Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 02 May 2012 21:50:11 +0300
From:      Zmiter <zmiterby@gmail.com>
To:        Andreas Longwitz <longwitz@incore.de>
Cc:        freebsd-stable@freebsd.org
Subject:   Re: Support for IPSec NAT-T in transoprt mode
Message-ID:  <4FA181E3.9020303@gmail.com>
In-Reply-To: <4F970899.2040105@incore.de>
References:  <4F970899.2040105@incore.de>

next in thread | previous in thread | raw e-mail | index | archive | help
24.04.2012 23:10, Andreas Longwitz ?????:
> There is one limitation I would like to get over. From man 8 setkey:
> System that do not perform the port check cannot support multiple
> endpoints behind the same NAT. I think this is a FreeBSD kernel restriction:
> For the first incoming L2TP packet the IPSEC part of the kernel does not
> save the source port in the corresponding SA (maybe a field like
> natt_l2tp_port). So the kernel does for outgoing L2TP packets not know
> the correct SA, if two ore more SA's with the same IP exists.
>
> I would like to know if the patch mentioned in this thread adresses this
> problem.
Thank you very much for your attention.
I've been testing those patches (actually, without your part) and YES 
it's a big problem with clients (Android, Windows Mobile) behind the 
same NAT. I cannot find the solution yet, but I'm very interested in it.
So, my Androids is some sort of stupid bricks, they do not send NAT-OA 
payloads at phase 2, and ipsec-tools fills the SPD with IPs taken from 
IDs. But this is not the correct way. IDs contain LAN (which is behind 
the NAT) addresses, and FreeBSD cannot route packets to the IPSec crypto 
part.
I've made some quick patching of IPSec tools to get my devices working, 
but I don't know if they accomodate to the RFCs and ISAKMP. The main 
idea is to take NAT-OAi and NAT-OAr addresses not from IDs when we are 
using NAT-T, but from real source and destination addresses of the 
server and client NATs.

Here is my ipsec-tools patch (i've call it patch-zz-local-2.diff and 
place at /usr/ports/security/ipsec-tools/files with two other patches 
from kern /146190)

*** src/racoon/pfkey.c	2012-04-13 02:02:02.000000000 +0300
--- src/racoon/pfkey.c	2012-04-19 12:47:57.000000000 +0300
***************
*** 1195,1200 ****
--- 1195,1202 ----
   #ifdef SADB_X_EXT_NAT_T_FRAG
   			sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag;
   #endif
+ 			plog(LLV_DEBUG2, LOCATION, NULL, "sa_args.l_natt_oa = %s\n", saddr2str(sa_args.l_natt_oa));
+ 			plog(LLV_DEBUG2, LOCATION, NULL, "sa_args.l_natt_oa_dst = %s\n", saddr2str(sa_args.l_natt_oa_dst));
   		}
   #endif

***************
*** 1483,1488 ****
--- 1485,1492 ----
   #ifdef SADB_X_EXT_NAT_T_FRAG
   			sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag;
   #endif
+ 			plog(LLV_DEBUG2, LOCATION, NULL, "sa_args.l_natt_oa = %s\n", saddr2str(sa_args.l_natt_oa));
+ 			plog(LLV_DEBUG2, LOCATION, NULL, "sa_args.l_natt_oa_dst = %s\n", saddr2str(sa_args.l_natt_oa_dst));
   		}
   #endif
   		/* more info to fill in */
*** src/racoon/isakmp_quick.c	2011-03-14 19:18:13.000000000 +0200
--- src/racoon/isakmp_quick.c	2012-04-19 17:23:16.000000000 +0300
***************
*** 562,567 ****
--- 562,569 ----
   			if (daddr == NULL)
   				goto end;

+ 			plog(LLV_DEBUG2, LOCATION, NULL, "daddr = %s, natoa_src = %s, natoa_dst = %s\n", saddr2str(daddr), saddr2str(iph2->natoa_src), saddr2str(iph2->natoa_dst));
+
   			if (iph2->natoa_src == NULL)
   				iph2->natoa_src = daddr;
   			else if (iph2->natoa_dst == NULL)
***************
*** 1262,1267 ****
--- 1264,1271 ----
   			if (daddr == NULL)
   				goto end;

+ 			plog(LLV_DEBUG2, LOCATION, NULL, "daddr = %s, natoa_src = %s, natoa_dst = %s\n", saddr2str(daddr), saddr2str(iph2->natoa_src), saddr2str(iph2->natoa_dst));
+
   			if (iph2->natoa_dst == NULL)
   				iph2->natoa_dst = daddr;
   			else if (iph2->natoa_src == NULL)
***************
*** 1309,1314 ****
--- 1313,1345 ----
   		plogdump(LLV_DEBUG, iph2->id->v, iph2->id->l);
   	}

