2 * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
3 * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of the project nor the names of its contributors
15 * may be used to endorse or promote products derived from this software
16 * without specific prior written permission.
18 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 #include <sys/types.h>
34 #include <sys/param.h>
37 #include <linux/udp.h>
39 #if defined(__NetBSD__) || defined (__FreeBSD__)
40 #include <netinet/udp.h>
55 #include "localconf.h"
56 #include "remoteconf.h"
58 #include "isakmp_var.h"
61 #include "ipsec_doi.h"
64 #include "crypto_openssl.h"
66 #include "nattraversal.h"
67 #include "grabmyaddr.h"
69 struct natt_ka_addrs
{
74 TAILQ_ENTRY(natt_ka_addrs
) chain
;
77 static TAILQ_HEAD(_natt_ka_addrs
, natt_ka_addrs
) ka_tree
;
80 * check if the given vid is NAT-T.
83 natt_vendorid (int vid
)
87 vid
== VENDORID_NATT_00
||
90 vid
== VENDORID_NATT_01
||
93 vid
== VENDORID_NATT_02
||
94 vid
== VENDORID_NATT_02_N
||
97 vid
== VENDORID_NATT_03
||
100 vid
== VENDORID_NATT_04
||
102 #ifdef ENABLE_NATT_05
103 vid
== VENDORID_NATT_05
||
105 #ifdef ENABLE_NATT_06
106 vid
== VENDORID_NATT_06
||
108 #ifdef ENABLE_NATT_07
109 vid
== VENDORID_NATT_07
||
111 #ifdef ENABLE_NATT_08
112 vid
== VENDORID_NATT_08
||
114 #ifdef ENABLE_NATT_APPLE
115 vid
== VENDORID_NATT_APPLE
||
117 /* Always enable NATT RFC if ENABLE_NATT
119 vid
== VENDORID_NATT_RFC
);
123 natt_hash_addr (struct ph1handle
*iph1
, struct sockaddr
*addr
)
128 void *addr_ptr
, *addr_port
;
129 size_t buf_size
, addr_size
;
131 plog (LLV_INFO
, LOCATION
, addr
, "Hashing %s with algo #%d %s\n",
132 saddr2str(addr
), iph1
->approval
->hashtype
,
133 (iph1
->rmconf
->nat_traversal
== NATT_FORCE
)?"(NAT-T forced)":"");
135 if (addr
->sa_family
== AF_INET
) {
136 addr_size
= sizeof (struct in_addr
); /* IPv4 address */
137 addr_ptr
= &((struct sockaddr_in
*)addr
)->sin_addr
;
138 addr_port
= &((struct sockaddr_in
*)addr
)->sin_port
;
140 else if (addr
->sa_family
== AF_INET6
) {
141 addr_size
= sizeof (struct in6_addr
); /* IPv6 address */
142 addr_ptr
= &((struct sockaddr_in6
*)addr
)->sin6_addr
;
143 addr_port
= &((struct sockaddr_in6
*)addr
)->sin6_port
;
146 plog (LLV_ERROR
, LOCATION
, addr
, "Unsupported address family #0x%x\n", addr
->sa_family
);
150 buf_size
= 2 * sizeof (cookie_t
); /* CKY-I + CKY+R */
151 buf_size
+= addr_size
+ 2; /* Address + Port */
153 if ((buf
= vmalloc (buf_size
)) == NULL
)
159 memcpy (ptr
, iph1
->index
.i_ck
, sizeof (cookie_t
));
160 ptr
+= sizeof (cookie_t
);
163 memcpy (ptr
, iph1
->index
.r_ck
, sizeof (cookie_t
));
164 ptr
+= sizeof (cookie_t
);
166 /* Copy-in Address (or zeroes if NATT_FORCE) */
167 if (iph1
->rmconf
->nat_traversal
== NATT_FORCE
)
168 memset (ptr
, 0, addr_size
);
170 memcpy (ptr
, addr_ptr
