1 /*        $NetBSD: nattraversal.c,v 1.16 2025/03/07 15:55:29 christos Exp $     */
2 
3 /*
4  * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
5  * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 #include "config.h"
34 
35 #include <sys/types.h>
36 #include <sys/param.h>
37 
38 #ifdef __linux__
39 #include <linux/udp.h>
40 #endif
41 #if defined(__NetBSD__) || defined (__FreeBSD__)
42 #include <netinet/udp.h>
43 #endif
44 
45 #include <stdlib.h>
46 #include <stdio.h>
47 #include <string.h>
48 #include <errno.h>
49 #include <ctype.h>
50 
51 #include "var.h"
52 #include "misc.h"
53 #include "vmbuf.h"
54 #include "plog.h"
55 #include "debug.h"
56 
57 #include "localconf.h"
58 #include "remoteconf.h"
59 #include "sockmisc.h"
60 #include "isakmp_var.h"
61 #include "isakmp.h"
62 #include "oakley.h"
63 #include "ipsec_doi.h"
64 #include "vendorid.h"
65 #include "handler.h"
66 #include "crypto_openssl.h"
67 #include "schedule.h"
68 #include "nattraversal.h"
69 #include "grabmyaddr.h"
70 
71 struct natt_ka_addrs {
72   struct sockaddr   *src;
73   struct sockaddr   *dst;
74   unsigned                    in_use;
75 
76   TAILQ_ENTRY(natt_ka_addrs) chain;
77 };
78 
79 static TAILQ_HEAD(_natt_ka_addrs, natt_ka_addrs) ka_tree;
80 static struct sched sc_natt = SCHED_INITIALIZER();
81 
82 /*
83  * check if the given vid is NAT-T.
84  */
85 int
natt_vendorid(int vid)86 natt_vendorid (int vid)
87 {
88   return (
89 #ifdef ENABLE_NATT_00
90             vid == VENDORID_NATT_00 ||
91 #endif
92 #ifdef ENABLE_NATT_01
93             vid == VENDORID_NATT_01 ||
94 #endif
95 #ifdef ENABLE_NATT_02
96             vid == VENDORID_NATT_02 ||
97             vid == VENDORID_NATT_02_N ||
98 #endif
99 #ifdef ENABLE_NATT_03
100             vid == VENDORID_NATT_03 ||
101 #endif
102 #ifdef ENABLE_NATT_04
103             vid == VENDORID_NATT_04 ||
104 #endif
105 #ifdef ENABLE_NATT_05
106             vid == VENDORID_NATT_05 ||
107 #endif
108 #ifdef ENABLE_NATT_06
109             vid == VENDORID_NATT_06 ||
110 #endif
111 #ifdef ENABLE_NATT_07
112             vid == VENDORID_NATT_07 ||
113 #endif
114 #ifdef ENABLE_NATT_08
115             vid == VENDORID_NATT_08 ||
116 #endif
117             /* Always enable NATT RFC if ENABLE_NATT
118              */
119             vid == VENDORID_NATT_RFC);
120 }
121 
122 vchar_t *
natt_hash_addr(struct ph1handle * iph1,struct sockaddr * addr)123 natt_hash_addr (struct ph1handle *iph1, struct sockaddr *addr)
124 {
125   vchar_t *natd;
126   vchar_t *buf;
127   char *ptr;
128   void *addr_ptr, *addr_port;
129   size_t buf_size, addr_size;
130   int natt_force = 0;
131 
132   if (iph1->rmconf != NULL && iph1->rmconf->nat_traversal == NATT_FORCE)
133             natt_force = 1;
134 
135   plog (LLV_INFO, LOCATION, addr, "Hashing %s with algo #%d %s\n",
136           saddr2str(addr), iph1->approval->hashtype,
137           natt_force?"(NAT-T forced)":"");
138 
139   if (addr->sa_family == AF_INET) {
140     addr_size = sizeof (struct in_addr);          /* IPv4 address */
141     addr_ptr = &((struct sockaddr_in *)addr)->sin_addr;
142     addr_port = &((struct sockaddr_in *)addr)->sin_port;
143   }
144   else if (addr->sa_family == AF_INET6) {
145     addr_size = sizeof (struct in6_addr);         /* IPv6 address */
146     addr_ptr = &((struct sockaddr_in6 *)addr)->sin6_addr;
147     addr_port = &((struct sockaddr_in6 *)addr)->sin6_port;
148   }
149   else {
150     plog (LLV_ERROR, LOCATION, addr, "Unsupported address family #0x%x\n", addr->sa_family);
151     return NULL;
152   }
153 