+ #ifdef ENABLE_NATT
+ 	if (iph2->ph1->natt_flags&  NAT_DETECTED)
+ 	{
+ 		struct sockaddr_storage addr;
+ 		u_int8_t prefix;
+ 		u_int16_t ul_proto;
+ 	
+ 		if (iph2->natoa_src == NULL)
+ 			if (!ipsecdoi_id2sockaddr(iph2->id,
+ 				(struct sockaddr *)&addr,
+ 				&prefix,&ul_proto))
+ 			{
+ 				iph2->natoa_src = dupsaddr((struct sockaddr *)&addr);
+ 				plog(LLV_DEBUG2, LOCATION, NULL, "natoa_src set from IDcr2: natoa_src = %s\n", saddr2str(iph2->natoa_src));
+ 			}
+
+ 		if (iph2->natoa_dst == NULL)
+ 			if (!ipsecdoi_id2sockaddr(iph2->id_p,
+ 				(struct sockaddr *)&addr,
+ 				&prefix,&ul_proto))
+ 			{
+ 				iph2->natoa_dst = dupsaddr((struct sockaddr *)&addr);
+ 				plog(LLV_DEBUG2, LOCATION, NULL, "natoa_dst set from IDci2: natoa_dst = %s\n", saddr2str(iph2->natoa_dst));
+ 			}
+ 	}
+ #endif
+
   	/* adjust buffer length for HASH */
   	hbuf->l = tlen;

***************
*** 2297,2302 ****
--- 2328,2340 ----
   		}
   #endif

+ #ifdef ENABLE_NATT
+ 		if (iph2->ph1->natt_flags&  NAT_DETECTED)
+ 		{
+ 			memcpy(&((struct sockaddr_in *)&spidx.dst)->sin_addr,&((struct sockaddr_in *)iph2->src)->sin_addr, sizeof(in_addr_t));
+ 		}
+ #endif
+
   		if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
   		 || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR)
   			idi2type = _XIDT(iph2->id);
***************
*** 2356,2361 ****
--- 2394,2405 ----
   		}
   #endif

+ #ifdef ENABLE_NATT
+ 		if (iph2->ph1->natt_flags&  NAT_DETECTED)
+ 		{
+ 			memcpy(&((struct sockaddr_in *)&spidx.src)->sin_addr,&((struct sockaddr_in *)iph2->dst)->sin_addr, sizeof(in_addr_t));
+ 		}
+ #endif
   		/* Before setting iph2->[sa_src, sa_dst] with the addresses
   		 * provided in ID payloads, we check:
   		 * - they are both addresses of same family

************************
end of patch
************************

And here is my sys/netipsec/ipsec_input.c patch:


*** sys/netipsec/ipsec_input.c	2011-10-17 15:29:28.000000000 +0300
--- sys/netipsec/ipsec_input.c	2012-04-13 14:42:00.000000000 +0300
***************
*** 76,81 ****
--- 76,86 ----
   #include<netinet/icmp6.h>
   #endif

+ #ifdef IPSEC_NAT_T
+ #include<netinet/tcp.h>
+ #include<netinet/udp.h>
+ #endif
+
   #include<netipsec/ipsec.h>
   #ifdef INET6
   #include<netipsec/ipsec6.h>
***************
*** 347,352 ****
--- 352,383 ----
   	}
   	prot = ip->ip_p;

+ #ifdef IPSEC_NAT_T
+ 	if (saidx->mode == IPSEC_MODE_TRANSPORT&&  sproto == IPPROTO_ESP) {
+ 		if (V_esp_ignore_natt_cksum != 0) {
+ 			/* Ignore checksum of packet protected by ESP.  */
+ 			if (prot == IPPROTO_TCP || prot == IPPROTO_UDP) {
+ 				m->m_pkthdr.csum_flags |= (CSUM_DATA_VALID | CSUM_PSEUDO_HDR);
+ 				m->m_pkthdr.csum_data = 0xffff;
+ 			}
+ 		} else if (sav->natt_cksum != 0) {
+ 			if (prot == IPPROTO_TCP || prot == IPPROTO_UDP) {
+ 				u_int16_t proto_cksum;
+ 				int off = sizeof(struct ip);
+ 				if (prot == IPPROTO_TCP) {
+ 					off += offsetof(struct tcphdr, th_sum);
+ 				} else if (prot == IPPROTO_UDP) {
+ 					off += offsetof(struct udphdr, uh_sum);
+ 				}
+ 				m_copydata(m, off, sizeof(u_int16_t), (caddr_t)&proto_cksum);
+ 				proto_cksum = in_addword(sav->natt_cksum, ~ntohs(proto_cksum));
+ 				proto_cksum = ~htons(proto_cksum);
+ 				m_copyback(m, off, sizeof(u_int16_t), (caddr_t)&proto_cksum);
+ 			}
+ 		}
+ 	}
+ #endif
+
   #ifdef notyet
   	/* IP-in-IP encapsulation */
   	if (prot == IPPROTO_IPIP) {

*****************************
end of patch
*****************************

It differs from that in kern/146190 in one simple thing. I have problems with the original patch from kern/146190. When there was no NAT-OAi or NAT-OAr values in the kernel space, checksums was calculated at 0, but they were not ignored despite of the sysctl net.inet.esp.esp_ignore_natt_cksum value. The improvement allows to ignore every checksum in esp packets when net.inet.esp.esp_ignore_natt_cksum=1.


Thanks.
Zmiter
02.05.2012




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4FA181E3.9020303>