Merge remote-tracking branch 'origin/master' into credentials

9 files changed, 339 insertions, 160 deletions

diff --git a/src/gns/gnunet-gns-proxy.c b/src/gns/gnunet-gns-proxy.c
index ef9c7bf62..3a38970a8 100644
--- a/src/gns/gnunet-gns-proxy.c
+++ b/src/gns/gnunet-gns-proxy.c
@@ -1761,7 +1761,8 @@ create_response (void *cls,
   {
 
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
-                "Processing %lu bytes UPLOAD\n", *upload_data_size);
+                "Processing %u bytes UPLOAD\n",
+                (unsigned int) *upload_data_size);
     
     /* FIXME: This must be set or a header with Transfer-Encoding: chunked. Else
      * upload callback is not called!
diff --git a/src/include/gnunet_nat_service.h b/src/include/gnunet_nat_service.h
index 4df17b531..1620c9433 100644
--- a/src/include/gnunet_nat_service.h
+++ b/src/include/gnunet_nat_service.h
@@ -155,15 +155,11 @@ typedef void
  * reversal.
  *
  * @param cls closure
- * @param local_addr address where we received the request
- * @param local_addrlen actual length of the @a local_addr
  * @param remote_addr public IP address of the other peer
  * @param remote_addrlen actual length of the @a remote_addr
  */
 typedef void
 (*GNUNET_NAT_ReversalCallback) (void *cls,
-                                const struct sockaddr *local_addr,
-                                socklen_t local_addrlen,
                                 const struct sockaddr *remote_addr,
                                 socklen_t remote_addrlen);
 
@@ -184,8 +180,7 @@ struct GNUNET_NAT_Handle;
  *
  * @param cfg configuration to use
  * @param proto protocol this is about, IPPROTO_TCP or IPPROTO_UDP
- * @param adv_port advertised port (port we are either bound to or that our OS
- *                 locally performs redirection from to our bound port).
+ * @param hole_external hostname and port of manually punched hole in NAT, otherwise NULL (or empty string)
  * @param num_addrs number of addresses in @a addrs
  * @param addrs list of local addresses packets should be redirected to
  * @param addrlens actual lengths of the addresses in @a addrs
@@ -198,7 +193,7 @@ struct GNUNET_NAT_Handle;
 struct GNUNET_NAT_Handle *
 GNUNET_NAT_register (const struct GNUNET_CONFIGURATION_Handle *cfg,
                      uint8_t proto,
-                     uint16_t adv_port,
+                     const char *hole_external,
                      unsigned int num_addrs,
                      const struct sockaddr **addrs,
                      const socklen_t *addrlens,
diff --git a/src/nat/gnunet-helper-nat-server.c b/src/nat/gnunet-helper-nat-server.c
index 8c3df749d..ef8e97482 100644
--- a/src/nat/gnunet-helper-nat-server.c
+++ b/src/nat/gnunet-helper-nat-server.c
@@ -264,8 +264,11 @@ send_icmp_echo (const struct in_addr *my_ip)
   ip_pkt.src_ip = my_ip->s_addr;
   ip_pkt.dst_ip = dummy.s_addr;
   ip_pkt.checksum =
-      htons (calc_checksum ((uint16_t *) & ip_pkt, sizeof (struct ip_header)));
-  memcpy (&packet[off], &ip_pkt, sizeof (struct ip_header));
+      htons (calc_checksum ((uint16_t *) & ip_pkt,
+                            sizeof (struct ip_header)));
+  memcpy (&packet[off],
+          &ip_pkt,
+          sizeof (struct ip_header));
   off += sizeof (struct ip_header);
 
   icmp_echo.type = ICMP_ECHO;
@@ -273,9 +276,12 @@ send_icmp_echo (const struct in_addr *my_ip)
   icmp_echo.checksum = 0;
   icmp_echo.reserved = 0;
   icmp_echo.checksum =
-      htons (calc_checksum
-             ((uint16_t *) & icmp_echo, sizeof (struct icmp_echo_header)));
-  memcpy (&packet[off], &icmp_echo, sizeof (struct icmp_echo_header));
+    htons (calc_checksum
+           ((uint16_t *) & icmp_echo,
+            sizeof (struct icmp_echo_header)));
+  memcpy (&packet[off],
+          &icmp_echo,
+          sizeof (struct icmp_echo_header));
   off += sizeof (struct icmp_echo_header);
 
   memset (&dst, 0, sizeof (dst));
@@ -284,17 +290,24 @@ send_icmp_echo (const struct in_addr *my_ip)
   dst.sin_len = sizeof (struct sockaddr_in);
 #endif
   dst.sin_addr = dummy;
-  err =
-      sendto (rawsock, packet, off, 0, (struct sockaddr *) &dst, sizeof (dst));
+  err = sendto (rawsock,
+                packet,
+                off,
+                0,
+                (struct sockaddr *) &dst,
+                sizeof (dst));
   if (err < 0)
   {
 #if VERBOSE
-    fprintf (stderr, "sendto failed: %s\n", strerror (errno));
+    fprintf (stderr,
+             "sendto failed: %s\n",
+             strerror (errno));
 #endif
   }
   else if (sizeof (packet) != err)
   {
-    fprintf (stderr, "Error: partial send of ICMP message\n");
+    fprintf (stderr,
+             "Error: partial send of ICMP message\n");
   }
 }
 
