d",
st->st_esp.keymat_len, (int)key_len, (int)ei->authkeylen); st->st_esp.keymat_len, (int)key_len, (int)ei->authkeylen);
); )
passert(st->st_esp.keymat_len == key_len + ei->authkeylen); passert(st->st_esp.keymat_len == key_len + ei->authkeylen);
set_text_said(text_said, &dst.addr, esp_spi, SA_ESP); set_text_said(text_said, &dst.addr, esp_spi, SA_ESP);
@@ -1952,13 +1949,11 @@ setup_half_ipsec_sa(struct state *st, bool inbound)
said_next->enckey = esp_dst_keymat; said_next->enckey = esp_dst_keymat;
said_next->encapsulation = encapsulation; said_next->encapsulation = encapsulation;
said_next->reqid = c->spd.reqid + 1; said_next->reqid = c->spd.reqid + 1;
#ifdef NAT_TRAVERSAL
said_next->natt_sport = natt_sport; said_next->natt_sport = natt_sport;
said_next->natt_dport = natt_dport; said_next->natt_dport = natt_dport;
said_next->transid = st->st_esp.attrs.transid; said_next->transid = st->st_esp.attrs.transid;
said_next->natt_type = natt_type; said_next->natt_type = natt_type;
said_next->natt_oa = &natt_oa; said_next->natt_oa = &natt_oa;
#endif
said_next->text_said = text_said; said_next->text_said = text_said;
if (!kernel_ops->add_sa(said_next, replace)) if (!kernel_ops->add_sa(said_next, replace))
@@ -2826,68 +2821,69 @@ delete_ipsec_sa(struct state *st USED_BY_KLIPS, bool inbound_only USED_BY_KLIPS)
DBG(DBG_CONTROL, DBG_log("if I knew how, I'd eroute() and teardown_ipsec_sa()")); DBG(DBG_CONTROL, DBG_log("if I knew how, I'd eroute() and teardown_ipsec_sa()"));
#endif /* !KLIPS */ #endif /* !KLIPS */
} }
#ifdef NAT_TRAVERSAL
#ifdef KLIPS #ifdef KLIPS
static bool update_nat_t_ipsec_esp_sa (struct state *st, bool inbound) static bool update_nat_t_ipsec_esp_sa (struct state *st, bool inbound)
{ {
struct connection *c = st->st_connection; struct connection *c = st->st_connection;
char text_said[SATOT_BUF]; char text_said[SATOT_BUF];
struct kernel_sa sa; struct kernel_sa sa;
ip_address ip_address
src = inbound? c->spd.that.host_addr : c->spd.this.host_addr, src = inbound? c->spd.that.host_addr : c->spd.this.host_addr,
dst = inbound? c->spd.this.host_addr : c->spd.that.host_addr; dst = inbound? c->spd.this.host_addr : c->spd.that.host_addr;
ipsec_spi_t esp_spi = inbound? st->st_esp.our_spi : st->st_esp.attrs.spi;
ipsec_spi_t esp_spi = inbound? st->st_esp.our_spi : st->st_esp.attrs.spi; u_int16_t
natt_sport = inbound? c->spd.that.host_port : c->spd.this.host_port,
natt_dport = inbound? c->spd.this.host_port : c->spd.that.host_port;
u_int16_t set_text_said(text_said, &dst, esp_spi, SA_ESP);
natt_sport = inbound? c->spd.that.host_port : c->spd.this.host_port,
natt_dport = inbound? c->spd.this.host_port : c->spd.that.host_port;
set_text_said(text_said, &dst, esp_spi, SA_ESP); memset(&sa, 0, sizeof(sa));
sa.spi = esp_spi;
memset(&sa, 0, sizeof(sa)); sa.src = &src;
sa.spi = esp_spi; sa.dst = &dst;
sa.src = &src; sa.text_said = text_said;
sa.dst = &dst; sa.authalg = alg_info_esp_aa2sadb(st->st_esp.attrs.auth);
sa.text_said = text_said; sa.natt_sport = natt_sport;
sa.authalg = alg_info_esp_aa2sadb(st->st_esp.attrs.auth); sa.natt_dport = natt_dport;
sa.natt_sport = natt_sport; sa.transid = st->st_esp.attrs.transid;
sa.natt_dport = natt_dport;
sa.transid = st->st_esp.attrs.transid;
return kernel_ops->add_sa(&sa, TRUE);
return kernel_ops->add_sa(&sa, TRUE);
} }
#endif #endif
bool update_ipsec_sa (struct state *st USED_BY_KLIPS) bool update_ipsec_sa (struct state *st USED_BY_KLIPS)
{ {
#ifdef KLIPS #ifdef KLIPS
