Line 0
Link Here
|
|
|
1 |
--- src/libipsec/libpfkey.h |
2 |
+++ src/libipsec/libpfkey.h |
3 |
@@ -85,7 +85,7 @@ struct pfkey_send_sa_args { |
4 |
u_int32_t seq; |
5 |
u_int8_t l_natt_type; |
6 |
u_int16_t l_natt_sport, l_natt_dport; |
7 |
- struct sockaddr *l_natt_oa; |
8 |
+ struct sockaddr *l_natt_oai, *l_natt_oar; |
9 |
u_int16_t l_natt_frag; |
10 |
u_int8_t ctxdoi, ctxalg; /* Security context DOI and algorithm */ |
11 |
caddr_t ctxstr; /* Security context string */ |
12 |
--- src/libipsec/pfkey.c |
13 |
+++ src/libipsec/pfkey.c |
14 |
@@ -1335,9 +1335,12 @@ pfkey_send_x1(struct pfkey_send_sa_args |
15 |
len += sizeof(struct sadb_x_nat_t_type); |
16 |
len += sizeof(struct sadb_x_nat_t_port); |
17 |
len += sizeof(struct sadb_x_nat_t_port); |
18 |
- if (sa_parms->l_natt_oa) |
19 |
+ if (sa_parms->l_natt_oai) |
20 |
len += sizeof(struct sadb_address) + |
21 |
- PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oa)); |
22 |
+ PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oai)); |
23 |
+ if (sa_parms->l_natt_oar) |
24 |
+ len += sizeof(struct sadb_address) + |
25 |
+ PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oar)); |
26 |
#ifdef SADB_X_EXT_NAT_T_FRAG |
27 |
if (sa_parms->l_natt_frag) |
28 |
len += sizeof(struct sadb_x_nat_t_frag); |
29 |
@@ -1452,10 +1455,21 @@ pfkey_send_x1(struct pfkey_send_sa_args |
30 |
return -1; |
31 |
} |
32 |
|
33 |
- if (sa_parms->l_natt_oa) { |
34 |
- p = pfkey_setsadbaddr(p, ep, SADB_X_EXT_NAT_T_OA, |
35 |
- sa_parms->l_natt_oa, |
36 |
- (u_int)PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oa)), |
37 |
+ if (sa_parms->l_natt_oai) { |
38 |
+ p = pfkey_setsadbaddr(p, ep, SADB_X_EXT_NAT_T_OAI, |
39 |
+ sa_parms->l_natt_oai, |
40 |
+ (u_int)PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oai)), |
41 |
+ IPSEC_ULPROTO_ANY); |
42 |
+ if (!p) { |
43 |
+ free(newmsg); |
44 |
+ return -1; |
45 |
+ } |
46 |
+ } |
47 |
+ |
48 |
+ if (sa_parms->l_natt_oar) { |
49 |
+ p = pfkey_setsadbaddr(p, ep, SADB_X_EXT_NAT_T_OAR, |
50 |
+ sa_parms->l_natt_oar, |
51 |
+ (u_int)PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oar)), |
52 |
IPSEC_ULPROTO_ANY); |
53 |
if (!p) { |
54 |
free(newmsg); |
55 |
@@ -2034,7 +2048,8 @@ pfkey_align(struct sadb_msg *msg, caddr_ |
56 |
case SADB_X_EXT_NAT_T_TYPE: |
57 |
case SADB_X_EXT_NAT_T_SPORT: |
58 |
case SADB_X_EXT_NAT_T_DPORT: |
59 |
- case SADB_X_EXT_NAT_T_OA: |
60 |
+ case SADB_X_EXT_NAT_T_OAI: |
61 |
+ case SADB_X_EXT_NAT_T_OAR: |
62 |
#endif |
63 |
#ifdef SADB_X_EXT_TAG |
64 |
case SADB_X_EXT_TAG: |
65 |
@@ -2592,7 +2607,7 @@ pfkey_send_update_nat(int so, u_int saty |
66 |
psaa.l_natt_type = l_natt_type; |
67 |
psaa.l_natt_sport = l_natt_sport; |
68 |
psaa.l_natt_dport = l_natt_dport; |
69 |
- psaa.l_natt_oa = l_natt_oa; |
70 |
+ psaa.l_natt_oar = l_natt_oa; |
71 |
psaa.l_natt_frag = l_natt_frag; |
72 |
|
73 |
return pfkey_send_update2(&psaa); |
74 |
@@ -2667,7 +2682,7 @@ pfkey_send_add_nat(int so, u_int satype, |
75 |
psaa.l_natt_type = l_natt_type; |
76 |