@@ -315,16 +328,24 @@ send_udp ()
 #endif
   dst.sin_addr = dummy;
   dst.sin_port = htons (NAT_TRAV_PORT);
-  err = sendto (udpsock, NULL, 0, 0, (struct sockaddr *) &dst, sizeof (dst));
+  err = sendto (udpsock,
+                NULL,
+                0,
+                0,
+                (struct sockaddr *) &dst,
+                sizeof (dst));
   if (err < 0)
   {
 #if VERBOSE
-    fprintf (stderr, "sendto failed: %s\n", strerror (errno));
+    fprintf (stderr,
+             "sendto failed: %s\n",
+             strerror (errno));
 #endif
   }
   else if (0 != err)
   {
-    fprintf (stderr, "Error: partial send of ICMP message\n");
+    fprintf (stderr,
+             "Error: partial send of ICMP message\n");
   }
 }
 
@@ -348,11 +369,15 @@ process_icmp_response ()
   have = read (icmpsock, buf, sizeof (buf));
   if (-1 == have)
   {
-    fprintf (stderr, "Error reading raw socket: %s\n", strerror (errno));
+    fprintf (stderr,
+             "Error reading raw socket: %s\n",
+             strerror (errno));
     return;
   }
 #if VERBOSE
-  fprintf (stderr, "Received message of %u bytes\n", (unsigned int) have);
+  fprintf (stderr,
+           "Received message of %u bytes\n",
+           (unsigned int) have);
 #endif
   if (have <
       (ssize_t) (sizeof (struct ip_header) +
@@ -433,15 +458,27 @@ setup_raw_socket ()
   const int one = 1;
 
   if (-1 ==
-      setsockopt (rawsock, SOL_SOCKET, SO_BROADCAST, (char *) &one, sizeof (one)))
+      setsockopt (rawsock,
+                  SOL_SOCKET,
+                  SO_BROADCAST,
+                  (char *) &one,
+                  sizeof (one)))
   {
-    fprintf (stderr, "setsockopt failed: %s\n", strerror (errno));
+    fprintf (stderr,
+             "setsockopt failed: %s\n",
+             strerror (errno));
     return -1;
   }
   if (-1 ==
-      setsockopt (rawsock, IPPROTO_IP, IP_HDRINCL, (char *) &one, sizeof (one)))
+      setsockopt (rawsock,
+                  IPPROTO_IP,
+                  IP_HDRINCL,
+                  (char *) &one,
+                  sizeof (one)))
   {
-    fprintf (stderr, "setsockopt failed: %s\n", strerror (errno));
+    fprintf (stderr,
+             "setsockopt failed: %s\n",
+             strerror (errno));
     return -1;
   }
   return 0;
@@ -492,7 +529,8 @@ make_udp_socket (const struct in_addr *my_ip)
 
 
 int
-main (int argc, char *const *argv)
+main (int argc,
+      char *const *argv)
 {
   struct in_addr external;
   fd_set rs;
@@ -504,11 +542,15 @@ main (int argc, char *const *argv)
   int global_ret;
 
   /* Create an ICMP raw socket for reading (we'll check errors later) */
-  icmpsock = socket (AF_INET, SOCK_RAW, IPPROTO_ICMP);
+  icmpsock = socket (AF_INET,
+                     SOCK_RAW,
+                     IPPROTO_ICMP);
   icmp_eno = errno;
 
   /* Create an (ICMP) raw socket for writing (we'll check errors later) */
-  rawsock = socket (AF_INET, SOCK_RAW, IPPROTO_RAW);
+  rawsock = socket (AF_INET,
+                    SOCK_RAW,
+                    IPPROTO_RAW);
   raw_eno = errno;
   udpsock = -1;
 
