Attachment 183392 Details for Bug 219918 – LibAlias RFC 4787 req 1 and 3 implementation

[patch] LibAlias RFC 4787 req 1 and 3 implementation

0001-Implement-NAT-hole-punching-for-UDP-as-per-RFC-4787-.patch (text/plain), 7.91 KB, created by Damjan Jovanovic on 2017-06-11 07:34:04 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Damjan Jovanovic

Created: 2017-06-11 07:34:04 UTC

Size: 7.91 KB

patch

obsolete

>From da649c3fd41b78a4d220d432710bb9ff6c3053b7 Mon Sep 17 00:00:00 2001
>From: Damjan Jovanovic <damjan.jov@gmail.com>
>Date: Sat, 10 Jun 2017 09:47:45 +0200
>Subject: [PATCH] Implement NAT hole punching for UDP, as per RFC 4787
> requirements 1 and 3, creating an endpoint-independent mapping NAT also known
> as an (address- and port-restricted) cone NAT.
>
>Outgoing links are now hashed only on source IP/port, so they
>can be searched using only those, allowing us to find and reuse
>the alias address/port already in use by the packet's source
>address/port. When new links are allocated, we also search for an
>alias address/port that is not used by any link.
>
>Also updated the man page to reflect this.
>---
> netinet/libalias/alias_db.c | 96 ++++++++++++++++++++++++++++++++++++++-------
> netinet/libalias/libalias.3 | 18 +++++++--
> 2 files changed, 95 insertions(+), 19 deletions(-)
>
>diff --git a/netinet/libalias/alias_db.c b/netinet/libalias/alias_db.c
>index 4f8159b..3211990 100644
>--- a/netinet/libalias/alias_db.c
>+++ b/netinet/libalias/alias_db.c
>@@ -385,9 +385,7 @@ Miscellaneous:
> /* Local prototypes */
> static u_int	StartPointIn(struct in_addr, u_short, int);
> 
>-static		u_int
>-StartPointOut(struct in_addr, struct in_addr,
>-    u_short, u_short, int);
>+static u_int	StartPointOut(struct in_addr, u_short, int);
> 
> static int	SeqDiff(u_long, u_long);
> 
>@@ -422,16 +420,15 @@ StartPointIn(struct in_addr alias_addr,
> 
> 
> static		u_int
>-StartPointOut(struct in_addr src_addr, struct in_addr dst_addr,
>-    u_short src_port, u_short dst_port, int link_type)
>+StartPointOut(struct in_addr src_addr,
>+    u_short src_port,
>+    int link_type)
> {
> 	u_int n;
> 
> 	n = src_addr.s_addr;
>-	n += dst_addr.s_addr;
> 	if (link_type != LINK_PPTP) {
> 		n += src_port;
>-		n += dst_port;
> 	}
> 	n += link_type;
> 
>@@ -553,8 +550,15 @@ static struct alias_link *
> 		FindLinkOut   (struct libalias *, struct in_addr, struct in_addr, u_short, u_short, int, int);
> 
> static struct alias_link *
>+		FindLinkOutBySource   (struct libalias *, struct in_addr, u_short, int);
>+
>+static struct alias_link *
> 		FindLinkIn    (struct libalias *, struct in_addr, struct in_addr, u_short, u_short, int, int);
> 
>+static struct alias_link *
>+		FindLinkInByAlias    (struct libalias *, struct in_addr, u_short, int);
>+
>+
> 
> #define ALIAS_PORT_BASE            0x08000
> #define ALIAS_PORT_MASK            0x07fff
>@@ -594,6 +598,19 @@ GetNewPort(struct libalias *la, struct alias_link *lnk, int alias_port_param)
> 		 */
> 		max_trials = GET_NEW_PORT_MAX_ATTEMPTS;
> 
>+		if (lnk->link_type == LINK_UDP) {
>+			/*
>+			 * For UDP, we try to reuse the alias address:port for all destinations
>+			 * from the same internal address:port, as per RFC 4787.
>+			 */
>+			struct alias_link *search_result;
>+			search_result = FindLinkOutBySource(la, lnk->src_addr, lnk->src_port, LINK_UDP);
>+			if (search_result != NULL) {
>+				lnk->alias_port = search_result->alias_port;
>+				return (0);
>+			}
>+		}
>+
> 		if (la->packetAliasMode & PKT_ALIAS_SAME_PORTS) {
> 			/*
> 			 * When the PKT_ALIAS_SAME_PORTS option is chosen,
>@@ -626,9 +643,14 @@ GetNewPort(struct libalias *la, struct alias_link *lnk, int alias_port_param)
> 		int go_ahead;
> 		struct alias_link *search_result;
> 
>-		search_result = FindLinkIn(la, lnk->dst_addr, lnk->alias_addr,
>-		    lnk->dst_port, port_net,
>-		    lnk->link_type, 0);
>+		if (lnk->link_type == LINK_UDP) {
>+			search_result = FindLinkInByAlias(la, lnk->alias_addr,
>+			    port_net, lnk->link_type);
>+		} else {
>+			search_result = FindLinkIn(la, lnk->dst_addr, lnk->alias_addr,
>+			    lnk->dst_port, port_net,
>+			    lnk->link_type, 0);
>+		}
> 
> 		if (search_result == NULL)
> 			go_ahead = 1;
>@@ -1040,8 +1062,7 @@ AddLink(struct libalias *la, struct in_addr src_addr, struct in_addr dst_addr,
> 		}
> 
> 		/* Set up pointers for output lookup table */
>-		start_point = StartPointOut(src_addr, dst_addr,
