diff options
Diffstat (limited to 'main/ipsec-tools/40-cmpsaddr-cleanup.patch')
| -rw-r--r-- | main/ipsec-tools/40-cmpsaddr-cleanup.patch | 1403 |
1 files changed, 1403 insertions, 0 deletions
diff --git a/main/ipsec-tools/40-cmpsaddr-cleanup.patch b/main/ipsec-tools/40-cmpsaddr-cleanup.patch new file mode 100644 index 000000000..c5e3e4b33 --- /dev/null +++ b/main/ipsec-tools/40-cmpsaddr-cleanup.patch @@ -0,0 +1,1403 @@ +Get rid of CMPSADDR hack in port comparisons. Trac #295. + +From: Timo Teras <timo.teras@iki.fi> + + +--- + + src/racoon/admin.c | 37 ++++--- + src/racoon/grabmyaddr.c | 22 ++-- + src/racoon/handler.c | 41 +++----- + src/racoon/handler.h | 7 - + src/racoon/isakmp.c | 90 ++++------------- + src/racoon/isakmp_cfg.c | 9 -- + src/racoon/isakmp_inf.c | 111 ++++----------------- + src/racoon/isakmp_quick.c | 29 +++--- + src/racoon/nattraversal.c | 8 +- + src/racoon/pfkey.c | 52 +++------- + src/racoon/policy.c | 22 ++-- + src/racoon/remoteconf.c | 30 +----- + src/racoon/remoteconf.h | 3 - + src/racoon/sockmisc.c | 234 +++------------------------------------------ + src/racoon/sockmisc.h | 15 +-- + src/racoon/throttle.c | 2 + 16 files changed, 170 insertions(+), 542 deletions(-) + + +diff --git a/src/racoon/admin.c b/src/racoon/admin.c +index 576e191..b67e545 100644 +--- a/src/racoon/admin.c ++++ b/src/racoon/admin.c +@@ -167,6 +167,14 @@ end: + return error; + } + ++static int admin_ph1_delete_sa(struct ph1handle *iph1, void *arg) ++{ ++ if (iph1->status >= PHASE1ST_ESTABLISHED) ++ isakmp_info_send_d1(iph1); ++ purge_remote(iph1); ++ return 0; ++} ++ + /* + * main child's process. + */ +@@ -257,7 +265,7 @@ admin_process(so2, combuf) + break; + } + +- iph1 = getph1byaddrwop(src, dst); ++ iph1 = getph1byaddr(src, dst, 0); + if (iph1 == NULL) { + l_ac_errno = ENOENT; + break; +@@ -292,30 +300,25 @@ admin_process(so2, combuf) + + case ADMIN_DELETE_SA: { + struct ph1handle *iph1; +- struct sockaddr *dst; +- struct sockaddr *src; ++ struct ph1selector sel; + char *loc, *rem; + +- src = (struct sockaddr *) ++ memset(&sel, 0, sizeof(sel)); ++ sel.local = (struct sockaddr *) + &((struct admin_com_indexes *) + ((caddr_t)com + sizeof(*com)))->src; +- dst = (struct sockaddr *) ++ sel.remote = (struct sockaddr *) + &((struct admin_com_indexes *) + ((caddr_t)com + sizeof(*com)))->dst; + +- loc = racoon_strdup(saddrwop2str(src)); +- rem = racoon_strdup(saddrwop2str(dst)); ++ loc = racoon_strdup(saddr2str(sel.local)); ++ rem = racoon_strdup(saddr2str(sel.remote)); + STRDUP_FATAL(loc); + STRDUP_FATAL(rem); + +- if ((iph1 = getph1byaddrwop(src, dst)) == NULL) { +- plog(LLV_ERROR, LOCATION, NULL, +- "phase 1 for %s -> %s not found\n", loc, rem); +- } else { +- if (iph1->status >= PHASE1ST_ESTABLISHED) +- isakmp_info_send_d1(iph1); +- purge_remote(iph1); +- } ++ plog(LLV_INFO, LOCATION, NULL, ++ "admin delete-sa %s %s\n", loc, rem); ++ enumph1(&sel, admin_ph1_delete_sa, NULL); + + racoon_free(loc); + racoon_free(rem); +@@ -360,7 +363,7 @@ admin_process(so2, combuf) + plog(LLV_INFO, LOCATION, NULL, + "Flushing all SAs for peer %s\n", rem); + +- while ((iph1 = getph1bydstaddrwop(dst)) != NULL) { ++ while ((iph1 = getph1bydstaddr(dst)) != NULL) { + loc = racoon_strdup(saddrwop2str(iph1->local)); + STRDUP_FATAL(loc); + +@@ -429,7 +432,7 @@ admin_process(so2, combuf) + l_ac_errno = -1; + + /* connected already? */ +- ph1 = getph1byaddrwop(src, dst); ++ ph1 = getph1byaddr(src, dst, 0); + if (ph1 != NULL) { + event_list = &ph1->evt_listeners; + if (ph1->status == PHASE1ST_ESTABLISHED) +diff --git a/src/racoon/grabmyaddr.c b/src/racoon/grabmyaddr.c +index f866dd5..cb1b638 100644 +--- a/src/racoon/grabmyaddr.c ++++ b/src/racoon/grabmyaddr.c +@@ -100,7 +100,7 @@ myaddr_configured(addr) + return TRUE; + + LIST_FOREACH(cfg, &configured, chain) { +- if (cmpsaddrstrict(addr, (struct sockaddr *) &cfg->addr) == 0) ++ if (cmpsaddr(addr, (struct sockaddr *) &cfg->addr) == 0) + return TRUE; + } + +@@ -116,7 +116,7 @@ myaddr_open(addr, udp_encap) + + /* Already open? */ + LIST_FOREACH(my, &opened, chain) { +- if (cmpsaddrstrict(addr, (struct sockaddr *) &my->addr) == 0) ++ if (cmpsaddr(addr, (struct sockaddr *) &my->addr) == 0) + return TRUE; + } + +@@ -156,7 +156,7 @@ myaddr_open_all_configured(addr) + + LIST_FOREACH(cfg, &configured, chain) { + if (addr != NULL && +- cmpsaddrwop(addr, (struct sockaddr *) &cfg->addr) != 0) ++ cmpsaddr(addr, (struct sockaddr *) &cfg->addr) != 0) + continue; + if (!myaddr_open((struct sockaddr *) &cfg->addr, cfg->udp_encap)) + return FALSE; +@@ -187,8 +187,8 @@ myaddr_close_all_open(addr) + for (my = LIST_FIRST(&opened); my; my = next) { + next = LIST_NEXT(my, chain); + +- if (!cmpsaddrwop((struct sockaddr *) &addr, +- (struct sockaddr *) &my->addr)) ++ if (!cmpsaddr((struct sockaddr *) &addr, ++ (struct sockaddr *) &my->addr)) + myaddr_delete(my); + } + } +@@ -261,7 +261,7 @@ myaddr_getfd(addr) + struct myaddr *my; + + LIST_FOREACH(my, &opened, chain) { +- if (cmpsaddrstrict((struct sockaddr *) &my->addr, addr) == 0) ++ if (cmpsaddr((struct sockaddr *) &my->addr, addr) == 0) + return my->fd; + } + +@@ -273,19 +273,13 @@ myaddr_getsport(addr) + struct sockaddr *addr; + { + struct myaddr *my; +- int bestmatch_port = -1; + + LIST_FOREACH(my, &opened, chain) { +- if (cmpsaddrstrict((struct sockaddr *) &my->addr, addr) == 0) ++ if (cmpsaddr((struct sockaddr *) &my->addr, addr) == 0) + return