@@ -517,14 +559,18 @@ main (int argc, char *const *argv)
 #ifdef HAVE_SETRESUID
   if (0 != setresuid (uid, uid, uid))
   {
-    fprintf (stderr, "Failed to setresuid: %s\n", strerror (errno));
+    fprintf (stderr,
+             "Failed to setresuid: %s\n",
+             strerror (errno));
     global_ret = 1;
     goto error_exit;
   }
 #else
   if (0 != (setuid (uid) | seteuid (uid)))
   {
-    fprintf (stderr, "Failed to setuid: %s\n", strerror (errno));
+    fprintf (stderr,
+             "Failed to setuid: %s\n",
+             strerror (errno));
     global_ret = 2;
     goto error_exit;
   }
@@ -540,13 +586,16 @@ main (int argc, char *const *argv)
   }
   if (1 != inet_pton (AF_INET, argv[1], &external))
   {
-    fprintf (stderr, "Error parsing IPv4 address: %s\n", strerror (errno));
+    fprintf (stderr,
+             "Error parsing IPv4 address: %s\n",
+             strerror (errno));
     global_ret = 4;
     goto error_exit;
   }
   if (1 != inet_pton (AF_INET, DUMMY_IP, &dummy))
   {
-    fprintf (stderr, "Internal error converting dummy IP to binary.\n");
+    fprintf (stderr,
+             "Internal error converting dummy IP to binary.\n");
     global_ret = 5;
     goto error_exit;
   }
@@ -554,7 +603,9 @@ main (int argc, char *const *argv)
   /* error checking icmpsock */
   if (-1 == icmpsock)
   {
-    fprintf (stderr, "Error opening RAW socket: %s\n", strerror (icmp_eno));
+    fprintf (stderr,
+             "Error opening RAW socket: %s\n",
+             strerror (icmp_eno));
     global_ret = 6;
     goto error_exit;
   }
@@ -562,7 +613,9 @@ main (int argc, char *const *argv)
   {
     /* this could happen if we were started with a large number of already-open
        file descriptors... */
-    fprintf (stderr, "Socket number too large (%d > %u)\n", icmpsock,
+    fprintf (stderr,
+             "Socket number too large (%d > %u)\n",
+             icmpsock,
              (unsigned int) FD_SETSIZE);
     global_ret = 7;
     goto error_exit;
@@ -571,7 +624,9 @@ main (int argc, char *const *argv)
   /* error checking rawsock */
   if (-1 == rawsock)
   {
-    fprintf (stderr, "Error opening RAW socket: %s\n", strerror (raw_eno));
+    fprintf (stderr,
+             "Error opening RAW socket: %s\n",
+             strerror (raw_eno));
     global_ret = 8;
     goto error_exit;
   }
@@ -601,7 +656,9 @@ main (int argc, char *const *argv)
     {
       if (errno == EINTR)
         continue;
-      fprintf (stderr, "select failed: %s\n", strerror (errno));
+      fprintf (stderr,
+               "select failed: %s\n",
+               strerror (errno));
       break;
     }
     if (1 == getppid ())        /* Check the parent process id, if 1 the parent has died, so we should die too */
diff --git a/src/nat/gnunet-nat.c b/src/nat/gnunet-nat.c
index 4d0ed5723..81e4549b5 100644
--- a/src/nat/gnunet-nat.c
+++ b/src/nat/gnunet-nat.c
@@ -39,9 +39,10 @@ static int global_ret;
 static struct GNUNET_NAT_AutoHandle *ah;
 
 /**
- * Port we advertise.
+ * External hostname and port, if user manually punched
+ * the NAT.  
  */ 
-static unsigned int adv_port;
+static char *hole_external;
 
 /**
  * Flag set to 1 if we use IPPROTO_UDP.
@@ -338,15 +339,11 @@ address_cb (void *cls,
  * reversal.
  *
  * @param cls closure, NULL
- * @param local_addr address where we received the request
- * @param local_addrlen actual length of the @a local_addr
  * @param remote_addr public IP address of the other peer
  * @param remote_addrlen actual length of the @a remote_addr
  */
 static void
 reversal_cb (void *cls,
-             const struct sockaddr *local_addr,
-             socklen_t local_addrlen,
              const struct sockaddr *remote_addr,
              socklen_t remote_addrlen)
 {
@@ -572,7 +569,7 @@ run (void *cls,
   {
     nh = GNUNET_NAT_register (c,
                               proto,
-                              (uint16_t) adv_port,
+                              hole_external,
                               1,
                               (const struct sockaddr **) &local_sa,
                               &local_len,
@@ -580,6 +577,14 @@ run (void *cls,
                               (listen_reversal) ? &reversal_cb : NULL,
                               NULL);
   }
+  else if (listen_reversal)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_MESSAGE,
+                "Use of `-W` only effective in combination with `-i`\n");    
+    global_ret = 1;
+    GNUNET_SCHEDULER_shutdown ();
+    return;
+  }
 
   if (NULL != remote_addr)
   {
@@ -693,9 +698,9 @@ main (int argc,
     {'r', "remote", "ADDRESS",
      gettext_noop ("which remote IP and port should be asked for connection reversal"),
      GNUNET_YES, &GNUNET_GETOPT_set_string, &remote_addr },
-    {'p', "port", NULL,
-     gettext_noop ("port to use to advertise"),
-     GNUNET_YES, &GNUNET_GETOPT_set_uint, &adv_port },
+    {'p', "punched", NULL,
+     gettext_noop ("external hostname and port of NAT, if punched manually; use AUTO for hostname for automatic determination of the external IP"),
+     GNUNET_YES, &GNUNET_GETOPT_set_string, &hole_external },
     {'s', "stun", NULL,
      gettext_noop ("enable STUN processing"),
      GNUNET_NO, &GNUNET_GETOPT_set_one, &do_stun },
diff --git a/src/nat/gnunet-service-nat.c b/src/nat/gnunet-service-nat.c
index 762175437..e29f37108 100644
--- a/src/nat/gnunet-service-nat.c
+++ b/src/nat/gnunet-service-nat.c
@@ -1,6 +1,6 @@
 /*
   This file is part of GNUnet.
-  Copyright (C) 2016 GNUnet e.V.
+  Copyright (C) 2016, 2017 GNUnet e.V.
 