if (IS_IPSEC_SA_ESTABLISHED(st->st_state)) { if (IS_IPSEC_SA_ESTABLISHED(st->st_state))
if ((st->st_esp.present) && ( {
(!update_nat_t_ipsec_esp_sa (st, TRUE)) || if (st->st_esp.present && (
(!update_nat_t_ipsec_esp_sa (st, FALSE)))) { (!update_nat_t_ipsec_esp_sa (st, TRUE)) ||
return FALSE; (!update_nat_t_ipsec_esp_sa (st, FALSE))))
} {
return FALSE;
} }
else if (IS_ONLY_INBOUND_IPSEC_SA_ESTABLISHED(st->st_state)) { }
if ((st->st_esp.present) && (!update_nat_t_ipsec_esp_sa (st, FALSE))) { else if (IS_ONLY_INBOUND_IPSEC_SA_ESTABLISHED(st->st_state))
return FALSE; {
} if (st->st_esp.present && !update_nat_t_ipsec_esp_sa (st, FALSE))
{
return FALSE;
} }
else { }
DBG_log("assert failed at %s:%d st_state=%d", __FILE__, __LINE__, else
st->st_state); {
return FALSE; DBG_log("assert failed at %s:%d st_state=%d", __FILE__, __LINE__, st->st_state);
} return FALSE;
return TRUE; }
return TRUE;
#else /* !KLIPS */ #else /* !KLIPS */
DBG(DBG_CONTROL, DBG_log("if I knew how, I'd update_ipsec_sa()")); DBG(DBG_CONTROL, DBG_log("if I knew how, I'd update_ipsec_sa()"));
return TRUE; return TRUE;
#endif /* !KLIPS */ #endif /* !KLIPS */
} }
#endif
/* Check if there was traffic on given SA during the last idle_max /* Check if there was traffic on given SA during the last idle_max
* seconds. If TRUE, the SA was idle and DPD exchange should be performed. * seconds. If TRUE, the SA was idle and DPD exchange should be performed.
src/pluto/kernel.h
+2 -4
View File
@@ -69,11 +69,11 @@ struct kernel_sa {
unsigned compalg; unsigned compalg;
int encapsulation; int encapsulation;
#ifdef NAT_TRAVERSAL
u_int16_t natt_sport, natt_dport; u_int16_t natt_sport, natt_dport;
u_int8_t transid, natt_type; u_int8_t transid, natt_type;
ip_address *natt_oa; ip_address *natt_oa;
#endif
const char *text_said; const char *text_said;
}; };
@@ -195,6 +195,4 @@ extern bool was_eroute_idle(struct state *st, time_t idle_max
extern bool get_sa_info(struct state *st, bool inbound, u_int *bytes extern bool get_sa_info(struct state *st, bool inbound, u_int *bytes
, time_t *use_time); , time_t *use_time);
#ifdef NAT_TRAVERSAL
extern bool update_ipsec_sa(struct state *st); extern bool update_ipsec_sa(struct state *st);
#endif
src/pluto/kernel_netlink.c
-2
View File
@@ -677,7 +677,6 @@ netlink_add_sa(const struct kernel_sa *sa, bool replace)
attr = (struct rtattr *)((char *)attr + attr->rta_len); attr = (struct rtattr *)((char *)attr + attr->rta_len);
} }
#ifdef NAT_TRAVERSAL
if (sa->natt_type) if (sa->natt_type)
{ {
struct xfrm_encap_tmpl natt; struct xfrm_encap_tmpl natt;
@@ -695,7 +694,6 @@ netlink_add_sa(const struct kernel_sa *sa, bool replace)
req.n.nlmsg_len += attr->rta_len; req.n.nlmsg_len += attr->rta_len;
attr = (struct rtattr *)((char *)attr + attr->rta_len); attr = (struct rtattr *)((char *)attr + attr->rta_len);
} }
#endif
return send_netlink_msg(&req.n, NULL, 0, "Add SA", sa->text_said); return send_netlink_msg(&req.n, NULL, 0, "Add SA", sa->text_said);
} }
src/pluto/kernel_pfkey.c
+1 -13
View File
@@ -41,11 +41,8 @@
#include "kernel_pfkey.h" #include "kernel_pfkey.h"
#include "log.h" #include "log.h"
#include "whack.h" /* for RC_LOG_SERIOUS */ #include "whack.h" /* for RC_LOG_SERIOUS */
#ifdef NAT_TRAVERSAL
#include "demux.h" #include "demux.h"
#include "nat_traversal.h" #include "nat_traversal.h"
#endif
#include "alg_info.h" #include "alg_info.h"
#include "kernel_alg.h" #include "kernel_alg.h"
@@ -77,9 +74,7 @@ static sparse_names pfkey_type_names = {