, addr_size
);
173 /* Copy-in Port number */
174 memcpy (ptr
, addr_port
, 2);
176 natd
= oakley_hash (buf
, iph1
);
183 natt_compare_addr_hash (struct ph1handle
*iph1
, vchar_t
*natd_received
,
186 vchar_t
*natd_computed
;
190 if (iph1
->rmconf
->nat_traversal
== NATT_FORCE
)
194 /* old APPLE version sends natd payload in the wrong order */
195 if (iph1
->natt_options
->version
== VENDORID_NATT_APPLE
) {
197 natd_computed
= natt_hash_addr (iph1
, iph1
->remote
);
198 flag
= NAT_DETECTED_PEER
;
201 natd_computed
= natt_hash_addr (iph1
, iph1
->local
);
202 flag
= NAT_DETECTED_ME
;
208 natd_computed
= natt_hash_addr (iph1
, iph1
->local
);
209 flag
= NAT_DETECTED_ME
;
212 natd_computed
= natt_hash_addr (iph1
, iph1
->remote
);
213 flag
= NAT_DETECTED_PEER
;
217 if (natd_received
->l
== natd_computed
->l
&&
218 memcmp (natd_received
->v
, natd_computed
->v
, natd_received
->l
) == 0) {
219 iph1
->natt_flags
&= ~flag
;
223 vfree (natd_computed
);
229 natt_udp_encap (int encmode
)
231 return (encmode
== IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC
||
232 encmode
== IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC
||
233 encmode
== IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT
||
234 encmode
== IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT
);
238 natt_fill_options (struct ph1natt_options
*opts
, int version
)
243 opts
->version
= version
;
247 case VENDORID_NATT_00
:
248 case VENDORID_NATT_01
:
249 opts
->float_port
= 0; /* No port floating for those drafts */
250 opts
->payload_nat_d
= ISAKMP_NPTYPE_NATD_DRAFT
;
251 opts
->payload_nat_oa
= ISAKMP_NPTYPE_NATOA_DRAFT
;
252 opts
->mode_udp_tunnel
= IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT
;
253 opts
->mode_udp_transport
= IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT
;
254 opts
->encaps_type
= UDP_ENCAP_ESPINUDP_NON_IKE
;
258 case VENDORID_NATT_02
:
259 case VENDORID_NATT_02_N
:
260 case VENDORID_NATT_03
:
261 opts
->float_port
= lcconf
->port_isakmp_natt
;
262 opts
->payload_nat_d
= ISAKMP_NPTYPE_NATD_DRAFT
;
263 opts
->payload_nat_oa
= ISAKMP_NPTYPE_NATOA_DRAFT
;
264 opts
->mode_udp_tunnel
= IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT
;
265 opts
->mode_udp_transport
= IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT
;
266 opts
->encaps_type
= UDP_ENCAP_ESPINUDP
;
268 case VENDORID_NATT_04
:
269 case VENDORID_NATT_05
:
270 case VENDORID_NATT_06
:
271 case VENDORID_NATT_07
:
272 case VENDORID_NATT_08
:
274 case VENDORID_NATT_APPLE
:
275 opts
->float_port
= lcconf
->port_isakmp_natt
;
276 opts
->payload_nat_d
= ISAKMP_NPTYPE_NATD_BADDRAFT
;
277 opts
->payload_nat_oa
= ISAKMP_NPTYPE_NONE
;
278 opts
->mode_udp_tunnel
= IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC
;
279 opts
->mode_udp_transport
= IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC
;
280 opts
->encaps_type
= UDP_ENCAP_ESPINUDP
;
283 case VENDORID_NATT_RFC
:
284 opts
->float_port
= lcconf
->port_isakmp_natt
;
285 opts
->payload_nat_d
= ISAKMP_NPTYPE_NATD_RFC
;
286 opts
->payload_nat_oa
= ISAKMP_NPTYPE_NATOA_RFC
;
287 opts
->mode_udp_tunnel
= IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC
;
288 opts
->mode_udp_transport
= IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC
;
289 opts
->encaps_type
= UDP_ENCAP_ESPINUDP
;
292 plog(LLV_ERROR
, LOCATION
, NULL
,
293 "unsupported NAT-T version: %s\n",
294 vid_string_by_id(version
));
298 opts
->mode_udp_diff
= opts
->mode_udp_tunnel
- IPSECDOI_ATTR_ENC_MODE_TUNNEL
;
305 create_natoa_payloads(struct ph2handle
*iph2
, vchar_t
**natoa_i
, vchar_t
**natoa_r
)
315 *natoa_i
= *natoa_r
= NULL
;
318 /* create natoa payloads if natt being used */
319 /* don't send if type == apple */
320 if ((natt_type
= natd_hasnat(iph2
->ph1
)) != 0)
321 if (natt_type
== natt_type_rfc
)
322 natoa_type
= ISAKMP_NPTYPE_NATOA_RFC
;
323 else if (natt_type
== natt_type_02
|| natt_type
== natt_type_02N
)
324 natoa_type
= ISAKMP_NPTYPE_NATOA_DRAFT
;
329 switch (iph2
->src
->sa_family
) {
331 src_size
= sizeof(in_addr_t
);
335 src_size
= sizeof(struct in6_addr
);
339 plog(LLV_ERROR
, LOCATION
, NULL
,
340 "invalid address family: %d\n", iph2
->src
->sa_family
);
344 switch (iph2
->dst
->sa_family
) {
346 dst_size
= sizeof(in_addr_t
);
350 dst_size
= sizeof(struct in6_addr
);
354 plog(LLV_ERROR
, LOCATION
, NULL
,
355 "invalid address family: %d\n", iph2
->dst
->sa_family
);
359 i
= vmalloc(sizeof(struct isakmp_pl_natoa
) + src_size
- sizeof(struct isakmp_gen
));
360 r
= vmalloc(sizeof(struct isakmp_pl_natoa
) + dst_size
- sizeof(struct isakmp_gen
));
361 if (i
== NULL
|| r
== NULL
) {
362 plog(LLV_ERROR
, LOCATION
, NULL
,
363 "failed to get buffer for natoa payload.\n");
367 /* copy src address */
370 switch (iph2
->src
->sa_family
) {
372 *p
= IPSECDOI_ID_IPV4_ADDR
;
373 bcopy(&(((struct sockaddr_in
*)iph2
->src
)->sin_addr
.s_addr
), p
+ sizeof(u_int32_t
), src_size
);
377 *p
= IPSECDOI_ID_IPV6_ADDR
;
378 bcopy(&(((struct sockaddr_in6
*)iph2
->src
)->sin6_addr
), p
+ sizeof(u_int32_t
), src_size
);
383 /* copy dst address */
386 switch (iph2
->dst
->sa_family
) {
388 *p
= IPSECDOI_ID_IPV4_ADDR
;
389 bcopy(&(((struct sockaddr_in
*)iph2
->dst
)->sin_addr
.s_addr
), p
+ sizeof(u_int32_t
), dst_size
);
393 *p
= IPSECDOI_ID_IPV6_ADDR
;
394 bcopy(&(((struct sockaddr_in6
*)iph2
->dst
)->sin6_addr
), p
+ sizeof(u_int32_t
), dst_size
);
407 natt_float_ports (struct ph1handle
*iph1
)
410 if (! (iph1
->natt_flags
&& NAT_DETECTED
) )
412 if (! iph1
->natt_options
->float_port
){
413 /* Drafts 00 / 01, just schedule keepalive */
415 natt_keepalive_add_ph1 (iph1
);
421 * Only switch ports if port == isakmp port.