   GNUnet is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published
@@ -28,9 +28,12 @@
  * knowledge about the local network topology.
  *
  * TODO:
- * - test ICMP based NAT traversal
+ * - test and document (!) ICMP based NAT traversal
+ * - implement manual hole punching support (incl. DNS
+ *   lookup for DynDNS setups!)
  * - implement "more" autoconfig:
  *   re-work gnunet-nat-server & integrate!
+ *   + test manually punched NAT (how?)
  * - implement & test STUN processing to classify NAT;
  *   basically, open port & try different methods.
  * - implement NEW logic for external IP detection
@@ -129,6 +132,16 @@ struct ClientHandle
    * Array of addresses used by the service.
    */
   struct ClientAddress *caddrs;
+
+  /**
+   * External DNS name and port given by user due to manual
+   * hole punching.  Special DNS name 'AUTO' is used to indicate
+   * desire for automatic determination of the external IP 
+   * (instead of DNS or manual configuration, i.e. to be used 
+   * if the IP keeps changing and we have no DynDNS, but we do
+   * have a hole punched).
+   */
+  char *hole_external;
   
   /**
    * What does this client care about?
@@ -141,12 +154,6 @@ struct ClientHandle
   int natted_address;
   
   /**
-   * Port we would like as we are configured to use this one for
-   * advertising (in addition to the one we are binding to).
-   */
-  uint16_t adv_port;
-
-  /**
    * Number of addresses that this service is bound to.
    * Length of the @e caddrs array.
    */
@@ -176,6 +183,12 @@ struct LocalAddressList
   struct LocalAddressList *prev;
 
   /**
+   * Context for a gnunet-helper-nat-server used to listen
+   * for ICMP messages to this client for connection reversal.
+   */
+  struct HelperContext *hc;
+  
+  /**
    * The address itself (i.e. `struct sockaddr_in` or `struct
    * sockaddr_in6`, in the respective byte order).
    */
@@ -383,6 +396,31 @@ static struct in_addr mini_external_ipv4;
 
 
 /**
+ * Remove and free an entry from the #lal_head DLL.
+ *
+ * @param lal entry to free
+ */
+static void
+free_lal (struct LocalAddressList *lal)
+{
+  GNUNET_CONTAINER_DLL_remove (lal_head,
+                               lal_tail,
+                               lal);
+  if (NULL != lal->hc)
+  {
+    GNUNET_log (GNUNET_ERROR_TYPE_MESSAGE,
+                "Lost NATed local address %s, stopping NAT server\n",
+                GNUNET_a2s ((const struct sockaddr *) &lal->addr,
+                            sizeof (struct sockaddr_in)));
+
+    GN_stop_gnunet_nat_server_ (lal->hc);
+    lal->hc = NULL;
+  }
+  GNUNET_free (lal);
+}
+
+
+/**
  * Free the DLL starting at #lal_head.
  */ 
 static void
@@ -391,12 +429,7 @@ destroy_lal ()
   struct LocalAddressList *lal;
 
   while (NULL != (lal = lal_head))
-  {
-    GNUNET_CONTAINER_DLL_remove (lal_head,
-                                 lal_tail,
-                                 lal);
-    GNUNET_free (lal);
-  }
+    free_lal (lal);
 }
 
 
@@ -448,7 +481,14 @@ check_register (void *cls,
       GNUNET_break (0);
       return GNUNET_SYSERR;      
     }
-  }  
+    off += alen;
+    left -= alen;
+  }
+  if (left != ntohs (message->hole_external_len))
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;      
+  }
   return GNUNET_OK; 
 }
 
@@ -718,10 +758,12 @@ check_notify_client (struct LocalAddressList *delta,
     GNUNET_memcpy (&v4,
                    &delta->addr,
                    alen);
+    
+    /* Check for client notifications */
     for (unsigned int i=0;i<ch->num_caddrs;i++)
     {
       const struct sockaddr_in *c4;
-      
+
       if (AF_INET != ch->caddrs[i].ss.ss_family)
         return; /* IPv4 not relevant */
       c4 = (const struct sockaddr_in *) &ch->caddrs[i].ss;
@@ -857,40 +899,37 @@ check_notify_client_external_ipv4_change (const struct in_addr *v4,
                                           int add)
 {
   struct sockaddr_in sa;
-  uint16_t port;
-  uint16_t bport;
+  int have_v4;
 
   /* (1) check if client cares. */
   if (! ch->natted_address)
     return;
   if (0 == (GNUNET_NAT_RF_ADDRESSES & ch->flags))
     return;
-  bport = 0;
+  have_v4 = GNUNET_NO;
   for (unsigned int i=0;i<ch->num_caddrs;i++)
   {
     const struct sockaddr_storage *ss = &ch->caddrs[i].ss;
 
     if (AF_INET != ss->ss_family)
       continue;
-    bport = ntohs (((const struct sockaddr_in *) ss)->sin_port);
+    have_v4 = GNUNET_YES;
+    break;
   }
-  if (0 == bport)
+  if (GNUNET_NO == have_v4)
     return; /* IPv6-only */
-  
-  /* (2) figure out external port, build sockaddr */
-  port = ch->adv_port;
-  if (0 == port)
-    port = bport;
+
+  /* build address info */
   memset (&sa,
           0,
           sizeof (sa));
   sa.sin_family = AF_INET;
   sa.sin_addr = *v4;
-  sa.sin_port = htons (port);
+  sa.sin_port = htons (0);
   
   /* (3) notify client of change */
   notify_client (is_nat_v4 (v4)
-                 ? GNUNET_NAT_AC_EXTERN | GNUNET_NAT_AC_LAN_PRIVATE 
+                 ? GNUNET_NAT_AC_EXTERN | GNUNET_NAT_AC_LAN 
                  : GNUNET_NAT_AC_EXTERN | GNUNET_NAT_AC_GLOBAL,
                  ch,
                  add,
@@ -1006,6 +1045,65 @@ run_external_ip (void *cls)
 
