xref: /freebsd/sys/netpfil/ipfilter/netinet/ip_nat.c (revision 2bae5cad793bd67c071ade7c7a8ae9d4b34e6b6c)
1 
2 /*
3  * Copyright (C) 2012 by Darren Reed.
4  *
5  * See the IPFILTER.LICENCE file for details on licencing.
6  */
7 #if defined(KERNEL) || defined(_KERNEL)
8 # undef KERNEL
9 # undef _KERNEL
10 # define        KERNEL	1
11 # define        _KERNEL	1
12 #endif
13 #include <sys/errno.h>
14 #include <sys/types.h>
15 #include <sys/param.h>
16 #include <sys/time.h>
17 #include <sys/file.h>
18 #if defined(_KERNEL) && \
19     (defined(__NetBSD_Version) && (__NetBSD_Version >= 399002000))
20 # include <sys/kauth.h>
21 #endif
22 #if !defined(_KERNEL)
23 # include <stdio.h>
24 # include <string.h>
25 # include <stdlib.h>
26 # define KERNEL
27 # ifdef _OpenBSD__
28 struct file;
29 # endif
30 # include <sys/uio.h>
31 # undef KERNEL
32 #endif
33 #if defined(_KERNEL) && defined(__FreeBSD__)
34 # include <sys/filio.h>
35 # include <sys/fcntl.h>
36 #else
37 # include <sys/ioctl.h>
38 #endif
39 # include <sys/fcntl.h>
40 # include <sys/protosw.h>
41 #include <sys/socket.h>
42 #if defined(_KERNEL)
43 # include <sys/systm.h>
44 # if defined(__FreeBSD__)
45 #  include <sys/jail.h>
46 # endif
47 # if !defined(__SVR4)
48 #  include <sys/mbuf.h>
49 # endif
50 #endif
51 #if defined(__SVR4)
52 # include <sys/filio.h>
53 # include <sys/byteorder.h>
54 # ifdef KERNEL
55 #  include <sys/dditypes.h>
56 # endif
57 # include <sys/stream.h>
58 # include <sys/kmem.h>
59 #endif
60 #if defined(__FreeBSD__)
61 # include <sys/queue.h>
62 #endif
63 #include <net/if.h>
64 #if defined(__FreeBSD__)
65 # include <net/if_var.h>
66 #endif
67 #ifdef sun
68 # include <net/af.h>
69 #endif
70 #include <netinet/in.h>
71 #include <netinet/in_systm.h>
72 #include <netinet/ip.h>
73 
74 #ifdef RFC1825
75 # include <vpn/md5.h>
76 # include <vpn/ipsec.h>
77 extern struct ifnet vpnif;
78 #endif
79 
80 # include <netinet/ip_var.h>
81 #include <netinet/tcp.h>
82 #include <netinet/udp.h>
83 #include <netinet/ip_icmp.h>
84 #include "netinet/ip_compat.h"
85 #include <netinet/tcpip.h>
86 #include "netinet/ipl.h"
87 #include "netinet/ip_fil.h"
88 #include "netinet/ip_nat.h"
89 #include "netinet/ip_frag.h"
90 #include "netinet/ip_state.h"
91 #include "netinet/ip_proxy.h"
92 #include "netinet/ip_lookup.h"
93 #include "netinet/ip_dstlist.h"
94 #include "netinet/ip_sync.h"
95 #if defined(__FreeBSD__)
96 # include <sys/malloc.h>
97 #endif
98 #ifdef HAS_SYS_MD5_H
99 # include <sys/md5.h>
100 #else
101 # include "md5.h"
102 #endif
103 /* END OF INCLUDES */
104 
105 #undef	SOCKADDR_IN
106 #define	SOCKADDR_IN	struct sockaddr_in
107 
108 
109 
110 #define	NATFSUM(n,v,f)	((v) == 4 ? (n)->f.in4.s_addr : (n)->f.i6[0] + \
111 			 (n)->f.i6[1] + (n)->f.i6[2] + (n)->f.i6[3])
112 #define	NBUMP(x)	softn->(x)++
113 #define	NBUMPD(x, y)	do { \
114 				softn->x.y++; \
115 				DT(y); \
116 			} while (0)
117 #define	NBUMPSIDE(y,x)	softn->ipf_nat_stats.ns_side[y].x++
118 #define	NBUMPSIDED(y,x)	do { softn->ipf_nat_stats.ns_side[y].x++; \
119 			     DT(x); } while (0)
120 #define	NBUMPSIDEX(y,x,z) \
121 			do { softn->ipf_nat_stats.ns_side[y].x++; \
122 			     DT(z); } while (0)
123 #define	NBUMPSIDEDF(y,x)do { softn->ipf_nat_stats.ns_side[y].x++; \
124 			     DT1(x, fr_info_t *, fin); } while (0)
125 
126 static ipftuneable_t ipf_nat_tuneables[] = {
127 	/* nat */
128 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_lock) },
129 		"nat_lock",	0,	1,
130 		stsizeof(ipf_nat_softc_t, ipf_nat_lock),
131 		IPFT_RDONLY,		NULL,	NULL },
132 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_sz) },
133 		"nat_table_size", 1,	0x7fffffff,
134 		stsizeof(ipf_nat_softc_t, ipf_nat_table_sz),
135 		0,			NULL,	ipf_nat_rehash },
136 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_max) },
137 		"nat_table_max", 1,	0x7fffffff,
138 		stsizeof(ipf_nat_softc_t, ipf_nat_table_max),
139 		0,			NULL,	NULL },
140 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maprules_sz) },
141 		"nat_rules_size", 1,	0x7fffffff,
142 		stsizeof(ipf_nat_softc_t, ipf_nat_maprules_sz),
143 		0,			NULL,	ipf_nat_rehash_rules },
144 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_rdrrules_sz) },
145 		"rdr_rules_size", 1,	0x7fffffff,
146 		stsizeof(ipf_nat_softc_t, ipf_nat_rdrrules_sz),
147 		0,			NULL,	ipf_nat_rehash_rules },
148 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_hostmap_sz) },
149 		"hostmap_size",	1,	0x7fffffff,
150 		stsizeof(ipf_nat_softc_t, ipf_nat_hostmap_sz),
151 		0,			NULL,	ipf_nat_hostmap_rehash },
152 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maxbucket) },
153 		"nat_maxbucket",1,	0x7fffffff,
154 		stsizeof(ipf_nat_softc_t, ipf_nat_maxbucket),
155 		0,			NULL,	NULL },
156 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_logging) },
157 		"nat_logging",	0,	1,
158 		stsizeof(ipf_nat_softc_t, ipf_nat_logging),
159 		0,			NULL,	NULL },
160 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_doflush) },
161 		"nat_doflush",	0,	1,
162 		stsizeof(ipf_nat_softc_t, ipf_nat_doflush),
163 		0,			NULL,	NULL },
164 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_low) },
165 		"nat_table_wm_low",	1,	99,
166 		stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_low),
167 		0,			NULL,	NULL },
168 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_high) },
169 		"nat_table_wm_high",	2,	100,
170 		stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_high),
171 		0,			NULL,	NULL },
172 	{ { 0 },
173 		NULL,			0,	0,
174 		0,
175 		0,			NULL,	NULL }
176 };
177 
178 /* ======================================================================== */
179 /* How the NAT is organised and works.                                      */
180 /*                                                                          */
181 /* Inside (interface y) NAT       Outside (interface x)                     */
182 /* -------------------- -+- -------------------------------------           */
183 /* Packet going          |   out, processed by ipf_nat_checkout() for x     */
184 /* ------------>         |   ------------>                                  */
185 /* src=10.1.1.1          |   src=192.1.1.1                                  */
186 /*                       |                                                  */
187 /*                       |   in, processed by ipf_nat_checkin() for x       */
188 /* <------------         |   <------------                                  */
189 /* dst=10.1.1.1          |   dst=192.1.1.1                                  */
190 /* -------------------- -+- -------------------------------------           */
191 /* ipf_nat_checkout() - changes ip_src and if required, sport               */
192 /*             - creates a new mapping, if required.                        */
193 /* ipf_nat_checkin()  - changes ip_dst and if required, dport               */
194 /*                                                                          */
195 /* In the NAT table, internal source is recorded as "in" and externally     */
196 /* seen as "out".                                                           */
197 /* ======================================================================== */
198 
199 
200 #if SOLARIS && !defined(INSTANCES)
201 extern	int		pfil_delayed_copy;
202 #endif
203 
204 static	int	ipf_nat_flush_entry(ipf_main_softc_t *, void *);
205 static	int	ipf_nat_getent(ipf_main_softc_t *, caddr_t, int);
206 static	int	ipf_nat_getsz(ipf_main_softc_t *, caddr_t, int);
207 static	int	ipf_nat_putent(ipf_main_softc_t *, caddr_t, int);
208 static	void	ipf_nat_addmap(ipf_nat_softc_t *, ipnat_t *);
209 static	void	ipf_nat_addrdr(ipf_nat_softc_t *, ipnat_t *);
210 static	int	ipf_nat_builddivertmp(ipf_nat_softc_t *, ipnat_t *);
211 static	int	ipf_nat_clearlist(ipf_main_softc_t *, ipf_nat_softc_t *);
212 static	int	ipf_nat_cmp_rules(ipnat_t *, ipnat_t *);
213 static	int	ipf_nat_decap(fr_info_t *, nat_t *);
214 static	void	ipf_nat_delrule(ipf_main_softc_t *, ipf_nat_softc_t *,
215 				     ipnat_t *, int);
216 static	int	ipf_nat_extraflush(ipf_main_softc_t *, ipf_nat_softc_t *, int);
217 static	int	ipf_nat_finalise(fr_info_t *, nat_t *);
218 static	int	ipf_nat_flushtable(ipf_main_softc_t *, ipf_nat_softc_t *);
219 static	int	ipf_nat_getnext(ipf_main_softc_t *, ipftoken_t *,
220 				     ipfgeniter_t *, ipfobj_t *);
221 static	int	ipf_nat_gettable(ipf_main_softc_t *, ipf_nat_softc_t *,
222 				      char *);
223 static	hostmap_t *ipf_nat_hostmap(ipf_nat_softc_t *, ipnat_t *,
224 					struct in_addr, struct in_addr,
225 					struct in_addr, u_32_t);
226 static	int	ipf_nat_icmpquerytype(int);
227 static	int	ipf_nat_iterator(ipf_main_softc_t *, ipftoken_t *,
228 				      ipfgeniter_t *, ipfobj_t *);
229 static	int	ipf_nat_match(fr_info_t *, ipnat_t *);
230 static	int	ipf_nat_matcharray(nat_t *, int *, u_long);
231 static	int	ipf_nat_matchflush(ipf_main_softc_t *, ipf_nat_softc_t *,
232 					caddr_t);
233 static	void	ipf_nat_mssclamp(tcphdr_t *, u_32_t, fr_info_t *,
234 				      u_short *);
235 static	int	ipf_nat_newmap(fr_info_t *, nat_t *, natinfo_t *);
236 static	int	ipf_nat_newdivert(fr_info_t *, nat_t *, natinfo_t *);
237 static	int	ipf_nat_newrdr(fr_info_t *, nat_t *, natinfo_t *);
238 static	int	ipf_nat_newrewrite(fr_info_t *, nat_t *, natinfo_t *);
239 static	int	ipf_nat_nextaddr(fr_info_t *, nat_addr_t *, u_32_t *,
240 				      u_32_t *);
241 static	int	ipf_nat_nextaddrinit(ipf_main_softc_t *, char *,
242 					  nat_addr_t *, int, void *);
243 static	int	ipf_nat_resolverule(ipf_main_softc_t *, ipnat_t *);
244 static	int	ipf_nat_ruleaddrinit(ipf_main_softc_t *,
245 					  ipf_nat_softc_t *, ipnat_t *);
246 static	void	ipf_nat_rule_fini(ipf_main_softc_t *, ipnat_t *);
247 static	int	ipf_nat_rule_init(ipf_main_softc_t *, ipf_nat_softc_t *,
248 				       ipnat_t *);
249 static	int	ipf_nat_siocaddnat(ipf_main_softc_t *, ipf_nat_softc_t *,
250 					ipnat_t *, int);
251 static	void	ipf_nat_siocdelnat(ipf_main_softc_t *, ipf_nat_softc_t *,
252 					ipnat_t *, int);
253 static	void	ipf_nat_tabmove(ipf_nat_softc_t *, nat_t *);
254 
255 /* ------------------------------------------------------------------------ */
256 /* Function:    ipf_nat_main_load                                           */
257 /* Returns:     int - 0 == success, -1 == failure                           */
258 /* Parameters:  Nil                                                         */
259 /*                                                                          */
260 /* The only global NAT structure that needs to be initialised is the filter */
261 /* rule that is used with blocking packets.                                 */
262 /* ------------------------------------------------------------------------ */
263 int
ipf_nat_main_load(void)264 ipf_nat_main_load(void)
265 {
266 
267 	return (0);
268 }
269 
270 
271 /* ------------------------------------------------------------------------ */
272 /* Function:    ipf_nat_main_unload                                         */
273 /* Returns:     int - 0 == success, -1 == failure                           */
274 /* Parameters:  Nil                                                         */
275 /*                                                                          */
276 /* A null-op function that exists as a placeholder so that the flow in      */
277 /* other functions is obvious.                                              */
278 /* ------------------------------------------------------------------------ */
279 int
ipf_nat_main_unload(void)280 ipf_nat_main_unload(void)
281 {
282 	return (0);
283 }
284 
285 
286 /* ------------------------------------------------------------------------ */
287 /* Function:    ipf_nat_soft_create                                         */
288 /* Returns:     void * - NULL = failure, else pointer to NAT context        */
289 /* Parameters:  softc(I) - pointer to soft context main structure           */
290 /*                                                                          */
291 /* Allocate the initial soft context structure for NAT and populate it with */
292 /* some default values. Creating the tables is left until we call _init so  */
293 /* that sizes can be changed before we get under way.                       */
294 /* ------------------------------------------------------------------------ */
295 void *
ipf_nat_soft_create(ipf_main_softc_t * softc)296 ipf_nat_soft_create(ipf_main_softc_t *softc)
297 {
298 	ipf_nat_softc_t *softn;
299 
300 	KMALLOC(softn, ipf_nat_softc_t *);
301 	if (softn == NULL)
302 		return (NULL);
303 
304 	bzero((char *)softn, sizeof(*softn));
305 
306 	softn->ipf_nat_tune = ipf_tune_array_copy(softn,
307 						  sizeof(ipf_nat_tuneables),
308 						  ipf_nat_tuneables);
309 	if (softn->ipf_nat_tune == NULL) {
310 		ipf_nat_soft_destroy(softc, softn);
311 		return (NULL);
312 	}
313 	if (ipf_tune_array_link(softc, softn->ipf_nat_tune) == -1) {
314 		ipf_nat_soft_destroy(softc, softn);
315 		return (NULL);
316 	}
317 
318 	softn->ipf_nat_list_tail = &softn->ipf_nat_list;
319 
320 	if (softc->ipf_large_nat) {
321 	softn->ipf_nat_table_max = NAT_TABLE_MAX_LARGE;
322 	softn->ipf_nat_table_sz = NAT_TABLE_SZ_LARGE;
323 	softn->ipf_nat_maprules_sz = NAT_SIZE_LARGE;
324 	softn->ipf_nat_rdrrules_sz = RDR_SIZE_LARGE;
325 	softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE_LARGE;
326 	} else {
327 	softn->ipf_nat_table_max = NAT_TABLE_MAX_NORMAL;
328 	softn->ipf_nat_table_sz = NAT_TABLE_SZ_NORMAL;
329 	softn->ipf_nat_maprules_sz = NAT_SIZE_NORMAL;
330 	softn->ipf_nat_rdrrules_sz = RDR_SIZE_NORMAL;
331 	softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE_NORMAL;
332 	}
333 	softn->ipf_nat_doflush = 0;
334 #ifdef  IPFILTER_LOG
335 	softn->ipf_nat_logging = 1;
336 #else
337 	softn->ipf_nat_logging = 0;
338 #endif
339 
340 	softn->ipf_nat_defage = DEF_NAT_AGE;
341 	softn->ipf_nat_defipage = IPF_TTLVAL(60);
342 	softn->ipf_nat_deficmpage = IPF_TTLVAL(3);
343 	softn->ipf_nat_table_wm_high = 99;
344 	softn->ipf_nat_table_wm_low = 90;
345 
346 	return (softn);
347 }
348 
349 /* ------------------------------------------------------------------------ */
350 /* Function:    ipf_nat_soft_destroy                                        */
351 /* Returns:     Nil                                                         */
352 /* Parameters:  softc(I) - pointer to soft context main structure           */
353 /*                                                                          */
354 /* ------------------------------------------------------------------------ */
355 void
ipf_nat_soft_destroy(ipf_main_softc_t * softc,void * arg)356 ipf_nat_soft_destroy(ipf_main_softc_t *softc, void *arg)
357 {
358 	ipf_nat_softc_t *softn = arg;
359 
360 	if (softn->ipf_nat_tune != NULL) {
361 		ipf_tune_array_unlink(softc, softn->ipf_nat_tune);
362 		KFREES(softn->ipf_nat_tune, sizeof(ipf_nat_tuneables));
363 		softn->ipf_nat_tune = NULL;
364 	}
365 
366 	KFREE(softn);
367 }
368 
369 
370 /* ------------------------------------------------------------------------ */
371 /* Function:    ipf_nat_init                                                */
372 /* Returns:     int - 0 == success, -1 == failure                           */
373 /* Parameters:  softc(I) - pointer to soft context main structure           */
374 /*                                                                          */
375 /* Initialise all of the NAT locks, tables and other structures.            */
376 /* ------------------------------------------------------------------------ */
377 int
ipf_nat_soft_init(ipf_main_softc_t * softc,void * arg)378 ipf_nat_soft_init(ipf_main_softc_t *softc, void *arg)
379 {
380 	ipf_nat_softc_t *softn = arg;
381 	ipftq_t *tq;
382 	int i;
383 
384 	KMALLOCS(softn->ipf_nat_table[0], nat_t **, \
385 		 sizeof(nat_t *) * softn->ipf_nat_table_sz);
386 
387 	if (softn->ipf_nat_table[0] != NULL) {
388 		bzero((char *)softn->ipf_nat_table[0],
389 		      softn->ipf_nat_table_sz * sizeof(nat_t *));
390 	} else {
391 		return (-1);
392 	}
393 
394 	KMALLOCS(softn->ipf_nat_table[1], nat_t **, \
395 		 sizeof(nat_t *) * softn->ipf_nat_table_sz);
396 
397 	if (softn->ipf_nat_table[1] != NULL) {
398 		bzero((char *)softn->ipf_nat_table[1],
399 		      softn->ipf_nat_table_sz * sizeof(nat_t *));
400 	} else {
401 		return (-2);
402 	}
403 
404 	KMALLOCS(softn->ipf_nat_map_rules, ipnat_t **, \
405 		 sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
406 
407 	if (softn->ipf_nat_map_rules != NULL) {
408 		bzero((char *)softn->ipf_nat_map_rules,
409 		      softn->ipf_nat_maprules_sz * sizeof(ipnat_t *));
410 	} else {
411 		return (-3);
412 	}
413 
414 	KMALLOCS(softn->ipf_nat_rdr_rules, ipnat_t **, \
415 		 sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
416 
417 	if (softn->ipf_nat_rdr_rules != NULL) {
418 		bzero((char *)softn->ipf_nat_rdr_rules,
419 		      softn->ipf_nat_rdrrules_sz * sizeof(ipnat_t *));
420 	} else {
421 		return (-4);
422 	}
423 
424 	KMALLOCS(softn->ipf_hm_maptable, hostmap_t **, \
425 		 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
426 
427 	if (softn->ipf_hm_maptable != NULL) {
428 		bzero((char *)softn->ipf_hm_maptable,
429 		      sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
430 	} else {
431 		return (-5);
432 	}
433 	softn->ipf_hm_maplist = NULL;
434 
435 	KMALLOCS(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, u_int *,
436 		 softn->ipf_nat_table_sz * sizeof(u_int));
437 
438 	if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen == NULL) {
439 		return (-6);
440 	}
441 	bzero((char *)softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
442 	      softn->ipf_nat_table_sz * sizeof(u_int));
443 
444 	KMALLOCS(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, u_int *,
445 		 softn->ipf_nat_table_sz * sizeof(u_int));
446 
447 	if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen == NULL) {
448 		return (-7);
449 	}
450 
451 	bzero((char *)softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
452 	      softn->ipf_nat_table_sz * sizeof(u_int));
453 
454 	if (softn->ipf_nat_maxbucket == 0) {
455 		for (i = softn->ipf_nat_table_sz; i > 0; i >>= 1)
456 			softn->ipf_nat_maxbucket++;
457 		softn->ipf_nat_maxbucket *= 2;
458 	}
459 
460 	ipf_sttab_init(softc, softn->ipf_nat_tcptq);
461 	/*
462 	 * Increase this because we may have "keep state" following this too
463 	 * and packet storms can occur if this is removed too quickly.
464 	 */
465 	softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
466 	softn->ipf_nat_tcptq[IPF_TCP_NSTATES - 1].ifq_next =
467 							&softn->ipf_nat_udptq;
468 
469 	IPFTQ_INIT(&softn->ipf_nat_udptq, softn->ipf_nat_defage,
470 		   "nat ipftq udp tab");
471 	softn->ipf_nat_udptq.ifq_next = &softn->ipf_nat_udpacktq;
472 
473 	IPFTQ_INIT(&softn->ipf_nat_udpacktq, softn->ipf_nat_defage,
474 		   "nat ipftq udpack tab");
475 	softn->ipf_nat_udpacktq.ifq_next = &softn->ipf_nat_icmptq;
476 
477 	IPFTQ_INIT(&softn->ipf_nat_icmptq, softn->ipf_nat_deficmpage,
478 		   "nat icmp ipftq tab");
479 	softn->ipf_nat_icmptq.ifq_next = &softn->ipf_nat_icmpacktq;
480 
481 	IPFTQ_INIT(&softn->ipf_nat_icmpacktq, softn->ipf_nat_defage,
482 		   "nat icmpack ipftq tab");
483 	softn->ipf_nat_icmpacktq.ifq_next = &softn->ipf_nat_iptq;
484 
485 	IPFTQ_INIT(&softn->ipf_nat_iptq, softn->ipf_nat_defipage,
486 		   "nat ip ipftq tab");
487 	softn->ipf_nat_iptq.ifq_next = &softn->ipf_nat_pending;
488 
489 	IPFTQ_INIT(&softn->ipf_nat_pending, 1, "nat pending ipftq tab");
490 	softn->ipf_nat_pending.ifq_next = NULL;
491 
492 	for (i = 0, tq = softn->ipf_nat_tcptq; i < IPF_TCP_NSTATES; i++, tq++) {
493 		if (tq->ifq_ttl < softn->ipf_nat_deficmpage)
494 			tq->ifq_ttl = softn->ipf_nat_deficmpage;
495 		else if (tq->ifq_ttl > softn->ipf_nat_defage && softc->ipf_large_nat)
496 			tq->ifq_ttl = softn->ipf_nat_defage;
497 	}
498 
499 	/*
500 	 * Increase this because we may have "keep state" following
501 	 * this too and packet storms can occur if this is removed
502 	 * too quickly.
503 	 */
504 	softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
505 
506 	MUTEX_INIT(&softn->ipf_nat_new, "ipf nat new mutex");
507 	MUTEX_INIT(&softn->ipf_nat_io, "ipf nat io mutex");
508 
509 	softn->ipf_nat_inited = 1;
510 
511 	return (0);
512 }
513 
514 
515 /* ------------------------------------------------------------------------ */
516 /* Function:    ipf_nat_soft_fini                                           */
517 /* Returns:     Nil                                                         */
518 /* Parameters:  softc(I) - pointer to soft context main structure           */
519 /*                                                                          */
520 /* Free all memory used by NAT structures allocated at runtime.             */
521 /* ------------------------------------------------------------------------ */
522 int
ipf_nat_soft_fini(ipf_main_softc_t * softc,void * arg)523 ipf_nat_soft_fini(ipf_main_softc_t *softc, void *arg)
524 {
525 	ipf_nat_softc_t *softn = arg;
526 	ipftq_t *ifq, *ifqnext;
527 
528 	(void) ipf_nat_clearlist(softc, softn);
529 	(void) ipf_nat_flushtable(softc, softn);
530 
531 	/*
532 	 * Proxy timeout queues are not cleaned here because although they
533 	 * exist on the NAT list, ipf_proxy_unload is called after unload
534 	 * and the proxies actually are responsible for them being created.
535 	 * Should the proxy timeouts have their own list?  There's no real
536 	 * justification as this is the only complication.
537 	 */
538 	for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
539 		ifqnext = ifq->ifq_next;
540 		if (ipf_deletetimeoutqueue(ifq) == 0)
541 			ipf_freetimeoutqueue(softc, ifq);
542 	}
543 
544 	if (softn->ipf_nat_table[0] != NULL) {
545 		KFREES(softn->ipf_nat_table[0],
546 		       sizeof(nat_t *) * softn->ipf_nat_table_sz);
547 		softn->ipf_nat_table[0] = NULL;
548 	}
549 	if (softn->ipf_nat_table[1] != NULL) {
550 		KFREES(softn->ipf_nat_table[1],
551 		       sizeof(nat_t *) * softn->ipf_nat_table_sz);
552 		softn->ipf_nat_table[1] = NULL;
553 	}
554 	if (softn->ipf_nat_map_rules != NULL) {
555 		KFREES(softn->ipf_nat_map_rules,
556 		       sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
557 		softn->ipf_nat_map_rules = NULL;
558 	}
559 	if (softn->ipf_nat_rdr_rules != NULL) {
560 		KFREES(softn->ipf_nat_rdr_rules,
561 		       sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
562 		softn->ipf_nat_rdr_rules = NULL;
563 	}
564 	if (softn->ipf_hm_maptable != NULL) {
565 		KFREES(softn->ipf_hm_maptable,
566 		       sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
567 		softn->ipf_hm_maptable = NULL;
568 	}
569 	if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) {
570 		KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
571 		       sizeof(u_int) * softn->ipf_nat_table_sz);
572 		softn->ipf_nat_stats.ns_side[0].ns_bucketlen = NULL;
573 	}
574 	if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) {
575 		KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
576 		       sizeof(u_int) * softn->ipf_nat_table_sz);
577 		softn->ipf_nat_stats.ns_side[1].ns_bucketlen = NULL;
578 	}
579 
580 	if (softn->ipf_nat_inited == 1) {
581 		softn->ipf_nat_inited = 0;
582 		ipf_sttab_destroy(softn->ipf_nat_tcptq);
583 
584 		MUTEX_DESTROY(&softn->ipf_nat_new);
585 		MUTEX_DESTROY(&softn->ipf_nat_io);
586 
587 		MUTEX_DESTROY(&softn->ipf_nat_udptq.ifq_lock);
588 		MUTEX_DESTROY(&softn->ipf_nat_udpacktq.ifq_lock);
589 		MUTEX_DESTROY(&softn->ipf_nat_icmptq.ifq_lock);
590 		MUTEX_DESTROY(&softn->ipf_nat_icmpacktq.ifq_lock);
591 		MUTEX_DESTROY(&softn->ipf_nat_iptq.ifq_lock);
592 		MUTEX_DESTROY(&softn->ipf_nat_pending.ifq_lock);
593 	}
594 
595 	return (0);
596 }
597 
598 
599 /* ------------------------------------------------------------------------ */
600 /* Function:    ipf_nat_setlock                                             */
601 /* Returns:     Nil                                                         */
602 /* Parameters:  arg(I) - pointer to soft state information                  */
603 /*              tmp(I) - new lock value                                     */
604 /*                                                                          */
605 /* Set the "lock status" of NAT to the value in tmp.                        */
606 /* ------------------------------------------------------------------------ */
607 void
ipf_nat_setlock(void * arg,int tmp)608 ipf_nat_setlock(void *arg, int tmp)
609 {
610 	ipf_nat_softc_t *softn = arg;
611 
612 	softn->ipf_nat_lock = tmp;
613 }
614 
615 
616 /* ------------------------------------------------------------------------ */
617 /* Function:    ipf_nat_addrdr                                              */
618 /* Returns:     Nil                                                         */
619 /* Parameters:  n(I) - pointer to NAT rule to add                           */
620 /*                                                                          */
621 /* Adds a redirect rule to the hash table of redirect rules and the list of */
622 /* loaded NAT rules.  Updates the bitmask indicating which netmasks are in  */
623 /* use by redirect rules.                                                   */
624 /* ------------------------------------------------------------------------ */
625 static void
ipf_nat_addrdr(ipf_nat_softc_t * softn,ipnat_t * n)626 ipf_nat_addrdr(ipf_nat_softc_t *softn, ipnat_t *n)
627 {
628 	ipnat_t **np;
629 	u_32_t j;
630 	u_int hv;
631 	u_int rhv;
632 	int k;
633 
634 	if (n->in_odstatype == FRI_NORMAL) {
635 		k = count4bits(n->in_odstmsk);
636 		ipf_inet_mask_add(k, &softn->ipf_nat_rdr_mask);
637 		j = (n->in_odstaddr & n->in_odstmsk);
638 		rhv = NAT_HASH_FN(j, 0, 0xffffffff);
639 	} else {
640 		ipf_inet_mask_add(0, &softn->ipf_nat_rdr_mask);
641 		j = 0;
642 		rhv = 0;
643 	}
644 	hv = rhv % softn->ipf_nat_rdrrules_sz;
645 	np = softn->ipf_nat_rdr_rules + hv;
646 	while (*np != NULL)
647 		np = &(*np)->in_rnext;
648 	n->in_rnext = NULL;
649 	n->in_prnext = np;
650 	n->in_hv[0] = hv;
651 	n->in_use++;
652 	*np = n;
653 }
654 
655 
656 /* ------------------------------------------------------------------------ */
657 /* Function:    ipf_nat_addmap                                              */
658 /* Returns:     Nil                                                         */
659 /* Parameters:  n(I) - pointer to NAT rule to add                           */
660 /*                                                                          */
661 /* Adds a NAT map rule to the hash table of rules and the list of  loaded   */
662 /* NAT rules.  Updates the bitmask indicating which netmasks are in use by  */
663 /* redirect rules.                                                          */
664 /* ------------------------------------------------------------------------ */
665 static void
ipf_nat_addmap(ipf_nat_softc_t * softn,ipnat_t * n)666 ipf_nat_addmap(ipf_nat_softc_t *softn, ipnat_t *n)
667 {
668 	ipnat_t **np;
669 	u_32_t j;
670 	u_int hv;
671 	u_int rhv;
672 	int k;
673 
674 	if (n->in_osrcatype == FRI_NORMAL) {
675 		k = count4bits(n->in_osrcmsk);
676 		ipf_inet_mask_add(k, &softn->ipf_nat_map_mask);
677 		j = (n->in_osrcaddr & n->in_osrcmsk);
678 		rhv = NAT_HASH_FN(j, 0, 0xffffffff);
679 	} else {
680 		ipf_inet_mask_add(0, &softn->ipf_nat_map_mask);
681 		j = 0;
682 		rhv = 0;
683 	}
684 	hv = rhv % softn->ipf_nat_maprules_sz;
685 	np = softn->ipf_nat_map_rules + hv;
686 	while (*np != NULL)
687 		np = &(*np)->in_mnext;
688 	n->in_mnext = NULL;
689 	n->in_pmnext = np;
690 	n->in_hv[1] = rhv;
691 	n->in_use++;
692 	*np = n;
693 }
694 
695 
696 /* ------------------------------------------------------------------------ */
697 /* Function:    ipf_nat_delrdr                                              */
698 /* Returns:     Nil                                                         */
699 /* Parameters:  n(I) - pointer to NAT rule to delete                        */
700 /*                                                                          */
701 /* Removes a redirect rule from the hash table of redirect rules.           */
702 /* ------------------------------------------------------------------------ */
703 void
ipf_nat_delrdr(ipf_nat_softc_t * softn,ipnat_t * n)704 ipf_nat_delrdr(ipf_nat_softc_t *softn, ipnat_t *n)
705 {
706 	if (n->in_odstatype == FRI_NORMAL) {
707 		int k = count4bits(n->in_odstmsk);
708 		ipf_inet_mask_del(k, &softn->ipf_nat_rdr_mask);
709 	} else {
710 		ipf_inet_mask_del(0, &softn->ipf_nat_rdr_mask);
711 	}
712 	if (n->in_rnext)
713 		n->in_rnext->in_prnext = n->in_prnext;
714 	*n->in_prnext = n->in_rnext;
715 	n->in_use--;
716 }
717 
718 
719 /* ------------------------------------------------------------------------ */
720 /* Function:    ipf_nat_delmap                                              */
721 /* Returns:     Nil                                                         */
722 /* Parameters:  n(I) - pointer to NAT rule to delete                        */
723 /*                                                                          */
724 /* Removes a NAT map rule from the hash table of NAT map rules.             */
725 /* ------------------------------------------------------------------------ */
726 void
ipf_nat_delmap(ipf_nat_softc_t * softn,ipnat_t * n)727 ipf_nat_delmap(ipf_nat_softc_t *softn, ipnat_t *n)
728 {
729 	if (n->in_osrcatype == FRI_NORMAL) {
730 		int k = count4bits(n->in_osrcmsk);
731 		ipf_inet_mask_del(k, &softn->ipf_nat_map_mask);
732 	} else {
733 		ipf_inet_mask_del(0, &softn->ipf_nat_map_mask);
734 	}
735 	if (n->in_mnext != NULL)
736 		n->in_mnext->in_pmnext = n->in_pmnext;
737 	*n->in_pmnext = n->in_mnext;
738 	n->in_use--;
739 }
740 
741 
742 /* ------------------------------------------------------------------------ */
743 /* Function:    ipf_nat_hostmap                                             */
744 /* Returns:     struct hostmap* - NULL if no hostmap could be created,      */
745 /*                                else a pointer to the hostmapping to use  */
746 /* Parameters:  np(I)   - pointer to NAT rule                               */
747 /*              real(I) - real IP address                                   */
748 /*              map(I)  - mapped IP address                                 */
749 /*              port(I) - destination port number                           */
750 /* Write Locks: ipf_nat                                                     */
751 /*                                                                          */
752 /* Check if an ip address has already been allocated for a given mapping    */
753 /* that is not doing port based translation.  If is not yet allocated, then */
754 /* create a new entry if a non-NULL NAT rule pointer has been supplied.     */
755 /* ------------------------------------------------------------------------ */
756 static struct hostmap *
ipf_nat_hostmap(ipf_nat_softc_t * softn,ipnat_t * np,struct in_addr src,struct in_addr dst,struct in_addr map,u_32_t port)757 ipf_nat_hostmap(ipf_nat_softc_t *softn, ipnat_t *np, struct in_addr src,
758 	struct in_addr dst, struct in_addr map, u_32_t port)
759 {
760 	hostmap_t *hm;
761 	u_int hv, rhv;
762 
763 	hv = (src.s_addr ^ dst.s_addr);
764 	hv += src.s_addr;
765 	hv += dst.s_addr;
766 	rhv = hv;
767 	hv %= softn->ipf_nat_hostmap_sz;
768 	for (hm = softn->ipf_hm_maptable[hv]; hm; hm = hm->hm_hnext)
769 		if ((hm->hm_osrcip.s_addr == src.s_addr) &&
770 		    (hm->hm_odstip.s_addr == dst.s_addr) &&
771 		    ((np == NULL) || (np == hm->hm_ipnat)) &&
772 		    ((port == 0) || (port == hm->hm_port))) {
773 			softn->ipf_nat_stats.ns_hm_addref++;
774 			hm->hm_ref++;
775 			return (hm);
776 		}
777 
778 	if (np == NULL) {
779 		softn->ipf_nat_stats.ns_hm_nullnp++;
780 		return (NULL);
781 	}
782 
783 	KMALLOC(hm, hostmap_t *);
784 	if (hm) {
785 		hm->hm_next = softn->ipf_hm_maplist;
786 		hm->hm_pnext = &softn->ipf_hm_maplist;
787 		if (softn->ipf_hm_maplist != NULL)
788 			softn->ipf_hm_maplist->hm_pnext = &hm->hm_next;
789 		softn->ipf_hm_maplist = hm;
790 		hm->hm_hnext = softn->ipf_hm_maptable[hv];
791 		hm->hm_phnext = softn->ipf_hm_maptable + hv;
792 		if (softn->ipf_hm_maptable[hv] != NULL)
793 			softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext;
794 		softn->ipf_hm_maptable[hv] = hm;
795 		hm->hm_ipnat = np;
796 		np->in_use++;
797 		hm->hm_osrcip = src;
798 		hm->hm_odstip = dst;
799 		hm->hm_nsrcip = map;
800 		hm->hm_ndstip.s_addr = 0;
801 		hm->hm_ref = 1;
802 		hm->hm_port = port;
803 		hm->hm_hv = rhv;
804 		hm->hm_v = 4;
805 		softn->ipf_nat_stats.ns_hm_new++;
806 	} else {
807 		softn->ipf_nat_stats.ns_hm_newfail++;
808 	}
809 	return (hm);
810 }
811 
812 
813 /* ------------------------------------------------------------------------ */
814 /* Function:    ipf_nat_hostmapdel                                          */
815 /* Returns:     Nil                                                         */
816 /* Parameters:  hmp(I) - pointer to hostmap structure pointer               */
817 /* Write Locks: ipf_nat                                                     */
818 /*                                                                          */
819 /* Decrement the references to this hostmap structure by one.  If this      */
820 /* reaches zero then remove it and free it.                                 */
821 /* ------------------------------------------------------------------------ */
822 void
ipf_nat_hostmapdel(ipf_main_softc_t * softc,struct hostmap ** hmp)823 ipf_nat_hostmapdel(ipf_main_softc_t *softc, struct hostmap **hmp)
824 {
825 	struct hostmap *hm;
826 
827 	hm = *hmp;
828 	*hmp = NULL;
829 
830 	hm->hm_ref--;
831 	if (hm->hm_ref == 0) {
832 		ipf_nat_rule_deref(softc, &hm->hm_ipnat);
833 		if (hm->hm_hnext)
834 			hm->hm_hnext->hm_phnext = hm->hm_phnext;
835 		*hm->hm_phnext = hm->hm_hnext;
836 		if (hm->hm_next)
837 			hm->hm_next->hm_pnext = hm->hm_pnext;
838 		*hm->hm_pnext = hm->hm_next;
839 		KFREE(hm);
840 	}
841 }
842 
843 
844 /* ------------------------------------------------------------------------ */
845 /* Function:    ipf_fix_outcksum                                            */
846 /* Returns:     Nil                                                         */
847 /* Parameters:  cksum(I) - ipf_cksum_t, value of fin_cksum                  */
848 /*              sp(I)  - location of 16bit checksum to update               */
849 /*              n(I)  - amount to adjust checksum by                        */
850 /*		partial(I) - partial checksum				    */
851 /*                                                                          */
852 /* Adjusts the 16bit checksum by "n" for packets going out.                 */
853 /* ------------------------------------------------------------------------ */
854 void
ipf_fix_outcksum(int cksum,u_short * sp,u_32_t n,u_32_t partial)855 ipf_fix_outcksum(int cksum, u_short *sp, u_32_t n, u_32_t partial)
856 {
857 	u_short sumshort;
858 	u_32_t sum1;
859 
860 	if (n == 0)
861 		return;
862 
863 	if (cksum == 4) {
864 		*sp = 0;
865 		return;
866 	}
867 	if (cksum == 2) {
868 		sum1 = partial;
869 		sum1 = (sum1 & 0xffff) + (sum1 >> 16);
870 		*sp = htons(sum1);
871 		return;
872 	}
873 	sum1 = (~ntohs(*sp)) & 0xffff;
874 	sum1 += (n);
875 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
876 	/* Again */
877 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
878 	sumshort = ~(u_short)sum1;
879 	*(sp) = htons(sumshort);
880 }
881 
882 
883 /* ------------------------------------------------------------------------ */
884 /* Function:    ipf_fix_incksum                                             */
885 /* Returns:     Nil                                                         */
886 /* Parameters:  cksum(I) - ipf_cksum_t, value of fin_cksum                  */
887 /*              sp(I)  - location of 16bit checksum to update               */
888 /*              n(I)  - amount to adjust checksum by                        */
889 /*		partial(I) - partial checksum				    */
890 /*                                                                          */
891 /* Adjusts the 16bit checksum by "n" for packets going in.                  */
892 /* ------------------------------------------------------------------------ */
893 void
ipf_fix_incksum(int cksum,u_short * sp,u_32_t n,u_32_t partial)894 ipf_fix_incksum(int cksum, u_short *sp, u_32_t n, u_32_t partial)
895 {
896 	u_short sumshort;
897 	u_32_t sum1;
898 
899 	if (n == 0)
900 		return;
901 
902 	if (cksum == 4) {
903 		*sp = 0;
904 		return;
905 	}
906 	if (cksum == 2) {
907 		sum1 = partial;
908 		sum1 = (sum1 & 0xffff) + (sum1 >> 16);
909 		*sp = htons(sum1);
910 		return;
911 	}
912 
913 	sum1 = (~ntohs(*sp)) & 0xffff;
914 	sum1 += ~(n) & 0xffff;
915 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
916 	/* Again */
917 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
918 	sumshort = ~(u_short)sum1;
919 	*(sp) = htons(sumshort);
920 }
921 
922 
923 /* ------------------------------------------------------------------------ */
924 /* Function:    ipf_fix_datacksum                                           */
925 /* Returns:     Nil                                                         */
926 /* Parameters:  sp(I)  - location of 16bit checksum to update               */
927 /*              n(I)  - amount to adjust checksum by                        */
928 /*                                                                          */