154   buf_size = 2 * sizeof (cookie_t);     /* CKY-I + CKY+R */
155   buf_size += addr_size + 2;  /* Address + Port */
156 
157   if ((buf = vmalloc (buf_size)) == NULL)
158     return NULL;
159 
160   ptr = buf->v;
161 
162   /* Copy-in CKY-I */
163   memcpy (ptr, iph1->index.i_ck, sizeof (cookie_t));
164   ptr += sizeof (cookie_t);
165 
166   /* Copy-in CKY-I */
167   memcpy (ptr, iph1->index.r_ck, sizeof (cookie_t));
168   ptr += sizeof (cookie_t);
169 
170   /* Copy-in Address (or zeroes if NATT_FORCE) */
171   if (natt_force)
172     memset (ptr, 0, addr_size);
173   else
174     memcpy (ptr, addr_ptr, addr_size);
175   ptr += addr_size;
176 
177   /* Copy-in Port number */
178   memcpy (ptr, addr_port, 2);
179 
180   natd = oakley_hash (buf, iph1);
181   vfree(buf);
182 
183   return natd;
184 }
185 
186 int
natt_compare_addr_hash(struct ph1handle * iph1,vchar_t * natd_received,int natd_seq)187 natt_compare_addr_hash (struct ph1handle *iph1, vchar_t *natd_received,
188                               int natd_seq)
189 {
190   vchar_t *natd_computed;
191   uint32_t flag;
192   int verified = 0;
193 
194   if (iph1->rmconf != NULL &&
195       iph1->rmconf->nat_traversal == NATT_FORCE)
196     return verified;
197 
198   if (natd_seq == 0) {
199     natd_computed = natt_hash_addr (iph1, iph1->local);
200     flag = NAT_DETECTED_ME;
201   }
202   else {
203     natd_computed = natt_hash_addr (iph1, iph1->remote);
204     flag = NAT_DETECTED_PEER;
205   }
206 
207   if (natd_computed == NULL) {
208           plog(LLV_ERROR, LOCATION, NULL, "natd_computed allocation failed\n");
209           return verified; /* XXX should abort */
210   }
211 
212   if (natd_received->l == natd_computed->l &&
213       memcmp (natd_received->v, natd_computed->v, natd_received->l) == 0) {
214     iph1->natt_flags &= ~flag;
215     verified = 1;
216   }
217 
218   vfree (natd_computed);
219 
220   return verified;
221 }
222 
223 int
natt_udp_encap(int encmode)224 natt_udp_encap (int encmode)
225 {
226   return (encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC ||
227             encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC ||
228             encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT ||
229             encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT);
230 }
231 
232 int
natt_fill_options(struct ph1natt_options * opts,int version)233 natt_fill_options(struct ph1natt_options *opts, int version)
234 {
235           if (!opts)
236                     return -1;
237 
238           opts->version = version;
239 
240           switch (version) {
241           case VENDORID_NATT_00:
242           case VENDORID_NATT_01:
243                     opts->float_port = 0; /* No port floating for those drafts */
244                     opts->payload_nat_d = ISAKMP_NPTYPE_NATD_DRAFT;
245                     opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_DRAFT;
246                     opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT;
247                     opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT;
248                     opts->encaps_type = UDP_ENCAP_ESPINUDP_NON_IKE;
249                     break;
250           case VENDORID_NATT_02:
251           case VENDORID_NATT_02_N:
252           case VENDORID_NATT_03:
253                     opts->float_port = lcconf->port_isakmp_natt;
254                     opts->payload_nat_d = ISAKMP_NPTYPE_NATD_DRAFT;
255                     opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_DRAFT;
256                     opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT;