 
 /**
+ * We got a connection reversal request from another peer.
+ * Notify applicable clients.
+ *
+ * @param cls closure with the `struct LocalAddressList` 
+ * @param ra IP address of the peer who wants us to connect to it 
+ */
+static void
+reversal_callback (void *cls,
+                   const struct sockaddr_in *ra)
+{
+  struct LocalAddressList *lal = cls;
+  const struct sockaddr_in *l4;
+
+  GNUNET_assert (AF_INET == lal->af);
+  l4 = (const struct sockaddr_in *) &lal->addr;
+  for (struct ClientHandle *ch = ch_head;
+       NULL != ch;
+       ch = ch->next)
+  {    
+    struct GNUNET_NAT_ConnectionReversalRequestedMessage *crrm;
+    struct GNUNET_MQ_Envelope *env;
+    int match;
+
+    /* Check if client is in applicable range for ICMP NAT traversal
+       for this local address */
+    if (! ch->natted_address)
+      continue;
+    match = GNUNET_NO;
+    for (unsigned int i=0;i<ch->num_caddrs;i++)
+    {
+      struct ClientAddress *ca = &ch->caddrs[i];
+      const struct sockaddr_in *c4;
+      
+      if (AF_INET != ca->ss.ss_family)
+        continue;
+      c4 = (const struct sockaddr_in *) &ca->ss;
+      if ( (0 != c4->sin_addr.s_addr) &&
+           (l4->sin_addr.s_addr != c4->sin_addr.s_addr) )
+        continue;
+      match = GNUNET_YES;
+      break;
+    }
+    if (! match)
+      continue;
+
+    /* Notify applicable client about connection reversal request */
+    env = GNUNET_MQ_msg_extra (crrm,
+                               sizeof (struct sockaddr_in),
+                               GNUNET_MESSAGE_TYPE_NAT_CONNECTION_REVERSAL_REQUESTED);
+    GNUNET_memcpy (&crrm[1],
+                   ra,
+                   sizeof (struct sockaddr_in));
+    GNUNET_MQ_send (ch->mq,
+                    env);
+  }
+}
+
+
+/**
  * Task we run periodically to scan for network interfaces.
  *
  * @param cls NULL
@@ -1016,6 +1114,7 @@ run_scan (void *cls)
   struct IfcProcContext ifc_ctx;
   int found;
   int have_nat;
+  struct LocalAddressList *lnext;
   
   scan_task = GNUNET_SCHEDULER_add_delayed (SCAN_FREQ,
                                             &run_scan,
@@ -1028,8 +1127,9 @@ run_scan (void *cls)
   /* remove addresses that disappeared */
   for (struct LocalAddressList *lal = lal_head;
        NULL != lal;
-       lal = lal->next)
+       lal = lnext)
   {
+    lnext = lal->next;
     found = GNUNET_NO;
     for (struct LocalAddressList *pos = ifc_ctx.lal_head;
          NULL != pos;
@@ -1041,18 +1141,23 @@ run_scan (void *cls)
                          (AF_INET == lal->af)
                          ? sizeof (struct sockaddr_in)
                          : sizeof (struct sockaddr_in6))) )
+      {
         found = GNUNET_YES;
+      }
     }
     if (GNUNET_NO == found)
+    {
       notify_clients (lal,
                       GNUNET_NO);
+      free_lal (lal);
+    }
   }
 
   /* add addresses that appeared */
   have_nat = GNUNET_NO;
   for (struct LocalAddressList *pos = ifc_ctx.lal_head;
        NULL != pos;
-       pos = pos->next)
+       pos = ifc_ctx.lal_head)
   {
     found = GNUNET_NO;
     if (GNUNET_NAT_AC_LAN == (GNUNET_NAT_AC_LAN & pos->ac))
@@ -1069,9 +1174,35 @@ run_scan (void *cls)
                          : sizeof (struct sockaddr_in6))) )
         found = GNUNET_YES;
     }
-    if (GNUNET_NO == found)
+    GNUNET_CONTAINER_DLL_remove (ifc_ctx.lal_head,
+                                 ifc_ctx.lal_tail,
+                                 pos);
+    if (GNUNET_YES == found)
+    {
+      GNUNET_free (pos);
+    }
+    else
+    {
       notify_clients (pos,
                       GNUNET_YES);
+      GNUNET_CONTAINER_DLL_insert (lal_head,
+                                   lal_tail,
+                                   pos);
+      if ( (AF_INET == pos->af) &&
+           (NULL == pos->hc) &&
+           (0 != (GNUNET_NAT_AC_LAN & pos->ac)) )
+      {
+        const struct sockaddr_in *s4
+          = (const struct sockaddr_in *) &pos->addr;
+        
+        GNUNET_log (GNUNET_ERROR_TYPE_MESSAGE,
+                    "Found NATed local address %s, starting NAT server\n",
+                    GNUNET_a2s ((void *) &pos->addr, sizeof (*s4)));
+        pos->hc = GN_start_gnunet_nat_server_ (&s4->sin_addr,
+                                               &reversal_callback,
+                                               pos);
+      }
+    }
   }
   if ( (GNUNET_YES == have_nat) &&
        (GNUNET_YES == enable_upnp) &&
@@ -1096,10 +1227,6 @@ run_scan (void *cls)
       probe_external_ip_op = NULL;
     }
   }
-  
-  destroy_lal ();
-  lal_head = ifc_ctx.lal_head;
-  lal_tail = ifc_ctx.lal_tail;
 }
 