929 /* Fix_datacksum is used *only* for the adjustments of checksums in the     */
930 /* data section of an IP packet.                                            */
931 /*                                                                          */
932 /* The only situation in which you need to do this is when NAT'ing an       */
933 /* ICMP error message. Such a message, contains in its body the IP header   */
934 /* of the original IP packet, that causes the error.                        */
935 /*                                                                          */
936 /* You can't use fix_incksum or fix_outcksum in that case, because for the  */
937 /* kernel the data section of the ICMP error is just data, and no special   */
938 /* processing like hardware cksum or ntohs processing have been done by the */
939 /* kernel on the data section.                                              */
940 /* ------------------------------------------------------------------------ */
941 void
ipf_fix_datacksum(u_short * sp,u_32_t n)942 ipf_fix_datacksum(u_short *sp, u_32_t n)
943 {
944 	u_short sumshort;
945 	u_32_t sum1;
946 
947 	if (n == 0)
948 		return;
949 
950 	sum1 = (~ntohs(*sp)) & 0xffff;
951 	sum1 += (n);
952 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
953 	/* Again */
954 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
955 	sumshort = ~(u_short)sum1;
956 	*(sp) = htons(sumshort);
957 }
958 
959 
960 /* ------------------------------------------------------------------------ */
961 /* Function:    ipf_nat_ioctl                                               */
962 /* Returns:     int - 0 == success, != 0 == failure                         */
963 /* Parameters:  softc(I) - pointer to soft context main structure           */
964 /*              data(I)  - pointer to ioctl data                            */
965 /*              cmd(I)   - ioctl command integer                            */
966 /*              mode(I)  - file mode bits used with open                    */
967 /*              uid(I)   - uid of calling process                           */
968 /*              ctx(I)   - pointer used as key for finding context          */
969 /*                                                                          */
970 /* Processes an ioctl call made to operate on the IP Filter NAT device.     */
971 /* ------------------------------------------------------------------------ */
972 int
ipf_nat_ioctl(ipf_main_softc_t * softc,caddr_t data,ioctlcmd_t cmd,int mode,int uid,void * ctx)973 ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd,
974 	int mode, int uid, void *ctx)
975 {
976 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
977 	int error = 0, ret, arg, getlock;
978 	ipnat_t *nat, *nt, *n;
979 	ipnat_t natd;
980 	SPL_INT(s);
981 
982 #if !SOLARIS && defined(_KERNEL)
983 # if NETBSD_GE_REV(399002000)
984 	if ((mode & FWRITE) &&
985 	     kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_FIREWALL,
986 				     KAUTH_REQ_NETWORK_FIREWALL_FW,
987 				     NULL, NULL, NULL))
988 # else
989 #  if defined(__FreeBSD__)
990 	if (securelevel_ge(curthread->td_ucred, 3) && (mode & FWRITE))
991 #  else
992 	if ((securelevel >= 3) && (mode & FWRITE))
993 #  endif
994 # endif
995 	{
996 		IPFERROR(60001);
997 		return (EPERM);
998 	}
999 # if defined(__FreeBSD__)
1000 	if (jailed_without_vnet(curthread->td_ucred)) {
1001 		IPFERROR(60076);
1002 		return (EOPNOTSUPP);
1003 	}
1004 # endif
1005 #endif
1006 
1007 	getlock = (mode & NAT_LOCKHELD) ? 0 : 1;
1008 
1009 	n = NULL;
1010 	nt = NULL;
1011 	nat = NULL;
1012 
1013 	if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT) ||
1014 	    (cmd == (ioctlcmd_t)SIOCPURGENAT)) {
1015 		if (mode & NAT_SYSSPACE) {
1016 			bcopy(data, (char *)&natd, sizeof(natd));
1017 			nat = &natd;
1018 			error = 0;
1019 		} else {
1020 			bzero(&natd, sizeof(natd));
1021 			error = ipf_inobj(softc, data, NULL, &natd,
1022 					  IPFOBJ_IPNAT);
1023 			if (error != 0)
1024 				goto done;
1025 
1026 			if (natd.in_size < sizeof(ipnat_t)) {
1027 				error = EINVAL;
1028 				goto done;
1029 			}
1030 			KMALLOCS(nt, ipnat_t *, natd.in_size);
1031 			if (nt == NULL) {
1032 				IPFERROR(60070);
1033 				error = ENOMEM;
1034 				goto done;
1035 			}
1036 			bzero(nt, natd.in_size);
1037 			error = ipf_inobjsz(softc, data, nt, IPFOBJ_IPNAT,
1038 					    natd.in_size);
1039 			if (error)
1040 				goto done;
1041 			nat = nt;
1042 		}
1043 
1044 		/*
1045 		 * For add/delete, look to see if the NAT entry is
1046 		 * already present
1047 		 */
1048 		nat->in_flags &= IPN_USERFLAGS;
1049 		if ((nat->in_redir & NAT_MAPBLK) == 0) {
1050 			if (nat->in_osrcatype == FRI_NORMAL ||
1051 			    nat->in_osrcatype == FRI_NONE)
1052 				nat->in_osrcaddr &= nat->in_osrcmsk;
1053 			if (nat->in_odstatype == FRI_NORMAL ||
1054 			    nat->in_odstatype == FRI_NONE)
1055 				nat->in_odstaddr &= nat->in_odstmsk;
1056 			if ((nat->in_flags & (IPN_SPLIT|IPN_SIPRANGE)) == 0) {
1057 				if (nat->in_nsrcatype == FRI_NORMAL)
1058 					nat->in_nsrcaddr &= nat->in_nsrcmsk;
1059 				if (nat->in_ndstatype == FRI_NORMAL)
1060 					nat->in_ndstaddr &= nat->in_ndstmsk;
1061 			}
1062 		}
1063 
1064 		error = ipf_nat_rule_init(softc, softn, nat);
1065 		if (error != 0)
1066 			goto done;
1067 
1068 		MUTEX_ENTER(&softn->ipf_nat_io);
1069 		for (n = softn->ipf_nat_list; n != NULL; n = n->in_next)
1070 			if (ipf_nat_cmp_rules(nat, n) == 0)
1071 				break;
1072 	}
1073 
1074 	switch (cmd)
1075 	{
1076 #ifdef  IPFILTER_LOG
1077 	case SIOCIPFFB :
1078 	{
1079 		int tmp;
1080 
1081 		if (!(mode & FWRITE)) {
1082 			IPFERROR(60002);
1083 			error = EPERM;
1084 		} else {
1085 			tmp = ipf_log_clear(softc, IPL_LOGNAT);
1086 			error = BCOPYOUT(&tmp, data, sizeof(tmp));
1087 			if (error != 0) {
1088 				IPFERROR(60057);
1089 				error = EFAULT;
1090 			}
1091 		}
1092 		break;
1093 	}
1094 
1095 	case SIOCSETLG :
1096 		if (!(mode & FWRITE)) {
1097 			IPFERROR(60003);
1098 			error = EPERM;
1099 		} else {
1100 			error = BCOPYIN(data, &softn->ipf_nat_logging,
1101 					sizeof(softn->ipf_nat_logging));
1102 			if (error != 0)
1103 				error = EFAULT;
1104 		}
1105 		break;
1106 
1107 	case SIOCGETLG :
1108 		error = BCOPYOUT(&softn->ipf_nat_logging, data,
1109 				 sizeof(softn->ipf_nat_logging));
1110 		if (error != 0) {
1111 			IPFERROR(60004);
1112 			error = EFAULT;
1113 		}
1114 		break;
1115 
1116 	case FIONREAD :
1117 		arg = ipf_log_bytesused(softc, IPL_LOGNAT);
1118 		error = BCOPYOUT(&arg, data, sizeof(arg));
1119 		if (error != 0) {
1120 			IPFERROR(60005);
1121 			error = EFAULT;
1122 		}
1123 		break;
1124 #endif
1125 	case SIOCADNAT :
1126 		if (!(mode & FWRITE)) {
1127 			IPFERROR(60006);
1128 			error = EPERM;
1129 		} else if (n != NULL) {
1130 			natd.in_flineno = n->in_flineno;
1131 			(void) ipf_outobj(softc, data, &natd, IPFOBJ_IPNAT);
1132 			IPFERROR(60007);
1133 			error = EEXIST;
1134 		} else if (nt == NULL) {
1135 			IPFERROR(60008);
1136 			error = ENOMEM;
1137 		}
1138 		if (error != 0) {
1139 			MUTEX_EXIT(&softn->ipf_nat_io);
1140 			break;
1141 		}
1142 		if (nat != nt)
1143 			bcopy((char *)nat, (char *)nt, sizeof(*n));
1144 		error = ipf_nat_siocaddnat(softc, softn, nt, getlock);
1145 		MUTEX_EXIT(&softn->ipf_nat_io);
1146 		if (error == 0) {
1147 			nat = NULL;
1148 			nt = NULL;
1149 		}
1150 		break;
1151 
1152 	case SIOCRMNAT :
1153 	case SIOCPURGENAT :
1154 		if (!(mode & FWRITE)) {
1155 			IPFERROR(60009);
1156 			error = EPERM;
1157 			n = NULL;
1158 		} else if (n == NULL) {
1159 			IPFERROR(60010);
1160 			error = ESRCH;
1161 		}
1162 
1163 		if (error != 0) {
1164 			MUTEX_EXIT(&softn->ipf_nat_io);
1165 			break;
1166 		}
1167 		if (cmd == (ioctlcmd_t)SIOCPURGENAT) {
1168 			error = ipf_outobjsz(softc, data, n, IPFOBJ_IPNAT,
1169 					     n->in_size);
1170 			if (error) {
1171 				MUTEX_EXIT(&softn->ipf_nat_io);
1172 				goto done;
1173 			}
1174 			n->in_flags |= IPN_PURGE;
1175 		}
1176 		ipf_nat_siocdelnat(softc, softn, n, getlock);
1177 
1178 		MUTEX_EXIT(&softn->ipf_nat_io);
1179 		n = NULL;
1180 		break;
1181 
1182 	case SIOCGNATS :
1183 	    {
1184 		natstat_t *nsp = &softn->ipf_nat_stats;
1185 
1186 		nsp->ns_side[0].ns_table = softn->ipf_nat_table[0];
1187 		nsp->ns_side[1].ns_table = softn->ipf_nat_table[1];
1188 		nsp->ns_list = softn->ipf_nat_list;
1189 		nsp->ns_maptable = softn->ipf_hm_maptable;
1190 		nsp->ns_maplist = softn->ipf_hm_maplist;
1191 		nsp->ns_nattab_sz = softn->ipf_nat_table_sz;
1192 		nsp->ns_nattab_max = softn->ipf_nat_table_max;
1193 		nsp->ns_rultab_sz = softn->ipf_nat_maprules_sz;
1194 		nsp->ns_rdrtab_sz = softn->ipf_nat_rdrrules_sz;
1195 		nsp->ns_hostmap_sz = softn->ipf_nat_hostmap_sz;
1196 		nsp->ns_instances = softn->ipf_nat_instances;
1197 		nsp->ns_ticks = softc->ipf_ticks;
1198 #ifdef IPFILTER_LOGGING
1199 		nsp->ns_log_ok = ipf_log_logok(softc, IPF_LOGNAT);
1200 		nsp->ns_log_fail = ipf_log_failures(softc, IPF_LOGNAT);
1201 #else
1202 		nsp->ns_log_ok = 0;
1203 		nsp->ns_log_fail = 0;
1204 #endif
1205 		error = ipf_outobj(softc, data, nsp, IPFOBJ_NATSTAT);
1206 		break;
1207 	    }
1208 
1209 	case SIOCGNATL :
1210 	    {
1211 		natlookup_t nl;
1212 
1213 		error = ipf_inobj(softc, data, NULL, &nl, IPFOBJ_NATLOOKUP);
1214 		if (error == 0) {
1215 			void *ptr;
1216 
1217 			if (getlock) {
1218 				READ_ENTER(&softc->ipf_nat);
1219 			}
1220 
1221 			switch (nl.nl_v)
1222 			{
1223 			case 4 :
1224 				ptr = ipf_nat_lookupredir(&nl);
1225 				break;
1226 #ifdef USE_INET6
1227 			case 6 :
1228 				ptr = ipf_nat6_lookupredir(&nl);
1229 				break;
1230 #endif
1231 			default:
1232 				ptr = NULL;
1233 				break;
1234 			}
1235 
1236 			if (getlock) {
1237 				RWLOCK_EXIT(&softc->ipf_nat);
1238 			}
1239 			if (ptr != NULL) {
1240 				error = ipf_outobj(softc, data, &nl,
1241 						   IPFOBJ_NATLOOKUP);
1242 			} else {
1243 				IPFERROR(60011);
1244 				error = ESRCH;
1245 			}
1246 		}
1247 		break;
1248 	    }
1249 
1250 	case SIOCIPFFL :	/* old SIOCFLNAT & SIOCCNATL */
1251 		if (!(mode & FWRITE)) {
1252 			IPFERROR(60012);
1253 			error = EPERM;
1254 			break;
1255 		}
1256 		if (getlock) {
1257 			WRITE_ENTER(&softc->ipf_nat);
1258 		}
1259 
1260 		error = BCOPYIN(data, &arg, sizeof(arg));
1261 		if (error != 0) {
1262 			IPFERROR(60013);
1263 			error = EFAULT;
1264 		} else {
1265 			if (arg == 0)
1266 				ret = ipf_nat_flushtable(softc, softn);
1267 			else if (arg == 1)
1268 				ret = ipf_nat_clearlist(softc, softn);
1269 			else
1270 				ret = ipf_nat_extraflush(softc, softn, arg);
1271 			ipf_proxy_flush(softc->ipf_proxy_soft, arg);
1272 		}
1273 
1274 		if (getlock) {
1275 			RWLOCK_EXIT(&softc->ipf_nat);
1276 		}
1277 		if (error == 0) {
1278 			error = BCOPYOUT(&ret, data, sizeof(ret));
1279 		}
1280 		break;
1281 
1282 	case SIOCMATCHFLUSH :
1283 		if (!(mode & FWRITE)) {
1284 			IPFERROR(60014);
1285 			error = EPERM;
1286 			break;
1287 		}
1288 		if (getlock) {
1289 			WRITE_ENTER(&softc->ipf_nat);
1290 		}
1291 
1292 		error = ipf_nat_matchflush(softc, softn, data);
1293 
1294 		if (getlock) {
1295 			RWLOCK_EXIT(&softc->ipf_nat);
1296 		}
1297 		break;
1298 
1299 	case SIOCPROXY :
1300 		error = ipf_proxy_ioctl(softc, data, cmd, mode, ctx);
1301 		break;
1302 
1303 	case SIOCSTLCK :
1304 		if (!(mode & FWRITE)) {
1305 			IPFERROR(60015);
1306 			error = EPERM;
1307 		} else {
1308 			error = ipf_lock(data, &softn->ipf_nat_lock);
1309 		}
1310 		break;
1311 
1312 	case SIOCSTPUT :
1313 		if ((mode & FWRITE) != 0) {
1314 			error = ipf_nat_putent(softc, data, getlock);
1315 		} else {
1316 			IPFERROR(60016);
1317 			error = EACCES;
1318 		}
1319 		break;
1320 
1321 	case SIOCSTGSZ :
1322 		if (softn->ipf_nat_lock) {
1323 			error = ipf_nat_getsz(softc, data, getlock);
1324 		} else {
1325 			IPFERROR(60017);
1326 			error = EACCES;
1327 		}
1328 		break;
1329 
1330 	case SIOCSTGET :
1331 		if (softn->ipf_nat_lock) {
1332 			error = ipf_nat_getent(softc, data, getlock);
1333 		} else {
1334 			IPFERROR(60018);
1335 			error = EACCES;
1336 		}
1337 		break;
1338 
1339 	case SIOCGENITER :
1340 	    {
1341 		ipfgeniter_t iter;
1342 		ipftoken_t *token;
1343 		ipfobj_t obj;
1344 
1345 		error = ipf_inobj(softc, data, &obj, &iter, IPFOBJ_GENITER);
1346 		if (error != 0)
1347 			break;
1348 
1349 		SPL_SCHED(s);
1350 		token = ipf_token_find(softc, iter.igi_type, uid, ctx);
1351 		if (token != NULL) {
1352 			error  = ipf_nat_iterator(softc, token, &iter, &obj);
1353 			WRITE_ENTER(&softc->ipf_tokens);
1354 			ipf_token_deref(softc, token);
1355 			RWLOCK_EXIT(&softc->ipf_tokens);
1356 		}
1357 		SPL_X(s);
1358 		break;
1359 	    }
1360 
1361 	case SIOCIPFDELTOK :
1362 		error = BCOPYIN(data, &arg, sizeof(arg));
1363 		if (error == 0) {
1364 			SPL_SCHED(s);
1365 			error = ipf_token_del(softc, arg, uid, ctx);
1366 			SPL_X(s);
1367 		} else {
1368 			IPFERROR(60019);
1369 			error = EFAULT;
1370 		}
1371 		break;
1372 
1373 	case SIOCGTQTAB :
1374 		error = ipf_outobj(softc, data, softn->ipf_nat_tcptq,
1375 				   IPFOBJ_STATETQTAB);
1376 		break;
1377 
1378 	case SIOCGTABL :
1379 		error = ipf_nat_gettable(softc, softn, data);
1380 		break;
1381 
1382 	default :
1383 		IPFERROR(60020);
1384 		error = EINVAL;
1385 		break;
1386 	}
1387 done:
1388 	if (nat != NULL)
1389 		ipf_nat_rule_fini(softc, nat);
1390 	if (nt != NULL)
1391 		KFREES(nt, nt->in_size);
1392 	return (error);
1393 }
1394 
1395 
1396 /* ------------------------------------------------------------------------ */
1397 /* Function:    ipf_nat_siocaddnat                                          */
1398 /* Returns:     int - 0 == success, != 0 == failure                         */
1399 /* Parameters:  softc(I) - pointer to soft context main structure           */
1400 /*              softn(I) - pointer to NAT context structure                 */
1401 /*              n(I)       - pointer to new NAT rule                        */
1402 /*              np(I)      - pointer to where to insert new NAT rule        */
1403 /*              getlock(I) - flag indicating if lock on  is held            */
1404 /* Mutex Locks: ipf_nat_io                                                  */
1405 /*                                                                          */
1406 /* Handle SIOCADNAT.  Resolve and calculate details inside the NAT rule     */
1407 /* from information passed to the kernel, then add it  to the appropriate   */
1408 /* NAT rule table(s).                                                       */
1409 /* ------------------------------------------------------------------------ */
1410 static int
ipf_nat_siocaddnat(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n,int getlock)1411 ipf_nat_siocaddnat(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *n,
1412 	int getlock)
1413 {
1414 	int error = 0;
1415 
1416 	if (ipf_nat_resolverule(softc, n) != 0) {
1417 		IPFERROR(60022);
1418 		return (ENOENT);
1419 	}
1420 
1421 	if ((n->in_age[0] == 0) && (n->in_age[1] != 0)) {
1422 		IPFERROR(60023);
1423 		return (EINVAL);
1424 	}
1425 
1426 	if (n->in_redir == (NAT_DIVERTUDP|NAT_MAP)) {
1427 		/*
1428 		 * Prerecord whether or not the destination of the divert
1429 		 * is local or not to the interface the packet is going
1430 		 * to be sent out.
1431 		 */
1432 		n->in_dlocal = ipf_deliverlocal(softc, n->in_v[1],
1433 						n->in_ifps[1], &n->in_ndstip6);
1434 	}
1435 
1436 	if (getlock) {
1437 		WRITE_ENTER(&softc->ipf_nat);
1438 	}
1439 	n->in_next = NULL;
1440 	n->in_pnext = softn->ipf_nat_list_tail;
1441 	*n->in_pnext = n;
1442 	softn->ipf_nat_list_tail = &n->in_next;
1443 	n->in_use++;
1444 
1445 	if (n->in_redir & NAT_REDIRECT) {
1446 		n->in_flags &= ~IPN_NOTDST;
1447 		switch (n->in_v[0])
1448 		{
1449 		case 4 :
1450 			ipf_nat_addrdr(softn, n);
1451 			break;
1452 #ifdef USE_INET6
1453 		case 6 :
1454 			ipf_nat6_addrdr(softn, n);
1455 			break;
1456 #endif
1457 		default :
1458 			break;
1459 		}
1460 		ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_rdr);
1461 	}
1462 
1463 	if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
1464 		n->in_flags &= ~IPN_NOTSRC;
1465 		switch (n->in_v[0])
1466 		{
1467 		case 4 :
1468 			ipf_nat_addmap(softn, n);
1469 			break;
1470 #ifdef USE_INET6
1471 		case 6 :
1472 			ipf_nat6_addmap(softn, n);
1473 			break;
1474 #endif
1475 		default :
1476 			break;
1477 		}
1478 		ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_map);
1479 	}
1480 
1481 	if (n->in_age[0] != 0)
1482 		n->in_tqehead[0] = ipf_addtimeoutqueue(softc,
1483 						       &softn->ipf_nat_utqe,
1484 						       n->in_age[0]);
1485 
1486 	if (n->in_age[1] != 0)
1487 		n->in_tqehead[1] = ipf_addtimeoutqueue(softc,
1488 						       &softn->ipf_nat_utqe,
1489 						       n->in_age[1]);
1490 
1491 	MUTEX_INIT(&n->in_lock, "ipnat rule lock");
1492 
1493 	n = NULL;
1494 	ATOMIC_INC32(softn->ipf_nat_stats.ns_rules);
1495 #if SOLARIS && !defined(INSTANCES)
1496 	pfil_delayed_copy = 0;
1497 #endif
1498 	if (getlock) {
1499 		RWLOCK_EXIT(&softc->ipf_nat);			/* WRITE */
1500 	}
1501 
1502 	return (error);
1503 }
1504 
1505 
1506 /* ------------------------------------------------------------------------ */
1507 /* Function:    ipf_nat_ruleaddrinit                                        */
1508 /* Parameters:  softc(I) - pointer to soft context main structure           */
1509 /*              softn(I) - pointer to NAT context structure                 */
1510 /*              n(I)     - pointer to NAT rule                              */
1511 /*                                                                          */
1512 /* Initialise all of the NAT address structures in a NAT rule.              */
1513 /* ------------------------------------------------------------------------ */
1514 static int
ipf_nat_ruleaddrinit(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n)1515 ipf_nat_ruleaddrinit(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
1516 	ipnat_t *n)
1517 {
1518 	int idx, error;
1519 
1520 	if ((n->in_ndst.na_atype == FRI_LOOKUP) &&
1521 	    (n->in_ndst.na_type != IPLT_DSTLIST)) {
1522 		IPFERROR(60071);
1523 		return (EINVAL);
1524 	}
1525 	if ((n->in_nsrc.na_atype == FRI_LOOKUP) &&
1526 	    (n->in_nsrc.na_type != IPLT_DSTLIST)) {
1527 		IPFERROR(60069);
1528 		return (EINVAL);
1529 	}
1530 
1531 	if (n->in_redir == NAT_BIMAP) {
1532 		n->in_ndstaddr = n->in_osrcaddr;
1533 		n->in_ndstmsk = n->in_osrcmsk;
1534 		n->in_odstaddr = n->in_nsrcaddr;
1535 		n->in_odstmsk = n->in_nsrcmsk;
1536 
1537 	}
1538 
1539 	if (n->in_redir & NAT_REDIRECT)
1540 		idx = 1;
1541 	else
1542 		idx = 0;
1543 	/*
1544 	 * Initialise all of the address fields.
1545 	 */
1546 	error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc, 1,
1547 				     n->in_ifps[idx]);
1548 	if (error != 0)
1549 		return (error);
1550 
1551 	error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst, 1,
1552 				     n->in_ifps[idx]);
1553 	if (error != 0)
1554 		return (error);
1555 
1556 	error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc, 1,
1557 				     n->in_ifps[idx]);
1558 	if (error != 0)
1559 		return (error);
1560 
1561 	error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst, 1,
1562 				     n->in_ifps[idx]);
1563 	if (error != 0)
1564 		return (error);
1565 
1566 	if (n->in_redir & NAT_DIVERTUDP)
1567 		ipf_nat_builddivertmp(softn, n);
1568 
1569 	return (0);
1570 }
1571 
1572 
1573 /* ------------------------------------------------------------------------ */
1574 /* Function:    ipf_nat_resolvrule                                          */
1575 /* Returns:     Nil                                                         */
1576 /* Parameters:  softc(I) - pointer to soft context main structure           */
1577 /*              n(I)     - pointer to NAT rule                              */
1578 /*                                                                          */
1579 /* Handle SIOCADNAT.  Resolve and calculate details inside the NAT rule     */
1580 /* from information passed to the kernel, then add it  to the appropriate   */
1581 /* NAT rule table(s).                                                       */
1582 /* ------------------------------------------------------------------------ */
1583 static int
ipf_nat_resolverule(ipf_main_softc_t * softc,ipnat_t * n)1584 ipf_nat_resolverule(ipf_main_softc_t *softc, ipnat_t *n)
1585 {
1586 	char *base;
1587 
1588 	base = n->in_names;
1589 
1590 	n->in_ifps[0] = ipf_resolvenic(softc, base + n->in_ifnames[0],
1591 				       n->in_v[0]);
1592 
1593 	if (n->in_ifnames[1] == -1) {
1594 		n->in_ifnames[1] = n->in_ifnames[0];
1595 		n->in_ifps[1] = n->in_ifps[0];
1596 	} else {
1597 		n->in_ifps[1] = ipf_resolvenic(softc, base + n->in_ifnames[1],
1598 					       n->in_v[1]);
1599 	}
1600 
1601 	if (n->in_plabel != -1) {
1602 		if (n->in_redir & NAT_REDIRECT)
1603 			n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft,
1604 						     n->in_pr[0],
1605 						     base + n->in_plabel);
1606 		else
1607 			n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft,
1608 						     n->in_pr[1],
1609 						     base + n->in_plabel);
1610 		if (n->in_apr == NULL)
1611 			return (-1);
1612 	}
1613 	return (0);
1614 }
1615 
1616 
1617 /* ------------------------------------------------------------------------ */
1618 /* Function:    ipf_nat_siocdelnat                                          */
1619 /* Returns:     int - 0 == success, != 0 == failure                         */
1620 /* Parameters:  softc(I)   - pointer to soft context main structure         */
1621 /*              softn(I)   - pointer to NAT context structure               */
1622 /*              n(I)       - pointer to new NAT rule                        */
1623 /*              getlock(I) - flag indicating if lock on  is held            */
1624 /* Mutex Locks: ipf_nat_io                                                  */
1625 /*                                                                          */
1626 /* Handle SIOCADNAT.  Resolve and calculate details inside the NAT rule     */
1627 /* from information passed to the kernel, then add it  to the appropriate   */
1628 /* NAT rule table(s).                                                       */
1629 /* ------------------------------------------------------------------------ */
1630 static void
ipf_nat_siocdelnat(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n,int getlock)1631 ipf_nat_siocdelnat(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *n,
1632 	int getlock)
1633 {
1634 	if (getlock) {
1635 		WRITE_ENTER(&softc->ipf_nat);
1636 	}
1637 
1638 	ipf_nat_delrule(softc, softn, n, 1);
1639 
1640 	if (getlock) {
1641 		RWLOCK_EXIT(&softc->ipf_nat);			/* READ/WRITE */
1642 	}
1643 }
1644 
1645 
1646 /* ------------------------------------------------------------------------ */
1647 /* Function:    ipf_nat_getsz                                               */
1648 /* Returns:     int - 0 == success, != 0 is the error value.                */
1649 /* Parameters:  softc(I)   - pointer to soft context main structure         */
1650 /*              data(I)    - pointer to natget structure with kernel        */
1651 /*                           pointer get the size of.                       */
1652 /*              getlock(I) - flag indicating whether or not the caller      */
1653 /*                           holds a lock on ipf_nat                        */
1654 /*                                                                          */
1655 /* Handle SIOCSTGSZ.                                                        */
1656 /* Return the size of the nat list entry to be copied back to user space.   */
1657 /* The size of the entry is stored in the ng_sz field and the enture natget */
1658 /* structure is copied back to the user.                                    */
1659 /* ------------------------------------------------------------------------ */
1660 static int
ipf_nat_getsz(ipf_main_softc_t * softc,caddr_t data,int getlock)1661 ipf_nat_getsz(ipf_main_softc_t *softc, caddr_t data, int getlock)
1662 {
1663 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1664 	ap_session_t *aps;
1665 	nat_t *nat, *n;
1666 	natget_t ng;
1667 	int error;
1668 
1669 	error = BCOPYIN(data, &ng, sizeof(ng));
1670 	if (error != 0) {
1671 		IPFERROR(60024);
1672 		return (EFAULT);
1673 	}
1674 
1675 	if (getlock) {
1676 		READ_ENTER(&softc->ipf_nat);
1677 	}
1678 
1679 	nat = ng.ng_ptr;
1680 	if (!nat) {
1681 		nat = softn->ipf_nat_instances;
1682 		ng.ng_sz = 0;
1683 		/*
1684 		 * Empty list so the size returned is 0.  Simple.
1685 		 */
1686 		if (nat == NULL) {
1687 			if (getlock) {
1688 				RWLOCK_EXIT(&softc->ipf_nat);
1689 			}
1690 			error = BCOPYOUT(&ng, data, sizeof(ng));
1691 			if (error != 0) {
1692 				IPFERROR(60025);
1693 				return (EFAULT);
1694 			}
1695 			return (0);
1696 		}
1697 	} else {
1698 		/*
1699 		 * Make sure the pointer we're copying from exists in the
1700 		 * current list of entries.  Security precaution to prevent
1701 		 * copying of random kernel data.
1702 		 */
1703 		for (n = softn->ipf_nat_instances; n; n = n->nat_next)
1704 			if (n == nat)
1705 				break;
1706 		if (n == NULL) {
1707 			if (getlock) {
1708 				RWLOCK_EXIT(&softc->ipf_nat);
1709 			}
1710 			IPFERROR(60026);
1711 			return (ESRCH);
1712 		}
1713 	}
1714 
1715 	/*
1716 	 * Include any space required for proxy data structures.
1717 	 */
1718 	ng.ng_sz = sizeof(nat_save_t);
1719 	aps = nat->nat_aps;
1720 	if (aps != NULL) {
1721 		ng.ng_sz += sizeof(ap_session_t) - 4;
1722 		if (aps->aps_data != 0)
1723 			ng.ng_sz += aps->aps_psiz;
1724 	}
1725 	if (getlock) {
1726 		RWLOCK_EXIT(&softc->ipf_nat);
1727 	}
1728 
1729 	error = BCOPYOUT(&ng, data, sizeof(ng));
1730 	if (error != 0) {
1731 		IPFERROR(60027);
1732 		return (EFAULT);
1733 	}
1734 	return (0);
1735 }
1736 
1737 
1738 /* ------------------------------------------------------------------------ */
1739 /* Function:    ipf_nat_getent                                              */
1740 /* Returns:     int - 0 == success, != 0 is the error value.                */
1741 /* Parameters:  softc(I)   - pointer to soft context main structure         */
1742 /*              data(I)    - pointer to natget structure with kernel pointer*/
1743 /*                           to NAT structure to copy out.                  */
1744 /*              getlock(I) - flag indicating whether or not the caller      */
1745 /*                           holds a lock on ipf_nat                        */
1746 /*                                                                          */
1747 /* Handle SIOCSTGET.                                                        */
1748 /* Copies out NAT entry to user space.  Any additional data held for a      */
1749 /* proxy is also copied, as to is the NAT rule which was responsible for it */
1750 /* ------------------------------------------------------------------------ */
1751 static int
ipf_nat_getent(ipf_main_softc_t * softc,caddr_t data,int getlock)1752 ipf_nat_getent(ipf_main_softc_t *softc, caddr_t data, int getlock)
1753 {
1754 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1755 	int error, outsize;
1756 	ap_session_t *aps;
1757 	nat_save_t *ipn, ipns;
1758 	nat_t *n, *nat;
1759 
1760 	error = ipf_inobj(softc, data, NULL, &ipns, IPFOBJ_NATSAVE);
1761 	if (error != 0)
1762 		return (error);
1763 
1764 	if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920)) {
1765 		IPFERROR(60028);
1766 		return (EINVAL);
1767 	}
1768 
1769 	KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize);
1770 	if (ipn == NULL) {
1771 		IPFERROR(60029);
1772 		return (ENOMEM);
1773 	}
1774 
1775 	if (getlock) {
1776 		READ_ENTER(&softc->ipf_nat);
1777 	}
1778 
1779 	ipn->ipn_dsize = ipns.ipn_dsize;
1780 	nat = ipns.ipn_next;
1781 	if (nat == NULL) {
1782 		nat = softn->ipf_nat_instances;
1783 		if (nat == NULL) {
1784 			if (softn->ipf_nat_instances == NULL) {
1785 				IPFERROR(60030);
1786 				error = ENOENT;
1787 			}
1788 			goto finished;
1789 		}
1790 	} else {
1791 		/*
1792 		 * Make sure the pointer we're copying from exists in the
1793 		 * current list of entries.  Security precaution to prevent
1794 		 * copying of random kernel data.
1795 		 */
1796 		for (n = softn->ipf_nat_instances; n; n = n->nat_next)
1797 			if (n == nat)
1798 				break;
1799 		if (n == NULL) {
1800 			IPFERROR(60031);
1801 			error = ESRCH;
1802 			goto finished;
1803 		}
1804 	}
1805 	ipn->ipn_next = nat->nat_next;
1806 
1807 	/*
1808 	 * Copy the NAT structure.
1809 	 */
1810 	bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat));
1811 
1812 	/*
1813 	 * If we have a pointer to the NAT rule it belongs to, save that too.
1814 	 */
1815 	if (nat->nat_ptr != NULL)
1816 		bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat,
1817 		      sizeof(nat->nat_ptr));
1818 
1819 	/*
1820 	 * If we also know the NAT entry has an associated filter rule,
1821 	 * save that too.
1822 	 */
1823 	if (nat->nat_fr != NULL)
1824 		bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr,
1825 		      sizeof(ipn->ipn_fr));
1826 
1827 	/*
1828 	 * Last but not least, if there is an application proxy session set
1829 	 * up for this NAT entry, then copy that out too, including any
1830 	 * private data saved along side it by the proxy.
1831 	 */
1832 	aps = nat->nat_aps;
1833 	outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data);
1834 	if (aps != NULL) {
1835 		char *s;
1836 
1837 		if (outsize < sizeof(*aps)) {
1838 			IPFERROR(60032);
1839 			error = ENOBUFS;
1840 			goto finished;
1841 		}
1842 
1843 		s = ipn->ipn_data;
1844 		bcopy((char *)aps, s, sizeof(*aps));
1845 		s += sizeof(*aps);
1846 		outsize -= sizeof(*aps);
1847 		if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz))
1848 			bcopy(aps->aps_data, s, aps->aps_psiz);
1849 		else {
1850 			IPFERROR(60033);
1851 			error = ENOBUFS;
1852 		}
1853 	}
1854 	if (error == 0) {
1855 		error = ipf_outobjsz(softc, data, ipn, IPFOBJ_NATSAVE,
1856 				     ipns.ipn_dsize);
1857 	}
1858 
1859 finished:
1860 	if (ipn != NULL) {
1861 		KFREES(ipn, ipns.ipn_dsize);
1862 	}
1863 	if (getlock) {
1864 		RWLOCK_EXIT(&softc->ipf_nat);
1865 	}
1866 	return (error);
1867 }
1868 
1869 
1870 /* ------------------------------------------------------------------------ */
1871 /* Function:    ipf_nat_putent                                              */
1872 /* Returns:     int - 0 == success, != 0 is the error value.                */
1873 /* Parameters:  softc(I)   - pointer to soft context main structure         */
1874 /*              data(I)    - pointer to natget structure with NAT           */
1875 /*                           structure information to load into the kernel  */
1876 /*              getlock(I) - flag indicating whether or not a write lock    */
1877 /*                           on is already held.                            */
1878 /*                                                                          */
1879 /* Handle SIOCSTPUT.                                                        */
1880 /* Loads a NAT table entry from user space, including a NAT rule, proxy and */
1881 /* firewall rule data structures, if pointers to them indicate so.          */
1882 /* ------------------------------------------------------------------------ */
1883 static int
ipf_nat_putent(ipf_main_softc_t * softc,caddr_t data,int getlock)1884 ipf_nat_putent(ipf_main_softc_t *softc, caddr_t data, int getlock)
1885 {
1886 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1887 	nat_save_t ipn, *ipnn;
1888 	ap_session_t *aps;
1889 	nat_t *n, *nat;
1890 	frentry_t *fr;
1891 	fr_info_t fin;
1892 	ipnat_t *in;
1893 	int error;
1894 
1895 	error = ipf_inobj(softc, data, NULL, &ipn, IPFOBJ_NATSAVE);
1896 	if (error != 0)
1897 		return (error);
1898 
1899 	/*
1900 	 * Initialise early because of code at junkput label.
1901 	 */
1902 	n = NULL;
1903 	in = NULL;
1904 	aps = NULL;
1905 	nat = NULL;
1906 	ipnn = NULL;
1907 	fr = NULL;
1908 
1909 	/*
1910 	 * New entry, copy in the rest of the NAT entry if it's size is more
1911 	 * than just the nat_t structure.
1912 	 */
1913 	if (ipn.ipn_dsize > sizeof(ipn)) {
1914 		if (ipn.ipn_dsize > 81920) {
1915 			IPFERROR(60034);
1916 			error = ENOMEM;
1917 			goto junkput;
1918 		}
1919 
1920 		KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize);
1921 		if (ipnn == NULL) {
1922 			IPFERROR(60035);
1923 			return (ENOMEM);
1924 		}
1925 
1926 		bzero(ipnn, ipn.ipn_dsize);
1927 		error = ipf_inobjsz(softc, data, ipnn, IPFOBJ_NATSAVE,
1928 				    ipn.ipn_dsize);
1929 		if (error != 0) {
1930 			goto junkput;
1931 		}
1932 	} else
1933 		ipnn = &ipn;
1934 
1935 	KMALLOC(nat, nat_t *);
1936 	if (nat == NULL) {
1937 		IPFERROR(60037);
1938 		error = ENOMEM;
1939 		goto junkput;
1940 	}
1941 
1942 	bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat));
1943 
1944 	switch (nat->nat_v[0])
1945 	{
1946 	case 4:
1947 #ifdef USE_INET6
1948 	case 6 :
1949 #endif
1950 		break;
1951 	default :
1952 		IPFERROR(60061);
1953 		error = EPROTONOSUPPORT;
1954 		goto junkput;
1955 		/*NOTREACHED*/
1956 	}
1957 
1958 	/*
1959 	 * Initialize all these so that ipf_nat_delete() doesn't cause a crash.
1960 	 */
1961 	bzero((char *)nat, offsetof(struct nat, nat_tqe));
1962 	nat->nat_tqe.tqe_pnext = NULL;
1963 	nat->nat_tqe.tqe_next = NULL;
1964 	nat->nat_tqe.tqe_ifq = NULL;
1965 	nat->nat_tqe.tqe_parent = nat;
1966 
1967 	/*
1968 	 * Restore the rule associated with this nat session
1969 	 */
1970 	in = ipnn->ipn_nat.nat_ptr;
1971 	if (in != NULL) {
1972 		KMALLOCS(in, ipnat_t *, ipnn->ipn_ipnat.in_size);
1973 		nat->nat_ptr = in;
1974 		if (in == NULL) {
1975 			IPFERROR(60038);
1976 			error = ENOMEM;
1977 			goto junkput;
1978 		}
1979 		bcopy((char *)&ipnn->ipn_ipnat, (char *)in,
1980 		      ipnn->ipn_ipnat.in_size);
1981 		in->in_use = 1;
1982 		in->in_flags |= IPN_DELETE;
1983 
1984 		ATOMIC_INC32(softn->ipf_nat_stats.ns_rules);
1985 
1986 		if (ipf_nat_resolverule(softc, in) != 0) {
1987 			IPFERROR(60039);
1988 			error = ESRCH;
1989 			goto junkput;
1990 		}
1991 	}
1992 
1993 	/*
1994 	 * Check that the NAT entry doesn't already exist in the kernel.
1995 	 *
1996 	 * For NAT_OUTBOUND, we're lookup for a duplicate MAP entry.  To do
1997 	 * this, we check to see if the inbound combination of addresses and
1998 	 * ports is already known.  Similar logic is applied for NAT_INBOUND.
1999 	 *
2000 	 */
2001 	bzero((char *)&fin, sizeof(fin));
2002 	fin.fin_v = nat->nat_v[0];
2003 	fin.fin_p = nat->nat_pr[0];
2004 	fin.fin_rev = nat->nat_rev;
2005 	fin.fin_ifp = nat->nat_ifps[0];
2006 	fin.fin_data[0] = ntohs(nat->nat_ndport);
2007 	fin.fin_data[1] = ntohs(nat->nat_nsport);
2008 
2009 	switch (nat->nat_dir)
2010 	{
2011 	case NAT_OUTBOUND :
2012 	case NAT_DIVERTOUT :
2013 		if (getlock) {
2014 			READ_ENTER(&softc->ipf_nat);
2015 		}
2016 
2017 		fin.fin_v = nat->nat_v[1];
2018 		if (nat->nat_v[1] == 4) {
2019 			n = ipf_nat_inlookup(&fin, nat->nat_flags, fin.fin_p,
2020 					     nat->nat_ndstip, nat->nat_nsrcip);
2021 #ifdef USE_INET6
2022 		} else if (nat->nat_v[1] == 6) {
2023 			n = ipf_nat6_inlookup(&fin, nat->nat_flags, fin.fin_p,
2024 					      &nat->nat_ndst6.in6,
2025 					      &nat->nat_nsrc6.in6);
2026 #endif
2027 		}
2028 
2029 		if (getlock) {
2030 			RWLOCK_EXIT(&softc->ipf_nat);
2031 		}
2032 		if (n != NULL) {
2033 			IPFERROR(60040);
2034 			error = EEXIST;
2035 			goto junkput;
2036 		}
2037 		break;
2038 
2039 	case NAT_INBOUND :
2040 	case NAT_DIVERTIN :
2041 		if (getlock) {
2042 			READ_ENTER(&softc->ipf_nat);
2043 		}
2044 
2045 		if (fin.fin_v == 4) {
2046 			n = ipf_nat_outlookup(&fin, nat->nat_flags, fin.fin_p,
2047 					      nat->nat_ndstip,
2048 					      nat->nat_nsrcip);
2049 #ifdef USE_INET6
2050 		} else if (fin.fin_v == 6) {
2051 			n = ipf_nat6_outlookup(&fin, nat->nat_flags, fin.fin_p,
2052 					       &nat->nat_ndst6.in6,
2053 					       &nat->nat_nsrc6.in6);
2054 #endif
2055 		}
2056 
2057 		if (getlock) {
2058 			RWLOCK_EXIT(&softc->ipf_nat);
2059 		}
2060 		if (n != NULL) {
2061 			IPFERROR(60041);
2062 			error = EEXIST;
2063 			goto junkput;
2064 		}
2065 		break;
2066 
2067 	default :
2068 		IPFERROR(60042);
2069 		error = EINVAL;
2070 		goto junkput;
2071 	}
2072 
2073 	/*
2074 	 * Restore ap_session_t structure.  Include the private data allocated
2075 	 * if it was there.
2076 	 */
2077 	aps = nat->nat_aps;
2078 	if (aps != NULL) {
2079 		KMALLOC(aps, ap_session_t *);
2080 		nat->nat_aps = aps;
2081 		if (aps == NULL) {
2082 			IPFERROR(60043);
2083 			error = ENOMEM;
2084 			goto junkput;
2085 		}
2086 		bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
2087 		if (in != NULL)
2088 			aps->aps_apr = in->in_apr;
2089 		else
2090 			aps->aps_apr = NULL;
2091 		if (aps->aps_psiz != 0) {
2092 			if (aps->aps_psiz > 81920) {
2093 				IPFERROR(60044);
2094 				error = ENOMEM;
2095 				goto junkput;
2096 			}
2097 			KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
2098 			if (aps->aps_data == NULL) {
2099 				IPFERROR(60045);
2100 				error = ENOMEM;
2101 				goto junkput;
2102 			}
2103 			bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
2104 			      aps->aps_psiz);
2105 		} else {
2106 			aps->aps_psiz = 0;
2107 			aps->aps_data = NULL;
2108 		}
2109 	}
2110 
2111 	/*
2112 	 * If there was a filtering rule associated with this entry then
2113 	 * build up a new one.