257                     opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT;
258                     opts->encaps_type = UDP_ENCAP_ESPINUDP;
259                     break;
260           case VENDORID_NATT_04:
261           case VENDORID_NATT_05:
262           case VENDORID_NATT_06:
263           case VENDORID_NATT_07:
264           case VENDORID_NATT_08:
265                     opts->float_port = lcconf->port_isakmp_natt;
266                     opts->payload_nat_d = ISAKMP_NPTYPE_NATD_BADDRAFT;
267                     opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_BADDRAFT;
268                     opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
269                     opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
270                     opts->encaps_type = UDP_ENCAP_ESPINUDP;
271                     break;
272           case VENDORID_NATT_RFC:
273                     opts->float_port = lcconf->port_isakmp_natt;
274                     opts->payload_nat_d = ISAKMP_NPTYPE_NATD_RFC;
275                     opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_RFC;
276                     opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
277                     opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
278                     opts->encaps_type = UDP_ENCAP_ESPINUDP;
279                     break;
280           default:
281                     plog(LLV_ERROR, LOCATION, NULL,
282                         "unsupported NAT-T version: %s\n",
283                         vid_string_by_id(version));
284                     return -1;
285           }
286 
287           opts->mode_udp_diff = opts->mode_udp_tunnel - IPSECDOI_ATTR_ENC_MODE_TUNNEL;
288 
289           return 0;
290 }
291 
292 void
natt_float_ports(struct ph1handle * iph1)293 natt_float_ports(struct ph1handle *iph1)
294 {
295           if (!(iph1->natt_flags & NAT_DETECTED))
296                     return;
297           if (!iph1->natt_options->float_port) {
298                     /* Drafts 00 / 01, just schedule keepalive */
299                     natt_keepalive_add_ph1 (iph1);
300                     return;
301           }
302 
303           set_port(iph1->local, iph1->natt_options->float_port);
304           set_port(iph1->remote, iph1->natt_options->float_port);
305           iph1->natt_flags |= NAT_PORTS_CHANGED | NAT_ADD_NON_ESP_MARKER;
306 
307           natt_keepalive_add_ph1(iph1);
308 }
309 
310 /*ARGSUSED*/
311 static int
natt_is_enabled(struct remoteconf * rmconf,void * args __unused)312 natt_is_enabled(struct remoteconf *rmconf, void *args __unused)
313 {
314           if (rmconf->nat_traversal)
315                     return 1;
316           return 0;
317 }
318 
319 void
natt_handle_vendorid(struct ph1handle * iph1,int vid_numeric)320 natt_handle_vendorid(struct ph1handle *iph1, int vid_numeric)
321 {
322           if (iph1->rmconf == NULL) {
323                     /* Check if any candidate remote conf allows nat-t */
324                     struct rmconfselector rmconf;
325                     rmconf_selector_from_ph1(&rmconf, iph1);
326                     if (enumrmconf(&rmconf, natt_is_enabled, NULL) == 0)
327                               return;
328           } else {
329                     if (!iph1->rmconf->nat_traversal)
330                               return;
331           }
332 
333           if (!iph1->natt_options)
334                     iph1->natt_options = racoon_calloc(1, sizeof(*iph1->natt_options));
335 
336           if (!iph1->natt_options) {