extract_port((struct sockaddr *) &my->addr); +- if (cmpsaddrwop((struct sockaddr *) &my->addr, addr) != 0) +- continue; +- if (bestmatch_port == -1 || +- extract_port((struct sockaddr *) &my->addr) == PORT_ISAKMP) +- bestmatch_port = extract_port((struct sockaddr *) &my->addr); + } + +- return bestmatch_port; ++ return PORT_ISAKMP; + } + + void +diff --git a/src/racoon/handler.c b/src/racoon/handler.c +index 960b5b3..b33986f 100644 +--- a/src/racoon/handler.c ++++ b/src/racoon/handler.c +@@ -120,11 +120,11 @@ enumph1(sel, enum_func, enum_arg) + LIST_FOREACH(p, &ph1tree, chain) { + if (sel != NULL) { + if (sel->local != NULL && +- CMPSADDR(sel->local, p->local) != 0) ++ cmpsaddr(sel->local, p->local) != 0) + continue; + + if (sel->remote != NULL && +- CMPSADDR(sel->remote, p->remote) != 0) ++ cmpsaddr(sel->remote, p->remote) != 0) + continue; + } + +@@ -201,17 +201,12 @@ getph1(rmconf, local, remote, flags) + "status %d, skipping\n", p->status); + continue; + } +- if (flags & GETPH1_F_WITHOUT_PORTS) { +- if (local != NULL && cmpsaddrwop(local, p->local) != 0) +- continue; +- if (remote != NULL && cmpsaddrwop(remote, p->remote) != 0) +- continue; +- } else { +- if (local != NULL && CMPSADDR(local, p->local) != 0) +- continue; +- if (remote != NULL && CMPSADDR(remote, p->remote) != 0) +- continue; +- } ++ ++ if (local != NULL && cmpsaddr(local, p->local) != 0) ++ continue; ++ ++ if (remote != NULL && cmpsaddr(remote, p->remote) != 0) ++ continue; + + plog(LLV_DEBUG2, LOCATION, NULL, "matched\n"); + return p; +@@ -287,8 +282,8 @@ void migrate_dying_ph12(iph1) + if (p->status < PHASE1ST_DYING) + continue; + +- if (CMPSADDR(iph1->local, p->local) == 0 +- && CMPSADDR(iph1->remote, p->remote) == 0) ++ if (cmpsaddr(iph1->local, p->local) == 0 ++ && cmpsaddr(iph1->remote, p->remote) == 0) + migrate_ph12(p, iph1); + } + } +@@ -518,11 +513,11 @@ enumph2(sel, enum_func, enum_arg) + continue; + + if (sel->src != NULL && +- CMPSADDR(sel->src, p->src) != 0) ++ cmpsaddr(sel->src, p->src) != 0) + continue; + + if (sel->dst != NULL && +- CMPSADDR(sel->dst, p->dst) != 0) ++ cmpsaddr(sel->dst, p->dst) != 0) + continue; + } + +@@ -586,8 +581,8 @@ getph2byid(src, dst, spid) + + LIST_FOREACH(p, &ph2tree, chain) { + if (spid == p->spid && +- cmpsaddrwild(src, p->src) == 0 && +- cmpsaddrwild(dst, p->dst) == 0){ ++ cmpsaddr(src, p->src) == 0 && ++ cmpsaddr(dst, p->dst) == 0){ + /* Sanity check to detect zombie handlers + * XXX Sould be done "somewhere" more interesting, + * because we have lots of getph2byxxxx(), but this one +@@ -614,8 +609,8 @@ getph2bysaddr(src, dst) + struct ph2handle *p; + + LIST_FOREACH(p, &ph2tree, chain) { +- if (cmpsaddrstrict(src, p->src) == 0 && +- cmpsaddrstrict(dst, p->dst) == 0) ++ if (cmpsaddr(src, p->src) == 0 && ++ cmpsaddr(dst, p->dst) == 0) + return p; + } + +@@ -918,7 +913,7 @@ getcontacted(remote) + struct contacted *p; + + LIST_FOREACH(p, &ctdtree, chain) { +- if (cmpsaddrstrict(remote, p->remote) == 0) ++ if (cmpsaddr(remote, p->remote) == 0) + return p; + } + +@@ -997,7 +992,7 @@ check_recvdpkt(remote, local, rbuf) + /* + * the packet was processed before, but the remote address mismatches. + */ +- if (cmpsaddrstrict(remote, r->remote) != 0) ++ if (cmpsaddr(remote, r->remote) != 0) + return 2; + + /* +diff --git a/src/racoon/handler.h b/src/racoon/handler.h +index c31753d..8f19c88 100644 +--- a/src/racoon/handler.h ++++ b/src/racoon/handler.h +@@ -467,7 +467,6 @@ extern int enumph1 __P((struct ph1selector *ph1sel, + void *enum_arg)); + + #define GETPH1_F_ESTABLISHED 0x0001 +-#define GETPH1_F_WITHOUT_PORTS 0x0002 + + extern struct ph1handle *getph1 __P((struct remoteconf *rmconf, + struct sockaddr *local, +@@ -476,10 +475,8 @@ extern struct ph1handle *getph1 __P((struct remoteconf *rmconf, + + #define getph1byaddr(local, remote, est) \ + getph1(NULL, local, remote, est ? GETPH1_F_ESTABLISHED : 0) +-#define getph1byaddrwop(local, remote) \ +- getph1(NULL, local, remote, GETPH1_F_WITHOUT_PORTS) +-#define getph1bydstaddrwop(remote) \ +- getph1(NULL, NULL, remote, GETPH1_F_WITHOUT_PORTS) ++#define getph1bydstaddr(remote) \ ++ getph1(NULL, NULL, remote, 0) + + #ifdef ENABLE_HYBRID + struct ph1handle *getph1bylogin __P((char *)); +diff --git a/src/racoon/isakmp.c b/src/racoon/isakmp.c +index fe51653..0de16d1 100644 +--- a/src/racoon/isakmp.c ++++ b/src/racoon/isakmp.c +@@ -475,8 +475,8 @@ isakmp_main(msg, remote, local) + /* Floating ports for NAT-T */ + if (NATT_AVAILABLE(iph1) && + ! (iph1->natt_flags & NAT_PORTS_CHANGED) && +- ((cmpsaddrstrict(iph1->remote, remote) != 0) || +- (cmpsaddrstrict(iph1->local, local) != 0))) ++ ((cmpsaddr(iph1->remote, remote) != 0) || ++ (cmpsaddr(iph1->local, local) != 0))) + { + /* prevent memory leak */ + racoon_free(iph1->remote); +@@ -517,7 +517,7 @@ isakmp_main(msg, remote, local) + #endif + + /* must be same addresses in one stream of a phase at least. */ +- if (cmpsaddrstrict(iph1->remote, remote) != 0) { ++ if (cmpsaddr(iph1->remote, remote) != 0) { + char *saddr_db, *saddr_act; + + saddr_db = racoon_strdup(saddr2str(iph1->remote)); +@@ -643,7 +643,7 @@ isakmp_main(msg, remote, local) + "exchange received.