2114 	 */
2115 	fr = nat->nat_fr;
2116 	if (fr != NULL) {
2117 		if ((nat->nat_flags & SI_NEWFR) != 0) {
2118 			KMALLOC(fr, frentry_t *);
2119 			nat->nat_fr = fr;
2120 			if (fr == NULL) {
2121 				IPFERROR(60046);
2122 				error = ENOMEM;
2123 				goto junkput;
2124 			}
2125 			ipnn->ipn_nat.nat_fr = fr;
2126 			fr->fr_ref = 1;
2127 			(void) ipf_outobj(softc, data, ipnn, IPFOBJ_NATSAVE);
2128 			bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr));
2129 
2130 			fr->fr_ref = 1;
2131 			fr->fr_dsize = 0;
2132 			fr->fr_data = NULL;
2133 			fr->fr_type = FR_T_NONE;
2134 
2135 			MUTEX_NUKE(&fr->fr_lock);
2136 			MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock");
2137 		} else {
2138 			if (getlock) {
2139 				READ_ENTER(&softc->ipf_nat);
2140 			}
2141 			for (n = softn->ipf_nat_instances; n; n = n->nat_next)
2142 				if (n->nat_fr == fr)
2143 					break;
2144 
2145 			if (n != NULL) {
2146 				MUTEX_ENTER(&fr->fr_lock);
2147 				fr->fr_ref++;
2148 				MUTEX_EXIT(&fr->fr_lock);
2149 			}
2150 			if (getlock) {
2151 				RWLOCK_EXIT(&softc->ipf_nat);
2152 			}
2153 
2154 			if (n == NULL) {
2155 				IPFERROR(60047);
2156 				error = ESRCH;
2157 				goto junkput;
2158 			}
2159 		}
2160 	}
2161 
2162 	if (ipnn != &ipn) {
2163 		KFREES(ipnn, ipn.ipn_dsize);
2164 		ipnn = NULL;
2165 	}
2166 
2167 	if (getlock) {
2168 		WRITE_ENTER(&softc->ipf_nat);
2169 	}
2170 
2171 	if (fin.fin_v == 4)
2172 		error = ipf_nat_finalise(&fin, nat);
2173 #ifdef USE_INET6
2174 	else
2175 		error = ipf_nat6_finalise(&fin, nat);
2176 #endif
2177 
2178 	if (getlock) {
2179 		RWLOCK_EXIT(&softc->ipf_nat);
2180 	}
2181 
2182 	if (error == 0)
2183 		return (0);
2184 
2185 	IPFERROR(60048);
2186 	error = ENOMEM;
2187 
2188 junkput:
2189 	if (fr != NULL) {
2190 		(void) ipf_derefrule(softc, &fr);
2191 	}
2192 
2193 	if ((ipnn != NULL) && (ipnn != &ipn)) {
2194 		KFREES(ipnn, ipn.ipn_dsize);
2195 	}
2196 	if (nat != NULL) {
2197 		if (aps != NULL) {
2198 			if (aps->aps_data != NULL) {
2199 				KFREES(aps->aps_data, aps->aps_psiz);
2200 			}
2201 			KFREE(aps);
2202 		}
2203 		if (in != NULL) {
2204 			if (in->in_apr)
2205 				ipf_proxy_deref(in->in_apr);
2206 			KFREES(in, in->in_size);
2207 		}
2208 		KFREE(nat);
2209 	}
2210 	return (error);
2211 }
2212 
2213 
2214 /* ------------------------------------------------------------------------ */
2215 /* Function:    ipf_nat_delete                                              */
2216 /* Returns:     Nil                                                         */
2217 /* Parameters:  softc(I)   - pointer to soft context main structure         */
2218 /*              nat(I)     - pointer to NAT structure to delete             */
2219 /*              logtype(I) - type of LOG record to create before deleting   */
2220 /* Write Lock:  ipf_nat                                                     */
2221 /*                                                                          */
2222 /* Delete a nat entry from the various lists and table.  If NAT logging is  */
2223 /* enabled then generate a NAT log record for this event.                   */
2224 /* ------------------------------------------------------------------------ */
2225 void
ipf_nat_delete(ipf_main_softc_t * softc,struct nat * nat,int logtype)2226 ipf_nat_delete(ipf_main_softc_t *softc, struct nat *nat, int logtype)
2227 {
2228 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2229 	int madeorphan = 0, bkt, removed = 0;
2230 	nat_stat_side_t *nss;
2231 	struct ipnat *ipn;
2232 
2233 	if (logtype != 0 && softn->ipf_nat_logging != 0)
2234 		ipf_nat_log(softc, softn, nat, logtype);
2235 
2236 	/*
2237 	 * Take it as a general indication that all the pointers are set if
2238 	 * nat_pnext is set.
2239 	 */
2240 	if (nat->nat_pnext != NULL) {
2241 		removed = 1;
2242 
2243 		bkt = nat->nat_hv[0] % softn->ipf_nat_table_sz;
2244 		nss = &softn->ipf_nat_stats.ns_side[0];
2245 		if (nss->ns_bucketlen[bkt] > 0)
2246 			nss->ns_bucketlen[bkt]--;
2247 		if (nss->ns_bucketlen[bkt] == 0) {
2248 			nss->ns_inuse--;
2249 		}
2250 
2251 		bkt = nat->nat_hv[1] % softn->ipf_nat_table_sz;
2252 		nss = &softn->ipf_nat_stats.ns_side[1];
2253 		if (nss->ns_bucketlen[bkt] > 0)
2254 			nss->ns_bucketlen[bkt]--;
2255 		if (nss->ns_bucketlen[bkt] == 0) {
2256 			nss->ns_inuse--;
2257 		}
2258 
2259 		*nat->nat_pnext = nat->nat_next;
2260 		if (nat->nat_next != NULL) {
2261 			nat->nat_next->nat_pnext = nat->nat_pnext;
2262 			nat->nat_next = NULL;
2263 		}
2264 		nat->nat_pnext = NULL;
2265 
2266 		*nat->nat_phnext[0] = nat->nat_hnext[0];
2267 		if (nat->nat_hnext[0] != NULL) {
2268 			nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
2269 			nat->nat_hnext[0] = NULL;
2270 		}
2271 		nat->nat_phnext[0] = NULL;
2272 
2273 		*nat->nat_phnext[1] = nat->nat_hnext[1];
2274 		if (nat->nat_hnext[1] != NULL) {
2275 			nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
2276 			nat->nat_hnext[1] = NULL;
2277 		}
2278 		nat->nat_phnext[1] = NULL;
2279 
2280 		if ((nat->nat_flags & SI_WILDP) != 0) {
2281 			ATOMIC_DEC32(softn->ipf_nat_stats.ns_wilds);
2282 		}
2283 		madeorphan = 1;
2284 	}
2285 
2286 	if (nat->nat_me != NULL) {
2287 		*nat->nat_me = NULL;
2288 		nat->nat_me = NULL;
2289 		nat->nat_ref--;
2290 		ASSERT(nat->nat_ref >= 0);
2291 	}
2292 
2293 	if (nat->nat_tqe.tqe_ifq != NULL) {
2294 		/*
2295 		 * No call to ipf_freetimeoutqueue() is made here, they are
2296 		 * garbage collected in ipf_nat_expire().
2297 		 */
2298 		(void) ipf_deletequeueentry(&nat->nat_tqe);
2299 	}
2300 
2301 	if (nat->nat_sync) {
2302 		ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync);
2303 		nat->nat_sync = NULL;
2304 	}
2305 
2306 	if (logtype == NL_EXPIRE)
2307 		softn->ipf_nat_stats.ns_expire++;
2308 
2309 	MUTEX_ENTER(&nat->nat_lock);
2310 	/*
2311 	 * NL_DESTROY should only be passed in when we've got nat_ref >= 2.
2312 	 * This happens when a nat'd packet is blocked and we want to throw
2313 	 * away the NAT session.
2314 	 */
2315 	if (logtype == NL_DESTROY) {
2316 		if (nat->nat_ref > 2) {
2317 			nat->nat_ref -= 2;
2318 			MUTEX_EXIT(&nat->nat_lock);
2319 			if (removed)
2320 				softn->ipf_nat_stats.ns_orphans++;
2321 			return;
2322 		}
2323 	} else if (nat->nat_ref > 1) {
2324 		nat->nat_ref--;
2325 		MUTEX_EXIT(&nat->nat_lock);
2326 		if (madeorphan == 1)
2327 			softn->ipf_nat_stats.ns_orphans++;
2328 		return;
2329 	}
2330 	ASSERT(nat->nat_ref >= 0);
2331 	MUTEX_EXIT(&nat->nat_lock);
2332 
2333 	nat->nat_ref = 0;
2334 
2335 	if (madeorphan == 0)
2336 		softn->ipf_nat_stats.ns_orphans--;
2337 
2338 	/*
2339 	 * At this point, nat_ref can be either 0 or -1
2340 	 */
2341 	softn->ipf_nat_stats.ns_proto[nat->nat_pr[0]]--;
2342 
2343 	if (nat->nat_fr != NULL) {
2344 		(void) ipf_derefrule(softc, &nat->nat_fr);
2345 	}
2346 
2347 	if (nat->nat_hm != NULL) {
2348 		ipf_nat_hostmapdel(softc, &nat->nat_hm);
2349 	}
2350 
2351 	/*
2352 	 * If there is an active reference from the nat entry to its parent
2353 	 * rule, decrement the rule's reference count and free it too if no
2354 	 * longer being used.
2355 	 */
2356 	ipn = nat->nat_ptr;
2357 	nat->nat_ptr = NULL;
2358 
2359 	if (ipn != NULL) {
2360 		ipn->in_space++;
2361 		ipf_nat_rule_deref(softc, &ipn);
2362 	}
2363 
2364 	if (nat->nat_aps != NULL) {
2365 		ipf_proxy_free(softc, nat->nat_aps);
2366 		nat->nat_aps = NULL;
2367 	}
2368 
2369 	MUTEX_DESTROY(&nat->nat_lock);
2370 
2371 	softn->ipf_nat_stats.ns_active--;
2372 
2373 	/*
2374 	 * If there's a fragment table entry too for this nat entry, then
2375 	 * dereference that as well.  This is after nat_lock is released
2376 	 * because of Tru64.
2377 	 */
2378 	ipf_frag_natforget(softc, (void *)nat);
2379 
2380 	KFREE(nat);
2381 }
2382 
2383 
2384 /* ------------------------------------------------------------------------ */
2385 /* Function:    ipf_nat_flushtable                                          */
2386 /* Returns:     int - number of NAT rules deleted                           */
2387 /* Parameters:  softc(I) - pointer to soft context main structure           */
2388 /*              softn(I) - pointer to NAT context structure                 */
2389 /* Write Lock:  ipf_nat                                                     */
2390 /*                                                                          */
2391 /* Deletes all currently active NAT sessions.  In deleting each NAT entry a */
2392 /* log record should be emitted in ipf_nat_delete() if NAT logging is       */
2393 /* enabled.                                                                 */
2394 /* ------------------------------------------------------------------------ */
2395 /*
2396  * nat_flushtable - clear the NAT table of all mapping entries.
2397  */
2398 static int
ipf_nat_flushtable(ipf_main_softc_t * softc,ipf_nat_softc_t * softn)2399 ipf_nat_flushtable(ipf_main_softc_t *softc, ipf_nat_softc_t *softn)
2400 {
2401 	nat_t *nat;
2402 	int j = 0;
2403 
2404 	/*
2405 	 * ALL NAT mappings deleted, so lets just make the deletions
2406 	 * quicker.
2407 	 */
2408 	if (softn->ipf_nat_table[0] != NULL)
2409 		bzero((char *)softn->ipf_nat_table[0],
2410 		      sizeof(softn->ipf_nat_table[0]) *
2411 		      softn->ipf_nat_table_sz);
2412 	if (softn->ipf_nat_table[1] != NULL)
2413 		bzero((char *)softn->ipf_nat_table[1],
2414 		      sizeof(softn->ipf_nat_table[1]) *
2415 		      softn->ipf_nat_table_sz);
2416 
2417 	while ((nat = softn->ipf_nat_instances) != NULL) {
2418 		ipf_nat_delete(softc, nat, NL_FLUSH);
2419 		j++;
2420 	}
2421 
2422 	return (j);
2423 }
2424 
2425 
2426 /* ------------------------------------------------------------------------ */
2427 /* Function:    ipf_nat_clearlist                                           */
2428 /* Returns:     int - number of NAT/RDR rules deleted                       */
2429 /* Parameters:  softc(I) - pointer to soft context main structure           */
2430 /*              softn(I) - pointer to NAT context structure                 */
2431 /*                                                                          */
2432 /* Delete all rules in the current list of rules.  There is nothing elegant */
2433 /* about this cleanup: simply free all entries on the list of rules and     */
2434 /* clear out the tables used for hashed NAT rule lookups.                   */
2435 /* ------------------------------------------------------------------------ */
2436 static int
ipf_nat_clearlist(ipf_main_softc_t * softc,ipf_nat_softc_t * softn)2437 ipf_nat_clearlist(ipf_main_softc_t *softc, ipf_nat_softc_t *softn)
2438 {
2439 	ipnat_t *n;
2440 	int i = 0;
2441 
2442 	if (softn->ipf_nat_map_rules != NULL) {
2443 		bzero((char *)softn->ipf_nat_map_rules,
2444 		      sizeof(*softn->ipf_nat_map_rules) *
2445 		      softn->ipf_nat_maprules_sz);
2446 	}
2447 	if (softn->ipf_nat_rdr_rules != NULL) {
2448 		bzero((char *)softn->ipf_nat_rdr_rules,
2449 		      sizeof(*softn->ipf_nat_rdr_rules) *
2450 		      softn->ipf_nat_rdrrules_sz);
2451 	}
2452 
2453 	while ((n = softn->ipf_nat_list) != NULL) {
2454 		ipf_nat_delrule(softc, softn, n, 0);
2455 		i++;
2456 	}
2457 #if SOLARIS && !defined(INSTANCES)
2458 	pfil_delayed_copy = 1;
2459 #endif
2460 	return (i);
2461 }
2462 
2463 
2464 /* ------------------------------------------------------------------------ */
2465 /* Function:    ipf_nat_delrule                                             */
2466 /* Returns:     Nil                                                         */
2467 /* Parameters:  softc(I) - pointer to soft context main structure           */
2468 /*              softn(I) - pointer to NAT context structure                 */
2469 /*              np(I)    - pointer to NAT rule to delete                    */
2470 /*              purge(I) - 1 == allow purge, 0 == prevent purge             */
2471 /* Locks:       WRITE(ipf_nat)                                              */
2472 /*                                                                          */
2473 /* Preventing "purge" from occuring is allowed because when all of the NAT  */
2474 /* rules are being removed, allowing the "purge" to walk through the list   */
2475 /* of NAT sessions, possibly multiple times, would be a large performance   */
2476 /* hit, on the order of O(N^2).                                             */
2477 /* ------------------------------------------------------------------------ */
2478 static void
ipf_nat_delrule(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * np,int purge)2479 ipf_nat_delrule(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *np,
2480 	int purge)
2481 {
2482 
2483 	if (np->in_pnext != NULL) {
2484 		*np->in_pnext = np->in_next;
2485 		if (np->in_next != NULL)
2486 			np->in_next->in_pnext = np->in_pnext;
2487 		if (softn->ipf_nat_list_tail == &np->in_next)
2488 			softn->ipf_nat_list_tail = np->in_pnext;
2489 	}
2490 
2491 	if ((purge == 1) && ((np->in_flags & IPN_PURGE) != 0)) {
2492 		nat_t *next;
2493 		nat_t *nat;
2494 
2495 		for (next = softn->ipf_nat_instances; (nat = next) != NULL;) {
2496 			next = nat->nat_next;
2497 			if (nat->nat_ptr == np)
2498 				ipf_nat_delete(softc, nat, NL_PURGE);
2499 		}
2500 	}
2501 
2502 	if ((np->in_flags & IPN_DELETE) == 0) {
2503 		if (np->in_redir & NAT_REDIRECT) {
2504 			switch (np->in_v[0])
2505 			{
2506 			case 4 :
2507 				ipf_nat_delrdr(softn, np);
2508 				break;
2509 #ifdef USE_INET6
2510 			case 6 :
2511 				ipf_nat6_delrdr(softn, np);
2512 				break;
2513 #endif
2514 			}
2515 		}
2516 		if (np->in_redir & (NAT_MAPBLK|NAT_MAP)) {
2517 			switch (np->in_v[0])
2518 			{
2519 			case 4 :
2520 				ipf_nat_delmap(softn, np);
2521 				break;
2522 #ifdef USE_INET6
2523 			case 6 :
2524 				ipf_nat6_delmap(softn, np);
2525 				break;
2526 #endif
2527 			}
2528 		}
2529 	}
2530 
2531 	np->in_flags |= IPN_DELETE;
2532 	ipf_nat_rule_deref(softc, &np);
2533 }
2534 
2535 
2536 /* ------------------------------------------------------------------------ */
2537 /* Function:    ipf_nat_newmap                                              */
2538 /* Returns:     int - -1 == error, 0 == success                             */
2539 /* Parameters:  fin(I) - pointer to packet information                      */
2540 /*              nat(I) - pointer to NAT entry                               */
2541 /*              ni(I)  - pointer to structure with misc. information needed */
2542 /*                       to create new NAT entry.                           */
2543 /*                                                                          */
2544 /* Given an empty NAT structure, populate it with new information about a   */
2545 /* new NAT session, as defined by the matching NAT rule.                    */
2546 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2547 /* to the new IP address for the translation.                               */
2548 /* ------------------------------------------------------------------------ */
2549 static int
ipf_nat_newmap(fr_info_t * fin,nat_t * nat,natinfo_t * ni)2550 ipf_nat_newmap(fr_info_t *fin, nat_t *nat, natinfo_t *ni)
2551 {
2552 	ipf_main_softc_t *softc = fin->fin_main_soft;
2553 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2554 	u_short st_port, dport, sport, port, sp, dp;
2555 	struct in_addr in, inb;
2556 	hostmap_t *hm;
2557 	u_32_t flags;
2558 	u_32_t st_ip;
2559 	ipnat_t *np;
2560 	nat_t *natl;
2561 	int l;
2562 
2563 	/*
2564 	 * If it's an outbound packet which doesn't match any existing
2565 	 * record, then create a new port
2566 	 */
2567 	l = 0;
2568 	hm = NULL;
2569 	np = ni->nai_np;
2570 	st_ip = np->in_snip;
2571 	st_port = np->in_spnext;
2572 	flags = nat->nat_flags;
2573 
2574 	if (flags & IPN_ICMPQUERY) {
2575 		sport = fin->fin_data[1];
2576 		dport = 0;
2577 	} else {
2578 		sport = htons(fin->fin_data[0]);
2579 		dport = htons(fin->fin_data[1]);
2580 	}
2581 
2582 	/*
2583 	 * Do a loop until we either run out of entries to try or we find
2584 	 * a NAT mapping that isn't currently being used.  This is done
2585 	 * because the change to the source is not (usually) being fixed.
2586 	 */
2587 	do {
2588 		port = 0;
2589 		in.s_addr = htonl(np->in_snip);
2590 		if (l == 0) {
2591 			/*
2592 			 * Check to see if there is an existing NAT
2593 			 * setup for this IP address pair.
2594 			 */
2595 			hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2596 					     fin->fin_dst, in, 0);
2597 			if (hm != NULL)
2598 				in.s_addr = hm->hm_nsrcip.s_addr;
2599 		} else if ((l == 1) && (hm != NULL)) {
2600 			ipf_nat_hostmapdel(softc, &hm);
2601 		}
2602 		in.s_addr = ntohl(in.s_addr);
2603 
2604 		nat->nat_hm = hm;
2605 
2606 		if ((np->in_nsrcmsk == 0xffffffff) && (np->in_spnext == 0)) {
2607 			if (l > 0) {
2608 				NBUMPSIDEX(1, ns_exhausted, ns_exhausted_1);
2609 				DT4(ns_exhausted_1, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2610 				return (-1);
2611 			}
2612 		}
2613 
2614 		if (np->in_redir == NAT_BIMAP &&
2615 		    np->in_osrcmsk == np->in_nsrcmsk) {
2616 			/*
2617 			 * map the address block in a 1:1 fashion
2618 			 */
2619 			in.s_addr = np->in_nsrcaddr;
2620 			in.s_addr |= fin->fin_saddr & ~np->in_osrcmsk;
2621 			in.s_addr = ntohl(in.s_addr);
2622 
2623 		} else if (np->in_redir & NAT_MAPBLK) {
2624 			if ((l >= np->in_ppip) || ((l > 0) &&
2625 			     !(flags & IPN_TCPUDP))) {
2626 				NBUMPSIDEX(1, ns_exhausted, ns_exhausted_2);
2627 				DT4(ns_exhausted_2, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2628 				return (-1);
2629 			}
2630 			/*
2631 			 * map-block - Calculate destination address.
2632 			 */
2633 			in.s_addr = ntohl(fin->fin_saddr);
2634 			in.s_addr &= ntohl(~np->in_osrcmsk);
2635 			inb.s_addr = in.s_addr;
2636 			in.s_addr /= np->in_ippip;
2637 			in.s_addr &= ntohl(~np->in_nsrcmsk);
2638 			in.s_addr += ntohl(np->in_nsrcaddr);
2639 			/*
2640 			 * Calculate destination port.
2641 			 */
2642 			if ((flags & IPN_TCPUDP) &&
2643 			    (np->in_ppip != 0)) {
2644 				port = ntohs(sport) + l;
2645 				port %= np->in_ppip;
2646 				port += np->in_ppip *
2647 					(inb.s_addr % np->in_ippip);
2648 				port += MAPBLK_MINPORT;
2649 				port = htons(port);
2650 			}
2651 
2652 		} else if ((np->in_nsrcaddr == 0) &&
2653 			   (np->in_nsrcmsk == 0xffffffff)) {
2654 			i6addr_t in6;
2655 
2656 			/*
2657 			 * 0/32 - use the interface's IP address.
2658 			 */
2659 			if ((l > 0) ||
2660 			    ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp,
2661 				       &in6, NULL) == -1) {
2662 				NBUMPSIDEX(1, ns_new_ifpaddr, ns_new_ifpaddr_1);
2663 				DT4(ns_new_ifpaddr_1, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2664 				return (-1);
2665 			}
2666 			in.s_addr = ntohl(in6.in4.s_addr);
2667 
2668 		} else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) {
2669 			/*
2670 			 * 0/0 - use the original source address/port.
2671 			 */
2672 			if (l > 0) {
2673 				NBUMPSIDEX(1, ns_exhausted, ns_exhausted_3);
2674 				DT4(ns_exhausted_3, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2675 				return (-1);
2676 			}
2677 			in.s_addr = ntohl(fin->fin_saddr);
2678 
2679 		} else if ((np->in_nsrcmsk != 0xffffffff) &&
2680 			   (np->in_spnext == 0) && ((l > 0) || (hm == NULL)))
2681 			np->in_snip++;
2682 
2683 		natl = NULL;
2684 
2685 		if ((flags & IPN_TCPUDP) &&
2686 		    ((np->in_redir & NAT_MAPBLK) == 0) &&
2687 		    (np->in_flags & IPN_AUTOPORTMAP)) {
2688 			/*
2689 			 * "ports auto" (without map-block)
2690 			 */
2691 			if ((l > 0) && (l % np->in_ppip == 0)) {
2692 				if ((l > np->in_ppip) &&
2693 				    np->in_nsrcmsk != 0xffffffff)
2694 					np->in_snip++;
2695 			}
2696 			if (np->in_ppip != 0) {
2697 				port = ntohs(sport);
2698 				port += (l % np->in_ppip);
2699 				port %= np->in_ppip;
2700 				port += np->in_ppip *
2701 					(ntohl(fin->fin_saddr) %
2702 					 np->in_ippip);
2703 				port += MAPBLK_MINPORT;
2704 				port = htons(port);
2705 			}
2706 
2707 		} else if (((np->in_redir & NAT_MAPBLK) == 0) &&
2708 			   (flags & IPN_TCPUDPICMP) && (np->in_spnext != 0)) {
2709 			/*
2710 			 * Standard port translation.  Select next port.
2711 			 */
2712 			if (np->in_flags & IPN_SEQUENTIAL) {
2713 				port = np->in_spnext;
2714 			} else {
2715 				port = ipf_random() % (np->in_spmax -
2716 						       np->in_spmin + 1);
2717 				port += np->in_spmin;
2718 			}
2719 			port = htons(port);
2720 			np->in_spnext++;
2721 
2722 			if (np->in_spnext > np->in_spmax) {
2723 				np->in_spnext = np->in_spmin;
2724 				if (np->in_nsrcmsk != 0xffffffff)
2725 					np->in_snip++;
2726 			}
2727 		}
2728 
2729 		if (np->in_flags & IPN_SIPRANGE) {
2730 			if (np->in_snip > ntohl(np->in_nsrcmsk))
2731 				np->in_snip = ntohl(np->in_nsrcaddr);
2732 		} else {
2733 			if ((np->in_nsrcmsk != 0xffffffff) &&
2734 			    ((np->in_snip + 1) & ntohl(np->in_nsrcmsk)) >
2735 			    ntohl(np->in_nsrcaddr))
2736 				np->in_snip = ntohl(np->in_nsrcaddr) + 1;
2737 		}
2738 
2739 		if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY)))
2740 			port = sport;
2741 
2742 		/*
2743 		 * Here we do a lookup of the connection as seen from
2744 		 * the outside.  If an IP# pair already exists, try
2745 		 * again.  So if you have A->B becomes C->B, you can
2746 		 * also have D->E become C->E but not D->B causing
2747 		 * another C->B.  Also take protocol and ports into
2748 		 * account when determining whether a pre-existing
2749 		 * NAT setup will cause an external conflict where
2750 		 * this is appropriate.
2751 		 */
2752 		inb.s_addr = htonl(in.s_addr);
2753 		sp = fin->fin_data[0];
2754 		dp = fin->fin_data[1];
2755 		fin->fin_data[0] = fin->fin_data[1];
2756 		fin->fin_data[1] = ntohs(port);
2757 		natl = ipf_nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
2758 					(u_int)fin->fin_p, fin->fin_dst, inb);
2759 		fin->fin_data[0] = sp;
2760 		fin->fin_data[1] = dp;
2761 
2762 		/*
2763 		 * Has the search wrapped around and come back to the
2764 		 * start ?
2765 		 */
2766 		if ((natl != NULL) &&
2767 		    (np->in_spnext != 0) && (st_port == np->in_spnext) &&
2768 		    (np->in_snip != 0) && (st_ip == np->in_snip)) {
2769 			NBUMPSIDED(1, ns_wrap);
2770 			DT4(ns_wrap, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2771 			return (-1);
2772 		}
2773 		l++;
2774 	} while (natl != NULL);
2775 
2776 	/* Setup the NAT table */
2777 	nat->nat_osrcip = fin->fin_src;
2778 	nat->nat_nsrcaddr = htonl(in.s_addr);
2779 	nat->nat_odstip = fin->fin_dst;
2780 	nat->nat_ndstip = fin->fin_dst;
2781 	if (nat->nat_hm == NULL)
2782 		nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2783 					      fin->fin_dst, nat->nat_nsrcip,
2784 					      0);
2785 
2786 	if (flags & IPN_TCPUDP) {
2787 		nat->nat_osport = sport;
2788 		nat->nat_nsport = port;	/* sport */
2789 		nat->nat_odport = dport;
2790 		nat->nat_ndport = dport;
2791 		((tcphdr_t *)fin->fin_dp)->th_sport = port;
2792 	} else if (flags & IPN_ICMPQUERY) {
2793 		nat->nat_oicmpid = fin->fin_data[1];
2794 		((icmphdr_t *)fin->fin_dp)->icmp_id = port;
2795 		nat->nat_nicmpid = port;
2796 	}
2797 	return (0);
2798 }
2799 
2800 
2801 /* ------------------------------------------------------------------------ */
2802 /* Function:    ipf_nat_newrdr                                              */
2803 /* Returns:     int - -1 == error, 0 == success (no move), 1 == success and */
2804 /*                    allow rule to be moved if IPN_ROUNDR is set.          */
2805 /* Parameters:  fin(I) - pointer to packet information                      */
2806 /*              nat(I) - pointer to NAT entry                               */
2807 /*              ni(I)  - pointer to structure with misc. information needed */
2808 /*                       to create new NAT entry.                           */
2809 /*                                                                          */
2810 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2811 /* to the new IP address for the translation.                               */
2812 /* ------------------------------------------------------------------------ */
2813 static int
ipf_nat_newrdr(fr_info_t * fin,nat_t * nat,natinfo_t * ni)2814 ipf_nat_newrdr(fr_info_t *fin, nat_t *nat, natinfo_t *ni)
2815 {
2816 	ipf_main_softc_t *softc = fin->fin_main_soft;
2817 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2818 	u_short nport, dport, sport;
2819 	struct in_addr in, inb;
2820 	u_short sp, dp;
2821 	hostmap_t *hm;
2822 	u_32_t flags;
2823 	ipnat_t *np;
2824 	nat_t *natl;
2825 	int move;
2826 
2827 	move = 1;
2828 	hm = NULL;
2829 	in.s_addr = 0;
2830 	np = ni->nai_np;
2831 	flags = nat->nat_flags;
2832 
2833 	if (flags & IPN_ICMPQUERY) {
2834 		dport = fin->fin_data[1];
2835 		sport = 0;
2836 	} else {
2837 		sport = htons(fin->fin_data[0]);
2838 		dport = htons(fin->fin_data[1]);
2839 	}
2840 
2841 	/* TRACE sport, dport */
2842 
2843 
2844 	/*
2845 	 * If the matching rule has IPN_STICKY set, then we want to have the
2846 	 * same rule kick in as before.  Why would this happen?  If you have
2847 	 * a collection of rdr rules with "round-robin sticky", the current
2848 	 * packet might match a different one to the previous connection but
2849 	 * we want the same destination to be used.
2850 	 */
2851 	if (((np->in_flags & (IPN_ROUNDR|IPN_SPLIT)) != 0) &&
2852 	    ((np->in_flags & IPN_STICKY) != 0)) {
2853 		hm = ipf_nat_hostmap(softn, NULL, fin->fin_src, fin->fin_dst,
2854 				     in, (u_32_t)dport);
2855 		if (hm != NULL) {
2856 			in.s_addr = ntohl(hm->hm_ndstip.s_addr);
2857 			np = hm->hm_ipnat;
2858 			ni->nai_np = np;
2859 			move = 0;
2860 			ipf_nat_hostmapdel(softc, &hm);
2861 		}
2862 	}
2863 
2864 	/*
2865 	 * Otherwise, it's an inbound packet. Most likely, we don't
2866 	 * want to rewrite source ports and source addresses. Instead,
2867 	 * we want to rewrite to a fixed internal address and fixed
2868 	 * internal port.
2869 	 */
2870 	if (np->in_flags & IPN_SPLIT) {
2871 		in.s_addr = np->in_dnip;
2872 		inb.s_addr = htonl(in.s_addr);
2873 
2874 		if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) {
2875 			hm = ipf_nat_hostmap(softn, NULL, fin->fin_src,
2876 					     fin->fin_dst, inb, (u_32_t)dport);
2877 			if (hm != NULL) {
2878 				in.s_addr = hm->hm_ndstip.s_addr;
2879 				move = 0;
2880 			}
2881 		}
2882 
2883 		if (hm == NULL || hm->hm_ref == 1) {
2884 			if (np->in_ndstaddr == htonl(in.s_addr)) {
2885 				np->in_dnip = ntohl(np->in_ndstmsk);
2886 				move = 0;
2887 			} else {
2888 				np->in_dnip = ntohl(np->in_ndstaddr);
2889 			}
2890 		}
2891 		if (hm != NULL)
2892 			ipf_nat_hostmapdel(softc, &hm);
2893 
2894 	} else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) {
2895 		i6addr_t in6;
2896 
2897 		/*
2898 		 * 0/32 - use the interface's IP address.
2899 		 */
2900 		if (ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp,
2901 			       &in6, NULL) == -1) {
2902 			NBUMPSIDEX(0, ns_new_ifpaddr, ns_new_ifpaddr_2);
2903 			DT3(ns_new_ifpaddr_2, fr_info_t *, fin, nat_t *, nat, natinfo_t, ni);
2904 			return (-1);
2905 		}
2906 		in.s_addr = ntohl(in6.in4.s_addr);
2907 
2908 	} else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk== 0)) {
2909 		/*
2910 		 * 0/0 - use the original destination address/port.
2911 		 */
2912 		in.s_addr = ntohl(fin->fin_daddr);
2913 
2914 	} else if (np->in_redir == NAT_BIMAP &&
2915 		   np->in_ndstmsk == np->in_odstmsk) {
2916 		/*
2917 		 * map the address block in a 1:1 fashion
2918 		 */
2919 		in.s_addr = np->in_ndstaddr;
2920 		in.s_addr |= fin->fin_daddr & ~np->in_ndstmsk;
2921 		in.s_addr = ntohl(in.s_addr);
2922 	} else {
2923 		in.s_addr = ntohl(np->in_ndstaddr);
2924 	}
2925 
2926 	if ((np->in_dpnext == 0) || ((flags & NAT_NOTRULEPORT) != 0))
2927 		nport = dport;
2928 	else {
2929 		/*
2930 		 * Whilst not optimized for the case where
2931 		 * pmin == pmax, the gain is not significant.
2932 		 */
2933 		if (((np->in_flags & IPN_FIXEDDPORT) == 0) &&
2934 		    (np->in_odport != np->in_dtop)) {
2935 			nport = ntohs(dport) - np->in_odport + np->in_dpmax;
2936 			nport = htons(nport);
2937 		} else {
2938 			nport = htons(np->in_dpnext);
2939 			np->in_dpnext++;
2940 			if (np->in_dpnext > np->in_dpmax)
2941 				np->in_dpnext = np->in_dpmin;
2942 		}
2943 	}
2944 
2945 	/*
2946 	 * When the redirect-to address is set to 0.0.0.0, just
2947 	 * assume a blank `forwarding' of the packet.  We don't
2948 	 * setup any translation for this either.
2949 	 */
2950 	if (in.s_addr == 0) {
2951 		if (nport == dport) {
2952 			NBUMPSIDED(0, ns_xlate_null);
2953 			return (-1);
2954 		}
2955 		in.s_addr = ntohl(fin->fin_daddr);
2956 	}
2957 
2958 	/*
2959 	 * Check to see if this redirect mapping already exists and if
2960 	* it does, return "failure" (allowing it to be created will just
2961 	 * cause one or both of these "connections" to stop working.)
2962 	 */
2963 	inb.s_addr = htonl(in.s_addr);
2964 	sp = fin->fin_data[0];
2965 	dp = fin->fin_data[1];
2966 	fin->fin_data[1] = fin->fin_data[0];
2967 	fin->fin_data[0] = ntohs(nport);
2968 	natl = ipf_nat_outlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
2969 			     (u_int)fin->fin_p, inb, fin->fin_src);
2970 	fin->fin_data[0] = sp;
2971 	fin->fin_data[1] = dp;
2972 	if (natl != NULL) {
2973 		DT2(ns_new_xlate_exists, fr_info_t *, fin, nat_t *, natl);
2974 		NBUMPSIDE(0, ns_xlate_exists);
2975 		return (-1);
2976 	}
2977 
2978 	inb.s_addr = htonl(in.s_addr);
2979 	nat->nat_ndstaddr = htonl(in.s_addr);
2980 	nat->nat_odstip = fin->fin_dst;
2981 	nat->nat_nsrcip = fin->fin_src;
2982 	nat->nat_osrcip = fin->fin_src;
2983 	if ((nat->nat_hm == NULL) && ((np->in_flags & IPN_STICKY) != 0))
2984 		nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2985 					      fin->fin_dst, inb, (u_32_t)dport);
2986 
2987 	if (flags & IPN_TCPUDP) {
2988 		nat->nat_odport = dport;
2989 		nat->nat_ndport = nport;
2990 		nat->nat_osport = sport;
2991 		nat->nat_nsport = sport;
2992 		((tcphdr_t *)fin->fin_dp)->th_dport = nport;
2993 	} else if (flags & IPN_ICMPQUERY) {
2994 		nat->nat_oicmpid = fin->fin_data[1];
2995 		((icmphdr_t *)fin->fin_dp)->icmp_id = nport;
2996 		nat->nat_nicmpid = nport;
2997 	}
2998 
2999 	return (move);
3000 }
3001 
3002 /* ------------------------------------------------------------------------ */
3003 /* Function:    ipf_nat_add                                                 */
3004 /* Returns:     nat_t* - NULL == failure to create new NAT structure,       */
3005 /*                       else pointer to new NAT structure                  */
3006 /* Parameters:  fin(I)       - pointer to packet information                */
3007 /*              np(I)        - pointer to NAT rule                          */
3008 /*              natsave(I)   - pointer to where to store NAT struct pointer */
3009 /*              flags(I)     - flags describing the current packet          */
3010 /*              direction(I) - direction of packet (in/out)                 */
3011 /* Write Lock:  ipf_nat                                                     */
3012 /*                                                                          */
3013 /* Attempts to create a new NAT entry.  Does not actually change the packet */
3014 /* in any way.                                                              */
3015 /*                                                                          */
3016 /* This function is in three main parts: (1) deal with creating a new NAT   */
3017 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with     */
3018 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */
3019 /* and (3) building that structure and putting it into the NAT table(s).    */
3020 /*                                                                          */
3021 /* NOTE: natsave should NOT be used to point back to an ipstate_t struct    */
3022 /*       as it can result in memory being corrupted.                        */
3023 /* ------------------------------------------------------------------------ */
3024 nat_t *
ipf_nat_add(fr_info_t * fin,ipnat_t * np,nat_t ** natsave,u_int flags,int direction)3025 ipf_nat_add(fr_info_t *fin, ipnat_t *np, nat_t **natsave, u_int flags,
3026 	int direction)
3027 {
3028 	ipf_main_softc_t *softc = fin->fin_main_soft;
3029 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3030 	hostmap_t *hm = NULL;
3031 	nat_t *nat, *natl;
3032 	natstat_t *nsp;
3033 	u_int nflags;
3034 	natinfo_t ni;
3035 	int move;
3036 
3037 	nsp = &softn->ipf_nat_stats;
3038 
3039 	if ((nsp->ns_active * 100 / softn->ipf_nat_table_max) >
3040 	    softn->ipf_nat_table_wm_high) {
3041 		softn->ipf_nat_doflush = 1;
3042 	}
3043 
3044 	if (nsp->ns_active >= softn->ipf_nat_table_max) {
3045 		NBUMPSIDED(fin->fin_out, ns_table_max);
3046 		DT2(ns_table_max, nat_stat_t *, nsp, ipf_nat_softc_t *, softn);
3047 		return (NULL);
3048 	}
3049 
3050 	move = 1;
3051 	nflags = np->in_flags & flags;
3052 	nflags &= NAT_FROMRULE;
3053 
3054 	ni.nai_np = np;
3055 	ni.nai_dport = 0;
3056 	ni.nai_sport = 0;
3057 
3058 	/* Give me a new nat */
3059 	KMALLOC(nat, nat_t *);
3060 	if (nat == NULL) {
3061 		DT(ns_memfail);
3062 		NBUMPSIDED(fin->fin_out, ns_memfail);
3063 		/*
3064 		 * Try to automatically tune the max # of entries in the
3065 		 * table allowed to be less than what will cause kmem_alloc()
3066 		 * to fail and try to eliminate panics due to out of memory
3067 		 * conditions arising.
3068 		 */
3069 		if ((softn->ipf_nat_table_max > softn->ipf_nat_table_sz) &&
3070 		    (nsp->ns_active > 100)) {
3071 			softn->ipf_nat_table_max = nsp->ns_active - 100;
3072 			printf("table_max reduced to %d\n",
3073 				softn->ipf_nat_table_max);
3074 		}
3075 		return (NULL);
3076 	}
3077 
3078 	if (flags & IPN_ICMPQUERY) {
3079 		/*
3080 		 * In the ICMP query NAT code, we translate the ICMP id fields
3081 		 * to make them unique. This is indepedent of the ICMP type
3082 		 * (e.g. in the unlikely event that a host sends an echo and
3083 		 * an tstamp request with the same id, both packets will have
3084 		 * their ip address/id field changed in the same way).
3085 		 */
3086 		/* The icmp_id field is used by the sender to identify the
3087 		 * process making the icmp request. (the receiver justs
3088 		 * copies it back in its response). So, it closely matches
3089 		 * the concept of source port. We overlay sport, so we can
3090 		 * maximally reuse the existing code.
3091 		 */
3092 		ni.nai_sport = fin->fin_data[1];
3093 		ni.nai_dport = 0;
3094 	}
3095 
3096 	bzero((char *)nat, sizeof(*nat));
3097 	nat->nat_flags = flags;
3098 	nat->nat_redir = np->in_redir;
3099 	nat->nat_dir = direction;
3100 	nat->nat_pr[0] = fin->fin_p;
3101 	nat->nat_pr[1] = fin->fin_p;
3102 
3103 	/*
3104 	 * Search the current table for a match and create a new mapping
3105 	 * if there is none found.
3106 	 */
3107 	if (np->in_redir & NAT_DIVERTUDP) {
3108 		move = ipf_nat_newdivert(fin, nat, &ni);
3109 
3110 	} else if (np->in_redir & NAT_REWRITE) {
3111 		move = ipf_nat_newrewrite(fin, nat, &ni);
3112 
3113 	} else if (direction == NAT_OUTBOUND) {
3114 		/*
3115 		 * We can now arrange to call this for the same connection
3116 		 * because ipf_nat_new doesn't protect the code path into
3117 		 * this function.
