#include "alg_info.h"
#include "ike_alg.h"
#include "kernel_alg.h"
-#ifdef NAT_TRAVERSAL
#include "nat_traversal.h"
-#endif
-#ifdef VIRTUAL_IP
#include "virtual.h"
-#endif
/*
* are we sending Pluto's Vendor ID?
#endif /* !VENDORID */
/*
- * are we sending an XAUTH VID (Cisco Mode Config Interoperability)?
+ * are we sending an XAUTH VID?
*/
#ifdef XAUTH_VID
#define SEND_XAUTH_VID 1
#define SEND_XAUTH_VID 0
#endif /* !XAUTH_VID */
+/*
+ * are we sending a Cisco Unity VID?
+ */
+#ifdef CISCO_QUIRKS
+#define SEND_CISCO_UNITY_VID 1
+#else /* !CISCO_QUIRKS */
+#define SEND_CISCO_UNITY_VID 0
+#endif /* !CISCO_QUIRKS */
+
/* MAGIC: perform f, a function that returns notification_t
* and return from the ENCLOSING stf_status returning function if it fails.
*/
if (state == STATE_UNDEFINED)
state = st->st_state;
- if (IS_QUICK(state)) {
+ if (IS_QUICK(state))
+ {
p1st = find_phase1_state(st->st_connection, ISAKMP_SA_ESTABLISHED_STATES);
- if ((p1st == NULL) || (!IS_ISAKMP_SA_ESTABLISHED(p1st->st_state))) {
+ if ((p1st == NULL) || (!IS_ISAKMP_SA_ESTABLISHED(p1st->st_state)))
+ {
loglog(RC_LOG_SERIOUS,
"no Phase1 state for Quick mode notification");
return;
send_notification(st, type, p1st, generate_msgid(p1st),
st->st_icookie, st->st_rcookie, NULL, 0, PROTO_ISAKMP);
}
- else if (IS_ISAKMP_ENCRYPTED(state)) {
+ else if (IS_ISAKMP_ENCRYPTED(state) && st->st_enc_key.ptr != NULL)
+ {
send_notification(st, type, st, generate_msgid(st),
st->st_icookie, st->st_rcookie, NULL, 0, PROTO_ISAKMP);
}
- else {
+ else
+ {
/* no ISAKMP SA established - don't encrypt notification */
send_notification(st, type, NULL, 0,
st->st_icookie, st->st_rcookie, NULL, 0, PROTO_ISAKMP);
oldc = cur_connection;
set_cur_connection(dst->st_connection);
-#ifdef NAT_TRAVERSAL
+
if (nat_traversal_enabled)
nat_traversal_change_port_lookup(md, dst);
-#endif
+
loglog(RC_LOG_SERIOUS, "received Delete SA payload: "
"deleting ISAKMP State #%lu", dst->st_serialno);
delete_state(dst);
oldc = cur_connection;
set_cur_connection(rc);
-#ifdef NAT_TRAVERSAL
if (nat_traversal_enabled)
nat_traversal_change_port_lookup(md, dst);
-#endif
+
if (rc->newest_ipsec_sa == dst->st_serialno
&& (rc->policy & POLICY_UP))
{
/* determine how many Vendor ID payloads we will be sending */
if (SEND_PLUTO_VID)
vids_to_send++;
- if (SEND_XAUTH_VID)
+ if (SEND_CISCO_UNITY_VID)
vids_to_send++;
if (c->spd.this.cert.type == CERT_PGP)
vids_to_send++;
+ if (SEND_XAUTH_VID)
+ vids_to_send++;
/* always send DPD Vendor ID */
vids_to_send++;
-#ifdef NAT_TRAVERSAL
if (nat_traversal_enabled)
vids_to_send++;
-#endif