337                     plog(LLV_ERROR, LOCATION, NULL,
338                         "Allocating memory for natt_options failed!\n");
339                     return;
340           }
341 
342           if (iph1->natt_options->version < vid_numeric)
343                     if (natt_fill_options(iph1->natt_options, vid_numeric) == 0)
344                               iph1->natt_flags |= NAT_ANNOUNCED;
345 }
346 
347 static void
natt_keepalive_delete(struct natt_ka_addrs * ka)348 natt_keepalive_delete (struct natt_ka_addrs *ka)
349 {
350   TAILQ_REMOVE (&ka_tree, ka, chain);
351   racoon_free (ka->src);
352   racoon_free (ka->dst);
353   racoon_free (ka);
354 }
355 
356 /* NAT keepalive functions */
357 /*ARGSUSED*/
358 static void
natt_keepalive_send(struct sched * param __unused)359 natt_keepalive_send (struct sched *param __unused)
360 {
361   struct natt_ka_addrs        *ka, *next = NULL;
362   char keepalive_packet[] = { (char)0xff };
363   size_t len;
364   int s;
365 
366   for (ka = TAILQ_FIRST(&ka_tree); ka; ka = next) {
367     next = TAILQ_NEXT(ka, chain);
368 
369     s = myaddr_getfd(ka->src);
370     if (s == -1) {
371       natt_keepalive_delete(ka);
372       continue;
373     }
374     plog (LLV_DEBUG, LOCATION, NULL, "KA: %s\n",
375             saddr2str_fromto("%s->%s", ka->src, ka->dst));
376     len = sendfromto(s, keepalive_packet, sizeof (keepalive_packet),
377                          ka->src, ka->dst, 1);
378     if (len == (size_t)-1)
379       plog(LLV_ERROR, LOCATION, NULL, "KA: sendfromto failed: %s\n",
380              strerror (errno));
381   }
382 
383   sched_schedule (&sc_natt, lcconf->natt_ka_interval, natt_keepalive_send);
384 }
385 
386 void
natt_keepalive_init(void)387 natt_keepalive_init (void)
388 {
389   TAILQ_INIT(&ka_tree);
390 
391   /* To disable sending KAs set natt_ka_interval=0 */
392   if (lcconf->natt_ka_interval > 0)
393     sched_schedule (&sc_natt, lcconf->natt_ka_interval, natt_keepalive_send);
394 }
395 
396 int
natt_keepalive_add(struct sockaddr * src,struct sockaddr * dst)397 natt_keepalive_add (struct sockaddr *src, struct sockaddr *dst)
398 {
399   struct natt_ka_addrs *ka = NULL, *new_addr;
400 
401   TAILQ_FOREACH (ka, &ka_tree, chain) {
402     if (cmpsaddr(ka->src, src) == CMPSADDR_MATCH &&
403           cmpsaddr(ka->dst, dst) == CMPSADDR_MATCH) {
404       ka->in_use++;
405       plog (LLV_INFO, LOCATION, NULL, "KA found: %s (in_use=%u)\n",
406               saddr2str_fromto("%s->%s", src, dst), ka->in_use);
407       return 0;
408     }
409   }
410 
411   plog (LLV_INFO, LOCATION, NULL, "KA list add: %s\n", saddr2str_fromto("%s->%s", src, dst));
412 
413   new_addr = (struct natt_ka_addrs *)racoon_malloc(sizeof(*new_addr));
414   if (! new_addr) {
415     plog (LLV_ERROR, LOCATION, NULL, "Can't allocate new KA list item\n");
416     return -1;
417   }
418 
419   if ((new_addr->src = dupsaddr(src)) == NULL) {
420           racoon_free(new_addr);
421           plog (LLV_ERROR, LOCATION, NULL, "Can't allocate new KA list item\n");
422           return -1;
423   }
424   if ((new_addr->dst = dupsaddr(dst)) == NULL) {
425           racoon_free(new_addr);
426           plog (LLV_ERROR, LOCATION, NULL, "Can't allocate new KA list item\n");
427           return -1;
428   }
429   new_addr->in_use = 1;
430   TAILQ_INSERT_TAIL(&ka_tree, new_addr, chain);
431 
432   return 0;
433 }
434 
435 int
natt_keepalive_add_ph1(struct ph1handle * iph1)436 natt_keepalive_add_ph1 (struct ph1handle *iph1)
437 {
438   int ret = 0;
439 
440   /* Should only the NATed host send keepalives?
