ikev2_natt.h File Reference

IKEv2 NAT traversal - NAT detection (RFC 7296 §2.23) + UDP-encapsulation demux (RFC 3948). More...

#include "protocore_config.h"

Go to the source code of this file.

Detailed Description

IKEv2 NAT traversal - NAT detection (RFC 7296 §2.23) + UDP-encapsulation demux (RFC 3948).

When a NAT sits between two IKE peers it rewrites the outer IP address / UDP port, which breaks ESP's integrity check over the addresses and hides the peers from each other. IKEv2 detects this by each side sending, in IKE_SA_INIT, two Notify payloads whose data is a hash binding the SA to the addresses each side believes are in use:

NAT_DETECTION_SOURCE_IP = SHA-1( SPIi | SPIr | source IP | source port ) NAT_DETECTION_DESTINATION_IP = SHA-1( SPIi | SPIr | dest IP | dest port )

The SPIs are taken in header order (initiator then responder). The receiver recomputes each hash over the addresses it actually observes: a mismatch on the SOURCE hash means the peer's source was translated (the peer is behind a NAT); a mismatch on the DESTINATION hash means our own address was translated (we are behind a NAT). When either side is behind a NAT both move ESP into UDP on port 4500 (RFC 3948) and the NATed side sends keepalives.

This file is the host-testable NAT-T logic: the detection hash, the two Notify builders (over the tier-1 pc_ike_notify_build), the mismatch tests, and the RFC 3948 marker / keepalive demux. The device side only has to feed it the observed addresses off the socket.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file ikev2_natt.h.