get_cookie(TRUE, st->st_icookie, COOKIE_SIZE, &c->spd.that.host_addr);
u_char *sa_start = rbody.cur;
lset_t auth_policy = policy & POLICY_ID_AUTH_MASK;
- if (!out_sa(&rbody, &oakley_sadb[auth_policy >> POLICY_ISAKMP_SHIFT]
- , st, TRUE, vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE))
+ if (!out_sa(&rbody, &oakley_sadb, st, TRUE
+ , vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE))
{
reset_cur_state();
return STF_INTERNAL_ERROR;
}
}
- /* if enabled send XAUTH Vendor ID */
- if (SEND_XAUTH_VID)
+ /* if enabled send Cisco Unity Vendor ID */
+ if (SEND_CISCO_UNITY_VID)
{
if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
- , &rbody, VID_MISC_XAUTH))
+ , &rbody, VID_CISCO_UNITY))
{
reset_cur_state();
return STF_INTERNAL_ERROR;
}
}
-
/* if we have an OpenPGP certificate we assume an
* OpenPGP peer and have to send the Vendor ID
*/
}
}
+ /* Announce our ability to do eXtended AUTHentication to the peer */
+ if (SEND_XAUTH_VID)
+ {
+ if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
+ , &rbody, VID_MISC_XAUTH))
+ {
+ reset_cur_state();
+ return STF_INTERNAL_ERROR;
+ }
+ }
+
/* Announce our ability to do Dead Peer Detection to the peer */
{
if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
}
}
-#ifdef NAT_TRAVERSAL
if (nat_traversal_enabled)
{
/* Add supported NAT-Traversal VID */
return STF_INTERNAL_ERROR;
}
}
-#endif
close_message(&rbody);
close_output_pbs(&reply);
switch (st->st_oakley.auth)
{
case OAKLEY_PRESHARED_KEY:
+ case XAUTHInitPreShared:
+ case XAUTHRespPreShared:
if (!skeyid_preshared(st))
return FALSE;
break;
case OAKLEY_RSA_SIG:
+ case XAUTHInitRSA:
+ case XAUTHRespRSA:
if (!skeyid_digisig(st))
return FALSE;
break;
{
char id_buf[BUF_LEN]; /* arbitrary limit on length of ID reported */
- (void) idtoa(&st->st_connection->spd.that.id, id_buf, sizeof(id_buf));
+ (void) idtoa(peer, id_buf, sizeof(id_buf));
if (s.best_ugh == NULL)
{
, replacing
, isakmp_sa->st_serialno);
-#ifdef NAT_TRAVERSAL
if (isakmp_sa->nat_traversal & NAT_T_DETECTED)
{
/* Duplicate nat_traversal status in new state */
np = (st->nat_traversal & NAT_T_WITH_RFC_VALUES) ?
ISAKMP_NEXT_NATOA_RFC : ISAKMP_NEXT_NATOA_DRAFTS;
}
-#endif
/* set up reply */
init_pbs(&reply, reply_buffer, sizeof(reply_buffer), "reply packet");
}
}
-#ifdef NAT_TRAVERSAL
/* Send NAT-OA if our address is NATed */
if (send_natoa)
{
return STF_INTERNAL_ERROR;
}
}
-#endif
/* finish computing HASH(1), inserting it in output */
(void) quick_mode_hash12(r_hashval, r_hash_start, rbody.cur
* Besides, there is no good reason for allowing these to be
* other than 0 in Phase 1.