NE(SADB_X_ADDFLOW), NE(SADB_X_ADDFLOW),
NE(SADB_X_DELFLOW), NE(SADB_X_DELFLOW),
NE(SADB_X_DEBUG), NE(SADB_X_DEBUG),
#ifdef NAT_TRAVERSAL
NE(SADB_X_NAT_T_NEW_MAPPING), NE(SADB_X_NAT_T_NEW_MAPPING),
#endif
NE(SADB_MAX), NE(SADB_MAX),
{ 0, sparse_end } { 0, sparse_end }
}; };
@@ -250,10 +245,7 @@ pfkey_get(pfkey_buf *buf)
else if (!(buf->msg.sadb_msg_pid == (unsigned)pid else if (!(buf->msg.sadb_msg_pid == (unsigned)pid
|| (buf->msg.sadb_msg_pid == 0 && buf->msg.sadb_msg_type == SADB_ACQUIRE) || (buf->msg.sadb_msg_pid == 0 && buf->msg.sadb_msg_type == SADB_ACQUIRE)
|| (buf->msg.sadb_msg_type == SADB_REGISTER) || (buf->msg.sadb_msg_type == SADB_REGISTER)
#ifdef NAT_TRAVERSAL || (buf->msg.sadb_msg_pid == 0 && buf->msg.sadb_msg_type == SADB_X_NAT_T_NEW_MAPPING)))
|| (buf->msg.sadb_msg_pid == 0 && buf->msg.sadb_msg_type == SADB_X_NAT_T_NEW_MAPPING)
#endif
))
{ {
/* not for us: ignore */ /* not for us: ignore */
DBG(DBG_KLIPS, DBG(DBG_KLIPS,
@@ -435,11 +427,9 @@ pfkey_async(pfkey_buf *buf)
/* to simulate loss of ACQUIRE, delete this call */ /* to simulate loss of ACQUIRE, delete this call */
process_pfkey_acquire(buf, extensions); process_pfkey_acquire(buf, extensions);
break; break;
#ifdef NAT_TRAVERSAL
case SADB_X_NAT_T_NEW_MAPPING: case SADB_X_NAT_T_NEW_MAPPING:
process_pfkey_nat_t_new_mapping(&(buf->msg), extensions); process_pfkey_nat_t_new_mapping(&(buf->msg), extensions);
break; break;
#endif
default: default:
/* ignored */ /* ignored */
break; break;
@@ -822,7 +812,6 @@ pfkey_add_sa(const struct kernel_sa *sa, bool replace)
, sa->enckey) , sa->enckey)
, "pfkey_key_e Add SA", sa->text_said, extensions)) , "pfkey_key_e Add SA", sa->text_said, extensions))
#ifdef NAT_TRAVERSAL
&& (sa->natt_type == 0 && (sa->natt_type == 0
|| pfkey_build(pfkey_x_nat_t_type_build( || pfkey_build(pfkey_x_nat_t_type_build(
&extensions[SADB_X_EXT_NAT_T_TYPE], sa->natt_type), &extensions[SADB_X_EXT_NAT_T_TYPE], sa->natt_type),
@@ -840,7 +829,6 @@ pfkey_add_sa(const struct kernel_sa *sa, bool replace)
&& (sa->natt_type == 0 || isanyaddr(sa->natt_oa) && (sa->natt_type == 0 || isanyaddr(sa->natt_oa)
|| pfkeyext_address(SADB_X_EXT_NAT_T_OA, sa->natt_oa || pfkeyext_address(SADB_X_EXT_NAT_T_OA, sa->natt_oa
, "pfkey_nat_t_oa Add ESP SA", sa->text_said, extensions)) , "pfkey_nat_t_oa Add ESP SA", sa->text_said, extensions))
#endif
&& finish_pfkey_msg(extensions, "Add SA", sa->text_said, NULL); && finish_pfkey_msg(extensions, "Add SA", sa->text_said, NULL);
src/pluto/keys.c
+5 -13
View File
@@ -55,11 +55,6 @@
#include "timer.h" #include "timer.h"
#include "fetch.h" #include "fetch.h"
#ifdef NAT_TRAVERSAL
#define PB_STREAM_UNDEFINED
#include "nat_traversal.h"
#endif
const char *shared_secrets_file = SHARED_SECRETS_FILE; const char *shared_secrets_file = SHARED_SECRETS_FILE;
typedef struct id_list id_list_t; typedef struct id_list id_list_t;
@@ -185,19 +180,16 @@ get_secret(const struct connection *c, enum PrivateKeyKind kind, bool asym)
happy(anyaddr(addrtypeof(&c->spd.that.host_addr), &rw_id.ip_addr)); happy(anyaddr(addrtypeof(&c->spd.that.host_addr), &rw_id.ip_addr));
his_id = &rw_id; his_id = &rw_id;
} }
#ifdef NAT_TRAVERSAL else if (kind == PPK_PSK
else if (nat_traversal_enabled
&& (c->policy & POLICY_PSK) && (c->policy & POLICY_PSK)
&& kind == PPK_PSK
&& ((c->kind == CK_TEMPLATE && c->spd.that.id.kind == ID_NONE) || && ((c->kind == CK_TEMPLATE && c->spd.that.id.kind == ID_NONE) ||
(c->kind == CK_INSTANCE && id_is_ipaddr(&c->spd.that.id)))) (c->kind == CK_INSTANCE && id_is_ipaddr(&c->spd.that.id))))