\n"); + return -1; + } +- if (cmpsaddrstrict(iph1->remote, remote) != 0) { ++ if (cmpsaddr(iph1->remote, remote) != 0) { + plog(LLV_WARNING, LOCATION, remote, + "remote address mismatched. " + "db=%s\n", +@@ -1275,6 +1275,12 @@ isakmp_ph2begin_i(iph1, iph2) + } + #endif + ++ /* fixup ph2 ports for this ph1 */ ++ if (extract_port(iph2->src) == 0) ++ set_port(iph2->src, extract_port(iph1->local)); ++ if (extract_port(iph2->dst) == 0) ++ set_port(iph2->dst, extract_port(iph1->remote)); ++ + /* found ISAKMP-SA. */ + plog(LLV_DEBUG, LOCATION, NULL, "===\n"); + plog(LLV_DEBUG, LOCATION, NULL, "begin QUICK mode.\n"); +@@ -1353,15 +1359,6 @@ isakmp_ph2begin_r(iph1, msg) + delph2(iph2); + return -1; + } +-#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT)) +- if (set_port(iph2->dst, 0) == NULL || +- set_port(iph2->src, 0) == NULL) { +- plog(LLV_ERROR, LOCATION, NULL, +- "invalid family: %d\n", iph2->dst->sa_family); +- delph2(iph2); +- return -1; +- } +-#endif + + /* add new entry to isakmp status table */ + insph2(iph2); +@@ -2186,23 +2183,12 @@ isakmp_post_acquire(iph2) + return 0; + } + +- /* +- * Search isakmp status table by address and port +- * If NAT-T is in use, consider null ports as a +- * wildcard and use IKE ports instead. ++ /* ++ * XXX Searching by IP addresses + ports might fail on ++ * some cases, we should use the ISAKMP identity to search ++ * matching ISAKMP. + */ +-#ifdef ENABLE_NATT +- if (!extract_port(iph2->src) && !extract_port(iph2->dst)) { +- if ((iph1 = getph1byaddrwop(iph2->src, iph2->dst)) != NULL) { +- set_port(iph2->src, extract_port(iph1->local)); +- set_port(iph2->dst, extract_port(iph1->remote)); +- } +- } else { +- iph1 = getph1byaddr(iph2->src, iph2->dst, 0); +- } +-#else + iph1 = getph1byaddr(iph2->src, iph2->dst, 0); +-#endif + + /* no ISAKMP-SA found. */ + if (iph1 == NULL) { +@@ -2380,26 +2366,8 @@ isakmp_chkph1there(iph2) + return; + } + +- /* +- * Search isakmp status table by address and port +- * If NAT-T is in use, consider null ports as a +- * wildcard and use IKE ports instead. +- */ +-#ifdef ENABLE_NATT +- if (!extract_port(iph2->src) && !extract_port(iph2->dst)) { +- plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: extract_port.\n"); +- if( (iph1 = getph1byaddrwop(iph2->src, iph2->dst)) != NULL){ +- plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: found a ph1 wop.\n"); +- } +- } else { +- plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: searching byaddr.\n"); +- iph1 = getph1byaddr(iph2->src, iph2->dst, 0); +- if(iph1 != NULL) +- plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: found byaddr.\n"); +- } +-#else ++ /* Search isakmp status table by address and port */ + iph1 = getph1byaddr(iph2->src, iph2->dst, 0); +-#endif + + /* XXX Even if ph1 as responder is there, should we not start + * phase 2 negotiation ? */ +@@ -3321,20 +3289,10 @@ purge_remote(iph1) + msg = next; + continue; + } ++ pk_fixup_sa_addresses(mhp); + src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); + dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); + +-#ifdef SADB_X_NAT_T_NEW_MAPPING +- if (PFKEY_ADDR_X_NATTYPE(mhp[SADB_X_EXT_NAT_T_TYPE])) { +- /* NAT-T is enabled for this SADB entry; copy +- * the ports from NAT-T extensions */ +- if(mhp[SADB_X_EXT_NAT_T_SPORT] != NULL) +- set_port(src, PFKEY_ADDR_X_PORT(mhp[SADB_X_EXT_NAT_T_SPORT])); +- if(mhp[SADB_X_EXT_NAT_T_DPORT] != NULL) +- set_port(dst, PFKEY_ADDR_X_PORT(mhp[SADB_X_EXT_NAT_T_DPORT])); +- } +-#endif +- + if (sa->sadb_sa_state != SADB_SASTATE_LARVAL && + sa->sadb_sa_state != SADB_SASTATE_MATURE && + sa->sadb_sa_state != SADB_SASTATE_DYING) { +@@ -3346,22 +3304,14 @@ purge_remote(iph1) + * check in/outbound SAs. + * Select only SAs where src == local and dst == remote (outgoing) + * or src == remote and dst == local (incoming). +- * XXX we sometime have src/dst ports set to 0 and want to match +- * iph1->local/remote with ports set to 500. This is a bug, see trac:2 + */ +-#ifdef ENABLE_NATT +- if ((cmpsaddrmagic(iph1->local, src) || cmpsaddrmagic(iph1->remote, dst)) && +- (cmpsaddrmagic(iph1->local, dst) || cmpsaddrmagic(iph1->remote, src))) { +- msg = next; +- continue; +- } +-#else +- if ((CMPSADDR(iph1->local, src) || CMPSADDR(iph1->remote, dst)) && +- (CMPSADDR(iph1->local, dst) || CMPSADDR(iph1->remote, src))) { ++ if ((cmpsaddr(iph1->local, src) || ++ cmpsaddr(iph1->remote, dst)) && ++ (cmpsaddr(iph1->local, dst) || ++ cmpsaddr(iph1->remote, src))) { + msg = next; + continue; + } +-#endif + + proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype); + iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi); +diff --git a/src/racoon/isakmp_cfg.c b/src/racoon/isakmp_cfg.c +index 62916f8..df763f8 100644 +--- a/src/racoon/isakmp_cfg.c ++++ b/src/racoon/isakmp_cfg.c +@@ -1151,15 +1151,6 @@ isakmp_cfg_send(iph1, payload, np, flags, new_exchange) + goto end; + } + +-#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT)) +- if (set_port(iph2->dst, 0) == NULL || +- set_port(iph2->src, 0) == NULL) { +- plog(LLV_ERROR, LOCATION, NULL, +- "invalid family: %d\n", iph1->remote->sa_family); +- delph2(iph2); +- goto end; +- } +-#endif + iph2->side = INITIATOR; + iph2->status = PHASE2ST_START; + +diff --git a/src/racoon/isakmp_inf.c b/src/racoon/isakmp_inf.c +index a712825..6fa3498 100644 +--- a/src/racoon/isakmp_inf.c ++++ b/src/racoon/isakmp_inf.c +@@ -903,15 +903,6 @@ isakmp_info_send_common(iph1, payload, np, flags) + delph2(iph2); + goto end; + } +-#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT)) +- if (set_port(iph2->dst, 0) == NULL || +- set_port(iph2->src, 0) == NULL) { +- plog(LLV_ERROR, LOCATION, NULL, +- "invalid