summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
authormanu <manu@NetBSD.org>2005-05-20 01:25:17 +0000
committermanu <manu@NetBSD.org>2005-05-20 01:25:17 +0000
commit7c6ffb8ab4d42678ff3104d00a5b73448d78a1ee (patch)
treee83695f0502236ac0024f1de09fa80b748fae4a3 /sys
parent47d12f36e751828ecf1dd323ee151fec8329dde1 (diff)
Use NAT-T ports for AH and IPcomp too.
Diffstat (limited to 'sys')
-rw-r--r--sys/netinet6/ah_input.c19
-rw-r--r--sys/netinet6/ipcomp_input.c18
2 files changed, 31 insertions, 6 deletions
diff --git a/sys/netinet6/ah_input.c b/sys/netinet6/ah_input.c
index d3ccbab7b7d..27c990708a3 100644
--- a/sys/netinet6/ah_input.c
+++ b/sys/netinet6/ah_input.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ah_input.c,v 1.46 2005/04/29 10:39:09 yamt Exp $ */
+/* $NetBSD: ah_input.c,v 1.47 2005/05/20 01:25:17 manu Exp $ */
/* $KAME: ah_input.c,v 1.64 2001/09/04 08:43:19 itojun Exp $ */
/*
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ah_input.c,v 1.46 2005/04/29 10:39:09 yamt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ah_input.c,v 1.47 2005/05/20 01:25:17 manu Exp $");
#include "opt_inet.h"
@@ -109,12 +109,25 @@ ah4_input(m, va_alist)
int off, proto;
va_list ap;
size_t stripsiz = 0;
+ u_int16_t sport = 0;
+ u_int16_t dport = 0;
+#ifdef IPSEC_NAT_T
+ struct m_tag *tag = NULL;
+#endif
va_start(ap, m);
off = va_arg(ap, int);
proto = va_arg(ap, int);
va_end(ap);
+#ifdef IPSEC_NAT_T
+ /* find the source port for NAT-T */
+ if ((tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL)) != NULL) {
+ sport = ((u_int16_t *)(tag + 1))[0];
+ dport = ((u_int16_t *)(tag + 1))[1];
+ }
+#endif
+
ip = mtod(m, struct ip *);
IP6_EXTHDR_GET(ah, struct ah *, m, off, sizeof(struct newah));
if (ah == NULL) {
@@ -131,7 +144,7 @@ ah4_input(m, va_alist)
if ((sav = key_allocsa(AF_INET,
(caddr_t)&ip->ip_src, (caddr_t)&ip->ip_dst,
- IPPROTO_AH, spi, 0, 0)) == 0) {
+ IPPROTO_AH, spi, sport, dport)) == 0) {
ipseclog((LOG_WARNING,
"IPv4 AH input: no key association found for spi %u\n",
(u_int32_t)ntohl(spi)));
diff --git a/sys/netinet6/ipcomp_input.c b/sys/netinet6/ipcomp_input.c
index dbd2315cceb..d88f32738d9 100644
--- a/sys/netinet6/ipcomp_input.c
+++ b/sys/netinet6/ipcomp_input.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ipcomp_input.c,v 1.24 2005/04/29 10:39:09 yamt Exp $ */
+/* $NetBSD: ipcomp_input.c,v 1.25 2005/05/20 01:25:17 manu Exp $ */
/* $KAME: ipcomp_input.c,v 1.29 2001/09/04 08:43:19 itojun Exp $ */
/*
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipcomp_input.c,v 1.24 2005/04/29 10:39:09 yamt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipcomp_input.c,v 1.25 2005/05/20 01:25:17 manu Exp $");
#include "opt_inet.h"
@@ -103,6 +103,11 @@ ipcomp4_input(m, va_alist)
struct secasvar *sav = NULL;
int off, proto;
va_list ap;
+ u_int16_t sport = 0;
+ u_int16_t dport = 0;
+#ifdef IPSEC_NAT_T
+ struct m_tag *tag = NULL;
+#endif
va_start(ap, m);
off = va_arg(ap, int);
@@ -115,6 +120,13 @@ ipcomp4_input(m, va_alist)
ipsecstat.in_inval++;
goto fail;
}
+#ifdef IPSEC_NAT_T
+ /* find the source port for NAT-T */
+ if ((tag = m_tag_find(m, PACKET_TAG_IPSEC_NAT_T_PORTS, NULL)) != NULL) {
+ sport = ((u_int16_t *)(tag + 1))[0];
+ dport = ((u_int16_t *)(tag + 1))[1];
+ }
+#endif
md = m_pulldown(m, off, sizeof(*ipcomp), NULL);
if (!md) {
@@ -138,7 +150,7 @@ ipcomp4_input(m, va_alist)
if (cpi >= IPCOMP_CPI_NEGOTIATE_MIN) {
sav = key_allocsa(AF_INET, (caddr_t)&ip->ip_src,
(caddr_t)&ip->ip_dst, IPPROTO_IPCOMP, htonl(cpi),
- 0, 0);
+ sport, dport);
if (sav != NULL &&
(sav->state == SADB_SASTATE_MATURE ||
sav->state == SADB_SASTATE_DYING)) {