{ {
/* roadwarrior: replace him with 0.0.0.0 */ /* roadwarrior: replace him with 0.0.0.0 */
rw_id.kind = ID_IPV4_ADDR; rw_id.kind = ID_IPV4_ADDR;
happy(anyaddr(addrtypeof(&c->spd.that.host_addr), &rw_id.ip_addr)); happy(anyaddr(addrtypeof(&c->spd.that.host_addr), &rw_id.ip_addr));
his_id = &rw_id; his_id = &rw_id;
} }
#endif
for (s = secrets; s != NULL; s = s->next) for (s = secrets; s != NULL; s = s->next)
{ {
src/pluto/nat_traversal.c
+2 -7
View File
@@ -14,8 +14,6 @@
* RCSID $Id: nat_traversal.c,v 1.8 2005/01/06 22:36:58 as Exp $ * RCSID $Id: nat_traversal.c,v 1.8 2005/01/06 22:36:58 as Exp $
*/ */
#ifdef NAT_TRAVERSAL
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
#include <ctype.h> #include <ctype.h>
@@ -31,6 +29,7 @@
#include <ipsec_policy.h> #include <ipsec_policy.h>
#include <pfkeyv2.h> #include <pfkeyv2.h>
#include <pfkey.h> #include <pfkey.h>
#include "constants.h" #include "constants.h"
#include "defs.h" #include "defs.h"
#include "log.h" #include "log.h"
@@ -42,8 +41,6 @@
#include "kernel.h" #include "kernel.h"
#include "whack.h" #include "whack.h"
#include "timer.h" #include "timer.h"
#include "cookie.h" #include "cookie.h"
#include "sha1.h" #include "sha1.h"
#include "md5.h" #include "md5.h"
@@ -580,7 +577,7 @@ static void nat_traversal_send_ka (struct state *st)
/* send keep alive */ /* send keep alive */
setchunk(st->st_tpacket, &ka_payload, 1); setchunk(st->st_tpacket, &ka_payload, 1);
_send_packet(st, "NAT-T Keep Alive", FALSE); send_packet(st, "NAT-T Keep Alive");
/* restore state chunk */ /* restore state chunk */
setchunk(st->st_tpacket, sav.ptr, sav.len); setchunk(st->st_tpacket, sav.ptr, sav.len);
@@ -865,5 +862,3 @@ void process_pfkey_nat_t_new_mapping(
plog("SADB_X_NAT_T_NEW_MAPPING message from KLIPS malformed: %s", ugh); plog("SADB_X_NAT_T_NEW_MAPPING message from KLIPS malformed: %s", ugh);
} }
#endif
src/pluto/plutomain.c
+1 -30
View File
@@ -57,18 +57,11 @@
#include "ocsp.h" #include "ocsp.h"
#include "crl.h" #include "crl.h"
#include "fetch.h" #include "fetch.h"
#include "sha1.h" #include "sha1.h"
#include "md5.h" #include "md5.h"
#include "crypto.h" /* requires sha1.h and md5.h */ #include "crypto.h" /* requires sha1.h and md5.h */
#ifdef VIRTUAL_IP
#include "virtual.h"
#endif
#ifdef NAT_TRAVERSAL
#include "nat_traversal.h" #include "nat_traversal.h"
#endif #include "virtual.h"
static void static void
usage(const char *mess) usage(const char *mess)
@@ -123,17 +116,13 @@ usage(const char *mess)
" [--debug-controlmore]" " [--debug-controlmore]"
" [--debug-private]" " [--debug-private]"
#endif #endif
#ifdef NAT_TRAVERSAL
" [ --debug-natt]" " [ --debug-natt]"
" \\\n\t" " \\\n\t"
"[--nat_traversal] [--keep_alive <delay_sec>]" "[--nat_traversal] [--keep_alive <delay_sec>]"
" \\\n\t" " \\\n\t"
"[--force_keepalive] [--disable_port_floating]" "[--force_keepalive] [--disable_port_floating]"
#endif
#ifdef VIRTUAL_IP
" \\\n\t" " \\\n\t"
"[--virtual_private <network_list>]" "[--virtual_private <network_list>]"
#endif
"\n" "\n"
"strongSwan %s\n" "strongSwan %s\n"
, ipsec_version_code()); , ipsec_version_code());
@@ -225,15 +214,11 @@ main(int argc, char **argv)
{ {
bool fork_desired = TRUE; bool fork_desired = TRUE;
bool log_to_stderr_desired = FALSE; bool log_to_stderr_desired = FALSE;
#ifdef NAT_TRAVERSAL
bool nat_traversal = FALSE; bool nat_traversal = FALSE;
bool nat_t_spf = TRUE; /* support port floating */ bool nat_t_spf = TRUE; /* support port floating */
