* Purple is the legal property of its developers, whose names are too numerous
* to list here. Please refer to the COPYRIGHT file distributed with this
* Most code in nat-pmp.c copyright (C) 2007, R. Tyler Ballance, bleep, LLC.
* This file is distributed under the 3-clause (modified) BSD license:
* Redistribution and use in source and binary forms, with or without modification, are permitted
* provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice, this list of conditions and
* the following disclaimer.
* Neither the name of the bleep. LLC nor the names of its contributors may be used to endorse or promote
* products derived from this software without specific prior written permission.
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
/* We will need sysctl() and NET_RT_DUMP, both of which are not present
* on all platforms, to continue. */
#if defined(HAVE_SYS_SYSCTL_H) && defined(NET_RT_DUMP)
guint8 opcode; /* 128 + n */
struct _PurplePmpMapResponse {
typedef struct _PurplePmpMapResponse PurplePmpMapResponse;
PURPLE_PMP_STATUS_UNDISCOVERED = -1,
PURPLE_PMP_STATUS_UNABLE_TO_DISCOVER,
PURPLE_PMP_STATUS_DISCOVERING,
PURPLE_PMP_STATUS_DISCOVERED
static PurplePmpInfo pmp_info = {PURPLE_PMP_STATUS_UNDISCOVERED, NULL};
* Thanks to R. Matthew Emerson for the fixes on this
#define PMP_MAP_OPCODE_UDP 1
#define PMP_MAP_OPCODE_TCP 2
#define PMP_TIMEOUT 250000 /* 250000 useconds */
/* alignment constraint for routing socket */
#define ROUNDUP(a) ((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long))
#define ADVANCE(x, n) (x += ROUNDUP((n)->sa_len))
get_rtaddrs(int bitmask, struct sockaddr *sa, struct sockaddr *addrs[])
for (i = 0; i < RTAX_MAX; i++)
#ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
sa = (struct sockaddr *)(ROUNDUP(sa->sa_len) + (char *)sa);
if (sa->sa_family == AF_INET)
sa = (struct sockaddr*)(sizeof(struct sockaddr_in) + (char *)sa);
else if (sa->sa_family == AF_INET6)
sa = (struct sockaddr*)(sizeof(struct sockaddr_in6) + (char *)sa);
is_default_route(struct sockaddr *sa, struct sockaddr *mask)
if (sa->sa_family != AF_INET)
sin = (struct sockaddr_in *)sa;
if ((sin->sin_addr.s_addr == INADDR_ANY) &&
(ntohl(((struct sockaddr_in *)mask)->sin_addr.s_addr) == 0L ||
#ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
* The return sockaddr_in must be g_free()'d when no longer needed
static struct sockaddr_in *
struct sockaddr_in *sin = NULL;
mib[1] = PF_ROUTE; /* entire routing table or a subset of it */
mib[2] = 0; /* protocol number - always 0 */
mib[3] = 0; /* address family - 0 for all addres families */
/* Determine the buffer side needed to get the full routing table */
if (sysctl(mib, 6, NULL, &needed, NULL, 0) < 0)
purple_debug_warning("nat-pmp", "sysctl: net.route.0.0.dump estimate\n");
if (!(buf = malloc(needed)))
purple_debug_warning("nat-pmp", "Failed to malloc %" G_GSIZE_FORMAT "\n", needed);
/* Read the routing table into buf */
if (sysctl(mib, 6, buf, &needed, NULL, 0) < 0)
purple_debug_warning("nat-pmp", "sysctl: net.route.0.0.dump\n");
for (next = buf; next < lim; next += rtm->rtm_msglen)
rtm = (struct rt_msghdr *)next;
sa = (struct sockaddr *)(rtm + 1);
if (sa->sa_family == AF_INET)
struct sockaddr_in *cursin = (struct sockaddr_in*) sa;
if ((rtm->rtm_flags & RTF_GATEWAY)
&& cursin->sin_addr.s_addr == INADDR_ANY)
/* We found the default route. Now get the destination address and netmask. */
struct sockaddr *rti_info[RTAX_MAX];
struct sockaddr addr, mask;
get_rtaddrs(rtm->rtm_addrs, sa, rti_info);
memset(&addr, 0, sizeof(addr));
if (rtm->rtm_addrs & RTA_DST)
memcpy(&addr, rti_info[RTAX_DST], sizeof(addr));
memset(&mask, 0, sizeof(mask));
if (rtm->rtm_addrs & RTA_NETMASK)
memcpy(&mask, rti_info[RTAX_NETMASK], sizeof(mask));
if (rtm->rtm_addrs & RTA_GATEWAY &&
is_default_route(&addr, &mask))
if (rti_info[RTAX_GATEWAY]) {
struct sockaddr_in *rti_sin = (struct sockaddr_in *)rti_info[RTAX_GATEWAY];
sin = g_new0(struct sockaddr_in, 1);
sin->sin_family = rti_sin->sin_family;
sin->sin_port = rti_sin->sin_port;
sin->sin_addr.s_addr = rti_sin->sin_addr.s_addr;
memcpy(sin, rti_info[RTAX_GATEWAY], sizeof(struct sockaddr_in));
purple_debug_info("nat-pmp", "Found a default gateway\n");
* purple_pmp_get_public_ip() will return the publicly facing IP address of the
* default NAT gateway. The function will return NULL if:
* - The gateway doesn't support NAT-PMP