family: %d\n", iph1->remote->sa_family); +- delph2(iph2); +- goto end; +- } +-#endif + iph2->side = INITIATOR; + iph2->status = PHASE2ST_START; + iph2->msgid = isakmp_newmsgid2(iph1); +@@ -1127,9 +1118,6 @@ purge_ipsec_spi(dst0, proto, spi, n) + u_int64_t created; + size_t i; + caddr_t mhp[SADB_EXT_MAX + 1]; +-#ifdef ENABLE_NATT +- int natt_port_forced; +-#endif + + plog(LLV_DEBUG2, LOCATION, NULL, + "purge_ipsec_spi:\n"); +@@ -1169,6 +1157,7 @@ purge_ipsec_spi(dst0, proto, spi, n) + msg = next; + continue; + } ++ pk_fixup_sa_addresses(mhp); + src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); + dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); + lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD]; +@@ -1182,28 +1171,7 @@ purge_ipsec_spi(dst0, proto, spi, n) + msg = next; + continue; + } +-#ifdef ENABLE_NATT +- if (PFKEY_ADDR_X_NATTYPE(mhp[SADB_X_EXT_NAT_T_TYPE])) { +- /* NAT-T is enabled for this SADB entry; copy +- * the ports from NAT-T extensions */ +- if (extract_port(src) == 0 && +- mhp[SADB_X_EXT_NAT_T_SPORT] != NULL) { +- set_port(src, PFKEY_ADDR_X_PORT(mhp[SADB_X_EXT_NAT_T_SPORT])); +- } + +- if (extract_port(dst) == 0 && +- mhp[SADB_X_EXT_NAT_T_DPORT] != NULL) { +- set_port(dst, PFKEY_ADDR_X_PORT(mhp[SADB_X_EXT_NAT_T_DPORT])); +- } +- natt_port_forced = 0; +- } else { +- /* Force default UDP ports, so +- * CMPSADDR will match SAs with NO encapsulation */ +- set_port(src, PORT_ISAKMP); +- set_port(dst, PORT_ISAKMP); +- natt_port_forced = 1; +- } +-#endif + plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(src)); + plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(dst)); + +@@ -1211,19 +1179,11 @@ purge_ipsec_spi(dst0, proto, spi, n) + + /* don't delete inbound SAs at the moment */ + /* XXX should we remove SAs with opposite direction as well? */ +- if (CMPSADDR(dst0, dst)) { ++ if (cmpsaddr(dst0, dst)) { + msg = next; + continue; + } + +-#ifdef ENABLE_NATT +- if (natt_port_forced) { +- /* Set back port to 0 if it was forced +- * to default UDP port */ +- set_port(src, 0); +- set_port(dst, 0); +- } +-#endif + for (i = 0; i < n; i++) { + plog(LLV_DEBUG, LOCATION, NULL, + "check spi(packet)=%u spi(db)=%u.\n", +@@ -1354,37 +1314,33 @@ isakmp_info_recv_initialcontact(iph1, protectedph2) + msg = (struct sadb_msg *)buf->v; + end = (struct sadb_msg *)(buf->v + buf->l); + +- while (msg < end) { ++ for (; msg < end; msg = next) { + if ((msg->sadb_msg_len << 3) < sizeof(*msg)) + break; ++ + next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3)); +- if (msg->sadb_msg_type != SADB_DUMP) { +- msg = next; ++ if (msg->sadb_msg_type != SADB_DUMP) + continue; +- } + + if (pfkey_align(msg, mhp) || pfkey_check(mhp)) { + plog(LLV_ERROR, LOCATION, NULL, + "pfkey_check (%s)\n", ipsec_strerror()); +- msg = next; + continue; + } + + if (mhp[SADB_EXT_SA] == NULL + || mhp[SADB_EXT_ADDRESS_SRC] == NULL +- || mhp[SADB_EXT_ADDRESS_DST] == NULL) { +- msg = next; ++ || mhp[SADB_EXT_ADDRESS_DST] == NULL) + continue; +- } ++ + sa = (struct sadb_sa *)mhp[SADB_EXT_SA]; ++ pk_fixup_sa_addresses(mhp); + src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); + dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); + + if (sa->sadb_sa_state != SADB_SASTATE_MATURE +- && sa->sadb_sa_state != SADB_SASTATE_DYING) { +- msg = next; ++ && sa->sadb_sa_state != SADB_SASTATE_DYING) + continue; +- } + + /* + * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that +@@ -1394,39 +1350,18 @@ isakmp_info_recv_initialcontact(iph1, protectedph2) + * racoon only deletes SA which is matched both the + * source address and the destination accress. + */ +-#ifdef ENABLE_NATT +- /* +- * XXX RFC 3947 says that whe MUST NOT use IP+port to find old SAs +- * from this peer ! +- */ +- if(iph1->natt_flags & NAT_DETECTED){ +- if (CMPSADDR(iph1->local, src) == 0 && +- CMPSADDR(iph1->remote, dst) == 0) +- ; +- else if (CMPSADDR(iph1->remote, src) == 0 && +- CMPSADDR(iph1->local, dst) == 0) +- ; +- else { +- msg = next; +- continue; +- } +- } else +-#endif +- /* If there is no NAT-T, we don't have to check addr + port... +- * XXX what about a configuration with a remote peers which is not +- * NATed, but which NATs some other peers ? +- * Here, the INITIAl-CONTACT would also flush all those NATed peers !! +- */ +- if (cmpsaddrwop(iph1->local, src) == 0 && +- cmpsaddrwop(iph1->remote, dst) == 0) +- ; +- else if (cmpsaddrwop(iph1->remote, src) == 0 && +- cmpsaddrwop(iph1->local, dst) == 0) +- ; +- else { +- msg = next; ++ ++ /* ++ * Check that the IP and port match. But this is not optimal, ++ * since NAT-T can make the peer have multiple different ++ * ports. Correct thing to do is delete all entries with ++ * same identity. -TT ++ */ ++ if ((cmpsaddr(iph1->local, src) != 0 || ++ cmpsaddr(iph1->remote, dst) != 0) && ++ (cmpsaddr(iph1->local, dst) != 0 || ++ cmpsaddr(iph1->remote, src) != 0)) + continue; +- } + + /* + * Make sure this is an SATYPE that we manage. +@@ -1438,10 +1373,8 @@ isakmp_info_recv_initialcontact(iph1, protectedph2) + msg->sadb_msg_satype) + break; + } +- if (i == pfkey_nsatypes) { +- msg = next; ++ if (i == pfkey_nsatypes) + continue; +- } + + plog(LLV_INFO, LOCATION, NULL, + "purging spi=%u.