unsigned int keep_alive = 0; unsigned int keep_alive = 0;
bool force_keepalive = FALSE; bool force_keepalive = FALSE;
#endif
#ifdef VIRTUAL_IP
char *virtual_private = NULL; char *virtual_private = NULL;
#endif
int lockfd; int lockfd;
/* handle arguments */ /* handle arguments */
@@ -269,20 +254,15 @@ main(int argc, char **argv)
{ "pkcs11module", required_argument, NULL, 'm' }, { "pkcs11module", required_argument, NULL, 'm' },
{ "pkcs11keepstate", no_argument, NULL, 'k' }, { "pkcs11keepstate", no_argument, NULL, 'k' },
{ "pkcs11proxy", no_argument, NULL, 'y' }, { "pkcs11proxy", no_argument, NULL, 'y' },
#ifdef NAT_TRAVERSAL
{ "nat_traversal", no_argument, NULL, '1' }, { "nat_traversal", no_argument, NULL, '1' },
{ "keep_alive", required_argument, NULL, '2' }, { "keep_alive", required_argument, NULL, '2' },
{ "force_keepalive", no_argument, NULL, '3' }, { "force_keepalive", no_argument, NULL, '3' },
{ "disable_port_floating", no_argument, NULL, '4' }, { "disable_port_floating", no_argument, NULL, '4' },
{ "debug-natt", no_argument, NULL, '5' }, { "debug-natt", no_argument, NULL, '5' },
#endif
#ifdef VIRTUAL_IP
{ "virtual_private", required_argument, NULL, '6' }, { "virtual_private", required_argument, NULL, '6' },
#endif
#ifdef DEBUG #ifdef DEBUG
{ "debug-none", no_argument, NULL, 'N' }, { "debug-none", no_argument, NULL, 'N' },
{ "debug-all", no_argument, NULL, 'A' }, { "debug-all", no_argument, NULL, 'A' },
{ "debug-raw", no_argument, NULL, DBG_RAW + DBG_OFFSET }, { "debug-raw", no_argument, NULL, DBG_RAW + DBG_OFFSET },
{ "debug-crypt", no_argument, NULL, DBG_CRYPT + DBG_OFFSET }, { "debug-crypt", no_argument, NULL, DBG_CRYPT + DBG_OFFSET },
{ "debug-parsing", no_argument, NULL, DBG_PARSING + DBG_OFFSET }, { "debug-parsing", no_argument, NULL, DBG_PARSING + DBG_OFFSET },
@@ -460,7 +440,6 @@ main(int argc, char **argv)
log_to_perpeer = TRUE; log_to_perpeer = TRUE;
continue; continue;
#ifdef NAT_TRAVERSAL
case '1': /* --nat_traversal */ case '1': /* --nat_traversal */
nat_traversal = TRUE; nat_traversal = TRUE;
continue; continue;
@@ -476,12 +455,9 @@ main(int argc, char **argv)
case '5': /* --debug-nat_t */ case '5': /* --debug-nat_t */
base_debugging |= DBG_NATT; base_debugging |= DBG_NATT;
continue; continue;
#endif
#ifdef VIRTUAL_IP
case '6': /* --virtual_private */ case '6': /* --virtual_private */
virtual_private = optarg; virtual_private = optarg;
continue; continue;
#endif
default: default:
#ifdef DEBUG #ifdef DEBUG
@@ -620,13 +596,8 @@ main(int argc, char **argv)
, ipsec_version_code() , ipsec_version_code()
, compile_time_interop_options); , compile_time_interop_options);
#ifdef NAT_TRAVERSAL
init_nat_traversal(nat_traversal, keep_alive, force_keepalive, nat_t_spf); init_nat_traversal(nat_traversal, keep_alive, force_keepalive, nat_t_spf);
#endif
#ifdef VIRTUAL_IP
init_virtual_ip(virtual_private); init_virtual_ip(virtual_private);
#endif
scx_init(pkcs11_module_path); /* load and initialize PKCS #11 module */ scx_init(pkcs11_module_path); /* load and initialize PKCS #11 module */
init_rnd_pool(); init_rnd_pool();
init_secret(); init_secret();
src/pluto/rcv_whack.c
+18 -22
View File
@@ -321,28 +321,24 @@ whack_handle(int whackctlfd)
|| !unpack_str(&msg.left.ca) /* string 4 */ || !unpack_str(&msg.left.ca) /* string 4 */
|| !unpack_str(&msg.left.groups) /* string 5 */ || !unpack_str(&msg.left.groups) /* string 5 */