*/
-#ifdef NAT_TRAVERSAL
if ((st->nat_traversal & NAT_T_WITH_PORT_FLOATING)
&& id->isaid_doi_specific_a == IPPROTO_UDP
&& (id->isaid_doi_specific_b == 0 || id->isaid_doi_specific_b == NAT_T_IKE_FLOAT_PORT))
"accepted with port_floating NAT-T",
id->isaid_doi_specific_a, id->isaid_doi_specific_b);
}
- else
-#endif
- if (!(id->isaid_doi_specific_a == 0 && id->isaid_doi_specific_b == 0)
- && !(id->isaid_doi_specific_a == IPPROTO_UDP && id->isaid_doi_specific_b == IKE_UDP_PORT))
+ else if (!(id->isaid_doi_specific_a == 0 && id->isaid_doi_specific_b == 0)
+ && !(id->isaid_doi_specific_a == IPPROTO_UDP && id->isaid_doi_specific_b == IKE_UDP_PORT))
{
loglog(RC_LOG_SERIOUS, "protocol/port in Phase 1 ID Payload must be 0/0 or %d/%d"
" but are %d/%d"
DBG(DBG_CONTROL,
char buf[BUF_LEN];
- dntoa_or_null(buf, BUF_LEN, c->spd.this.ca, "%none");
+ dntoa_or_null(buf, BUF_LEN, c->spd.that.ca, "%none");
DBG_log("required CA: '%s'", buf);
)
if (r->kind == CK_TEMPLATE)
{
/* instantiate it, filling in peer's ID */
- r = rw_instantiate(r, &c->spd.that.host_addr,
-#ifdef NAT_TRAVERSAL
- c->spd.that.host_port,
-#endif
-#ifdef VIRTUAL_IP
- NULL,
-#endif
- peer);
+ r = rw_instantiate(r, &c->spd.that.host_addr
+ , c->spd.that.host_port, NULL, peer);
}
/* copy certificate request info */
{
struct payload_digest *const sa_pd = md->chain[ISAKMP_NEXT_SA];
struct state *st;
- struct connection *c = find_host_connection(&md->iface->addr, pluto_port
- , &md->sender, md->sender_port, LEMPTY);
+ struct connection *c;
struct isakmp_proposal proposal;
pb_stream proposal_pbs;
pb_stream r_sa_pbs;
lset_t policy = LEMPTY;
int vids_to_send = 0;
+ /* We preparse the peer's proposal in order to determine
+ * the requested authentication policy (RSA or PSK)
+ */
RETURN_STF_FAILURE(preparse_isakmp_sa_body(&sa_pd->payload.sa
, &sa_pd->pbs, &ipsecdoisit, &proposal_pbs, &proposal));
-#ifdef NAT_TRAVERSAL
+ backup_pbs(&proposal_pbs);
+ RETURN_STF_FAILURE(parse_isakmp_policy(&proposal_pbs
+ , proposal.isap_notrans, &policy));
+ restore_pbs(&proposal_pbs);
+
+ /* We are only considering candidate connections that match
+ * the requested authentication policy (RSA or PSK)
+ */
+ c = find_host_connection(&md->iface->addr, pluto_port
+ , &md->sender, md->sender_port, policy);
+
if (c == NULL && md->iface->ike_float)
{
c = find_host_connection(&md->iface->addr, NAT_T_IKE_FLOAT_PORT
- , &md->sender, md->sender_port, LEMPTY);
+ , &md->sender, md->sender_port, policy);
}
-#endif
if (c == NULL)
{
{
struct connection *d;
- backup_pbs(&proposal_pbs);
- RETURN_STF_FAILURE(parse_isakmp_policy(&proposal_pbs
- , proposal.isap_notrans, &policy));
- restore_pbs(&proposal_pbs);
-
d = find_host_connection(&md->iface->addr
, pluto_port, (ip_address*)NULL, md->sender_port, policy);
/* Create a temporary connection that is a copy of this one.
* His ID isn't declared yet.
*/
- c = rw_instantiate(c, &md->sender,
-#ifdef NAT_TRAVERSAL
- md->sender_port,
-#endif
-#ifdef VIRTUAL_IP
- NULL,
-#endif
- NULL);
+ c = rw_instantiate(c, &md->sender, md->sender_port, NULL, NULL);
}
}
+ else if (c->kind == CK_TEMPLATE)
+ {
+ /* Create an instance
+ * This is a rare case: wildcard peer ID but static peer IP address
+ */
+ c = rw_instantiate(c, &md->sender, md->sender_port, NULL, &c->spd.that.id);
+ }
/* Set up state */
md->st = st = new_state();
/* determine how many Vendor ID payloads we will be sending */
if (SEND_PLUTO_VID)
vids_to_send++;
- if (SEND_XAUTH_VID)
+ if (SEND_CISCO_UNITY_VID)
vids_to_send++;
if (md->openpgp)
vids_to_send++;
+ if (SEND_XAUTH_VID)
+ vids_to_send++;
/* always send DPD Vendor ID */
vids_to_send++;
-#ifdef NAT_TRAVERSAL
if (md->nat_traversal_vid && nat_traversal_enabled)
vids_to_send++;
-#endif
/* HDR out.