\n", ntohl(sa->sadb_sa_spi)); +@@ -1461,8 +1394,6 @@ isakmp_info_recv_initialcontact(iph1, protectedph2) + remph2(iph2); + delph2(iph2); + } +- +- msg = next; + } + + vfree(buf); +diff --git a/src/racoon/isakmp_quick.c b/src/racoon/isakmp_quick.c +index 804c1bf..46c84c1 100644 +--- a/src/racoon/isakmp_quick.c ++++ b/src/racoon/isakmp_quick.c +@@ -610,17 +610,19 @@ quick_i2recv(iph2, msg0) + error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED; + goto end; + } ++#ifdef ENABLE_NATT ++ set_port(iph2->natoa_src, ++ extract_port((struct sockaddr *) &proposed_addr)); ++#endif + +- if (cmpsaddrstrict((struct sockaddr *) &proposed_addr, +- (struct sockaddr *) &got_addr) == 0) { ++ if (cmpsaddr((struct sockaddr *) &proposed_addr, ++ (struct sockaddr *) &got_addr) == 0) { + plog(LLV_DEBUG, LOCATION, NULL, + "IDci matches proposal.\n"); + #ifdef ENABLE_NATT + } else if (iph2->natoa_src != NULL +- && cmpsaddrwop(iph2->natoa_src, +- (struct sockaddr *) &got_addr) == 0 +- && extract_port((struct sockaddr *) &proposed_addr) == +- extract_port((struct sockaddr *) &got_addr)) { ++ && cmpsaddr(iph2->natoa_src, ++ (struct sockaddr *) &got_addr) == 0) { + plog(LLV_DEBUG, LOCATION, NULL, + "IDci matches NAT-OAi.\n"); + #endif +@@ -656,16 +658,19 @@ quick_i2recv(iph2, msg0) + goto end; + } + +- if (cmpsaddrstrict((struct sockaddr *) &proposed_addr, +- (struct sockaddr *) &got_addr) == 0) { ++#ifdef ENABLE_NATT ++ set_port(iph2->natoa_dst, ++ extract_port((struct sockaddr *) &proposed_addr)); ++#endif ++ ++ if (cmpsaddr((struct sockaddr *) &proposed_addr, ++ (struct sockaddr *) &got_addr) == 0) { + plog(LLV_DEBUG, LOCATION, NULL, + "IDcr matches proposal.\n"); + #ifdef ENABLE_NATT + } else if (iph2->natoa_dst != NULL +- && cmpsaddrwop(iph2->natoa_dst, +- (struct sockaddr *) &got_addr) == 0 +- && extract_port((struct sockaddr *) &proposed_addr) == +- extract_port((struct sockaddr *) &got_addr)) { ++ && cmpsaddr(iph2->natoa_dst, ++ (struct sockaddr *) &got_addr) == 0) { + plog(LLV_DEBUG, LOCATION, NULL, + "IDcr matches NAT-OAr.\n"); + #endif +diff --git a/src/racoon/nattraversal.c b/src/racoon/nattraversal.c +index f23341a..92095de 100644 +--- a/src/racoon/nattraversal.c ++++ b/src/racoon/nattraversal.c +@@ -379,8 +379,8 @@ natt_keepalive_add (struct sockaddr *src, struct sockaddr *dst) + struct natt_ka_addrs *ka = NULL, *new_addr; + + TAILQ_FOREACH (ka, &ka_tree, chain) { +- if (cmpsaddrstrict(ka->src, src) == 0 && +- cmpsaddrstrict(ka->dst, dst) == 0) { ++ if (cmpsaddr(ka->src, src) == 0 && ++ cmpsaddr(ka->dst, dst) == 0) { + ka->in_use++; + plog (LLV_INFO, LOCATION, NULL, "KA found: %s (in_use=%u)\n", + saddr2str_fromto("%s->%s", src, dst), ka->in_use); +@@ -443,8 +443,8 @@ natt_keepalive_remove (struct sockaddr *src, struct sockaddr *dst) + plog (LLV_DEBUG, LOCATION, NULL, "KA tree dump: %s (in_use=%u)\n", + saddr2str_fromto("%s->%s", src, dst), ka->in_use); + +- if (cmpsaddrstrict(ka->src, src) == 0 && +- cmpsaddrstrict(ka->dst, dst) == 0 && ++ if (cmpsaddr(ka->src, src) == 0 && ++ cmpsaddr(ka->dst, dst) == 0 && + -- ka->in_use <= 0) { + + plog (LLV_DEBUG, LOCATION, NULL, "KA removing this one...\n"); +diff --git a/src/racoon/pfkey.c b/src/racoon/pfkey.c +index c210c5e..3778ef2 100644 +--- a/src/racoon/pfkey.c ++++ b/src/racoon/pfkey.c +@@ -774,8 +774,12 @@ pk_fixup_sa_addresses(mhp) + caddr_t *mhp; + { + struct sockaddr *src, *dst; ++ + src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); + dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); ++ set_port(src, PORT_ISAKMP); ++ set_port(dst, PORT_ISAKMP); ++ + #ifdef ENABLE_NATT + if (PFKEY_ADDR_X_NATTYPE(mhp[SADB_X_EXT_NAT_T_TYPE])) { + /* NAT-T is enabled for this SADB entry; copy +@@ -785,9 +789,6 @@ pk_fixup_sa_addresses(mhp) + if(mhp[SADB_X_EXT_NAT_T_DPORT] != NULL) + set_port(dst, PFKEY_ADDR_X_PORT(mhp[SADB_X_EXT_NAT_T_DPORT])); + } +-#else +- set_port(src, 0); +- set_port(dst, 0); + #endif + } + +@@ -949,10 +950,6 @@ pk_sendgetspi(iph2) + dport=extract_port(dst); + } + #endif +- /* Always remove port information, it will be sent in +- * SADB_X_EXT_NAT_T_[S|D]PORT if needed */ +- set_port(src, 0); +- set_port(dst, 0); + + plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_getspi\n"); + if (pfkey_send_getspi_nat( +@@ -1009,6 +1006,7 @@ pk_recvgetspi(mhp) + } + msg = (struct sadb_msg *)mhp[0]; + sa = (struct sadb_sa *)mhp[SADB_EXT_SA]; ++ pk_fixup_sa_addresses(mhp); + dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); /* note SA dir */ + src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); + +@@ -1183,18 +1181,14 @@ pk_sendupdate(iph2) + #ifdef ENABLE_NATT + if (pr->udp_encap) { + sa_args.l_natt_type = iph2->ph1->natt_options->encaps_type; +- sa_args.l_natt_sport = extract_port (iph2->ph1->remote); +- sa_args.l_natt_dport = extract_port (iph2->ph1->local); ++ sa_args.l_natt_sport = extract_port(iph2->ph1->remote); ++ sa_args.l_natt_dport = extract_port(iph2->ph1->local); + sa_args.l_natt_oa = iph2->natoa_src; + #ifdef SADB_X_EXT_NAT_T_FRAG + sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag; + #endif + } + #endif +- /* Always remove port information, it will be sent in +- * SADB_X_EXT_NAT_T_[S|D]PORT if needed */ +- set_port(sa_args.src, 0); +- set_port(sa_args.dst, 0); + + /* more info to fill in */ + sa_args.spi = pr->spi; +@@ -1358,14 +1352,6 @@ pk_recvupdate(mhp) + /* turn off schedule */ + sched_cancel(&iph2->scr); + +- /* Force the update of ph2's ports, as there is at least one +- * situation where they'll mismatch with ph1's values +- */ +-#ifdef ENABLE_NATT +- set_port(iph2->src, extract_port(iph2->ph1->local)); +- set_port(iph2->dst, extract_port(iph2->ph1->remote)); +-#endif +- + /* + * since we are going to reuse the phase2 handler, we need to + * remain it and refresh all the references between ph1 and ph2 to use. +@@ -1418,7 +1404,7 @@ pk_sendadd(iph2) + racoon_free(sa_args.src); + racoon_free(sa_args.dst); + return -1; +- } ++ } + + for (pr = iph2->approval->head; pr != NULL; pr = pr->next) { + /* validity check */ +@@ -1490,11 +1476,6 @@ pk_sendadd(iph2) + #endif + } + #endif +- /* Always remove port information, it will be sent in +- * SADB_X_EXT_NAT_T_[S|D]PORT if needed */ +- set_port(sa_args.src, 0); +- set_port(sa_args.dst, 0); +- + /* more info to fill in */ + sa_args.spi = pr->spi_p; + sa_args.reqid = pr->reqid_out; +@@ -1559,6 +1540,7 @@ pk_recvadd(mhp) + return -1; + } + msg = (struct sadb_msg *)mhp[0]; ++ pk_fixup_sa_addresses(mhp); + src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); + dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); + sa = (struct sadb_sa *)mhp[SADB_EXT_SA]; +@@ -1749,7 +1731,9 @@ pk_recvacquire(mhp) + } + msg = (struct sadb_msg *)mhp[0]; + xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY]; +- pk_fixup_sa_addresses(mhp); ++ /* acquire does not have nat-t ports; so do not bother setting ++ * the default port 500; just use the port zero for wildcard ++ * matching the get a valid natted destination */ + sp_src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); + sp_dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]); + +@@ -2884,8 +2868,8 @@ migrate_ph1_ike_addresses(iph1, arg) + u_int16_t port; + + /* Already up-to-date? */ +- if (cmpsaddrwop(iph1->local, ma->local) == 0 && +- cmpsaddrwop(iph1->remote, ma->remote) == 0) ++ if (cmpsaddr(iph1->local, ma->local) == 0 && ++ cmpsaddr(iph1->remote, ma->remote) == 0) + return 0; + + if (iph1->status < PHASE1ST_ESTABLISHED) { +@@ -2985,8 +2969,8 @@ migrate_ph2_ike_addresses(iph2, arg) + migrate_ph1_ike_addresses(iph2->ph1, arg); + + /* Already up-to-date? */ +- if (CMPSADDR(iph2->src, ma->local) == 0 && +- CMPSADDR(iph2->dst, ma->remote) == 0) ++ if (cmpsaddr(iph2->src, ma->local) == 0 && ++ cmpsaddr(iph2->dst, ma->remote) == 0) + return 0; + + /* save src/dst as sa_src/sa_dst before rewriting */ +@@ -3206,8 +3190,8 @@ migrate_ph2_one_isr(spid, isr_cur, xisr_old, xisr_new) + "changing address families (%d to %d) for endpoints.\n", + osaddr->sa_family, nsaddr->sa_family); + +- if (CMPSADDR(osaddr, (struct sockaddr *)&saidx->src) || +- CMPSADDR(odaddr, (struct sockaddr *)&saidx->dst)) { ++ if (cmpsaddr(osaddr, (struct sockaddr *) &saidx->src) || ++ cmpsaddr(odaddr, (struct sockaddr *) &saidx->dst)) { + plog(LLV_DEBUG, LOCATION, NULL, "SADB_X_MIGRATE: " + "mismatch of addresses in saidx and xisr.\n"); + return -1; +diff --git a/src/racoon/policy.c b/src/racoon/policy.c +index 850fa6b..058753f 100644 +--- a/src/racoon/policy.c ++++ b/src/racoon/policy.c +@@ -141,16 +141,18 @@ getsp_r(spidx, iph2) + saddr2str(iph2->src)); + plog(LLV_DEBUG, LOCATION, NULL, "src2: %s\n", + saddr2str((struct sockaddr *)&spidx->src)); +- if (cmpsaddrwop(iph2->src, (struct sockaddr *)&spidx->src) +- || spidx->prefs != prefixlen) ++ ++ if (cmpsaddr(iph2->src, (struct sockaddr *) &spidx->src) || ++ spidx->prefs != prefixlen) + return NULL; + + plog(LLV_DEBUG, LOCATION, NULL, "dst1: %s\n", + saddr2str(iph2->dst)); + plog(LLV_DEBUG, LOCATION, NULL, "dst2: %s\n", + saddr2str((struct sockaddr *)&spidx->dst)); +- if (cmpsaddrwop(iph2->dst, (struct sockaddr *)&spidx->dst) +- || spidx->prefd != prefixlen) ++ ++ if (cmpsaddr(iph2->dst, (struct sockaddr *) &spidx->dst) || ++ spidx->prefd != prefixlen) + return NULL; + + plog(LLV_DEBUG, LOCATION, NULL, "looks to be transport mode\n"); +@@ -198,11 +200,11 @@ cmpspidxstrict(a, b) + || a->ul_proto != b->ul_proto) + return 1; + +- if (cmpsaddrstrict((struct sockaddr *)&a->src, +- (struct sockaddr *)&b->src)) ++ if (cmpsaddr((struct sockaddr *) &a->src, ++ (struct sockaddr *) &b->src)) + return 1; +- if (cmpsaddrstrict((struct sockaddr *)&a->dst, +- (struct sockaddr *)&b->dst)) ++ if (cmpsaddr((struct sockaddr *) &a->dst, ++ (struct sockaddr *) &b->dst)) + return 1; + + #ifdef HAVE_SECCTX +@@ -259,7 +261,7 @@ cmpspidxwild(a, b) + a, b->prefs, saddr2str((struct sockaddr *)&sa1)); + plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n", + b, b->prefs, saddr2str((struct sockaddr *)&sa2)); +- if (cmpsaddrwild((struct sockaddr *)&sa1, (struct sockaddr *)&sa2)) ++ if (cmpsaddr((struct sockaddr *)&sa1, (struct sockaddr *)&sa2)) + return 1; + + #ifndef __linux__ +@@ -277,7 +279,7 @@ cmpspidxwild(a, b) + a, b->prefd, saddr2str((struct sockaddr *)&sa1)); + plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n", + b, b->prefd, saddr2str((struct sockaddr *)&sa2)); +- if (cmpsaddrwild((struct sockaddr *)&sa1, (struct sockaddr *)&sa2)) ++ if (cmpsaddr((struct sockaddr *)&sa1, (struct sockaddr *)&sa2)) + return 1; + + #ifdef HAVE_SECCTX +diff --git a/src/racoon/remoteconf.c b/src/racoon/remoteconf.c +index 73d80bc..88c622c 100644 +--- a/src/racoon/remoteconf.c ++++ b/src/racoon/remoteconf.c +@@ -200,15 +200,9 @@ rmconf_match_type(rmsel, rmconf) + /* Check address */ + if (rmsel->remote != NULL) { + if (rmconf->remote->sa_family != AF_UNSPEC) { +- if (rmsel->flags & GETRMCONF_F_NO_PORTS) { +- if (cmpsaddrwop(rmsel->remote, +- rmconf->remote) != 0) +- return 