|| !unpack_str(&msg.left.updown) /* string 6 */ || !unpack_str(&msg.left.updown) /* string 6 */
#ifdef VIRTUAL_IP || !unpack_str(&msg.left.virt) /* string 7 */
|| !unpack_str(&msg.left.virt) || !unpack_str(&msg.right.id) /* string 8 */
#endif || !unpack_str(&msg.right.cert) /* string 9 */
|| !unpack_str(&msg.right.id) /* string 7 */ || !unpack_str(&msg.right.ca) /* string 10 */
|| !unpack_str(&msg.right.cert) /* string 8 */ || !unpack_str(&msg.right.groups) /* string 11 */
|| !unpack_str(&msg.right.ca) /* string 9 */ || !unpack_str(&msg.right.updown) /* string 12 */
|| !unpack_str(&msg.right.groups) /* string 10 */ || !unpack_str(&msg.right.virt) /* string 13 */
|| !unpack_str(&msg.right.updown) /* string 11 */ || !unpack_str(&msg.keyid) /* string 14 */
#ifdef VIRTUAL_IP || !unpack_str(&msg.myid) /* string 15 */
|| !unpack_str(&msg.right.virt) || !unpack_str(&msg.cacert) /* string 16 */
#endif || !unpack_str(&msg.ldaphost) /* string 17 */
|| !unpack_str(&msg.keyid) /* string 12 */ || !unpack_str(&msg.ldapbase) /* string 18 */
|| !unpack_str(&msg.myid) /* string 13 */ || !unpack_str(&msg.crluri) /* string 19 */
|| !unpack_str(&msg.cacert) /* string 14 */ || !unpack_str(&msg.crluri2) /* string 20 */
|| !unpack_str(&msg.ldaphost) /* string 15 */ || !unpack_str(&msg.ocspuri) /* string 21 */
|| !unpack_str(&msg.ldapbase) /* string 16 */ || !unpack_str(&msg.ike) /* string 22 */
|| !unpack_str(&msg.crluri) /* string 17 */ || !unpack_str(&msg.esp) /* string 23 */
|| !unpack_str(&msg.crluri2) /* string 18 */ || !unpack_str(&msg.sc_data) /* string 24 */
|| !unpack_str(&msg.ocspuri) /* string 19 */
|| !unpack_str(&msg.ike) /* string 20 */
|| !unpack_str(&msg.esp) /* string 21 */
|| !unpack_str(&msg.sc_data) /* string 22 */
|| str_roof - next_str != (ptrdiff_t)msg.keyval.len) /* check chunk */ || str_roof - next_str != (ptrdiff_t)msg.keyval.len) /* check chunk */
{ {
ugh = "message from whack contains bad string"; ugh = "message from whack contains bad string";
src/pluto/server.c
+8 -13
View File
@@ -62,10 +62,7 @@
#include <pfkeyv2.h> #include <pfkeyv2.h>
#include <pfkey.h> #include <pfkey.h>
#include "kameipsec.h" #include "kameipsec.h"
#ifdef NAT_TRAVERSAL
#include "nat_traversal.h" #include "nat_traversal.h"
#endif
/* /*
* Server main loop and socket initialization routines. * Server main loop and socket initialization routines.
@@ -702,13 +699,11 @@ add_entry:
if (fd < 0) if (fd < 0)
break; break;
#ifdef NAT_TRAVERSAL
if (nat_traversal_support_non_ike if (nat_traversal_support_non_ike
&& addrtypeof(&ifp->addr) == AF_INET) && addrtypeof(&ifp->addr) == AF_INET)
{ {
nat_traversal_espinudp_socket(fd, ESPINUDP_WITH_NON_IKE); nat_traversal_espinudp_socket(fd, ESPINUDP_WITH_NON_IKE);
} }
#endif
q = alloc_thing(struct iface, "struct iface"); q = alloc_thing(struct iface, "struct iface");
q->rname = clone_str(ifp->name, "real device name"); q->rname = clone_str(ifp->name, "real device name");
@@ -720,7 +715,7 @@ add_entry:
interfaces = q; interfaces = q;
plog("adding interface %s/%s %s:%d" plog("adding interface %s/%s %s:%d"
, q->vname, q->rname, ip_str(&q->addr), pluto_port); , q->vname, q->rname, ip_str(&q->addr), pluto_port);
#ifdef NAT_TRAVERSAL
if (nat_traversal_support_port_floating if (nat_traversal_support_port_floating
&& addrtypeof(&ifp->addr) == AF_INET) && addrtypeof(&ifp->addr) == AF_INET)
{ {
@@ -742,7 +737,6 @@ add_entry:
plog("adding interface %s/%s %s:%d", plog("adding interface %s/%s %s:%d",