psaa.l_natt_sport = l_natt_sport; |
77 |
psaa.l_natt_dport = l_natt_dport; |
78 |
- psaa.l_natt_oa = l_natt_oa; |
79 |
+ psaa.l_natt_oai = l_natt_oa; |
80 |
psaa.l_natt_frag = l_natt_frag; |
81 |
|
82 |
return pfkey_send_add2(&psaa); |
83 |
--- src/racoon/isakmp_quick.c |
84 |
+++ src/racoon/isakmp_quick.c |
85 |
@@ -2390,6 +2390,32 @@ get_proposal_r(iph2) |
86 |
spidx.src.ss_family, spidx.dst.ss_family, |
87 |
_XIDT(iph2->id_p),idi2type); |
88 |
} |
89 |
+#ifdef ENABLE_NATT |
90 |
+ if (iph2->ph1->natt_flags & NAT_DETECTED_PEER) { |
91 |
+ u_int16_t port; |
92 |
+ |
93 |
+ port = extract_port(&spidx.src); |
94 |
+ memcpy(&spidx.src, iph2->ph1->remote, |
95 |
+ sysdep_sa_len(iph2->ph1->remote)); |
96 |
+ set_port(&spidx.src, port); |
97 |
+ switch (spidx.src.ss_family) { |
98 |
+ case AF_INET: |
99 |
+ spidx.prefs = sizeof(struct in_addr) << 3; |
100 |
+ break; |
101 |
+#ifdef INET6 |
102 |
+ case AF_INET6: |
103 |
+ spidx.prefs = sizeof(struct in6_addr) << 3; |
104 |
+ break; |
105 |
+#endif |
106 |
+ default: |
107 |
+ spidx.prefs = 0; |
108 |
+ break; |
109 |
+ } |
110 |
+ plog(LLV_DEBUG, LOCATION, |
111 |
+ NULL, "use NAT address %s as src\n", |
112 |
+ saddr2str((struct sockaddr *)&spidx.src)); |
113 |
+ } |
114 |
+#endif |
115 |
} else { |
116 |
plog(LLV_DEBUG, LOCATION, NULL, |
117 |
"get a source address of SP index from Phase 1" |
118 |
--- src/racoon/nattraversal.c |
119 |
+++ src/racoon/nattraversal.c |
120 |
@@ -436,10 +436,7 @@ natt_keepalive_add_ph1 (struct ph1handle |
121 |
{ |
122 |
int ret = 0; |
123 |
|
124 |
- /* Should only the NATed host send keepalives? |
125 |
- If yes, add '(iph1->natt_flags & NAT_DETECTED_ME)' |
126 |
- to the following condition. */ |
127 |
- if (iph1->natt_flags & NAT_DETECTED && |
128 |
+ if (iph1->natt_flags & NAT_DETECTED_ME && |
129 |
! (iph1->natt_flags & NAT_KA_QUEUED)) { |
130 |
ret = natt_keepalive_add (iph1->local, iph1->remote); |
131 |
if (ret == 0) |
132 |
--- src/racoon/pfkey.c |
133 |
+++ src/racoon/pfkey.c |
134 |
@@ -1190,7 +1190,10 @@ pk_sendupdate(iph2) |
135 |
sa_args.l_natt_type = iph2->ph1->natt_options->encaps_type; |
136 |
sa_args.l_natt_sport = extract_port(iph2->ph1->remote); |
137 |
sa_args.l_natt_dport = extract_port(iph2->ph1->local); |
138 |
- sa_args.l_natt_oa = iph2->natoa_src; |
139 |
+ /* if (iph2->ph1->natt_flags & NAT_DETECTED_PEER) */ |
140 |
+ sa_args.l_natt_oai = iph2->natoa_dst; |
141 |
+ /* if (iph2->ph1->natt_flags & NAT_DETECTED_ME) */ |
142 |
+ sa_args.l_natt_oar = iph2->natoa_src; |
143 |
#ifdef SADB_X_EXT_NAT_T_FRAG |
144 |
sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag; |
145 |
#endif |
146 |
@@ -1477,7 +1480,6 @@ pk_sendadd(iph2) |
147 |
sa_args.l_natt_type = UDP_ENCAP_ESPINUDP; |
148 |
sa_args.l_natt_sport = extract_port(iph2->ph1->local); |
149 |
sa_args.l_natt_dport = extract_port(iph2->ph1->remote); |
150 |
- sa_args.l_natt_oa = iph2->natoa_dst; |
151 |
#ifdef SADB_X_EXT_NAT_T_FRAG |
152 |
sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag; |
153 |
#endif |