441      If yes, add '(iph1->natt_flags & NAT_DETECTED_ME)'
442      to the following condition. */
443   if (iph1->natt_flags & NAT_DETECTED &&
444       ! (iph1->natt_flags & NAT_KA_QUEUED)) {
445     ret = natt_keepalive_add (iph1->local, iph1->remote);
446     if (ret == 0)
447       iph1->natt_flags |= NAT_KA_QUEUED;
448   }
449 
450   return ret;
451 }
452 
453 void
natt_keepalive_remove(struct sockaddr * src,struct sockaddr * dst)454 natt_keepalive_remove (struct sockaddr *src, struct sockaddr *dst)
455 {
456   struct natt_ka_addrs *ka, *next = NULL;
457 
458   plog (LLV_INFO, LOCATION, NULL, "KA remove: %s\n", saddr2str_fromto("%s->%s", src, dst));
459 
460   for (ka = TAILQ_FIRST(&ka_tree); ka; ka = next) {
461     next = TAILQ_NEXT(ka, chain);
462 
463     plog (LLV_DEBUG, LOCATION, NULL, "KA tree dump: %s (in_use=%u)\n",
464             saddr2str_fromto("%s->%s", src, dst), ka->in_use);
465 
466     if (cmpsaddr(ka->src, src) == CMPSADDR_MATCH &&
467           cmpsaddr(ka->dst, dst) == CMPSADDR_MATCH &&
468           -- ka->in_use <= 0) {
469 
470       plog (LLV_DEBUG, LOCATION, NULL, "KA removing this one...\n");
471 
472       natt_keepalive_delete (ka);
473       /* Should we break here? Every pair of addresses should
474          be inserted only once, but who knows :-) Lets traverse
475            the whole list... */
476     }
477   }
478 }
479 
480 /*ARGSUSED*/
481 static int
natt_enabled_in_rmconf_stub(struct remoteconf * rmconf,void * data __unused)482 natt_enabled_in_rmconf_stub (struct remoteconf *rmconf, void *data __unused)
483 {
484   return rmconf->nat_traversal ? 1 : 0;
485 }
486 
487 int
natt_enabled_in_rmconf()488 natt_enabled_in_rmconf ()
489 {
490   return enumrmconf(NULL, natt_enabled_in_rmconf_stub, NULL) != 0;
491 }
492 
493 
494 struct payload_list *
isakmp_plist_append_natt_vids(struct payload_list * plist,vchar_t * vid_natt[MAX_NATT_VID_COUNT])495 isakmp_plist_append_natt_vids (struct payload_list *plist, vchar_t *vid_natt[MAX_NATT_VID_COUNT]){
496           int i, vid_natt_i = 0;
497 
498           if(vid_natt == NULL)
499                     return NULL;
500 
501           for (i = 0; i < MAX_NATT_VID_COUNT; i++)
502                     vid_natt[i]=NULL;
503 
504           /* Puts the olders VIDs last, as some implementations may choose the first
505            * NATT VID given
506            */
507 
508           /* Always set RFC VID
509            */
510           if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_RFC)) != NULL)
511                     vid_natt_i++;
512 #ifdef ENABLE_NATT_08
513           if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_08)) != NULL)
514                     vid_natt_i++;
515 #endif
516 #ifdef ENABLE_NATT_07
517           if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_07)) != NULL)
518                     vid_natt_i++;
519 #endif
520 #ifdef ENABLE_NATT_06
521           if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_06)) != NULL)
522                     vid_natt_i++;
523 #endif
524 #ifdef ENABLE_NATT_05
525           if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_05)) != NULL)
526                     vid_natt_i++;
527 #endif
528 #ifdef ENABLE_NATT_04
529           if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_04)) != NULL)
530                     vid_natt_i++;
531 #endif
532 #ifdef ENABLE_NATT_03
533           if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_03)) != NULL)
534                     vid_natt_i++;
535 #endif
536 #ifdef ENABLE_NATT_02
537           if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02)) != NULL)
538                     vid_natt_i++;
539           if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02_N)) != NULL)
540                     vid_natt_i++;
541 #endif
542 #ifdef ENABLE_NATT_01
543           if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_01)) != NULL)
544                     vid_natt_i++;
545 #endif
546 #ifdef ENABLE_NATT_00
547           if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_00)) != NULL)
548                     vid_natt_i++;
549 #endif
550           /* set VID payload for NAT-T */
551           for (i = 0; i < vid_natt_i; i++)
552                     plist = isakmp_plist_append(plist, vid_natt[i], ISAKMP_NPTYPE_VID);
553 
554           return plist;
555 }
556