422 * In the case where ports are set from policy or from
423 * remote config we could be talking to a device behind
424 * a nat using the translated port.
426 if (*get_port_ptr(iph1
->local
) == htons(lcconf
->port_isakmp
))
427 set_port (iph1
->local
, iph1
->natt_options
->float_port
);
428 if (*get_port_ptr(iph1
->remote
) == htons(lcconf
->port_isakmp
))
429 set_port (iph1
->remote
, iph1
->natt_options
->float_port
);
430 iph1
->natt_flags
|= NAT_PORTS_CHANGED
| NAT_ADD_NON_ESP_MARKER
;
434 natt_keepalive_add_ph1 (iph1
);
439 natt_handle_vendorid (struct ph1handle
*iph1
, int vid_numeric
)
441 if (! iph1
->natt_options
)
442 iph1
->natt_options
= racoon_calloc (1, sizeof (*iph1
->natt_options
));
444 if (! iph1
->natt_options
) {
445 plog (LLV_ERROR
, LOCATION
, NULL
,
446 "Allocating memory for natt_options failed!\n");
450 if (iph1
->natt_options
->version
< vid_numeric
)
451 if (natt_fill_options (iph1
->natt_options
, vid_numeric
) == 0)
452 iph1
->natt_flags
|= NAT_ANNOUNCED
;
456 /* NAT keepalive functions */
458 natt_keepalive_send (void *param
)
460 struct natt_ka_addrs
*ka
, *next
= NULL
;
461 char keepalive_packet
[] = { 0xff };
465 for (ka
= TAILQ_FIRST(&ka_tree
); ka
; ka
= next
) {
466 next
= TAILQ_NEXT(ka
, chain
);
468 s
= getsockmyaddr(ka
->src
);
470 TAILQ_REMOVE (&ka_tree
, ka
, chain
);
474 plog (LLV_DEBUG
, LOCATION
, NULL
, "KA: %s\n",
475 saddr2str_fromto("%s->%s", ka
->src
, ka
->dst
));
476 len
= sendfromto(s
, keepalive_packet
, sizeof (keepalive_packet
),
477 ka
->src
, ka
->dst
, 1);
479 plog(LLV_ERROR
, LOCATION
, NULL
, "KA: sendfromto failed: %s\n",
483 sched_new (lcconf
->natt_ka_interval
, natt_keepalive_send
, NULL
);
487 natt_keepalive_init (void)
489 TAILQ_INIT(&ka_tree
);
491 /* To disable sending KAs set natt_ka_interval=0 */
492 if (lcconf
->natt_ka_interval
> 0)
493 sched_new (lcconf
->natt_ka_interval
, natt_keepalive_send
, NULL
);
497 natt_keepalive_add (struct sockaddr
*src
, struct sockaddr
*dst
)
499 struct natt_ka_addrs
*ka
= NULL
, *new_addr
;
501 TAILQ_FOREACH (ka
, &ka_tree
, chain
) {
502 if (cmpsaddrstrict(ka
->src
, src
) == 0 &&
503 cmpsaddrstrict(ka
->dst
, dst
) == 0) {
505 plog (LLV_INFO
, LOCATION
, NULL
, "KA found: %s (in_use=%u)\n",
506 saddr2str_fromto("%s->%s", src
, dst
), ka
->in_use
);
511 plog (LLV_INFO
, LOCATION
, NULL
, "KA list add: %s\n", saddr2str_fromto("%s->%s", src
, dst
));
513 new_addr
= (struct natt_ka_addrs
*)racoon_malloc(sizeof(*new_addr
));
515 plog (LLV_ERROR
, LOCATION
, NULL
, "Can't allocate new KA list item\n");
519 new_addr
->src
= dupsaddr(src
);
520 new_addr
->dst
= dupsaddr(dst
);
521 new_addr
->in_use
= 1;
522 TAILQ_INSERT_TAIL(&ka_tree
, new_addr
, chain
);
528 natt_keepalive_add_ph1 (struct ph1handle
*iph1
)
532 /* Should only the NATed host send keepalives?