q->vname, q->rname, ip_str(&q->addr), NAT_T_IKE_FLOAT_PORT); q->vname, q->rname, ip_str(&q->addr), NAT_T_IKE_FLOAT_PORT);
} }
#endif
break; break;
} }
@@ -753,16 +747,17 @@ add_entry:
{ {
/* matches -- rejuvinate old entry */ /* matches -- rejuvinate old entry */
q->change = IFN_KEEP; q->change = IFN_KEEP;
#ifdef NAT_TRAVERSAL
/* look for other interfaces to keep (due to NAT-T) */ /* look for other interfaces to keep (due to NAT-T) */
for (q = q->next ; q ; q = q->next) { for (q = q->next ; q ; q = q->next)
{
if (streq(q->rname, ifp->name) if (streq(q->rname, ifp->name)
&& streq(q->vname, v->name) && streq(q->vname, v->name)
&& sameaddr(&q->addr, &ifp->addr)) { && sameaddr(&q->addr, &ifp->addr))
q->change = IFN_KEEP; {
q->change = IFN_KEEP;
} }
} }
#endif
break; break;
} }
src/pluto/server.h
-2
View File
@@ -40,9 +40,7 @@ struct iface {
ip_address addr; /* interface IP address */ ip_address addr; /* interface IP address */
int fd; /* file descriptor of socket for IKE UDP messages */ int fd; /* file descriptor of socket for IKE UDP messages */
struct iface *next; struct iface *next;
#ifdef NAT_TRAVERSAL
bool ike_float; bool ike_float;
#endif
enum { IFN_ADD, IFN_KEEP, IFN_DELETE } change; enum { IFN_ADD, IFN_KEEP, IFN_DELETE } change;
}; };
src/pluto/spdb.c
+5 -20
View File
@@ -35,23 +35,19 @@
#include "kernel.h" #include "kernel.h"
#include "log.h" #include "log.h"
#include "spdb.h" #include "spdb.h"
#include "whack.h" /* for RC_LOG_SERIOUS */ #include "whack.h"
#include "sha1.h" #include "sha1.h"
#include "md5.h" #include "md5.h"
#include "crypto.h" /* requires sha1.h and md5.h */ #include "crypto.h" /* requires sha1.h and md5.h */
#include "alg_info.h" #include "alg_info.h"
#include "kernel_alg.h" #include "kernel_alg.h"
#include "ike_alg.h" #include "ike_alg.h"
#include "db_ops.h" #include "db_ops.h"
#include "nat_traversal.h"
#define AD(x) x, elemsof(x) /* Array Description */ #define AD(x) x, elemsof(x) /* Array Description */
#define AD_NULL NULL, 0 #define AD_NULL NULL, 0
#ifdef NAT_TRAVERSAL
#include "nat_traversal.h"
#endif
/**************** Oakely (main mode) SA database ****************/ /**************** Oakely (main mode) SA database ****************/
/* arrays of attributes for transforms, preshared key */ /* arrays of attributes for transforms, preshared key */
@@ -659,7 +655,6 @@ out_sa(pb_stream *outs
if (p->protoid != PROTO_IPCOMP if (p->protoid != PROTO_IPCOMP
|| st->st_policy & POLICY_TUNNEL) || st->st_policy & POLICY_TUNNEL)
{ {
#ifdef NAT_TRAVERSAL
#ifndef I_KNOW_TRANSPORT_MODE_HAS_SECURITY_CONCERN_BUT_I_WANT_IT #ifndef I_KNOW_TRANSPORT_MODE_HAS_SECURITY_CONCERN_BUT_I_WANT_IT
if ((st->nat_traversal & NAT_T_DETECTED) if ((st->nat_traversal & NAT_T_DETECTED)
&& !(st->st_policy & POLICY_TUNNEL)) && !(st->st_policy & POLICY_TUNNEL))
@@ -671,23 +666,17 @@ out_sa(pb_stream *outs
"Transport Mode not allowed due to security concerns -- " "Transport Mode not allowed due to security concerns -- "
"using Tunnel mode"); "using Tunnel mode");
} }
#endif
#endif #endif
out_attr(ENCAPSULATION_MODE out_attr(ENCAPSULATION_MODE
#ifdef NAT_TRAVERSAL
#ifdef I_KNOW_TRANSPORT_MODE_HAS_SECURITY_CONCERN_BUT_I_WANT_IT #ifdef I_KNOW_TRANSPORT_MODE_HAS_SECURITY_CONCERN_BUT_I_WANT_IT
, NAT_T_ENCAPSULATION_MODE(st,st->st_policy) , NAT_T_ENCAPSULATION_MODE(st, st->st_policy)
#else #else
/* If NAT-T is detected, use UDP_TUNNEL as long as Transport /* If NAT-T is detected, use UDP_TUNNEL as long as Transport
* Mode has security concerns. * Mode has security concerns.