0; +- } else { +- if (cmpsaddrstrict(rmsel->remote, +- rmconf->remote) != 0) +- return 0; +- } ++ if (cmpsaddr(rmsel->remote, rmconf->remote) != 0) ++ return 0; ++ + /* Address matched */ + ret = 2; + } +@@ -262,7 +256,7 @@ void rmconf_selector_from_ph1(rmsel, iph1) + struct ph1handle *iph1; + { + memset(rmsel, 0, sizeof(*rmsel)); +- rmsel->flags = GETRMCONF_F_NO_PORTS; ++ rmsel->flags = 0; + rmsel->remote = iph1->remote; + rmsel->etype = iph1->etype; + rmsel->approval = iph1->approval; +@@ -357,22 +351,8 @@ getrmconf(remote, flags) + int n = 0; + + memset(&ctx, 0, sizeof(ctx)); +- ctx.sel.flags = flags | GETRMCONF_F_NO_PORTS; ++ ctx.sel.flags = flags; + ctx.sel.remote = remote; +-#ifndef ENABLE_NATT +- /* +- * We never have ports set in our remote configurations, but when +- * NAT-T is enabled, the kernel can have policies with ports and +- * send us an acquire message for a destination that has a port set. +- * If we do this port check here, we don't find the remote config. +- * +- * In an ideal world, we would be able to have remote conf with +- * port, and the port could be a wildcard. That test could be used. +- */ +- if (remote->sa_family != AF_UNSPEC && +- extract_port(remote) != IPSEC_PORT_ANY) +- ctx.sel.flags &= ~GETRMCONF_F_NO_PORTS; +-#endif /* ENABLE_NATT */ + + if (enumrmconf(&ctx.sel, rmconf_find, &ctx) != 0) { + plog(LLV_ERROR, LOCATION, remote, +diff --git a/src/racoon/remoteconf.h b/src/racoon/remoteconf.h +index 38faf03..b2e9e4a 100644 +--- a/src/racoon/remoteconf.h ++++ b/src/racoon/remoteconf.h +@@ -189,8 +189,7 @@ extern int enumrmconf __P((struct rmconfselector *rmsel, + void *enum_arg)); + + #define GETRMCONF_F_NO_ANONYMOUS 0x0001 +-#define GETRMCONF_F_NO_PORTS 0x0002 +-#define GETRMCONF_F_NO_PASSIVE 0x0004 ++#define GETRMCONF_F_NO_PASSIVE 0x0002 + + #define RMCONF_ERR_MULTIPLE ((struct remoteconf *) -1) + +diff --git a/src/racoon/sockmisc.c b/src/racoon/sockmisc.c +index 5c1f9c7..2bc2177 100644 +--- a/src/racoon/sockmisc.c ++++ b/src/racoon/sockmisc.c +@@ -80,87 +77,28 @@ + const int niflags = 0; + + /* +- * compare two sockaddr without port number. +- * OUT: 0: equal. +- * 1: not equal. +- */ +-int +-cmpsaddrwop(addr1, addr2) +- const struct sockaddr *addr1; +- const struct sockaddr *addr2; +-{ +- caddr_t sa1, sa2; +- +- if (addr1 == 0 && addr2 == 0) +- return 0; +- if (addr1 == 0 || addr2 == 0) +- return 1; +- +-#ifdef __linux__ +- if (addr1->sa_family != addr2->sa_family) +- return 1; +-#else +- if (addr1->sa_len != addr2->sa_len +- || addr1->sa_family != addr2->sa_family) +- return 1; +- +-#endif /* __linux__ */ +- +- switch (addr1->sa_family) { +- case AF_UNSPEC: +- break; +- case AF_INET: +- sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr; +- sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr; +- if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0) +- return 1; +- break; +-#ifdef INET6 +- case AF_INET6: +- sa1 = (caddr_t)&((struct sockaddr_in6 *)addr1)->sin6_addr; +- sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr; +- if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0) +- return 1; +- if (((struct sockaddr_in6 *)addr1)->sin6_scope_id != +- ((struct sockaddr_in6 *)addr2)->sin6_scope_id) +- return 1; +- break; +-#endif +- default: +- return 1; +- } +- +- return 0; +-} +- +-/* + * compare two sockaddr with port, taking care wildcard. + * addr1 is a subject address, addr2 is in a database entry. + * OUT: 0: equal. + * 1: not equal. + */ + int +-cmpsaddrwild(addr1, addr2) ++cmpsaddr(addr1, addr2) + const struct sockaddr *addr1; + const struct sockaddr *addr2; + { + caddr_t sa1, sa2; + u_short port1, port2; + +- if (addr1 == 0 && addr2 == 0) +- return 0; +- if (addr1 == 0 || addr2 == 0) +- return 1; ++ if (addr1 == NULL && addr2 == NULL) ++ return CMPSADDR_MATCH; + +-#ifdef __linux__ +- if (addr1->sa_family != addr2->sa_family) +- return 1; +-#else +- if (addr1->sa_len != addr2->sa_len +- || addr1->sa_family != addr2->sa_family) +- return 1; ++ if (addr1 == NULL || addr2 == NULL) ++ return CMPSADDR_MISMATCH; + +-#endif /* __linux__ */ ++ if (addr1->sa_family != addr2->sa_family || ++ sysdep_sa_len(addr1) != sysdep_sa_len(addr2)) ++ return CMPSADDR_MISMATCH; + + switch (addr1->sa_family) { + case AF_UNSPEC: +@@ -170,12 +108,8 @@ cmpsaddrwild(addr1, addr2) + sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr; + port1 = ((struct sockaddr_in *)addr1)->sin_port; + port2 = ((struct sockaddr_in *)addr2)->sin_port; +- if (!(port1 == IPSEC_PORT_ANY || +- port2 == IPSEC_PORT_ANY || +- port1 == port2)) +- return 1; + if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0) +- return 1; ++ return CMPSADDR_MISMATCH; + break; + #ifdef INET6 + case AF_INET6: +@@ -183,155 +117,23 @@ cmpsaddrwild(addr1, addr2) + sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr; + port1 = ((struct sockaddr_in6 *)addr1)->sin6_port; + port2 = ((struct sockaddr_in6 *)addr2)->sin6_port; +- if (!