* - The gateway errors in some other spectacular fashion
purple_pmp_get_public_ip()
struct sockaddr_in addr, *gateway, *publicsockaddr = NULL;
struct timeval req_timeout;
PurplePmpIpResponse resp;
if (pmp_info.status == PURPLE_PMP_STATUS_UNABLE_TO_DISCOVER)
if ((pmp_info.status == PURPLE_PMP_STATUS_DISCOVERED) && (pmp_info.publicip != NULL))
purple_debug_info("nat-pmp", "Returning cached publicip %s\n",pmp_info.publicip);
return pmp_info.publicip;
purple_debug_info("nat-pmp", "Cannot request public IP from a NULL gateway!\n");
/* If we get a NULL gateway, don't try again next time */
pmp_info.status = PURPLE_PMP_STATUS_UNABLE_TO_DISCOVER;
/* Default port for NAT-PMP is 5351 */
if (gateway->sin_port != PMP_PORT)
gateway->sin_port = htons(PMP_PORT);
req_timeout.tv_usec = PMP_TIMEOUT;
sendfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
/* Clean out both req and resp structures */
memset(&req, 0, sizeof(PurplePmpIpRequest));
memset(&resp, 0, sizeof(PurplePmpIpResponse));
/* The NAT-PMP spec says we should attempt to contact the gateway 9 times, doubling the time we wait each time.
* Even starting with a timeout of 0.1 seconds, that means that we have a total waiting of 204.6 seconds.
* With the recommended timeout of 0.25 seconds, we're talking 511.5 seconds (8.5 minutes).
* This seems really silly... if this were nonblocking, a couple retries might be in order, but it's not at present.
purple_debug_info("nat-pmp", "Attempting to retrieve the public ip address for the NAT device at: %s\n", inet_ntoa(gateway->sin_addr));
purple_debug_info("nat-pmp", "\tTimeout: %ds %dus\n", req_timeout.tv_sec, req_timeout.tv_usec);
/* TODO: Non-blocking! */
if (sendto(sendfd, &req, sizeof(req), 0, (struct sockaddr *)(gateway), sizeof(struct sockaddr)) < 0)
purple_debug_info("nat-pmp", "There was an error sending the NAT-PMP public IP request! (%s)\n", g_strerror(errno));
pmp_info.status = PURPLE_PMP_STATUS_UNABLE_TO_DISCOVER;
if (setsockopt(sendfd, SOL_SOCKET, SO_RCVTIMEO, &req_timeout, sizeof(req_timeout)) < 0)
purple_debug_info("nat-pmp", "There was an error setting the socket's options! (%s)\n", g_strerror(errno));
pmp_info.status = PURPLE_PMP_STATUS_UNABLE_TO_DISCOVER;
/* TODO: Non-blocking! */
len = sizeof(struct sockaddr_in);
if (recvfrom(sendfd, &resp, sizeof(PurplePmpIpResponse), 0, (struct sockaddr *)(&addr), &len) < 0)
purple_debug_info("nat-pmp", "There was an error receiving the response from the NAT-PMP device! (%s)\n", g_strerror(errno));
pmp_info.status = PURPLE_PMP_STATUS_UNABLE_TO_DISCOVER;
if (addr.sin_addr.s_addr == gateway->sin_addr.s_addr)
purple_debug_info("nat-pmp", "Response was not received from our gateway! Instead from: %s\n", inet_ntoa(addr.sin_addr));
pmp_info.status = PURPLE_PMP_STATUS_UNABLE_TO_DISCOVER;
pmp_info.status = PURPLE_PMP_STATUS_UNABLE_TO_DISCOVER;
purple_debug_info("nat-pmp", "Response received from NAT-PMP device:\n");
purple_debug_info("nat-pmp", "version: %d\n", resp.version);
purple_debug_info("nat-pmp", "opcode: %d\n", resp.opcode);
purple_debug_info("nat-pmp", "resultcode: %d\n", ntohs(resp.resultcode));
purple_debug_info("nat-pmp", "epoch: %d\n", ntohl(resp.epoch));
in.s_addr = resp.address;
purple_debug_info("nat-pmp", "address: %s\n", inet_ntoa(in));
publicsockaddr->sin_addr.s_addr = resp.address;
g_free(pmp_info.publicip);
pmp_info.publicip = g_strdup(inet_ntoa(publicsockaddr->sin_addr));
pmp_info.status = PURPLE_PMP_STATUS_DISCOVERED;
return inet_ntoa(publicsockaddr->sin_addr);
purple_pmp_create_map(PurplePmpType type, unsigned short privateport, unsigned short publicport, int lifetime)
struct sockaddr_in *gateway;
struct timeval req_timeout;
PurplePmpMapResponse *resp;
purple_debug_info("nat-pmp", "Cannot create mapping on a NULL gateway!\n");
/* Default port for NAT-PMP is 5351 */
if (gateway->sin_port != PMP_PORT)
gateway->sin_port = htons(PMP_PORT);
resp = g_new0(PurplePmpMapResponse, 1);
req_timeout.tv_usec = PMP_TIMEOUT;
sendfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
memset(&req, 0, sizeof(PurplePmpMapRequest));
req.opcode = ((type == PURPLE_PMP_TYPE_UDP) ? PMP_MAP_OPCODE_UDP : PMP_MAP_OPCODE_TCP);
req.privateport = htons(privateport); /* What a difference byte ordering makes...d'oh! */
req.publicport = htons(publicport);
req.lifetime = htonl(lifetime);
/* The NAT-PMP spec says we should attempt to contact the gateway 9 times, doubling the time we wait each time.