3118 		 */
3119 		natl = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p,
3120 				     fin->fin_src, fin->fin_dst);
3121 		if (natl != NULL) {
3122 			KFREE(nat);
3123 			nat = natl;
3124 			goto done;
3125 		}
3126 
3127 		move = ipf_nat_newmap(fin, nat, &ni);
3128 	} else {
3129 		/*
3130 		 * NAT_INBOUND is used for redirects rules
3131 		 */
3132 		natl = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p,
3133 					fin->fin_src, fin->fin_dst);
3134 		if (natl != NULL) {
3135 			KFREE(nat);
3136 			nat = natl;
3137 			goto done;
3138 		}
3139 
3140 		move = ipf_nat_newrdr(fin, nat, &ni);
3141 	}
3142 	if (move == -1)
3143 		goto badnat;
3144 
3145 	np = ni.nai_np;
3146 
3147 	nat->nat_mssclamp = np->in_mssclamp;
3148 	nat->nat_me = natsave;
3149 	nat->nat_fr = fin->fin_fr;
3150 	nat->nat_rev = fin->fin_rev;
3151 	nat->nat_ptr = np;
3152 	nat->nat_dlocal = np->in_dlocal;
3153 
3154 	if ((np->in_apr != NULL) && ((nat->nat_flags & NAT_SLAVE) == 0)) {
3155 		if (ipf_proxy_new(fin, nat) == -1) {
3156 			NBUMPSIDED(fin->fin_out, ns_appr_fail);
3157 			DT3(ns_appr_fail, fr_info_t *, fin, nat_t *, nat, ipnat_t *, np);
3158 			goto badnat;
3159 		}
3160 	}
3161 
3162 	nat->nat_ifps[0] = np->in_ifps[0];
3163 	if (np->in_ifps[0] != NULL) {
3164 		COPYIFNAME(np->in_v[0], np->in_ifps[0], nat->nat_ifnames[0]);
3165 	}
3166 
3167 	nat->nat_ifps[1] = np->in_ifps[1];
3168 	if (np->in_ifps[1] != NULL) {
3169 		COPYIFNAME(np->in_v[1], np->in_ifps[1], nat->nat_ifnames[1]);
3170 	}
3171 
3172 	if (ipf_nat_finalise(fin, nat) == -1) {
3173 		goto badnat;
3174 	}
3175 
3176 	np->in_use++;
3177 
3178 	if ((move == 1) && (np->in_flags & IPN_ROUNDR)) {
3179 		if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_REDIRECT) {
3180 			ipf_nat_delrdr(softn, np);
3181 			ipf_nat_addrdr(softn, np);
3182 		} else if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_MAP) {
3183 			ipf_nat_delmap(softn, np);
3184 			ipf_nat_addmap(softn, np);
3185 		}
3186 	}
3187 
3188 	if (flags & SI_WILDP)
3189 		nsp->ns_wilds++;
3190 	nsp->ns_proto[nat->nat_pr[0]]++;
3191 
3192 	goto done;
3193 badnat:
3194 	DT3(ns_badnatnew, fr_info_t *, fin, nat_t *, nat, ipnat_t *, np);
3195 	NBUMPSIDE(fin->fin_out, ns_badnatnew);
3196 	if ((hm = nat->nat_hm) != NULL)
3197 		ipf_nat_hostmapdel(softc, &hm);
3198 	KFREE(nat);
3199 	nat = NULL;
3200 done:
3201 	if (nat != NULL && np != NULL)
3202 		np->in_hits++;
3203 	if (natsave != NULL)
3204 		*natsave = nat;
3205 	return (nat);
3206 }
3207 
3208 
3209 /* ------------------------------------------------------------------------ */
3210 /* Function:    ipf_nat_finalise                                            */
3211 /* Returns:     int - 0 == sucess, -1 == failure                            */
3212 /* Parameters:  fin(I) - pointer to packet information                      */
3213 /*              nat(I) - pointer to NAT entry                               */
3214 /* Write Lock:  ipf_nat                                                     */
3215 /*                                                                          */
3216 /* This is the tail end of constructing a new NAT entry and is the same     */
3217 /* for both IPv4 and IPv6.                                                  */
3218 /* ------------------------------------------------------------------------ */
3219 /*ARGSUSED*/
3220 static int
ipf_nat_finalise(fr_info_t * fin,nat_t * nat)3221 ipf_nat_finalise(fr_info_t *fin, nat_t *nat)
3222 {
3223 	ipf_main_softc_t *softc = fin->fin_main_soft;
3224 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3225 	u_32_t sum1, sum2, sumd;
3226 	frentry_t *fr;
3227 #if SOLARIS && defined(_KERNEL) && defined(ICK_M_CTL_MAGIC)
3228 	qpktinfo_t *qpi = fin->fin_qpi;
3229 #endif
3230 
3231 	switch (nat->nat_pr[0])
3232 	{
3233 	case IPPROTO_ICMP :
3234 		sum1 = LONG_SUM(ntohs(nat->nat_oicmpid));
3235 		sum2 = LONG_SUM(ntohs(nat->nat_nicmpid));
3236 		CALC_SUMD(sum1, sum2, sumd);
3237 		nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
3238 
3239 		break;
3240 
3241 	default :
3242 		sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr) + \
3243 				ntohs(nat->nat_osport));
3244 		sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr) + \
3245 				ntohs(nat->nat_nsport));
3246 		CALC_SUMD(sum1, sum2, sumd);
3247 		nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
3248 
3249 		sum1 = LONG_SUM(ntohl(nat->nat_odstaddr) + \
3250 				ntohs(nat->nat_odport));
3251 		sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr) + \
3252 				ntohs(nat->nat_ndport));
3253 		CALC_SUMD(sum1, sum2, sumd);
3254 		nat->nat_sumd[0] += (sumd & 0xffff) + (sumd >> 16);
3255 		break;
3256 	}
3257 
3258 	/*
3259 	 * Compute the partial checksum, just in case.
3260 	 * This is only ever placed into outbound packets so care needs
3261 	 * to be taken over which pair of addresses are used.
3262 	 */
3263 	if (nat->nat_dir == NAT_OUTBOUND) {
3264 		sum1 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
3265 		sum1 += LONG_SUM(ntohl(nat->nat_ndstaddr));
3266 	} else {
3267 		sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr));
3268 		sum1 += LONG_SUM(ntohl(nat->nat_odstaddr));
3269 	}
3270 	sum1 += nat->nat_pr[1];
3271 	nat->nat_sumd[1] = (sum1 & 0xffff) + (sum1 >> 16);
3272 
3273 	sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr));
3274 	sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
3275 	CALC_SUMD(sum1, sum2, sumd);
3276 	nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
3277 
3278 	sum1 = LONG_SUM(ntohl(nat->nat_odstaddr));
3279 	sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr));
3280 	CALC_SUMD(sum1, sum2, sumd);
3281 	nat->nat_ipsumd += (sumd & 0xffff) + (sumd >> 16);
3282 
3283 	nat->nat_v[0] = 4;
3284 	nat->nat_v[1] = 4;
3285 
3286 	if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) {
3287 		nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
3288 	}
3289 
3290 	if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) {
3291 		nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
3292 	}
3293 
3294 	if ((nat->nat_flags & SI_CLONE) == 0)
3295 		nat->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, nat);
3296 
3297 	if (ipf_nat_insert(softc, softn, nat) == 0) {
3298 		if (softn->ipf_nat_logging)
3299 			ipf_nat_log(softc, softn, nat, NL_NEW);
3300 		fr = nat->nat_fr;
3301 		if (fr != NULL) {
3302 			MUTEX_ENTER(&fr->fr_lock);
3303 			fr->fr_ref++;
3304 			MUTEX_EXIT(&fr->fr_lock);
3305 		}
3306 		return (0);
3307 	}
3308 
3309 	NBUMPSIDED(fin->fin_out, ns_unfinalised);
3310 	DT2(ns_unfinalised, fr_info_t *, fin, nat_t *, nat);
3311 	/*
3312 	 * nat_insert failed, so cleanup time...
3313 	 */
3314 	if (nat->nat_sync != NULL)
3315 		ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync);
3316 	return (-1);
3317 }
3318 
3319 
3320 /* ------------------------------------------------------------------------ */
3321 /* Function:    ipf_nat_insert                                              */
3322 /* Returns:     int - 0 == sucess, -1 == failure                            */
3323 /* Parameters:  softc(I) - pointer to soft context main structure           */
3324 /*              softn(I) - pointer to NAT context structure                 */
3325 /*              nat(I) - pointer to NAT structure                           */
3326 /* Write Lock:  ipf_nat                                                     */
3327 /*                                                                          */
3328 /* Insert a NAT entry into the hash tables for searching and add it to the  */
3329 /* list of active NAT entries.  Adjust global counters when complete.       */
3330 /* ------------------------------------------------------------------------ */
3331 int
ipf_nat_insert(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,nat_t * nat)3332 ipf_nat_insert(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, nat_t *nat)
3333 {
3334 	u_int hv0, hv1;
3335 	u_int sp, dp;
3336 	ipnat_t *in;
3337 	int ret;
3338 
3339 	/*
3340 	* Try and return an error as early as possible, so calculate the hash
3341 	 * entry numbers first and then proceed.
3342 	 */
3343 	if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) {
3344 		if ((nat->nat_flags & IPN_TCPUDP) != 0) {
3345 			sp = nat->nat_osport;
3346 			dp = nat->nat_odport;
3347 		} else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
3348 			sp = 0;
3349 			dp = nat->nat_oicmpid;
3350 		} else {
3351 			sp = 0;
3352 			dp = 0;
3353 		}
3354 		hv0 = NAT_HASH_FN(nat->nat_osrcaddr, sp, 0xffffffff);
3355 		hv0 = NAT_HASH_FN(nat->nat_odstaddr, hv0 + dp, 0xffffffff);
3356 		/*
3357 		 * TRACE nat_osrcaddr, nat_osport, nat_odstaddr,
3358 		 * nat_odport, hv0
3359 		 */
3360 
3361 		if ((nat->nat_flags & IPN_TCPUDP) != 0) {
3362 			sp = nat->nat_nsport;
3363 			dp = nat->nat_ndport;
3364 		} else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
3365 			sp = 0;
3366 			dp = nat->nat_nicmpid;
3367 		} else {
3368 			sp = 0;
3369 			dp = 0;
3370 		}
3371 		hv1 = NAT_HASH_FN(nat->nat_nsrcaddr, sp, 0xffffffff);
3372 		hv1 = NAT_HASH_FN(nat->nat_ndstaddr, hv1 + dp, 0xffffffff);
3373 		/*
3374 		 * TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr,
3375 		 * nat_ndport, hv1
3376 		 */
3377 	} else {
3378 		hv0 = NAT_HASH_FN(nat->nat_osrcaddr, 0, 0xffffffff);
3379 		hv0 = NAT_HASH_FN(nat->nat_odstaddr, hv0, 0xffffffff);
3380 		/* TRACE nat_osrcaddr, nat_odstaddr, hv0 */
3381 
3382 		hv1 = NAT_HASH_FN(nat->nat_nsrcaddr, 0, 0xffffffff);
3383 		hv1 = NAT_HASH_FN(nat->nat_ndstaddr, hv1, 0xffffffff);
3384 		/* TRACE nat_nsrcaddr, nat_ndstaddr, hv1 */
3385 	}
3386 
3387 	nat->nat_hv[0] = hv0;
3388 	nat->nat_hv[1] = hv1;
3389 
3390 	MUTEX_INIT(&nat->nat_lock, "nat entry lock");
3391 
3392 	in = nat->nat_ptr;
3393 	nat->nat_ref = nat->nat_me ? 2 : 1;
3394 
3395 	nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0';
3396 	nat->nat_ifps[0] = ipf_resolvenic(softc, nat->nat_ifnames[0], 4);
3397 
3398 	if (nat->nat_ifnames[1][0] != '\0') {
3399 		nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
3400 		nat->nat_ifps[1] = ipf_resolvenic(softc,
3401 						  nat->nat_ifnames[1], 4);
3402 	} else if (in->in_ifnames[1] != -1) {
3403 		char *name;
3404 
3405 		name = in->in_names + in->in_ifnames[1];
3406 		if (name[1] != '\0' && name[0] != '-' && name[0] != '*') {
3407 			(void) strncpy(nat->nat_ifnames[1],
3408 				       nat->nat_ifnames[0], LIFNAMSIZ);
3409 			nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
3410 			nat->nat_ifps[1] = nat->nat_ifps[0];
3411 		}
3412 	}
3413 	if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) {
3414 		nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
3415 	}
3416 	if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) {
3417 		nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
3418 	}
3419 
3420 	ret = ipf_nat_hashtab_add(softc, softn, nat);
3421 	if (ret == -1)
3422 		MUTEX_DESTROY(&nat->nat_lock);
3423 	return (ret);
3424 }
3425 
3426 
3427 /* ------------------------------------------------------------------------ */
3428 /* Function:    ipf_nat_hashtab_add                                         */
3429 /* Returns:     int - 0 == sucess, -1 == failure                            */
3430 /* Parameters:  softc(I) - pointer to soft context main structure           */
3431 /*              softn(I) - pointer to NAT context structure                 */
3432 /*              nat(I) - pointer to NAT structure                           */
3433 /*                                                                          */
3434 /* Handle the insertion of a NAT entry into the table/list.                 */
3435 /* ------------------------------------------------------------------------ */
3436 int
ipf_nat_hashtab_add(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,nat_t * nat)3437 ipf_nat_hashtab_add(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
3438 	nat_t *nat)
3439 {
3440 	nat_t **natp;
3441 	u_int hv0;
3442 	u_int hv1;
3443 
3444 	if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) {
3445 		hv1 = nat->nat_hv[0] % softn->ipf_nat_table_sz;
3446 		hv0 = nat->nat_hv[1] % softn->ipf_nat_table_sz;
3447 	} else {
3448 		hv0 = nat->nat_hv[0] % softn->ipf_nat_table_sz;
3449 		hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz;
3450 	}
3451 
3452 	if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0] >=
3453 	    softn->ipf_nat_maxbucket) {
3454 		DT1(ns_bucket_max_0, int,
3455 		    softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0]);
3456 		NBUMPSIDE(0, ns_bucket_max);
3457 		return (-1);
3458 	}
3459 
3460 	if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1] >=
3461 	    softn->ipf_nat_maxbucket) {
3462 		DT1(ns_bucket_max_1, int,
3463 		    softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1]);
3464 		NBUMPSIDE(1, ns_bucket_max);
3465 		return (-1);
3466 	}
3467 
3468 	/*
3469 	 * The ordering of operations in the list and hash table insertion
3470 	 * is very important.  The last operation for each task should be
3471 	 * to update the top of the list, after all the "nexts" have been
3472 	 * done so that walking the list while it is being done does not
3473 	 * find strange pointers.
3474 	 *
3475 	 * Global list of NAT instances
3476 	 */
3477 	nat->nat_next = softn->ipf_nat_instances;
3478 	nat->nat_pnext = &softn->ipf_nat_instances;
3479 	if (softn->ipf_nat_instances)
3480 		softn->ipf_nat_instances->nat_pnext = &nat->nat_next;
3481 	softn->ipf_nat_instances = nat;
3482 
3483 	/*
3484 	 * Inbound hash table.
3485 	 */
3486 	natp = &softn->ipf_nat_table[0][hv0];
3487 	nat->nat_phnext[0] = natp;
3488 	nat->nat_hnext[0] = *natp;
3489 	if (*natp) {
3490 		(*natp)->nat_phnext[0] = &nat->nat_hnext[0];
3491 	} else {
3492 		NBUMPSIDE(0, ns_inuse);
3493 	}
3494 	*natp = nat;
3495 	NBUMPSIDE(0, ns_bucketlen[hv0]);
3496 
3497 	/*
3498 	 * Outbound hash table.
3499 	 */
3500 	natp = &softn->ipf_nat_table[1][hv1];
3501 	nat->nat_phnext[1] = natp;
3502 	nat->nat_hnext[1] = *natp;
3503 	if (*natp)
3504 		(*natp)->nat_phnext[1] = &nat->nat_hnext[1];
3505 	else {
3506 		NBUMPSIDE(1, ns_inuse);
3507 	}
3508 	*natp = nat;
3509 	NBUMPSIDE(1, ns_bucketlen[hv1]);
3510 
3511 	ipf_nat_setqueue(softc, softn, nat);
3512 
3513 	if (nat->nat_dir & NAT_OUTBOUND) {
3514 		NBUMPSIDE(1, ns_added);
3515 	} else {
3516 		NBUMPSIDE(0, ns_added);
3517 	}
3518 	softn->ipf_nat_stats.ns_active++;
3519 	return (0);
3520 }
3521 
3522 
3523 /* ------------------------------------------------------------------------ */
3524 /* Function:    ipf_nat_icmperrorlookup                                     */
3525 /* Returns:     nat_t* - point to matching NAT structure                    */
3526 /* Parameters:  fin(I) - pointer to packet information                      */
3527 /*              dir(I) - direction of packet (in/out)                       */
3528 /*                                                                          */
3529 /* Check if the ICMP error message is related to an existing TCP, UDP or    */
3530 /* ICMP query nat entry.  It is assumed that the packet is already of the   */
3531 /* the required length.                                                     */
3532 /* ------------------------------------------------------------------------ */
3533 nat_t *
ipf_nat_icmperrorlookup(fr_info_t * fin,int dir)3534 ipf_nat_icmperrorlookup(fr_info_t *fin, int dir)
3535 {
3536 	ipf_main_softc_t *softc = fin->fin_main_soft;
3537 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3538 	int flags = 0, minlen;
3539 	icmphdr_t *orgicmp;
3540 	nat_stat_side_t *nside;
3541 	tcphdr_t *tcp = NULL;
3542 	u_short data[2];
3543 	nat_t *nat;
3544 	ip_t *oip;
3545 	u_int p;
3546 
3547 	nside = &softn->ipf_nat_stats.ns_side[fin->fin_out];
3548 	/*
3549 	 * Does it at least have the return (basic) IP header ?
3550 	 * Only a basic IP header (no options) should be with an ICMP error
3551 	 * header.  Also, if it's not an error type, then return.
3552 	 */
3553 	if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR)) {
3554 		ATOMIC_INCL(nside->ns_icmp_basic);
3555 		return (NULL);
3556 	}
3557 
3558 	/*
3559 	 * Check packet size
3560 	 */
3561 	oip = (ip_t *)((char *)fin->fin_dp + 8);
3562 	minlen = IP_HL(oip) << 2;
3563 	if ((minlen < sizeof(ip_t)) ||
3564 	    (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)) {
3565 		ATOMIC_INCL(nside->ns_icmp_size);
3566 		return (NULL);
3567 	}
3568 
3569 	/*
3570 	 * Is the buffer big enough for all of it ?  It's the size of the IP
3571 	 * header claimed in the encapsulated part which is of concern.  It
3572 	 * may be too big to be in this buffer but not so big that it's
3573 	 * outside the ICMP packet, leading to TCP deref's causing problems.
3574 	 * This is possible because we don't know how big oip_hl is when we
3575 	 * do the pullup early in ipf_check() and thus can't gaurantee it is
3576 	 * all here now.
3577 	 */
3578 #ifdef  ipf_nat_KERNEL
3579 	{
3580 	mb_t *m;
3581 
3582 	m = fin->fin_m;
3583 # if SOLARIS
3584 	if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
3585 	    (char *)m->b_wptr) {
3586 		ATOMIC_INCL(nside->ns_icmp_mbuf);
3587 		return (NULL);
3588 	}
3589 # else
3590 	if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
3591 	    (char *)fin->fin_ip + M_LEN(m)) {
3592 		ATOMIC_INCL(nside->ns_icmp_mbuf);
3593 		return (NULL);
3594 	}
3595 # endif
3596 	}
3597 #endif
3598 
3599 	if (fin->fin_daddr != oip->ip_src.s_addr) {
3600 		ATOMIC_INCL(nside->ns_icmp_address);
3601 		return (NULL);
3602 	}
3603 
3604 	p = oip->ip_p;
3605 	if (p == IPPROTO_TCP)
3606 		flags = IPN_TCP;
3607 	else if (p == IPPROTO_UDP)
3608 		flags = IPN_UDP;
3609 	else if (p == IPPROTO_ICMP) {
3610 		orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
3611 
3612 		/* see if this is related to an ICMP query */
3613 		if (ipf_nat_icmpquerytype(orgicmp->icmp_type)) {
3614 			data[0] = fin->fin_data[0];
3615 			data[1] = fin->fin_data[1];
3616 			fin->fin_data[0] = 0;
3617 			fin->fin_data[1] = orgicmp->icmp_id;
3618 
3619 			flags = IPN_ICMPERR|IPN_ICMPQUERY;
3620 			/*
3621 			 * NOTE : dir refers to the direction of the original
3622 			 *        ip packet. By definition the icmp error
3623 			 *        message flows in the opposite direction.
3624 			 */
3625 			if (dir == NAT_INBOUND)
3626 				nat = ipf_nat_inlookup(fin, flags, p,
3627 						       oip->ip_dst,
3628 						       oip->ip_src);
3629 			else
3630 				nat = ipf_nat_outlookup(fin, flags, p,
3631 							oip->ip_dst,
3632 							oip->ip_src);
3633 			fin->fin_data[0] = data[0];
3634 			fin->fin_data[1] = data[1];
3635 			return (nat);
3636 		}
3637 	}
3638 
3639 	if (flags & IPN_TCPUDP) {
3640 		minlen += 8;		/* + 64bits of data to get ports */
3641 		/* TRACE (fin,minlen) */
3642 		if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen) {
3643 			ATOMIC_INCL(nside->ns_icmp_short);
3644 			return (NULL);
3645 		}
3646 
3647 		data[0] = fin->fin_data[0];
3648 		data[1] = fin->fin_data[1];
3649 		tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
3650 		fin->fin_data[0] = ntohs(tcp->th_dport);
3651 		fin->fin_data[1] = ntohs(tcp->th_sport);
3652 
3653 		if (dir == NAT_INBOUND) {
3654 			nat = ipf_nat_inlookup(fin, flags, p, oip->ip_dst,
3655 					       oip->ip_src);
3656 		} else {
3657 			nat = ipf_nat_outlookup(fin, flags, p, oip->ip_dst,
3658 					    oip->ip_src);
3659 		}
3660 		fin->fin_data[0] = data[0];
3661 		fin->fin_data[1] = data[1];
3662 		return (nat);
3663 	}
3664 	if (dir == NAT_INBOUND)
3665 		nat = ipf_nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3666 	else
3667 		nat = ipf_nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3668 
3669 	return (nat);
3670 }
3671 
3672 
3673 /* ------------------------------------------------------------------------ */
3674 /* Function:    ipf_nat_icmperror                                           */
3675 /* Returns:     nat_t* - point to matching NAT structure                    */
3676 /* Parameters:  fin(I)    - pointer to packet information                   */
3677 /*              nflags(I) - NAT flags for this packet                       */
3678 /*              dir(I)    - direction of packet (in/out)                    */
3679 /*                                                                          */
3680 /* Fix up an ICMP packet which is an error message for an existing NAT      */
3681 /* session.  This will correct both packet header data and checksums.       */
3682 /*                                                                          */
3683 /* This should *ONLY* be used for incoming ICMP error packets to make sure  */
3684 /* a NAT'd ICMP packet gets correctly recognised.                           */
3685 /* ------------------------------------------------------------------------ */
3686 nat_t *
ipf_nat_icmperror(fr_info_t * fin,u_int * nflags,int dir)3687 ipf_nat_icmperror(fr_info_t *fin, u_int *nflags, int dir)
3688 {
3689 	ipf_main_softc_t *softc = fin->fin_main_soft;
3690 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3691 	u_32_t sum1, sum2, sumd, sumd2;
3692 	struct in_addr a1, a2, a3, a4;
3693 	int flags, dlen, odst;
3694 	icmphdr_t *icmp;
3695 	u_short *csump;
3696 	tcphdr_t *tcp;
3697 	nat_t *nat;
3698 	ip_t *oip;
3699 	void *dp;
3700 
3701 	if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
3702 		NBUMPSIDED(fin->fin_out, ns_icmp_short);
3703 		return (NULL);
3704 	}
3705 
3706 	/*
3707 	* ipf_nat_icmperrorlookup() will return NULL for `defective' packets.
3708 	 */
3709 	if ((fin->fin_v != 4) || !(nat = ipf_nat_icmperrorlookup(fin, dir))) {
3710 		NBUMPSIDED(fin->fin_out, ns_icmp_notfound);
3711 		return (NULL);
3712 	}
3713 
3714 	tcp = NULL;
3715 	csump = NULL;
3716 	flags = 0;
3717 	sumd2 = 0;
3718 	*nflags = IPN_ICMPERR;
3719 	icmp = fin->fin_dp;
3720 	oip = (ip_t *)&icmp->icmp_ip;
3721 	dp = (((char *)oip) + (IP_HL(oip) << 2));
3722 	if (oip->ip_p == IPPROTO_TCP) {
3723 		tcp = (tcphdr_t *)dp;
3724 		csump = (u_short *)&tcp->th_sum;
3725 		flags = IPN_TCP;
3726 	} else if (oip->ip_p == IPPROTO_UDP) {
3727 		udphdr_t *udp;
3728 
3729 		udp = (udphdr_t *)dp;
3730 		tcp = (tcphdr_t *)dp;
3731 		csump = (u_short *)&udp->uh_sum;
3732 		flags = IPN_UDP;
3733 	} else if (oip->ip_p == IPPROTO_ICMP)
3734 		flags = IPN_ICMPQUERY;
3735 	dlen = fin->fin_plen - ((char *)dp - (char *)fin->fin_ip);
3736 
3737 	/*
3738 	 * Need to adjust ICMP header to include the real IP#'s and
3739 	 * port #'s.  Only apply a checksum change relative to the
3740 	 * IP address change as it will be modified again in ipf_nat_checkout
3741 	 * for both address and port.  Two checksum changes are
3742 	 * necessary for the two header address changes.  Be careful
3743 	 * to only modify the checksum once for the port # and twice
3744 	 * for the IP#.
3745 	 */
3746 
3747 	/*
3748 	 * Step 1
3749 	 * Fix the IP addresses in the offending IP packet. You also need
3750 	 * to adjust the IP header checksum of that offending IP packet.
3751 	 *
3752 	 * Normally, you would expect that the ICMP checksum of the
3753 	 * ICMP error message needs to be adjusted as well for the
3754 	 * IP address change in oip.
3755 	 * However, this is a NOP, because the ICMP checksum is
3756 	 * calculated over the complete ICMP packet, which includes the
3757 	 * changed oip IP addresses and oip->ip_sum. However, these
3758 	 * two changes cancel each other out (if the delta for
3759 	 * the IP address is x, then the delta for ip_sum is minus x),
3760 	 * so no change in the icmp_cksum is necessary.
3761 	 *
3762 	 * Inbound ICMP
3763 	 * ------------
3764 	 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b
3765 	 * - response to outgoing packet (a,b)=>(c,b) (OIP_SRC=c,OIP_DST=b)
3766 	 * - OIP_SRC(c)=nat_newsrcip,          OIP_DST(b)=nat_newdstip
3767 	 *=> OIP_SRC(c)=nat_oldsrcip,          OIP_DST(b)=nat_olddstip
3768 	 *
3769 	 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c
3770 	 * - response to outgoing packet (c,a)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3771 	 * - OIP_SRC(b)=nat_olddstip,          OIP_DST(a)=nat_oldsrcip
3772 	 *=> OIP_SRC(b)=nat_newdstip,          OIP_DST(a)=nat_newsrcip
3773 	 *
3774 	 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d
3775 	 * - response to outgoing packet (a,b)=>(c,d) (OIP_SRC=c,OIP_DST=d)
3776 	 * - OIP_SRC(c)=nat_newsrcip,          OIP_DST(d)=nat_newdstip
3777 	 *=> OIP_SRC(c)=nat_oldsrcip,          OIP_DST(d)=nat_olddstip
3778 	 *
3779 	 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d
3780 	 * - response to outgoing packet (d,c)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3781 	 * - OIP_SRC(b)=nat_olddstip,          OIP_DST(a)=nat_oldsrcip
3782 	 *=> OIP_SRC(b)=nat_newdstip,          OIP_DST(a)=nat_newsrcip
3783 	 *
3784 	 * Outbound ICMP
3785 	 * -------------
3786 	 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b
3787 	 * - response to incoming packet (b,c)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3788 	 * - OIP_SRC(b)=nat_olddstip,          OIP_DST(a)=nat_oldsrcip
3789 	 *=> OIP_SRC(b)=nat_newdstip,          OIP_DST(a)=nat_newsrcip
3790 	 *
3791 	 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c
3792 	 * - response to incoming packet (a,b)=>(a,c) (OIP_SRC=a,OIP_DST=c)
3793 	 * - OIP_SRC(a)=nat_newsrcip,          OIP_DST(c)=nat_newdstip
3794 	 *=> OIP_SRC(a)=nat_oldsrcip,          OIP_DST(c)=nat_olddstip
3795 	 *
3796 	 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d
3797 	 * - response to incoming packet (d,c)=>(b,a) (OIP_SRC=c,OIP_DST=d)
3798 	 * - OIP_SRC(c)=nat_olddstip,          OIP_DST(d)=nat_oldsrcip
3799 	 *=> OIP_SRC(b)=nat_newdstip,          OIP_DST(a)=nat_newsrcip
3800 	 *
3801 	 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d
3802 	 * - response to incoming packet (a,b)=>(c,d) (OIP_SRC=b,OIP_DST=a)
3803 	 * - OIP_SRC(b)=nat_newsrcip,          OIP_DST(a)=nat_newdstip
3804 	 *=> OIP_SRC(a)=nat_oldsrcip,          OIP_DST(c)=nat_olddstip
3805 	 */
3806 
3807 	if (((fin->fin_out == 0) && ((nat->nat_redir & NAT_MAP) != 0)) ||
3808 	    ((fin->fin_out == 1) && ((nat->nat_redir & NAT_REDIRECT) != 0))) {
3809 		a1.s_addr = ntohl(nat->nat_osrcaddr);
3810 		a4.s_addr = ntohl(oip->ip_src.s_addr);
3811 		a3.s_addr = ntohl(nat->nat_odstaddr);
3812 		a2.s_addr = ntohl(oip->ip_dst.s_addr);
3813 		oip->ip_src.s_addr = htonl(a1.s_addr);
3814 		oip->ip_dst.s_addr = htonl(a3.s_addr);
3815 		odst = 1;
3816 	} else {
3817 		a1.s_addr = ntohl(nat->nat_ndstaddr);
3818 		a2.s_addr = ntohl(oip->ip_dst.s_addr);
3819 		a3.s_addr = ntohl(nat->nat_nsrcaddr);
3820 		a4.s_addr = ntohl(oip->ip_src.s_addr);
3821 		oip->ip_dst.s_addr = htonl(a3.s_addr);
3822 		oip->ip_src.s_addr = htonl(a1.s_addr);
3823 		odst = 0;
3824 	}
3825 	sum1 = 0;
3826 	sum2 = 0;
3827 	sumd = 0;
3828 	CALC_SUMD(a2.s_addr, a3.s_addr, sum1);
3829 	CALC_SUMD(a4.s_addr, a1.s_addr, sum2);
3830 	sumd = sum2 + sum1;
3831 	if (sumd != 0)
3832 		ipf_fix_datacksum(&oip->ip_sum, sumd);
3833 
3834 	sumd2 = sumd;
3835 	sum1 = 0;
3836 	sum2 = 0;
3837 
3838 	/*
3839 	 * Fix UDP pseudo header checksum to compensate for the
3840 	 * IP address change.
3841 	 */
3842 	if (((flags & IPN_TCPUDP) != 0) && (dlen >= 4)) {
3843 		u_32_t sum3, sum4, sumt;
3844 
3845 		/*
3846 		 * Step 2 :
3847 		 * For offending TCP/UDP IP packets, translate the ports as
3848 		 * well, based on the NAT specification. Of course such
3849 		 * a change may be reflected in the ICMP checksum as well.
3850 		 *
3851 		 * Since the port fields are part of the TCP/UDP checksum
3852 		 * of the offending IP packet, you need to adjust that checksum
3853 		 * as well... except that the change in the port numbers should
3854 		 * be offset by the checksum change.  However, the TCP/UDP
3855 		 * checksum will also need to change if there has been an
3856 		 * IP address change.
3857 		 */
3858 		if (odst == 1) {
3859 			sum1 = ntohs(nat->nat_osport);
3860 			sum4 = ntohs(tcp->th_sport);
3861 			sum3 = ntohs(nat->nat_odport);
3862 			sum2 = ntohs(tcp->th_dport);
3863 
3864 			tcp->th_sport = htons(sum1);
3865 			tcp->th_dport = htons(sum3);
3866 		} else {
3867 			sum1 = ntohs(nat->nat_ndport);
3868 			sum2 = ntohs(tcp->th_dport);
3869 			sum3 = ntohs(nat->nat_nsport);
3870 			sum4 = ntohs(tcp->th_sport);
3871 
3872 			tcp->th_dport = htons(sum3);
3873 			tcp->th_sport = htons(sum1);
3874 		}
3875 		CALC_SUMD(sum4, sum1, sumt);
3876 		sumd += sumt;
3877 		CALC_SUMD(sum2, sum3, sumt);
3878 		sumd += sumt;
3879 
3880 		if (sumd != 0 || sumd2 != 0) {
3881 			/*
3882 			 * At this point, sumd is the delta to apply to the
3883 			 * TCP/UDP header, given the changes in both the IP
3884 			 * address and the ports and sumd2 is the delta to
3885 			 * apply to the ICMP header, given the IP address
3886 			 * change delta that may need to be applied to the
3887 			 * TCP/UDP checksum instead.
3888 			 *
3889 			 * If we will both the IP and TCP/UDP checksums
3890 			 * then the ICMP checksum changes by the address
3891 			 * delta applied to the TCP/UDP checksum.  If we
3892 			 * do not change the TCP/UDP checksum them we
3893 			 * apply the delta in ports to the ICMP checksum.
3894 			 */
3895 			if (oip->ip_p == IPPROTO_UDP) {
3896 				if ((dlen >= 8) && (*csump != 0)) {
3897 					ipf_fix_datacksum(csump, sumd);
3898 				} else {
3899 					CALC_SUMD(sum1, sum4, sumd2);
3900 					CALC_SUMD(sum3, sum2, sumt);
3901 					sumd2 += sumt;
3902 				}
3903 			} else if (oip->ip_p == IPPROTO_TCP) {
3904 				if (dlen >= 18) {
3905 					ipf_fix_datacksum(csump, sumd);
3906 				} else {
3907 					CALC_SUMD(sum1, sum4, sumd2);
3908 					CALC_SUMD(sum3, sum2, sumt);
3909 					sumd2 += sumt;
3910 				}
3911 			}
3912 			if (sumd2 != 0) {
3913 				sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3914 				sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3915 				sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3916 				ipf_fix_incksum(0, &icmp->icmp_cksum, sumd2, 0);
3917 			}
3918 		}
3919 	} else if (((flags & IPN_ICMPQUERY) != 0) && (dlen >= 8)) {
3920 		icmphdr_t *orgicmp;
3921 
3922 		/*
3923 		 * XXX - what if this is bogus hl and we go off the end ?
3924 		 * In this case, ipf_nat_icmperrorlookup() will have
3925 		 * returned NULL.
3926 		 */
3927 		orgicmp = (icmphdr_t *)dp;
3928 
3929 		if (odst == 1) {
3930 			if (orgicmp->icmp_id != nat->nat_osport) {
3931 
3932 				/*
3933 				 * Fix ICMP checksum (of the offening ICMP
3934 				 * query packet) to compensate the change
3935 				 * in the ICMP id of the offending ICMP
3936 				 * packet.
3937 				 *
3938 				 * Since you modify orgicmp->icmp_id with
3939 				 * a delta (say x) and you compensate that
3940 				 * in origicmp->icmp_cksum with a delta
3941 				 * minus x, you don't have to adjust the
3942 				 * overall icmp->icmp_cksum
3943 				 */
3944 				sum1 = ntohs(orgicmp->icmp_id);
3945 				sum2 = ntohs(nat->nat_oicmpid);
3946 				CALC_SUMD(sum1, sum2, sumd);
3947 				orgicmp->icmp_id = nat->nat_oicmpid;
3948 				ipf_fix_datacksum(&orgicmp->icmp_cksum, sumd);
3949 			}
3950 		} /* nat_dir == NAT_INBOUND is impossible for icmp queries */
3951 	}
3952 	return (nat);
3953 }
3954 
3955 
3956 /*
3957  *       MAP-IN    MAP-OUT   RDR-IN   RDR-OUT
3958  * osrc    X       == src    == src      X
3959  * odst    X       == dst    == dst      X
3960  * nsrc  == dst      X         X      == dst
3961  * ndst  == src      X         X      == src
3962  * MAP = NAT_OUTBOUND, RDR = NAT_INBOUND
3963  */
3964 /*
3965  * NB: these lookups don't lock access to the list, it assumed that it has
3966  * already been done!
3967  */
3968 /* ------------------------------------------------------------------------ */
3969 /* Function:    ipf_nat_inlookup                                            */
3970 /* Returns:     nat_t* - NULL == no match,                                  */
3971 /*                       else pointer to matching NAT entry                 */
3972 /* Parameters:  fin(I)    - pointer to packet information                   */
3973 /*              flags(I)  - NAT flags for this packet                       */
3974 /*              p(I)      - protocol for this packet                        */
3975 /*              src(I)    - source IP address                               */
3976 /*              mapdst(I) - destination IP address                          */
3977 /*                                                                          */
3978 /* Lookup a nat entry based on the mapped destination ip address/port and   */
3979 /* real source address/port.  We use this lookup when receiving a packet,   */
3980 /* we're looking for a table entry, based on the destination address.       */
3981 /*                                                                          */
3982 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.         */
3983 /*                                                                          */
3984 /* NOTE: IT IS ASSUMED THAT  IS ONLY HELD WITH A READ LOCK WHEN             */
3985 /*       THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags.             */
3986 /*                                                                          */
3987 /* flags   -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if   */
3988 /*            the packet is of said protocol                                */
3989 /* ------------------------------------------------------------------------ */
3990 nat_t *
ipf_nat_inlookup(fr_info_t * fin,u_int flags,u_int p,struct in_addr src,struct in_addr mapdst)3991 ipf_nat_inlookup(fr_info_t *fin, u_int flags, u_int p,
3992 	struct in_addr src , struct in_addr mapdst)
3993 {
3994 	ipf_main_softc_t *softc = fin->fin_main_soft;
3995 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3996 	u_short sport, dport;
3997 	ipnat_t *ipn;
3998 	nat_t *nat;
3999 	int nflags;
4000 	u_32_t dst;
4001 	void *ifp;
4002 	u_int hv, rhv;
4003 
4004 	ifp = fin->fin_ifp;
4005 	dst = mapdst.s_addr;
4006 
4007 	switch (p)
4008 	{
4009 	case IPPROTO_TCP :
4010 	case IPPROTO_UDP :
4011 		sport = htons(fin->fin_data[0]);
4012 		dport = htons(fin->fin_data[1]);
4013 		break;
4014 	case IPPROTO_ICMP :
4015 		sport = 0;
4016 		dport = fin->fin_data[1];
4017 		break;
4018 	default :
4019 		sport = 0;
4020 		dport = 0;
4021 		break;
4022 	}
4023 
4024 
4025 	if ((flags & SI_WILDP) != 0)
4026 		goto find_in_wild_ports;
4027 
4028 	rhv = NAT_HASH_FN(dst, dport, 0xffffffff);
4029 	rhv = NAT_HASH_FN(src.s_addr, rhv + sport, 0xffffffff);
4030 	hv = rhv % softn->ipf_nat_table_sz;
4031 	nat = softn->ipf_nat_table[1][hv];
4032 	/* TRACE dst, dport, src, sport, hv, nat */
4033 
4034 	for (; nat; nat = nat->nat_hnext[1]) {
4035 		if (nat->nat_ifps[0] != NULL) {
4036 			if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
4037 				continue;
4038 		}
4039 
4040 		if (nat->nat_pr[0] != p)
4041 			continue;
4042 
4043 		switch (nat->nat_dir)
4044 		{
4045 		case NAT_INBOUND :
4046 		case NAT_DIVERTIN :
4047 			if (nat->nat_v[0] != 4)
4048 				continue;
4049 			if (nat->nat_osrcaddr != src.s_addr ||
4050 			    nat->nat_odstaddr != dst)
4051 				continue;
4052 			if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4053 				if (nat->nat_osport != sport)
4054 					continue;
4055 				if (nat->nat_odport != dport)
4056 					continue;
4057 
4058 			} else if (p == IPPROTO_ICMP) {
4059 				if (nat->nat_osport != dport) {
4060 					continue;
4061 				}
4062 			}
4063 			break;
4064 		case NAT_DIVERTOUT :
4065 			if (nat->nat_dlocal)
4066 				continue;
4067 		case NAT_OUTBOUND :
4068 			if (nat->nat_v[1] != 4)
4069 				continue;
4070 			if (nat->nat_dlocal)
4071 				continue;
4072 			if (nat->nat_dlocal)
4073 				continue;
4074 			if (nat->nat_ndstaddr != src.s_addr ||
4075 			    nat->nat_nsrcaddr != dst)
4076 				continue;
4077 			if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4078 				if (nat->nat_ndport != sport)
4079 					continue;
4080 				if (nat->nat_nsport != dport)
4081 					continue;
4082 
4083 			} else if (p == IPPROTO_ICMP) {
4084 				if (nat->nat_osport != dport) {
4085 					continue;
4086 				}
4087 			}
4088 			break;
4089 		}
4090 
4091 
4092 		if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4093 			ipn = nat->nat_ptr;
4094 			if ((ipn != NULL) && (nat->nat_aps != NULL))
4095 				if (ipf_proxy_match(fin, nat) != 0)
4096 					continue;
4097 		}
4098 		if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) {
4099 			nat->nat_ifps[0] = ifp;
4100 			nat->nat_mtu[0] = GETIFMTU_4(ifp);
4101 		}
4102 		return (nat);
4103 	}
4104 
4105 	/*
4106 	 * So if we didn't find it but there are wildcard members in the hash
4107 	 * table, go back and look for them.  We do this search and update here
4108 	 * because it is modifying the NAT table and we want to do this only
4109 	 * for the first packet that matches.  The exception, of course, is
4110 	 * for "dummy" (FI_IGNORE) lookups.