* We can't leave this to comm_handle() because we must
/* SA body in and out */
RETURN_STF_FAILURE(parse_isakmp_sa_body(ipsecdoisit, &proposal_pbs
- ,&proposal, &r_sa_pbs, st));
+ ,&proposal, &r_sa_pbs, st, FALSE));
/* if enabled send Pluto Vendor ID */
if (SEND_PLUTO_VID)
}
}
- /* if enabled send XAUTH Vendor ID */
- if (SEND_XAUTH_VID)
+ /* if enabled send Cisco Unity Vendor ID */
+ if (SEND_CISCO_UNITY_VID)
{
if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
- , &md->rbody, VID_MISC_XAUTH))
+ , &md->rbody, VID_CISCO_UNITY))
{
return STF_INTERNAL_ERROR;
}
}
}
- /* Announce our ability to do Dead Peer Detection to the peer */
+ /* Announce our ability to do eXtended AUTHentication to the peer */
+ if (SEND_XAUTH_VID)
{
if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
- , &md->rbody, VID_MISC_DPD))
+ , &md->rbody, VID_MISC_XAUTH))
{
return STF_INTERNAL_ERROR;
}
}
-#ifdef NAT_TRAVERSAL
- DBG(DBG_CONTROLMORE,
- DBG_log("sender checking NAT-t: %d and %d"
- , nat_traversal_enabled, md->nat_traversal_vid)
- )
+ /* Announce our ability to do Dead Peer Detection to the peer */
+ if (!out_vendorid(vids_to_send-- ? ISAKMP_NEXT_VID : ISAKMP_NEXT_NONE
+ , &md->rbody, VID_MISC_DPD))
+ {
+ return STF_INTERNAL_ERROR;
+ }
+
if (md->nat_traversal_vid && nat_traversal_enabled)
{
/* reply if NAT-Traversal draft is supported */
return STF_INTERNAL_ERROR;
}
}
-#endif
close_message(&md->rbody);
RETURN_STF_FAILURE(BAD_PROPOSAL_SYNTAX);
}
RETURN_STF_FAILURE(parse_isakmp_sa_body(ipsecdoisit
- , &proposal_pbs, &proposal, NULL, st));
+ , &proposal_pbs, &proposal, NULL, st, TRUE));
}
-#ifdef NAT_TRAVERSAL
- DBG(DBG_CONTROLMORE,
- DBG_log("sender checking NAT-t: %d and %d"
- , nat_traversal_enabled, md->nat_traversal_vid)
- )
if (nat_traversal_enabled && md->nat_traversal_vid)
{
st->nat_traversal = nat_traversal_vid_to_method(md->nat_traversal_vid);
np = (st->nat_traversal & NAT_T_WITH_RFC_VALUES) ?
ISAKMP_NEXT_NATD_RFC : ISAKMP_NEXT_NATD_DRAFTS;
}
- #endif
/**************** build output packet HDR;KE;Ni ****************/
return STF_INTERNAL_ERROR;
#endif
-#ifdef NAT_TRAVERSAL
if (st->nat_traversal & NAT_T_WITH_NATD)
{
if (!nat_traversal_add_natd(ISAKMP_NEXT_NONE, &md->rbody, md))
return STF_INTERNAL_ERROR;
}
-#endif
/* finish message */
close_message(&md->rbody);
pb_stream *keyex_pbs = &md->chain[ISAKMP_NEXT_KE]->pbs;
/* send CR if auth is RSA and no preloaded RSA public key exists*/
- bool send_cr = !no_cr_send && (st->st_oakley.auth == OAKLEY_RSA_SIG) &&
- !has_preloaded_public_key(st);
-
+ bool RSA_auth = st->st_oakley.auth == OAKLEY_RSA_SIG
+ || st->st_oakley.auth == XAUTHInitRSA
+ || st->st_oakley.auth == XAUTHRespRSA;
+ bool send_cr = !no_cr_send && RSA_auth && !has_preloaded_public_key(st);
+
u_int8_t np = ISAKMP_NEXT_NONE;
/* KE in */
/* Ni in */
RETURN_STF_FAILURE(accept_nonce(md, &st->st_ni, "Ni"));
-#ifdef NAT_TRAVERSAL
- DBG(DBG_CONTROLMORE,
- DBG_log("inI2: checking NAT-t: %d and %d"