* Even starting with a timeout of 0.1 seconds, that means that we have a total waiting of 204.6 seconds.
* With the recommended timeout of 0.25 seconds, we're talking 511.5 seconds (8.5 minutes).
* This seems really silly... if this were nonblocking, a couple retries might be in order, but it's not at present.
* XXX Make this nonblocking.
* XXX This code looks like the pmp_get_public_ip() code. Can it be consolidated?
purple_debug_info("nat-pmp", "Attempting to create a NAT-PMP mapping the private port %d, and the public port %d\n", privateport, publicport);
purple_debug_info("nat-pmp", "\tTimeout: %ds %dus\n", req_timeout.tv_sec, req_timeout.tv_usec);
/* TODO: Non-blocking! */
success = (sendto(sendfd, &req, sizeof(req), 0, (struct sockaddr *)(gateway), sizeof(struct sockaddr)) >= 0);
purple_debug_info("nat-pmp", "There was an error sending the NAT-PMP mapping request! (%s)\n", g_strerror(errno));
success = (setsockopt(sendfd, SOL_SOCKET, SO_RCVTIMEO, &req_timeout, sizeof(req_timeout)) >= 0);
purple_debug_info("nat-pmp", "There was an error setting the socket's options! (%s)\n", g_strerror(errno));
/* The original code treats EAGAIN as a reason to iterate.. but I've removed iteration. This may be a problem */
/* TODO: Non-blocking! */
success = ((recvfrom(sendfd, resp, sizeof(PurplePmpMapResponse), 0, NULL, NULL) >= 0) ||
purple_debug_info("nat-pmp", "There was an error receiving the response from the NAT-PMP device! (%s)\n", g_strerror(errno));
success = (resp->opcode == (req.opcode + 128));
purple_debug_info("nat-pmp", "The opcode for the response from the NAT device (%i) does not match the request opcode (%i + 128 = %i)!\n",
resp->opcode, req.opcode, req.opcode + 128);
purple_debug_info("nat-pmp", "Response received from NAT-PMP device:\n");
purple_debug_info("nat-pmp", "version: %d\n", resp->version);
purple_debug_info("nat-pmp", "opcode: %d\n", resp->opcode);
purple_debug_info("nat-pmp", "resultcode: %d\n", ntohs(resp->resultcode));
purple_debug_info("nat-pmp", "epoch: %d\n", ntohl(resp->epoch));
purple_debug_info("nat-pmp", "privateport: %d\n", ntohs(resp->privateport));
purple_debug_info("nat-pmp", "publicport: %d\n", ntohs(resp->publicport));
purple_debug_info("nat-pmp", "lifetime: %d\n", ntohl(resp->lifetime));
/* XXX The private port may actually differ from the one we requested, according to the spec.
* We don't handle that situation at present.
* TODO: Look at the result and verify it matches what we wanted; either return a failure if it doesn't,
* or change network.c to know what to do if the desired private port shifts as a result of the nat-pmp operation.
purple_pmp_destroy_map(PurplePmpType type, unsigned short privateport)
success = purple_pmp_create_map(((type == PURPLE_PMP_TYPE_UDP) ? PMP_MAP_OPCODE_UDP : PMP_MAP_OPCODE_TCP),
purple_debug_warning("nat-pmp", "Failed to properly destroy mapping for %s port %d!\n",
((type == PURPLE_PMP_TYPE_UDP) ? "UDP" : "TCP"), privateport);
purple_pmp_network_config_changed_cb(GNetworkMonitor *monitor, gboolean avialable, gpointer data)
pmp_info.status = PURPLE_PMP_STATUS_UNDISCOVERED;
g_free(pmp_info.publicip);
pmp_info.publicip = NULL;
purple_pmp_get_handle(void)
g_signal_connect(g_network_monitor_get_default(),
G_CALLBACK(purple_pmp_network_config_changed_cb),
#else /* #ifdef NET_RT_DUMP */
purple_pmp_get_public_ip()
purple_pmp_create_map(PurplePmpType type, unsigned short privateport, unsigned short publicport, int lifetime)
purple_pmp_destroy_map(PurplePmpType type, unsigned short privateport)
#endif /* #if !(defined(HAVE_SYS_SYCTL_H) && defined(NET_RT_DUMP)) */