4111 	 */
4112 find_in_wild_ports:
4113 	if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) {
4114 		NBUMPSIDEX(0, ns_lookup_miss, ns_lookup_miss_0);
4115 		return (NULL);
4116 	}
4117 	if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) {
4118 		NBUMPSIDEX(0, ns_lookup_nowild, ns_lookup_nowild_0);
4119 		return (NULL);
4120 	}
4121 
4122 	RWLOCK_EXIT(&softc->ipf_nat);
4123 
4124 	hv = NAT_HASH_FN(dst, 0, 0xffffffff);
4125 	hv = NAT_HASH_FN(src.s_addr, hv, softn->ipf_nat_table_sz);
4126 	WRITE_ENTER(&softc->ipf_nat);
4127 
4128 	nat = softn->ipf_nat_table[1][hv];
4129 	/* TRACE dst, src, hv, nat */
4130 	for (; nat; nat = nat->nat_hnext[1]) {
4131 		if (nat->nat_ifps[0] != NULL) {
4132 			if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
4133 				continue;
4134 		}
4135 
4136 		if (nat->nat_pr[0] != fin->fin_p)
4137 			continue;
4138 
4139 		switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND))
4140 		{
4141 		case NAT_INBOUND :
4142 			if (nat->nat_v[0] != 4)
4143 				continue;
4144 			if (nat->nat_osrcaddr != src.s_addr ||
4145 			    nat->nat_odstaddr != dst)
4146 				continue;
4147 			break;
4148 		case NAT_OUTBOUND :
4149 			if (nat->nat_v[1] != 4)
4150 				continue;
4151 			if (nat->nat_ndstaddr != src.s_addr ||
4152 			    nat->nat_nsrcaddr != dst)
4153 				continue;
4154 			break;
4155 		}
4156 
4157 		nflags = nat->nat_flags;
4158 		if (!(nflags & (NAT_TCPUDP|SI_WILDP)))
4159 			continue;
4160 
4161 		if (ipf_nat_wildok(nat, (int)sport, (int)dport, nflags,
4162 				   NAT_INBOUND) == 1) {
4163 			if ((fin->fin_flx & FI_IGNORE) != 0)
4164 				break;
4165 			if ((nflags & SI_CLONE) != 0) {
4166 				nat = ipf_nat_clone(fin, nat);
4167 				if (nat == NULL)
4168 					break;
4169 			} else {
4170 				MUTEX_ENTER(&softn->ipf_nat_new);
4171 				softn->ipf_nat_stats.ns_wilds--;
4172 				MUTEX_EXIT(&softn->ipf_nat_new);
4173 			}
4174 
4175 			if (nat->nat_dir == NAT_INBOUND) {
4176 				if (nat->nat_osport == 0) {
4177 					nat->nat_osport = sport;
4178 					nat->nat_nsport = sport;
4179 				}
4180 				if (nat->nat_odport == 0) {
4181 					nat->nat_odport = dport;
4182 					nat->nat_ndport = dport;
4183 				}
4184 			} else if (nat->nat_dir == NAT_OUTBOUND) {
4185 				if (nat->nat_osport == 0) {
4186 					nat->nat_osport = dport;
4187 					nat->nat_nsport = dport;
4188 				}
4189 				if (nat->nat_odport == 0) {
4190 					nat->nat_odport = sport;
4191 					nat->nat_ndport = sport;
4192 				}
4193 			}
4194 			if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) {
4195 				nat->nat_ifps[0] = ifp;
4196 				nat->nat_mtu[0] = GETIFMTU_4(ifp);
4197 			}
4198 			nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
4199 			ipf_nat_tabmove(softn, nat);
4200 			break;
4201 		}
4202 	}
4203 
4204 	MUTEX_DOWNGRADE(&softc->ipf_nat);
4205 
4206 	if (nat == NULL) {
4207 		NBUMPSIDE(0, ns_lookup_miss);
4208 	}
4209 	return (nat);
4210 }
4211 
4212 
4213 /* ------------------------------------------------------------------------ */
4214 /* Function:    ipf_nat_tabmove                                             */
4215 /* Returns:     Nil                                                         */
4216 /* Parameters:  softn(I) - pointer to NAT context structure                 */
4217 /*              nat(I)   - pointer to NAT structure                         */
4218 /* Write Lock:  ipf_nat                                                     */
4219 /*                                                                          */
4220 /* This function is only called for TCP/UDP NAT table entries where the     */
4221 /* original was placed in the table without hashing on the ports and we now */
4222 /* want to include hashing on port numbers.                                 */
4223 /* ------------------------------------------------------------------------ */
4224 static void
ipf_nat_tabmove(ipf_nat_softc_t * softn,nat_t * nat)4225 ipf_nat_tabmove(ipf_nat_softc_t *softn, nat_t *nat)
4226 {
4227 	u_int hv0, hv1, rhv0, rhv1;
4228 	natstat_t *nsp;
4229 	nat_t **natp;
4230 
4231 	if (nat->nat_flags & SI_CLONE)
4232 		return;
4233 
4234 	nsp = &softn->ipf_nat_stats;
4235 	/*
4236 	 * Remove the NAT entry from the old location
4237 	 */
4238 	if (nat->nat_hnext[0])
4239 		nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
4240 	*nat->nat_phnext[0] = nat->nat_hnext[0];
4241 	nsp->ns_side[0].ns_bucketlen[nat->nat_hv[0] %
4242 				     softn->ipf_nat_table_sz]--;
4243 
4244 	if (nat->nat_hnext[1])
4245 		nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
4246 	*nat->nat_phnext[1] = nat->nat_hnext[1];
4247 	nsp->ns_side[1].ns_bucketlen[nat->nat_hv[1] %
4248 				     softn->ipf_nat_table_sz]--;
4249 
4250 	/*
4251 	 * Add into the NAT table in the new position
4252 	 */
4253 	rhv0 = NAT_HASH_FN(nat->nat_osrcaddr, nat->nat_osport, 0xffffffff);
4254 	rhv0 = NAT_HASH_FN(nat->nat_odstaddr, rhv0 + nat->nat_odport,
4255 			   0xffffffff);
4256 	rhv1 = NAT_HASH_FN(nat->nat_nsrcaddr, nat->nat_nsport, 0xffffffff);
4257 	rhv1 = NAT_HASH_FN(nat->nat_ndstaddr, rhv1 + nat->nat_ndport,
4258 			   0xffffffff);
4259 
4260 	hv0 = rhv0 % softn->ipf_nat_table_sz;
4261 	hv1 = rhv1 % softn->ipf_nat_table_sz;
4262 
4263 	if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) {
4264 		u_int swap;
4265 
4266 		swap = hv0;
4267 		hv0 = hv1;
4268 		hv1 = swap;
4269 	}
4270 
4271 	/* TRACE nat_osrcaddr, nat_osport, nat_odstaddr, nat_odport, hv0 */
4272 	/* TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr, nat_ndport, hv1 */
4273 
4274 	nat->nat_hv[0] = rhv0;
4275 	natp = &softn->ipf_nat_table[0][hv0];
4276 	if (*natp)
4277 		(*natp)->nat_phnext[0] = &nat->nat_hnext[0];
4278 	nat->nat_phnext[0] = natp;
4279 	nat->nat_hnext[0] = *natp;
4280 	*natp = nat;
4281 	nsp->ns_side[0].ns_bucketlen[hv0]++;
4282 
4283 	nat->nat_hv[1] = rhv1;
4284 	natp = &softn->ipf_nat_table[1][hv1];
4285 	if (*natp)
4286 		(*natp)->nat_phnext[1] = &nat->nat_hnext[1];
4287 	nat->nat_phnext[1] = natp;
4288 	nat->nat_hnext[1] = *natp;
4289 	*natp = nat;
4290 	nsp->ns_side[1].ns_bucketlen[hv1]++;
4291 }
4292 
4293 
4294 /* ------------------------------------------------------------------------ */
4295 /* Function:    ipf_nat_outlookup                                           */
4296 /* Returns:     nat_t* - NULL == no match,                                  */
4297 /*                       else pointer to matching NAT entry                 */
4298 /* Parameters:  fin(I)   - pointer to packet information                    */
4299 /*              flags(I) - NAT flags for this packet                        */
4300 /*              p(I)     - protocol for this packet                         */
4301 /*              src(I)   - source IP address                                */
4302 /*              dst(I)   - destination IP address                           */
4303 /*              rw(I)    - 1 == write lock on  held, 0 == read lock.        */
4304 /*                                                                          */
4305 /* Lookup a nat entry based on the source 'real' ip address/port and        */
4306 /* destination address/port.  We use this lookup when sending a packet out, */
4307 /* we're looking for a table entry, based on the source address.            */
4308 /*                                                                          */
4309 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.         */
4310 /*                                                                          */
4311 /* NOTE: IT IS ASSUMED THAT  IS ONLY HELD WITH A READ LOCK WHEN             */
4312 /*       THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags.             */
4313 /*                                                                          */
4314 /* flags   -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if   */
4315 /*            the packet is of said protocol                                */
4316 /* ------------------------------------------------------------------------ */
4317 nat_t *
ipf_nat_outlookup(fr_info_t * fin,u_int flags,u_int p,struct in_addr src,struct in_addr dst)4318 ipf_nat_outlookup(fr_info_t *fin, u_int flags, u_int p,
4319 	struct in_addr src , struct in_addr dst)
4320 {
4321 	ipf_main_softc_t *softc = fin->fin_main_soft;
4322 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4323 	u_short sport, dport;
4324 	ipnat_t *ipn;
4325 	nat_t *nat;
4326 	void *ifp;
4327 	u_int hv;
4328 
4329 	ifp = fin->fin_ifp;
4330 
4331 	switch (p)
4332 	{
4333 	case IPPROTO_TCP :
4334 	case IPPROTO_UDP :
4335 		sport = htons(fin->fin_data[0]);
4336 		dport = htons(fin->fin_data[1]);
4337 		break;
4338 	case IPPROTO_ICMP :
4339 		sport = 0;
4340 		dport = fin->fin_data[1];
4341 		break;
4342 	default :
4343 		sport = 0;
4344 		dport = 0;
4345 		break;
4346 	}
4347 
4348 	if ((flags & SI_WILDP) != 0)
4349 		goto find_out_wild_ports;
4350 
4351 	hv = NAT_HASH_FN(src.s_addr, sport, 0xffffffff);
4352 	hv = NAT_HASH_FN(dst.s_addr, hv + dport, softn->ipf_nat_table_sz);
4353 	nat = softn->ipf_nat_table[0][hv];
4354 
4355 	/* TRACE src, sport, dst, dport, hv, nat */
4356 
4357 	for (; nat; nat = nat->nat_hnext[0]) {
4358 		if (nat->nat_ifps[1] != NULL) {
4359 			if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
4360 				continue;
4361 		}
4362 
4363 		if (nat->nat_pr[1] != p)
4364 			continue;
4365 
4366 		switch (nat->nat_dir)
4367 		{
4368 		case NAT_INBOUND :
4369 		case NAT_DIVERTIN :
4370 			if (nat->nat_v[1] != 4)
4371 				continue;
4372 			if (nat->nat_ndstaddr != src.s_addr ||
4373 			    nat->nat_nsrcaddr != dst.s_addr)
4374 				continue;
4375 
4376 			if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4377 				if (nat->nat_ndport != sport)
4378 					continue;
4379 				if (nat->nat_nsport != dport)
4380 					continue;
4381 
4382 			} else if (p == IPPROTO_ICMP) {
4383 				if (nat->nat_osport != dport) {
4384 					continue;
4385 				}
4386 			}
4387 			break;
4388 		case NAT_OUTBOUND :
4389 		case NAT_DIVERTOUT :
4390 			if (nat->nat_v[0] != 4)
4391 				continue;
4392 			if (nat->nat_osrcaddr != src.s_addr ||
4393 			    nat->nat_odstaddr != dst.s_addr)
4394 				continue;
4395 
4396 			if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4397 				if (nat->nat_odport != dport)
4398 					continue;
4399 				if (nat->nat_osport != sport)
4400 					continue;
4401 
4402 			} else if (p == IPPROTO_ICMP) {
4403 				if (nat->nat_osport != dport) {
4404 					continue;
4405 				}
4406 			}
4407 			break;
4408 		}
4409 
4410 		ipn = nat->nat_ptr;
4411 		if ((ipn != NULL) && (nat->nat_aps != NULL))
4412 			if (ipf_proxy_match(fin, nat) != 0)
4413 				continue;
4414 
4415 		if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) {
4416 			nat->nat_ifps[1] = ifp;
4417 			nat->nat_mtu[1] = GETIFMTU_4(ifp);
4418 		}
4419 		return (nat);
4420 	}
4421 
4422 	/*
4423 	 * So if we didn't find it but there are wildcard members in the hash
4424 	 * table, go back and look for them.  We do this search and update here
4425 	 * because it is modifying the NAT table and we want to do this only
4426 	 * for the first packet that matches.  The exception, of course, is
4427 	 * for "dummy" (FI_IGNORE) lookups.
4428 	 */
4429 find_out_wild_ports:
4430 	if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) {
4431 		NBUMPSIDEX(1, ns_lookup_miss, ns_lookup_miss_1);
4432 		return (NULL);
4433 	}
4434 	if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) {
4435 		NBUMPSIDEX(1, ns_lookup_nowild, ns_lookup_nowild_1);
4436 		return (NULL);
4437 	}
4438 
4439 	RWLOCK_EXIT(&softc->ipf_nat);
4440 
4441 	hv = NAT_HASH_FN(src.s_addr, 0, 0xffffffff);
4442 	hv = NAT_HASH_FN(dst.s_addr, hv, softn->ipf_nat_table_sz);
4443 
4444 	WRITE_ENTER(&softc->ipf_nat);
4445 
4446 	nat = softn->ipf_nat_table[0][hv];
4447 	for (; nat; nat = nat->nat_hnext[0]) {
4448 		if (nat->nat_ifps[1] != NULL) {
4449 			if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
4450 				continue;
4451 		}
4452 
4453 		if (nat->nat_pr[1] != fin->fin_p)
4454 			continue;
4455 
4456 		switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND))
4457 		{
4458 		case NAT_INBOUND :
4459 			if (nat->nat_v[1] != 4)
4460 				continue;
4461 			if (nat->nat_ndstaddr != src.s_addr ||
4462 			    nat->nat_nsrcaddr != dst.s_addr)
4463 				continue;
4464 			break;
4465 		case NAT_OUTBOUND :
4466 			if (nat->nat_v[0] != 4)
4467 				continue;
4468 			if (nat->nat_osrcaddr != src.s_addr ||
4469 			    nat->nat_odstaddr != dst.s_addr)
4470 				continue;
4471 			break;
4472 		}
4473 
4474 		if (!(nat->nat_flags & (NAT_TCPUDP|SI_WILDP)))
4475 			continue;
4476 
4477 		if (ipf_nat_wildok(nat, (int)sport, (int)dport, nat->nat_flags,
4478 				   NAT_OUTBOUND) == 1) {
4479 			if ((fin->fin_flx & FI_IGNORE) != 0)
4480 				break;
4481 			if ((nat->nat_flags & SI_CLONE) != 0) {
4482 				nat = ipf_nat_clone(fin, nat);
4483 				if (nat == NULL)
4484 					break;
4485 			} else {
4486 				MUTEX_ENTER(&softn->ipf_nat_new);
4487 				softn->ipf_nat_stats.ns_wilds--;
4488 				MUTEX_EXIT(&softn->ipf_nat_new);
4489 			}
4490 
4491 			if (nat->nat_dir == NAT_OUTBOUND) {
4492 				if (nat->nat_osport == 0) {
4493 					nat->nat_osport = sport;
4494 					nat->nat_nsport = sport;
4495 				}
4496 				if (nat->nat_odport == 0) {
4497 					nat->nat_odport = dport;
4498 					nat->nat_ndport = dport;
4499 				}
4500 			} else if (nat->nat_dir == NAT_INBOUND) {
4501 				if (nat->nat_osport == 0) {
4502 					nat->nat_osport = dport;
4503 					nat->nat_nsport = dport;
4504 				}
4505 				if (nat->nat_odport == 0) {
4506 					nat->nat_odport = sport;
4507 					nat->nat_ndport = sport;
4508 				}
4509 			}
4510 			if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) {
4511 				nat->nat_ifps[1] = ifp;
4512 				nat->nat_mtu[1] = GETIFMTU_4(ifp);
4513 			}
4514 			nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
4515 			ipf_nat_tabmove(softn, nat);
4516 			break;
4517 		}
4518 	}
4519 
4520 	MUTEX_DOWNGRADE(&softc->ipf_nat);
4521 
4522 	if (nat == NULL) {
4523 		NBUMPSIDE(1, ns_lookup_miss);
4524 	}
4525 	return (nat);
4526 }
4527 
4528 
4529 /* ------------------------------------------------------------------------ */
4530 /* Function:    ipf_nat_lookupredir                                         */
4531 /* Returns:     nat_t* - NULL == no match,                                  */
4532 /*                       else pointer to matching NAT entry                 */
4533 /* Parameters:  np(I) - pointer to description of packet to find NAT table  */
4534 /*                      entry for.                                          */
4535 /*                                                                          */
4536 /* Lookup the NAT tables to search for a matching redirect                  */
4537 /* The contents of natlookup_t should imitate those found in a packet that  */
4538 /* would be translated - ie a packet coming in for RDR or going out for MAP.*/
4539 /* We can do the lookup in one of two ways, imitating an inbound or         */
4540 /* outbound  packet.  By default we assume outbound, unless IPN_IN is set.  */
4541 /* For IN, the fields are set as follows:                                   */
4542 /*     nl_real* = source information                                        */
4543 /*     nl_out* = destination information (translated)                       */
4544 /* For an out packet, the fields are set like this:                         */
4545 /*     nl_in* = source information (untranslated)                           */
4546 /*     nl_out* = destination information (translated)                       */
4547 /* ------------------------------------------------------------------------ */
4548 nat_t *
ipf_nat_lookupredir(natlookup_t * np)4549 ipf_nat_lookupredir(natlookup_t *np)
4550 {
4551 	fr_info_t fi;
4552 	nat_t *nat;
4553 
4554 	bzero((char *)&fi, sizeof(fi));
4555 	if (np->nl_flags & IPN_IN) {
4556 		fi.fin_data[0] = ntohs(np->nl_realport);
4557 		fi.fin_data[1] = ntohs(np->nl_outport);
4558 	} else {
4559 		fi.fin_data[0] = ntohs(np->nl_inport);
4560 		fi.fin_data[1] = ntohs(np->nl_outport);
4561 	}
4562 	if (np->nl_flags & IPN_TCP)
4563 		fi.fin_p = IPPROTO_TCP;
4564 	else if (np->nl_flags & IPN_UDP)
4565 		fi.fin_p = IPPROTO_UDP;
4566 	else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY))
4567 		fi.fin_p = IPPROTO_ICMP;
4568 
4569 	/*
4570 	 * We can do two sorts of lookups:
4571 	 * - IPN_IN: we have the `real' and `out' address, look for `in'.
4572 	 * - default: we have the `in' and `out' address, look for `real'.
4573 	 */
4574 	if (np->nl_flags & IPN_IN) {
4575 		if ((nat = ipf_nat_inlookup(&fi, np->nl_flags, fi.fin_p,
4576 					    np->nl_realip, np->nl_outip))) {
4577 			np->nl_inip = nat->nat_odstip;
4578 			np->nl_inport = nat->nat_odport;
4579 		}
4580 	} else {
4581 		/*
4582 		 * If nl_inip is non null, this is a lookup based on the real
4583 		 * ip address. Else, we use the fake.
4584 		 */
4585 		if ((nat = ipf_nat_outlookup(&fi, np->nl_flags, fi.fin_p,
4586 					 np->nl_inip, np->nl_outip))) {
4587 
4588 			if ((np->nl_flags & IPN_FINDFORWARD) != 0) {
4589 				fr_info_t fin;
4590 				bzero((char *)&fin, sizeof(fin));
4591 				fin.fin_p = nat->nat_pr[0];
4592 				fin.fin_data[0] = ntohs(nat->nat_ndport);
4593 				fin.fin_data[1] = ntohs(nat->nat_nsport);
4594 				if (ipf_nat_inlookup(&fin, np->nl_flags,
4595 						     fin.fin_p, nat->nat_ndstip,
4596 						     nat->nat_nsrcip) != NULL) {
4597 					np->nl_flags &= ~IPN_FINDFORWARD;
4598 				}
4599 			}
4600 
4601 			np->nl_realip = nat->nat_odstip;
4602 			np->nl_realport = nat->nat_odport;
4603 		}
4604  	}
4605 
4606 	return (nat);
4607 }
4608 
4609 
4610 /* ------------------------------------------------------------------------ */
4611 /* Function:    ipf_nat_match                                               */
4612 /* Returns:     int - 0 == no match, 1 == match                             */
4613 /* Parameters:  fin(I)   - pointer to packet information                    */
4614 /*              np(I)    - pointer to NAT rule                              */
4615 /*                                                                          */
4616 /* Pull the matching of a packet against a NAT rule out of that complex     */
4617 /* loop inside ipf_nat_checkin() and lay it out properly in its own function. */
4618 /* ------------------------------------------------------------------------ */
4619 static int
ipf_nat_match(fr_info_t * fin,ipnat_t * np)4620 ipf_nat_match(fr_info_t *fin, ipnat_t *np)
4621 {
4622 	ipf_main_softc_t *softc = fin->fin_main_soft;
4623 	frtuc_t *ft;
4624 	int match;
4625 
4626 	match = 0;
4627 	switch (np->in_osrcatype)
4628 	{
4629 	case FRI_NORMAL :
4630 		match = ((fin->fin_saddr & np->in_osrcmsk) != np->in_osrcaddr);
4631 		break;
4632 	case FRI_LOOKUP :
4633 		match = (*np->in_osrcfunc)(softc, np->in_osrcptr,
4634 					   4, &fin->fin_saddr, fin->fin_plen);
4635 		break;
4636 	}
4637 	match ^= ((np->in_flags & IPN_NOTSRC) != 0);
4638 	if (match)
4639 		return (0);
4640 
4641 	match = 0;
4642 	switch (np->in_odstatype)
4643 	{
4644 	case FRI_NORMAL :
4645 		match = ((fin->fin_daddr & np->in_odstmsk) != np->in_odstaddr);
4646 		break;
4647 	case FRI_LOOKUP :
4648 		match = (*np->in_odstfunc)(softc, np->in_odstptr,
4649 					   4, &fin->fin_daddr, fin->fin_plen);
4650 		break;
4651 	}
4652 
4653 	match ^= ((np->in_flags & IPN_NOTDST) != 0);
4654 	if (match)
4655 		return (0);
4656 
4657 	ft = &np->in_tuc;
4658 	if (!(fin->fin_flx & FI_TCPUDP) ||
4659 	    (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
4660 		if (ft->ftu_scmp || ft->ftu_dcmp)
4661 			return (0);
4662 		return (1);
4663 	}
4664 
4665 	return (ipf_tcpudpchk(&fin->fin_fi, ft));
4666 }
4667 
4668 
4669 /* ------------------------------------------------------------------------ */
4670 /* Function:    ipf_nat_update                                              */
4671 /* Returns:     Nil                                                         */
4672 /* Parameters:  fin(I) - pointer to packet information                      */
4673 /*              nat(I) - pointer to NAT structure                           */
4674 /*                                                                          */
4675 /* Updates the lifetime of a NAT table entry for non-TCP packets.  Must be  */
4676 /* called with fin_rev updated - i.e. after calling ipf_nat_proto().        */
4677 /*                                                                          */
4678 /* This *MUST* be called after ipf_nat_proto() as it expects fin_rev to     */
4679 /* already be set.                                                          */
4680 /* ------------------------------------------------------------------------ */
4681 void
ipf_nat_update(fr_info_t * fin,nat_t * nat)4682 ipf_nat_update(fr_info_t *fin, nat_t *nat)
4683 {
4684 	ipf_main_softc_t *softc = fin->fin_main_soft;
4685 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4686 	ipftq_t *ifq, *ifq2;
4687 	ipftqent_t *tqe;
4688 	ipnat_t *np = nat->nat_ptr;
4689 
4690 	tqe = &nat->nat_tqe;
4691 	ifq = tqe->tqe_ifq;
4692 
4693 	/*
4694 	 * We allow over-riding of NAT timeouts from NAT rules, even for
4695 	 * TCP, however, if it is TCP and there is no rule timeout set,
4696 	 * then do not update the timeout here.
4697 	 */
4698 	if (np != NULL) {
4699 		np->in_bytes[fin->fin_rev] += fin->fin_plen;
4700 		ifq2 = np->in_tqehead[fin->fin_rev];
4701 	} else {
4702 		ifq2 = NULL;
4703 	}
4704 
4705 	if (nat->nat_pr[0] == IPPROTO_TCP && ifq2 == NULL) {
4706 		(void) ipf_tcp_age(&nat->nat_tqe, fin, softn->ipf_nat_tcptq,
4707 				   0, 2);
4708 	} else {
4709 		if (ifq2 == NULL) {
4710 			if (nat->nat_pr[0] == IPPROTO_UDP)
4711 				ifq2 = fin->fin_rev ? &softn->ipf_nat_udpacktq :
4712 						      &softn->ipf_nat_udptq;
4713 			else if (nat->nat_pr[0] == IPPROTO_ICMP ||
4714 				 nat->nat_pr[0] == IPPROTO_ICMPV6)
4715 				ifq2 = fin->fin_rev ? &softn->ipf_nat_icmpacktq:
4716 						      &softn->ipf_nat_icmptq;
4717 			else
4718 				ifq2 = &softn->ipf_nat_iptq;
4719 		}
4720 
4721 		ipf_movequeue(softc->ipf_ticks, tqe, ifq, ifq2);
4722 	}
4723 }
4724 
4725 
4726 /* ------------------------------------------------------------------------ */
4727 /* Function:    ipf_nat_checkout                                            */
4728 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
4729 /*                     0 == no packet translation occurred,                 */
4730 /*                     1 == packet was successfully translated.             */
4731 /* Parameters:  fin(I)   - pointer to packet information                    */
4732 /*              passp(I) - pointer to filtering result flags                */
4733 /*                                                                          */
4734 /* Check to see if an outcoming packet should be changed.  ICMP packets are */
4735 /* first checked to see if they match an existing entry (if an error),      */
4736 /* otherwise a search of the current NAT table is made.  If neither results */
4737 /* in a match then a search for a matching NAT rule is made.  Create a new  */
4738 /* NAT entry if a we matched a NAT rule.  Lastly, actually change the       */
4739 /* packet header(s) as required.                                            */
4740 /* ------------------------------------------------------------------------ */
4741 int
ipf_nat_checkout(fr_info_t * fin,u_32_t * passp)4742 ipf_nat_checkout(fr_info_t *fin, u_32_t *passp)
4743 {
4744 	ipnat_t *np = NULL, *npnext;
4745 	struct ifnet *ifp, *sifp;
4746 	ipf_main_softc_t *softc;
4747 	ipf_nat_softc_t *softn;
4748 	tcphdr_t *tcp = NULL;
4749 	int rval, natfailed;
4750 	u_int nflags = 0;
4751 	u_32_t ipa, iph;
4752 	int natadd = 1;
4753 	frentry_t *fr;
4754 	nat_t *nat;
4755 
4756 	if (fin->fin_v == 6) {
4757 #ifdef USE_INET6
4758 		return (ipf_nat6_checkout(fin, passp));
4759 #else
4760 		return (0);
4761 #endif
4762 	}
4763 
4764 	softc = fin->fin_main_soft;
4765 	softn = softc->ipf_nat_soft;
4766 
4767 	if (softn->ipf_nat_lock != 0)
4768 		return (0);
4769 	if (softn->ipf_nat_stats.ns_rules == 0 &&
4770 	    softn->ipf_nat_instances == NULL)
4771 		return (0);
4772 
4773 	natfailed = 0;
4774 	fr = fin->fin_fr;
4775 	sifp = fin->fin_ifp;
4776 	if (fr != NULL) {
4777 		ifp = fr->fr_tifs[fin->fin_rev].fd_ptr;
4778 		if ((ifp != NULL) && (ifp != (void *)-1))
4779 			fin->fin_ifp = ifp;
4780 	}
4781 	ifp = fin->fin_ifp;
4782 
4783 	if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
4784 		switch (fin->fin_p)
4785 		{
4786 		case IPPROTO_TCP :
4787 			nflags = IPN_TCP;
4788 			break;
4789 		case IPPROTO_UDP :
4790 			nflags = IPN_UDP;
4791 			break;
4792 		case IPPROTO_ICMP :
4793 			/*
4794 			 * This is an incoming packet, so the destination is
4795 			 * the icmp_id and the source port equals 0
4796 			 */
4797 			if ((fin->fin_flx & FI_ICMPQUERY) != 0)
4798 				nflags = IPN_ICMPQUERY;
4799 			break;
4800 		default :
4801 			break;
4802 		}
4803 
4804 		if ((nflags & IPN_TCPUDP))
4805 			tcp = fin->fin_dp;
4806 	}
4807 
4808 	ipa = fin->fin_saddr;
4809 
4810 	READ_ENTER(&softc->ipf_nat);
4811 
4812 	if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
4813 	    (nat = ipf_nat_icmperror(fin, &nflags, NAT_OUTBOUND)))
4814 		/*EMPTY*/;
4815 	else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin)))
4816 		natadd = 0;
4817 	else if ((nat = ipf_nat_outlookup(fin, nflags|NAT_SEARCH,
4818 				      (u_int)fin->fin_p, fin->fin_src,
4819 				      fin->fin_dst))) {
4820 		nflags = nat->nat_flags;
4821 	} else if (fin->fin_off == 0) {
4822 		u_32_t hv, msk, nmsk = 0;
4823 
4824 		/*
4825 		 * If there is no current entry in the nat table for this IP#,
4826 		 * create one for it (if there is a matching rule).
4827 		 */
4828 maskloop:
4829 		msk = softn->ipf_nat_map_active_masks[nmsk];
4830 		iph = ipa & msk;
4831 		hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_maprules_sz);
4832 retry_roundrobin:
4833 		for (np = softn->ipf_nat_map_rules[hv]; np; np = npnext) {
4834 			npnext = np->in_mnext;
4835 			if ((np->in_ifps[1] && (np->in_ifps[1] != ifp)))
4836 				continue;
4837 			if (np->in_v[0] != 4)
4838 				continue;
4839 			if (np->in_pr[1] && (np->in_pr[1] != fin->fin_p))
4840 				continue;
4841 			if ((np->in_flags & IPN_RF) &&
4842 			    !(np->in_flags & nflags))
4843 				continue;
4844 			if (np->in_flags & IPN_FILTER) {
4845 				switch (ipf_nat_match(fin, np))
4846 				{
4847 				case 0 :
4848 					continue;
4849 				case -1 :
4850 					rval = -3;
4851 					goto outmatchfail;
4852 				case 1 :
4853 				default :
4854 					break;
4855 				}
4856 			} else if ((ipa & np->in_osrcmsk) != np->in_osrcaddr)
4857 				continue;
4858 
4859 			if ((fr != NULL) &&
4860 			    !ipf_matchtag(&np->in_tag, &fr->fr_nattag))
4861 				continue;
4862 
4863 			if (np->in_plabel != -1) {
4864 				if (((np->in_flags & IPN_FILTER) == 0) &&
4865 				    (np->in_odport != fin->fin_data[1]))
4866 					continue;
4867 				if (ipf_proxy_ok(fin, tcp, np) == 0)
4868 					continue;
4869 			}
4870 
4871 			if (np->in_flags & IPN_NO) {
4872 				np->in_hits++;
4873 				break;
4874 			}
4875 			MUTEX_ENTER(&softn->ipf_nat_new);
4876 			/*
4877 			 * If we've matched a round-robin rule but it has
4878 			 * moved in the list since we got it, start over as
4879 			 * this is now no longer correct.
4880 			 */
4881 			if (npnext != np->in_mnext) {
4882 				if ((np->in_flags & IPN_ROUNDR) != 0) {
4883 					MUTEX_EXIT(&softn->ipf_nat_new);
4884 					goto retry_roundrobin;
4885 				}
4886 				npnext = np->in_mnext;
4887 			}
4888 
4889 			nat = ipf_nat_add(fin, np, NULL, nflags, NAT_OUTBOUND);
4890 			MUTEX_EXIT(&softn->ipf_nat_new);
4891 			if (nat != NULL) {
4892 				natfailed = 0;
4893 				break;
4894 			}
4895 			natfailed = -2;
4896 		}
4897 		if ((np == NULL) && (nmsk < softn->ipf_nat_map_max)) {
4898 			nmsk++;
4899 			goto maskloop;
4900 		}
4901 	}
4902 
4903 	if (nat != NULL) {
4904 		rval = ipf_nat_out(fin, nat, natadd, nflags);
4905 		if (rval == 1) {
4906 			MUTEX_ENTER(&nat->nat_lock);
4907 			ipf_nat_update(fin, nat);
4908 			nat->nat_bytes[1] += fin->fin_plen;
4909 			nat->nat_pkts[1]++;
4910 			fin->fin_pktnum = nat->nat_pkts[1];
4911 			MUTEX_EXIT(&nat->nat_lock);
4912 		}
4913 	} else
4914 		rval = natfailed;
4915 outmatchfail:
4916 	RWLOCK_EXIT(&softc->ipf_nat);
4917 
4918 	switch (rval)
4919 	{
4920 	case -3 :
4921 		/* ipf_nat_match() failure */
4922 		/* FALLTHROUGH */
4923 	case -2 :
4924 		/* retry_roundrobin loop failure */
4925 		/* FALLTHROUGH */
4926 	case -1 :
4927 		/* proxy failure detected by ipf_nat_out() */
4928 		if (passp != NULL) {
4929 			DT2(frb_natv4out, fr_info_t *, fin, int, rval);
4930 			NBUMPSIDED(1, ns_drop);
4931 			*passp = FR_BLOCK;
4932 			fin->fin_reason = FRB_NATV4;
4933 		}
4934 		fin->fin_flx |= FI_BADNAT;
4935 		NBUMPSIDED(1, ns_badnat);
4936 		rval = -1;	/* We only return -1 on error. */
4937 		break;
4938 	case 0 :
4939 		NBUMPSIDE(1, ns_ignored);
4940 		break;
4941 	case 1 :
4942 		NBUMPSIDE(1, ns_translated);
4943 		break;
4944 	}
4945 	fin->fin_ifp = sifp;
4946 	return (rval);
4947 }
4948 
4949 /* ------------------------------------------------------------------------ */
4950 /* Function:    ipf_nat_out                                                 */
4951 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
4952 /*                     1 == packet was successfully translated.             */
4953 /* Parameters:  fin(I)    - pointer to packet information                   */
4954 /*              nat(I)    - pointer to NAT structure                        */
4955 /*              natadd(I) - flag indicating if it is safe to add frag cache */
4956 /*              nflags(I) - NAT flags set for this packet                   */
4957 /*                                                                          */
4958 /* Translate a packet coming "out" on an interface.                         */
4959 /* ------------------------------------------------------------------------ */
4960 int
ipf_nat_out(fr_info_t * fin,nat_t * nat,int natadd,u_32_t nflags)4961 ipf_nat_out(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags)
4962 {
4963 	ipf_main_softc_t *softc = fin->fin_main_soft;
4964 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4965 	icmphdr_t *icmp;
4966 	tcphdr_t *tcp;
4967 	ipnat_t *np;
4968 	int skip;
4969 	int i;
4970 
4971 	tcp = NULL;
4972 	icmp = NULL;
4973 	np = nat->nat_ptr;
4974 
4975 	if ((natadd != 0) && (fin->fin_flx & FI_FRAG) && (np != NULL))
4976 		(void) ipf_frag_natnew(softc, fin, 0, nat);
4977 
4978 	/*
4979 	 * Fix up checksums, not by recalculating them, but
4980 	 * simply computing adjustments.
4981 	 * This is only done for STREAMS based IP implementations where the
4982 	 * checksum has already been calculated by IP.  In all other cases,
4983 	 * IPFilter is called before the checksum needs calculating so there
4984 	 * is no call to modify whatever is in the header now.
4985 	 */
4986 	if (nflags == IPN_ICMPERR) {
4987 		u_32_t s1, s2, sumd, msumd;
4988 
4989 		s1 = LONG_SUM(ntohl(fin->fin_saddr));
4990 		if (nat->nat_dir == NAT_OUTBOUND) {
4991 			s2 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
4992 		} else {
4993 			s2 = LONG_SUM(ntohl(nat->nat_odstaddr));
4994 		}
4995 		CALC_SUMD(s1, s2, sumd);
4996 		msumd = sumd;
4997 
4998 		s1 = LONG_SUM(ntohl(fin->fin_daddr));
4999 		if (nat->nat_dir == NAT_OUTBOUND) {
5000 			s2 = LONG_SUM(ntohl(nat->nat_ndstaddr));
5001 		} else {
5002 			s2 = LONG_SUM(ntohl(nat->nat_osrcaddr));
5003 		}
5004 		CALC_SUMD(s1, s2, sumd);
5005 		msumd += sumd;
5006 
5007 		ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, msumd, 0);
5008 	}
5009 #if !defined(_KERNEL) || SOLARIS || \
5010     defined(BRIDGE_IPF) || defined(__FreeBSD__)
5011 	else {
5012 		/*
5013 		 * We always do this on FreeBSD because this code doesn't
5014 		 * exist in fastforward.
5015 		 */
5016 		switch (nat->nat_dir)
5017 		{
5018 		case NAT_OUTBOUND :
5019 			ipf_fix_outcksum(fin->fin_cksum & FI_CK_L4PART,
5020 					 &fin->fin_ip->ip_sum,
5021 					 nat->nat_ipsumd, 0);
5022 			break;
5023 
5024 		case NAT_INBOUND :
5025 			ipf_fix_incksum(fin->fin_cksum & FI_CK_L4PART,
5026 					&fin->fin_ip->ip_sum,
5027 					nat->nat_ipsumd, 0);
5028 			break;
5029 
5030 		default :
5031 			break;
5032 		}
5033 	}
5034 #endif
5035 
5036 	/*
5037 	 * Address assignment is after the checksum modification because
5038 	 * we are using the address in the packet for determining the
5039 	 * correct checksum offset (the ICMP error could be coming from
5040 	 * anyone...)
5041 	 */
5042 	switch (nat->nat_dir)
5043 	{
5044 	case NAT_OUTBOUND :
5045 		fin->fin_ip->ip_src = nat->nat_nsrcip;
5046 		fin->fin_saddr = nat->nat_nsrcaddr;
5047 		fin->fin_ip->ip_dst = nat->nat_ndstip;
5048 		fin->fin_daddr = nat->nat_ndstaddr;
5049 		break;
5050 
5051 	case NAT_INBOUND :
5052 		fin->fin_ip->ip_src = nat->nat_odstip;
5053 		fin->fin_saddr = nat->nat_ndstaddr;
5054 		fin->fin_ip->ip_dst = nat->nat_osrcip;
5055 		fin->fin_daddr = nat->nat_nsrcaddr;
5056 		break;
5057 
5058 	case NAT_DIVERTIN :
5059 	    {
5060 		mb_t *m;
5061 
5062 		skip = ipf_nat_decap(fin, nat);
5063 		if (skip <= 0) {
5064 			NBUMPSIDED(1, ns_decap_fail);
5065 			return (-1);
5066 		}
5067 
5068 		m = fin->fin_m;
5069 
5070 #if SOLARIS && defined(_KERNEL)
5071 		m->b_rptr += skip;
5072 #else
5073 		m->m_data += skip;
5074 		m->m_len -= skip;
5075 
5076 # ifdef M_PKTHDR
5077 		if (m->m_flags & M_PKTHDR)
5078 			m->m_pkthdr.len -= skip;
5079 # endif
5080 #endif
5081 
5082 		MUTEX_ENTER(&nat->nat_lock);
5083 		ipf_nat_update(fin, nat);
5084 		MUTEX_EXIT(&nat->nat_lock);
5085 		fin->fin_flx |= FI_NATED;
5086 		if (np != NULL && np->in_tag.ipt_num[0] != 0)
5087 			fin->fin_nattag = &np->in_tag;
5088 		return (1);
5089 		/* NOTREACHED */
5090 	    }
5091 
5092 	case NAT_DIVERTOUT :
5093 	    {
5094 		u_32_t s1, s2, sumd;
5095 		udphdr_t *uh;
5096 		ip_t *ip;
5097 		mb_t *m;
5098 
5099 		m = M_DUP(np->in_divmp);
5100 		if (m == NULL) {
5101 			NBUMPSIDED(1, ns_divert_dup);
5102 			return (-1);
5103 		}
5104 
5105 		ip = MTOD(m, ip_t *);
5106 		ip_fillid(ip, V_ip_random_id);
5107 		s2 = ntohs(ip->ip_id);
5108 
5109 		s1 = ip->ip_len;
5110 		ip->ip_len = ntohs(ip->ip_len);
5111 		ip->ip_len += fin->fin_plen;
5112 		ip->ip_len = htons(ip->ip_len);
5113 		s2 += ntohs(ip->ip_len);
5114 		CALC_SUMD(s1, s2, sumd);
5115 
5116 		uh = (udphdr_t *)(ip + 1);
5117 		uh->uh_ulen += fin->fin_plen;
5118 		uh->uh_ulen = htons(uh->uh_ulen);
5119 #if !defined(_KERNEL) || SOLARIS || \
5120     defined(BRIDGE_IPF) || defined(__FreeBSD__)
5121 		ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0);
5122 #endif
5123 
5124 		PREP_MB_T(fin, m);
5125 
5126 		fin->fin_src = ip->ip_src;
5127 		fin->fin_dst = ip->ip_dst;
5128 		fin->fin_ip = ip;
5129 		fin->fin_plen += sizeof(ip_t) + 8;	/* UDP + IPv4 hdr */
5130 		fin->fin_dlen += sizeof(ip_t) + 8;	/* UDP + IPv4 hdr */
5131 
5132 		nflags &= ~IPN_TCPUDPICMP;
5133 
5134 		break;
5135 	    }
5136 
5137 	default :
5138 		break;
5139 	}
5140 
5141 	if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5142 		u_short *csump;
5143 
5144 		if ((nat->nat_nsport != 0) && (nflags & IPN_TCPUDP)) {
5145 			tcp = fin->fin_dp;
5146 
5147 			switch (nat->nat_dir)
5148 			{
5149 			case NAT_OUTBOUND :
5150 				tcp->th_sport = nat->nat_nsport;
5151 				fin->fin_data[0] = ntohs(nat->nat_nsport);
5152 				tcp->th_dport = nat->nat_ndport;
5153 				fin->fin_data[1] = ntohs(nat->nat_ndport);
5154 				break;
5155 
5156 			case NAT_INBOUND :
5157 				tcp->th_sport = nat->nat_odport;
5158 				fin->fin_data[0] = ntohs(nat->nat_odport);
5159 				tcp->th_dport = nat->nat_osport;
5160 				fin->fin_data[1] = ntohs(nat->nat_osport);
5161 				break;
5162 			}
5163 		}
5164 
5165 		if ((nat->nat_nsport != 0) && (nflags & IPN_ICMPQUERY)) {
5166 			icmp = fin->fin_dp;
5167 			icmp->icmp_id = nat->nat_nicmpid;
5168 		}
5169 
5170 		csump = ipf_nat_proto(fin, nat, nflags);
5171 
5172 		/*
5173 		 * The above comments do not hold for layer 4 (or higher)
5174 		 * checksums...
5175 		 */
5176 		if (csump != NULL) {
5177 			if (nat->nat_dir == NAT_OUTBOUND)
5178 				ipf_fix_outcksum(fin->fin_cksum, csump,
5179 						 nat->nat_sumd[0],
5180 						 nat->nat_sumd[1] +
5181 						 fin->fin_dlen);
5182 			else
5183 				ipf_fix_incksum(fin->fin_cksum, csump,
5184 						nat->nat_sumd[0],
5185 						nat->nat_sumd[1] +
5186 						fin->fin_dlen);
5187 		}
5188 	}
5189 
5190 	ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
5191 	/* ------------------------------------------------------------- */
5192 	/* A few quick notes:                                            */
5193 	/*      Following are test conditions prior to calling the       */
5194 	/*      ipf_proxy_check routine.                                 */
5195 	/*                                                               */
5196 	/*      A NULL tcp indicates a non TCP/UDP packet.  When dealing */
5197 	/*      with a redirect rule, we attempt to match the packet's   */
5198 	/*      source port against in_dport, otherwise we'd compare the */
5199 	/*      packet's destination.                                    */
5200 	/* ------------------------------------------------------------- */
5201 	if ((np != NULL) && (np->in_apr != NULL)) {
5202 		i = ipf_proxy_check(fin, nat);
5203 		if (i == -1) {
5204 			NBUMPSIDED(1, ns_ipf_proxy_fail);
5205 		}
5206 	} else {
5207 		i = 1;
5208 	}
5209 	fin->fin_flx |= FI_NATED;
5210 	return (i);
5211 }
5212 
5213 
5214 /* ------------------------------------------------------------------------ */
5215 /* Function:    ipf_nat_checkin                                             */
5216 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
5217 /*                     0 == no packet translation occurred,                 */
5218 /*                     1 == packet was successfully translated.             */
5219 /* Parameters:  fin(I)   - pointer to packet information                    */
5220 /*              passp(I) - pointer to filtering result flags                */
5221 /*                                                                          */
5222 /* Check to see if an incoming packet should be changed.  ICMP packets are  */
5223 /* first checked to see if they match an existing entry (if an error),      */
5224 /* otherwise a search of the current NAT table is made.  If neither results */
5225 /* in a match then a search for a matching NAT rule is made.  Create a new  */
5226 /* NAT entry if a we matched a NAT rule.  Lastly, actually change the       */
5227 /* packet header(s) as required.                                            */
5228 /* ------------------------------------------------------------------------ */
5229 int
ipf_nat_checkin(fr_info_t * fin,u_32_t * passp)5230 ipf_nat_checkin(fr_info_t *fin, u_32_t *passp)
5231 {
5232 	ipf_main_softc_t *softc;
5233 	ipf_nat_softc_t *softn;
5234 	u_int nflags, natadd;
5235 	ipnat_t *np, *npnext;
5236 	int rval, natfailed;
5237 	struct ifnet *ifp;
5238 	struct in_addr in;
5239 	icmphdr_t *icmp;
5240 	tcphdr_t *tcp;
5241 	u_short dport;
5242 	nat_t *nat;
5243 	u_32_t iph;
5244 
5245 	softc = fin->fin_main_soft;
5246 	softn = softc->ipf_nat_soft;
5247 
5248 	if (softn->ipf_nat_lock != 0)
5249 		return (0);
5250 	if (softn->ipf_nat_stats.ns_rules == 0 &&
5251 	    softn->ipf_nat_instances == NULL)
5252 		return (0);
5253 
5254 	tcp = NULL;
5255 	icmp = NULL;
5256 	dport = 0;
5257 	natadd = 1;
5258 	nflags = 0;
5259 	natfailed = 0;
5260 	ifp = fin->fin_ifp;
5261 
5262 	if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5263 		switch (fin->fin_p)
5264 		{
5265 		case IPPROTO_TCP :
5266 			nflags = IPN_TCP;
5267 			break;
5268 		case IPPROTO_UDP :
5269 			nflags = IPN_UDP;
5270 			break;
5271 		case IPPROTO_ICMP :
5272 			icmp = fin->fin_dp;
5273 
5274 			/*
5275 			 * This is an incoming packet, so the destination is
5276 			 * the icmp_id and the source port equals 0
5277 			 */
5278 			if ((fin->fin_flx & FI_ICMPQUERY) != 0) {
5279 				nflags = IPN_ICMPQUERY;
5280 				dport = icmp->icmp_id;
5281 			} break;
5282 		default :
5283 			break;
5284 		}
5285 
5286 		if ((nflags & IPN_TCPUDP)) {
5287 			tcp = fin->fin_dp;
5288 			dport = fin->fin_data[1];
5289 		}
5290 	}
5291 
5292 	in = fin->fin_dst;
5293 
5294 	READ_ENTER(&softc->ipf_nat);
5295 
5296 	if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
5297 	    (nat = ipf_nat_icmperror(fin, &nflags, NAT_INBOUND)))
5298 		/*EMPTY*/;
5299 	else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin)))
5300 		natadd = 0;
5301 	else if ((nat = ipf_nat_inlookup(fin, nflags|NAT_SEARCH,
5302 					 (u_int)fin->fin_p,
5303 					 fin->fin_src, in))) {
5304 		nflags = nat->nat_flags;
5305 	} else if (fin->fin_off == 0) {
5306 		u_32_t hv, msk, rmsk = 0;
5307 
5308 		/*
5309 		 * If there is no current entry in the nat table for this IP#,
5310 		 * create one for it (if there is a matching rule).