- , nat_traversal_enabled, st->nat_traversal)
- )
if (st->nat_traversal & NAT_T_WITH_NATD)
{
nat_traversal_natd_lookup(md);
{
nat_traversal_new_ka_event();
}
-#endif
/* decode certificate requests */
st->st_connection->got_certrequest = FALSE;
}
}
}
-
-#ifdef NAT_TRAVERSAL
+
if (st->nat_traversal & NAT_T_WITH_NATD)
{
if (!nat_traversal_add_natd(ISAKMP_NEXT_NONE, &md->rbody, md))
return STF_INTERNAL_ERROR;
}
-#endif
/* finish message */
close_message(&md->rbody);
{
struct state *const st = md->st;
pb_stream *const keyex_pbs = &md->chain[ISAKMP_NEXT_KE]->pbs;
- int auth_payload = st->st_oakley.auth == OAKLEY_PRESHARED_KEY
- ? ISAKMP_NEXT_HASH : ISAKMP_NEXT_SIG;
pb_stream id_pbs; /* ID Payload; also used for hash calculation */
certpolicy_t cert_policy = st->st_connection->spd.this.sendcert;
cert_t mycert = st->st_connection->spd.this.cert;
bool requested, send_cert, send_cr;
+ bool RSA_auth = st->st_oakley.auth == OAKLEY_RSA_SIG
+ || st->st_oakley.auth == XAUTHInitRSA
+ || st->st_oakley.auth == XAUTHRespRSA;
+
+ int auth_payload = RSA_auth ? ISAKMP_NEXT_SIG : ISAKMP_NEXT_HASH;
+
/* KE in */
RETURN_STF_FAILURE(accept_KE(&st->st_gr, "Gr", st->st_oakley.group, keyex_pbs));
*/
requested = cert_policy == CERT_SEND_IF_ASKED
&& st->st_connection->got_certrequest;
- send_cert = st->st_oakley.auth == OAKLEY_RSA_SIG
- && mycert.type != CERT_NONE
+ send_cert = RSA_auth && mycert.type != CERT_NONE
&& (cert_policy == CERT_ALWAYS_SEND || requested);
/* send certificate request if we don't have a preloaded RSA public key */
send_cr = !no_cr_send && send_cert && !has_preloaded_public_key(st);
/* done parsing; initialize crypto */
-
compute_dh_shared(st, st->st_gr, st->st_oakley.group);
if (!generate_skeyids_iv(st))
return STF_FAIL + AUTHENTICATION_FAILED;
-#ifdef NAT_TRAVERSAL
- if (st->nat_traversal & NAT_T_WITH_NATD) {
- nat_traversal_natd_lookup(md);
- }
- if (st->nat_traversal) {
- nat_traversal_show_result(st->nat_traversal, md->sender_port);
- }
- if (st->nat_traversal & NAT_T_WITH_KA) {
- nat_traversal_new_ka_event();
- }
-#endif
+ if (st->nat_traversal & NAT_T_WITH_NATD)
+ {
+ nat_traversal_natd_lookup(md);
+ }
+ if (st->nat_traversal)
+ {
+ nat_traversal_show_result(st->nat_traversal, md->sender_port);
+ }
+ if (st->nat_traversal & NAT_T_WITH_KA)
+ {
+ nat_traversal_new_ka_event();
+ }
/*************** build output packet HDR*;IDii;HASH/SIG_I ***************/
/* ??? NOTE: this is almost the same as main_inI3_outR3's code */
}
/* CERT out */
- if ( st->st_oakley.auth == OAKLEY_RSA_SIG)
+ if (RSA_auth)
{
DBG(DBG_CONTROL,
DBG_log("our certificate policy is %s"
switch (st->st_oakley.auth)
{
case OAKLEY_PRESHARED_KEY:
+ case XAUTHInitPreShared:
+ case XAUTHRespPreShared:
{
pb_stream *const hash_pbs = &md->chain[ISAKMP_NEXT_HASH]->pbs;
break;
case OAKLEY_RSA_SIG:
+ case XAUTHInitRSA:
+ case XAUTHRespRSA:
r = RSA_check_signature(&peer, st, hash_val, hash_len