>-		    src_port, dst_port, link_type);
>+		start_point = StartPointOut(src_addr, src_port, link_type);
> 		LIST_INSERT_HEAD(&la->linkTableOut[start_point], lnk, list_out);
> 
> 		/* Set up pointers for input lookup table */
>@@ -1100,7 +1121,7 @@ _FindLinkOut(struct libalias *la, struct in_addr src_addr,
> 	struct alias_link *lnk;
> 
> 	LIBALIAS_LOCK_ASSERT(la);
>-	i = StartPointOut(src_addr, dst_addr, src_port, dst_port, link_type);
>+	i = StartPointOut(src_addr, src_port, link_type);
> 	LIST_FOREACH(lnk, &la->linkTableOut[i], list_out) {
> 		if (lnk->dst_addr.s_addr == dst_addr.s_addr &&
> 		    lnk->src_addr.s_addr == src_addr.s_addr &&
>@@ -1169,6 +1190,51 @@ FindLinkOut(struct libalias *la, struct in_addr src_addr,
> 
> 
> static struct alias_link *
>+FindLinkOutBySource(struct libalias *la, struct in_addr src_addr,
>+    u_short src_port,
>+    int link_type)
>+{
>+	u_int i;
>+	struct alias_link *lnk;
>+
>+	LIBALIAS_LOCK_ASSERT(la);
>+
>+	i = StartPointOut(src_addr, src_port, link_type);
>+	LIST_FOREACH(lnk, &la->linkTableOut[i], list_out) {
>+		if (lnk->src_addr.s_addr == src_addr.s_addr &&
>+		    lnk->src_port == src_port &&
>+		    lnk->link_type == link_type &&
>+		    lnk->server == NULL) {
>+			break;
>+		}
>+	}
>+	return lnk;
>+}
>+
>+
>+static struct alias_link *
>+FindLinkInByAlias(struct libalias *la, struct in_addr alias_addr,
>+    u_short alias_port,
>+    int link_type)
>+{
>+	u_int i;
>+	struct alias_link *lnk;
>+
>+	LIBALIAS_LOCK_ASSERT(la);
>+
>+	i = StartPointIn(alias_addr, alias_port, link_type);
>+	LIST_FOREACH(lnk, &la->linkTableIn[i], list_in) {
>+		if (lnk->alias_addr.s_addr == alias_addr.s_addr &&
>+		    lnk->alias_port == alias_port &&
>+		    lnk->link_type == link_type) {
>+			break;
>+		}
>+	}
>+	return lnk;
>+}
>+
>+
>+static struct alias_link *
> _FindLinkIn(struct libalias *la, struct in_addr dst_addr,
>     struct in_addr alias_addr,
>     u_short dst_port,
>@@ -1592,7 +1658,7 @@ FindPptpOutByCallId(struct libalias *la, struct in_addr src_addr,
> 	struct alias_link *lnk;
> 
> 	LIBALIAS_LOCK_ASSERT(la);
>-	i = StartPointOut(src_addr, dst_addr, 0, 0, LINK_PPTP);
>+	i = StartPointOut(src_addr, 0, LINK_PPTP);
> 	LIST_FOREACH(lnk, &la->linkTableOut[i], list_out)
> 	    if (lnk->link_type == LINK_PPTP &&
> 	    lnk->src_addr.s_addr == src_addr.s_addr &&
>@@ -1613,7 +1679,7 @@ FindPptpOutByPeerCallId(struct libalias *la, struct in_addr src_addr,
> 	struct alias_link *lnk;
> 
> 	LIBALIAS_LOCK_ASSERT(la);
>-	i = StartPointOut(src_addr, dst_addr, 0, 0, LINK_PPTP);
>+	i = StartPointOut(src_addr, 0, LINK_PPTP);
> 	LIST_FOREACH(lnk, &la->linkTableOut[i], list_out)
> 	    if (lnk->link_type == LINK_PPTP &&
> 	    lnk->src_addr.s_addr == src_addr.s_addr &&
>diff --git a/netinet/libalias/libalias.3 b/netinet/libalias/libalias.3
>index e496168..124a377 100644
>--- a/netinet/libalias/libalias.3
>+++ b/netinet/libalias/libalias.3
>@@ -940,10 +940,20 @@ individual packets should be handled.)
> .Pp
> Each aliasing link must have a unique combination of the following five
> quantities: alias address/port, remote address/port and protocol.
>-This ensures that several machines on a local network can share the
>-same aliasing IP address.
>-In cases where conflicts might arise, the aliasing port is chosen so that
>-uniqueness is maintained.
>+.Pp
>+For UDP, the same alias address/port is used for all outgoing packets from
>+a given source address/port, and only from that source address/port,
>+regardless of the remote address/port. This allows NAT hole punching,
>+fixes protocols like STUN, allows clients to send to and receive from
>+multiple remote endpoints like UDP sockets naturally can, and which RFC
>+4787 requires. Each aliasing address/port can thus only be used by a
>+single source address/port. This is an endpoint-independent mapping, or an
>+"(address- and port-restricted) cone NAT".
>+.Pp
>+For TCP, the same alias address/port can be used by connections from many
>+different source addresses/ports, provided they can be distinguished by
>+their destination address/port. When they can't, a different aliasing port
>+is chosen so that uniqueness is maintained.
> .Ss STATIC AND DYNAMIC LINKS
> Aliasing links can either be static or dynamic.
> Static links persist indefinitely and represent fixed rules for translating
>-- 
>2.9.0
>

Actions: View | Diff

Attachments on bug 219918: 183392 | 183455