5311 		 */
5312 maskloop:
5313 		msk = softn->ipf_nat_rdr_active_masks[rmsk];
5314 		iph = in.s_addr & msk;
5315 		hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_rdrrules_sz);
5316 retry_roundrobin:
5317 		/* TRACE (iph,msk,rmsk,hv,softn->ipf_nat_rdrrules_sz) */
5318 		for (np = softn->ipf_nat_rdr_rules[hv]; np; np = npnext) {
5319 			npnext = np->in_rnext;
5320 			if (np->in_ifps[0] && (np->in_ifps[0] != ifp))
5321 				continue;
5322 			if (np->in_v[0] != 4)
5323 				continue;
5324 			if (np->in_pr[0] && (np->in_pr[0] != fin->fin_p))
5325 				continue;
5326 			if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags))
5327 				continue;
5328 			if (np->in_flags & IPN_FILTER) {
5329 				switch (ipf_nat_match(fin, np))
5330 				{
5331 				case 0 :
5332 					continue;
5333 				case -1 :
5334 					rval = -3;
5335 					goto inmatchfail;
5336 				case 1 :
5337 				default :
5338 					break;
5339 				}
5340 			} else {
5341 				if ((in.s_addr & np->in_odstmsk) !=
5342 				    np->in_odstaddr)
5343 					continue;
5344 				if (np->in_odport &&
5345 				    ((np->in_dtop < dport) ||
5346 				     (dport < np->in_odport)))
5347 					continue;
5348 			}
5349 
5350 			if (np->in_plabel != -1) {
5351 				if (!ipf_proxy_ok(fin, tcp, np)) {
5352 					continue;
5353 				}
5354 			}
5355 
5356 			if (np->in_flags & IPN_NO) {
5357 				np->in_hits++;
5358 				break;
5359 			}
5360 
5361 			MUTEX_ENTER(&softn->ipf_nat_new);
5362 			/*
5363 			 * If we've matched a round-robin rule but it has
5364 			 * moved in the list since we got it, start over as
5365 			 * this is now no longer correct.
5366 			 */
5367 			if (npnext != np->in_rnext) {
5368 				if ((np->in_flags & IPN_ROUNDR) != 0) {
5369 					MUTEX_EXIT(&softn->ipf_nat_new);
5370 					goto retry_roundrobin;
5371 				}
5372 				npnext = np->in_rnext;
5373 			}
5374 
5375 			nat = ipf_nat_add(fin, np, NULL, nflags, NAT_INBOUND);
5376 			MUTEX_EXIT(&softn->ipf_nat_new);
5377 			if (nat != NULL) {
5378 				natfailed = 0;
5379 				break;
5380 			}
5381 			natfailed = -2;
5382 		}
5383 		if ((np == NULL) && (rmsk < softn->ipf_nat_rdr_max)) {
5384 			rmsk++;
5385 			goto maskloop;
5386 		}
5387 	}
5388 
5389 	if (nat != NULL) {
5390 		rval = ipf_nat_in(fin, nat, natadd, nflags);
5391 		if (rval == 1) {
5392 			MUTEX_ENTER(&nat->nat_lock);
5393 			ipf_nat_update(fin, nat);
5394 			nat->nat_bytes[0] += fin->fin_plen;
5395 			nat->nat_pkts[0]++;
5396 			fin->fin_pktnum = nat->nat_pkts[0];
5397 			MUTEX_EXIT(&nat->nat_lock);
5398 		}
5399 	} else
5400 		rval = natfailed;
5401 inmatchfail:
5402 	RWLOCK_EXIT(&softc->ipf_nat);
5403 
5404 	DT2(frb_natv4in, fr_info_t *, fin, int, rval);
5405 	switch (rval)
5406 	{
5407 	case -3 :
5408 		/* ipf_nat_match() failure */
5409 		/* FALLTHROUGH */
5410 	case -2 :
5411 		/* retry_roundrobin loop failure */
5412 		/* FALLTHROUGH */
5413 	case -1 :
5414 		/* proxy failure detected by ipf_nat_in() */
5415 		if (passp != NULL) {
5416 			NBUMPSIDED(0, ns_drop);
5417 			*passp = FR_BLOCK;
5418 			fin->fin_reason = FRB_NATV4;
5419 		}
5420 		fin->fin_flx |= FI_BADNAT;
5421 		NBUMPSIDED(0, ns_badnat);
5422 		rval = -1;	/* We only return -1 on error. */
5423 		break;
5424 	case 0 :
5425 		NBUMPSIDE(0, ns_ignored);
5426 		break;
5427 	case 1 :
5428 		NBUMPSIDE(0, ns_translated);
5429 		break;
5430 	}
5431 	return (rval);
5432 }
5433 
5434 
5435 /* ------------------------------------------------------------------------ */
5436 /* Function:    ipf_nat_in                                                  */
5437 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
5438 /*                     1 == packet was successfully translated.             */
5439 /* Parameters:  fin(I)    - pointer to packet information                   */
5440 /*              nat(I)    - pointer to NAT structure                        */
5441 /*              natadd(I) - flag indicating if it is safe to add frag cache */
5442 /*              nflags(I) - NAT flags set for this packet                   */
5443 /* Locks Held:  ipf_nat(READ)                                               */
5444 /*                                                                          */
5445 /* Translate a packet coming "in" on an interface.                          */
5446 /* ------------------------------------------------------------------------ */
5447 int
ipf_nat_in(fr_info_t * fin,nat_t * nat,int natadd,u_32_t nflags)5448 ipf_nat_in(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags)
5449 {
5450 	ipf_main_softc_t *softc = fin->fin_main_soft;
5451 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5452 	u_32_t sumd, sum1, sum2;
5453 #if !defined(_KERNEL) || SOLARIS
5454 	u_32_t ipsumd;
5455 #endif
5456 	icmphdr_t *icmp;
5457 	tcphdr_t *tcp;
5458 	ipnat_t *np;
5459 	int skip;
5460 	int i;
5461 
5462 	tcp = NULL;
5463 	np = nat->nat_ptr;
5464 	fin->fin_fr = nat->nat_fr;
5465 
5466 	if (np != NULL) {
5467 		if ((natadd != 0) && (fin->fin_flx & FI_FRAG))
5468 			(void) ipf_frag_natnew(softc, fin, 0, nat);
5469 
5470 	/* ------------------------------------------------------------- */
5471 	/* A few quick notes:                                            */
5472 	/*      Following are test conditions prior to calling the       */
5473 	/*      ipf_proxy_check routine.                                 */
5474 	/*                                                               */
5475 	/*      A NULL tcp indicates a non TCP/UDP packet.  When dealing */
5476 	/*      with a map rule, we attempt to match the packet's        */
5477 	/*      source port against in_dport, otherwise we'd compare the */
5478 	/*      packet's destination.                                    */
5479 	/* ------------------------------------------------------------- */
5480 		if (np->in_apr != NULL) {
5481 			i = ipf_proxy_check(fin, nat);
5482 			if (i == -1) {
5483 				NBUMPSIDED(0, ns_ipf_proxy_fail);
5484 				return (-1);
5485 			}
5486 		}
5487 	}
5488 
5489 	ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
5490 
5491 #if !defined(_KERNEL) || SOLARIS
5492 	ipsumd = nat->nat_ipsumd;
5493 #endif
5494 	/*
5495 	 * Fix up checksums, not by recalculating them, but
5496 	 * simply computing adjustments.
5497 	 * Why only do this for some platforms on inbound packets ?
5498 	 * Because for those that it is done, IP processing is yet to happen
5499 	 * and so the IPv4 header checksum has not yet been evaluated.
5500 	 * Perhaps it should always be done for the benefit of things like
5501 	 * fast forwarding (so that it doesn't need to be recomputed) but with
5502 	 * header checksum offloading, perhaps it is a moot point.
5503 	 */
5504 
5505 	switch (nat->nat_dir)
5506 	{
5507 	case NAT_INBOUND :
5508 		if ((fin->fin_flx & FI_ICMPERR) == 0) {
5509 			fin->fin_ip->ip_src = nat->nat_nsrcip;
5510 			fin->fin_saddr = nat->nat_nsrcaddr;
5511 		} else {
5512 			sum1 = nat->nat_osrcaddr;
5513 			sum2 = nat->nat_nsrcaddr;
5514 			CALC_SUMD(sum1, sum2, sumd);
5515 #if !defined(_KERNEL) || SOLARIS
5516 			ipsumd -= sumd;
5517 #endif
5518 		}
5519 		fin->fin_ip->ip_dst = nat->nat_ndstip;
5520 		fin->fin_daddr = nat->nat_ndstaddr;
5521 #if !defined(_KERNEL) || SOLARIS
5522 		ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
5523 #endif
5524 		break;
5525 
5526 	case NAT_OUTBOUND :
5527 		if ((fin->fin_flx & FI_ICMPERR) == 0) {
5528 			fin->fin_ip->ip_src = nat->nat_odstip;
5529 			fin->fin_saddr = nat->nat_odstaddr;
5530 		} else {
5531 			sum1 = nat->nat_odstaddr;
5532 			sum2 = nat->nat_ndstaddr;
5533 			CALC_SUMD(sum1, sum2, sumd);
5534 #if !defined(_KERNEL) || SOLARIS
5535 			ipsumd -= sumd;
5536 #endif
5537 		}
5538 		fin->fin_ip->ip_dst = nat->nat_osrcip;
5539 		fin->fin_daddr = nat->nat_osrcaddr;
5540 #if !defined(_KERNEL) || SOLARIS
5541 		ipf_fix_incksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
5542 #endif
5543 		break;
5544 
5545 	case NAT_DIVERTIN :
5546 	    {
5547 		udphdr_t *uh;
5548 		ip_t *ip;
5549 		mb_t *m;
5550 
5551 		m = M_DUP(np->in_divmp);
5552 		if (m == NULL) {
5553 			NBUMPSIDED(0, ns_divert_dup);
5554 			return (-1);
5555 		}
5556 
5557 		ip = MTOD(m, ip_t *);
5558 		ip_fillid(ip, V_ip_random_id);
5559 		sum1 = ntohs(ip->ip_len);
5560 		ip->ip_len = ntohs(ip->ip_len);
5561 		ip->ip_len += fin->fin_plen;
5562 		ip->ip_len = htons(ip->ip_len);
5563 
5564 		uh = (udphdr_t *)(ip + 1);
5565 		uh->uh_ulen += fin->fin_plen;
5566 		uh->uh_ulen = htons(uh->uh_ulen);
5567 
5568 		sum2 = ntohs(ip->ip_id) + ntohs(ip->ip_len);
5569 		sum2 += ntohs(ip->ip_off) & IP_DF;
5570 		CALC_SUMD(sum1, sum2, sumd);
5571 
5572 #if !defined(_KERNEL) || SOLARIS
5573 		ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0);
5574 #endif
5575 		PREP_MB_T(fin, m);
5576 
5577 		fin->fin_ip = ip;
5578 		fin->fin_plen += sizeof(ip_t) + 8;	/* UDP + new IPv4 hdr */
5579 		fin->fin_dlen += sizeof(ip_t) + 8;	/* UDP + old IPv4 hdr */
5580 
5581 		nflags &= ~IPN_TCPUDPICMP;
5582 
5583 		break;
5584 	    }
5585 
5586 	case NAT_DIVERTOUT :
5587 	    {
5588 		mb_t *m;
5589 
5590 		skip = ipf_nat_decap(fin, nat);
5591 		if (skip <= 0) {
5592 			NBUMPSIDED(0, ns_decap_fail);
5593 			return (-1);
5594 		}
5595 
5596 		m = fin->fin_m;
5597 
5598 #if SOLARIS && defined(_KERNEL)
5599 		m->b_rptr += skip;
5600 #else
5601 		m->m_data += skip;
5602 		m->m_len -= skip;
5603 
5604 # ifdef M_PKTHDR
5605 		if (m->m_flags & M_PKTHDR)
5606 			m->m_pkthdr.len -= skip;
5607 # endif
5608 #endif
5609 
5610 		ipf_nat_update(fin, nat);
5611 		nflags &= ~IPN_TCPUDPICMP;
5612 		fin->fin_flx |= FI_NATED;
5613 		if (np != NULL && np->in_tag.ipt_num[0] != 0)
5614 			fin->fin_nattag = &np->in_tag;
5615 		return (1);
5616 		/* NOTREACHED */
5617 	    }
5618 	}
5619 	if (nflags & IPN_TCPUDP)
5620 		tcp = fin->fin_dp;
5621 
5622 	if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5623 		u_short *csump;
5624 
5625 		if ((nat->nat_odport != 0) && (nflags & IPN_TCPUDP)) {
5626 			switch (nat->nat_dir)
5627 			{
5628 			case NAT_INBOUND :
5629 				tcp->th_sport = nat->nat_nsport;
5630 				fin->fin_data[0] = ntohs(nat->nat_nsport);
5631 				tcp->th_dport = nat->nat_ndport;
5632 				fin->fin_data[1] = ntohs(nat->nat_ndport);
5633 				break;
5634 
5635 			case NAT_OUTBOUND :
5636 				tcp->th_sport = nat->nat_odport;
5637 				fin->fin_data[0] = ntohs(nat->nat_odport);
5638 				tcp->th_dport = nat->nat_osport;
5639 				fin->fin_data[1] = ntohs(nat->nat_osport);
5640 				break;
5641 			}
5642 		}
5643 
5644 
5645 		if ((nat->nat_odport != 0) && (nflags & IPN_ICMPQUERY)) {
5646 			icmp = fin->fin_dp;
5647 
5648 			icmp->icmp_id = nat->nat_nicmpid;
5649 		}
5650 
5651 		csump = ipf_nat_proto(fin, nat, nflags);
5652 
5653 		/*
5654 		 * The above comments do not hold for layer 4 (or higher)
5655 		 * checksums...
5656 		 */
5657 		if (csump != NULL) {
5658 			if (nat->nat_dir == NAT_OUTBOUND)
5659 				ipf_fix_incksum(0, csump, nat->nat_sumd[0], 0);
5660 			else
5661 				ipf_fix_outcksum(0, csump, nat->nat_sumd[0], 0);
5662 		}
5663 	}
5664 
5665 	fin->fin_flx |= FI_NATED;
5666 	if (np != NULL && np->in_tag.ipt_num[0] != 0)
5667 		fin->fin_nattag = &np->in_tag;
5668 	return (1);
5669 }
5670 
5671 
5672 /* ------------------------------------------------------------------------ */
5673 /* Function:    ipf_nat_proto                                               */
5674 /* Returns:     u_short* - pointer to transport header checksum to update,  */
5675 /*                         NULL if the transport protocol is not recognised */
5676 /*                         as needing a checksum update.                    */
5677 /* Parameters:  fin(I)    - pointer to packet information                   */
5678 /*              nat(I)    - pointer to NAT structure                        */
5679 /*              nflags(I) - NAT flags set for this packet                   */
5680 /*                                                                          */
5681 /* Return the pointer to the checksum field for each protocol so understood.*/
5682 /* If support for making other changes to a protocol header is required,    */
5683 /* that is not strictly 'address' translation, such as clamping the MSS in  */
5684 /* TCP down to a specific value, then do it from here.                      */
5685 /* ------------------------------------------------------------------------ */
5686 u_short *
ipf_nat_proto(fr_info_t * fin,nat_t * nat,u_int nflags)5687 ipf_nat_proto(fr_info_t *fin, nat_t *nat, u_int nflags)
5688 {
5689 	icmphdr_t *icmp;
5690 	u_short *csump;
5691 	tcphdr_t *tcp;
5692 	udphdr_t *udp;
5693 
5694 	csump = NULL;
5695 	if (fin->fin_out == 0) {
5696 		fin->fin_rev = (nat->nat_dir & NAT_OUTBOUND);
5697 	} else {
5698 		fin->fin_rev = ((nat->nat_dir & NAT_OUTBOUND) == 0);
5699 	}
5700 
5701 	switch (fin->fin_p)
5702 	{
5703 	case IPPROTO_TCP :
5704 		tcp = fin->fin_dp;
5705 
5706 		if ((nflags & IPN_TCP) != 0)
5707 			csump = &tcp->th_sum;
5708 
5709 		/*
5710 		 * Do a MSS CLAMPING on a SYN packet,
5711 		 * only deal IPv4 for now.
5712 		 */
5713 		if ((nat->nat_mssclamp != 0) && (tcp_get_flags(tcp) & TH_SYN) != 0)
5714 			ipf_nat_mssclamp(tcp, nat->nat_mssclamp, fin, csump);
5715 
5716 		break;
5717 
5718 	case IPPROTO_UDP :
5719 		udp = fin->fin_dp;
5720 
5721 		if ((nflags & IPN_UDP) != 0) {
5722 			if (udp->uh_sum != 0)
5723 				csump = &udp->uh_sum;
5724 		}
5725 		break;
5726 
5727 	case IPPROTO_ICMP :
5728 		icmp = fin->fin_dp;
5729 
5730 		if ((nflags & IPN_ICMPQUERY) != 0) {
5731 			if (icmp->icmp_cksum != 0)
5732 				csump = &icmp->icmp_cksum;
5733 		}
5734 		break;
5735 
5736 #ifdef USE_INET6
5737 	case IPPROTO_ICMPV6 :
5738 	    {
5739 		struct icmp6_hdr *icmp6 = (struct icmp6_hdr *)fin->fin_dp;
5740 
5741 		icmp6 = fin->fin_dp;
5742 
5743 		if ((nflags & IPN_ICMPQUERY) != 0) {
5744 			if (icmp6->icmp6_cksum != 0)
5745 				csump = &icmp6->icmp6_cksum;
5746 		}
5747 		break;
5748 	    }
5749 #endif
5750 	}
5751 	return (csump);
5752 }
5753 
5754 
5755 /* ------------------------------------------------------------------------ */
5756 /* Function:    ipf_nat_expire                                              */
5757 /* Returns:     Nil                                                         */
5758 /* Parameters:  softc(I) - pointer to soft context main structure           */
5759 /*                                                                          */
5760 /* Check all of the timeout queues for entries at the top which need to be  */
5761 /* expired.                                                                 */
5762 /* ------------------------------------------------------------------------ */
5763 void
ipf_nat_expire(ipf_main_softc_t * softc)5764 ipf_nat_expire(ipf_main_softc_t *softc)
5765 {
5766 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5767 	ipftq_t *ifq, *ifqnext;
5768 	ipftqent_t *tqe, *tqn;
5769 	int i;
5770 	SPL_INT(s);
5771 
5772 	SPL_NET(s);
5773 	WRITE_ENTER(&softc->ipf_nat);
5774 	for (ifq = softn->ipf_nat_tcptq, i = 0; ifq != NULL;
5775 	     ifq = ifq->ifq_next) {
5776 		for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
5777 			if (tqe->tqe_die > softc->ipf_ticks)
5778 				break;
5779 			tqn = tqe->tqe_next;
5780 			ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
5781 		}
5782 	}
5783 
5784 	for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifq->ifq_next) {
5785 		for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
5786 			if (tqe->tqe_die > softc->ipf_ticks)
5787 				break;
5788 			tqn = tqe->tqe_next;
5789 			ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
5790 		}
5791 	}
5792 
5793 	for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
5794 		ifqnext = ifq->ifq_next;
5795 
5796 		if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
5797 		    (ifq->ifq_ref == 0)) {
5798 			ipf_freetimeoutqueue(softc, ifq);
5799 		}
5800 	}
5801 
5802 	if (softn->ipf_nat_doflush != 0) {
5803 		ipf_nat_extraflush(softc, softn, 2);
5804 		softn->ipf_nat_doflush = 0;
5805 	}
5806 
5807 	RWLOCK_EXIT(&softc->ipf_nat);
5808 	SPL_X(s);
5809 }
5810 
5811 
5812 /* ------------------------------------------------------------------------ */
5813 /* Function:    ipf_nat_sync                                                */
5814 /* Returns:     Nil                                                         */
5815 /* Parameters:  softc(I) - pointer to soft context main structure           */
5816 /*              ifp(I) - pointer to network interface                       */
5817 /*                                                                          */
5818 /* Walk through all of the currently active NAT sessions, looking for those */
5819 /* which need to have their translated address updated.                     */
5820 /* ------------------------------------------------------------------------ */
5821 void
ipf_nat_sync(ipf_main_softc_t * softc,void * ifp)5822 ipf_nat_sync(ipf_main_softc_t *softc, void *ifp)
5823 {
5824 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5825 	u_32_t sum1, sum2, sumd;
5826 	i6addr_t in;
5827 	ipnat_t *n;
5828 	nat_t *nat;
5829 	void *ifp2;
5830 	int idx;
5831 	SPL_INT(s);
5832 
5833 	if (softc->ipf_running <= 0)
5834 		return;
5835 
5836 	/*
5837 	 * Change IP addresses for NAT sessions for any protocol except TCP
5838 	 * since it will break the TCP connection anyway.  The only rules
5839 	 * which will get changed are those which are "map ... -> 0/32",
5840 	 * where the rule specifies the address is taken from the interface.
5841 	 */
5842 	SPL_NET(s);
5843 	WRITE_ENTER(&softc->ipf_nat);
5844 
5845 	if (softc->ipf_running <= 0) {
5846 		RWLOCK_EXIT(&softc->ipf_nat);
5847 		return;
5848 	}
5849 
5850 	for (nat = softn->ipf_nat_instances; nat; nat = nat->nat_next) {
5851 		if ((nat->nat_flags & IPN_TCP) != 0)
5852 			continue;
5853 
5854 		n = nat->nat_ptr;
5855 		if (n != NULL) {
5856 			if (n->in_v[1] == 4) {
5857 				if (n->in_redir & NAT_MAP) {
5858 					if ((n->in_nsrcaddr != 0) ||
5859 					    (n->in_nsrcmsk != 0xffffffff))
5860 						continue;
5861 				} else if (n->in_redir & NAT_REDIRECT) {
5862 					if ((n->in_ndstaddr != 0) ||
5863 					    (n->in_ndstmsk != 0xffffffff))
5864 						continue;
5865 				}
5866 			}
5867 #ifdef USE_INET6
5868 			if (n->in_v[1] == 4) {
5869 				if (n->in_redir & NAT_MAP) {
5870 					if (!IP6_ISZERO(&n->in_nsrcaddr) ||
5871 					    !IP6_ISONES(&n->in_nsrcmsk))
5872 						continue;
5873 				} else if (n->in_redir & NAT_REDIRECT) {
5874 					if (!IP6_ISZERO(&n->in_ndstaddr) ||
5875 					    !IP6_ISONES(&n->in_ndstmsk))
5876 						continue;
5877 				}
5878 			}
5879 #endif
5880 		}
5881 
5882 		if (((ifp == NULL) || (ifp == nat->nat_ifps[0]) ||
5883 		     (ifp == nat->nat_ifps[1]))) {
5884 			nat->nat_ifps[0] = GETIFP(nat->nat_ifnames[0],
5885 						  nat->nat_v[0]);
5886 			if ((nat->nat_ifps[0] != NULL) &&
5887 			    (nat->nat_ifps[0] != (void *)-1)) {
5888 				nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
5889 			}
5890 			if (nat->nat_ifnames[1][0] != '\0') {
5891 				nat->nat_ifps[1] = GETIFP(nat->nat_ifnames[1],
5892 							  nat->nat_v[1]);
5893 			} else {
5894 				nat->nat_ifps[1] = nat->nat_ifps[0];
5895 			}
5896 			if ((nat->nat_ifps[1] != NULL) &&
5897 			    (nat->nat_ifps[1] != (void *)-1)) {
5898 				nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
5899 			}
5900 			ifp2 = nat->nat_ifps[0];
5901 			if (ifp2 == NULL)
5902 				continue;
5903 
5904 			/*
5905 			 * Change the map-to address to be the same as the
5906 			 * new one.
5907 			 */
5908 			sum1 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
5909 			if (ipf_ifpaddr(softc, nat->nat_v[0], FRI_NORMAL, ifp2,
5910 				       &in, NULL) != -1) {
5911 				if (nat->nat_v[0] == 4)
5912 					nat->nat_nsrcip = in.in4;
5913 			}
5914 			sum2 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
5915 
5916 			if (sum1 == sum2)
5917 				continue;
5918 			/*
5919 			 * Readjust the checksum adjustment to take into
5920 			 * account the new IP#.
5921 			 */
5922 			CALC_SUMD(sum1, sum2, sumd);
5923 			/* XXX - dont change for TCP when solaris does
5924 			 * hardware checksumming.
5925 			 */
5926 			sumd += nat->nat_sumd[0];
5927 			nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
5928 			nat->nat_sumd[1] = nat->nat_sumd[0];
5929 		}
5930 	}
5931 
5932 	for (n = softn->ipf_nat_list; (n != NULL); n = n->in_next) {
5933 		char *base = n->in_names;
5934 
5935 		if ((ifp == NULL) || (n->in_ifps[0] == ifp))
5936 			n->in_ifps[0] = ipf_resolvenic(softc,
5937 						       base + n->in_ifnames[0],
5938 						       n->in_v[0]);
5939 		if ((ifp == NULL) || (n->in_ifps[1] == ifp))
5940 			n->in_ifps[1] = ipf_resolvenic(softc,
5941 						       base + n->in_ifnames[1],
5942 						       n->in_v[1]);
5943 
5944 		if (n->in_redir & NAT_REDIRECT)
5945 			idx = 1;
5946 		else
5947 			idx = 0;
5948 
5949 		if (((ifp == NULL) || (n->in_ifps[idx] == ifp)) &&
5950 		    (n->in_ifps[idx] != NULL &&
5951 		     n->in_ifps[idx] != (void *)-1)) {
5952 
5953 			ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc,
5954 					     0, n->in_ifps[idx]);
5955 			ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst,
5956 					     0, n->in_ifps[idx]);
5957 			ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc,
5958 					     0, n->in_ifps[idx]);
5959 			ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst,
5960 					     0, n->in_ifps[idx]);
5961 		}
5962 	}
5963 	RWLOCK_EXIT(&softc->ipf_nat);
5964 	SPL_X(s);
5965 }
5966 
5967 
5968 /* ------------------------------------------------------------------------ */
5969 /* Function:    ipf_nat_icmpquerytype                                       */
5970 /* Returns:     int - 1 == success, 0 == failure                            */
5971 /* Parameters:  icmptype(I) - ICMP type number                              */
5972 /*                                                                          */
5973 /* Tests to see if the ICMP type number passed is a query/response type or  */
5974 /* not.                                                                     */
5975 /* ------------------------------------------------------------------------ */
5976 static int
ipf_nat_icmpquerytype(int icmptype)5977 ipf_nat_icmpquerytype(int icmptype)
5978 {
5979 
5980 	/*
5981 	 * For the ICMP query NAT code, it is essential that both the query
5982 	 * and the reply match on the NAT rule. Because the NAT structure
5983 	 * does not keep track of the icmptype, and a single NAT structure
5984 	 * is used for all icmp types with the same src, dest and id, we
5985 	 * simply define the replies as queries as well. The funny thing is,
5986 	 * altough it seems silly to call a reply a query, this is exactly
5987 	 * as it is defined in the IPv4 specification
5988 	 */
5989 	switch (icmptype)
5990 	{
5991 	case ICMP_ECHOREPLY:
5992 	case ICMP_ECHO:
5993 	/* route advertisement/solicitation is currently unsupported: */
5994 	/* it would require rewriting the ICMP data section          */
5995 	case ICMP_TSTAMP:
5996 	case ICMP_TSTAMPREPLY:
5997 	case ICMP_IREQ:
5998 	case ICMP_IREQREPLY:
5999 	case ICMP_MASKREQ:
6000 	case ICMP_MASKREPLY:
6001 		return (1);
6002 	default:
6003 		return (0);
6004 	}
6005 }
6006 
6007 
6008 /* ------------------------------------------------------------------------ */
6009 /* Function:    nat_log                                                     */
6010 /* Returns:     Nil                                                         */
6011 /* Parameters:  softc(I) - pointer to soft context main structure           */
6012 /*              softn(I) - pointer to NAT context structure                 */
6013 /*              nat(I)    - pointer to NAT structure                        */
6014 /*              action(I) - action related to NAT structure being performed */
6015 /*                                                                          */
6016 /* Creates a NAT log entry.                                                 */
6017 /* ------------------------------------------------------------------------ */
6018 void
ipf_nat_log(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,struct nat * nat,u_int action)6019 ipf_nat_log(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, struct nat *nat,
6020 	u_int action)
6021 {
6022 #ifdef	IPFILTER_LOG
6023 	struct ipnat *np;
6024 	int rulen;
6025 	struct natlog natl;
6026 	void *items[1];
6027 	size_t sizes[1];
6028 	int types[1];
6029 
6030 	bcopy((char *)&nat->nat_osrc6, (char *)&natl.nl_osrcip,
6031 	      sizeof(natl.nl_osrcip));
6032 	bcopy((char *)&nat->nat_nsrc6, (char *)&natl.nl_nsrcip,
6033 	      sizeof(natl.nl_nsrcip));
6034 	bcopy((char *)&nat->nat_odst6, (char *)&natl.nl_odstip,
6035 	      sizeof(natl.nl_odstip));
6036 	bcopy((char *)&nat->nat_ndst6, (char *)&natl.nl_ndstip,
6037 	      sizeof(natl.nl_ndstip));
6038 
6039 	natl.nl_bytes[0] = nat->nat_bytes[0];
6040 	natl.nl_bytes[1] = nat->nat_bytes[1];
6041 	natl.nl_pkts[0] = nat->nat_pkts[0];
6042 	natl.nl_pkts[1] = nat->nat_pkts[1];
6043 	natl.nl_odstport = nat->nat_odport;
6044 	natl.nl_osrcport = nat->nat_osport;
6045 	natl.nl_nsrcport = nat->nat_nsport;
6046 	natl.nl_ndstport = nat->nat_ndport;
6047 	natl.nl_p[0] = nat->nat_pr[0];
6048 	natl.nl_p[1] = nat->nat_pr[1];
6049 	natl.nl_v[0] = nat->nat_v[0];
6050 	natl.nl_v[1] = nat->nat_v[1];
6051 	natl.nl_type = nat->nat_redir;
6052 	natl.nl_action = action;
6053 	natl.nl_rule = -1;
6054 
6055 	bcopy(nat->nat_ifnames[0], natl.nl_ifnames[0],
6056 	      sizeof(nat->nat_ifnames[0]));
6057 	bcopy(nat->nat_ifnames[1], natl.nl_ifnames[1],
6058 	      sizeof(nat->nat_ifnames[1]));
6059 
6060 	if (softc->ipf_large_nat && nat->nat_ptr != NULL) {
6061 		for (rulen = 0, np = softn->ipf_nat_list; np != NULL;
6062 		     np = np->in_next, rulen++)
6063 			if (np == nat->nat_ptr) {
6064 				natl.nl_rule = rulen;
6065 				break;
6066 			}
6067 	}
6068 	items[0] = &natl;
6069 	sizes[0] = sizeof(natl);
6070 	types[0] = 0;
6071 
6072 	(void) ipf_log_items(softc, IPL_LOGNAT, NULL, items, sizes, types, 1);
6073 #endif
6074 }
6075 
6076 
6077 
6078 
6079 /* ------------------------------------------------------------------------ */
6080 /* Function:    ipf_nat_rule_deref                                          */
6081 /* Returns:     Nil                                                         */
6082 /* Parameters:  softc(I) - pointer to soft context main structure           */
6083 /*              inp(I)   - pointer to pointer to NAT rule                   */
6084 /* Write Locks: ipf_nat                                                     */
6085 /*                                                                          */
6086 /* Dropping the refernce count for a rule means that whatever held the      */
6087 /* pointer to this rule (*inp) is no longer interested in it and when the   */
6088 /* reference count drops to zero, any resources allocated for the rule can  */
6089 /* be released and the rule itself free'd.                                  */
6090 /* ------------------------------------------------------------------------ */
6091 void
ipf_nat_rule_deref(ipf_main_softc_t * softc,ipnat_t ** inp)6092 ipf_nat_rule_deref(ipf_main_softc_t *softc, ipnat_t **inp)
6093 {
6094 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6095 	ipnat_t *n;
6096 
6097 	n = *inp;
6098 	*inp = NULL;
6099 	n->in_use--;
6100 	if (n->in_use > 0)
6101 		return;
6102 
6103 	if (n->in_apr != NULL)
6104 		ipf_proxy_deref(n->in_apr);
6105 
6106 	ipf_nat_rule_fini(softc, n);
6107 
6108 	if (n->in_redir & NAT_REDIRECT) {
6109 		if ((n->in_flags & IPN_PROXYRULE) == 0) {
6110 			ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_rdr);
6111 		}
6112 	}
6113 	if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
6114 		if ((n->in_flags & IPN_PROXYRULE) == 0) {
6115 			ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_map);
6116 		}
6117 	}
6118 
6119 	if (n->in_tqehead[0] != NULL) {
6120 		if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
6121 			ipf_freetimeoutqueue(softc, n->in_tqehead[0]);
6122 		}
6123 	}
6124 
6125 	if (n->in_tqehead[1] != NULL) {
6126 		if (ipf_deletetimeoutqueue(n->in_tqehead[1]) == 0) {
6127 			ipf_freetimeoutqueue(softc, n->in_tqehead[1]);
6128 		}
6129 	}
6130 
6131 	if ((n->in_flags & IPN_PROXYRULE) == 0) {
6132 		ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules);
6133 	}
6134 
6135 	MUTEX_DESTROY(&n->in_lock);
6136 
6137 	KFREES(n, n->in_size);
6138 
6139 #if SOLARIS && !defined(INSTANCES)
6140 	if (softn->ipf_nat_stats.ns_rules == 0)
6141 		pfil_delayed_copy = 1;
6142 #endif
6143 }
6144 
6145 
6146 /* ------------------------------------------------------------------------ */
6147 /* Function:    ipf_nat_deref                                               */
6148 /* Returns:     Nil                                                         */
6149 /* Parameters:  softc(I) - pointer to soft context main structure           */
6150 /*              natp(I)  - pointer to pointer to NAT table entry            */
6151 /*                                                                          */
6152 /* Decrement the reference counter for this NAT table entry and free it if  */
6153 /* there are no more things using it.                                       */
6154 /*                                                                          */
6155 /* IF nat_ref == 1 when this function is called, then we have an orphan nat */
6156 /* structure *because* it only gets called on paths _after_ nat_ref has been*/
6157 /* incremented.  If nat_ref == 1 then we shouldn't decrement it here        */
6158 /* because nat_delete() will do that and send nat_ref to -1.                */
6159 /*                                                                          */
6160 /* Holding the lock on nat_lock is required to serialise nat_delete() being */
6161 /* called from a NAT flush ioctl with a deref happening because of a packet.*/
6162 /* ------------------------------------------------------------------------ */
6163 void
ipf_nat_deref(ipf_main_softc_t * softc,nat_t ** natp)6164 ipf_nat_deref(ipf_main_softc_t *softc, nat_t **natp)
6165 {
6166 	nat_t *nat;
6167 
6168 	nat = *natp;
6169 	*natp = NULL;
6170 
6171 	MUTEX_ENTER(&nat->nat_lock);
6172 	if (nat->nat_ref > 1) {
6173 		nat->nat_ref--;
6174 		ASSERT(nat->nat_ref >= 0);
6175 		MUTEX_EXIT(&nat->nat_lock);
6176 		return;
6177 	}
6178 	MUTEX_EXIT(&nat->nat_lock);
6179 
6180 	WRITE_ENTER(&softc->ipf_nat);
6181 	ipf_nat_delete(softc, nat, NL_EXPIRE);
6182 	RWLOCK_EXIT(&softc->ipf_nat);
6183 }
6184 
6185 
6186 /* ------------------------------------------------------------------------ */
6187 /* Function:    ipf_nat_clone                                               */
6188 /* Returns:     ipstate_t* - NULL == cloning failed,                        */
6189 /*                           else pointer to new state structure            */
6190 /* Parameters:  fin(I) - pointer to packet information                      */
6191 /*              is(I)  - pointer to master state structure                  */
6192 /* Write Lock:  ipf_nat                                                     */
6193 /*                                                                          */
6194 /* Create a "duplcate" state table entry from the master.                   */
6195 /* ------------------------------------------------------------------------ */
6196 nat_t *
ipf_nat_clone(fr_info_t * fin,nat_t * nat)6197 ipf_nat_clone(fr_info_t *fin, nat_t *nat)
6198 {
6199 	ipf_main_softc_t *softc = fin->fin_main_soft;
6200 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6201 	frentry_t *fr;
6202 	nat_t *clone;
6203 	ipnat_t *np;
6204 
6205 	KMALLOC(clone, nat_t *);
6206 	if (clone == NULL) {
6207 		NBUMPSIDED(fin->fin_out, ns_clone_nomem);
6208 		return (NULL);
6209 	}
6210 	bcopy((char *)nat, (char *)clone, sizeof(*clone));
6211 
6212 	MUTEX_NUKE(&clone->nat_lock);
6213 
6214 	clone->nat_rev = fin->fin_rev;
6215 	clone->nat_aps = NULL;
6216 	/*
6217 	 * Initialize all these so that ipf_nat_delete() doesn't cause a crash.
6218 	 */
6219 	clone->nat_tqe.tqe_pnext = NULL;
6220 	clone->nat_tqe.tqe_next = NULL;
6221 	clone->nat_tqe.tqe_ifq = NULL;
6222 	clone->nat_tqe.tqe_parent = clone;
6223 
6224 	clone->nat_flags &= ~SI_CLONE;
6225 	clone->nat_flags |= SI_CLONED;
6226 
6227 	if (clone->nat_hm)
6228 		clone->nat_hm->hm_ref++;
6229 
6230 	if (ipf_nat_insert(softc, softn, clone) == -1) {
6231 		KFREE(clone);
6232 		NBUMPSIDED(fin->fin_out, ns_insert_fail);
6233 		return (NULL);
6234 	}
6235 
6236 	np = clone->nat_ptr;
6237 	if (np != NULL) {
6238 		if (softn->ipf_nat_logging)
6239 			ipf_nat_log(softc, softn, clone, NL_CLONE);
6240 		np->in_use++;
6241 	}
6242 	fr = clone->nat_fr;
6243 	if (fr != NULL) {
6244 		MUTEX_ENTER(&fr->fr_lock);
6245 		fr->fr_ref++;
6246 		MUTEX_EXIT(&fr->fr_lock);
6247 	}
6248 
6249 
6250 	/*
6251 	 * Because the clone is created outside the normal loop of things and
6252 	 * TCP has special needs in terms of state, initialise the timeout
6253 	 * state of the new NAT from here.
6254 	 */
6255 	if (clone->nat_pr[0] == IPPROTO_TCP) {
6256 		(void) ipf_tcp_age(&clone->nat_tqe, fin, softn->ipf_nat_tcptq,
6257 				   clone->nat_flags, 2);
6258 	}
6259 	clone->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, clone);
6260 	if (softn->ipf_nat_logging)
6261 		ipf_nat_log(softc, softn, clone, NL_CLONE);
6262 	return (clone);
6263 }
6264 
6265 
6266 /* ------------------------------------------------------------------------ */
6267 /* Function:   ipf_nat_wildok                                               */
6268 /* Returns:    int - 1 == packet's ports match wildcards                    */
6269 /*                   0 == packet's ports don't match wildcards              */
6270 /* Parameters: nat(I)   - NAT entry                                         */
6271 /*             sport(I) - source port                                       */
6272 /*             dport(I) - destination port                                  */
6273 /*             flags(I) - wildcard flags                                    */
6274 /*             dir(I)   - packet direction                                  */
6275 /*                                                                          */
6276 /* Use NAT entry and packet direction to determine which combination of     */
6277 /* wildcard flags should be used.                                           */
6278 /* ------------------------------------------------------------------------ */
6279 int
ipf_nat_wildok(nat_t * nat,int sport,int dport,int flags,int dir)6280 ipf_nat_wildok(nat_t *nat, int sport, int dport, int flags, int dir)
6281 {
6282 	/*
6283 	 * When called by       dir is set to
6284 	 * nat_inlookup         NAT_INBOUND (0)
6285 	 * nat_outlookup        NAT_OUTBOUND (1)
6286 	 *
6287 	 * We simply combine the packet's direction in dir with the original
6288 	 * "intended" direction of that NAT entry in nat->nat_dir to decide
6289 	 * which combination of wildcard flags to allow.