 
@@ -1164,12 +1291,12 @@ upnp_addr_change_cb (void *cls,
   {
   case AF_INET:
     ac = is_nat_v4 (&((const struct sockaddr_in *) addr)->sin_addr)
-      ? GNUNET_NAT_AC_LAN_PRIVATE
+      ? GNUNET_NAT_AC_LAN
       : GNUNET_NAT_AC_EXTERN;
     break;
   case AF_INET6:
     ac = is_nat_v6 (&((const struct sockaddr_in6 *) addr)->sin6_addr)
-      ? GNUNET_NAT_AC_LAN_PRIVATE
+      ? GNUNET_NAT_AC_LAN
       : GNUNET_NAT_AC_EXTERN;
     break;
   default:
@@ -1216,7 +1343,6 @@ handle_register (void *cls,
               "Received REGISTER message from client\n");
   ch->flags = message->flags;
   ch->proto = message->proto;
-  ch->adv_port = ntohs (message->adv_port);
   ch->num_caddrs = ntohs (message->num_addrs);
   ch->caddrs = GNUNET_new_array (ch->num_caddrs,
                                  struct ClientAddress);
@@ -1292,6 +1418,11 @@ handle_register (void *cls,
 
     off += alen;
   }
+
+  ch->hole_external
+    = GNUNET_strndup (off,
+                      ntohs (message->hole_external_len));
+    
   /* Actually send IP address list to client */
   for (struct LocalAddressList *lal = lal_head;
        NULL != lal;
@@ -1363,7 +1494,7 @@ notify_clients_stun_change (const struct sockaddr_in *ip,
     if (! ch->natted_address)
       continue;
     v4 = *ip;
-    v4.sin_port = htons (ch->adv_port);
+    v4.sin_port = htons (0);
     env = GNUNET_MQ_msg_extra (msg,
                                sizeof (v4),
                                GNUNET_MESSAGE_TYPE_NAT_ADDRESS_CHANGE);
@@ -2045,6 +2176,7 @@ client_disconnect_cb (void *cls,
     }
   }
   GNUNET_free_non_null (ch->caddrs);
+  GNUNET_free (ch->hole_external);
   GNUNET_free (ch);
 }
 
diff --git a/src/nat/gnunet-service-nat_helper.c b/src/nat/gnunet-service-nat_helper.c
index 379603ae2..7e5051d65 100644
--- a/src/nat/gnunet-service-nat_helper.c
+++ b/src/nat/gnunet-service-nat_helper.c
@@ -28,7 +28,6 @@
 #include "gnunet_util_lib.h"
 #include "gnunet-service-nat_helper.h"
 
-#define LOG(kind,...) GNUNET_log_from (kind, "nat", __VA_ARGS__)
 
 /**
  * Information we keep per NAT helper process.
@@ -39,7 +38,7 @@ struct HelperContext
   /**
    * IP address we pass to the NAT helper.
    */
-  const char *internal_address;
+  struct in_addr internal_address;
 
   /**
    * Function to call if we receive a reversal request.
@@ -133,11 +132,11 @@ nat_server_read (void *cls)
                              sizeof (mybuf));
   if (bytes < 1)
   {
-    LOG (GNUNET_ERROR_TYPE_DEBUG,
-         "Finished reading from server stdout with code: %d\n",
-         bytes);
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+                "Finished reading from server stdout with code: %d\n",
+                bytes);
     if (0 != GNUNET_OS_process_kill (h->server_proc,
--                                    GNUNET_TERM_SIG))
+                                     GNUNET_TERM_SIG))
       GNUNET_log_from_strerror (GNUNET_ERROR_TYPE_WARNING,
                                 "nat",
                                 "kill");
@@ -183,10 +182,9 @@ nat_server_read (void *cls)
                          &sin_addr.sin_addr)))
   {
     /* should we restart gnunet-helper-nat-server? */
-    LOG (GNUNET_ERROR_TYPE_WARNING,
-         "nat",
-         _("gnunet-helper-nat-server generated malformed address `%s'\n"),
-         mybuf);
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("gnunet-helper-nat-server generated malformed address `%s'\n"),
+                mybuf);
     h->server_read_task 
       = GNUNET_SCHEDULER_add_read_file (GNUNET_TIME_UNIT_FOREVER_REL,
                                         h->server_stdout_handle,
@@ -195,10 +193,10 @@ nat_server_read (void *cls)
     return;
   }
   sin_addr.sin_port = htons ((uint16_t) port);
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "gnunet-helper-nat-server read: %s:%d\n",
-       mybuf,
-       port);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "gnunet-helper-nat-server read: %s:%d\n",
+              mybuf,
+              port);
   h->cb (h->cb_cls,
          &sin_addr);
   h->server_read_task 
@@ -220,6 +218,7 @@ restart_nat_server (void *cls)
 {
   struct HelperContext *h = cls;
   char *binary;
+  char ia[INET_ADDRSTRLEN];
   