533 If yes, add '(iph1->natt_flags & NAT_DETECTED_ME)'
534 to the following condition. */
535 if (iph1
->natt_flags
& NAT_DETECTED
&&
536 ! (iph1
->natt_flags
& NAT_KA_QUEUED
)) {
537 ret
= natt_keepalive_add (iph1
->local
, iph1
->remote
);
539 iph1
->natt_flags
|= NAT_KA_QUEUED
;
546 natt_keepalive_remove (struct sockaddr
*src
, struct sockaddr
*dst
)
548 struct natt_ka_addrs
*ka
, *next
= NULL
;
550 plog (LLV_INFO
, LOCATION
, NULL
, "KA remove: %s\n", saddr2str_fromto("%s->%s", src
, dst
));
552 for (ka
= TAILQ_FIRST(&ka_tree
); ka
; ka
= next
) {
553 next
= TAILQ_NEXT(ka
, chain
);
555 plog (LLV_DEBUG
, LOCATION
, NULL
, "KA tree dump: %s (in_use=%u)\n",
556 saddr2str_fromto("%s->%s", src
, dst
), ka
->in_use
);
558 if (cmpsaddrstrict(ka
->src
, src
) == 0 &&
559 cmpsaddrstrict(ka
->dst
, dst
) == 0 &&
560 -- ka
->in_use
<= 0) {
562 plog (LLV_DEBUG
, LOCATION
, NULL
, "KA removing this one...\n");
564 TAILQ_REMOVE (&ka_tree
, ka
, chain
);
566 /* Should we break here? Every pair of addresses should
567 be inserted only once, but who knows :-) Lets traverse
572 #endif /* __APPLE__ */
574 static struct remoteconf
*
575 natt_enabled_in_rmconf_stub (struct remoteconf
*rmconf
, void *data
)
577 return (rmconf
->nat_traversal
? rmconf
: NULL
);
581 natt_enabled_in_rmconf ()
583 return foreachrmconf (natt_enabled_in_rmconf_stub
, NULL
) != NULL
;
587 struct payload_list
*
588 isakmp_plist_append_natt_vids (struct payload_list
*plist
, vchar_t
*vid_natt
[MAX_NATT_VID_COUNT
]){
589 int i
, vid_natt_i
= 0;
594 for (i
= 0; i
< MAX_NATT_VID_COUNT
; i
++)
597 /* Puts the olders VIDs last, as some implementations may choose the first
601 /* Always set RFC VID
603 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_RFC
)) != NULL
)
605 #ifdef ENABLE_NATT_APPLE
606 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_APPLE
)) != NULL
)
609 #ifdef ENABLE_NATT_08
610 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_08
)) != NULL
)
613 #ifdef ENABLE_NATT_07
614 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_07
)) != NULL
)
617 #ifdef ENABLE_NATT_06
618 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_06
)) != NULL
)
621 #ifdef ENABLE_NATT_05
622 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_05
)) != NULL
)
625 #ifdef ENABLE_NATT_04
626 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_04
)) != NULL
)
629 #ifdef ENABLE_NATT_03
630 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_03
)) != NULL
)
633 #ifdef ENABLE_NATT_02
634 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_02
)) != NULL
)
636 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_02_N
)) != NULL
)
639 #ifdef ENABLE_NATT_01
640 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_01
)) != NULL
)
643 #ifdef ENABLE_NATT_00
644 if ((vid_natt
[vid_natt_i
] = set_vendorid(VENDORID_NATT_00
)) != NULL
)
647 /* set VID payload for NAT-T */
648 for (i
= 0; i
< vid_natt_i
; i
++)
649 plist
= isakmp_plist_append(plist
, vid_natt
[i
], ISAKMP_NPTYPE_VID
);