6290 	 */
6291 	switch ((dir << 1) | (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND)))
6292 	{
6293 	case 3: /* outbound packet / outbound entry */
6294 		if (((nat->nat_osport == sport) ||
6295 		    (flags & SI_W_SPORT)) &&
6296 		    ((nat->nat_odport == dport) ||
6297 		    (flags & SI_W_DPORT)))
6298 			return (1);
6299 		break;
6300 	case 2: /* outbound packet / inbound entry */
6301 		if (((nat->nat_osport == dport) ||
6302 		    (flags & SI_W_SPORT)) &&
6303 		    ((nat->nat_odport == sport) ||
6304 		    (flags & SI_W_DPORT)))
6305 			return (1);
6306 		break;
6307 	case 1: /* inbound packet / outbound entry */
6308 		if (((nat->nat_osport == dport) ||
6309 		    (flags & SI_W_SPORT)) &&
6310 		    ((nat->nat_odport == sport) ||
6311 		    (flags & SI_W_DPORT)))
6312 			return (1);
6313 		break;
6314 	case 0: /* inbound packet / inbound entry */
6315 		if (((nat->nat_osport == sport) ||
6316 		    (flags & SI_W_SPORT)) &&
6317 		    ((nat->nat_odport == dport) ||
6318 		    (flags & SI_W_DPORT)))
6319 			return (1);
6320 		break;
6321 	default:
6322 		break;
6323 	}
6324 
6325 	return (0);
6326 }
6327 
6328 
6329 /* ------------------------------------------------------------------------ */
6330 /* Function:    nat_mssclamp                                                */
6331 /* Returns:     Nil                                                         */
6332 /* Parameters:  tcp(I)    - pointer to TCP header                           */
6333 /*              maxmss(I) - value to clamp the TCP MSS to                   */
6334 /*              fin(I)    - pointer to packet information                   */
6335 /*              csump(I)  - pointer to TCP checksum                         */
6336 /*                                                                          */
6337 /* Check for MSS option and clamp it if necessary.  If found and changed,   */
6338 /* then the TCP header checksum will be updated to reflect the change in    */
6339 /* the MSS.                                                                 */
6340 /* ------------------------------------------------------------------------ */
6341 static void
ipf_nat_mssclamp(tcphdr_t * tcp,u_32_t maxmss,fr_info_t * fin,u_short * csump)6342 ipf_nat_mssclamp(tcphdr_t *tcp, u_32_t maxmss, fr_info_t *fin, u_short *csump)
6343 {
6344 	u_char *cp, *ep, opt;
6345 	int hlen, advance;
6346 	u_32_t mss, sumd;
6347 
6348 	hlen = TCP_OFF(tcp) << 2;
6349 	if (hlen > sizeof(*tcp)) {
6350 		cp = (u_char *)tcp + sizeof(*tcp);
6351 		ep = (u_char *)tcp + hlen;
6352 
6353 		while (cp < ep) {
6354 			opt = cp[0];
6355 			if (opt == TCPOPT_EOL)
6356 				break;
6357 			else if (opt == TCPOPT_NOP) {
6358 				cp++;
6359 				continue;
6360 			}
6361 
6362 			if (cp + 1 >= ep)
6363 				break;
6364 			advance = cp[1];
6365 			if ((cp + advance > ep) || (advance <= 0))
6366 				break;
6367 			switch (opt)
6368 			{
6369 			case TCPOPT_MAXSEG:
6370 				if (advance != 4)
6371 					break;
6372 				mss = cp[2] * 256 + cp[3];
6373 				if (mss > maxmss) {
6374 					cp[2] = maxmss / 256;
6375 					cp[3] = maxmss & 0xff;
6376 					CALC_SUMD(mss, maxmss, sumd);
6377 					ipf_fix_outcksum(0, csump, sumd, 0);
6378 				}
6379 				break;
6380 			default:
6381 				/* ignore unknown options */
6382 				break;
6383 			}
6384 
6385 			cp += advance;
6386 		}
6387 	}
6388 }
6389 
6390 
6391 /* ------------------------------------------------------------------------ */
6392 /* Function:    ipf_nat_setqueue                                            */
6393 /* Returns:     Nil                                                         */
6394 /* Parameters:  softc(I) - pointer to soft context main structure           */
6395 /*              softn(I) - pointer to NAT context structure                 */
6396 /*              nat(I)- pointer to NAT structure                            */
6397 /* Locks:       ipf_nat (read or write)                                     */
6398 /*                                                                          */
6399 /* Put the NAT entry on its default queue entry, using rev as a helped in   */
6400 /* determining which queue it should be placed on.                          */
6401 /* ------------------------------------------------------------------------ */
6402 void
ipf_nat_setqueue(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,nat_t * nat)6403 ipf_nat_setqueue(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, nat_t *nat)
6404 {
6405 	ipftq_t *oifq, *nifq;
6406 	int rev = nat->nat_rev;
6407 
6408 	if (nat->nat_ptr != NULL)
6409 		nifq = nat->nat_ptr->in_tqehead[rev];
6410 	else
6411 		nifq = NULL;
6412 
6413 	if (nifq == NULL) {
6414 		switch (nat->nat_pr[0])
6415 		{
6416 		case IPPROTO_UDP :
6417 			nifq = &softn->ipf_nat_udptq;
6418 			break;
6419 		case IPPROTO_ICMP :
6420 			nifq = &softn->ipf_nat_icmptq;
6421 			break;
6422 		case IPPROTO_TCP :
6423 			nifq = softn->ipf_nat_tcptq +
6424 			       nat->nat_tqe.tqe_state[rev];
6425 			break;
6426 		default :
6427 			nifq = &softn->ipf_nat_iptq;
6428 			break;
6429 		}
6430 	}
6431 
6432 	oifq = nat->nat_tqe.tqe_ifq;
6433 	/*
6434 	 * If it's currently on a timeout queue, move it from one queue to
6435 	 * another, else put it on the end of the newly determined queue.
6436 	 */
6437 	if (oifq != NULL)
6438 		ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq, nifq);
6439 	else
6440 		ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe, nifq, nat);
6441 	return;
6442 }
6443 
6444 
6445 /* ------------------------------------------------------------------------ */
6446 /* Function:    nat_getnext                                                 */
6447 /* Returns:     int - 0 == ok, else error                                   */
6448 /* Parameters:  softc(I) - pointer to soft context main structure           */
6449 /*              t(I)   - pointer to ipftoken structure                      */
6450 /*              itp(I) - pointer to ipfgeniter_t structure                  */
6451 /*                                                                          */
6452 /* Fetch the next nat/ipnat structure pointer from the linked list and      */
6453 /* copy it out to the storage space pointed to by itp_data.  The next item  */
6454 /* in the list to look at is put back in the ipftoken struture.             */
6455 /* ------------------------------------------------------------------------ */
6456 static int
ipf_nat_getnext(ipf_main_softc_t * softc,ipftoken_t * t,ipfgeniter_t * itp,ipfobj_t * objp)6457 ipf_nat_getnext(ipf_main_softc_t *softc, ipftoken_t *t, ipfgeniter_t *itp,
6458 	ipfobj_t *objp)
6459 {
6460 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6461 	hostmap_t *hm, *nexthm = NULL, zerohm;
6462 	ipnat_t *ipn, *nextipnat = NULL, zeroipn;
6463 	nat_t *nat, *nextnat = NULL, zeronat;
6464 	int error = 0;
6465 	void *nnext;
6466 
6467 	if (itp->igi_nitems != 1) {
6468 		IPFERROR(60075);
6469 		return (ENOSPC);
6470 	}
6471 
6472 	READ_ENTER(&softc->ipf_nat);
6473 
6474 	switch (itp->igi_type)
6475 	{
6476 	case IPFGENITER_HOSTMAP :
6477 		hm = t->ipt_data;
6478 		if (hm == NULL) {
6479 			nexthm = softn->ipf_hm_maplist;
6480 		} else {
6481 			nexthm = hm->hm_next;
6482 		}
6483 		if (nexthm != NULL) {
6484 			ATOMIC_INC32(nexthm->hm_ref);
6485 			t->ipt_data = nexthm;
6486 		} else {
6487 			bzero(&zerohm, sizeof(zerohm));
6488 			nexthm = &zerohm;
6489 			t->ipt_data = NULL;
6490 		}
6491 		nnext = nexthm->hm_next;
6492 		break;
6493 
6494 	case IPFGENITER_IPNAT :
6495 		ipn = t->ipt_data;
6496 		if (ipn == NULL) {
6497 			nextipnat = softn->ipf_nat_list;
6498 		} else {
6499 			nextipnat = ipn->in_next;
6500 		}
6501 		if (nextipnat != NULL) {
6502 			ATOMIC_INC32(nextipnat->in_use);
6503 			t->ipt_data = nextipnat;
6504 		} else {
6505 			bzero(&zeroipn, sizeof(zeroipn));
6506 			nextipnat = &zeroipn;
6507 			t->ipt_data = NULL;
6508 		}
6509 		nnext = nextipnat->in_next;
6510 		break;
6511 
6512 	case IPFGENITER_NAT :
6513 		nat = t->ipt_data;
6514 		if (nat == NULL) {
6515 			nextnat = softn->ipf_nat_instances;
6516 		} else {
6517 			nextnat = nat->nat_next;
6518 		}
6519 		if (nextnat != NULL) {
6520 			MUTEX_ENTER(&nextnat->nat_lock);
6521 			nextnat->nat_ref++;
6522 			MUTEX_EXIT(&nextnat->nat_lock);
6523 			t->ipt_data = nextnat;
6524 		} else {
6525 			bzero(&zeronat, sizeof(zeronat));
6526 			nextnat = &zeronat;
6527 			t->ipt_data = NULL;
6528 		}
6529 		nnext = nextnat->nat_next;
6530 		break;
6531 
6532 	default :
6533 		RWLOCK_EXIT(&softc->ipf_nat);
6534 		IPFERROR(60055);
6535 		return (EINVAL);
6536 	}
6537 
6538 	RWLOCK_EXIT(&softc->ipf_nat);
6539 
6540 	objp->ipfo_ptr = itp->igi_data;
6541 
6542 	switch (itp->igi_type)
6543 	{
6544 	case IPFGENITER_HOSTMAP :
6545 		error = COPYOUT(nexthm, objp->ipfo_ptr, sizeof(*nexthm));
6546 		if (error != 0) {
6547 			IPFERROR(60049);
6548 			error = EFAULT;
6549 		}
6550 		if (hm != NULL) {
6551 			WRITE_ENTER(&softc->ipf_nat);
6552 			ipf_nat_hostmapdel(softc, &hm);
6553 			RWLOCK_EXIT(&softc->ipf_nat);
6554 		}
6555 		break;
6556 
6557 	case IPFGENITER_IPNAT :
6558 		objp->ipfo_size = nextipnat->in_size;
6559 		objp->ipfo_type = IPFOBJ_IPNAT;
6560 		error = ipf_outobjk(softc, objp, nextipnat);
6561 		if (ipn != NULL) {
6562 			WRITE_ENTER(&softc->ipf_nat);
6563 			ipf_nat_rule_deref(softc, &ipn);
6564 			RWLOCK_EXIT(&softc->ipf_nat);
6565 		}
6566 		break;
6567 
6568 	case IPFGENITER_NAT :
6569 		objp->ipfo_size = sizeof(nat_t);
6570 		objp->ipfo_type = IPFOBJ_NAT;
6571 		error = ipf_outobjk(softc, objp, nextnat);
6572 		if (nat != NULL)
6573 			ipf_nat_deref(softc, &nat);
6574 
6575 		break;
6576 	}
6577 
6578 	if (nnext == NULL)
6579 		ipf_token_mark_complete(t);
6580 
6581 	return (error);
6582 }
6583 
6584 
6585 /* ------------------------------------------------------------------------ */
6586 /* Function:    nat_extraflush                                              */
6587 /* Returns:     int - 0 == success, -1 == failure                           */
6588 /* Parameters:  softc(I) - pointer to soft context main structure           */
6589 /*              softn(I) - pointer to NAT context structure                 */
6590 /*              which(I) - how to flush the active NAT table                */
6591 /* Write Locks: ipf_nat                                                     */
6592 /*                                                                          */
6593 /* Flush nat tables.  Three actions currently defined:                      */
6594 /* which == 0 : flush all nat table entries                                 */
6595 /* which == 1 : flush TCP connections which have started to close but are   */
6596 /*	      stuck for some reason.                                        */
6597 /* which == 2 : flush TCP connections which have been idle for a long time, */
6598 /*	      starting at > 4 days idle and working back in successive half-*/
6599 /*	      days to at most 12 hours old.  If this fails to free enough   */
6600 /*            slots then work backwards in half hour slots to 30 minutes.   */
6601 /*            If that too fails, then work backwards in 30 second intervals */
6602 /*            for the last 30 minutes to at worst 30 seconds idle.          */
6603 /* ------------------------------------------------------------------------ */
6604 static int
ipf_nat_extraflush(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,int which)6605 ipf_nat_extraflush(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, int which)
6606 {
6607 	nat_t *nat, **natp;
6608 	ipftqent_t *tqn;
6609 	ipftq_t *ifq;
6610 	int removed;
6611 	SPL_INT(s);
6612 
6613 	removed = 0;
6614 
6615 	SPL_NET(s);
6616 	switch (which)
6617 	{
6618 	case 0 :
6619 		softn->ipf_nat_stats.ns_flush_all++;
6620 		/*
6621 		 * Style 0 flush removes everything...
6622 		 */
6623 		for (natp = &softn->ipf_nat_instances;
6624 		     ((nat = *natp) != NULL); ) {
6625 			ipf_nat_delete(softc, nat, NL_FLUSH);
6626 			removed++;
6627 		}
6628 		break;
6629 
6630 	case 1 :
6631 		softn->ipf_nat_stats.ns_flush_closing++;
6632 		/*
6633 		 * Since we're only interested in things that are closing,
6634 		 * we can start with the appropriate timeout queue.
6635 		 */
6636 		for (ifq = softn->ipf_nat_tcptq + IPF_TCPS_CLOSE_WAIT;
6637 		     ifq != NULL; ifq = ifq->ifq_next) {
6638 
6639 			for (tqn = ifq->ifq_head; tqn != NULL; ) {
6640 				nat = tqn->tqe_parent;
6641 				tqn = tqn->tqe_next;
6642 				if (nat->nat_pr[0] != IPPROTO_TCP ||
6643 				    nat->nat_pr[1] != IPPROTO_TCP)
6644 					break;
6645 				ipf_nat_delete(softc, nat, NL_EXPIRE);
6646 				removed++;
6647 			}
6648 		}
6649 
6650 		/*
6651 		 * Also need to look through the user defined queues.
6652 		 */
6653 		for (ifq = softn->ipf_nat_utqe; ifq != NULL;
6654 		     ifq = ifq->ifq_next) {
6655 			for (tqn = ifq->ifq_head; tqn != NULL; ) {
6656 				nat = tqn->tqe_parent;
6657 				tqn = tqn->tqe_next;
6658 				if (nat->nat_pr[0] != IPPROTO_TCP ||
6659 				    nat->nat_pr[1] != IPPROTO_TCP)
6660 					continue;
6661 
6662 				if ((nat->nat_tcpstate[0] >
6663 				     IPF_TCPS_ESTABLISHED) &&
6664 				    (nat->nat_tcpstate[1] >
6665 				     IPF_TCPS_ESTABLISHED)) {
6666 					ipf_nat_delete(softc, nat, NL_EXPIRE);
6667 					removed++;
6668 				}
6669 			}
6670 		}
6671 		break;
6672 
6673 		/*
6674 		 * Args 5-11 correspond to flushing those particular states
6675 		 * for TCP connections.
6676 		 */
6677 	case IPF_TCPS_CLOSE_WAIT :
6678 	case IPF_TCPS_FIN_WAIT_1 :
6679 	case IPF_TCPS_CLOSING :
6680 	case IPF_TCPS_LAST_ACK :
6681 	case IPF_TCPS_FIN_WAIT_2 :
6682 	case IPF_TCPS_TIME_WAIT :
6683 	case IPF_TCPS_CLOSED :
6684 		softn->ipf_nat_stats.ns_flush_state++;
6685 		tqn = softn->ipf_nat_tcptq[which].ifq_head;
6686 		while (tqn != NULL) {
6687 			nat = tqn->tqe_parent;
6688 			tqn = tqn->tqe_next;
6689 			ipf_nat_delete(softc, nat, NL_FLUSH);
6690 			removed++;
6691 		}
6692 		break;
6693 
6694 	default :
6695 		if (which < 30)
6696 			break;
6697 
6698 		softn->ipf_nat_stats.ns_flush_timeout++;
6699 		/*
6700 		 * Take a large arbitrary number to mean the number of seconds
6701 		 * for which which consider to be the maximum value we'll allow
6702 		 * the expiration to be.
6703 		 */
6704 		which = IPF_TTLVAL(which);
6705 		for (natp = &softn->ipf_nat_instances;
6706 		     ((nat = *natp) != NULL); ) {
6707 			if (softc->ipf_ticks - nat->nat_touched > which) {
6708 				ipf_nat_delete(softc, nat, NL_FLUSH);
6709 				removed++;
6710 			} else
6711 				natp = &nat->nat_next;
6712 		}
6713 		break;
6714 	}
6715 
6716 	if (which != 2) {
6717 		SPL_X(s);
6718 		return (removed);
6719 	}
6720 
6721 	softn->ipf_nat_stats.ns_flush_queue++;
6722 
6723 	/*
6724 	 * Asked to remove inactive entries because the table is full, try
6725 	 * again, 3 times, if first attempt failed with a different criteria
6726 	 * each time.  The order tried in must be in decreasing age.
6727 	 * Another alternative is to implement random drop and drop N entries
6728 	 * at random until N have been freed up.
6729 	 */
6730 	if (softc->ipf_ticks - softn->ipf_nat_last_force_flush >
6731 	    IPF_TTLVAL(5)) {
6732 		softn->ipf_nat_last_force_flush = softc->ipf_ticks;
6733 
6734 		removed = ipf_queueflush(softc, ipf_nat_flush_entry,
6735 					 softn->ipf_nat_tcptq,
6736 					 softn->ipf_nat_utqe,
6737 					 &softn->ipf_nat_stats.ns_active,
6738 					 softn->ipf_nat_table_sz,
6739 					 softn->ipf_nat_table_wm_low);
6740 	}
6741 
6742 	SPL_X(s);
6743 	return (removed);
6744 }
6745 
6746 
6747 /* ------------------------------------------------------------------------ */
6748 /* Function:    ipf_nat_flush_entry                                         */
6749 /* Returns:     0 - always succeeds                                         */
6750 /* Parameters:  softc(I) - pointer to soft context main structure           */
6751 /*              entry(I) - pointer to NAT entry                             */
6752 /* Write Locks: ipf_nat                                                     */
6753 /*                                                                          */
6754 /* This function is a stepping stone between ipf_queueflush() and           */
6755 /* nat_dlete().  It is used so we can provide a uniform interface via the   */
6756 /* ipf_queueflush() function.  Since the nat_delete() function returns void */
6757 /* we translate that to mean it always succeeds in deleting something.      */
6758 /* ------------------------------------------------------------------------ */
6759 static int
ipf_nat_flush_entry(ipf_main_softc_t * softc,void * entry)6760 ipf_nat_flush_entry(ipf_main_softc_t *softc, void *entry)
6761 {
6762 	ipf_nat_delete(softc, entry, NL_FLUSH);
6763 	return (0);
6764 }
6765 
6766 
6767 /* ------------------------------------------------------------------------ */
6768 /* Function:    ipf_nat_iterator                                            */
6769 /* Returns:     int - 0 == ok, else error                                   */
6770 /* Parameters:  softc(I) - pointer to soft context main structure           */
6771 /*              token(I) - pointer to ipftoken structure                    */
6772 /*              itp(I)   - pointer to ipfgeniter_t structure                */
6773 /*              obj(I)   - pointer to data description structure            */
6774 /*                                                                          */
6775 /* This function acts as a handler for the SIOCGENITER ioctls that use a    */
6776 /* generic structure to iterate through a list.  There are three different  */
6777 /* linked lists of NAT related information to go through: NAT rules, active */
6778 /* NAT mappings and the NAT fragment cache.                                 */
6779 /* ------------------------------------------------------------------------ */
6780 static int
ipf_nat_iterator(ipf_main_softc_t * softc,ipftoken_t * token,ipfgeniter_t * itp,ipfobj_t * obj)6781 ipf_nat_iterator(ipf_main_softc_t *softc, ipftoken_t *token, ipfgeniter_t *itp,
6782 	ipfobj_t *obj)
6783 {
6784 	int error;
6785 
6786 	if (itp->igi_data == NULL) {
6787 		IPFERROR(60052);
6788 		return (EFAULT);
6789 	}
6790 
6791 	switch (itp->igi_type)
6792 	{
6793 	case IPFGENITER_HOSTMAP :
6794 	case IPFGENITER_IPNAT :
6795 	case IPFGENITER_NAT :
6796 		error = ipf_nat_getnext(softc, token, itp, obj);
6797 		break;
6798 
6799 	case IPFGENITER_NATFRAG :
6800 		error = ipf_frag_nat_next(softc, token, itp);
6801 		break;
6802 	default :
6803 		IPFERROR(60053);
6804 		error = EINVAL;
6805 		break;
6806 	}
6807 
6808 	return (error);
6809 }
6810 
6811 
6812 /* ------------------------------------------------------------------------ */
6813 /* Function:    ipf_nat_setpending                                          */
6814 /* Returns:     Nil                                                         */
6815 /* Parameters:  softc(I) - pointer to soft context main structure           */
6816 /*              nat(I)   - pointer to NAT structure                         */
6817 /* Locks:       ipf_nat (read or write)                                     */
6818 /*                                                                          */
6819 /* Put the NAT entry on to the pending queue - this queue has a very short  */
6820 /* lifetime where items are put that can't be deleted straight away because */
6821 /* of locking issues but we want to delete them ASAP, anyway.  In calling   */
6822 /* this function, it is assumed that the owner (if there is one, as shown   */
6823 /* by nat_me) is no longer interested in it.                                */
6824 /* ------------------------------------------------------------------------ */
6825 void
ipf_nat_setpending(ipf_main_softc_t * softc,nat_t * nat)6826 ipf_nat_setpending(ipf_main_softc_t *softc, nat_t *nat)
6827 {
6828 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6829 	ipftq_t *oifq;
6830 
6831 	oifq = nat->nat_tqe.tqe_ifq;
6832 	if (oifq != NULL)
6833 		ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq,
6834 			      &softn->ipf_nat_pending);
6835 	else
6836 		ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe,
6837 				&softn->ipf_nat_pending, nat);
6838 
6839 	if (nat->nat_me != NULL) {
6840 		*nat->nat_me = NULL;
6841 		nat->nat_me = NULL;
6842 		nat->nat_ref--;
6843 		ASSERT(nat->nat_ref >= 0);
6844 	}
6845 }
6846 
6847 
6848 /* ------------------------------------------------------------------------ */
6849 /* Function:    nat_newrewrite                                              */
6850 /* Returns:     int - -1 == error, 0 == success (no move), 1 == success and */
6851 /*                    allow rule to be moved if IPN_ROUNDR is set.          */
6852 /* Parameters:  fin(I) - pointer to packet information                      */
6853 /*              nat(I) - pointer to NAT entry                               */
6854 /*              ni(I)  - pointer to structure with misc. information needed */
6855 /*                       to create new NAT entry.                           */
6856 /* Write Lock:  ipf_nat                                                     */
6857 /*                                                                          */
6858 /* This function is responsible for setting up an active NAT session where  */
6859 /* we are changing both the source and destination parameters at the same   */
6860 /* time.  The loop in here works differently to elsewhere - each iteration  */
6861 /* is responsible for changing a single parameter that can be incremented.  */
6862 /* So one pass may increase the source IP#, next source port, next dest. IP#*/
6863 /* and the last destination port for a total of 4 iterations to try each.   */
6864 /* This is done to try and exhaustively use the translation space available.*/
6865 /* ------------------------------------------------------------------------ */
6866 static int
ipf_nat_newrewrite(fr_info_t * fin,nat_t * nat,natinfo_t * nai)6867 ipf_nat_newrewrite(fr_info_t *fin, nat_t *nat, natinfo_t *nai)
6868 {
6869 	int src_search = 1;
6870 	int dst_search = 1;
6871 	fr_info_t frnat;
6872 	u_32_t flags;
6873 	u_short swap;
6874 	ipnat_t *np;
6875 	nat_t *natl;
6876 	int l = 0;
6877 	int changed;
6878 
6879 	natl = NULL;
6880 	changed = -1;
6881 	np = nai->nai_np;
6882 	flags = nat->nat_flags;
6883 	bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
6884 
6885 	nat->nat_hm = NULL;
6886 
6887 	do {
6888 		changed = -1;
6889 		/* TRACE (l, src_search, dst_search, np) */
6890 		DT4(ipf_nat_rewrite_1, int, l, int, src_search, int, dst_search, ipnat_t *, np);
6891 
6892 		if ((src_search == 0) && (np->in_spnext == 0) &&
6893 		    (dst_search == 0) && (np->in_dpnext == 0)) {
6894 			if (l > 0)
6895 				return (-1);
6896 		}
6897 
6898 		/*
6899 		 * Find a new source address
6900 		 */
6901 		if (ipf_nat_nextaddr(fin, &np->in_nsrc, &frnat.fin_saddr,
6902 				     &frnat.fin_saddr) == -1) {
6903 			return (-1);
6904 		}
6905 
6906 		if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0xffffffff)) {
6907 			src_search = 0;
6908 			if (np->in_stepnext == 0)
6909 				np->in_stepnext = 1;
6910 
6911 		} else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) {
6912 			src_search = 0;
6913 			if (np->in_stepnext == 0)
6914 				np->in_stepnext = 1;
6915 
6916 		} else if (np->in_nsrcmsk == 0xffffffff) {
6917 			src_search = 0;
6918 			if (np->in_stepnext == 0)
6919 				np->in_stepnext = 1;
6920 
6921 		} else if (np->in_nsrcmsk != 0xffffffff) {
6922 			if (np->in_stepnext == 0 && changed == -1) {
6923 				np->in_snip++;
6924 				np->in_stepnext++;
6925 				changed = 0;
6926 			}
6927 		}
6928 
6929 		if ((flags & IPN_TCPUDPICMP) != 0) {
6930 			if (np->in_spnext != 0)
6931 				frnat.fin_data[0] = np->in_spnext;
6932 
6933 			/*
6934 			 * Standard port translation.  Select next port.
6935 			 */
6936 			if ((flags & IPN_FIXEDSPORT) != 0) {
6937 				np->in_stepnext = 2;
6938 			} else if ((np->in_stepnext == 1) &&
6939 				   (changed == -1) && (natl != NULL)) {
6940 				np->in_spnext++;
6941 				np->in_stepnext++;
6942 				changed = 1;
6943 				if (np->in_spnext > np->in_spmax)
6944 					np->in_spnext = np->in_spmin;
6945 			}
6946 		} else {
6947 			np->in_stepnext = 2;
6948 		}
6949 		np->in_stepnext &= 0x3;
6950 
6951 		/*
6952 		 * Find a new destination address
6953 		 */
6954 		/* TRACE (fin, np, l, frnat) */
6955 		DT4(ipf_nat_rewrite_2, frinfo_t *, fin, ipnat_t *, np, int, l, frinfo_t *, &frnat);
6956 
6957 		if (ipf_nat_nextaddr(fin, &np->in_ndst, &frnat.fin_daddr,
6958 				     &frnat.fin_daddr) == -1)
6959 			return (-1);
6960 		if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) {
6961 			dst_search = 0;
6962 			if (np->in_stepnext == 2)
6963 				np->in_stepnext = 3;
6964 
6965 		} else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0)) {
6966 			dst_search = 0;
6967 			if (np->in_stepnext == 2)
6968 				np->in_stepnext = 3;
6969 
6970 		} else if (np->in_ndstmsk == 0xffffffff) {
6971 			dst_search = 0;
6972 			if (np->in_stepnext == 2)
6973 				np->in_stepnext = 3;
6974 
6975 		} else if (np->in_ndstmsk != 0xffffffff) {
6976 			if ((np->in_stepnext == 2) && (changed == -1) &&
6977 			    (natl != NULL)) {
6978 				changed = 2;
6979 				np->in_stepnext++;
6980 				np->in_dnip++;
6981 			}
6982 		}
6983 
6984 		if ((flags & IPN_TCPUDPICMP) != 0) {
6985 			if (np->in_dpnext != 0)
6986 				frnat.fin_data[1] = np->in_dpnext;
6987 
6988 			/*
6989 			 * Standard port translation.  Select next port.
6990 			 */
6991 			if ((flags & IPN_FIXEDDPORT) != 0) {
6992 				np->in_stepnext = 0;
6993 			} else if (np->in_stepnext == 3 && changed == -1) {
6994 				np->in_dpnext++;
6995 				np->in_stepnext++;
6996 				changed = 3;
6997 				if (np->in_dpnext > np->in_dpmax)
6998 					np->in_dpnext = np->in_dpmin;
6999 			}
7000 		} else {
7001 			if (np->in_stepnext == 3)
7002 				np->in_stepnext = 0;
7003 		}
7004 
7005 		/* TRACE (frnat) */
7006 		DT1(ipf_nat_rewrite_3, frinfo_t *, &frnat);
7007 
7008 		/*
7009 		 * Here we do a lookup of the connection as seen from
7010 		 * the outside.  If an IP# pair already exists, try
7011 		 * again.  So if you have A->B becomes C->B, you can
7012 		 * also have D->E become C->E but not D->B causing
7013 		 * another C->B.  Also take protocol and ports into
7014 		 * account when determining whether a pre-existing
7015 		 * NAT setup will cause an external conflict where
7016 		 * this is appropriate.
7017 		 *
7018 		 * fin_data[] is swapped around because we are doing a
7019 		 * lookup of the packet is if it were moving in the opposite
7020 		 * direction of the one we are working with now.
7021 		 */
7022 		if (flags & IPN_TCPUDP) {
7023 			swap = frnat.fin_data[0];
7024 			frnat.fin_data[0] = frnat.fin_data[1];
7025 			frnat.fin_data[1] = swap;
7026 		}
7027 		if (fin->fin_out == 1) {
7028 			natl = ipf_nat_inlookup(&frnat,
7029 						flags & ~(SI_WILDP|NAT_SEARCH),
7030 						(u_int)frnat.fin_p,
7031 						frnat.fin_dst, frnat.fin_src);
7032 
7033 		} else {
7034 			natl = ipf_nat_outlookup(&frnat,
7035 						 flags & ~(SI_WILDP|NAT_SEARCH),
7036 						 (u_int)frnat.fin_p,
7037 						 frnat.fin_dst, frnat.fin_src);
7038 		}
7039 		if (flags & IPN_TCPUDP) {
7040 			swap = frnat.fin_data[0];
7041 			frnat.fin_data[0] = frnat.fin_data[1];
7042 			frnat.fin_data[1] = swap;
7043 		}
7044 
7045 		/* TRACE natl, in_stepnext, l */
7046 		DT3(ipf_nat_rewrite_2, nat_t *, natl, ipnat_t *, np , int, l);
7047 
7048 		if ((natl != NULL) && (l > 8))	/* XXX 8 is arbitrary */
7049 			return (-1);
7050 
7051 		np->in_stepnext &= 0x3;
7052 
7053 		l++;
7054 		changed = -1;
7055 	} while (natl != NULL);
7056 
7057 	nat->nat_osrcip = fin->fin_src;
7058 	nat->nat_odstip = fin->fin_dst;
7059 	nat->nat_nsrcip = frnat.fin_src;
7060 	nat->nat_ndstip = frnat.fin_dst;
7061 
7062 	if ((flags & IPN_TCPUDP) != 0) {
7063 		nat->nat_osport = htons(fin->fin_data[0]);
7064 		nat->nat_odport = htons(fin->fin_data[1]);
7065 		nat->nat_nsport = htons(frnat.fin_data[0]);
7066 		nat->nat_ndport = htons(frnat.fin_data[1]);
7067 	} else if ((flags & IPN_ICMPQUERY) != 0) {
7068 		nat->nat_oicmpid = fin->fin_data[1];
7069 		nat->nat_nicmpid = frnat.fin_data[1];
7070 	}
7071 
7072 	return (0);
7073 }
7074 
7075 
7076 /* ------------------------------------------------------------------------ */
7077 /* Function:    nat_newdivert                                               */
7078 /* Returns:     int - -1 == error, 0 == success                             */
7079 /* Parameters:  fin(I) - pointer to packet information                      */
7080 /*              nat(I) - pointer to NAT entry                               */
7081 /*              ni(I)  - pointer to structure with misc. information needed */
7082 /*                       to create new NAT entry.                           */
7083 /* Write Lock:  ipf_nat                                                     */
7084 /*                                                                          */
7085 /* Create a new NAT  divert session as defined by the NAT rule.  This is    */
7086 /* somewhat different to other NAT session creation routines because we     */
7087 /* do not iterate through either port numbers or IP addresses, searching    */
7088 /* for a unique mapping, however, a complimentary duplicate check is made.  */
7089 /* ------------------------------------------------------------------------ */
7090 static int
ipf_nat_newdivert(fr_info_t * fin,nat_t * nat,natinfo_t * nai)7091 ipf_nat_newdivert(fr_info_t *fin, nat_t *nat, natinfo_t *nai)
7092 {
7093 	ipf_main_softc_t *softc = fin->fin_main_soft;
7094 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7095 	fr_info_t frnat;
7096 	ipnat_t *np;
7097 	nat_t *natl;
7098 	int p;
7099 
7100 	np = nai->nai_np;
7101 	bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
7102 
7103 	nat->nat_pr[0] = 0;
7104 	nat->nat_osrcaddr = fin->fin_saddr;
7105 	nat->nat_odstaddr = fin->fin_daddr;
7106 	frnat.fin_saddr = htonl(np->in_snip);
7107 	frnat.fin_daddr = htonl(np->in_dnip);
7108 	if ((nat->nat_flags & IPN_TCPUDP) != 0) {
7109 		nat->nat_osport = htons(fin->fin_data[0]);
7110 		nat->nat_odport = htons(fin->fin_data[1]);
7111 	} else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
7112 		nat->nat_oicmpid = fin->fin_data[1];
7113 	}
7114 
7115 	if (np->in_redir & NAT_DIVERTUDP) {
7116 		frnat.fin_data[0] = np->in_spnext;
7117 		frnat.fin_data[1] = np->in_dpnext;
7118 		frnat.fin_flx |= FI_TCPUDP;
7119 		p = IPPROTO_UDP;
7120 	} else {
7121 		frnat.fin_flx &= ~FI_TCPUDP;
7122 		p = IPPROTO_IPIP;
7123 	}
7124 
7125 	if (fin->fin_out == 1) {
7126 		natl = ipf_nat_inlookup(&frnat, 0, p,
7127 					frnat.fin_dst, frnat.fin_src);
7128 
7129 	} else {
7130 		natl = ipf_nat_outlookup(&frnat, 0, p,
7131 					 frnat.fin_dst, frnat.fin_src);
7132 	}
7133 
7134 	if (natl != NULL) {
7135 		NBUMPSIDED(fin->fin_out, ns_divert_exist);
7136 		DT3(ns_divert_exist, fr_info_t *, fin, nat_t *, nat, natinfo_t, nai);
7137 		return (-1);
7138 	}
7139 
7140 	nat->nat_nsrcaddr = frnat.fin_saddr;
7141 	nat->nat_ndstaddr = frnat.fin_daddr;
7142 	if ((nat->nat_flags & IPN_TCPUDP) != 0) {
7143 		nat->nat_nsport = htons(frnat.fin_data[0]);
7144 		nat->nat_ndport = htons(frnat.fin_data[1]);
7145 	} else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
7146 		nat->nat_nicmpid = frnat.fin_data[1];
7147 	}
7148 
7149 	nat->nat_pr[fin->fin_out] = fin->fin_p;
7150 	nat->nat_pr[1 - fin->fin_out] = p;
7151 
7152 	if (np->in_redir & NAT_REDIRECT)
7153 		nat->nat_dir = NAT_DIVERTIN;
7154 	else
7155 		nat->nat_dir = NAT_DIVERTOUT;
7156 
7157 	return (0);
7158 }
7159 
7160 
7161 /* ------------------------------------------------------------------------ */
7162 /* Function:    nat_builddivertmp                                           */
7163 /* Returns:     int - -1 == error, 0 == success                             */
7164 /* Parameters:  softn(I) - pointer to NAT context structure                 */
7165 /*              np(I)    - pointer to a NAT rule                            */
7166 /*                                                                          */
7167 /* For divert rules, a skeleton packet representing what will be prepended  */
7168 /* to the real packet is created.  Even though we don't have the full       */
7169 /* packet here, a checksum is calculated that we update later when we       */
7170 /* fill in the final details.  At present a 0 checksum for UDP is being set */
7171 /* here because it is expected that divert will be used for localhost.      */
7172 /* ------------------------------------------------------------------------ */
7173 static int
ipf_nat_builddivertmp(ipf_nat_softc_t * softn,ipnat_t * np)7174 ipf_nat_builddivertmp(ipf_nat_softc_t *softn, ipnat_t *np)
7175 {
7176 	udphdr_t *uh;
7177 	size_t len;
7178 	ip_t *ip;
7179 
7180 	if ((np->in_redir & NAT_DIVERTUDP) != 0)
7181 		len = sizeof(ip_t) + sizeof(udphdr_t);
7182 	else
7183 		len = sizeof(ip_t);
7184 
7185 	ALLOC_MB_T(np->in_divmp, len);
7186 	if (np->in_divmp == NULL) {
7187 		NBUMPD(ipf_nat_stats, ns_divert_build);
7188 		return (-1);
7189 	}
7190 
7191 	/*
7192 	 * First, the header to get the packet diverted to the new destination
7193 	 */
7194 	ip = MTOD(np->in_divmp, ip_t *);
7195 	IP_V_A(ip, 4);
7196 	IP_HL_A(ip, 5);
7197 	ip->ip_tos = 0;
7198 	if ((np->in_redir & NAT_DIVERTUDP) != 0)
7199 		ip->ip_p = IPPROTO_UDP;
7200 	else
7201 		ip->ip_p = IPPROTO_IPIP;
7202 	ip->ip_ttl = 255;
7203 	ip->ip_off = 0;
7204 	ip->ip_sum = 0;
7205 	ip->ip_len = htons(len);
7206 	ip->ip_id = 0;
7207 	ip->ip_src.s_addr = htonl(np->in_snip);
7208 	ip->ip_dst.s_addr = htonl(np->in_dnip);
7209 	ip->ip_sum = ipf_cksum((u_short *)ip, sizeof(*ip));
7210 
7211 	if (np->in_redir & NAT_DIVERTUDP) {
7212 		uh = (udphdr_t *)(ip + 1);
7213 		uh->uh_sum = 0;
7214 		uh->uh_ulen = 8;
7215 		uh->uh_sport = htons(np->in_spnext);
7216 		uh->uh_dport = htons(np->in_dpnext);
7217 	}
7218 
7219 	return (0);
7220 }
7221 
7222 
7223 #define	MINDECAP	(sizeof(ip_t) + sizeof(udphdr_t) + sizeof(ip_t))
7224 
7225 /* ------------------------------------------------------------------------ */
7226 /* Function:    nat_decap                                                   */
7227 /* Returns:     int - -1 == error, 0 == success                             */
7228 /* Parameters:  fin(I) - pointer to packet information                      */
7229 /*              nat(I) - pointer to current NAT session                     */
7230 /*                                                                          */
7231 /* This function is responsible for undoing a packet's encapsulation in the */
7232 /* reverse of an encap/divert rule.  After removing the outer encapsulation */
7233 /* it is necessary to call ipf_makefrip() again so that the contents of 'fin'*/
7234 /* match the "new" packet as it may still be used by IPFilter elsewhere.    */
7235 /* We use "dir" here as the basis for some of the expectations about the    */
7236 /* outer header.  If we return an error, the goal is to leave the original  */
7237 /* packet information undisturbed - this falls short at the end where we'd  */
7238 /* need to back a backup copy of "fin" - expensive.                         */
7239 /* ------------------------------------------------------------------------ */
7240 static int
ipf_nat_decap(fr_info_t * fin,nat_t * nat)7241 ipf_nat_decap(fr_info_t *fin, nat_t *nat)
7242 {
7243 	ipf_main_softc_t *softc = fin->fin_main_soft;
7244 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7245 	char *hdr;
7246 	int hlen;
7247 	int skip;
7248 	mb_t *m;
7249 
7250 	if ((fin->fin_flx & FI_ICMPERR) != 0) {
7251 		/*
7252 		 * ICMP packets don't get decapsulated, instead what we need
7253 		 * to do is change the ICMP reply from including (in the data
7254 		 * portion for errors) the encapsulated packet that we sent
7255 		 * out to something that resembles the original packet prior
7256 		 * to encapsulation.  This isn't done here - all we're doing
7257 		 * here is changing the outer address to ensure that it gets
7258 		 * targetted back to the correct system.
7259 		 */
7260 
7261 		if (nat->nat_dir & NAT_OUTBOUND) {
7262 			u_32_t sum1, sum2, sumd;
7263 
7264 			sum1 = ntohl(fin->fin_daddr);
7265 			sum2 = ntohl(nat->nat_osrcaddr);
7266 			CALC_SUMD(sum1, sum2, sumd);
7267 			fin->fin_ip->ip_dst = nat->nat_osrcip;
7268 			fin->fin_daddr = nat->nat_osrcaddr;
7269 #if !defined(_KERNEL) || SOLARIS
7270 			ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, sumd, 0);
7271 #endif
7272 		}
7273 		return (0);
7274 	}
7275 
7276 	m = fin->fin_m;
7277 	skip = fin->fin_hlen;
7278 
7279 	switch (nat->nat_dir)
7280 	{
7281 	case NAT_DIVERTIN :
7282 	case NAT_DIVERTOUT :
7283 		if (fin->fin_plen < MINDECAP)
7284 			return (-1);
7285 		skip += sizeof(udphdr_t);
7286 		break;
7287 
7288 	case NAT_ENCAPIN :
7289 	case NAT_ENCAPOUT :
7290 		if (fin->fin_plen < (skip + sizeof(ip_t)))
7291 			return (-1);
7292 		break;
7293 	default :
7294 		return (-1);
7295 		/* NOTREACHED */
7296 	}
7297 
7298 	/*
7299 	 * The aim here is to keep the original packet details in "fin" for
7300 	 * as long as possible so that returning with an error is for the
7301 	 * original packet and there is little undoing work to do.
7302 	 */
7303 	if (M_LEN(m) < skip + sizeof(ip_t)) {
7304 		if (ipf_pr_pullup(fin, skip + sizeof(ip_t)) == -1)
7305 			return (-1);
7306 	}
7307 
7308 	hdr = MTOD(fin->fin_m, char *);
7309 	fin->fin_ip = (ip_t *)(hdr + skip);
7310 	hlen = IP_HL(fin->fin_ip) << 2;
7311 
7312 	if (ipf_pr_pullup(fin, skip + hlen) == -1) {
7313 		NBUMPSIDED(fin->fin_out, ns_decap_pullup);
7314 		return (-1);
7315 	}
7316 
7317 	fin->fin_hlen = hlen;
7318 	fin->fin_dlen -= skip;
7319 	fin->fin_plen -= skip;
7320 	fin->fin_ipoff += skip;
7321 
7322 	if (ipf_makefrip(hlen, (ip_t *)hdr, fin) == -1) {
7323 		NBUMPSIDED(fin->fin_out, ns_decap_bad);
7324 		return (-1);
7325 	}
7326 
7327 	return (skip);
7328 }
7329 
7330 
7331 /* ------------------------------------------------------------------------ */
7332 /* Function:    nat_nextaddr                                                */
7333 /* Returns:     int - -1 == bad input (no new address),                     */
7334 /*                     0 == success and dst has new address                 */
7335 /* Parameters:  fin(I) - pointer to packet information                      */
7336 /*              na(I)  - how to generate new address                        */
7337 /*              old(I) - original address being replaced                    */
7338 /*              dst(O) - where to put the new address                       */
7339 /* Write Lock:  ipf_nat                                                     */
7340 /*                                                                          */
7341 /* This function uses the contents of the "na" structure, in combination    */
7342 /* with "old" to produce a new address to store in "dst".  Not all of the   */
7343 /* possible uses of "na" will result in a new address.                      */
7344 /* ------------------------------------------------------------------------ */
7345 static int
ipf_nat_nextaddr(fr_info_t * fin,nat_addr_t * na,u_32_t * old,u_32_t * dst)7346 ipf_nat_nextaddr(fr_info_t *fin, nat_addr_t *na, u_32_t *old, u_32_t *dst)
7347 {
7348 	ipf_main_softc_t *softc = fin->fin_main_soft;
7349 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7350 	u_32_t new;
7351 	i6addr_t newip;
7352 	int error;
7353 
7354 	new = 0;
7355 
7356 	switch (na->na_atype)
7357 	{
7358 	case FRI_RANGE :
7359 	case FRI_NETMASKED :
7360 	case FRI_DYNAMIC :
7361 	case FRI_NORMAL :
7362 	case FRI_LOOKUP :
7363 		break;
7364 
7365 	case FRI_BROADCAST :
7366 	case FRI_PEERADDR :
7367 	case FRI_NETWORK :
7368 	default :
7369 		DT4(ns_na_atype, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7370 		return (-1);
7371 	}
7372 
7373 	error = -1;
7374 
7375 	if (na->na_atype == FRI_LOOKUP) {
7376 		if (na->na_type == IPLT_DSTLIST) {
7377 			error = ipf_dstlist_select_node(fin, na->na_ptr, dst,
7378 							NULL);
7379 		} else {
7380 			NBUMPSIDE(fin->fin_out, ns_badnextaddr);
7381 			DT4(ns_badnextaddr_1, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7382 		}
7383 
7384 	} else if (na->na_atype == IPLT_NONE) {
7385 		/*
7386 		 * 0/0 as the new address means leave it alone.