* *
* User has been informed of that * User has been informed of that
*/ */
, NAT_T_ENCAPSULATION_MODE(st,POLICY_TUNNEL) , NAT_T_ENCAPSULATION_MODE(st, POLICY_TUNNEL)
#endif
#else /* ! NAT_TRAVERSAL */
, st->st_policy & POLICY_TUNNEL
? ENCAPSULATION_MODE_TUNNEL : ENCAPSULATION_MODE_TRANSPORT
#endif #endif
, attr_desc, attr_val_descs , attr_desc, attr_val_descs
, &trans_pbs); , &trans_pbs);
@@ -1557,7 +1546,6 @@ parse_ipsec_transform(struct isakmp_transform *trans
break; break;
case ENCAPSULATION_MODE | ISAKMP_ATTR_AF_TV: case ENCAPSULATION_MODE | ISAKMP_ATTR_AF_TV:
ipcomp_inappropriate = FALSE; ipcomp_inappropriate = FALSE;
#ifdef NAT_TRAVERSAL
switch (val) switch (val)
{ {
case ENCAPSULATION_MODE_TUNNEL: case ENCAPSULATION_MODE_TUNNEL:
@@ -1642,9 +1630,6 @@ parse_ipsec_transform(struct isakmp_transform *trans
, "unknown ENCAPSULATION_MODE %d in IPSec SA", val); , "unknown ENCAPSULATION_MODE %d in IPSec SA", val);
return FALSE; return FALSE;
} }
#else
attrs->encapsulation = val;
#endif
break; break;
case AUTH_ALGORITHM | ISAKMP_ATTR_AF_TV: case AUTH_ALGORITHM | ISAKMP_ATTR_AF_TV:
attrs->auth = val; attrs->auth = val;
src/pluto/state.h
-2
View File
@@ -213,10 +213,8 @@ struct state
bool started; bool started;
} st_modecfg; } st_modecfg;
#ifdef NAT_TRAVERSAL
u_int32_t nat_traversal; u_int32_t nat_traversal;
ip_address nat_oa; ip_address nat_oa;
#endif
/* RFC 3706 Dead Peer Detection */ /* RFC 3706 Dead Peer Detection */
bool st_dpd; /* Peer supports DPD */ bool st_dpd; /* Peer supports DPD */
src/pluto/timer.c
-5
View File
@@ -38,10 +38,7 @@
#include "rnd.h" #include "rnd.h"
#include "timer.h" #include "timer.h"
#include "whack.h" #include "whack.h"
#ifdef NAT_TRAVERSAL
#include "nat_traversal.h" #include "nat_traversal.h"
#endif
/* monotonic version of time(3) */ /* monotonic version of time(3) */
time_t time_t
@@ -427,11 +424,9 @@ handle_timer_event(void)
case EVENT_DPD_TIMEOUT: case EVENT_DPD_TIMEOUT:
dpd_timeout(st); dpd_timeout(st);
break; break;
#ifdef NAT_TRAVERSAL
case EVENT_NAT_T_KEEPALIVE: case EVENT_NAT_T_KEEPALIVE:
nat_traversal_ka_event(); nat_traversal_ka_event();
break; break;
#endif
default: default:
loglog(RC_LOG_SERIOUS, "INTERNAL ERROR: ignoring unknown expiring event %s" loglog(RC_LOG_SERIOUS, "INTERNAL ERROR: ignoring unknown expiring event %s"
, enum_show(&timer_event_names, type)); , enum_show(&timer_event_names, type));
src/pluto/vendor.c
+2 -5
View File
@@ -30,10 +30,7 @@
#include "whack.h" #include "whack.h"
#include "vendor.h" #include "vendor.h"
#include "kernel.h" #include "kernel.h"
#ifdef NAT_TRAVERSAL
#include "nat_traversal.h" #include "nat_traversal.h"
#endif
/** /**
* Unknown/Special VID: * Unknown/Special VID:
@@ -348,7 +345,7 @@ handle_known_vendorid (struct msg_digest *md
md->openpgp = TRUE; md->openpgp = TRUE;
vid_useful = TRUE; vid_useful = TRUE;
break; break;
#ifdef NAT_TRAVERSAL
/* /*
* Use most recent supported NAT-Traversal method and ignore the * Use most recent supported NAT-Traversal method and ignore the
* other ones (implementations will send all supported methods but * other ones (implementations will send all supported methods but
@@ -376,7 +373,7 @@ handle_known_vendorid (struct msg_digest *md
vid_useful = TRUE; vid_useful = TRUE;
} }
break; break;
#endif
/* Remote side would like to do DPD with us on this connection */ /* Remote side would like to do DPD with us on this connection */
case VID_MISC_DPD: case VID_MISC_DPD:
md->dpd = TRUE; md->dpd = TRUE;
src/pluto/virtual.c
-4
View File
@@ -14,8 +14,6 @@
* RCSID $Id: virtual.c,v 1.4 2004/04/02 10:38:52 as Exp $ * RCSID $Id: virtual.c,v 1.4 2004/04/02 10:38:52 as Exp $
*/ */
#ifdef VIRTUAL_IP
#include <freeswan.h> #include <freeswan.h>
#include <stdlib.h> #include <stdlib.h>
@@ -334,5 +332,3 @@ is_virtual_net_allowed(const struct connection *c, const ip_subnet *peer_net,
return FALSE; return FALSE;
} }
#endif