, &md->chain[ISAKMP_NEXT_SIG]->pbs
#ifdef USE_KEYRR
pb_stream r_id_pbs; /* ID Payload; also used for hash calculation */
certpolicy_t cert_policy;
cert_t mycert;
+ bool RSA_auth;
bool send_cert;
bool requested;
mycert = st->st_connection->spd.this.cert;
requested = cert_policy == CERT_SEND_IF_ASKED
&& st->st_connection->got_certrequest;
- send_cert = st->st_oakley.auth == OAKLEY_RSA_SIG
+ RSA_auth = st->st_oakley.auth == OAKLEY_RSA_SIG
+ || st->st_oakley.auth == XAUTHInitRSA
+ || st->st_oakley.auth == XAUTHRespRSA;
+ send_cert = RSA_auth
&& mycert.type != CERT_NONE
&& (cert_policy == CERT_ALWAYS_SEND || requested);
*/
echo_hdr(md, TRUE, ISAKMP_NEXT_ID);
- auth_payload = st->st_oakley.auth == OAKLEY_PRESHARED_KEY
- ? ISAKMP_NEXT_HASH : ISAKMP_NEXT_SIG;
+ auth_payload = RSA_auth ? ISAKMP_NEXT_SIG : ISAKMP_NEXT_HASH;
/* IDir out */
{
}
/* CERT out */
- if (st->st_oakley.auth == OAKLEY_RSA_SIG)
+ if (RSA_auth)
{
DBG(DBG_CONTROL,
DBG_log("our certificate policy is %s"
/* Plain Road Warrior:
* instantiate, carrying over authenticated peer ID
*/
- p = rw_instantiate(p, &c->spd.that.host_addr,
-#ifdef NAT_TRAVERSAL
- md->sender_port,
-#endif
-#ifdef VIRTUAL_IP
- his_net,
-#endif
- &c->spd.that.id);
+ p = rw_instantiate(p, &c->spd.that.host_addr, md->sender_port
+ , his_net, &c->spd.that.id);
}
}
#ifdef DEBUG
p->spd.that.client = *his_net;
p->spd.that.has_client_wildcard = FALSE;
}
-
-#ifdef VIRTUAL_IP
else if (is_virtual_connection(c))
{
c->spd.that.client = *his_net;
if (subnetishost(his_net) && addrinsubnet(&c->spd.that.host_addr, his_net))
c->spd.that.has_client = FALSE;
}
-#endif
/* fill in the client's true port */
if (p->spd.that.has_port_wildcard)
st->st_policy = (p1st->st_policy & POLICY_ISAKMP_MASK)
| (c->policy & ~POLICY_ISAKMP_MASK);
-#ifdef NAT_TRAVERSAL
if (p1st->nat_traversal & NAT_T_DETECTED)
{
st->nat_traversal = p1st->nat_traversal;
{
st->nat_traversal = 0;
}
- if ((st->nat_traversal & NAT_T_DETECTED) &&
- (st->nat_traversal & NAT_T_WITH_NATOA))
+ if ((st->nat_traversal & NAT_T_DETECTED)
+ && (st->nat_traversal & NAT_T_WITH_NATOA))
{
nat_traversal_natoa_lookup(md);
}
-#endif
/* Start the output packet.
*
p->isaiid_np = ISAKMP_NEXT_NONE;
}
-#ifdef NAT_TRAVERSAL
if ((st->nat_traversal & NAT_T_WITH_NATOA)
&& (st->nat_traversal & LELEM(NAT_TRAVERSAL_NAT_BHND_ME))
&& (st->st_esp.attrs.encapsulation == ENCAPSULATION_MODE_TRANSPORT))
addrtosubnet(&c->spd.that.host_addr, &c->spd.that.client);
c->spd.that.has_client = FALSE;
}
-#endif
/* Compute reply HASH(2) and insert in output */
(void)quick_mode_hash12(r_hashval, r_hash_start, md->rbody.cur
}
}
-#ifdef NAT_TRAVERSAL
if ((st->nat_traversal & NAT_T_DETECTED)
&& (st->nat_traversal & NAT_T_WITH_NATOA))
{
nat_traversal_natoa_lookup(md);
}
-#endif
/* ??? We used to copy the accepted proposal into the state, but it was
* never used. From sa_pd->pbs.start, length pbs_room(&sa_pd->pbs).
projects / strongswan.git / blobdiff