   h->server_read_task = NULL;
   h->server_stdout 
@@ -232,10 +231,15 @@ restart_nat_server (void *cls)
     try_again (h);
     return;
   }
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       "Starting `%s' at `%s'\n",
-       "gnunet-helper-nat-server",
-       h->internal_address);
+  GNUNET_assert (NULL !=
+                 inet_ntop (AF_INET,
+                            &h->internal_address,
+                            ia,
+                            sizeof (ia)));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Starting `%s' at `%s'\n",
+              "gnunet-helper-nat-server",
+              ia);
   /* Start the server process */
   binary
     = GNUNET_OS_get_libexec_binary_path ("gnunet-helper-nat-server");
@@ -247,15 +251,14 @@ restart_nat_server (void *cls)
                                NULL,
                                binary,
                                "gnunet-helper-nat-server",
-                               h->internal_address,
+                               ia,
                                NULL);
   GNUNET_free (binary);
   if (NULL == h->server_proc)
   {
-    LOG (GNUNET_ERROR_TYPE_WARNING,
-         "nat",
-         _("Failed to start %s\n"),
-         "gnunet-helper-nat-server");
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                _("Failed to start %s\n"),
+                "gnunet-helper-nat-server");
     GNUNET_DISK_pipe_close (h->server_stdout);
     h->server_stdout = NULL;
     try_again (h);
@@ -285,7 +288,7 @@ restart_nat_server (void *cls)
  * @return NULL on error
  */
 struct HelperContext *
-GN_start_gnunet_nat_server_ (const char *internal_address,
+GN_start_gnunet_nat_server_ (const struct in_addr *internal_address,
                              GN_ReversalCallback cb,
                              void *cb_cls)
 {
@@ -294,8 +297,8 @@ GN_start_gnunet_nat_server_ (const char *internal_address,
   h = GNUNET_new (struct HelperContext);
   h->cb = cb;
   h->cb_cls = cb_cls;
-  h->internal_address
-    = internal_address;
+  h->internal_address = *internal_address;
+  restart_nat_server (h);
   if (NULL == h->server_stdout)
   {
     GN_stop_gnunet_nat_server_ (h);
@@ -323,9 +326,8 @@ GN_stop_gnunet_nat_server_ (struct HelperContext *h)
   {
     if (0 != GNUNET_OS_process_kill (h->server_proc,
                                      GNUNET_TERM_SIG))
-      GNUNET_log_from_strerror (GNUNET_ERROR_TYPE_WARNING,
-                                "nat",
-                                "kill");
+      GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                           "kill");
     GNUNET_OS_process_wait (h->server_proc);
     GNUNET_OS_process_destroy (h->server_proc);
     h->server_proc = NULL;
@@ -370,9 +372,8 @@ GN_request_connection_reversal (const struct in_addr *internal_address,
                          intv4,
                          INET_ADDRSTRLEN))
   {
-    GNUNET_log_from_strerror (GNUNET_ERROR_TYPE_WARNING,
-                              "nat",
-                              "inet_ntop");
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "inet_ntop");
     return GNUNET_SYSERR;
   }
   if (NULL == inet_ntop (AF_INET,
@@ -380,20 +381,19 @@ GN_request_connection_reversal (const struct in_addr *internal_address,
                          remv4,
                          INET_ADDRSTRLEN))
   {
-    GNUNET_log_from_strerror (GNUNET_ERROR_TYPE_WARNING,
-                              "nat",
-                              "inet_ntop");
+    GNUNET_log_strerror (GNUNET_ERROR_TYPE_WARNING,
+                         "inet_ntop");
     return GNUNET_SYSERR;
   }  
   GNUNET_snprintf (port_as_string,
                    sizeof (port_as_string),
                    "%d",
                    internal_port);
-  LOG (GNUNET_ERROR_TYPE_DEBUG,
-       _("Running gnunet-helper-nat-client %s %s %u\n"),
-       intv4,
-       remv4,
-       internal_port);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              _("Running gnunet-helper-nat-client %s %s %u\n"),
+              intv4,
+              remv4,
+              internal_port);
   binary
     = GNUNET_OS_get_libexec_binary_path ("gnunet-helper-nat-client");
   proc
diff --git a/src/nat/gnunet-service-nat_helper.h b/src/nat/gnunet-service-nat_helper.h
index d3f1a757c..026526b05 100644
--- a/src/nat/gnunet-service-nat_helper.h
+++ b/src/nat/gnunet-service-nat_helper.h
@@ -56,7 +56,7 @@ typedef void
  * @return NULL on error
  */
 struct HelperContext *
-GN_start_gnunet_nat_server_ (const char *internal_address,
+GN_start_gnunet_nat_server_ (const struct in_addr *internal_address,
                              GN_ReversalCallback cb,
                              void *cb_cls);
 
diff --git a/src/nat/nat.h b/src/nat/nat.h
index 3356b19ce..af418c7c2 100644
--- a/src/nat/nat.h
+++ b/src/nat/nat.h
@@ -110,10 +110,11 @@ struct GNUNET_NAT_RegisterMessage
   uint8_t proto;
 
   /**
-   * Port we would like as we are configured to use this one for
-   * advertising (in addition to the one we are binding to).
+   * Number of bytes in the string that follow which
+   * specify the hostname and port of a manually punched
+   * hole for this client.
    */
-  uint16_t adv_port GNUNET_PACKED;
+  uint16_t hole_external_len GNUNET_PACKED;
 