7387 		 */
7388 		if (na->na_addr[0].in4.s_addr == 0 &&
7389 		    na->na_addr[1].in4.s_addr == 0) {
7390 			new = *old;
7391 
7392 		/*
7393 		 * 0/32 means get the interface's address
7394 		 */
7395 		} else if (na->na_addr[0].in4.s_addr == 0 &&
7396 			   na->na_addr[1].in4.s_addr == 0xffffffff) {
7397 			if (ipf_ifpaddr(softc, 4, na->na_atype,
7398 					fin->fin_ifp, &newip, NULL) == -1) {
7399 				NBUMPSIDED(fin->fin_out, ns_ifpaddrfail);
7400 				DT4(ns_ifpaddrfail, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7401 				return (-1);
7402 			}
7403 			new = newip.in4.s_addr;
7404 		} else {
7405 			new = htonl(na->na_nextip);
7406 		}
7407 		*dst = new;
7408 		error = 0;
7409 
7410 	} else {
7411 		NBUMPSIDE(fin->fin_out, ns_badnextaddr);
7412 		DT4(ns_badnextaddr_2, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7413 	}
7414 
7415 	return (error);
7416 }
7417 
7418 
7419 /* ------------------------------------------------------------------------ */
7420 /* Function:    nat_nextaddrinit                                            */
7421 /* Returns:     int - 0 == success, else error number                       */
7422 /* Parameters:  softc(I) - pointer to soft context main structure           */
7423 /*              na(I)      - NAT address information for generating new addr*/
7424 /*              initial(I) - flag indicating if it is the first call for    */
7425 /*                           this "na" structure.                           */
7426 /*              ifp(I)     - network interface to derive address            */
7427 /*                           information from.                              */
7428 /*                                                                          */
7429 /* This function is expected to be called in two scenarious: when a new NAT */
7430 /* rule is loaded into the kernel and when the list of NAT rules is sync'd  */
7431 /* up with the valid network interfaces (possibly due to them changing.)    */
7432 /* To distinguish between these, the "initial" parameter is used.  If it is */
7433 /* 1 then this indicates the rule has just been reloaded and 0 for when we  */
7434 /* are updating information.  This difference is important because in       */
7435 /* instances where we are not updating address information associated with  */
7436 /* a network interface, we don't want to disturb what the "next" address to */
7437 /* come out of ipf_nat_nextaddr() will be.                                  */
7438 /* ------------------------------------------------------------------------ */
7439 static int
ipf_nat_nextaddrinit(ipf_main_softc_t * softc,char * base,nat_addr_t * na,int initial,void * ifp)7440 ipf_nat_nextaddrinit(ipf_main_softc_t *softc, char *base, nat_addr_t *na,
7441 	int initial, void *ifp)
7442 {
7443 
7444 	switch (na->na_atype)
7445 	{
7446 	case FRI_LOOKUP :
7447 		if (na->na_subtype == 0) {
7448 			na->na_ptr = ipf_lookup_res_num(softc, IPL_LOGNAT,
7449 							na->na_type,
7450 							na->na_num,
7451 							&na->na_func);
7452 		} else if (na->na_subtype == 1) {
7453 			na->na_ptr = ipf_lookup_res_name(softc, IPL_LOGNAT,
7454 							 na->na_type,
7455 							 base + na->na_num,
7456 							 &na->na_func);
7457 		}
7458 		if (na->na_func == NULL) {
7459 			IPFERROR(60060);
7460 			return (ESRCH);
7461 		}
7462 		if (na->na_ptr == NULL) {
7463 			IPFERROR(60056);
7464 			return (ESRCH);
7465 		}
7466 		break;
7467 
7468 	case FRI_DYNAMIC :
7469 	case FRI_BROADCAST :
7470 	case FRI_NETWORK :
7471 	case FRI_NETMASKED :
7472 	case FRI_PEERADDR :
7473 		if (ifp != NULL)
7474 			(void )ipf_ifpaddr(softc, 4, na->na_atype, ifp,
7475 					   &na->na_addr[0], &na->na_addr[1]);
7476 		break;
7477 
7478 	case FRI_SPLIT :
7479 	case FRI_RANGE :
7480 		if (initial)
7481 			na->na_nextip = ntohl(na->na_addr[0].in4.s_addr);
7482 		break;
7483 
7484 	case FRI_NONE :
7485 		na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr;
7486 		return (0);
7487 
7488 	case FRI_NORMAL :
7489 		na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr;
7490 		break;
7491 
7492 	default :
7493 		IPFERROR(60054);
7494 		return (EINVAL);
7495 	}
7496 
7497 	if (initial && (na->na_atype == FRI_NORMAL)) {
7498 		if (na->na_addr[0].in4.s_addr == 0) {
7499 			if ((na->na_addr[1].in4.s_addr == 0xffffffff) ||
7500 			    (na->na_addr[1].in4.s_addr == 0)) {
7501 				return (0);
7502 			}
7503 		}
7504 
7505 		if (na->na_addr[1].in4.s_addr == 0xffffffff) {
7506 			na->na_nextip = ntohl(na->na_addr[0].in4.s_addr);
7507 		} else {
7508 			na->na_nextip = ntohl(na->na_addr[0].in4.s_addr) + 1;
7509 		}
7510 	}
7511 
7512 	return (0);
7513 }
7514 
7515 
7516 /* ------------------------------------------------------------------------ */
7517 /* Function:    ipf_nat_matchflush                                          */
7518 /* Returns:     int - -1 == error, 0 == success                             */
7519 /* Parameters:  softc(I) - pointer to soft context main structure           */
7520 /*              softn(I) - pointer to NAT context structure                 */
7521 /*              nat(I)   - pointer to current NAT session                   */
7522 /*                                                                          */
7523 /* ------------------------------------------------------------------------ */
7524 static int
ipf_nat_matchflush(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,caddr_t data)7525 ipf_nat_matchflush(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
7526 	caddr_t data)
7527 {
7528 	int *array, flushed, error;
7529 	nat_t *nat, *natnext;
7530 	ipfobj_t obj;
7531 
7532 	error = ipf_matcharray_load(softc, data, &obj, &array);
7533 	if (error != 0)
7534 		return (error);
7535 
7536 	flushed = 0;
7537 
7538 	for (nat = softn->ipf_nat_instances; nat != NULL; nat = natnext) {
7539 		natnext = nat->nat_next;
7540 		if (ipf_nat_matcharray(nat, array, softc->ipf_ticks) == 0) {
7541 			ipf_nat_delete(softc, nat, NL_FLUSH);
7542 			flushed++;
7543 		}
7544 	}
7545 
7546 	obj.ipfo_retval = flushed;
7547 	error = BCOPYOUT(&obj, data, sizeof(obj));
7548 
7549 	KFREES(array, array[0] * sizeof(*array));
7550 
7551 	return (error);
7552 }
7553 
7554 
7555 /* ------------------------------------------------------------------------ */
7556 /* Function:    ipf_nat_matcharray                                          */
7557 /* Returns:     int - -1 == error, 0 == success                             */
7558 /* Parameters:  fin(I) - pointer to packet information                      */
7559 /*              nat(I) - pointer to current NAT session                     */
7560 /*                                                                          */
7561 /* ------------------------------------------------------------------------ */
7562 static int
ipf_nat_matcharray(nat_t * nat,int * array,u_long ticks)7563 ipf_nat_matcharray(nat_t *nat, int *array, u_long ticks)
7564 {
7565 	int i, n, *x, e, p;
7566 
7567 	e = 0;
7568 	n = array[0];
7569 	x = array + 1;
7570 
7571 	for (; n > 0; x += 3 + x[2]) {
7572 		if (x[0] == IPF_EXP_END)
7573 			break;
7574 		e = 0;
7575 
7576 		n -= x[2] + 3;
7577 		if (n < 0)
7578 			break;
7579 
7580 		p = x[0] >> 16;
7581 		if (p != 0 && p != nat->nat_pr[1])
7582 			break;
7583 
7584 		switch (x[0])
7585 		{
7586 		case IPF_EXP_IP_PR :
7587 			for (i = 0; !e && i < x[2]; i++) {
7588 				e |= (nat->nat_pr[1] == x[i + 3]);
7589 			}
7590 			break;
7591 
7592 		case IPF_EXP_IP_SRCADDR :
7593 			if (nat->nat_v[0] == 4) {
7594 				for (i = 0; !e && i < x[2]; i++) {
7595 					e |= ((nat->nat_osrcaddr & x[i + 4]) ==
7596 					      x[i + 3]);
7597 				}
7598 			}
7599 			if (nat->nat_v[1] == 4) {
7600 				for (i = 0; !e && i < x[2]; i++) {
7601 					e |= ((nat->nat_nsrcaddr & x[i + 4]) ==
7602 					      x[i + 3]);
7603 				}
7604 			}
7605 			break;
7606 
7607 		case IPF_EXP_IP_DSTADDR :
7608 			if (nat->nat_v[0] == 4) {
7609 				for (i = 0; !e && i < x[2]; i++) {
7610 					e |= ((nat->nat_odstaddr & x[i + 4]) ==
7611 					      x[i + 3]);
7612 				}
7613 			}
7614 			if (nat->nat_v[1] == 4) {
7615 				for (i = 0; !e && i < x[2]; i++) {
7616 					e |= ((nat->nat_ndstaddr & x[i + 4]) ==
7617 					      x[i + 3]);
7618 				}
7619 			}
7620 			break;
7621 
7622 		case IPF_EXP_IP_ADDR :
7623 			for (i = 0; !e && i < x[2]; i++) {
7624 				if (nat->nat_v[0] == 4) {
7625 					e |= ((nat->nat_osrcaddr & x[i + 4]) ==
7626 					      x[i + 3]);
7627 				}
7628 				if (nat->nat_v[1] == 4) {
7629 					e |= ((nat->nat_nsrcaddr & x[i + 4]) ==
7630 					      x[i + 3]);
7631 				}
7632 				if (nat->nat_v[0] == 4) {
7633 					e |= ((nat->nat_odstaddr & x[i + 4]) ==
7634 					      x[i + 3]);
7635 				}
7636 				if (nat->nat_v[1] == 4) {
7637 					e |= ((nat->nat_ndstaddr & x[i + 4]) ==
7638 					      x[i + 3]);
7639 				}
7640 			}
7641 			break;
7642 
7643 #ifdef USE_INET6
7644 		case IPF_EXP_IP6_SRCADDR :
7645 			if (nat->nat_v[0] == 6) {
7646 				for (i = 0; !e && i < x[3]; i++) {
7647 					e |= IP6_MASKEQ(&nat->nat_osrc6,
7648 							x + i + 7, x + i + 3);
7649 				}
7650 			}
7651 			if (nat->nat_v[1] == 6) {
7652 				for (i = 0; !e && i < x[3]; i++) {
7653 					e |= IP6_MASKEQ(&nat->nat_nsrc6,
7654 							x + i + 7, x + i + 3);
7655 				}
7656 			}
7657 			break;
7658 
7659 		case IPF_EXP_IP6_DSTADDR :
7660 			if (nat->nat_v[0] == 6) {
7661 				for (i = 0; !e && i < x[3]; i++) {
7662 					e |= IP6_MASKEQ(&nat->nat_odst6,
7663 							x + i + 7,
7664 							x + i + 3);
7665 				}
7666 			}
7667 			if (nat->nat_v[1] == 6) {
7668 				for (i = 0; !e && i < x[3]; i++) {
7669 					e |= IP6_MASKEQ(&nat->nat_ndst6,
7670 							x + i + 7,
7671 							x + i + 3);
7672 				}
7673 			}
7674 			break;
7675 
7676 		case IPF_EXP_IP6_ADDR :
7677 			for (i = 0; !e && i < x[3]; i++) {
7678 				if (nat->nat_v[0] == 6) {
7679 					e |= IP6_MASKEQ(&nat->nat_osrc6,
7680 							x + i + 7,
7681 							x + i + 3);
7682 				}
7683 				if (nat->nat_v[0] == 6) {
7684 					e |= IP6_MASKEQ(&nat->nat_odst6,
7685 							x + i + 7,
7686 							x + i + 3);
7687 				}
7688 				if (nat->nat_v[1] == 6) {
7689 					e |= IP6_MASKEQ(&nat->nat_nsrc6,
7690 							x + i + 7,
7691 							x + i + 3);
7692 				}
7693 				if (nat->nat_v[1] == 6) {
7694 					e |= IP6_MASKEQ(&nat->nat_ndst6,
7695 							x + i + 7,
7696 							x + i + 3);
7697 				}
7698 			}
7699 			break;
7700 #endif
7701 
7702 		case IPF_EXP_UDP_PORT :
7703 		case IPF_EXP_TCP_PORT :
7704 			for (i = 0; !e && i < x[2]; i++) {
7705 				e |= (nat->nat_nsport == x[i + 3]) ||
7706 				     (nat->nat_ndport == x[i + 3]);
7707 			}
7708 			break;
7709 
7710 		case IPF_EXP_UDP_SPORT :
7711 		case IPF_EXP_TCP_SPORT :
7712 			for (i = 0; !e && i < x[2]; i++) {
7713 				e |= (nat->nat_nsport == x[i + 3]);
7714 			}
7715 			break;
7716 
7717 		case IPF_EXP_UDP_DPORT :
7718 		case IPF_EXP_TCP_DPORT :
7719 			for (i = 0; !e && i < x[2]; i++) {
7720 				e |= (nat->nat_ndport == x[i + 3]);
7721 			}
7722 			break;
7723 
7724 		case IPF_EXP_TCP_STATE :
7725 			for (i = 0; !e && i < x[2]; i++) {
7726 				e |= (nat->nat_tcpstate[0] == x[i + 3]) ||
7727 				     (nat->nat_tcpstate[1] == x[i + 3]);
7728 			}
7729 			break;
7730 
7731 		case IPF_EXP_IDLE_GT :
7732 			e |= (ticks - nat->nat_touched > x[3]);
7733 			break;
7734 		}
7735 		e ^= x[1];
7736 
7737 		if (!e)
7738 			break;
7739 	}
7740 
7741 	return (e);
7742 }
7743 
7744 
7745 /* ------------------------------------------------------------------------ */
7746 /* Function:    ipf_nat_gettable                                            */
7747 /* Returns:     int     - 0 = success, else error                           */
7748 /* Parameters:  softc(I) - pointer to soft context main structure           */
7749 /*              softn(I) - pointer to NAT context structure                 */
7750 /*              data(I)  - pointer to ioctl data                            */
7751 /*                                                                          */
7752 /* This function handles ioctl requests for tables of nat information.      */
7753 /* At present the only table it deals with is the hash bucket statistics.   */
7754 /* ------------------------------------------------------------------------ */
7755 static int
ipf_nat_gettable(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,char * data)7756 ipf_nat_gettable(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, char *data)
7757 {
7758 	ipftable_t table;
7759 	int error;
7760 
7761 	error = ipf_inobj(softc, data, NULL, &table, IPFOBJ_GTABLE);
7762 	if (error != 0)
7763 		return (error);
7764 
7765 	switch (table.ita_type)
7766 	{
7767 	case IPFTABLE_BUCKETS_NATIN :
7768 		error = COPYOUT(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
7769 				table.ita_table,
7770 				softn->ipf_nat_table_sz * sizeof(u_int));
7771 		break;
7772 
7773 	case IPFTABLE_BUCKETS_NATOUT :
7774 		error = COPYOUT(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
7775 				table.ita_table,
7776 				softn->ipf_nat_table_sz * sizeof(u_int));
7777 		break;
7778 
7779 	default :
7780 		IPFERROR(60058);
7781 		return (EINVAL);
7782 	}
7783 
7784 	if (error != 0) {
7785 		IPFERROR(60059);
7786 		error = EFAULT;
7787 	}
7788 	return (error);
7789 }
7790 
7791 
7792 /* ------------------------------------------------------------------------ */
7793 /* Function:    ipf_nat_settimeout                                          */
7794 /* Returns:     int  - 0 = success, else failure			    */
7795 /* Parameters:  softc(I) - pointer to soft context main structure           */
7796 /*              t(I) - pointer to tunable                                   */
7797 /*              p(I) - pointer to new tuning data                           */
7798 /*                                                                          */
7799 /* Apply the timeout change to the NAT timeout queues.                      */
7800 /* ------------------------------------------------------------------------ */
7801 int
ipf_nat_settimeout(struct ipf_main_softc_s * softc,ipftuneable_t * t,ipftuneval_t * p)7802 ipf_nat_settimeout(struct ipf_main_softc_s *softc, ipftuneable_t *t,
7803 	ipftuneval_t *p)
7804 {
7805 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7806 
7807 	if (!strncmp(t->ipft_name, "tcp_", 4))
7808 		return (ipf_settimeout_tcp(t, p, softn->ipf_nat_tcptq));
7809 
7810 	if (!strcmp(t->ipft_name, "udp_timeout")) {
7811 		ipf_apply_timeout(&softn->ipf_nat_udptq, p->ipftu_int);
7812 	} else if (!strcmp(t->ipft_name, "udp_ack_timeout")) {
7813 		ipf_apply_timeout(&softn->ipf_nat_udpacktq, p->ipftu_int);
7814 	} else if (!strcmp(t->ipft_name, "icmp_timeout")) {
7815 		ipf_apply_timeout(&softn->ipf_nat_icmptq, p->ipftu_int);
7816 	} else if (!strcmp(t->ipft_name, "icmp_ack_timeout")) {
7817 		ipf_apply_timeout(&softn->ipf_nat_icmpacktq, p->ipftu_int);
7818 	} else if (!strcmp(t->ipft_name, "ip_timeout")) {
7819 		ipf_apply_timeout(&softn->ipf_nat_iptq, p->ipftu_int);
7820 	} else {
7821 		IPFERROR(60062);
7822 		return (ESRCH);
7823 	}
7824 	return (0);
7825 }
7826 
7827 
7828 /* ------------------------------------------------------------------------ */
7829 /* Function:    ipf_nat_rehash                                              */
7830 /* Returns:     int  - 0 = success, else failure			    */
7831 /* Parameters:  softc(I) - pointer to soft context main structure           */
7832 /*              t(I) - pointer to tunable                                   */
7833 /*              p(I) - pointer to new tuning data                           */
7834 /*                                                                          */
7835 /* To change the size of the basic NAT table, we need to first allocate the */
7836 /* new tables (lest it fails and we've got nowhere to store all of the NAT  */
7837 /* sessions currently active) and then walk through the entire list and     */
7838 /* insert them into the table.  There are two tables here: an inbound one   */
7839 /* and an outbound one.  Each NAT entry goes into each table once.          */
7840 /* ------------------------------------------------------------------------ */
7841 int
ipf_nat_rehash(ipf_main_softc_t * softc,ipftuneable_t * t,ipftuneval_t * p)7842 ipf_nat_rehash(ipf_main_softc_t *softc, ipftuneable_t *t, ipftuneval_t *p)
7843 {
7844 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7845 	nat_t **newtab[2], *nat, **natp;
7846 	u_int *bucketlens[2];
7847 	u_int maxbucket;
7848 	u_int newsize;
7849 	int error;
7850 	u_int hv;
7851 	int i;
7852 
7853 	newsize = p->ipftu_int;
7854 	/*
7855 	 * In case there is nothing to do...
7856 	 */
7857 	if (newsize == softn->ipf_nat_table_sz)
7858 		return (0);
7859 
7860 	newtab[0] = NULL;
7861 	newtab[1] = NULL;
7862 	bucketlens[0] = NULL;
7863 	bucketlens[1] = NULL;
7864 	/*
7865 	 * 4 tables depend on the NAT table size: the inbound looking table,
7866 	 * the outbound lookup table and the hash chain length for each.
7867 	 */
7868 	KMALLOCS(newtab[0], nat_t **, newsize * sizeof(nat_t *));
7869 	if (newtab[0] == NULL) {
7870 		error = 60063;
7871 		goto badrehash;
7872 	}
7873 
7874 	KMALLOCS(newtab[1], nat_t **, newsize * sizeof(nat_t *));
7875 	if (newtab[1] == NULL) {
7876 		error = 60064;
7877 		goto badrehash;
7878 	}
7879 
7880 	KMALLOCS(bucketlens[0], u_int *, newsize * sizeof(u_int));
7881 	if (bucketlens[0] == NULL) {
7882 		error = 60065;
7883 		goto badrehash;
7884 	}
7885 
7886 	KMALLOCS(bucketlens[1], u_int *, newsize * sizeof(u_int));
7887 	if (bucketlens[1] == NULL) {
7888 		error = 60066;
7889 		goto badrehash;
7890 	}
7891 
7892 	/*
7893 	 * Recalculate the maximum length based on the new size.
7894 	 */
7895 	for (maxbucket = 0, i = newsize; i > 0; i >>= 1)
7896 		maxbucket++;
7897 	maxbucket *= 2;
7898 
7899 	bzero((char *)newtab[0], newsize * sizeof(nat_t *));
7900 	bzero((char *)newtab[1], newsize * sizeof(nat_t *));
7901 	bzero((char *)bucketlens[0], newsize * sizeof(u_int));
7902 	bzero((char *)bucketlens[1], newsize * sizeof(u_int));
7903 
7904 	WRITE_ENTER(&softc->ipf_nat);
7905 
7906 	if (softn->ipf_nat_table[0] != NULL) {
7907 		KFREES(softn->ipf_nat_table[0],
7908 		       softn->ipf_nat_table_sz *
7909 		       sizeof(*softn->ipf_nat_table[0]));
7910 	}
7911 	softn->ipf_nat_table[0] = newtab[0];
7912 
7913 	if (softn->ipf_nat_table[1] != NULL) {
7914 		KFREES(softn->ipf_nat_table[1],
7915 		       softn->ipf_nat_table_sz *
7916 		       sizeof(*softn->ipf_nat_table[1]));
7917 	}
7918 	softn->ipf_nat_table[1] = newtab[1];
7919 
7920 	if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) {
7921 		KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
7922 		       softn->ipf_nat_table_sz * sizeof(u_int));
7923 	}
7924 	softn->ipf_nat_stats.ns_side[0].ns_bucketlen = bucketlens[0];
7925 
7926 	if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) {
7927 		KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
7928 		       softn->ipf_nat_table_sz * sizeof(u_int));
7929 	}
7930 	softn->ipf_nat_stats.ns_side[1].ns_bucketlen = bucketlens[1];
7931 
7932 #ifdef USE_INET6
7933 	if (softn->ipf_nat_stats.ns_side6[0].ns_bucketlen != NULL) {
7934 		KFREES(softn->ipf_nat_stats.ns_side6[0].ns_bucketlen,
7935 		       softn->ipf_nat_table_sz * sizeof(u_int));
7936 	}
7937 	softn->ipf_nat_stats.ns_side6[0].ns_bucketlen = bucketlens[0];
7938 
7939 	if (softn->ipf_nat_stats.ns_side6[1].ns_bucketlen != NULL) {
7940 		KFREES(softn->ipf_nat_stats.ns_side6[1].ns_bucketlen,
7941 		       softn->ipf_nat_table_sz * sizeof(u_int));
7942 	}
7943 	softn->ipf_nat_stats.ns_side6[1].ns_bucketlen = bucketlens[1];
7944 #endif
7945 
7946 	softn->ipf_nat_maxbucket = maxbucket;
7947 	softn->ipf_nat_table_sz = newsize;
7948 	/*
7949 	 * Walk through the entire list of NAT table entries and put them
7950 	 * in the new NAT table, somewhere.  Because we have a new table,
7951 	 * we need to restart the counter of how many chains are in use.
7952 	 */
7953 	softn->ipf_nat_stats.ns_side[0].ns_inuse = 0;
7954 	softn->ipf_nat_stats.ns_side[1].ns_inuse = 0;
7955 #ifdef USE_INET6
7956 	softn->ipf_nat_stats.ns_side6[0].ns_inuse = 0;
7957 	softn->ipf_nat_stats.ns_side6[1].ns_inuse = 0;
7958 #endif
7959 
7960 	for (nat = softn->ipf_nat_instances; nat != NULL; nat = nat->nat_next) {
7961 		nat->nat_hnext[0] = NULL;
7962 		nat->nat_phnext[0] = NULL;
7963 		hv = nat->nat_hv[0] % softn->ipf_nat_table_sz;
7964 
7965 		natp = &softn->ipf_nat_table[0][hv];
7966 		if (*natp) {
7967 			(*natp)->nat_phnext[0] = &nat->nat_hnext[0];
7968 		} else {
7969 			NBUMPSIDE(0, ns_inuse);
7970 		}
7971 		nat->nat_phnext[0] = natp;
7972 		nat->nat_hnext[0] = *natp;
7973 		*natp = nat;
7974 		NBUMPSIDE(0, ns_bucketlen[hv]);
7975 
7976 		nat->nat_hnext[1] = NULL;
7977 		nat->nat_phnext[1] = NULL;
7978 		hv = nat->nat_hv[1] % softn->ipf_nat_table_sz;
7979 
7980 		natp = &softn->ipf_nat_table[1][hv];
7981 		if (*natp) {
7982 			(*natp)->nat_phnext[1] = &nat->nat_hnext[1];
7983 		} else {
7984 			NBUMPSIDE(1, ns_inuse);
7985 		}
7986 		nat->nat_phnext[1] = natp;
7987 		nat->nat_hnext[1] = *natp;
7988 		*natp = nat;
7989 		NBUMPSIDE(1, ns_bucketlen[hv]);
7990 	}
7991 	RWLOCK_EXIT(&softc->ipf_nat);
7992 
7993 	return (0);
7994 
7995 badrehash:
7996 	if (bucketlens[1] != NULL) {
7997 		KFREES(bucketlens[0], newsize * sizeof(u_int));
7998 	}
7999 	if (bucketlens[0] != NULL) {
8000 		KFREES(bucketlens[0], newsize * sizeof(u_int));
8001 	}
8002 	if (newtab[0] != NULL) {
8003 		KFREES(newtab[0], newsize * sizeof(nat_t *));
8004 	}
8005 	if (newtab[1] != NULL) {
8006 		KFREES(newtab[1], newsize * sizeof(nat_t *));
8007 	}
8008 	IPFERROR(error);
8009 	return (ENOMEM);
8010 }
8011 
8012 
8013 /* ------------------------------------------------------------------------ */
8014 /* Function:    ipf_nat_rehash_rules                                        */
8015 /* Returns:     int  - 0 = success, else failure			    */
8016 /* Parameters:  softc(I) - pointer to soft context main structure           */
8017 /*              t(I) - pointer to tunable                                   */
8018 /*              p(I) - pointer to new tuning data                           */
8019 /*                                                                          */
8020 /* All of the NAT rules hang off of a hash table that is searched with a    */
8021 /* hash on address after the netmask is applied.  There is a different table*/
8022 /* for both inbound rules (rdr) and outbound (map.)  The resizing will only */
8023 /* affect one of these two tables.                                          */
8024 /* ------------------------------------------------------------------------ */
8025 int
ipf_nat_rehash_rules(ipf_main_softc_t * softc,ipftuneable_t * t,ipftuneval_t * p)8026 ipf_nat_rehash_rules(ipf_main_softc_t *softc, ipftuneable_t *t,
8027 	ipftuneval_t *p)
8028 {
8029 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8030 	ipnat_t **newtab, *np, ***old, **npp;
8031 	u_int newsize;
8032 	u_int mask;
8033 	u_int hv;
8034 
8035 	newsize = p->ipftu_int;
8036 	/*
8037 	 * In case there is nothing to do...
8038 	 */
8039 	if (newsize == *t->ipft_pint)
8040 		return (0);
8041 
8042 	/*
8043 	 * All inbound rules have the NAT_REDIRECT bit set in in_redir and
8044 	 * all outbound rules have either NAT_MAP or MAT_MAPBLK set.
8045 	 * This if statement allows for some more generic code to be below,
8046 	 * rather than two huge gobs of code that almost do the same thing.
8047 	 */
8048 	if (t->ipft_pint == &softn->ipf_nat_rdrrules_sz) {
8049 		old = &softn->ipf_nat_rdr_rules;
8050 		mask = NAT_REDIRECT;
8051 	} else {
8052 		old = &softn->ipf_nat_map_rules;
8053 		mask = NAT_MAP|NAT_MAPBLK;
8054 	}
8055 
8056 	KMALLOCS(newtab, ipnat_t **, newsize * sizeof(ipnat_t *));
8057 	if (newtab == NULL) {
8058 		IPFERROR(60067);
8059 		return (ENOMEM);
8060 	}
8061 
8062 	bzero((char *)newtab, newsize * sizeof(ipnat_t *));
8063 
8064 	WRITE_ENTER(&softc->ipf_nat);
8065 
8066 	if (*old != NULL) {
8067 		KFREES(*old, *t->ipft_pint * sizeof(ipnat_t **));
8068 	}
8069 	*old = newtab;
8070 	*t->ipft_pint = newsize;
8071 
8072 	for (np = softn->ipf_nat_list; np != NULL; np = np->in_next) {
8073 		if ((np->in_redir & mask) == 0)
8074 			continue;
8075 
8076 		if (np->in_redir & NAT_REDIRECT) {
8077 			np->in_rnext = NULL;
8078 			hv = np->in_hv[0] % newsize;
8079 			for (npp = newtab + hv; *npp != NULL; )
8080 				npp = &(*npp)->in_rnext;
8081 			np->in_prnext = npp;
8082 			*npp = np;
8083 		}
8084 		if (np->in_redir & NAT_MAP) {
8085 			np->in_mnext = NULL;
8086 			hv = np->in_hv[1] % newsize;
8087 			for (npp = newtab + hv; *npp != NULL; )
8088 				npp = &(*npp)->in_mnext;
8089 			np->in_pmnext = npp;
8090 			*npp = np;
8091 		}
8092 
8093 	}
8094 	RWLOCK_EXIT(&softc->ipf_nat);
8095 
8096 	return (0);
8097 }
8098 
8099 
8100 /* ------------------------------------------------------------------------ */
8101 /* Function:    ipf_nat_hostmap_rehash                                      */
8102 /* Returns:     int  - 0 = success, else failure			    */
8103 /* Parameters:  softc(I) - pointer to soft context main structure           */
8104 /*              t(I) - pointer to tunable                                   */
8105 /*              p(I) - pointer to new tuning data                           */
8106 /*                                                                          */
8107 /* Allocate and populate a new hash table that will contain a reference to  */
8108 /* all of the active IP# translations currently in place.                   */
8109 /* ------------------------------------------------------------------------ */
8110 int
ipf_nat_hostmap_rehash(ipf_main_softc_t * softc,ipftuneable_t * t,ipftuneval_t * p)8111 ipf_nat_hostmap_rehash(ipf_main_softc_t *softc, ipftuneable_t *t,
8112 	ipftuneval_t *p)
8113 {
8114 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8115 	hostmap_t *hm, **newtab;
8116 	u_int newsize;
8117 	u_int hv;
8118 
8119 	newsize = p->ipftu_int;
8120 	/*
8121 	 * In case there is nothing to do...
8122 	 */
8123 	if (newsize == *t->ipft_pint)
8124 		return (0);
8125 
8126 	KMALLOCS(newtab, hostmap_t **, newsize * sizeof(hostmap_t *));
8127 	if (newtab == NULL) {
8128 		IPFERROR(60068);
8129 		return (ENOMEM);
8130 	}
8131 
8132 	bzero((char *)newtab, newsize * sizeof(hostmap_t *));
8133 
8134 	WRITE_ENTER(&softc->ipf_nat);
8135 	if (softn->ipf_hm_maptable != NULL) {
8136 		KFREES(softn->ipf_hm_maptable,
8137 		       softn->ipf_nat_hostmap_sz * sizeof(hostmap_t *));
8138 	}
8139 	softn->ipf_hm_maptable = newtab;
8140 	softn->ipf_nat_hostmap_sz = newsize;
8141 
8142 	for (hm = softn->ipf_hm_maplist; hm != NULL; hm = hm->hm_next) {
8143 		hv = hm->hm_hv % softn->ipf_nat_hostmap_sz;
8144 		hm->hm_hnext = softn->ipf_hm_maptable[hv];
8145 		hm->hm_phnext = softn->ipf_hm_maptable + hv;
8146 		if (softn->ipf_hm_maptable[hv] != NULL)
8147 			softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext;
8148 		softn->ipf_hm_maptable[hv] = hm;
8149 	}
8150 	RWLOCK_EXIT(&softc->ipf_nat);
8151 
8152 	return (0);
8153 }
8154 
8155 
8156 /* ------------------------------------------------------------------------ */
8157 /* Function:    ipf_nat_add_tq                                              */
8158 /* Parameters:  softc(I) - pointer to soft context main structure           */
8159 /*                                                                          */
8160 /* ------------------------------------------------------------------------ */
8161 ipftq_t *
ipf_nat_add_tq(ipf_main_softc_t * softc,int ttl)8162 ipf_nat_add_tq(ipf_main_softc_t *softc, int ttl)
8163 {
8164 	ipf_nat_softc_t *softs = softc->ipf_nat_soft;
8165 
8166 	return (ipf_addtimeoutqueue(softc, &softs->ipf_nat_utqe, ttl));
8167 }
8168 
8169 /* ------------------------------------------------------------------------ */
8170 /* Function:    ipf_nat_uncreate                                            */
8171 /* Returns:     Nil                                                         */
8172 /* Parameters:  fin(I) - pointer to packet information                      */
8173 /*                                                                          */
8174 /* This function is used to remove a NAT entry from the NAT table when we   */
8175 /* decide that the create was actually in error. It is thus assumed that    */
8176 /* fin_flx will have both FI_NATED and FI_NATNEW set. Because we're dealing */
8177 /* with the translated packet (not the original), we have to reverse the    */
8178 /* lookup. Although doing the lookup is expensive (relatively speaking), it */
8179 /* is not anticipated that this will be a frequent occurance for normal     */
8180 /* traffic patterns.                                                        */
8181 /* ------------------------------------------------------------------------ */
8182 void
ipf_nat_uncreate(fr_info_t * fin)8183 ipf_nat_uncreate(fr_info_t *fin)
8184 {
8185 	ipf_main_softc_t *softc = fin->fin_main_soft;
8186 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8187 	int nflags;
8188 	nat_t *nat;
8189 
8190 	switch (fin->fin_p)
8191 	{
8192 	case IPPROTO_TCP :
8193 		nflags = IPN_TCP;
8194 		break;
8195 	case IPPROTO_UDP :
8196 		nflags = IPN_UDP;
8197 		break;
8198 	default :
8199 		nflags = 0;
8200 		break;
8201 	}
8202 
8203 	WRITE_ENTER(&softc->ipf_nat);
8204 
8205 	if (fin->fin_out == 0) {
8206 		nat = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p,
8207 					fin->fin_dst, fin->fin_src);
8208 	} else {
8209 		nat = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p,
8210 				       fin->fin_src, fin->fin_dst);
8211 	}
8212 
8213 	if (nat != NULL) {
8214 		NBUMPSIDE(fin->fin_out, ns_uncreate[0]);
8215 		ipf_nat_delete(softc, nat, NL_DESTROY);
8216 	} else {
8217 		NBUMPSIDE(fin->fin_out, ns_uncreate[1]);
8218 	}
8219 
8220 	RWLOCK_EXIT(&softc->ipf_nat);
8221 }
8222 
8223 
8224 /* ------------------------------------------------------------------------ */
8225 /* Function:    ipf_nat_cmp_rules                                           */
8226 /* Returns:     int   - 0 == success, else rules do not match.              */
8227 /* Parameters:  n1(I) - first rule to compare                               */
8228 /*              n2(I) - first rule to compare                               */
8229 /*                                                                          */
8230 /* Compare two rules using pointers to each rule. A straight bcmp will not  */
8231 /* work as some fields (such as in_dst, in_pkts) actually do change once    */
8232 /* the rule has been loaded into the kernel. Whilst this function returns   */
8233 /* various non-zero returns, they're strictly to aid in debugging. Use of   */
8234 /* this function should simply care if the result is zero or not.           */
8235 /* ------------------------------------------------------------------------ */
8236 static int
ipf_nat_cmp_rules(ipnat_t * n1,ipnat_t * n2)8237 ipf_nat_cmp_rules(ipnat_t *n1, ipnat_t *n2)
8238 {
8239 	if (n1->in_size != n2->in_size)
8240 		return (1);
8241 
8242 	if (bcmp((char *)&n1->in_v, (char *)&n2->in_v,
8243 		 offsetof(ipnat_t, in_ndst) - offsetof(ipnat_t, in_v)) != 0)
8244 		return (2);
8245 
8246 	if (bcmp((char *)&n1->in_tuc, (char *)&n2->in_tuc,
8247 		 n1->in_size - offsetof(ipnat_t, in_tuc)) != 0)
8248 		return (3);
8249 	if (n1->in_ndst.na_atype != n2->in_ndst.na_atype)
8250 		return (5);
8251 	if (n1->in_ndst.na_function != n2->in_ndst.na_function)
8252 		return (6);
8253 	if (bcmp((char *)&n1->in_ndst.na_addr, (char *)&n2->in_ndst.na_addr,
8254 		 sizeof(n1->in_ndst.na_addr)))
8255 		return (7);
8256 	if (n1->in_nsrc.na_atype != n2->in_nsrc.na_atype)
8257 		return (8);
8258 	if (n1->in_nsrc.na_function != n2->in_nsrc.na_function)
8259 		return (9);
8260 	if (bcmp((char *)&n1->in_nsrc.na_addr, (char *)&n2->in_nsrc.na_addr,
8261 		 sizeof(n1->in_nsrc.na_addr)))
8262 		return (10);
8263 	if (n1->in_odst.na_atype != n2->in_odst.na_atype)
8264 		return (11);
8265 	if (n1->in_odst.na_function != n2->in_odst.na_function)
8266 		return (12);
8267 	if (bcmp((char *)&n1->in_odst.na_addr, (char *)&n2->in_odst.na_addr,
8268 		 sizeof(n1->in_odst.na_addr)))
8269 		return (13);
8270 	if (n1->in_osrc.na_atype != n2->in_osrc.na_atype)
8271 		return (14);
8272 	if (n1->in_osrc.na_function != n2->in_osrc.na_function)
8273 		return (15);
8274 	if (bcmp((char *)&n1->in_osrc.na_addr, (char *)&n2->in_osrc.na_addr,
8275 		 sizeof(n1->in_osrc.na_addr)))
8276 		return (16);
8277 	return (0);
8278 }
8279 
8280 
8281 /* ------------------------------------------------------------------------ */
8282 /* Function:    ipf_nat_rule_init                                           */
8283 /* Returns:     int   - 0 == success, else rules do not match.              */
8284 /* Parameters:  softc(I) - pointer to soft context main structure           */
8285 /*              softn(I) - pointer to NAT context structure                 */
8286 /*              n(I)     - first rule to compare                            */
8287 /*                                                                          */
8288 /* ------------------------------------------------------------------------ */
8289 static int
ipf_nat_rule_init(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n)8290 ipf_nat_rule_init(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
8291 	ipnat_t *n)
8292 {
8293 	int error = 0;
8294 
8295 	if ((n->in_flags & IPN_SIPRANGE) != 0)
8296 		n->in_nsrcatype = FRI_RANGE;
8297 
8298 	if ((n->in_flags & IPN_DIPRANGE) != 0)
8299 		n->in_ndstatype = FRI_RANGE;
8300 
8301 	if ((n->in_flags & IPN_SPLIT) != 0)
8302 		n->in_ndstatype = FRI_SPLIT;
8303 
8304 	if ((n->in_redir & (NAT_MAP|NAT_REWRITE|NAT_DIVERTUDP)) != 0)
8305 		n->in_spnext = n->in_spmin;
8306 
8307 	if ((n->in_redir & (NAT_REWRITE|NAT_DIVERTUDP)) != 0) {
8308 		n->in_dpnext = n->in_dpmin;
8309 	} else if (n->in_redir == NAT_REDIRECT) {
8310 		n->in_dpnext = n->in_dpmin;
8311 	}
8312 
8313 	n->in_stepnext = 0;
8314 
8315 	switch (n->in_v[0])
8316 	{
8317 	case 4 :
8318 		error = ipf_nat_ruleaddrinit(softc, softn, n);
8319 		if (error != 0)
8320 			return (error);
8321 		break;
8322 #ifdef USE_INET6
8323 	case 6 :
8324 		error = ipf_nat6_ruleaddrinit(softc, softn, n);
8325 		if (error != 0)
8326 			return (error);
8327 		break;
8328 #endif
8329 	default :
8330 		break;
8331 	}
8332 
8333 	if (n->in_redir == (NAT_DIVERTUDP|NAT_MAP)) {
8334 		/*
8335 		 * Prerecord whether or not the destination of the divert
8336 		 * is local or not to the interface the packet is going
8337 		 * to be sent out.
8338 		 */
8339 		n->in_dlocal = ipf_deliverlocal(softc, n->in_v[1],
8340 						n->in_ifps[1], &n->in_ndstip6);
8341 	}
8342 
8343 	return (error);
8344 }
8345 
8346 
8347 /* ------------------------------------------------------------------------ */
8348 /* Function:    ipf_nat_rule_fini                                           */
8349 /* Returns:     int   - 0 == success, else rules do not match.              */
8350 /* Parameters:  softc(I) - pointer to soft context main structure           */
8351 /*              n(I)     - rule to work on                                  */
8352 /*                                                                          */
8353 /* This function is used to release any objects that were referenced during */
8354 /* the rule initialisation. This is useful both when free'ing the rule and  */
8355 /* when handling ioctls that need to initialise these fields but not        */
8356 /* actually use them after the ioctl processing has finished.               */
8357 /* ------------------------------------------------------------------------ */
8358 static void
ipf_nat_rule_fini(ipf_main_softc_t * softc,ipnat_t * n)8359 ipf_nat_rule_fini(ipf_main_softc_t *softc, ipnat_t *n)
8360 {
8361 	if (n->in_odst.na_atype == FRI_LOOKUP && n->in_odst.na_ptr != NULL)
8362 		ipf_lookup_deref(softc, n->in_odst.na_type, n->in_odst.na_ptr);
8363 
8364 	if (n->in_osrc.na_atype == FRI_LOOKUP && n->in_osrc.na_ptr != NULL)
8365 		ipf_lookup_deref(softc, n->in_osrc.na_type, n->in_osrc.na_ptr);
8366 
8367 	if (n->in_ndst.na_atype == FRI_LOOKUP && n->in_ndst.na_ptr != NULL)
8368 		ipf_lookup_deref(softc, n->in_ndst.na_type, n->in_ndst.na_ptr);
8369 
8370 	if (n->in_nsrc.na_atype == FRI_LOOKUP && n->in_nsrc.na_ptr != NULL)
8371 		ipf_lookup_deref(softc, n->in_nsrc.na_type, n->in_nsrc.na_ptr);
8372 
8373 	if (n->in_divmp != NULL)
8374 		FREE_MB_T(n->in_divmp);
8375 }
8376