(port1 == IPSEC_PORT_ANY || +- port2 == IPSEC_PORT_ANY || +- port1 == port2)) +- return 1; + if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0) +- return 1; ++ return CMPSADDR_MISMATCH; + if (((struct sockaddr_in6 *)addr1)->sin6_scope_id != + ((struct sockaddr_in6 *)addr2)->sin6_scope_id) +- return 1; ++ return CMPSADDR_MISMATCH; + break; + #endif + default: +- return 1; ++ return CMPSADDR_MISMATCH; + } + +- return 0; +-} +- +-/* +- * compare two sockaddr with port, taking care specific situation: +- * one addr has 0 as port, and the other has 500 (network order), return equal +- * OUT: 0: equal. +- * 1: not equal. +- */ +-int +-cmpsaddrmagic(addr1, addr2) +- const struct sockaddr *addr1; +- const struct sockaddr *addr2; +-{ +- caddr_t sa1, sa2; +- u_short port1, port2; +- +- if (addr1 == 0 && addr2 == 0) +- return 0; +- if (addr1 == 0 || addr2 == 0) +- return 1; +- +-#ifdef __linux__ +- if (addr1->sa_family != addr2->sa_family) +- return 1; +-#else +- if (addr1->sa_len != addr2->sa_len +- || addr1->sa_family != addr2->sa_family) +- return 1; ++ if (port1 == port2 || ++ port1 == IPSEC_PORT_ANY || ++ port2 == IPSEC_PORT_ANY) ++ return CMPSADDR_MATCH; + +-#endif /* __linux__ */ +- +- switch (addr1->sa_family) { +- case AF_UNSPEC: +- break; +- case AF_INET: +- sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr; +- sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr; +- port1 = ((struct sockaddr_in *)addr1)->sin_port; +- port2 = ((struct sockaddr_in *)addr2)->sin_port; +- plog(LLV_DEBUG, LOCATION, NULL, "cmpsaddr_magic: port1 == %d, port2 == %d\n", port1, port2); +- if (!((port1 == IPSEC_PORT_ANY && port2 == ntohs(PORT_ISAKMP)) || +- (port2 == IPSEC_PORT_ANY && port1 == ntohs(PORT_ISAKMP)) || +- (port1 == port2))){ +- plog(LLV_DEBUG, LOCATION, NULL, "cmpsaddr_magic: ports mismatch\n"); +- return 1; +- } +- plog(LLV_DEBUG, LOCATION, NULL, "cmpsaddr_magic: ports matched\n"); +- if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0) +- return 1; +- break; +-#ifdef INET6 +- case AF_INET6: +- sa1 = (caddr_t)&((struct sockaddr_in6 *)addr1)->sin6_addr; +- sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr; +- port1 = ((struct sockaddr_in6 *)addr1)->sin6_port; +- port2 = ((struct sockaddr_in6 *)addr2)->sin6_port; +- if (!((port1 == IPSEC_PORT_ANY && port2 == PORT_ISAKMP) || +- (port2 == IPSEC_PORT_ANY && port1 == PORT_ISAKMP) || +- (port1 == port2))) +- return 1; +- if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0) +- return 1; +- if (((struct sockaddr_in6 *)addr1)->sin6_scope_id != +- ((struct sockaddr_in6 *)addr2)->sin6_scope_id) +- return 1; +- break; +-#endif +- default: +- return 1; +- } +- +- return 0; +-} +- +-/* +- * compare two sockaddr with strict match on port. +- * OUT: 0: equal. +- * 1: not equal. +- */ +-int +-cmpsaddrstrict(addr1, addr2) +- const struct sockaddr *addr1; +- const struct sockaddr *addr2; +-{ +- caddr_t sa1, sa2; +- u_short port1, port2; +- +- if (addr1 == 0 && addr2 == 0) +- return 0; +- if (addr1 == 0 || addr2 == 0) +- return 1; +- +-#ifdef __linux__ +- if (addr1->sa_family != addr2->sa_family) +- return 1; +-#else +- if (addr1->sa_len != addr2->sa_len +- || addr1->sa_family != addr2->sa_family) +- return 1; +- +-#endif /* __linux__ */ +- +- switch (addr1->sa_family) { +- case AF_INET: +- sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr; +- sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr; +- port1 = ((struct sockaddr_in *)addr1)->sin_port; +- port2 = ((struct sockaddr_in *)addr2)->sin_port; +- if (port1 != port2) +- return 1; +- if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0) +- return 1; +- break; +-#ifdef INET6 +- case AF_INET6: +- sa1 = (caddr_t)&((struct sockaddr_in6 *)addr1)->sin6_addr; +- sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr; +- port1 = ((struct sockaddr_in6 *)addr1)->sin6_port; +- port2 = ((struct sockaddr_in6 *)addr2)->sin6_port; +- if (port1 != port2) +- return 1; +- if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0) +- return 1; +- if (((struct sockaddr_in6 *)addr1)->sin6_scope_id != +- ((struct sockaddr_in6 *)addr2)->sin6_scope_id) +- return 1; +- break; +-#endif +- default: +- return 1; +- } +- +- return 0; ++ return CMPSADDR_WOP_MATCH; + } + + /* get local address against the destination. */ +@@ -1129,7 +931,7 @@ naddr_score(const struct netaddr *naddr, const struct sockaddr *saddr) + free(a2); + free(a3); + } +- if (cmpsaddrwop(&sa, &naddr->sa.sa) == 0) ++ if (cmpsaddr(&sa, &naddr->sa.sa) == 0) + return naddr->prefix + port_score; + + return -1; +diff --git a/src/racoon/sockmisc.h b/src/racoon/sockmisc.h +index fcc286f..0a58f44 100644 +--- a/src/racoon/sockmisc.h ++++ b/src/racoon/sockmisc.h +@@ -54,16 +54,11 @@ struct netaddr { + + extern const int niflags; + +-extern int cmpsaddrwop __P((const struct sockaddr *, const struct sockaddr *)); +-extern int cmpsaddrwild __P((const struct sockaddr *, const struct sockaddr *)); +-extern int cmpsaddrstrict __P((const struct sockaddr *, const struct sockaddr *)); +-extern int cmpsaddrmagic __P((const struct sockaddr *, const struct sockaddr *)); +- +-#ifdef ENABLE_NATT +-#define CMPSADDR(saddr1, saddr2) cmpsaddrstrict((saddr1), (saddr2)) +-#else +-#define CMPSADDR(saddr1, saddr2) cmpsaddrwop((saddr1), (saddr2)) +-#endif ++#define CMPSADDR_MATCH 0 ++#define CMPSADDR_WOP_MATCH 1 ++#define CMPSADDR_MISMATCH 2 ++ ++extern int cmpsaddr __P((const struct sockaddr *, const struct sockaddr *)); + + extern struct sockaddr *getlocaladdr __P((struct sockaddr *)); + +diff --git a/src/racoon/throttle.c b/src/racoon/throttle.c +index 5ab62c3..64b566b 100644 +--- a/src/racoon/throttle.c ++++ b/src/racoon/throttle.c +@@ -104,7 +104,7 @@ restart: + goto restart; + } + +- if (cmpsaddrwop(addr, (struct sockaddr *)&te->host) == 0) { ++ if (cmpsaddr(addr, (struct sockaddr *) &te->host) == 0) { + found = 1; + break; + } |