   /**
    * Number of addresses that this service is bound to that follow.
@@ -124,6 +125,9 @@ struct GNUNET_NAT_RegisterMessage
 
   /* Followed by @e num_addrs addresses of type 'struct
      sockaddr' */
+
+  /* Followed by @e hole_external_len bytes giving a hostname
+     and port */
   
 };
 
@@ -191,19 +195,7 @@ struct GNUNET_NAT_ConnectionReversalRequestedMessage
    */
   struct GNUNET_MessageHeader header;
 
-  /**
-   * Size of the local address where we received the request, in NBO.
-   */
-  uint16_t local_addr_size;
-
-  /**
-   * Size of the remote address making the request, in NBO.
-   */
-  uint16_t remote_addr_size;
-
-  /* followed by a `struct sockaddr` of @e local_addr_size bytes */
-
-  /* followed by a `struct sockaddr` of @e remote_addr_size bytes */
+  /* followed by a `struct sockaddr_in` */
   
 };
 
diff --git a/src/nat/nat_api.c b/src/nat/nat_api.c
index 481bc6fde..e4dfc1629 100644
--- a/src/nat/nat_api.c
+++ b/src/nat/nat_api.c
@@ -176,14 +176,7 @@ check_connection_reversal_request (void *cls,
 {
   if (ntohs (crm->header.size) !=
       sizeof (*crm) +
-      ntohs (crm->local_addr_size) +
-      ntohs (crm->remote_addr_size) )
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
-  if ( (sizeof (struct sockaddr_in) != ntohs (crm->local_addr_size)) ||
-       (sizeof (struct sockaddr_in) != ntohs (crm->remote_addr_size)) )
+      sizeof (struct sockaddr_in) )
   {
     GNUNET_break (0);
     return GNUNET_SYSERR;
@@ -203,13 +196,9 @@ handle_connection_reversal_request (void *cls,
                                     const struct GNUNET_NAT_ConnectionReversalRequestedMessage *crm)
 {
   struct GNUNET_NAT_Handle *nh = cls;
-  const struct sockaddr_in *local_sa = (const struct sockaddr_in *) &crm[1];
-  const struct sockaddr_in *remote_sa = &local_sa[1];
 
   nh->reversal_callback (nh->callback_cls,
-                         (const struct sockaddr *) local_sa,
-                         sizeof (struct sockaddr_in),
-                         (const struct sockaddr *) remote_sa,
+                         (const struct sockaddr *) &crm[1],
                          sizeof (struct sockaddr_in));
 }
 
@@ -380,8 +369,7 @@ do_connect (void *cls)
  *
  * @param cfg configuration to use
  * @param proto protocol this is about, IPPROTO_TCP or IPPROTO_UDP
- * @param adv_port advertised port (port we are either bound to or that our OS
- *                 locally performs redirection from to our bound port).
+ * @param hole_external hostname and port of manually punched hole in NAT, otherwise NULL (or empty string)
  * @param num_addrs number of addresses in @a addrs
  * @param addrs list of local addresses packets should be redirected to
  * @param addrlens actual lengths of the addresses in @a addrs
@@ -394,7 +382,7 @@ do_connect (void *cls)
 struct GNUNET_NAT_Handle *
 GNUNET_NAT_register (const struct GNUNET_CONFIGURATION_Handle *cfg,
                      uint8_t proto,
-                     uint16_t adv_port,
+                     const char *hole_external,
                      unsigned int num_addrs,
                      const struct sockaddr **addrs,
                      const socklen_t *addrlens,
@@ -405,11 +393,17 @@ GNUNET_NAT_register (const struct GNUNET_CONFIGURATION_Handle *cfg,
   struct GNUNET_NAT_Handle *nh;
   struct GNUNET_NAT_RegisterMessage *rm;
   size_t len;
+  size_t hole_external_len;
   char *off;
   
   len = 0;
   for (unsigned int i=0;i<num_addrs;i++)
     len += addrlens[i];
+  hole_external_len
+    = (NULL == hole_external)
+    ? 0
+    : strlen (hole_external);
+  len += hole_external_len;
   if ( (len > GNUNET_SERVER_MAX_MESSAGE_SIZE - sizeof (*rm)) ||
        (num_addrs > UINT16_MAX) )
   {
@@ -425,7 +419,7 @@ GNUNET_NAT_register (const struct GNUNET_CONFIGURATION_Handle *cfg,
   if (NULL != reversal_callback)
     rm->flags |= GNUNET_NAT_RF_REVERSAL;
   rm->proto = proto;
-  rm->adv_port = htons (adv_port);
+  rm->hole_external_len = htons (hole_external_len);
   rm->num_addrs = htons ((uint16_t) num_addrs);
   off = (char *) &rm[1];
   for (unsigned int i=0;i<num_addrs;i++)
@@ -464,6 +458,9 @@ GNUNET_NAT_register (const struct GNUNET_CONFIGURATION_Handle *cfg,
                    addrlens[i]);
     off += addrlens[i];
   }
+  GNUNET_memcpy (off,
+                 hole_external,
+                 hole_external_len);
 
   nh = GNUNET_new (struct GNUNET_NAT_Handle);
   nh->reg = &rm->header;